PRIVACY

Privacy Policy

This policy explains how OraTek Diagnostics, Inc. ("OraTek", "we", "us") collects, uses, and protects personal data in connection with the OraTek CRM application (the "Service"). The Service is a sales and outreach platform used by our own sales team and by other companies who license it from us.

If you have questions or want to exercise your rights under this policy, contact us at privacy@oratekdx.com.

1. Who this policy applies to

This policy covers two groups of people:

• Customers and users — the companies that use OraTek CRM and the individual salespeople, marketers, and managers who log in. We are the data controller for your account, and a data processor for the business contact data you put into the Service.
• Prospects and business contacts — the people your sales team researches and reaches out to. We hold their information on behalf of our customer. We don't market to them from OraTek; your rep does.

2. Data we collect

Account data (customer users)

• Name, email, profile photo, role, team, manager assignment
• Authentication info — password hash (bcrypt) or Google account identifier
• Organization (employer) name and plan
• Login timestamps, IP address, user agent

Data you bring into the Service

• Business contact records — names, titles, companies, emails, phones, LinkedIn URLs, notes
• Campaign content — message templates, sequences, email drafts
• Activity logs — calls made, emails sent, meetings booked, status changes
• Deal and pipeline data — amounts, stages, close dates
• Event and conference records you track
• Recruiting candidate data (manager-level users only)

Device data (OraTek CRM mobile app)

The iOS / Android app requests these device permissions only when you use the related feature, and only for that purpose:

• Camera — when you take a photo to attach to the AI assistant, a contact, a message, or a task.
• Photo library — when you choose an existing image to attach.
• Microphone — for voice dictation, and for phone calls you place in the CRM or the app. Dictation audio is turned into text by your device's or browser's speech service (Apple or Google); the CRM receives only the text. Call audio travels live to the person you're calling through your organization's phone provider (see Integration data). If your organization turns on call recording, calls are recorded after an announcement and stored in your organization's own Twilio account; OraTek does not keep a copy. In the iPhone app the call appears on the phone's call screen (CallKit) but is not added to the phone's Recents; in the Android app a notification shows while the call is on.
• Location (while in use) — to show your position on the territory map and find nearby leads. We never track your location in the background, and never sell it.

Photos you attach and dictation transcripts are sent to your chosen AI provider (see section 4). We don't access your camera, photos, microphone, or location for any other purpose.

Integration data (with your explicit consent)

When you connect a third-party account, we receive only what's needed for the connected feature:

• Google (Gmail + Calendar) — see section 3 for the detailed Google-specific disclosures.
• LinkedIn — your li_at session cookie (encrypted at rest), used by our automation worker to send invites and messages on your behalf at your direction.
• Twilio (your organization's own account) — when your administrator turns on calling, calls and texts to your organization's business numbers are carried by its Twilio account, under Twilio's terms. We keep each call's details (who, when, how long, and the outcome you log). Voicemail recordings stay in that Twilio account and are played through the CRM; voicemail transcripts and texts sent to business numbers are stored encrypted. Call recording is off unless your organization's administrator turns it on. When it is on:
  • an announcement plays before the call connects (or, if your administrator chooses, the rep tells the other person, and nothing is recorded until the rep confirms they have);
  • recordings stay in your organization's Twilio account and play through the CRM only to people your organization authorizes — the rep on the call, their managers, the lead's owner and administrators; each play is logged;
  • your organization can mark any lead “never record”, exclude whole segments (for example clinics and laboratories), and delete any recording;
  • recordings are deleted after the period your organization sets (12 months unless it chooses otherwise), when the lead is deleted, or on request. When a recording is deleted, Twilio removes the audio immediately and keeps the call's metadata (not the audio) for up to 40 days.
  Voicemails left for your organization are handled the same way and are kept until your organization deletes them or sets a voicemail retention period. If your organization also turns on call transcription, each recorded call's audio is sent to Twilio Conversational Intelligence (an AI speech-to-text service, in your organization's own Twilio account) to produce a transcript. Personal-information redaction is on by default. The CRM stores the transcript encrypted, shows it only to the same people who may play the recording (each view is logged), and deletes Twilio's copy once it has it. The transcript is deleted when the recording is deleted — by your organization, at the end of the retention period, when the lead is deleted, or on request. Short calls (under a length your organization sets) are not transcribed. During a call, whether placed in the browser or in the iPhone or Android app, the calling software also sends call-quality diagnostics (connection and audio statistics, no call content) to Twilio.
• AI provider (your choice) — the assistant ("Julie") works with Anthropic (Claude), OpenAI (GPT), Google (Gemini), or any OpenAI-compatible endpoint. Your personal API key is stored in your browser only — we never receive or transmit it. Your messages and any attached images go directly from your browser to the provider you select, under that provider's terms.

Data we do not collect

• No Protected Health Information (PHI). OraTek CRM is a sales tool, not a clinical system.
• No payment card data — billing is handled by our payment processor (Stripe).
• No tracking cookies used for ad networks.

