Effective Date: April 22, 2025
Last Updated: May 20, 2025
Depending on your location, different data protection laws and frameworks apply:
For the purposes of this Privacy Policy, the following terms are defined as follows:
ADHICS: The Abu Dhabi Healthcare Information and Cyber Security Standard, issued by the Department of Health – Abu Dhabi. It outlines the regulatory framework for safeguarding personal health information and cybersecurity practices in healthcare environments across the Emirate.
UAE PDPL: The United Arab Emirates Federal Decree Law No. 45 of 2021 on the Protection of Personal Data, which governs the processing, transfer, and protection of personal data within the UAE.
HIPAA: The Health Insurance Portability and Accountability Act of 1996, a U.S. federal law that establishes national standards for protecting sensitive patient health information.
Protected Health Information (PHI): Any individually identifiable health information, including medical history, diagnosis, treatment, and personal identifiers such as name, date of birth, or patient ID, collected or processed in connection with healthcare delivery.
Personal Data: Any data relating to an identified or identifiable individual, including but not limited to names, device IDs, IP addresses, biometric data, or any data subject to UAE PDPL or other privacy laws.
De-Identified Data: Information that has been processed to remove or obscure personal identifiers, making it no longer reasonably capable of being associated with a specific individual, in accordance with HIPAA and ADHICS requirements.
Voice Data / Audio Input: Any audio captured by the Orva system through wake-word activation (“Hey Orva”), including voice commands, time-stamped utterances, and associated metadata.
System Metadata: Operational data collected by Orva to support performance monitoring and diagnostics, such as device ID, session logs, time of interaction, and assigned user role.
Data Controller: The entity (typically the healthcare provider or facility) that determines the purpose and means of processing personal or health data, in accordance with ADHICS or HIPAA guidelines.
Data Processor: A third-party organization (such as Orva) that processes data on behalf of the Data Controller, as defined by contractual agreements and applicable data protection laws.
Confidential Data: As classified in Orva’s internal data governance framework, this includes PHI, personal data, audio recordings, and system logs that are subject to strict access, encryption, and retention policies.
Retention Period: The timeframe during which data is maintained by Orva or its partners, as defined by legal, contractual, or clinical requirements, after which data is securely deleted or archived.
Anonymized Data: Data that has been permanently stripped of personal identifiers and cannot be re-linked to an individual, used for benchmarking, training, or analytical purposes without re-identification risk.
Business Associate Agreement (BAA): A legally binding document required under HIPAA that governs the responsibilities of a third party (such as Orva) in safeguarding PHI on behalf of a covered healthcare entity.
Session: A discrete period of Orva usage within an operating room or clinical setting, during which data collection, voice activation, and logging occur under user supervision.
User Roles: Designated permissions assigned within the Orva system to clinicians, administrators, or other authorized users based on least privilege and clinical responsibilities.
Orva is a clinical-grade voice assistant developed by RAIN Technology, Inc. (for the United States) and RAIN Technology ME LTD (for the United Arab Emirates), collectively referred to as "Orva," "we," "our," or "us." This Privacy Policy outlines how we collect, use, store, and protect data within our software platform (“Orva”) when used in surgical environments.
Your use of the Orva product, whether as a healthcare provider, facility administrator, or end user, constitutes your acceptance of the applicable version of this Privacy Policy, based on your region. If you do not agree, you should not access or use the Orva platform.
Applies to healthcare providers and patients located in the United Arab Emirates
We are committed to protecting the confidentiality, integrity, and availability of healthcare data in accordance with ADHICS v2, UAE PDPL, and applicable Ministry of Health (MOHAP) regulations.
The Orva system may collect the following categories of data:
The use of Orva’s voice-enabled features within clinical settings is governed by applicable data protection and health information privacy laws, including the Abu Dhabi Healthcare Information and Cyber Security (ADHICS) standards, which establish requirements for the collection, processing, and safeguarding of health data.
Patient consent for the use of Orva’s voice technology—including the capture and processing of voice data and any associated protected health information (PHI)—is obtained as part of the healthcare facility’s general surgical consent process. This consent is considered valid under ADHICS, which allows for the integration of digital health technologies into patient care workflows when informed consent has been obtained and documented by the healthcare provider.
Orva’s legal bases for processing personal data under ADHICS and other applicable laws include:
Healthcare institutions deploying Orva are expected to ensure that all patients are informed of the use of such technologies, the purpose for which voice data may be recorded, and the rights afforded to them under ADHICS, including the right to access, rectify, or request deletion of their personal data where applicable.
