AURA BIOLOGICS

Privacy Policy

Effective: the date this version is published on the AURA portal

1. Who we are

Aura Biologics LLC operates a platform that collects patient information, routes it to licensed physicians for review, and coordinates scheduling, billing, product ordering and delivery.

AURA’s handling of health information is subject to the Health Insurance Portability and Accountability Act (“HIPAA”), both in AURA’s own right and in its capacity as a business associate of the physicians who treat patients through the platform. Where HIPAA applies, AURA’s Notice of Privacy Practices governs and this policy supplements it.

2. What we collect

• Information you give us. Your name, date of birth, contact details, address, and the answers you give in the intake form.
• Health information. Information about your health and medical history that you provide, and medical records you authorise us to obtain from another provider.
• Documents you upload. Including imaging, laboratory results and records.
• Payment information. Processed by our payment provider. AURA does not store full card numbers.
• Account and device information. Sign-in records, and technical information your browser or device sends when you use the platform.

3. Why we collect it

To route your case to a physician, to let that physician assess it, to coordinate treatment, billing and delivery, to keep the records the law requires us to keep, to secure the platform, and to communicate with you about your case.

4. Who we share it with

• The physician reviewing or treating your case, and their clinic.
• Service providers under written agreement, including hosting, email delivery, payment processing and document signature. Where those providers handle protected health information, they do so under a business associate agreement.
• Where required by law, or to protect someone’s safety.

We do not sell your personal information. We do not share your health information for advertising.

5. How long we keep it

Deleting your account is not the same as deleting your medical record, and we cannot delete a medical record on request.

• Medical records are retained for a minimum of seven years, as required by law for adult patients. Where another law requires longer, the longer period applies.
• Account information not forming part of a medical record is deleted within 30 days of your request.
• Billing records are retained as required by tax and financial record-keeping law.

When you ask us to delete your account, we tell you what has been deleted and what has been retained.

6. Your rights

Depending on where you live, you may have the right to access the personal information we hold about you, to correct it, to ask us to delete it, to receive a copy in a portable form, and to appeal a decision we make about such a request. Whether a state privacy law gives you these rights also depends on whether that law applies to the information concerned.

Separately, HIPAA gives you rights in your protected health information, including access, amendment and an accounting of disclosures. Those rights are described in our Notice of Privacy Practices.

To exercise any of these rights, contact us using the details in section 11.

7. How to delete your account

You can request deletion from within the application, or by contacting us. We will confirm what has been deleted and what has been retained under section 5, and the period for which the retained information will be held.

8. Security

We protect information using encryption in transit and at rest, role-based access limited to staff who need it, audit logging of access to patient information, and multi-factor authentication for staff accounts. Patient documents are held in private storage that is not publicly reachable.

No system is completely secure, and we do not claim otherwise. If a breach affecting your information occurs, we will notify you as the law requires.

9. Children

The platform is not intended for use by people under 18, and we do not knowingly collect information from a person under 18 other than where a parent or legal guardian provides it on a patient’s behalf.

10. Changes

We may change this policy. The effective date above shows when it last changed. Where a change is material, we will tell you.

11. Contact

Aura Biologics LLC

Address: 3245 Main St., Suite 235-340, Frisco, TX 75034

General enquiries: info@aurabiologics.com

Privacy requests: support@aurabiologics.com