Snapshot 232344
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Orvera AI is positioned as a Major Contender in the Everest Group PEAK Matrix® 2026→
Legal
Orvera AI Privacy Policy
Updated: 13 Oct 2026
Version 1.0
Your privacy rights
Go straight to the section for you
Section 11 EEA, UK and Swiss users GDPR
Section 12 Indian users IT Act and SPDI Rules
Section 14 California residents CCPA/CPRA
Section 17 Children COPPA
WE DO NOT SELL YOUR PERSONAL INFORMATION, NOR DO WE INTEND TO DO SO.
On this page
WE WILL POST ANY CHANGES TO THIS PRIVACY POLICY ON OUR WEBSITE AND WILL NOTIFY YOU BY EMAIL WHERE REQUIRED BY APPLICABLE LAW. PLEASE REVIEW THIS PRIVACY POLICY PERIODICALLY. YOUR CONTINUED USE OF OUR WEBSITE, PLATFORM, OR SERVICES CONSTITUTES ACCEPTANCE OF ANY CHANGES.
1 Introduction
Callbotics LLC doing business as Orvera AI ("Orvera AI," "we," "us," or "our") is committed to protecting the privacy of its enterprise customers, website visitors, and prospective customers (collectively, "Users," "you," or "your").
This Privacy Policy (the "Privacy Policy") explains how we collect, use, disclose, and safeguard personal information when you (a) visit our website at orvera.ai (the "Website"), or (b) access or use our AI agent platform and associated services (collectively, the "Platform" or "Services").
Orvera AI has AI agents for your Customer Experience team. Voice, Chat, Email and Digital. Orvera AI serves many industries such as Healthcare, Insurance, Legal, BPO, Retail/E-Commerce, Telecom, Travel/Hospitality and Utilities. In providing the Platform, Orvera AI processes personal information in two distinct capacities:
1. Website and Marketing Data: Personal information collected from Website visitors and prospective customers for Orvera AI' own business purposes (Orvera AI acts as controller).
2. Customer Platform Data: Personal information, including end-customer interaction data, submitted by enterprise customers and processed through the Platform on behalf of those customers (Orvera AI acts as a processor or sub processor; the enterprise customer is the controller).
PLEASE READ THIS PRIVACY POLICY CAREFULLY. BY ACCESSING OR USING OUR WEBSITE OR SERVICES, YOU AGREE TO THE PRACTICES DESCRIBED HEREIN. IF YOU DO NOT AGREE, PLEASE DO NOT USE OUR WEBSITE OR SERVICES.
WE DO NOT SELL YOUR PERSONAL INFORMATION, NOR DO WE INTEND TO DO SO.
For questions, please contact us at: legal@orvera.ai.
2 Scope and Territorial Applicability
This Privacy Policy applies to personal information processed in connection with our Website and Services, regardless of where you are located. Orvera AI' primary servers are located in the United States. If you are accessing the Website or Services from outside the United States, please be aware that your personal information may be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country of residence.
Enterprise customers who have executed a Data Processing Agreement ("DPA") with Orvera AI should refer to that DPA for the terms governing Orvera AI' processing of Customer Platform Data as processor. To the extent of any conflict between this Privacy Policy and an applicable DPA, the DPA governs with respect to Customer Platform Data.
This Privacy Policy does not govern the processing of personal data of Orvera AI employees, contractors, and job applicants in their capacity as such. Orvera AI processes employee personal data in accordance with applicable employment law in each jurisdiction where it employs staff and provides employees with separate privacy notices as required by law.
3 What Information Do We Collect?
1 Information You Provide Directly.
When you register on the Website, request a demo, fill out a form, or otherwise interact with Orvera AI, we may collect:
1.1 First and last name;
1.2 Business email address and telephone number;
1.3 Professional or employment-related information, including employer, job title, and business address;
1.4 Account credentials (username and password);
1.5 Education information (degrees, majors, schools), where relevant to a user's professional profile or licensing requirements;
1.6 Records and copies of correspondence if you contact us;
1.7 Government-issued identification numbers, including Social Security numbers, passport numbers, and driver's license or state ID card numbers, where required for identity verification, credentialing, or compliance purposes in connection with regulated industry deployments (see Section 3(4));
1.8 Credit card and payment information (processed by Stripe); and
1.9 Any other information you choose to provide.
2 Information Collected Automatically.
When you visit or use the Website or Platform, we automatically collect:
2.1 IP address and approximate geolocation (including street-level location data where sufficient to determine street name and city or town);
2.2 Browser type, version, and operating system;
2.3 Device type and identifiers;
2.4 Pages viewed, links clicked, and referring URLs;
2.5 Browsing history, search history, and information regarding your interaction with the Website; and
2.6 Information collected via cookies and similar tracking technologies, including Microsoft Clarity (see Section 6).
3 Financial Information.
We use Stripe, Inc. as our third-party payment processor. We do not directly collect or store full credit card numbers on our servers. We may receive limited payment metadata (such as the last four digits of a payment card and transaction reference numbers) for subscription management and fraud prevention. Credit card information retained in connection with active subscriptions is stored in accordance with Stripe's PCI-DSS-compliant infrastructure.