For more information about the ADHICS guidelines and compliance requirements, please refer to the Department of Health – Abu Dhabi’s official website: https://www.doh.gov.ae
Collected data is used for the following purposes:
Data Classification and Handling
All voice recordings and associated PHI are classified as Confidential under Orva’s internal data classification framework. As such, they are subject to strict access controls, encryption requirements, and handling procedures, including:
Retention & Disposal
PHI and voice recordings are retained in accordance with the healthcare provider’s documented retention schedule, in line with legal, regulatory, and contractual requirements. De-identified data and system logs may be retained for up to five (5) years for the purposes of product improvement, system auditing, and incident forensics, unless otherwise restricted by the data controller. Personally identifiable data is securely disposed of when it no longer serves a legitimate business or clinical purpose, or upon verified request from a data subject in compliance with applicable laws.
Orva implements administrative, technical, and physical safeguards:
In accordance with the UAE Personal Data Protection Law (PDPL), Federal Decree Law No. 45 of 2021, individuals whose personal data is processed through the Orva platform are granted specific rights regarding the access, correction, use, and deletion of their personal data. These rights may be exercised directly by the data subject or through their authorized healthcare provider, who serves as the data controller under UAE law.
Subject to lawful exceptions and institutional policy, you or your healthcare provider may:
Requests to exercise any of the above rights may be submitted:
RAIN will acknowledge receipt of your request within five (5) business days and will respond or fulfill the request within thirty (30) calendar days, in accordance with Article 14 of the PDPL. Extensions may apply for complex or high-volume requests, with notice provided.
RAIN reserves the right to verify the identity of the requester and may refer certain requests to the healthcare provider for further processing, where required by contractual or regulatory obligations.
To maintain a secure, stable, and high-performing platform, Orva collects and processes anonymized technical data and system usage metrics. These analytics are critical for operational reliability, product improvement, and service optimization.
RAIN Technology ME LTD collects the following categories of non-identifiable and anonymized system data:
These analytics are processed exclusively for the following purposes:
RAIN Technology ME LTD does not use tracking data for advertising, commercial profiling, or user behavior analysis unrelated to clinical functionality.
We may amend this policy in response to legal, operational, or regulatory changes. Facilities will be notified of material changes in advance, and a revised effective date will be posted.
RAIN Technology ME LTD
Level 14, Al Sarab Tower
ADGM Square, Al Maryah Island
Abu Dhabi, UAE
Email: hello@orvahealth.com
Applies to healthcare providers and patients located in the United States
RAIN Technology, Inc. ("RAIN," "we," "our," or "us") is committed to protecting the privacy and security of protected health information (PHI) and personally identifiable information (PII) processed through the Orva platform. Orva is a voice-enabled clinical support tool deployed in surgical and procedural environments to assist with intraoperative workflow automation, documentation, and patient safety. This Privacy Policy describes how Orva collects, uses, discloses, and safeguards data under applicable U.S. privacy and security laws.
Orva complies with the following federal and state-level regulatory frameworks:
This Privacy Policy applies to all users of the Orva platform within the United States, including healthcare providers, clinical users, and patients whose data is processed by Orva under the direction of a HIPAA-covered entity.
By using Orva, you agree to the data practices described in this Policy and acknowledge that Orva operates in accordance with Business Associate Agreements (BAAs) signed with covered healthcare entities, which define permitted and authorized uses of PHI under HIPAA.
As part of its operation within clinical environments, the Orva platform collects specific categories of data to facilitate voice-driven workflow support, system functionality, and compliance with healthcare documentation standards. All data collected is either directly provided by the healthcare facility or generated through use of the system by authorized users.
The categories of data collected may include:
Structured and unstructured clinical data associated with events in the operating room, including:
These data are used to support documentation accuracy, post-operative review, and benchmarking.
Data elements that may be classified as PHI under HIPAA, depending on facility configuration and user input, including:
This data is entered or managed exclusively by the healthcare provider and is used solely for clinical support functions.
System-level and environmental metadata automatically collected during each usage session, such as:
This data supports auditability, system performance monitoring, and access control enforcement.
Voice data collected only after activation by the system’s wake word (“Hey Orva”), including:
Voice samples are used strictly for system functionality and—only after being irreversibly de-identified—for natural language model training and platform improvement.
All data is handled in accordance with HIPAA requirements and is processed under the direction of the healthcare provider as the designated covered entity or data controller.
The collection and processing of personal and protected health information (PHI) through the Orva platform is governed by U.S. healthcare privacy laws, including the Health Insurance Portability and Accountability Act (HIPAA) and the Health Information Technology for Economic and Clinical Health (HITECH) Act. Orva operates exclusively under the authority and direction of licensed healthcare providers that qualify as HIPAA-covered entities.
