Privacy Policy

This policy applies to our website and marketing activities, customer accounts, customer content, support and sales conversations, and other communications with us.

For customer content, we generally act as a service provider or processor and handle information on our customers’ instructions and under our agreements with them. For account administration, billing, website operations, security, and marketing, we may act as a controller or business under applicable privacy laws.

If your information appears in content submitted by a customer, that customer generally determines how it is used. Requests relating to that information should normally be directed to the relevant customer.

Information you provide

• Name, work contact details, job title, and employer
• Account, authentication, billing, and administration information
• Support requests, demo requests, feedback, and other communications

Payment information may be processed by third-party payment providers.

Customer content

At our customers’ direction, the Services may process documents, records, structured data, and other information customers upload or connect. Depending on what a customer submits, this may include names, contact information, identifiers, correspondence, operational records, or health-related information.

Technical information

We may collect IP addresses, browser and device information, application logs and timestamps, authentication and security events, and feature usage information.

Cookies

We use cookies and similar technologies to operate the Services, remember preferences, and understand how our website is used. Where required by law, we obtain consent for non-essential cookies and provide appropriate choices.

We may use personal information to:

• Provide, operate, maintain, secure, and improve the Services
• Authenticate users, administer accounts, and manage billing
• Process customer content and generate customer-requested outputs
• Provide support and manage customer relationships
• Prevent security incidents, fraud, and misuse
• Communicate about our products and services
• Meet legal, regulatory, tax, accounting, and other obligations

AI processing

The Services use artificial intelligence and machine learning to process customer content and provide requested functionality. We do not use customer content to train or fine-tune general-purpose AI models. Third-party AI providers that process customer content act as subprocessors under applicable contractual protections.

Health information

Some customers may submit protected health information or other health-related information. Where Cora Labs acts as a business associate under HIPAA, we process protected health information in accordance with the applicable Business Associate Agreement and HIPAA requirements.

We may share personal information with:

• Service providers and subprocessors, including cloud infrastructure, AI, email, monitoring, and analytics providers
• Professional advisors, including lawyers, accountants, and auditors
• Authorities or other third parties where required by law
• A successor or potential successor in connection with a financing, merger, acquisition, reorganization, or sale of assets

Our service providers and subprocessors are subject to contractual obligations appropriate to their services. A current subprocessor list is available on request. Where permitted by law, we may notify affected customers of legal requests relating to their content.

We do not sell personal information or customer content, or share personal information for cross-context behavioral or targeted advertising.

We maintain administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, and disclosure. Our safeguards take into account the nature of the information and the risks associated with processing it. More information about our security practices is available on request.

We retain personal information for as long as reasonably necessary to provide the Services, meet legal obligations, resolve disputes, and enforce agreements. Customer content is retained and deleted according to customer instructions and applicable agreements. Certain records may be retained for legal, tax, accounting, security, or compliance purposes.

Cora Labs is based in the United States. We and our service providers may process personal information in the United States and other countries. Where required by law, we use safeguards for international transfers, including the European Commission’s Standard Contractual Clauses and applicable UK transfer mechanisms.

Depending on where you live, you may have the right to access, correct, delete, or obtain a copy of your personal information; object to or restrict certain processing; withdraw consent; or opt out of certain uses. We may need to verify your identity before responding.

If your information was provided by one of our customers, we may refer your request to that customer. Where applicable, you may appeal our decision or lodge a complaint with your local data protection authority. You may unsubscribe from marketing emails using the link in the message.

EEA and UK

Where the GDPR or UK GDPR applies, our legal bases may include performing a contract; our legitimate interests in operating and securing the Services and conducting business-to-business marketing; compliance with legal obligations; and consent, where required. You may object to processing based on legitimate interests.

U.S. states

Certain U.S. state privacy laws may provide additional rights. Where applicable, you may exercise them using the process described here.

To exercise your rights, email privacy@coralabs.ai.

The Services are intended for professional use and are not directed to children. We do not knowingly collect personal information directly from children through our website or Services. Information about minors in customer-submitted content is treated as customer content.

We may update this Privacy Policy from time to time. When we do, we will update the date at the top of this page and, where appropriate, provide additional notice of material changes.