1. Scope — and what this policy is not

This policy explains how Alara Healthcare Consulting LLC, doing business as Alara Healthcare (“Alara Healthcare,” “we,” “us,” “our”), handles information collected through alarahealth.net (the “Site”).

Read this part carefully, because it is the part people get wrong.

This policy does not cover protected health information. Alara Healthcare is a management services organization. It is not a healthcare provider and not a HIPAA covered entity. Where we handle protected health information on behalf of a client practice, we do so as a business associate, strictly under a written business associate agreement and under that practice’s own privacy notice — not under this policy. If you are a patient looking for how your medical information is handled, ask your practice for its Notice of Privacy Practices; this Site is not the place for it.

This policy does not cover our clients’ own practices. It covers this website, our marketing, and our business relationships. And it does not cover any third-party website you reach from a link here.

The Alara Population Health application at pophealth.alarahealth.net and the customer documentation site are provided under a written subscription agreement and business associate agreement with each customer. Those agreements, not these Terms or the Privacy Policy, govern them.

2. What we collect

2.1 Information you give us. When you submit the contact form we collect your organization name, your name and title, e-mail address, and telephone number, and optionally the number of providers, approximate attributed lives, your current EMR, the payers or contracts you name, the interests you select, and whatever you type in the message field. We also record whether you checked the SMS opt-in box and whether you accepted the Terms of Use, the exact consent text shown to you, and the date and time.

2.2 Information we collect automatically. When you use the Site we receive standard technical information from your browser: IP address, browser type and version, operating system, device type, referring page, the pages you view, and the dates and times of your visit.

Two specific uses of your IP address you should know about, because they are more than ordinary server logging:

We store your IP address with your form submission. We keep it in the same record as the rest of your inquiry, and use it to detect and block automated and abusive submissions — including by limiting how many submissions we accept from one address in an hour.
We use your IP address to determine your approximate country and, in some cases, to block form submissions. We do this to protect the Site and to comply with United States sanctions and export laws. This check runs automatically when you open the contact form.

2.3 Cookies and similar technologies. We do not use advertising cookies, tracking pixels, session-replay tools, or third-party marketing tags on this Site. We measure how the Site is used with Vercel Web Analytics, a cookie-free service served from our own domain by our hosting provider. It counts page views and clicks in aggregate, sets no cookies, uses no advertising identifiers, and does not follow you across other websites, and we cannot identify you from it. Because we set no non-essential cookies, there is nothing here for you to consent to or opt out of, and you will not see a cookie banner. Typefaces and every other asset are served from our own site.

If this changes, this section changes with it. We will update it — and, where the law requires it, obtain your consent — before any analytics, advertising, or session-recording technology is added to the Site.

2.4 Do Not Track. Browsers send a “Do Not Track” signal that has no agreed meaning. We do not track you across other websites, so there is nothing for the signal to switch off, and we do not respond to it.

2.5 What we do not collect here. We do not collect protected health information through this Site, and we ask you not to send it — see section 3. We do not knowingly collect information from children; see section 10. We do not collect payment card details through this Site. We do not buy personal information from data brokers.

3. Do not send protected health information through this Site

This Site is a public website. It is not a patient portal, not a secure clinical channel, and not covered by a business associate agreement.

Do not submit protected health information — patient names or identifiers, medical records, images, claims files, member rosters, or any other individually identifiable health information — through any form, e-mail address, or telephone number published here.

If your inquiry needs data of that kind, tell us and we will set up a secure, contracted channel first. If you send it anyway, we may delete it without reading it, and we will treat it as confidential while it is in our hands but cannot apply HIPAA’s protections to a channel that was never built for it.

4. Why we use your information, and on what basis

Purpose	What we use
Responding to your inquiry and discussing a possible engagement	Contact and practice details, message content
Sending you text messages you asked for	Mobile number, opt-in record, message logs
Sending you information about our services	Contact details
Preventing spam, fraud, and abuse of the Site	IP address, submission timing, technical data
Enforcing geographic access restrictions and complying with sanctions law	IP address, derived country
Keeping the Site secure, reliable, and working	Technical and log data
Understanding how the Site is used	Aggregate, cookie-free analytics: page views, clicks, referring site, device type
Meeting our legal, tax, and recordkeeping obligations, and establishing or defending legal claims	Whatever the obligation or claim requires

We use your information for the purpose you gave it to us for and the purposes above, and not for unrelated purposes without telling you.

5. Automated decision-making

The country check described in section 2.2 is automated, and it can block your form submission without a person reviewing it. It uses only your IP address and produces only one outcome: the form is available or it is not. It has no other consequence, and it makes no assessment of you. If you believe you were blocked in error, write to us at info@alarahealth.net and a person will review it.

