Privacy Notice

The AOR Wound-Care Readiness Assessment™ evaluates business, operational and documentation readiness at the program level. It is not designed, intended or configured to receive protected health information (PHI).

Do not submit patient names, dates of birth, photographs of patients, diagnoses tied to an identifiable individual, medical record numbers, insurance member identifiers, Social Security numbers or any other patient identifier in any field of this site.

Automated pattern detection is applied as a precaution to free-text fields. Pattern detection is not a compliance control and does not guarantee HIPAA compliance. Responsibility for avoiding PHI submission remains with the submitting organization.

• Business contact information such as contact name, professional title, business email address and business telephone number.
• Organizational information such as legal and display name, website, organization type, number of locations, primary region and service areas.
• Credential-related information such as National Provider Identifier (NPI), primary specialty, states of licensure, places of service and Medicare or Medicare Advantage participation status, as provided by you.
• Assessment responses describing program volume, clinical capability, documentation practices, products, technology, goals and timelines.
• Communication preferences and consent selections, including the version of the consent language presented to you.
• Technical and device information such as browser type, operating system, approximate region, referring pages and interaction events.
• Cookie and similar storage identifiers, as described in the Cookie Policy.

We store a one-way hashed representation of the network address associated with a consent event, and a short summary of the browser user agent, solely as evidence of when a consent choice was recorded.

NPI and credential information is collected as business identification supplied by the organization. Format checks confirm only that an NPI contains ten digits. Format checking is not verification, validation or endorsement of any credential, licensure status or enrollment.

• Generating a preliminary, non-clinical readiness profile from the responses submitted.
• Responding to inquiries and arranging requested consultations.
• Evaluating whether an organization may be a fit for AOR programs and services.
• Maintaining records of consent, communication preferences and internal follow-up activity.
• Operating, securing, troubleshooting and improving this website.
• Meeting applicable legal, recordkeeping and internal governance obligations.

Where analytics is enabled, AOR collects aggregate interaction events using an allowlist of named events. Assessment answers, free-text responses, consent selections, contact details, NPI, license information, database identifiers and secure session tokens are never included in analytics or advertising payloads.

Assessment content is never placed in page URLs and is not written to browser console logs or error-monitoring payloads.

AOR uses third-party providers for website hosting, application infrastructure, database services, authentication and, where enabled, analytics and business communications. Providers act on documented instructions for the purposes described above.

A current list of categories of service providers is available on request using the contact method below.

• Transport encryption for data in transit and encryption at rest provided by the underlying platform.
• Row-level access rules on stored records, with deny-by-default behavior.
• Role-based internal access, restricted to authorized AOR personnel and scoped to assignment.
• Server-side validation, rate limiting and short-lived, hashed assessment session tokens.
• Privileged credentials held server-side only and never exposed in front-end code.
• Audit logging of privileged changes to internal records.

No method of transmission or storage can be guaranteed to be completely secure. AOR does not represent that information can never be intercepted or accessed without authorization.

Retention periods are configurable by record type, including incomplete assessments, submitted inquiries, consent records, audit logs and disqualified or removed records. Automatic deletion is not active and will not be activated until an authorized AOR administrator approves a retention schedule. Consent and audit records are retained as evidence of the choices recorded.

Business email, telephone and SMS preferences are recorded separately. SMS requires separate express consent and is never pre-selected. Preferences can be changed at any time using the contact method below. See the Communications Consent page for details.

Where applicable law provides such rights, an authorized representative of a submitting organization may request access to, correction of, or deletion of business information associated with their organization. Requests are verified before action, and some records — such as consent evidence and audit logs — may be retained where retention is required or legitimate.

AOR Medical Solutions operates from and serves organizations in Florida and Puerto Rico, with expansion to additional United States jurisdictions. Information submitted through this site is processed in the United States.

Questions about this notice, or requests relating to business information, may be submitted through the contact section of this website. A dedicated privacy contact address will be published following final legal review.