3. Google API Services disclosures

Scopes we request

• https://www.googleapis.com/auth/gmail.send — send the emails you compose in the CRM on your behalf (sensitive scope)
• https://www.googleapis.com/auth/gmail.compose — create and save draft replies in your Gmail Drafts folder for you to review before sending (restricted scope)
• https://www.googleapis.com/auth/gmail.readonly — read message metadata and bodies so we can show your email history against a contact and detect replies to sequences you've enrolled prospects in (restricted scope)
• https://www.googleapis.com/auth/calendar.events — read and write your calendar to show your schedule, book meetings, and record demos
• openid email profile — identify you when you log in

What we do with Google user data

• Limited Use. We use Google user data only to provide user-facing features inside the Service — sending emails you composed, detecting replies from your prospects so sequences stop, displaying your calendar, booking meetings you initiated.
• We do not transfer Gmail data to third parties except as necessary to provide or improve user-facing features, comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to users.
• We do not use Gmail data for serving ads, including retargeted or personalized ads.
• We do not allow humans to read your Gmail data except (a) with your explicit permission, (b) for security purposes such as investigating abuse, (c) to comply with law, or (d) where the data is aggregated and anonymized for internal operations.
• We do not use Gmail data to train machine learning models.

Data access and deletion

You can revoke OraTek's access to your Google account at any time from the Connections page in the CRM, or at myaccount.google.com/permissions. When you revoke access, we retain aggregated activity data (e.g. "Sarah sent 12 emails last week") for reporting but delete stored message contents and tokens within 30 days.

4. How we use data

• To operate the Service — authenticate you, save your work, show your pipeline
• To provide AI assistance — your in-browser Julie uses your own API key for the provider you choose (Anthropic, OpenAI, Google Gemini, or an OpenAI-compatible endpoint); your messages and attachments go directly to that provider, and we don't receive or store those chats
• To send emails and LinkedIn messages you compose or approve
• To measure campaign performance (opens, clicks, bounces, replies)
• To monitor for abuse, debug errors, and keep the Service secure
• To communicate with you about billing, updates, and security

5. How we share data

We share data with service providers strictly as needed to run the Service, and only under data processing agreements (DPAs):

• DigitalOcean — hosting, database, object storage
• Resend — transactional and marketing email delivery (from our mail.oratekdx.info sender)
• Google — when you connect Gmail or Calendar
• Your chosen AI provider (Anthropic, OpenAI, Google Gemini, or an OpenAI-compatible endpoint) — receives the messages and attachments you send to Julie, transmitted directly from your browser with your own API key. Each provider handles that data under its own terms.
• Sentry / Better Stack — error logging, anonymized where possible
• Stripe — billing

We don't sell personal data. We don't share it with advertisers.

6. Where data is stored

All production data is stored in the United States (DigitalOcean NYC3 region). Backups encrypted at rest. In transit, we use TLS 1.2+.

7. Retention

• Active account data: kept while your account is active.
• Deleted by you: deleted from primary storage within 30 days, from backups within 90 days.
• Account closed: data retained 30 days for recovery, then permanently deleted. You can request immediate deletion at privacy@oratekdx.com.
• Google OAuth tokens: deleted immediately when you disconnect, within 30 days in backups.
• Audit logs: 12 months for security purposes.
• Call recordings and voicemails: the period your organization sets (recordings: 12 months by default; voicemails: kept until deleted unless a period is set), then deleted from your organization's Twilio account. Call transcripts are kept exactly as long as their recording. A recording on legal hold is kept until the hold is released. When an organization closes its account, its recordings, voicemails and any transcript copies at Twilio are deleted before the organization's data is.

8. Your rights

• Access — request a copy of your data
• Correction — request changes to inaccurate data
• Deletion — request we delete your data (subject to our legal retention obligations)
• Portability — request your data in a machine-readable format
• Withdraw consent — disconnect integrations or delete your account at any time

For EU/UK residents: you may also lodge a complaint with your local data protection authority. We comply with GDPR Article 28 as a processor for customer-uploaded contact data.

For California residents: you have rights under the CCPA/CPRA including the right to know, delete, and opt out of sale (we don't sell). Contact us at privacy@oratekdx.com.

9. Email opt-outs (CAN-SPAM, CASL)

Every marketing email sent through OraTek CRM includes a one-click unsubscribe link. Unsubscribes are honored within 10 business days and apply across all sequences from the sending organization. List-Unsubscribe headers are included on every bulk send.

10. Security

• Passwords hashed with bcrypt (12 rounds)
• Sensitive tokens (LinkedIn cookies, Google OAuth refresh tokens) encrypted at rest with AES-256-GCM
• TLS 1.2+ in transit
• Least-privilege database access, rate limiting, audit logging
• Annual security reviews; incident response plan in place

If you believe your account has been compromised, email security@oratekdx.com.

11. Children

OraTek CRM is a business tool and is not directed at children under 16. We do not knowingly collect data from children.

12. Changes to this policy

We'll post changes here and notify customer admins by email. Continued use after the effective date means you accept the revised policy.

13. Contact

OraTek Diagnostics, Inc.
Orem, Utah, USA
Privacy questions: privacy@oratekdx.com
Security concerns: security@oratekdx.com
Data deletion requests: privacy@oratekdx.com