RAIN Technology, Inc. processes data under the following lawful bases:
RAIN enters into a Business Associate Agreement with each covered entity using the Orva platform. This agreement governs:
Under each BAA, Orva acts as a Business Associate and is contractually and legally obligated to process data solely for authorized clinical, operational, or administrative purposes as permitted under HIPAA.
In some cases, patient consent may be required for the processing of identifiable voice recordings or clinical data—such as when such data is used for secondary purposes (e.g., analytics or training). In those instances:
Clinicians, administrators, and other authorized users of the Orva platform must agree to system terms upon account creation. This agreement includes:
No data is used for commercial purposes or shared outside the scope defined by the covered entity’s privacy policies and the applicable BAA.
RAIN Technology, Inc. uses the data collected through the Orva platform exclusively for purposes that support clinical care, healthcare operations, and the secure functioning of the system. All data use is governed by applicable Business Associate Agreements (BAAs), and no information is processed outside the scope of the provider’s clinical or operational intent.
Your data may be used for the following purposes:
RAIN does not use your data for any of the following:
All data use is documented, auditable, and strictly limited to purposes that support the covered entity’s care delivery or operational needs, in accordance with HIPAA and applicable state laws.
RAIN Technology, Inc. is committed to ensuring that all data processed through the Orva platform—particularly Protected Health Information (PHI) and related clinical metadata—is securely stored and managed in accordance with U.S. healthcare data protection laws.
All PHI, system logs, and user interaction data are:
RAIN partners only with cloud service providers who have signed HIPAA Business Associate Agreements (BAAs) and who support infrastructure designed to meet U.S. healthcare compliance requirements.
RAIN does not routinely transfer identifiable PHI outside the United States. However, in limited circumstances—such as when supporting international provider groups or for system development purposes—international data transfers may occur only if all of the following safeguards are in place:
RAIN maintains full documentation for all international transfer activities, including legal basis, data categories, recipient entities, and applicable technical safeguards.
RAIN Technology, Inc. applies strict access controls and data governance measures to ensure that Protected Health Information (PHI) and Personally Identifiable Information (PII) processed through the Orva platform are only accessible by authorized personnel and only disclosed in compliance with applicable law and contractual obligations.
Access to data within the Orva system is limited to:
All system interactions are logged and retained for accountability and compliance verification, per HIPAA’s audit trail requirements.
RAIN does not sell, lease, or commercially distribute PHI or PII under any circumstances. Data is not shared with third parties unless one of the following conditions applies:
RAIN maintains detailed records of all data disclosures and supports covered entities in fulfilling their own HIPAA accounting of disclosures obligations upon request.
RAIN Technology, Inc. maintains a comprehensive information security program designed to protect the confidentiality, integrity, and availability of all data processed through the Orva platform. All safeguards are aligned with the HIPAA Security Rule (45 CFR §§164.302–318) and the HITECH Act, and reflect industry-recognized best practices for healthcare systems.
All data, including PHI and session metadata, is protected through advanced encryption protocols:
Encryption keys are managed securely in accordance with NIST and HIPAA guidance, with regular rotation and strict access policies.
RAIN maintains an incident response plan consistent with the HIPAA Breach Notification Rule (45 CFR §§164.400–414). This includes:
RAIN regularly tests its incident response procedures and conducts third-party security assessments to validate effectiveness.
As a user of the Orva platform or as a patient whose information may be processed through the system, you are entitled to certain rights under applicable U.S. privacy laws, including the Health Insurance Portability and Accountability Act (HIPAA) and, where applicable, the California Consumer Privacy Act (CCPA/CPRA).
These rights may be exercised directly by you or through your healthcare provider, who serves as the data controller (covered entity) under HIPAA.
Requests related to your rights should be directed:
RAIN will acknowledge all requests within five (5) business days and will respond within thirty (30) calendar days, in accordance with HIPAA and, where applicable, CCPA/CPRA regulations. We may request additional information to verify your identity or confirm institutional authorization before processing your request.
RAIN Technology, Inc. collects and processes anonymized usage logs and performance metrics from the Orva platform to ensure continued reliability, product quality, and regulatory alignment. These logs do not contain Protected Health Information (PHI) or Personally Identifiable Information (PII) and are handled in accordance with HIPAA de-identification standards.
Anonymized logs support:
Anonymous usage data is never sold, shared with third parties for marketing, or used for profiling unrelated to clinical or technical performance.
We may revise this policy from time to time. Changes will be communicated to healthcare providers in advance, and the latest version will always be posted on our website or platform dashboard.
RAIN Technology, Inc.
5526 W 13400 S #60
Herriman, UT 84096
Email: hello@orvahealth.com