Solliva Physician Privacy Policy

Version 1.0 | Effective September 14, 2026 | Supersedes all prior versions

This Privacy Policy describes how Solliva LLC, a Florida limited liability company located at 7901 4th Street N STE 300, St. Petersburg, Florida 33702 ("Solliva," "we," "us," or "our"), collects, uses, and discloses information about the individuals who use the Solliva Physician application and administrative platform (the "Platform") — physicians, advanced practice providers, nurses, care managers, care navigators, administrators, and other workforce members ("Authorized Users," "you"). You will be asked to accept this policy at first login, together with the Solliva Physician End User Terms of Use.

1. Scope; Patient Data Is Governed Elsewhere

1.1 What this policy covers. This policy covers personal information about you that Solliva collects when you register for, access, and use the Platform, when you contact support, and when your organization provisions your account. 1.2 What it does not cover. Patient information — everything in patient records, care plans, notes, time entries, summaries, and messages — is PHI that Solliva processes as a business associate or subcontractor business associate under 45 C.F.R. Parts 160 and 164, solely as the applicable business associate agreements permit. Nothing in this policy expands or limits those agreements. Patients’ use of the Solliva patient application is governed by the separate Solliva Patient App Privacy Policy. 1.3 Your organization’s role. Your account exists because your employer or contracting organization — the Licensee under the Solliva Physician Platform License Terms, or a Client Practice it serves — provisioned it. That organization decides your role and permissions, supplies some of the information described below, and receives some of the information described below. Its own policies also apply to your use of the Platform, and questions about them belong to it, not to Solliva.

2. Information We Collect

2.1 Identity and professional information. Name, work contact information, job title and role, employer or contracting organization, and, depending on your role, professional credentials such as license type, license number and state, National Provider Identifier, and certification information. Some of this is supplied by your organization when it provisions your account; some you provide directly. 2.2 Account and authentication data. Username, hashed password, multi-factor authentication enrollment, session tokens, and account settings. 2.3 Activity and audit data. The Platform logs your activity: logins and logouts, records accessed, entries created and edited, time entries recorded, AI-generated content reviewed and attested, exports performed, administrative actions taken, and the timestamps, device, and network address associated with each. These audit logs are a HIPAA Security Rule requirement (45 C.F.R. § 164.312(b)) and a core integrity feature of the Platform. 2.4 Device and technical data. Device type, operating system and version, browser, application version, IP address, language, and crash and performance data. 2.5 Communications. Support requests, feedback, training records, and correspondence with Solliva. 2.6 Screening information from public sources. To meet program integrity obligations, Solliva or your organization may screen Authorized Users against public exclusion and debarment lists, including the OIG List of Excluded Individuals and Entities and the System for Award Management, and against state licensure databases. Solliva retains the results of screening it performs. 2.7 No advertising data. The Platform contains no advertising and incorporates no advertising software development kits. Solliva does not collect information from the Platform for advertising purposes, does not use the mobile advertising identifier, and does not share Platform data with advertising partners.

3. How We Use Your Information

3.1 Operating the Platform. Authenticating you; provisioning your role and permissions as your organization directs; providing Platform functionality, including the artificial-intelligence-assisted monthly summaries your organization uses; and providing support and training. 3.2 Security, integrity, and compliance. Maintaining the audit trail HIPAA requires; detecting and investigating unauthorized access, misuse, and security incidents; enforcing the End User Terms and the Platform License Terms; supporting exclusion screening; and meeting Solliva’s legal and contractual obligations, including cooperation with audits and investigations described in the Platform License Terms. 3.3 Service improvement. Analyzing usage, performance, and support data to maintain and improve the Platform. Analyses used beyond operations are performed on de-identified or aggregated data from which you and your organization are not reasonably identifiable. 3.4 Communications. Sending service, security, release, and training communications. Solliva sends marketing to professional users only as permitted by law and with unsubscribe options honored promptly. 3.5 Legal purposes. Complying with law and legal process, establishing and defending claims, and protecting the rights, property, and safety of Solliva, its customers, patients, and the public.

4. Monitoring; No Expectation of Personal Privacy in Platform Activity

4.1 Notice. YOUR USE OF THE PLATFORM IS RECORDED IN AUDIT LOGS AS DESCRIBED IN SECTION 2.3. SOLLIVA REVIEWS THOSE LOGS FOR SECURITY, INTEGRITY, SUPPORT, AND COMPLIANCE PURPOSES, AND PROVIDES THEM TO YOUR ORGANIZATION, WHICH MAY USE THEM FOR ITS OWN SECURITY, COMPLIANCE, QUALITY, AND WORKFORCE MANAGEMENT PURPOSES, INCLUDING INVESTIGATIONS. YOU SHOULD HAVE NO EXPECTATION OF PERSONAL PRIVACY IN YOUR ACTIVITY WITHIN THE PLATFORM. 4.2 Proportionality. Solliva’s own review of audit logs is limited to the purposes in Section 3.2 and is conducted under access controls. What your organization does with logs it receives is governed by its policies and applicable employment law, not by this policy.

