1. Introduction
This Privacy Policy (“Policy”) describes the types of information CerboOM, LLC and its affiliates (collectively, “CerboOM,” “we,” “us,” or “our”) may collect from you or that you may provide when you use our websites (including cer.bo and optimantra.com), the CerboOM EHR platform, Patient Portal, mobile applications, APIs, and all other interactive features, tools, and communications provided by CerboOM, however accessed and/or used (collectively, the “Services”). References to “Cerbo” or “OptiMantra” in this Policy refer to the applicable product or service offered by CerboOM. This Policy also describes our practices for collecting, using, maintaining, protecting, and disclosing that information. Please read this Policy and our posted Master Subscription Agreement and End User License Agreement (together with this Policy, the “Terms”) before you use our Services. By using the Services, you represent and warrant that you agree with this Policy. If you do not agree to all of our Terms, or if you violate them in any way, you may not access or use the Services.
Note: This Policy addresses Personal Information collected through our website and marketing-facing Services. To the extent you are a healthcare provider or clinic using the CerboOM EHR platform, the processing of Protected Health Information (“PHI”) is governed by the Business Associate Agreement and the HIPAA Rules, not this Policy.
2. Privacy Notice Changes
We may update this Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes, we will revise the “Last Updated” date at the top of this Policy and post the updated version on our website. We encourage you to review this Policy periodically to stay informed about how we are protecting your information. Your continued use of our Services after any changes to this Policy constitutes your acceptance of the updated Policy.
3. What Is Personal Information?
This Policy applies to Personal Information collected or used by CerboOM in connection with the Services. “Personal Information” generally means any information that enables us to identify you, directly or indirectly, by reference to an identifier such as your name, identification number, location data, online identifier, or one or more factors specific to you. Personal Information does not include anonymous information or information that has had the identity of an individual permanently removed.
We may collect the following categories of Personal Information:
• Contact Information: Name, postal address, unique personal identifier, telephone number, online identifier, internet protocol address, email address, company or practice name, professional title, and other similar identifiers.
• Account and Subscription Information: Login credentials, account preferences, subscription plan, Order Form details, billing and payment information (e.g., credit card or bank account information), and transaction history.
• Internet and Network Activity Information: Browsing history, search history, information regarding your interaction with the Services, advertisements, IP address, domain name, referring URL, pages and content viewed, page response times, download errors, and methods used to browse to or away from the Services.
• Device Information: Operating system, hardware and software versions, browser type, device identifiers, device IDs, mobile operator or ISP, language, time zone, and network connection speed.
• Inferences: Additional information reflecting your preferences, characteristics, and usage patterns derived from the foregoing categories.
4. How We Collect Personal Information
(a) Directly From You. We receive your Personal Information when you create an account, subscribe to the Services, request a demo or call with our team, sign up for our newsletter, submit forms or questionnaires, use the Patient Portal, communicate with us via email, phone, or in-app messaging, or otherwise use our Services.
(b) From Your Employer or Organization. We may receive your Personal Information from the healthcare practice, clinic, or other organization that has contracted with CerboOM, such as when an administrator creates your User account or adds you to the Services.
(c) From Third Party Sources. We may collect or receive information about you from other sources, such as service providers that support our business, integrated third-party applications (e.g., labs, pharmacies, payment processors, e-prescribing networks), and publicly available sources of information.
(d) Through Automated Means. When you use the Services, we receive certain technical information about your use of the Services that may be associated with your Personal Information. We automatically collect information from and about the computers, mobile devices, and other web-connected devices that you use in connection with the Services, and we may combine this information across the different devices you use.
5. How We Use Personal Information
We use Personal Information to operate, evaluate, and improve our Services, including for the following purposes:
• To perform our obligations arising from your account registration, subscription, Order Form, and any other agreement entered into between you (or your organization) and us;
• To provide you with the Services, including the EHR platform, Patient Portal, e-prescribing, lab integrations, billing, scheduling, and other features;
• To manage your account, subscriptions, and platform preferences;
• To respond to your questions and provide related customer support;
• To monitor, analyze, and improve the performance, security, and functionality of the Services;
• To communicate with you, including administrative messages, service updates, promotional communications, and other information we believe may be of interest to you;
• To prevent and detect fraud, abuse, security incidents, and other harmful activity;
• For our business purposes, such as data analysis, audits, developing new products and features, enhancing the Services, identifying usage trends, and determining the effectiveness of our promotional campaigns;
• To comply with applicable laws, legal processes, industry standards, our policies, and our contractual obligations; and
• For any other purpose specified at the point of collection or as described in your express authorization.
6. How We Share Your Information
(a) Service Providers. We share your Personal Information with vendors and service providers who assist us with providing, operating, and improving the Services (“Service Providers”). These companies are authorized to use your Personal Information only as necessary to provide services to us and are contractually obligated to maintain the confidentiality and security of your information.
(e) Business Transfers. In the event that CerboOM is involved in a merger, acquisition, financing, reorganization, bankruptcy, receivership, dissolution, sale of all or a portion of our assets, or transition of a service to another provider, your Personal Information may be transferred as part of such a transaction, as permitted by law and/or contract. In such event, CerboOM will endeavor to direct the transferee to use Personal Information in a manner that is consistent with this Policy.
7. Cookies, Tracking Technologies, and Behavioral Advertising
(a) Cookies and Tracking Technologies. We and Our partners, affiliates, and Service Providers may use cookies or other tracking technologies such as pixel tags and web beacons. These are used in storing content information and preferences, analyzing trends, administering and maintaining Our Website, monitoring Your interaction with the Website, and to gather demographic information about You. We may receive reports based on the use of these technologies by these companies on an individual as well as aggregated basis. We use cookies to remember Your settings for authentication. You can control the use of cookies at the individual browser level. If You reject cookies, You may still access and use the Website, but Your ability to use some features will be fundamentally diminished. These technologies help Us better understand Your behavior, tell Us which parts of Our Website have been visited, and facilitate and measure the effectiveness of advertisements and web searches. We treat information collected by cookies and other technologies as nonpersonal information. However, to the extent that Internet Protocol Addresses or similar identifiers are considered Personal Information by local law, We accordingly treat these identifiers as Personal Information.