6. When we share information — and when we never do

We do not sell your personal information. We have never sold it. We do not share it for cross-context behavioral advertising, and we do not rent, trade, or licence our contact lists.

We disclose personal information only:

To service providers who operate the Site and our business on our behalf — website and database hosting, e-mail, messaging, and professional advisors — each under a contract limiting them to our instructions;
To professional advisors (attorneys, accountants, insurers) where they need it to advise us;
When the law requires it — in response to a subpoena, court order, or lawful government request, or to comply with a legal obligation;
To protect rights and safety — where we reasonably believe disclosure is necessary to investigate suspected fraud or a security incident, to enforce our Terms of Use, or to protect the rights, property, or safety of any person; and
In a business transaction — a merger, acquisition, financing, reorganization, or sale of assets, under confidentiality obligations, with notice to you if the change would materially affect how your information is handled.

Protected health information is different. Where we hold it as a business associate, we use and disclose it only as the applicable business associate agreement and HIPAA permit — never under this section.

7. Where your information is held

We keep information in the United States. Our website and database infrastructure is operated by third-party providers within the United States. If that changes we will update this section.

8. How long we keep it

We keep personal information only as long as we need it for the purposes in section 4, and then delete or de-identify it. In practice:

Category	How long
Inquiries that do not become engagements	3 years from the last contact, then deleted
Records for clients	For the engagement and 7 years after it ends, for tax, insurance, and limitations purposes
SMS consent and opt-out records	5 years after opt-out — we are required to be able to prove consent and honored opt-outs
Security and abuse-prevention logs, including IP addresses	12 months, unless retained longer for a specific investigation
Anything under legal hold	Until the hold is released, whatever the schedule above says

9. Security, and what happens if something goes wrong

We maintain administrative, technical, and physical safeguards designed to protect personal information — including multi-factor authentication on our systems, encryption in transit and at rest, access limited to those who need it, and a written security program with a designated Security Official.

No safeguard is perfect, and we do not promise that our systems cannot be breached. Information you send us over the internet travels at your own risk until it reaches us.

If a breach of security compromises your personal information, we will notify you and the Florida Department of Legal Affairs as the Florida Information Protection Act, section 501.171, Florida Statutes, requires — as expeditiously as practicable and, absent a law-enforcement delay, no later than 30 days after we determine a breach occurred. Where we hold protected health information as a business associate, we report to the affected covered entity on the timeline in our agreement with it, and HIPAA’s breach-notification rules apply.

10. Children

The Site is directed to healthcare professionals and businesses, not to children. We do not knowingly collect personal information from anyone under 18, and never from a child under 13. If you believe a child has given us information, write to privacy@alarahealth.net and we will delete it.

11. Your choices and your rights

Everyone, whatever state you live in, can:

Stop text messages — reply STOP to any message, or ask us.
Stop marketing e-mail — use the unsubscribe link, or ask us. We will still send messages needed to administer an existing relationship.
Ask what we hold about you, ask us to correct it, or ask us to delete it — write to privacy@alarahealth.net. We will respond within 45 days, and will tell you if we need longer. We may need to verify your identity, and we may keep information the law requires us to keep.
Manage your browser — you can block or delete cookies and local storage in your browser settings. Because we set no non-essential cookies, this will not change what we collect.

A note on the Florida Digital Bill of Rights. Florida’s comprehensive privacy law, sections 501.701–501.722, Florida Statutes, applies only to businesses with over $1 billion in global gross revenue that also meet one of several technology-platform tests. Alara Healthcare does not meet those thresholds, so the statutory rights it creates do not apply to us. We are telling you this rather than staying quiet about it, and we offer the access, correction, and deletion rights above as a matter of policy regardless.

If you live in a state whose privacy law does give you statutory rights against us, we will honor them. Tell us which state you are writing from.

12. Changes to this policy

We may update this policy. We will post the revised version with a new effective date, and for a material change we will give notice — by a notice on the Site or by e-mail where we have your address — at least 30 days before the change takes effect, unless a shorter period is required by law or by a security need. Your continued use of the Site after that is acceptance of the change.

13. How to reach us

Questions, requests, and complaints about privacy:

Alara Healthcare Consulting LLC — Attn: Privacy Official · Florida, United States

E-mail: privacy@alarahealth.net · Telephone: +1 (786) 659-1661

If you are not satisfied with our response, you may contact the Florida Attorney General’s Office of Citizen Services or the Federal Trade Commission at reportfraud.ftc.gov.