4 Sensitive Personal Information: Special Disclosure.
Orvera AI' Platform serves highly regulated industries, including healthcare, insurance, legal, and financial services. In the course of enterprise customer deployments, the Platform may process the following categories of sensitive personal information on behalf of and at the direction of enterprise customers:
4.1 Protected Health Information ("PHI") as defined under HIPAA, including health records, insurance information, appointment data, and billing information relating to end-customers of healthcare enterprise clients;
4.2 Government-issued identification numbers, including Social Security numbers, passport numbers, and driver's license or ID card numbers, submitted in connection with identity verification, insurance underwriting, legal intake, or similar regulated processes;
4.3 Financial information, including account numbers and payment history, submitted in connection with billing and collections workflows; and
4.4 Other sensitive information submitted by enterprise customers as part of their specific use case.
Important: Orvera AI processes sensitive personal information solely at the direction of and on behalf of enterprise customers, who act as data controllers and are solely responsible for ensuring they have appropriate legal authority (including applicable notices, consents, and authorizations) to submit such information to the Platform. Enterprise customers processing PHI must execute a Business Associate Agreement ("BAA") with Orvera AI prior to submitting PHI. See Section 8(3). Orvera AI disclaims liability for unauthorized or non-consensual submissions of sensitive personal information by enterprise customers.
5 Customer Platform Data: Voice and Interaction Data.
In providing AI voice agent services, the Platform automatically processes real-time telephone and VoIP calls made or received through the Platform on behalf of enterprise customers. This includes audio captured during calls, transcriptions generated from calls, call metadata (duration, timestamps, caller identification), AI-generated analytics such as sentiment scores and call resolution outcomes, and records stored in or synchronized from enterprise customer CRM and business systems. This data ("Customer Platform Data") is processed solely as directed by the applicable enterprise customer and is subject to the DPA or BAA, as applicable.
Enterprise customers are solely responsible for providing all required notices and obtaining all required consents from end-customers prior to routing calls through the Platform. See Section 15 (Voice Recording and Wiretapping Law Compliance).
6 Information from Third-Party Integrations.
Where enterprise customers connect third-party platforms, including CRM platforms (Salesforce, HubSpot, Zoho, Pipedrive, Microsoft Dynamics 365), contact centre platforms (Amazon Connect, Genesys, NICE), communication and collaboration tools (Slack), scheduling platforms (Cal.com), and workflow automation tools (Zapier, Monday) - to the Services, information may be transmitted through those integrations to the Platform. When data is collected indirectly via these integrations, the enterprise customer (the Data Controller) is contractually obligated to provide the required GDPR Article 14 privacy notices to the end-user. Such information is processed as Customer Platform Data in accordance with the enterprise customer's instructions and the applicable DPA or BAA.
4 How Do We Collect Information?
We collect personal information from you in the following ways:
1. When you register on our website or access the Platform;
2. When you submit forms, including demo requests, contact forms, and inquiry submissions;
3. Through records and copies of correspondence (including email addresses) if you contact us;
4. Through telephony and VoIP systems that route calls through the Platform;
5. Through third-party CRM, contact centre, and business system integrations;
6. Automatically as you navigate the Website, through cookies and similar tracking technologies (including Microsoft Clarity and Google Analytics); and
7. From enterprise customers who submit end-customer data to the Platform for processing.
We do not collect personal information from third-party business partners or through offline means, other than as described above.
5 How Do We Use Your Information
We use the information we collect for the following purposes:
1. To personalize your experience with the Website and Platform;
2. To provide you with information, products, or services you request from us;
3. To present the Website and its contents to you;
4. To provide notices about your account or subscription, including expiration and renewal notices;
5. To carry out our obligations and enforce rights arising from contracts, including for billing and collection;
6. To notify you about changes to the Website or our products and services;
7. To allow you to participate in interactive features of the Website;
8. To improve the Website, the Platform, and our customer service;
9. To detect, investigate, and prevent fraud, security incidents, and other illegal activities;
10. To comply with applicable legal and regulatory obligations; and
11. To process and respond to inquiries and correspondence.
Customer Platform Data: Customer Platform Data is used solely to provide the Services pursuant to our agreements with enterprise customers. Orvera AI does not use Customer Platform Data for its own marketing purposes or to develop generalized AI models without explicit contractual authorization from the applicable enterprise customer.
6 Our Cookie Policy
We use cookies and similar technologies on our website. We utilize an "Reject All / Accept All" consent banner on our live website. We provide a Cookie Preferences feature that allows you to manage and customize your cookie settings in accordance with your preferences. Through this feature, you may choose to accept or reject non-essential cookies, subject to applicable laws and the technical requirements of our website. You may update your preferences at any time through the Cookie Preferences feature. By default, all performance, analytics, and advertising cookies are turned off and inactive. They will only be activated if you provide explicit, affirmative opt-in consent by interacting with our consent banner. If users disable cookies in their browsers, certain features of the Website, including analytical tools such as Microsoft Clarity, will not function. Disabling cookies is unlikely to affect the core browsing experience.
1. Strictly Necessary Cookies.
Required for the operation and security of the Website, including authentication and session management. These cannot be disabled.
2. Performance and Analytics Cookies.
We use Google Analytics to compile aggregate data about Website traffic and interactions. We also use Microsoft Clarity to understand user behaviour and improve Website performance. Microsoft Clarity uses cookies and similar technologies to capture how you use and interact with the Website, including mouse movements, clicks, and scrolling patterns. Clarity data may be shared with Microsoft. For more information, see Microsoft's privacy statement at https://privacy.microsoft.com. To opt out of Google Analytics, please visit https://tools.google.com/dlpage/gaoptout.
