Zoren AI

Privacy Policy

Effective date: September 14, 2026 · Last updated: September 14, 2026

This Privacy Policy explains how Zoren, Inc., which operates Zoren AI (“we,” “us,” or “our”), collects, uses, discloses, and protects information in connection with our prior-authorization automation platform and related services (the “Service”). It applies to visitors of our public website and to authorized users of the Service acting on behalf of a healthcare organization, pharmacy, or other business customer (“Customer”). If you are a patient and believe your protected health information was processed through the Service on behalf of a healthcare provider or pharmacy, please also see our HIPAA Notice and contact that provider or pharmacy directly — they, not us, control how your health information is used, as explained in Section 5 below.

1. Introduction & scope

We provide the Service to healthcare organizations and their authorized workforce members on a business-to-business basis. Our Customers — not individual patients — are typically the party who determines what patient-related information is submitted to the Service and for what purpose. Where we process protected health information (“PHI”) on a Customer’s behalf, we do so as their business associate under the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”), pursuant to a Business Associate Agreement (“BAA”) with that Customer. That BAA — not this Privacy Policy — governs our handling of PHI. This Privacy Policy instead describes our practices for the information described in Section 2, including information about our Customers’ authorized users and visitors to our public website.

2. Information we collect

We collect information in the following categories:

Account & authentication information — name, work email, organization, role, and credentials you or your organization’s administrator provide to create and manage a user account.
Customer-submitted workflow data — information a Customer or its authorized users enter into the Service to operate prior-authorization, prescription, and related workflows. This may include information about patients (such as demographic details, insurance information, and clinical information relevant to a specific request) that a Customer submits in the course of using the Service. Where this constitutes PHI, it is governed by our BAA with that Customer, not this Privacy Policy.
Usage & device data — log data, IP address, browser and device type, pages viewed, timestamps, and similar diagnostic information collected automatically when you use the Service or visit our website.
Cookies and similar technologies — as described in Section 6.
Voice call data — call audio, recordings, transcripts, and summaries from voice features a Customer enables, including calls with patients, prescribers, pharmacies, and payers. Where this constitutes PHI, it is governed by our BAA with that Customer.
Communications — information you provide when you contact us for support, sales, or other inquiries.
Integration data — information exchanged with third-party systems a Customer connects to the Service (for example, pharmacy or payer portals, fax and e-fax providers, or CRM systems), to the extent necessary to operate the requested workflow.

3. How we use information

We use the information described above to:

Provide, operate, secure, and maintain the Service;
Authenticate users and enforce access controls and tenant isolation;
Process and route prior-authorization and related workflow requests as directed by a Customer;
Communicate with you about the Service, including security notices and support responses;
Monitor, audit, and improve the reliability, security, and performance of the Service;
Detect, investigate, and prevent fraud, abuse, and security incidents;
Comply with legal obligations, including recordkeeping and audit requirements; and
Develop and improve the Service, including its AI models, using information that has been de-identified to the HIPAA standard and does not identify a specific patient or user, consistent with our BAA obligations.

4. Legal bases for processing

Where applicable law requires a legal basis for processing personal information, we rely on one or more of the following: performance of a contract with our Customer, our legitimate interests in operating and securing the Service, compliance with a legal obligation, and, where required, your or your organization’s consent.

We do not sell personal information. We may share information as follows:

With your Customer organization — administrators and authorized users at the healthcare organization or pharmacy you are affiliated with can access information relevant to their operations within the Service.
Service providers and subprocessors — vendors who process information on our behalf under contractual confidentiality and security obligations (for example, cloud hosting, AI model providers, error monitoring, and transactional email providers). See our Data Policy for our current subprocessor list.
Third-party integrations you direct us to use — pharmacy/payer portals, e-fax providers, CRM systems, and similar destinations a Customer configures, solely to carry out the requested workflow.
Legal and safety reasons — where required to comply with law, respond to lawful requests from public authorities, enforce our agreements, or protect the rights, property, or safety of Zoren, Inc., our Customers, or others.
Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections and, where required, notice to affected Customers.

6. Cookies & tracking technologies

We use a strictly necessary, secure, HTTP-only cookie to keep you signed in, along with browser storage required to operate your session. We use error-monitoring software to detect and fix problems in the Service. We do not use advertising cookies or third-party analytics cookies.

7. Data security

We maintain administrative, technical, and physical safeguards designed to protect information against unauthorized access, disclosure, alteration, and destruction, including encryption of data in transit and at rest, additional application-level encryption of designated PHI fields, role-based access controls, audit logging, and periodic security review. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. See our Data Policy for additional detail.

8. Data retention

We retain information for as long as your organization uses the Service, and we do not automatically delete it. We also retain information as needed to comply with legal obligations, resolve disputes, and enforce our agreements. When a Customer’s agreement ends, PHI is handled as described in our Business Associate Agreement and Data Policy. Information that has been de-identified is not PHI and may be retained indefinitely.

9. Your privacy rights

Depending on your location and role, you may have rights to access, correct, delete, or receive a copy of certain personal information we hold about you, and to object to or restrict certain processing. Because much of the information in the Service is submitted and controlled by our Customers in their role as data controller (or, for PHI, as HIPAA covered entity), we will direct requests concerning that information to the relevant Customer where required by our contractual and legal obligations, and will assist that Customer in responding as required by our agreements. For information we control directly (such as your account registration details), you may submit a request using the contact information in Section 15.

We do not sell personal information for money, and we do not “share” personal information for cross-context behavioral advertising as those terms are defined under applicable state privacy laws. If you are a resident of a state that grants you privacy rights regarding personal information we control, you may exercise them using the contact information in Section 15, and we will not discriminate against you for doing so.

11. Children's privacy

The Service is intended for use by adult professionals acting on behalf of a healthcare organization or pharmacy Customer. It is not directed to children, and we do not knowingly collect personal information directly from children through the public website.

12. Data location

We are based in the United States, serve US-based healthcare organizations, and store and process Service data in the United States.

13. Third-party links and services

The Service may link to or integrate with third-party websites and services that we do not control, including pharmacy and payer portals. Those third parties have their own privacy practices, and we encourage you to review their policies. We are not responsible for the content or privacy practices of third-party sites or services.

14. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the “Last updated” date above and, where required by law or contract, provide additional notice. Continued use of the Service after an update constitutes acceptance of the revised policy to the extent permitted by law.

15. Contact us

If you have questions about this Privacy Policy, contact us at [email protected] or at Zoren, Inc., 2615 N. Greenbrier, Santa Ana, CA 92706.