Aether Privacy Policy
Website, Products, and Services
1. Scope of this Policy
1.1 Covered services. This Privacy Policy explains how Aether Clinical Solutions LLC ("Aether," "we," "us," or "our") collects, uses, discloses, and protects personal information when you visit aethercs.com or another Aether-controlled public website; request information, a demonstration, or support; communicate or do business with us; or receive and use an individual account for an Aether product or service (the "Platform").
1.2 PHI processed for healthcare clients. This Policy is not a HIPAA Notice of Privacy Practices and does not replace a hospice's or other healthcare provider's notice. When Aether processes Protected Health Information ("PHI") for a healthcare client, Aether acts on that client's behalf under the applicable Client Agreement, Business Associate Agreement ("BAA"), the client's instructions, and applicable law. Those arrangements—not this Policy—control Aether's use and disclosure of PHI. Patients should direct requests concerning their health records or HIPAA rights to the hospice or other provider responsible for the records.
1.3 Client administration. If you use an Aether product or service through your employer or another organization, that organization controls your access, role, and use of information in its account. Its privacy and employment policies may also apply to you.
2. Personal information we collect
2.1 Information you provide. We may collect your name, business email address, telephone number, organization, job title, professional role, licensing or credential information relevant to your account or service role, account registration information, preferences, and the contents of business, sales, support, or other communications you send to us. If you are a billing or contracting contact, we may also collect business and transaction information needed to administer the relationship.
2.2 Website and device information. When you use our public website, we may automatically collect IP address, browser type, device type, operating system, referring page, pages viewed, links selected, timestamps, approximate location derived from IP address, and cookie or similar identifiers. We ask you not to submit PHI through public website forms or ordinary email.
2.3 Platform account and activity information. When you use an Aether product or service, we may collect account and authentication identifiers, assigned organization and role, login and multi-factor-authentication events, session information, IP address, device and browser information, and activity associated with the account, such as uploads, views, analyses, edits, acknowledgments, approvals, exports, and administrative changes. The contents of Client patient records and clinical workflows are handled as described in Section 1.2.
2.4 Information from Clients and service providers. We may receive account, role, contact, security, and support information from the Client that authorizes your access, from an identity or authentication provider, or from other vendors that help us operate the website, products, and services.
3. How we use personal information
We use personal information to:
- Provide, administer, personalize, maintain, and support the website, products, services, customer accounts, and Client relationships.
- Authenticate users, assign and enforce roles, prevent unauthorized access, protect PHI, detect fraud or abuse, and investigate security or support issues.
- Process requests for information, demonstrations, onboarding, support, billing, and other business communications.
- Operate, test, analyze, troubleshoot, and improve the reliability, usability, performance, safety, and security of our services.
- Send administrative notices and, where permitted, relevant product or business communications. You may opt out of marketing emails at any time.
- Comply with law, contractual obligations, audits, legal process, and requests from authorized regulators or authorities; establish or defend legal rights; and protect Aether, Clients, users, patients, and others.
- Create and use aggregated or de-identified information only as permitted by applicable law and the relevant Client Agreement and BAA.
4. How we disclose personal information
4.1 Service providers. We may disclose personal information to vendors and subprocessors that provide hosting, infrastructure, identity and authentication, security, monitoring, analytics, communications, customer support, professional, and other operational services. They may use the information only to perform services for Aether and are subject to contractual or legal obligations appropriate to their role. A vendor that handles PHI must be addressed through the applicable HIPAA and BAA framework.
4.2 Your organization. We may disclose account details and activity information to the Client and its authorized administrators for account administration, security, compliance, support, audit, and workforce-management purposes.
4.3 Legal, safety, and rights protection. We may disclose information if we reasonably believe disclosure is required by law or legal process or is appropriate to investigate or prevent fraud, abuse, a security incident, threats to safety, or violations of applicable agreements; respond to regulators or lawful authorities; or establish, exercise, or defend legal rights.