3. Advertising and Tracking Cookies.
We use Google Ads (currently not serving active ad campaigns but configured for future use, including Remarketing, Google Display Network Impression Reporting, Demographics and Interest Reporting, and DoubleClick Platform Integration). We also allow third-party behavioural tracking on the Website. You may opt out through the Network Advertising Initiative at How to Opt Out - The NAI: Network Advertising Initiative or the Digital Advertising Alliance at https://optout.aboutads.info.
4. Your Cookie Choices.
Through our live cookie consent banner, you have the affirmative right to opt-in to non-essential cookies. You can manage, modify, or withdraw your consent for performance, analytics, and advertising cookies at any time via our cookie preferences center.
Review or change your cookie choices at any time.
Read the full Cookie Policy for the cookies we use and how to manage them in your browser.
7 How Do We Protect Your Information?
Orvera AI implements administrative, technical, and physical security measures to protect personal information from unauthorized access, use, alteration, or disclosure. These include:
1. SSL/TLS encryption for all data in transit;
2. Encryption of data at rest;
3. Regular security scans and penetration testing;
4. Regular malware scanning;
5. Prevention of unauthorized third-party access to personal information stored on our servers;
6. Role-based access controls for personnel with access to personal information;
7. Security measures applied when users place orders, register, submit information, and access the Platform; and
8. Contractual data protection and security obligations imposed on all sub processors.
Orvera AI maintains HIPAA compliance and SOC 2 Type II certification to provide independent third-party validation of our security controls. Customers may request information about our current certification status and available compliance documentation by contacting legal@orvera.ai.
We use Stripe as our payment gateway and do not store full credit card information on our servers beyond what is necessary for active subscription management. Despite these measures, no method of transmission over the Internet or electronic storage is 100% secure.
8 Data Security Measures
1 Breach Notification.
Orvera AI has a written data breach notification plan. In the event of a personal data breach, Orvera AI will notify affected users via email, in-Platform notification, and by notifying the FTC, FCC, and/or applicable state regulatory agencies, in accordance with applicable law. For EEA and UK users, notification will be made to the relevant supervisory authority within 72 hours of becoming aware of the breach where required by the GDPR, and to affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms. For Customer Platform Data processed as processor, Orvera AI will notify the applicable enterprise customer in accordance with the timelines specified in the applicable DPA.
2 Individual Redress.
Orvera AI supports the individual redress principle. Individuals have the right to pursue legally enforceable rights against data collectors and processors who fail to adhere to applicable law, including through courts or government agencies to investigate and prosecute non-compliance.
3 HIPAA Compliance: Business Associate Agreements.
Orvera AI is HIPAA-compliant and provides services to covered entities and business associates in the healthcare industry. Enterprise customers that process PHI through the Platform must execute a Business Associate Agreement ("BAA") with Orvera AI prior to submitting any PHI. Orvera AI will process PHI solely in accordance with the applicable BAA and HIPAA requirements. Enterprise customers that have not executed a BAA must not submit PHI to the Platform. Retention of PHI is configurable by the enterprise customer; customers may select the retention period applicable to their data. Sensitive financial information (credit card data) is stored only through Stripe and is not retained on Orvera AI' servers beyond subscription management requirements.
9 Disclosure of Personal Information
1. Sub processors and Service Providers.
We share personal information with third-party sub processors and service providers that perform services on our behalf. We require all such parties to maintain confidentiality and to process personal information only for the purposes for which it was disclosed, under contractual obligations, including DPAs where applicable. See Section 23 for our current sub processor list.
2. Disclosure for Purpose Provided; No Unauthorized Disclosure.
We disclose personal information for the purpose for which the user provided it, or as described in this Privacy Policy. We will only disclose personal information as described in this Privacy Policy or with the consent of the user.
3. Business Transfers.
We may disclose personal information to a buyer or successor in connection with a merger, acquisition, divestiture, restructuring, dissolution, or similar transaction involving Orvera AI, provided the receiving party agrees to handle personal information in a manner consistent with this Privacy Policy and applicable DPAs.
4. Legal Compliance and Protection.
We may disclose personal information (i) to comply with applicable law, regulation, court order, or government request; (ii) to enforce our agreements and Terms of Service; or (iii) to protect the rights, property, or safety of Orvera AI, our customers, or others.
5. Aggregated or De-identified Data.
We may share aggregated or de-identified information that cannot reasonably be used to identify any individual, for analytics, product improvement, or other business purposes, without restriction.
6. No Sale of Personal Information.
We do not sell, trade, or otherwise transfer personal information to outside parties for their own commercial purposes. Information is shared with sub processors solely for the purpose of performing required tasks, which are governed by agreements (including DPAs) with those sub processors and our enterprise customers.
7. Third-Party Advertising.
We do not share personal information with third parties to market their own products and services to users, without user consent. We do not enable the display of third-party advertisements using personal information without user consent.
10 Data Retention
1. Website and Marketing Data.
We retain personal information collected from Website visitors and prospective customers for as long as necessary to fulfil the purposes for which it was collected, including responding to inquiries, delivering services, complying with legal obligations, and enforcing agreements. Inactive account data is typically deleted or anonymized within three (3) years of the date of last activity, unless a longer period is required by law.
