Koa PartnersLLC
Portal

Privacy Policy

Effective date: [PLACEHOLDER: effective date]

1. Who we are

This Privacy Policy explains how [PLACEHOLDER: legal entity name and state of organization] ("Koa", "we", "us") handles personal information in the Koa Partners Portal (the "Portal"), the sign-in and launch point for Koa services. Our address is [PLACEHOLDER: mailing address].

2. Information we handle

  • Account information. Your name, email address, the organization (tenant) you belong to, and the services you are entitled to use. Administrators who invite or manage users can see these details for their organization.
  • Sign-in credentials. Your email and password are sent over an encrypted connection and passed directly to our identity server to verify them. The Portal does not store your password.
  • Session cookie. After you sign in we set one cookie, portal_session. It is encrypted, marked HttpOnly, Secure and SameSite=Lax, and holds your sign-in token, organization, entitlements and a refresh token. It expires after 20 minutes of inactivity and is renewed while you are active. We do not use it for advertising.
  • Technical and security data. Request identifiers (an "error reference" you may see on error pages), and infrastructure and audit logs that may include IP address, timestamps, requested paths and user-agent. We use these to operate, secure and troubleshoot the Portal.
  • Administrative records. For administrators: tenant, member, invitation, entitlement and service-catalog records, and uploaded service icons.

We do not use analytics, advertising or cross-site tracking scripts in the Portal. Fonts are served from our own domain.

3. How we use information

To authenticate you, keep your session secure, show the services you are entitled to, let administrators manage their organization, send account emails (such as invitations and password setup), maintain security and audit trails, diagnose problems, and comply with legal obligations.

4. Information processed on behalf of customers

When you open a service from the Portal, the Portal passes a short-lived, service-specific identity token to that service. Information you enter into or receive from those services, which may include health-related or immigration-related information, is handled under the agreement between Koa and your organization and any privacy notice for that service. This policy covers the Portal itself.

[CONFIRM HIPAA STATUS: counsel to confirm whether Koa acts as a business associate and whether a BAA is in place before any HIPAA statement is added here.]

5. Who we share information with

We do not sell personal information. We share it only with:

  • Service providers that host and secure the Portal, including Google Cloud Platform (hosting, load balancing, key management, secrets and storage).
  • Our identity and records server (Medplum, operated by Koa) for authentication and account records.
  • Services you launch, which receive your identity, organization and entitlements.
  • Email delivery for invitations and password emails. [CONFIRM: email delivery provider used by Medplum for invitation and password emails.]
  • Authorities and advisers where required by law, to protect rights and safety, or in connection with a business transaction.

6. Security

We use encryption in transit, an encrypted session cookie, encryption key management, network perimeter controls and audit logging. No system is perfectly secure, and we cannot guarantee absolute security. The Portal currently signs you out of one session at a time and does not offer multi-factor authentication.

7. Retention

We keep logs for [PLACEHOLDER: log retention period] and account data for [PLACEHOLDER: account data retention period after deactivation], unless a longer period is required by law or your organization's agreement with us.

8. Your choices and rights

Depending on where you live and your relationship with us, you may have rights to access, correct or delete your information. Because accounts are created by your organization, requests about your account may be routed to your organization's administrator. Contact us at [PLACEHOLDER: privacy contact email]. You can end a session at any time by signing out, and you can clear the cookie in your browser.

9. Children

The Portal is for business use and is not directed to children under 16.

10. Changes

We may update this policy. The effective date above shows the current version, and we will give notice of material changes as required by law or our agreements.

11. Contact

[PLACEHOLDER: legal entity name and state of organization], [PLACEHOLDER: mailing address]. Email: [PLACEHOLDER: privacy contact email]. See also our Terms of Service.