(b) Behavioral Advertising. We may participate in third-party behavioral advertising. This means that a third party may use technology to collect information about Your use of Our Website so that other parties can provide advertising about products and services tailored to Your interests. If You do not want third parties to collect and use Your information in this manner, You may opt out at the Digital Advertising Alliance in the United States, the Digital Advertising Alliance of Canada in Canada, or the European Digital Advertising Alliance in Europe.
8. International Users
(a) United Kingdom (“U.K.”), Switzerland, and European Union Residents. Personal data You provide directly to Us through Our Website is processed in the United States. Data protection laws in the United States are likely different from those of Your home country. We are a controller with respect to the processing of Your personal data. When You submit Your personal data to Us, You acknowledge that Your personal data will be processed in the United States in accordance with this Privacy Policy. If We transfer personal data from the European Economic Area, Switzerland, or the United Kingdom, or as part of an onward transfer to one of Our Service Providers, We will transfer the personal data to parties that provide appropriate safeguards for Your personal data using an approved and valid personal data transfer mechanism, such as the European Union’s Standard Contractual Clauses or the United Kingdom’s International Data Transfer Agreement. If You want more information about how We transfer personal data, You may contact Us using the information provided at the end of this Privacy Notice. Pursuant to the applicable data protection legislation, You have the following data subject rights:
• (i) the right to access the personal data that We maintain about You;
• (ii) the right to require Us to correct Your personal data;
• (iii) the right to the erasure of Your personal data;
• (iv) the right to request that We stop processing Your personal data;
• (v) the right to not provide or to withdraw Your consent at any time;
• (vi) the right to suspend the processing of Your personal data;
• (vii) the right to transfer Your personal data to Yourself or to a third party;
• (viii) the right to not be subject to decisions based solely on automated decision making.
To exercise Your rights, please contact Us using the information located in the Contacting Us section below. We will respond to Your request as soon as possible but certainly within 30 days.
9. Your Privacy Rights
(a) Notice for Residents of Certain U.S. States. In addition to the privacy rights described above, if you are a resident of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have a right to submit certain specific requests regarding your Personal Information. You may request a copy of the categories and specific pieces of Personal Information we collected about you, the sources from which it was collected, the business or commercial purpose for collecting it, and the categories of third parties with whom we shared it. You may request that we correct your Personal Information if it is inaccurate or delete your Personal Information, subject to certain legal exceptions. You may not be discriminated against because you exercise any of your privacy rights. We endeavor to respond to state privacy requests within the timeframes required by applicable law.
(b) Do Not Track / Global Privacy Control. Do Not Track (DNT) is a privacy preference you can set in most browsers, but there is no standard interpretation or practice for responding to DNT signals. CerboOM handles all user information consistent with this Policy. We do endeavor to process Global Privacy Control (“GPC”) signals from web browsers by automatically opting out website visitors from third-party targeting cookies, although GPC technology is not fully developed and is not yet supported by all browsers.
(c) Additional Notice for California Residents. CerboOM does not sell or share your Personal Information as those terms are defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (Cal. Civ. Code § 1798.100 et seq.). If you are a California resident and would like to exercise any of the rights described above, or if you would like to designate an authorized agent to make a request on your behalf, please contact us as directed below.
(d) Notice for Nevada Residents. We do not sell Personal Information as defined by Nevada law (Nevada Revised Statutes, Chapter 603A). You can submit a request to us regarding the sale of such information via the contact information below.
10. Children Under the Age of 13
Our Services are not intended for children under 13 years of age. We do not knowingly collect or maintain Personal Information from individuals under the age of 13. If we learn that Personal Information of an individual less than 13 years of age has been collected on or through our Services, we will take appropriate steps to delete this information. If you are a parent or guardian and discover that your child has provided us with Personal Information, please contact us as directed below to request that we delete the information from our systems.
11. Information Security and Confidentiality
We maintain reasonable security safeguards designed to protect Personal Information in our possession and control from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. However, no method of transmission over the Internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security. We employ (and require our Service Providers to maintain) industry-standard organizational, administrative, physical, and technological measures designed to protect your Personal Information during processing. You are ultimately responsible for the security of your login credentials and should not share them with others. We will make any legally required disclosures in the event of any compromise of Personal Information. To the extent the law allows us to provide such notification via email or conspicuous posting on the Services, you agree to accept notice in that form.
We apply a general rule of keeping Personal Information only for as long as required to fulfill the purposes for which it was collected, including to provide you with our Services, to maintain active accounts, and as reasonably necessary for legal, tax, and accounting requirements, or if required to do so by a legal process or governmental authority.
12. Third-Party Links
Our Services may contain links to other websites or platforms, including third-party lab portals, payment processors, pharmacy networks, and other integrated services. We are not responsible for the privacy practices of such other sites. We encourage you to read the privacy policy of each website you visit. This Policy applies only to information collected by CerboOM through its Services.
13. Contacting Us
If you have any questions, concerns, or complaints about this Policy, our privacy practices, or if you have any requests regarding your Personal Information, please contact us by email at: support@cer.bo (for Cerbo products) or support@optimantrainc.zendesk.com (for OptiMantra products); or by mail to: CerboOM, LLC, 501 Union Street, Suite 545, PMB 41842, Nashville, TN 37219, ATTN: Privacy.