2. Customer Platform Data and PHI.
Customer Platform Data, including call recordings, transcriptions, and end-customer data - is retained for the period selected by the applicable enterprise customer in their Platform configuration and DPA. Enterprise customers control the retention period for their data and may configure shorter or longer periods as appropriate for their industry and legal obligations. Upon termination of an enterprise customer agreement, Orvera AI will delete or return Customer Platform Data in accordance with the applicable DPA. Enterprise customers in regulated industries (healthcare, insurance, legal, financial services) are responsible for ensuring retention periods comply with applicable sector-specific record-keeping requirements.
3. Sensitive Personal Information.
Sensitive personal information, including PHI and government-issued identification numbers, is retained only for as long as necessary for the specific purpose for which it was submitted, and in accordance with applicable law. Orvera AI does not retain sensitive personal information on its own servers beyond what is required to fulfil the applicable enterprise customer engagement.
11 FOR OUR EEA, UK, AND SWISS USERS (GDPR)
This Section applies to individuals in the European Economic Area ("EEA"), United Kingdom ("UK"), and Switzerland ("European Users"). Orvera AI offers its Services to European customers. This Section applies to personal data processed by Orvera AI in that context.
1 Data Controller and Processor.
For Website and Marketing Data, Orvera AI acts as the data controller under the GDPR. For Customer Platform Data processed on behalf of enterprise customers, Orvera AI acts as a data processor (or sub-processor). Orvera AI' processing of Customer Platform Data as processor is governed by the applicable DPA, incorporating EU Standard Contractual Clauses where required.
2 Lawful Bases for Processing Website and Marketing Data.
Orvera AI processes Website and Marketing Data on the following lawful bases under Article 6 GDPR:
2.1 Contractual necessity (Art. 6(1)(b)): Processing necessary to perform a contract with you or take pre-contractual steps.
2.2 Legitimate interests (Art. 6(1)(f)): Processing necessary for our legitimate business interests, including improving the Platform, fraud prevention, security monitoring, and direct marketing to existing customers, where such interests are not overridden by your interests or fundamental rights.
2.3 Legal obligation (Art. 6(1)(c)): Processing required to comply with applicable law.
2.4 Consent (Art. 6(1)(a)): For non-essential marketing communications and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.
3 International Data Transfers.
Transfers of personal data from the EEA, UK, or Switzerland to the United States are made in reliance on the EU Standard Contractual Clauses (2021 SCCs) as approved by the European Commission on June 4, 2021, and the UK Addendum thereto where applicable. Orvera AI has prepared SCCs for execution and will enter into SCCs with enterprise customers as required. For further information about the applicable transfer safeguards, please contact legal@orvera.ai.
4 Rights of Data Subjects.
European Users have the following rights with respect to personal data processed by Orvera AI as controller, subject to applicable conditions under the GDPR:
4.1 Access (Art. 15): Request a copy of the personal data we hold and information about how we process it.
4.2 Rectification (Art. 16): Request correction of inaccurate or incomplete personal data.
4.3 Erasure (Art. 17): Request deletion of your personal data where no longer needed or where consent is withdrawn and no other basis applies.
4.4 Restriction (Art. 18): Request restriction of processing in certain circumstances.
4.5 Portability (Art. 20): Request a copy of your personal data in machine-readable format and the right to transmit it to another controller.
4.6 Objection (Art. 21): Object to processing based on legitimate interests or for direct marketing.
4.7 Withdrawal of Consent: Withdraw consent at any time where processing is based on consent.
4.8 Right to Lodge a Complaint: You may lodge a complaint with your EEA Member State supervisory authority, or the UK ICO at https://ico.org.uk/make-a-complaint (telephone: 0303 123 1113) for UK residents.
To exercise rights relating to Customer Platform Data, please contact the applicable enterprise customer (the data controller). To exercise rights relating to Website and Marketing Data, contact us at legal@orvera.ai or at the address in Section 27. We will respond within thirty (30) days. We have one month to respond and may extend by a further two months where necessary, with notice. We may require identity verification before processing requests.
5 Automated Decision-Making and Profiling (Art. 22).
Orvera AI' AI voice agents make automated decisions in real time in contexts that may produce legally significant or similarly significant effects on end-customers - including healthcare appointment scheduling, insurance claims status, legal intake qualification, and collections interactions. Where Orvera AI' Platform is deployed by an enterprise customer in circumstances that constitute solely automated decision-making within the meaning of GDPR Article 22, European Users have the right to:
5.1 not be subject to such decisions without human intervention;
5.2 obtain human review of the decision;
5.3 express their point of view; and
5.4 contest the decision.
To invoke the right to human intervention, an end-user subjected to an AI agent's automated decision can clearly state "speak to a representative," "transfer to a human," or dial "0" during the live call to immediately bypass the AI and be routed to a human agent for review and continuation of the service. Enterprise customers who deploy the Platform in regulated contexts are responsible for ensuring appropriate human oversight mechanisms are in place and for communicating the existence and logic of automated processing to their own end-customers as required by applicable law.
Where Orvera AI acts as controller with respect to Website and Marketing Data, no solely automated decision-making within the meaning of Art. 22 is performed in respect of European Users.
