Privacy Policy

1. Information We Collect

We may collect information about you in a variety of ways. The information we may collect includes:

Personal Data

Personally identifiable information, such as your name, email address, telephone number, and company name, that you voluntarily give to us when you contact us, request information, or engage with our services.

Derivative Data

Information our servers automatically collect when you access our website, such as your IP address, browser type, operating system or access time.

Financial Data

Financial information, such as data related to your payment method, that we may collect when you engage our services. We store only very limited, if any, financial information that we collect.

2. Use of Your Information

Having accurate information about you permits us to provide you with a smooth, efficient, and customized experience. Specifically, we may use information collected about you to:

• Respond to your inquiries and fulfill your requests for our services.
• Send you administrative communications, such as updates about your project or engagement.
• Improve our website, products, and services.
• Monitor and analyze usage and trends to improve your experience.
• Comply with applicable legal and regulatory obligations.
• Prevent fraudulent transactions and monitor against theft.

3. Disclosure of Your Information

We may share information we have collected about you in certain situations. Your information may be disclosed as follows:

By Law or to Protect Rights

If we believe the release of information about you is necessary to respond to legal process, to investigate or remedy potential violations of our policies, or to protect the rights, property, and safety of others, we may share your information as permitted or required by any applicable law, rule, or regulation.

Third-Party Service Providers

We may share your information with third parties that perform services for us or on our behalf, including data analysis, email delivery, hosting services, customer service, and marketing assistance. We take appropriate steps to ensure that third parties handle your information in a manner consistent with this Privacy Policy, including by entering into written agreements where applicable, or by relying on the third party's own published data protection commitments, terms of service, or certifications where such parties operate under standardized agreements that are not subject to individual negotiation. In all cases, third parties are permitted to use your information only for the purposes for which it was shared and are not authorized to sell or otherwise disclose it for their own commercial purposes.

Business Transfers

We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

OrangeLoops does not sell any customer or visitor information to third parties.

4. Security of Your Information

We use administrative, technical, and physical security measures to help protect your personal information. While we have taken reasonable steps to secure the personal information you provide to us, please be aware that despite our efforts, no security measures are perfect or impenetrable, and no method of data transmission can be guaranteed against any interception or other type of misuse.

OrangeLoops maintains a formal information security program aligned with the SOC 2 Trust Services Criteria, covering security and confidentiality of the systems and data we manage on behalf of our clients.

5. HIPAA Compliance - Business Associate

When OrangeLoops provides software development or staff augmentation services to clients in the healthcare industry, OrangeLoops may act as a Business Associate under the Health Insurance Portability and Accountability Act (HIPAA). In these engagements, OrangeLoops personnel may work within client environments and systems that contain protected health information (PHI), or may develop or maintain software that processes PHI on behalf of the client.

In all such engagements, OrangeLoops:

• Requires a signed Business Associate Agreement (BAA) to be in place with the client before any OrangeLoops personnel access systems or environments containing PHI;
• Ensures that personnel assigned to healthcare engagements receive HIPAA training appropriate to their role and the nature of their access;
• Implements safeguards to protect the confidentiality, integrity, and availability of PHI accessed in the course of performing services; and
• Handles all PHI strictly in accordance with the terms of the applicable BAA and HIPAA requirements.

OrangeLoops does not use PHI for any purpose beyond the scope of the services agreed with the client. PHI accessed in the course of client engagements is never used for OrangeLoops's own business purposes.

6. Cookies and Tracking Technologies

We may use cookies, web beacons, tracking pixels, and other tracking technologies on our website to help customize the site and improve your experience. You can choose to disable cookies through your individual browser options.

To know more detailed information about cookie management with specific web browsers, it can be found on the browsers' respective websites.

7. Children's Privacy

Our website and services are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If we learn we have collected or received personal information from a child under 13 without verification of parental consent, we will delete that information.

8. Data Retention and Deletion

OrangeLoops does not automatically delete personal information after a fixed retention period. Personal information is retained for as long as necessary to fulfill the purposes described in this Privacy Policy, to maintain our business relationship with you, and to comply with applicable legal, contractual, and regulatory obligations.

