ATTRIA LLC ("Attria", "we") runs Attria, a service that shows healthcare practices which of their marketing brings in new patients. This policy covers the Attria app, our website at attria.ai, and the ways people reach us, such as sales calls, demos, support and events. It explains what information we handle, how we use it and what choices you have. Where it says patients, it also means the people a practice calls clients. If you don't agree with it, please don't use Attria or our website. Send questions to privacy@attria.ai.
Summary
- What we collect: information practices send through Attria about their patients and callers, information you give us, such as your name and email, and information your browser sends when you visit, such as your IP address.
- Sensitive information: patient information reaches us only for a practice, under its business associate agreement, and we use it only to run Attria for that practice.
- Where it comes from: from you, from your practice, and from the systems your practice connects, such as its practice management system and ad accounts.
- How we use it: to run, secure and improve Attria, to support you, to tell you about Attria, and to meet the law.
- Who gets it: your practice, the vendors that run Attria for us, and others only as this policy describes.
- Keeping it safe: we protect it with care, but no system online can be guaranteed to be completely secure.
- Your rights: depending on where you live, you may have rights to see, correct or delete your information. Email privacy@attria.ai.
Two roles
We handle information in two different roles.
- For healthcare practices, we are a service provider. We handle information about their patients, the people who call or text their tracking numbers, and visitors to their websites, only on the practice's instructions. When that information is protected health information, we are the practice's business associate under HIPAA and bound by a business associate agreement. A practice HIPAA does not cover, such as a veterinary practice, gets the same agreement as a contract. The practice's own privacy notice governs that information, so patients should take questions about it to their practice.
- For people who sign in to Attria, visitors to our website and people who contact us, we decide how the information is used, and this policy applies directly.
What we collect for practices
- Calls to a practice's tracking numbers: the caller's number and caller ID name, call times and length, and recordings unless the practice turns recording off. By default, recording starts when the office answers, and we play nothing on the line. A practice can turn on a "This call may be recorded" notice, which then plays before its office line rings. With the notice on, recording starts before the notice and includes the time spent waiting for an answer, even if the office never answers. We transcribe answered calls' recordings to find details such as whether an appointment was booked or the office's voicemail took the call. Recordings of unanswered calls stay with our phone vendor and are not transcribed.
- Texts to tracking numbers: the sender's number, the message and the time.
- Website visits and forms: when a practice adds our snippet to its website, we record the page a visitor lands on, the ad that sent them, such as UTM tags and ad click ids, and what they submit in a form. We drop card numbers, Social Security and insurance member numbers, file names, and answers to medical-history questions, such as medications, allergies, conditions or past surgeries, with their follow-ups. Anything else a visitor types, such as a message about their visit, is kept as written. The snippet keeps a random visitor id in a cookie named _attria_visitor on the practice's website for 180 days, with _attria_visitor_at holding when it last wrote that id. On Safari and other WebKit browsers it also keeps _attria_cookie_cal, a timestamp, for 30 days, to learn how long the browser keeps its cookies. On an office device the practice marks as its own, it keeps _attria_internal and _attria_internal_at for 400 days, so staff visits are left out. It sets a test cookie, _attria_probe, and deletes it at once to find which domain to use. While a tab is open, it keeps the tab's landing details, a short record of its recent form submits and any form not yet sent in that tab's session storage, which the browser clears when the tab closes; an unsent form is dropped after an hour. We don't store visitors' IP addresses with their visits.
- Practice records: we read patients, appointments, procedures and payments from the practice's management system.
- Ad accounts: with the practice's permission, we read ad spend and campaign results from Google Ads and Meta, and lead details from Google Local Services.
What we collect about you
When you sign in to Attria, visit our website or contact us, we collect:
- What you give us: your name, email address, phone number, job title and practice, and anything you write to us. Your password is held by our sign-in provider, not by us.
- Your account: the practice you belong to and your role there.
- Security records: when you sign in and out, your IP address and browser, and a log entry each time you open patient information.
- What your browser sends: your IP address, browser and device type, operating system, language, the page that sent you, the pages you view and when, and the rough location your IP address points to.
Please keep what you give us accurate, and tell us when it changes.
Cookies and similar tools
- The Attria app uses only the cookies that keep you signed in, which our sign-in provider sets. It carries no analytics or advertising cookies, pixels or tags, because the app shows patient information.
- Our website, attria.ai, may use cookies, pixels and analytics tools to count visits, see which pages help, and show Attria ads to visitors on other websites. These tools see only our website, never the Attria app or patient information. You can block or delete cookies in your browser's settings.
- The snippet a practice adds to its own website sets the cookies described above, for that practice.
How we use it
- To run Attria for each practice: track calls, texts and forms, match them to patients, and report which marketing brought those patients in.
- To create your account, sign you in and keep your account working.
- To keep the service and its data secure, prevent fraud, and find and fix problems.
- To answer support requests and ask for your feedback.
- To send you notices about your account, the service, and changes to our terms and policies.
- To send you news and offers about Attria. You can opt out of these emails at any time.
