Pretura Health Inc. ("Pretura," "we," "us," or "our") operates the Pretura Horizon platform, which transmits clinical information between pre-hospital Emergency Medical Services ("EMS") providers and emergency department ("ED") receiving facilities. This Privacy Policy explains how we collect, use, share, and protect information when you visit our marketing website at preturahorizon.us (the "Sites") or use the Pretura Horizon platform (the "Platform"), including the Pretura EMS mobile application.
This Privacy Policy is divided into: Section 3 — information we collect from visitors to our marketing Sites; and Section 4 — information that flows through the Platform itself, including Protected Health Information ("PHI"), which is governed primarily by the U.S. Health Insurance Portability and Accountability Act ("HIPAA") and the Business Associate Agreement ("BAA") between Pretura and each covered-entity customer.
When you fill out a contact form, request a demo, subscribe to communications, or apply for a job, we may collect your name, email address, phone number, employer, job title, and the contents of your message.
When you visit the Sites, we and our analytics providers may automatically collect: IP address and approximate geolocation; device type, operating system, and browser; pages visited, referring URL, and timestamps; and cookies and similar technologies for analytics and session management. You can control cookies through your browser settings. Refusing cookies may limit Site functionality.
The marketing Sites are not designed to receive PHI. Do not submit PHI through any form, email, or chat feature on preturahorizon.us. If you inadvertently transmit PHI to us through the Sites, we will delete it from the receiving system and ask you to use the Platform's authenticated, encrypted channels.
The Platform is a business-to-business clinical-information-exchange service. Pretura processes information through the Platform only as instructed by the covered-entity customer under its BAA. The categories below are described for transparency to patients, EMS crews, and clinical end-users.
When an EMS crew transports a patient to a Platform-connected ED, the Platform may receive and transmit PHI about the patient, including: demographics (name, date of birth, sex, address) as available; chief complaint, mechanism of injury, and clinical narrative; vital signs and 12-lead ECG tracings; medications administered en route; estimated time of arrival and transport disposition; and other clinical information described in HL7 v2.5.1 or FHIR R4 message profiles.
The Platform processes the following information about end-users (EMS clinicians, paramedics, ED nurses, physicians, charge staff): name, work email address, role/credential, and employer; authentication data (hashed passwords, MFA tokens, session tokens); audit metadata (who accessed what record, when, and from where); device identifiers for the Pretura Horizon mobile app; and approximate geolocation, where the user has authorized location services and the function requires it (e.g., routing, ETA).
We collect system logs, performance metrics, and error reports to operate, secure, and improve the Platform. Where these may include PHI (e.g., a stack trace referencing a record identifier), they are treated as PHI and subject to the BAA.
In the United States, our processing of PHI is permitted under HIPAA at 45 C.F.R. § 164.502(e) (business associate) and § 164.504(e) (BAA). Our processing of business-contact information on the marketing Sites is based on our legitimate business interest in marketing and operating our business, and on the consent you provide when you submit a form.
PHI processed through the Platform is shared with the covered-entity customer(s) on whose behalf we process it.
We use a limited set of subprocessors (notably Amazon Web Services) to host and secure the Platform. A current list is available to customers on request. Each subprocessor with access to PHI is bound by a written agreement no less protective than our BAA obligations.
We may disclose information in response to lawful subpoenas, court orders, government investigations, or other legal process, and to protect the rights, property, or safety of Pretura, our customers, or others.
If Pretura is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred subject to standard confidentiality protections and, with respect to PHI, in compliance with HIPAA.
We do not, and will not, sell PHI. We do not engage in HIPAA-defined "marketing" using PHI without express patient authorization.
We retain information only as long as necessary: marketing-Site form submissions for up to 24 months from last contact unless you opt out earlier; account and authentication records for the duration of the customer's subscription plus the period required by the BAA and applicable law; PHI and audit logs in accordance with the BAA and HIPAA's six-year retention requirement (45 C.F.R. § 164.316(b)(2)), with audit logs stored in immutable WORM storage; and backups rotated on a defined schedule, with deletions propagating within reasonable timeframes consistent with backup retention.
We implement administrative, physical, and technical safeguards designed to protect information, including: TLS 1.2+ encryption in transit; AES-256 encryption at rest, with keys managed by AWS KMS (FIPS 140-2 validated HSMs); role-based access controls, multi-factor authentication, and row-level security tenant isolation; immutable, hash-chained audit logging written to WORM storage; least-privilege access; automated dependency and container vulnerability scanning in our build pipeline; and an incident-response program. No system is perfectly secure. We urge users to safeguard their credentials and report suspected security events to security@pretura.health.
Safeguards not yet in place. We state these plainly rather than imply otherwise: no independent third-party penetration test has been performed to date, and formal workforce security training is documented but not yet operating on a recurring, attested schedule. Business Associate Agreement status with individual subprocessors is described in Section 7 and is available to customers on request; we do not represent that every subprocessor agreement is executed until it is.
You may unsubscribe from marketing emails using the link in any such email or by contacting us at the address in Section 13.
You may manage cookies in your browser. Some Site features may not function without cookies.
If you are a patient and wish to exercise rights regarding your PHI (access, amendment, accounting of disclosures, restrictions), please contact the covered-entity facility that treated you. Pretura does not have a direct relationship with patients and will forward direct requests to the relevant covered entity.
privacy@pretura.health.The Platform may incidentally process information about minor patients as directed by the covered-entity customer. The marketing Sites are not directed to children under 13 and we do not knowingly collect personal information from children on the Sites.
privacy@pretura.healthsecurity@pretura.healthWe may update this Privacy Policy from time to time. We will post the updated policy at the URL where you originally read it and update the "Last Updated" date. Material changes will be announced with reasonable prominence.
This Privacy Policy is governed by the laws of the Commonwealth of Pennsylvania, without regard to its conflict-of-laws principles, except where superseded by applicable mandatory law.