6 EU AI Act.
Orvera AI' Platform incorporates AI systems that may qualify as high-risk AI systems under Regulation (EU) 2024/1689 on Artificial Intelligence (the "EU AI Act") in certain deployment contexts, including AI systems used in access to essential private services, administration of justice, and law enforcement, as well as in employment, workers management, and access to self-employment contexts. Orvera AI is monitoring the staged implementation of the EU AI Act and its delegated acts. Enterprise customers deploying the Platform in the EEA should assess whether their specific use case triggers EU AI Act obligations applicable to deployers of AI systems. Where Orvera AI acts as a provider of AI systems within the scope of the EU AI Act, Orvera AI will fulfill the applicable obligations under that Regulation, including maintaining required technical documentation and providing transparency to deployers. Affected enterprise customers are encouraged to contact legal@orvera.ai to discuss AI Act compliance support.
The Website and Platform are intended for business and professional use and are not directed to children under the age of 16. Orvera AI does not knowingly solicit or collect personal data from children under 16 through the Website. Information submitted through the Website for business enquiry purposes is generally limited to business contact information, such as an individual's name, business email address, and company name. Please get in touch with us if you are a parent or guardian and know that your Children have provided us with Personal Data. If we become aware that we have collected Personal Data from children without verification of parental consent, we take steps to remove that information from our servers.
With respect to personal data processed through the Platform on behalf of our clients, Orvera AI generally acts as a data processor and processes such information in accordance with the client's documented instructions and applicable contractual arrangements. Our clients are responsible for determining the appropriate legal basis for processing and, where applicable, obtaining any required consent or parental or guardian consent in accordance with applicable data protection laws.
In accordance with Article 8 of the General Data Protection Regulation (EU) 2016/679 ("GDPR"), where consent is relied upon as the legal basis for processing personal data in relation to information society services offered directly to a child under the age of 16, such consent shall be obtained from or authorized by the holder of parental responsibility where required by applicable law. Member States may provide by law for a lower age, provided that such age is not below 13. Orvera AI does not knowingly target children under 16 or operate a service specifically directed at children.
12 For Our Indian Users
This Section applies to users and personnel located in India, where Orvera AI maintains an office in Pune. Orvera AI' processing of personal data relating to Indian residents is conducted in compliance with the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"). Orvera AI is monitoring the implementation of the Digital Personal Data Protection Act, 2023 ("DPDP Act") and will update its practices and this Privacy Policy as and when the DPDP Act and its implementing rules come into full force. For data protection inquiries from Indian users, please contact us at legal@orvera.ai.
13 Your California Privacy Rights
Orvera AI does not sell, trade, or otherwise transfer to outside third parties your "Personal Information" as defined under California Civil Code Section 1798.82(h). California Civil Code Section 1798.83 permits California residents to request information regarding disclosure of their Personal Information to third parties for direct marketing purposes. All such requests should be directed to legal@orvera.ai or Downtown Republic Centre, 325 North St. Paul Street, Suite 3100, Dallas, TX 75201. Orvera AI has a process in place to respond to such requests.
14 California Consumer Privacy Act (CCPA/CPRA)
This Section applies to California residents ("consumers" or "you") pursuant to the California Consumer Privacy Act of 2018 ("CCPA"), as amended by the California Privacy Rights Act of 2020 ("CPRA"). Orvera AI meets the CCPA threshold of possessing personal information of 50,000 or more consumers and will be offering services in California.
1. Right to Know.
You may request (up to twice per 12-month period) disclosure of: (i) the categories and specific pieces of personal information collected about you; (ii) categories of sources; (iii) business or commercial purposes; and (iv) categories of third parties with whom we share personal information.
2. Categories of Personal Information Collected.
For California residents, we collect the following categories: identifiers (name, email, telephone number, IP address, username and password); professional or employment-related information; education information; government identifiers (Social Security number, passport number, driver's license number, where applicable); financial information (payment card data via Stripe); geolocation data; internet and network activity information (browsing and interaction data); and inferences drawn from the above. PHI and sensitive government identifiers are collected only in the context of regulated enterprise deployments as described in Section 3(4).
3. Right to Delete.
Upon verifiable request, we will delete personal information we have collected about you and direct our service providers to do the same, subject to exceptions under the CCPA/CPRA (including information needed to complete transactions, detect security incidents, or comply with legal obligations).
4. Right to Correct.
You have the right to request correction of inaccurate personal information we maintain about you.
5. Right to Opt-Out.
Orvera AI does not sell personal information. Users may opt out of any disclosure of their information for third-party advertising purposes by emailing their request to legal@orvera.ai.
6. Right to Limit Use of Sensitive Personal Information.
To the extent Orvera AI processes sensitive personal information as defined under CPRA Section 1798.121, including Social Security numbers, passport numbers, driver's license numbers, and PHI, directly as a processor in connection with California residents, you have the right to direct Orvera AI to limit the use of such sensitive personal information to uses necessary to perform the services or provide the goods reasonably expected, or as otherwise permitted under CPRA.
7. Non-Discrimination.
We will not discriminate against you for exercising your CCPA/CPRA rights.
8. Sensitive Personal Information.
To the extent Orvera AI processes sensitive personal information (including government ID numbers, financial account information, and PHI) as defined under CPRA, such processing is performed solely as directed by enterprise customers as processor. Orvera AI does not use such information for purposes beyond those specified in the applicable DPA or enterprise agreement.
9. Contact.
Contact us at legal@orvera.ai or at the address in Section 27. We will respond within forty-five (45) days. We may require identity verification.
10. Persons Under Eighteen.
Orvera AI does not offer services to or allow persons under the age of 18 to use the Platform. We will not sell or share personal information of individuals under the age of 18.
15 Voice Recording and Wiretapping Law Compliance
Orvera AI' AI voice agents process live telephone, and VoIP calls on behalf of enterprise customers. Applicable federal and state laws govern the recording of telephone conversations. The Federal Electronic Communications Privacy Act (18 U.S.C. § 2511) requires at least one-party consent to record a call. Many states impose stricter all-party or two-party consent requirements, including California (Cal. Penal Code § 632), Illinois (720 ILCS 5/14-2), Florida (Fla. Stat. § 934.03), Connecticut, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania, and Washington.
Enterprise customers deploying Orvera AI' voice agents are solely responsible for:
1. Providing lawful notice and obtaining all required consents from end-customers prior to initiating or routing calls through the Platform;
2. Configuring the Platform to play appropriate recording disclosures at the outset of calls where required by applicable law; and
3. Ensuring compliance with all federal, state, and local call recording laws in every jurisdiction where calls are made or received.
Orvera AI can assist in implementing recording disclosure configurations and provide guidance on best practices. Enterprise customers should obtain independent legal counsel regarding their specific obligations. Orvera AI disclaims liability for enterprise customers' failure to comply with applicable call recording laws.
16 Telephone Consumer Protection Act (TCPA) And Do Not Call Compliance
The Telephone Consumer Protection Act (47 U.S.C. § 227) ("TCPA") restricts telemarketing communications and the use of automated telephone equipment, including autodialled calls, prerecorded voice messages, and artificial voice calls to mobile telephones. TCPA violations carry statutory damages of $500 per violation for negligent violations and up to $1,500 per wilful violation, with no statutory cap, making TCPA compliance a critical obligation for any enterprise deploying AI voice agents.
Enterprise customers deploying Orvera AI' voice agents for outbound calling are solely responsible for:
1. Obtaining prior express written consent from call recipients before initiating any autodialled or prerecorded calls or text messages to mobile phones, as required by the TCPA and applicable FCC regulations;
2. Ensuring that called numbers are not registered on the National Do Not Call Registry (www.donotcall.gov), applicable state Do Not Call registries, or the enterprise customer's own internal do-not-call list prior to initiating outbound calls;
3. Honouring do-not-call and opt-out requests promptly and maintaining internal do-not-call lists;
4. Complying with applicable calling hour restrictions (generally 8:00 a.m. to 9:00 p.m. local time of the called party under TCPA; stricter restrictions apply in some states); and
5. Ensuring that all required TCPA disclosures and consents are obtained prior to initiating any AI-driven call campaign through the Platform.
Orvera AI will cooperate with enterprise customers in implementing technically feasible compliance configurations and can provide guidance on best practices for consent capture and do-not-call list integration. Enterprise customers must obtain independent legal counsel regarding their specific TCPA obligations, including obligations under applicable FCC rules and any state-level equivalents. Orvera AI disclaims liability for enterprise customers' failure to comply with applicable TCPA, do-not-call, and telemarketing laws.
17 Children's Privacy (COPPA)
The Website and Platform are not directed to children under the age of 13, and Orvera AI does not operate a mixed-audience website or service. Consistent with the requirements of the Children's Online Privacy Protection Act (15 U.S.C. § 6501 et seq.) and its implementing regulations issued by the Federal Trade Commission (16 C.F.R. Part 312) (collectively, "COPPA"), this Section describes Orvera AI' practices with respect to the collection of personal information from children under 13.
For purposes of this Section, "personal information" has the meaning given to it in COPPA and the FTC's COPPA Rule (16 C.F.R. § 312.2), and includes: (i) first and last name; (ii) home or physical address, including street name and city or town; (iii) online contact information, including email address; (iv) telephone number; (v) social security number; (vi) a persistent identifier, such as a customer number, assigned cookie, IP address, or device serial number, that is associated with personal information; (vii) a photograph, video, or audio file containing a child's image or voice; (viii) geolocation information sufficient to identify street name and city or town; and (ix) information concerning the child combined with an identifier described above. The Website and Platform are enterprise-facing services intended solely for use by business professionals and organizations. Orvera AI does not market to, or knowingly solicit registrations or account creation from, children under 13. No section of the Website or Platform is directed to children under 13 as a primary audience.
Orvera AI does not knowingly collect, use, or disclose personal information from children under the age of 13, either through the Website or the Platform. Orvera AI does not allow third parties, including ad networks, analytics providers, or plug-ins, to collect personal information from children under 13 through the Website or Platform. Orvera AI does not condition a child's participation in any activity on the disclosure of more personal information than is reasonably necessary to participate in such activity.
Orvera AI' Platform processes real-time voice data on behalf of enterprise customers. Enterprise customers who deploy Orvera AI' AI voice agents in consumer-facing contexts must ensure that those deployments comply with COPPA where applicable, including by: (i) assessing whether their service is directed to children under 13 or has actual knowledge that a child under 13 is using the service; (ii) if so, obtaining verifiable parental consent before collecting any personal information (including voice recordings) from children under 13 through the Platform; and (iii) notifying Orvera AI prior to any deployment in a context that may involve children under 13 so that appropriate technical and contractual safeguards can be implemented. Enterprise customers bear sole responsibility for their COPPA compliance obligations in respect of their end-customers. Orvera AI disclaims liability for enterprise customers' failure to comply with COPPA.