- To show Attria ads to visitors of our website, and to learn which of our own marketing works.
- To post testimonials people give us.
- To understand how Attria is used, so we can improve it.
- To make pooled, de-identified data from many practices' information, such as how a practice compares with others like it. No practice and no person can be identified from it, and it never includes data from a practice's Google or Meta accounts. We may use it for any purpose.
- To meet our legal duties, and to establish or defend our legal rights.
We don't sell personal information. We never use patient information to market Attria, and we don't use it to train AI models. Pooled, de-identified data is not personal or patient information, so these limits don't cover it. The only patient-related data that reaches an ad platform is the conversion upload a practice can turn on for its own Google or Meta account, described below.
AI
Attria reads the transcripts of answered calls with an AI model run by one of our vendors under its business associate agreement with us, to find details such as whether an appointment was booked. We don't use patient information to train AI models.
Who we share it with
- The practice the information belongs to.
- The vendors that run Attria for us: hosting, the database, phone calls, the connection to practice software, sign-in and email. Each vendor that handles patient information signs a business associate agreement with us before it gets any.
- For information about you and our website visitors only, never patient information: analytics, advertising and retargeting networks, and the sales, marketing and support tools we use.
- We'll share the list of our vendors on request. Each one may use the information only to do its work for us.
- Google and Meta, only when a practice turns on conversion upload. For each lead who booked by phone and whose visit to the practice's website carried a Google or Meta click id, we send that click id and the time of the lead's first call that booked to the practice's own account on that platform. The account can then count the booking and use it to place the practice's ads. We never send a name, phone number, email address or amount.
- Anyone we choose, for pooled, de-identified data only. We make them promise not to try to identify anyone from it.
- Government authorities, when the law requires it.
- A company that buys or invests in our business, or one we are in talks with about it, which must keep the promises in this policy.
We don't sell or share phone numbers or text messages with anyone for their own marketing.
Google user data
When a practice connects its Google Ads account, Attria reads its campaigns, ad spend and Local Services leads. If the practice turns on conversion upload, Attria also sends that account the Google click id and booking call time of each lead who booked, as described above. We use the data we read from Google only to show the practice its own reports. We don't transfer it to anyone except as this policy describes, and we never use it for advertising. People at Attria read it only to give support the practice asks for, to investigate a security problem or to obey the law.
Attria's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Texts from Attria
We may text you about your account or a practice's setup, such as a code to confirm a phone number. How often depends on what you set up. Message and data rates may apply. Reply STOP to stop them, or email privacy@attria.ai.
How long we keep it
- Practice information, including call recordings, stays while the practice is a customer. We delete it within 30 days after the practice leaves, and our backups drop it within another 30 days. Pooled, de-identified data we have already made stays.
- Account information stays while you have access. We delete it with your practice's information, or sooner if you ask. We may keep what we need to prevent fraud, settle a dispute or meet the law.
- Information from website visits and sales contacts stays while we need it for the reasons above, and we delete it when you ask unless the law needs it kept.
- Security logs stay for six years. They record who opened patient information, not the information itself.
How we protect it
We encrypt patient names, phone numbers, email addresses, birth dates and messages one value at a time before storing them. A browser that has not signed in before needs a code we email before it can sign in. Each practice sees only its own data, and we log every time someone opens patient information. We and our vendors store the data in the United States. No system online can be guaranteed to be completely secure, so we can't promise that no one will ever get past these protections.
Your choices and rights
- If you are a patient or a caller, contact the practice you visit. It controls your information and can ask us to correct or delete it.
- If you sign in to Attria or have contacted us, email privacy@attria.ai to see, correct or delete your information. Your practice can also remove your access.
- Every marketing email has a link to stop them.
- Browsers can send a Do Not Track signal, but there is no agreed standard for it, so we don't respond to it.
Depending on where you live in the United States, such as California, Colorado, Connecticut, Utah or Virginia, you may have the right to:
- know whether we process your personal information, and get a copy of it
- correct it or have it deleted
- opt out of targeted advertising, of any sale of it, and of profiling that has legal or similarly significant effects on you
- get the list of the kinds of companies we have shared it with
- not be treated differently for using these rights
These rights cover the information we decide how to use, not patient information, which belongs to the practice. To use them, email privacy@attria.ai. We will confirm your identity first, using the information we already have, and may ask for a little more. Someone you authorize in writing can ask for you. If we turn down your request, you can appeal by replying to our answer, and if we turn down the appeal, you can complain to your state's attorney general. If you live in California, you may also ask once a year which companies, if any, we shared your information with for their own direct marketing.
Children
The Attria app and our website are for businesses, and not for anyone under 18. If we learn that we have information about someone under 18 who used them, we will delete it. A practice may hold records about patients who are children. The practice controls those records, and the patient rules above apply to them.
Changes
We may change this policy by posting a new version here with a new effective date. Each version stays at its own dated link. For a significant change, we may also tell you directly, such as by email.
Contact
ATTRIA LLC, California. privacy@attria.ai