Zoren AI

Privacy Policy

Effective date: Not yet in effect — pending legal review and publication · Last updated: August 7, 2026

This Privacy Policy explains how Zoren Inc., a Delaware corporation, doing business as Zoren AI (“we,” “us,” or “our”), collects, uses, discloses, and protects information in connection with our prior-authorization automation platform and related services (the “Service”). It applies to visitors of our public website and to authorized users of the Service acting on behalf of a healthcare organization, pharmacy, or other business customer (“Customer”). If you are a patient and believe your protected health information was processed through the Service on behalf of a healthcare provider or pharmacy, please also see our HIPAA Notice and contact that provider or pharmacy directly — they, not us, control how your health information is used, as explained in Section 5 below.

1. Introduction & scope

We provide the Service to healthcare organizations and their authorized workforce members on a business-to-business basis. Our Customers — not individual patients — are typically the party who determines what patient-related information is submitted to the Service and for what purpose. Where we process protected health information (“PHI”) on a Customer’s behalf, we do so as their business associate under the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”), pursuant to a Business Associate Agreement (“BAA”) with that Customer. That BAA — not this Privacy Policy — governs our handling of PHI. This Privacy Policy instead describes our practices for the information described in Section 2, including information about our Customers’ authorized users and visitors to our public website.

This is a draft policy pending legal review. Sections, defined terms, and cross-references (including the bracketed placeholders throughout) are not final and must be completed and verified by qualified counsel before publication.

2. Information we collect

We collect information in the following categories:

Account & authentication information — name, work email, organization, role, and credentials you or your organization’s administrator provide to create and manage a user account.
Customer-submitted workflow data — information a Customer or its authorized users enter into the Service to operate prior-authorization, prescription, and related workflows. This may include information about patients (such as demographic details, insurance information, and clinical information relevant to a specific request) that a Customer submits in the course of using the Service. Where this constitutes PHI, it is governed by our BAA with that Customer, not this Privacy Policy.
Usage & device data — log data, IP address, browser and device type, pages viewed, timestamps, and similar diagnostic information collected automatically when you use the Service or visit our website.
Cookies and similar technologies — as described in Section 6.
Communications — information you provide when you contact us for support, sales, or other inquiries.
Integration data — information exchanged with third-party systems a Customer connects to the Service (for example, pharmacy or payer portals, fax and e-fax providers, or CRM systems), to the extent necessary to operate the requested workflow.

3. How we use information

We use the information described above to:

Provide, operate, secure, and maintain the Service;
Authenticate users and enforce access controls and tenant isolation;
Process and route prior-authorization and related workflow requests as directed by a Customer;
Communicate with you about the Service, including security notices and support responses;
Monitor, audit, and improve the reliability, security, and performance of the Service;
Detect, investigate, and prevent fraud, abuse, and security incidents;
Comply with legal obligations, including recordkeeping and audit requirements; and
With appropriate safeguards, develop and improve product features using de-identified or aggregated data that does not identify a specific patient or user, consistent with our BAA obligations.

4. Legal bases for processing

Where applicable law requires a legal basis for processing personal information, we rely on one or more of the following: performance of a contract with our Customer, our legitimate interests in operating and securing the Service, compliance with a legal obligation, and, where required, your or your organization’s consent.

We do not sell personal information. We may share information as follows:

With your Customer organization — administrators and authorized users at the healthcare organization or pharmacy you are affiliated with can access information relevant to their operations within the Service.
Service providers and subprocessors — vendors who process information on our behalf under contractual confidentiality and security obligations (for example, cloud hosting, error monitoring, and transactional email providers). See our Data Policy for our current subprocessor list.
Third-party integrations you direct us to use — pharmacy/payer portals, e-fax providers, CRM systems, and similar destinations a Customer configures, solely to carry out the requested workflow.
Legal and safety reasons — where required to comply with law, respond to lawful requests from public authorities, enforce our agreements, or protect the rights, property, or safety of Zoren AI, our Customers, or others.
Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections and, where required, notice to affected Customers.

6. Cookies & tracking technologies

We use strictly necessary cookies to operate authentication and session management. We may use additional cookies or similar technologies for analytics and product improvement, in which case we will describe them here and provide any consent or preference controls required by applicable law. [Placeholder — finalize cookie categories, retention periods, and consent-banner behavior with counsel and engineering before publishing.]

7. Data security

We maintain administrative, technical, and physical safeguards designed to protect information against unauthorized access, disclosure, alteration, and destruction, including encryption of data in transit and at rest, role-based access controls, audit logging, and periodic security review. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. See our Data Policy for additional detail.

8. Data retention

We retain information for as long as reasonably necessary to provide the Service, comply with legal and contractual obligations (including HIPAA recordkeeping requirements under our BAAs), resolve disputes, and enforce our agreements. Retention periods for specific data categories are set out in our Data Policy and in applicable Customer agreements.

9. Your privacy rights

Depending on your location and role, you may have rights to access, correct, delete, or receive a copy of certain personal information we hold about you, and to object to or restrict certain processing. Because much of the information in the Service is submitted and controlled by our Customers in their role as data controller (or, for PHI, as HIPAA covered entity), we will direct requests concerning that information to the relevant Customer where required by our contractual and legal obligations, and will assist that Customer in responding as required by our agreements. For information we control directly (such as your account registration details), you may submit a request using the contact information in Section 15.

We do not sell personal information for money, and we do not “share” personal information for cross-context behavioral advertising as those terms are defined under applicable state privacy laws. [Placeholder — confirm final language against the specific US state privacy laws applicable to your user base (e.g., CCPA/CPRA, VCDPA, CPA, CTDPA) before publishing.]

11. Children's privacy

The Service is intended for use by adult professionals acting on behalf of a healthcare organization or pharmacy Customer. It is not directed to children, and we do not knowingly collect personal information directly from children through the public website.

12. International data transfers

We are based in the United States and primarily serve US-based healthcare organizations. If we process information transferred from outside the United States, we take steps intended to provide an adequate level of protection consistent with applicable law. [Placeholder — confirm whether this section is needed based on actual Customer geography.]

13. Third-party links and services

The Service may link to or integrate with third-party websites and services that we do not control, including pharmacy and payer portals. Those third parties have their own privacy practices, and we encourage you to review their policies. We are not responsible for the content or privacy practices of third-party sites or services.

14. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the “Last updated” date above and, where required by law or contract, provide additional notice. Continued use of the Service after an update constitutes acceptance of the revised policy to the extent permitted by law.

15. Contact us

If you have questions about this Privacy Policy, contact us at info@zoren.ai or at Zoren Inc., Wilmington, Delaware [street address — placeholder, confirm with your registered agent].