EverHealth Front Office Plus · Powered by Nimblr.ai

Privacy Policy

Last updated: September 21, 2026

Privacy Policy

This Privacy Policy explains how EverHealth Solutions, Inc. (“EverHealth,” “we,” “us,” or “our”) collects, uses, discloses, and protects information in connection with EverHealth Front Office Plus (the “Service”). The Service is an EverHealth-branded patient engagement and front-office automation solution powered by technology provided by Nimblr, Inc. (“Nimblr”).

This Privacy Policy applies to healthcare providers, medical practices, their authorized users, patients who communicate through the Service, and visitors to Service-related webpages. It should be read together with the applicable agreement between EverHealth and the healthcare provider or practice (the “Customer”).

1. Our roles

The Customer owns and controls the patient, appointment, scheduling, and communications data submitted to or processed through the Service (“Customer Data”).

When Customer Data includes protected health information (“PHI”) regulated by the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”), the Customer is generally the covered entity, EverHealth acts as its business associate, and Nimblr acts as EverHealth’s subcontractor business associate and underlying technology provider. The applicable Business Associate Agreement (“BAA”) controls our handling of PHI. If this Privacy Policy conflicts with the BAA regarding PHI, the BAA controls.

EverHealth controls the Customer’s commercial relationship, contracting, billing, account management, and first-level support. Nimblr operates and supports the underlying technology on EverHealth’s behalf.

This Privacy Policy is not a healthcare provider’s Notice of Privacy Practices. Patients should contact their healthcare provider for information about that provider’s privacy practices and the exercise of rights concerning medical records.

2. Information we collect

Depending on how the Service is used, we may collect or process:

Account and professional information: names, business contact details, job titles, organization names, usernames, authentication information, and account preferences.
Patient and appointment information: names, contact details, appointment details, scheduling preferences, provider information, and other information supplied by a Customer or patient.
Communications information: the content and metadata of calls, voicemail, SMS, MMS, and other messages processed through the Service, including dates, times, telephone numbers, delivery status, consent status, and opt-out requests. Calls may be recorded or transcribed when configured by the Customer and permitted by law.
Integration information: data exchanged with DrChrono and other integrations enabled by the Customer, including scheduling, workflow, and configuration data.
Billing and customer relationship information: subscription, invoice, transaction, support, and customer success records maintained by EverHealth. Payment card information may be processed by payment service providers rather than stored directly by us.
Device, log, and usage information: IP address, browser and device type, operating system, access times, pages or features used, error logs, diagnostic information, and security events.
Cookies and similar technologies: information used for authentication, security, preferences, service operation, and analytics. We do not use PHI for targeted advertising.
Information from other sources: information received from the Customer, its authorized users, integrations, service providers, or public sources as permitted by law.

Customers and authorized users are responsible for ensuring that Customer Data is accurate and that they have the authority, notices, and consents necessary to provide it to the Service.

3. How we use information

We use information as reasonably necessary to:

Provide, configure, operate, maintain, and support the Service.
Schedule, confirm, reschedule, and cancel appointments and perform Customer-configured patient engagement workflows.
Process calls, messages, and other communications on the Customer’s behalf.
Authenticate users and administer accounts.
Integrate the Service with DrChrono and other Customer-authorized systems.
Provide customer support and resolve technical issues.
Measure usage, prepare billing and operational reports, and manage the Customer relationship.
Monitor availability, performance, quality, safety, and security.
Prevent fraud, abuse, unauthorized access, and other harmful activity.
Comply with legal, regulatory, contractual, and healthcare compliance obligations.
Enforce applicable agreements and protect the rights, safety, and property of EverHealth, Nimblr, Customers, patients, and others.

We do not sell Customer Data or PHI. We do not use identifiable Customer Data or PHI to train artificial intelligence models.

Where permitted by the applicable BAA and law, Nimblr may create or use aggregated or de-identified information that does not identify EverHealth, a Customer, an authorized user, or a patient. Such information may be used to operate, secure, analyze, benchmark, develop, and improve the Service and its artificial intelligence models. We do not attempt to re-identify information that has been de-identified in accordance with applicable law.

4. Artificial intelligence

The Service uses artificial intelligence, speech recognition, and automated workflows to assist with patient communications and scheduling. Information submitted to these features may be processed by approved technology providers solely to provide and support the Service and subject to contractual privacy, security, and confidentiality requirements.

Artificial intelligence output may be incomplete or inaccurate and should be reviewed when appropriate. The Service does not provide medical advice, diagnosis, treatment, or emergency services and should not be used as a substitute for professional judgment.

5. Calls, text messages, and email

The Service may contact patients on a Customer’s behalf through calls, SMS, MMS, email, or other enabled channels for appointment-related and other Customer-configured purposes.

The Customer is responsible for obtaining and documenting any consent required to contact an individual, including prior express written consent where required, and for providing all legally required notices. The Service maintains features designed to process consent status and opt-out requests as configured by the Customer.

To stop text messages, reply STOP. We may send a confirmation and may ask which messaging program the recipient wishes to stop if the telephone number is enrolled in more than one program. For help, reply HELP or contact the applicable healthcare provider. Message frequency varies, and message and data rates may apply. Opting out may limit certain Service functionality but does not prevent a healthcare provider from contacting a patient through other lawful means.