Retention

We retain personal information collected through our website and in the course of client engagements for as long as the underlying business relationship or legal obligation requires. Specific retention periods may be established by applicable law, regulation, or the terms of the applicable services agreement. HIPAA Security Rule policies and procedures are retained for a minimum of six years in accordance with 45 C.F.R. § 164.316(b)(2).

Deletion Requests

OrangeLoops processes personal information deletion requests submitted directly to us. If you wish to request deletion of your personal information, please contact us using the information provided in Section 13. We will verify your identity and process your request within the timeframe required by applicable law.

Please note that we may be unable to fulfill a deletion request in whole or in part where:

• Retention is required by applicable law, regulation, or contractual obligation;
• The information is necessary to complete an ongoing transaction or engagement; or
• Deletion would conflict with our legitimate business, legal, or security interests.

Where personal information is processed as part of a client engagement, deletion requests from individual end-users should be directed to the applicable client. OrangeLoops processes such data on the client's behalf and acts on the client's instructions with respect to retention and deletion.

PHI

Personal information that constitutes protected health information (PHI) under HIPAA is retained and disposed of in accordance with the terms of the applicable Business Associate Agreement and applicable HIPAA requirements.

The return, destruction, or disposition of PHI upon termination of services is governed exclusively by the terms of the applicable Business Associate Agreement.

Individual rights with respect to PHI are exercised through the applicable Covered Entity, not directly through OrangeLoops.

9. Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal information. These may include:

• Right to Access: You may request a copy of the personal information we hold about you.
• Right to Rectification: You may request correction of inaccurate or incomplete personal information.
• Right to Erasure: You may request deletion of your personal information, subject to the limitations described in Section 8.
• Right to Restrict Processing: You may request that we limit how we use your personal information in certain circumstances.
• Right to Object: You may object to our processing of your personal information where we rely on legitimate interests as our legal basis.
• Right to Data Portability: You may request that we provide your personal information in a structured, commonly used, and machine-readable format.

To exercise any of these rights, please contact us using the information provided in Section 13. We will respond within the timeframe required by applicable law and will verify your identity before processing your request.

Please note that these rights may be subject to limitations under applicable law. Where personal information constitutes PHI under HIPAA, individual rights are exercised through the applicable Covered Entity, not directly through OrangeLoops.

10. Uruguay Law 18.331 - Personal Data Protection

OrangeLoops's workforce is based in Uruguay and is subject to Uruguay Law 18.331 on the Protection of Personal Data and Habeas Data Action (Ley de Protección de Datos Personales y Acción de Habeas Data). All workforce members who access personal data in the performance of their duties are required to handle such data strictly in accordance with applicable personal data protection regulations, including Law 18.331, and to use it only for the purposes for which it was collected or as required to perform contracted services.

Uruguay has been recognized by the European Union as providing an adequate level of data protection. Where personal data is transferred from clients or website visitors in the European Economic Area to OrangeLoops's Uruguay-based workforce, such transfers are conducted in reliance on Uruguay's adequacy status and in accordance with applicable data protection requirements.

If you are a resident of Uruguay and wish to exercise your rights under Law 18.331, including the right to access, rectify, or delete your personal data, please contact us using the information provided in Section 13.

11. California Privacy Rights (CCPA)

If you are a California resident, you have specific rights regarding your personal information under the California Consumer Privacy Act (CCPA). These rights include:

• Right to Know: You have the right to request that we disclose what personal information we collect, use, disclose, and sell.
• Right to Delete: You have the right to request that we delete the personal information we have collected from you, subject to certain exceptions.
• Right to Opt-Out: You have the right to opt-out of the sale of your personal information. OrangeLoops does not sell personal information.
• Right to Non-Discrimination: You have the right not to receive discriminatory treatment for exercising your CCPA privacy rights.

To exercise your rights under the CCPA, please contact us using the information in Section 13 below.

12. Changes to This Policy

We may update this Privacy Policy from time to time in order to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will notify you of any changes by posting the new Privacy Policy on this page with an updated effective date. You are advised to review this Privacy Policy periodically for any changes.

13. Contact Us

If you have questions or comments about this Privacy Policy, please contact us at: