Privacy Policy

Last updated: 10/22/2026

Privacy Policy at a Glance

PluraVue helps healthcare organizations securely track patient requests and manage specialist communications while maintaining strict HIPAA compliance.

What we collect: Only the information necessary to provide workflow management and referral services.

What we use it for: Secure fax transmission, request tracking, and audit logging.

What we don't do: We never sell, share, or track data outside of referral workflows.

Your control: You can access, correct, restrict, or delete your data at any time.

Compliance: We operate under Business Associate Agreements (BAAs) and follow HIPAA standards.

Scope

This policy applies to:

  • • Healthcare organizations using PluraVue services
  • • Individual providers and staff using the PluraVue Chrome extension
  • • Any users whose information is processed through PluraVue systems

Information We Collect

PluraVue collects and processes healthcare information in compliance with HIPAA regulations. We only collect what is required to provide secure workflow management and fax transmission services. This may include:

  • • Contact information (name, email, phone, fax)
  • • Healthcare facility information and credentials
  • • Patient request data and specialist communications
  • • System usage and audit logs for security
  • • Chrome extension form data (see below)

Chrome Extension Data Practices

Purpose & Functionality

Our Chrome extension integrates with supported web-based EHRs (including Athenahealth) to streamline referral workflows. It:

  • • Displays a floating button in supported EHRs
  • • Opens a secure referral form popup
  • • Enables faxing directly from the EHR workflow
  • • Functions without accessing unrelated browser activity

Data Collected Through Extension

We only collect data entered into the referral form:

  • • Identifiers: Patient, provider, specialist names
  • • Health information: Treatment details, report type, urgency, clinical notes
  • • Form data: Information explicitly submitted for fax transmission

Permissions & Access

  • • Runs only on two explicitly listed sites, not across all websites: athenahealth.com (the supported EHR) and gemini.google.com
  • • gemini.google.com is a testing and demo page only. EHRs require clinic login credentials, so we use it to test and demonstrate the button and referral form without access to patient records. The extension does not read or collect any Gemini content; only what you enter or attach in the PluraVue referral form is sent
  • • Uses storage for authentication tokens and extension settings only
  • • Only acts on referral-related interactions — not on unrelated browsing
  • • Transmits data securely via HTTPS to PluraVue's HIPAA-compliant servers
  • • Does not store patient referral form data locally after submission

What We Don't Collect

  • • Browsing history
  • • Non-referral website content
  • • User behavior tracking or analytics
  • • Any data not explicitly entered into referral forms

Data Usage & Limitations

  • • Used solely to send faxes and provide delivery confirmation
  • • Not sold, used for marketing, or shared outside covered entities
  • • Extension complies with HIPAA and Chrome Web Store Developer Program Policies

HIPAA Compliance

PluraVue operates under Business Associate Agreements with covered entities and maintains strict HIPAA safeguards:

  • • End-to-end encryption (AES-256 at rest, TLS 1.3 in transit)
  • • Role-based access controls and authentication
  • • Comprehensive audit logging and monitoring
  • • Regular security assessments and penetration testing
  • • Employee HIPAA training
  • • Secure API endpoints for extension data transmission

Data Security

We implement industry-leading security measures:

  • • AES-256 encryption for stored data
  • • TLS 1.3 encryption for data in transit
  • • Multi-factor authentication for all accounts
  • • Secure infrastructure certified by AWS/Azure compliance standards
  • • Regular third-party audits and reviews

Data Retention

  • • Active medical record requests: Retained during case management
  • • Audit logs: Retained 7 years (or longer if required by law)
  • • Account information: Retained during active subscription + 3 years
  • • Fax data: Processed and transmitted immediately; logs retained as required by HIPAA
  • • Extension form data: Not stored beyond fax completion and delivery confirmation
  • • We comply with the stricter of HIPAA, state law, or contractual requirements.

Your Rights

Under HIPAA and applicable laws, you may:

  • • Access your protected health information
  • • Request corrections to inaccurate data
  • • Request restrictions on certain uses or disclosures
  • • Request an accounting of disclosures
  • • File a complaint with HHS — or with us directly (we respond within 30 days)

Chrome Extension Control

You have full control of extension data collection. You may disable or uninstall the extension at any time through Chrome settings. Doing so immediately stops all data collection through the extension.

For more on your HIPAA rights, visit the HHS Patient Rights Guide.

Contact Information

For privacy-related questions or to exercise your rights, contact our Privacy Officer:

Email: privacy@pluravue.com

Phone: (208) 483-0880

Updates to This Policy

We may update this Privacy Policy as our practices or laws change. The revision date will always appear at the top of this page. If we make material changes, we will notify affected users and, if required, obtain consent.