Where Orvera AI has collected personal information from a child under 13 with verifiable parental consent, a parent or legal guardian of that child has the following rights under COPPA:
1. Right to Review. The right to review the personal information collected from their child and to request that Orvera AI provide a copy of any such information in its possession.
2. Right to Deletion. The right to request that Orvera AI delete the personal information collected from their child and to direct Orvera AI not to collect, use, or disclose further personal information from their child. Upon receiving a verified parental deletion request, Orvera AI will delete the personal information as promptly as practicable, subject to any legal retention obligations.
3. Right to Refuse Further Collection. The right to consent to Orvera AI' collection and use of their child's personal information while refusing to permit Orvera AI to disclose that information to third parties (except where disclosure is integral to the service being provided).
4. Right to Withdraw Consent. The right to withdraw parental consent at any time. Withdrawal will result in Orvera AI ceasing to collect, use, or disclose the child's personal information and, where continued access to the service requires collection of personal information, termination of the child's access to the service.
To exercise any rights relating to children’s personal information under applicable law, including the Children's Online Privacy Protection Act (COPPA), parents or legal guardians should contact the applicable Client/Operator that directly collected such information. Orvera AI processes children’s personal information solely as a Service Provider/Processor on behalf of its clients and does not independently collect or control such information as an Operator/Data Controller. Accordingly, Orvera AI will reasonably assist its clients in responding to verified parental rights requests in accordance with applicable law and contractual obligations.
If Orvera AI discovers or obtains actual knowledge that it has collected personal information from a child under 13 without verifiable parental consent, Orvera AI will: (i) immediately cease collecting, using, or disclosing any further personal information from that child; (ii) promptly delete or anonymize all personal information collected from that child, including any associated account data, unless retention is required to protect the safety of the child or others, or as required by applicable law; and (iii) notify the applicable enterprise customer if the personal information was collected through the Platform, so that appropriate steps can be taken. If you believe that Orvera AI has collected personal information from a child under 13, please contact us immediately at legal@orvera.ai.
18 Biometric Data
Certain AI voice processing features of the Platform, including voice pattern recognition, speaker identification, and AI-generated voiceprint analysis, may involve the processing of biometric identifiers or biometric information as defined under applicable law, including the Illinois Biometric Information Privacy Act (740 ILCS 14/1 et seq.) ("BIPA"), the Texas Capture or Use of Biometric Identifier Act (Tex. Bus. & Com. Code § 503.001), and comparable statutes in other states. Sub processors (when Orvera AI is acting as a data processor) including AssemblyAI, Cartesia AI, and RIME may process voice data in ways that generate or use biometric voice characteristics in the course of providing their services to Orvera AI.
Enterprise customers deploying voice features that may process biometric identifiers of their employees or end-customers are solely responsible for:
1. Providing required written disclosure and obtaining informed written consent from individuals prior to the collection of biometric identifiers or biometric information, as required by applicable law;
2. Establishing and publishing a publicly available written policy governing the retention schedule and guidelines for permanent destruction of biometric data, as required by BIPA and applicable state law; and
3. Complying with all applicable biometric privacy requirements in every jurisdiction where the Platform is deployed.
Orvera AI will cooperate with enterprise customers to implement technically feasible controls to support biometric data compliance. Enterprise customers must obtain independent legal counsel regarding their specific biometric privacy obligations. Orvera AI disclaims liability for enterprise customers' failure to comply with applicable biometric privacy laws, including BIPA, the Texas CUBI Act, and comparable statutes.
19 CAN-SPAM ACT OF 2003
Orvera AI collects email addresses to send information, respond to inquiries and requests, and send information and updates pertaining to orders. In compliance with the CAN-SPAM Act, Orvera AI will:
1. Not use false or misleading email subject lines or sender addresses;
2. Identify commercial messages as advertisements in a reasonable manner;
3. Include our physical address in all commercial email (see Section 27);
4. Monitor third-party email marketing services for compliance;
5. Honor opt-out and unsubscribe requests promptly; and
6. Include a clear opt-out or unsubscribe mechanism in every marketing email.
To opt out of receiving future emails from Orvera AI, please email us at legal@orvera.ai with your request to be removed from correspondence.
20 Third-Party Disclosure
Orvera AI does not sell, trade, or otherwise transfer personal information to outside parties, except as described in this Privacy Policy. We do not share personal information to enable third parties to market their products and services to users without user consent. We may share aggregated, non-personally identifiable visitor information with third parties for analytics, product improvement, or other legitimate business purposes.
We use sub processors (third parties who have access to personal information of our users to perform operational functions such as billing, hosting, and communications). All sub processors are bound by agreements, including DPAs where required, governing their access to and use of personal information. See Section 23 for our list of key sub processors. Information is shared with sub processors solely for the purpose of performing required tasks and is not used for any other purpose.
21 Google Analytics and Advertising
We use Google Analytics and have configured Google Ads on the Website (not currently running active advertising campaigns). We have implemented, or are exploring implementation of, the following Google advertising features: Remarketing with Google AdSense, Google Display Network Impression Reporting, Demographics and Interests Reporting, and DoubleClick Platform Integration.