4.4 Business transactions. We may disclose information in connection with a financing, merger, acquisition, reorganization, bankruptcy, sale of assets, due diligence process, or similar transaction, subject to appropriate confidentiality and legal protections.
4.5 At your direction or with consent. We may disclose information when you or the Client directs us to do so, when you consent, or as otherwise described when the information is collected.
4.6 Aggregated or de-identified information. We may disclose aggregated or de-identified information that does not reasonably identify an individual, but only as permitted by applicable law and, where the source includes Client data or PHI, the relevant Client Agreement and BAA. We do not attempt to re-identify information that we maintain as de-identified except as permitted by law to test or validate de-identification.
5. No sale of personal information or targeted advertising
Aether does not sell personal information for money. Aether does not share personal information for cross-context behavioral advertising and does not use PHI for advertising or marketing. If our practices change, we will update this Policy and provide any choices required by law before the change takes effect.
7. Data retention
We retain personal information for as long as reasonably necessary to provide the services, maintain the Client relationship, secure and audit accounts, comply with legal and contractual obligations, resolve disputes, and enforce agreements. Retention periods vary based on the type and sensitivity of the information, the purpose for which it was collected, Client instructions, applicable law, and legitimate security or recordkeeping needs. PHI retention, return, and deletion are governed by the applicable Client Agreement and BAA. Backups and security records may persist for a limited period after deletion from active systems.
8. Security
We use administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration, and destruction. Safeguards are selected in light of the information and the service involved. No system, transmission, or storage method is completely secure, and we cannot guarantee absolute security. If you believe an account or information may have been compromised, contact us promptly at trust@aethercs.com without including PHI in email.
9. Your choices and privacy rights
9.1 Account information. You may update certain account information through the Platform or by contacting your Client administrator or Aether. The Client may control which account fields you can change.
9.2 Communications. You may opt out of marketing emails by using the unsubscribe link or contacting us. You will continue to receive service, security, legal, and other non-marketing communications when necessary.
9.3 Privacy rights. Depending on where you live and subject to applicable exceptions, you may have rights to request access to, correction of, deletion of, or a portable copy of certain personal information; to learn about categories of information collected or disclosed; to appeal a denied request; or to opt out of certain uses or disclosures. Aether does not sell personal information or share it for cross-context behavioral advertising.
9.4 Exercising a right. Send a request to trust@aethercs.com or by mail to the address in Section 14. We may verify your identity and authority before acting. An authorized agent may submit a request where permitted by law, but we may require proof of authorization. We will not discriminate against you for exercising a privacy right.
9.5 PHI and employment records. Requests concerning PHI in a Client's records should be directed to that Client. Requests concerning personnel records controlled by your employer should be directed to the employer. We may forward a request to the appropriate Client or explain that Aether does not control the requested information.
10. Children
Our public website and Platform accounts are intended for business and professional users and are not directed to children under 18. We do not knowingly create Platform accounts for children. Our healthcare products and services may process patient information concerning a minor only on behalf of a Client and under the Client Agreement, BAA, Client instructions, and applicable law.
11. United States processing
Aether is based in the United States, and personal information may be processed and stored in the United States. If you access our services from another jurisdiction, applicable law may provide additional rights or require additional protections.
12. External links and third-party services
Our public website may link to websites or services that Aether does not control. Their privacy practices are governed by their own policies. A link does not mean Aether endorses or controls the third party's privacy or security practices.
13. Changes to this Policy
We may update this Policy to reflect changes in our website, products, services, business practices, or legal obligations. We will post the updated Policy with a revised effective date. If a change materially affects how we use personal information, we will provide additional notice when required by law or an applicable agreement.
14. Contact Us
Questions regarding this Privacy Policy, your personal information, privacy, security, compliance, legal matters, data protection, or requests to exercise applicable privacy rights may be directed to: trust@aethercs.com.