5. How We Disclose Your Information

5.1 Your organization. Account, role, activity, audit, attestation, and time-entry information is available to the Licensee that provisioned your account and, where you are Client Practice personnel or your work concerns a Client Practice’s patients, to that Client Practice, as their agreements provide. 5.2 Service providers. Vendors that host, secure, and support the Platform, under written agreements limiting their use of information to providing services to Solliva and, where they touch PHI, meeting HIPAA subcontractor requirements. A current list is available on request at contact@solliva.com. 5.3 Legal disclosures. In response to valid legal process, to comply with law, to cooperate with governmental or payer audits and investigations as the Platform License Terms describe, to enforce agreements, or to protect rights, property, or safety. 5.4 Corporate transactions. In connection with a merger, acquisition, financing, reorganization, sale of assets, or bankruptcy, with the recipient assuming the commitments of this policy as to previously collected information. 5.5 What we do not do. SOLLIVA DOES NOT SELL AUTHORIZED USERS’ PERSONAL INFORMATION, DOES NOT SHARE IT FOR CROSS-CONTEXT BEHAVIORAL ADVERTISING, AND HAS DONE NEITHER IN THE PRECEDING TWELVE (12) MONTHS.

6. Retention

Solliva retains your information for the periods below, then deletes or de-identifies it under a documented retention schedule. Retention may be extended by a legal hold, by law, or by your organization’s agreements with Solliva. Deactivation of your account by your organization does not delete audit history, which is retained as shown.

7. Your Privacy Rights

7.1 State privacy laws. Depending on your state of residence, you may have rights to know, access, correct, delete, or receive a copy of personal information Solliva holds about you, and to appeal a refusal. These rights apply to your information as an Authorized User; they are subject to exceptions, including where retention is required by law (audit logs, for example, cannot be deleted on request) and where the information is your organization’s Confidential Information or a patient’s PHI. California residents have the rights provided by the California Consumer Privacy Act as amended, which applies to workforce and business-to-business personal information. 7.2 California categories. In the preceding twelve (12) months, Solliva has collected the categories summarized below, from you, your organization, your device, and the public sources described in Section 2.6, for the purposes described in Section 3. Solliva does not sell personal information, does not share it for cross-context behavioral advertising, does not knowingly collect information of consumers under sixteen (16) through the Platform, and does not use or disclose sensitive personal information for purposes requiring a right to limit beyond those permitted by 11 C.C.R. § 7027(m).

7.3 How to exercise rights. Submit requests to contact@solliva.com. Solliva will verify your identity, coordinate with your organization where it supplied or controls the information, respond within the period your state’s law requires (generally forty-five (45) days, extendable once with notice), and explain any refusal and how to appeal; if your appeal is denied, you may contact your state attorney general. An authorized agent may submit a request on your behalf with proof of authority. Solliva will not retaliate against you for exercising a privacy right; your organization’s independent decisions are outside Solliva’s control. 7.4 Corrections through your organization. Role, employment, and credentialing information is controlled by your organization; corrections to it should be directed there, and Solliva will reflect the correction once made.

8. Security

Solliva maintains a written information security program consistent with the HIPAA Security Rule: encryption in transit and at rest, role-based access control, multi-factor authentication, logging and monitoring, vulnerability management, penetration testing, workforce training, and incident response. Protect your credentials, never share accounts, and report suspected compromise to contact@solliva.com and to your organization within twenty-four (24) hours, as the End User Terms require. If a breach affecting your personal information occurs, Solliva will provide any notification applicable state breach notification law requires.

9. Other Information

9.1 United States only. The Platform is intended for use in the United States, and information is processed in the United States. Where any service provider accesses information from outside the United States, the contractual safeguards in Section 5.2 apply, and disclosure is available on request. 9.2 Changes. Solliva may update this policy. Material changes will be announced at least thirty (30) days in advance through the Platform or by email, and a materially updated version will be presented for acceptance at login. Continued use after the effective date constitutes acceptance. Prior versions are available on request. 9.3 Contact. Privacy: contact@solliva.com. Security: contact@solliva.com. Mail: Solliva LLC, Attn: Privacy, 7901 4th Street N STE 300, St. Petersburg, Florida 33702.