By using these features, Orvera AI and Google may use first-party cookies and third-party cookies together to compile data about user interactions with the Website. Users may opt out of the Google Analytics Advertising Features using the Google Ads Settings at https://myadcenter.google.com or the Network Advertising Initiative opt-out tool at https://optout.networkadvertising.org. Orvera AI and Google will comply with all applicable advertising regulations.
22 Privacy And Third-Party Links
The Website may contain links to third-party websites, including integration partner sites. Orvera AI may, at its discretion, include or offer third-party products or services on the Website. These third-party sites have separate and independent privacy policies. Orvera AI has no responsibility or liability for the content or activities of linked sites. We encourage you to review the privacy policies of any third-party sites you visit.
23 List of Sub processors
Orvera AI uses the following sub processors in connection with the operation of the Platform and delivery of Services. All sub processors are bound by contractual data protection obligations, including DPAs where required by applicable law. Enterprise customers subject to a DPA may request an updated sub processor list at any time by contacting legal@orvera.ai.
List of Sub processors
Name of Sub processor Purpose Contact / Website
Name of Sub processor Stripe, Inc. Purpose Payment processing and subscription management Contact / Website info@stripe.com | 510 Townsend St, San Francisco, CA 94103
Name of Sub processor Cal.com, Inc. Purpose Scheduling and calendar integration Contact / Website https://cal.com/privacy | 2261 Market St, San Francisco, CA 94114
Name of Sub processor Google LLC (Google Analytics) Purpose Website analytics Contact / Website https://policies.google.com/privacy
Name of Sub processor Microsoft Corporation (Microsoft Clarity) Purpose Website behaviour analytics Contact / Website https://privacy.microsoft.com | 1 Microsoft Way, Redmond, WA 98052
Name of Sub processor LinkedIn Insights Purpose Lead Tracking Contact / Website https://www.linkedin.com/legal/l/cookie-table#security https://www.linkedin.com/legal/sas-terms
Name of Sub processor CookieYes Purpose Cookie Consent Management platform Contact / Website https://www.cookieyes.com/privacy-policy/?ref=cypbcyb&utm_source=cookie-banner&utm_medium=fl-branding
This list is updated periodically. Orvera AI will notify enterprise customers of any material changes to its sub processor list in accordance with applicable DPA terms.
24 Gramm-Leach-Bliley Act and Insurance Privacy Compliance
Orvera AI serves insurance carriers, benefits administrators, and other financial services enterprises. To the extent Orvera AI processes non-public personal financial information ("NPI") on behalf of financial institutions as defined under the Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.) ("GLB Act") and the FTC's Privacy Rule (16 C.F.R. Part 313), Orvera AI acts as a service provider to those financial institutions and processes NPI solely as directed by and under the contractual terms agreed with the applicable enterprise customer. Enterprise customers that are financial institutions subject to the GLB Act are responsible for:
1. Providing their own customers with required GLB Act privacy notices describing the collection, use, and disclosure of NPI;
2. Obtaining required opt-out consents where applicable;
3. Ensuring that their agreements with Orvera AI satisfy GLB Act safeguarding requirements for service providers; and
4. Complying with applicable state insurance privacy regulations, including the NAIC Insurance Information and Privacy Protection Model Act and comparable state-level insurance privacy statutes.
Orvera AI implements and maintains a comprehensive information security program designed to protect the security, confidentiality, and integrity of NPI in accordance with the FTC Safeguards Rule (16 C.F.R. Part 314), as amended. Enterprise customers in the insurance and financial services sector should contact legal@orvera.ai to discuss compliance requirements and available contractual documentation.
25 Copyright Infringement / DMCA NOTICE
If you believe that content on our website infringes your copyright, please provide our designated Copyright Agent with a written DMCA Takedown Notice containing:
1. Your physical or electronic signature;
2. Identification of the copyrighted work(s) claimed to have been infringed;
3. Identification of the allegedly infringing material and its location on the Website;
4. Your address, telephone number, and email address;
5. A statement of good faith belief that the use is not authorized by the copyright owner, its agent, or the law; and
6. A statement, under penalty of perjury, that the information is accurate and that you are authorized to act on behalf of the copyright owner.
Send DMCA Takedown Notices to legal@orvera.ai, Attn: DMCA Notice, Callbotics LLC, Downtown Republic Centre, 325 North St. Paul Street, Suite 3100, Dallas, TX 75201.
26 Modifications To This Privacy Policy
We reserve the right to update this Privacy Policy at any time. Changes will be posted on our website with a revised date. We notify users of any privacy policy changes via the Privacy Policy page. Where required by applicable law, we will provide direct email notification of material changes. Enterprise customers should review their applicable DPA for change notification terms specific to Customer Platform Data processing.
27 Contact Us
To ask questions about this Privacy Policy, exercise your data rights, or raise privacy concerns, contact us at:
Privacy/Legal Officer Callbotics LLC doing business as Orvera AI
Downtown Republic Centre, 325 North St. Paul Street, Suite 3100, Dallas, TX 75201
Email: legal@orvera.ai
Phone: +1 (214) 884-8489
Website: orvera.ai
BY USING OUR WEBSITE OR SERVICES, YOU HAVE AGREED TO AND ACCEPTED THE PRACTICES DESCRIBED IN THIS PRIVACY POLICY. IF YOU DO NOT AGREE, PLEASE DO NOT USE OUR WEBSITE OR SERVICES.