1. Overview
Oira (“Oira”, “we”, “us”) provides an AI clinical documentation agent for healthcare professionals. This Privacy Policy explains how we handle information when you use our website and platform. Protected Health Information (PHI) processed on behalf of healthcare providers is governed by our Business Associate Agreement and the safeguards described in our HIPAA & Security page.
2. Information We Collect
- Account information: name, work email, professional license details, and organization.
- Content you process: audio from clinical encounters, transcripts, and drafted notes, processed solely to produce your documentation.
- Usage data: log data, device information, and product analytics used to keep the service reliable.
- Support communications: messages you send us when requesting help.
3. How We Use Information
- To provide, operate, and improve the documentation service.
- To generate drafts, coding suggestions, and summaries you review and approve.
- To authenticate users, prevent abuse, and meet legal obligations.
We do not sell your data. We do not use PHI or encounter audio to train machine-learning models.
4. Sharing & Subprocessors
We share data only with vetted subprocessors that help us deliver the service (e.g., cloud hosting, speech processing), each bound by confidentiality and security obligations. We may disclose information if required by law, with notice whenever legally permitted.
5. Retention & Deletion
Encounter audio is processed to generate your draft and then deleted according to your workspace settings. Notes remain available until you delete them. You can request deletion of your account and associated data at any time by contacting us.
6. Your Rights
- Access, correct, or export your personal information.
- Request deletion of your account and data.
- Withdraw consent where processing is based on consent.
7. Costa Rica & International Users
Oira is designed for healthcare professionals in Costa Rica and beyond. For users in Costa Rica, we process personal data in accordance with Ley 8968 sobre la Protección de los Datos Personales ante el Habeas Data and applicable health-sector regulations. For users in other jurisdictions, equivalent protections apply under local law such as GDPR.