Electronic communications may travel through third-party telecommunications networks. We use reasonable safeguards, but no communications network can be guaranteed to be completely secure.

6. How we disclose information

We may disclose information:

To the Customer and its authorized users: to provide the Service and make communications, appointment activity, and reports available to the applicable healthcare provider or practice.
To Nimblr: as the underlying technology provider and, when PHI is involved, EverHealth’s subcontractor business associate.
To service providers and subprocessors: for hosting, telecommunications, integrations, support, security, analytics, payment processing, and other functions necessary to provide the Service. Such providers may use information only to perform services for us and are subject to appropriate contractual restrictions.
To Customer-authorized integrations: when the Customer enables an integration or directs us to exchange information with another service.
For legal and safety reasons: when required by law or legal process, or when reasonably necessary to protect rights, safety, security, and property. Where legally permitted, we review requests and seek to limit disclosures to what is required.
In a business transaction: in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to applicable confidentiality, privacy, and HIPAA requirements.
With consent or at the Customer’s direction: for another disclosed purpose authorized by the relevant party.

Subcontractors that create, receive, maintain, or transmit PHI on our behalf must agree in writing to applicable HIPAA restrictions and safeguards.

We do not disclose an End Customer’s name, logo, or identifiable information for a case study, testimonial, or public customer reference without prior written consent.

7. HIPAA and healthcare information

We use and disclose PHI only as permitted by the applicable BAA, to provide the Service, for permitted management and administration purposes, or as required by law. We apply the minimum-necessary standard where required and maintain administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of PHI.

PHI processed for the Service is not transmitted to, received by, stored at, accessed from, or made available at a location outside the United States, except where expressly authorized in writing under the applicable BAA and subject to applicable privacy and security requirements.

Requests to access, amend, restrict, or obtain an accounting of disclosures of PHI should be directed to the patient’s healthcare provider. We assist the Customer in responding to such requests as required by HIPAA and the applicable BAA.

8. Security

EverHealth and Nimblr maintain administrative, technical, and physical safeguards reasonably designed to protect information against unauthorized access, acquisition, use, disclosure, alteration, and destruction. These safeguards include access controls, monitoring, incident response procedures, workforce training, and contractual controls for relevant service providers.

No system is completely secure. Customers and authorized users must protect their credentials, use appropriate access controls, keep account information current, and promptly report suspected unauthorized access.

If we confirm a security incident involving Customer Data or PHI, we will investigate, mitigate, and notify affected Customers or other parties as required by applicable law and contractual obligations.

9. Data retention, return, and deletion

We retain information for as long as reasonably necessary to provide the Service, comply with law and contractual obligations, resolve disputes, maintain security and business records, and enforce agreements.

Following termination of the Customer’s Service, Customer Data may be exported and deleted in accordance with the Customer agreement and BAA. Limited information may remain in backups or be retained when required by law, regulatory obligations, litigation holds, security requirements, or documented retention policies. Any retained information remains subject to applicable confidentiality and security obligations.

10. Cookies and analytics

Service-related webpages may use cookies, local storage, and similar technologies for authentication, security, preferences, performance, and analytics. Browser settings may allow users to block or delete cookies, but doing so may prevent certain Service features from functioning.

We do not use PHI for cross-context behavioral advertising. Where applicable law treats particular analytics technologies as a “sale” or “sharing” of personal information, we provide legally required choices.

11. Privacy rights

Depending on where an individual resides and subject to applicable exceptions, the individual may have rights to request:

Access to or a copy of personal information.
Correction of inaccurate personal information.
Deletion of personal information.
Information about categories of information collected, sources, purposes, and recipients.
Restriction of or objection to certain processing.
Portability of certain information.
Withdrawal of consent where processing is based on consent.

We do not discriminate against an individual for exercising a privacy right.

For personal information controlled by a healthcare provider, including medical records and appointment information, contact that provider directly. If we receive a request concerning Customer-controlled information, we may refer the request to the Customer. Requests concerning EverHealth-controlled information may be sent to privacy@drchrono.com. We may verify identity and authority before responding.

Certain information, including PHI and information maintained under HIPAA, may be exempt from state consumer privacy laws such as the California Consumer Privacy Act. Rights concerning PHI are addressed through HIPAA and the applicable healthcare provider.

12. Children

The Service is intended for use by healthcare organizations and authorized adult users. It is not directed to children for independent account registration. Information about minors may be processed on behalf of a healthcare provider as part of providing healthcare-related services and is handled under the Customer’s instructions, applicable law, and the BAA.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version and revise the “Last updated” date. If required by law, we will provide additional notice of material changes. Changes do not reduce protections that apply to PHI under a BAA without an appropriate written amendment.

14. Contact us

For questions or requests concerning this Privacy Policy, contact:

EverHealth Solutions, Inc.
Attn: Privacy
328 Gibraltar Drive
Sunnyvale, CA 94089
Email: privacy@drchrono.com
Telephone: (844) 569-8628

For support, billing, appointment, or medical-record questions, contact the applicable healthcare provider or EverHealth support through the support channel provided with the Service.

Last updated: September 21, 2026