Last updated: April 29, 2026
Effective date: April 29, 2026
This Privacy Policy applies to visitors of the Interoperly public marketing website at interoperly.com. It explains what information we collect when you visit this site, why we collect it, who we share it with, and the rights you have over your information.
This policy applies to interoperly.com only. The Interoperly clinical platform (operating at console.interoperly.com, app.interoperly.com, and api.interoperly.com) handles Protected Health Information under separate HIPAA-governed privacy controls. If you are a patient using the Interoperly app, the privacy notice applicable to your use of the app will be presented to you through the app at the time of onboarding.
Interoperly LLC ("Interoperly," "we," "us," "our") is a Delaware limited liability company that operates the Interoperly clinical decision intelligence platform. For purposes of GDPR, we are the data controller for personal data collected on this website. To exercise your privacy rights or to contact us about this policy, write to privacy@interoperly.com. A business mailing address for written privacy requests will be added to this policy before activation of visitor analytics, tracking technologies, or contact-form data intake. Until then, privacy@interoperly.com is the sole method for privacy requests on this site.
When you visit interoperly.com, we collect a limited set of information necessary to operate, secure, and improve the site:
3.1 Standard web request data. Our hosting provider (Vercel, listed in the Vendor Disclosure Table in Section 6) automatically logs incoming HTTP requests, including: IP address, user agent string, requested URL, HTTP referer, response status, and timestamp. These logs are used for security, abuse prevention, and operational diagnostics.
3.2 Information you provide voluntarily. If you submit a form on this site (when contact-form intake is launched in a future update), the information you provide (such as your name, work email, company name, job title, and message) is transmitted to Interoperly and stored in our managed Postgres database operated by Neon (listed in the Vendor Disclosure Table in Section 6). At the time of this policy's effective date, no contact form is active on this site.
3.3 Browser-level information necessary for site function. Your browser language preference (used to render appropriate content) and any consent choices you record (when the cookie banner is launched in a future update) are stored locally in your browser.
You are not required to provide voluntary inquiry information through this site. If you choose not to provide it, we may not be able to respond to your inquiry or evaluate a potential business relationship.
The Interoperly public marketing site is designed to be a PHI-free zone through strict operational and technical controls. We do not request, collect, process, or transmit Protected Health Information (PHI) as defined by the Health Insurance Portability and Accountability Act (HIPAA) at 45 CFR 160.103 through this website.
Specifically, on interoperly.com:
If a visitor unintentionally includes health-information-like content in a free-text field on a future contact form, our automated handling flags the submission, excludes it from any analytics-vendor sync, and routes it to privacy@interoperly.com for manual review and redaction. This handling is described further in our internal Free-Text Hygiene Procedure.
Our clinical platform handles PHI under separate HIPAA-governed controls. That platform is not in scope for this policy.
We process the information described in Section 3 for the following purposes, with the following legal bases under GDPR Article 6:
5.1 Site operation and security. To deliver this website to your browser, defend against abuse, and diagnose operational issues. Legal basis: legitimate interests (Article 6(1)(f)) in operating a secure public-facing website.
5.2 Responding to inquiries. To answer questions you submit through a contact form (when launched). Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b)).
5.3 Improving our site and content. To understand which content resonates with visitors and improve future content. Legal basis: consent (Article 6(1)(a)) where required, or legitimate interests (Article 6(1)(f)) for non-personal aggregate measurement. Analytics vendors named as Planned in Section 6 will activate only after consent infrastructure is in place.
5.4 Sales and outreach. To identify organizations that may benefit from Interoperly and reach out about our services. Legal basis: consent (Article 6(1)(a)) where required, or legitimate interests (Article 6(1)(f)). Identification and enrichment vendors named as Planned in Section 6 will activate only after consent infrastructure is in place.
The following table identifies vendors who may receive personal data from this site. Vendors marked Active currently receive data; vendors marked Planned will only receive data after a separate Data Processing Agreement is executed and consent infrastructure is in place.
| Vendor | Service | Data Received | Status | DPA Basis | Residency |
|---|---|---|---|---|---|
| Vercel, Inc. | Static site hosting and edge delivery | Standard web request logs (IP, user agent, request path, timestamp) | Active | Vercel standard DPA | US (multi-region edge) |
| GitHub, Inc. | Source code hosting and deploy triggers | No visitor data; source code only | Active | GitHub Customer DPA | US |
| Neon, Inc. (subsidiary of Databricks, Inc.) | Managed Postgres for visitor inquiry data | Will receive contact-form submissions (name, work email, company, role, message) once the contact form launches in a future update. No data flowing today. | Active infrastructure; no visitor inquiry data flowing until contact form launch | In force by reference via the Neon Platform Services Product Specific Schedule (effective April 25, 2026), which incorporates Neon-specific modifications to the Databricks Data Processing Addendum. | aws-us-west-2 (Oregon, USA) |
| PostHog, Inc. | Product analytics and visitor behavioral analytics | When activated: pageviews, session duration, scroll depth, asset downloads, form completion events. No form input contents. No data flowing today. | Planned, not yet active | Pending vendor onboarding and DPA execution | TBD at vendor onboarding |
| Microsoft Corporation | Session replay and heatmap analytics (Microsoft Clarity) | When activated: DOM interactions with input masking enabled and data-private redaction on text fields. No data flowing today. | Planned, not yet active | Pending vendor onboarding and DPA execution | US |
| LinkedIn Corporation | Conversion tracking and audience insights (LinkedIn Insight Tag) | When activated: pageview signals tied to LinkedIn member matching. No data flowing today. | Planned, not yet active | Pending vendor onboarding and DPA execution | US |
| RB2B, Inc. | Visitor identity resolution (firmographic) | When activated: reverse-IP-derived company and role enrichment of identified visitors. No data flowing today. | Planned, not yet active | Pending vendor onboarding and DPA execution | US |
| Apollo.io, Inc. | Sales intelligence and visitor enrichment | When activated: firmographic enrichment from public business databases. No data flowing today. | Planned, not yet active | Pending vendor onboarding and DPA execution | US |
We organize cookies and similar technologies into the following categories:
As of the effective date of this policy, only Strictly necessary cookies are in use. We will introduce a consent banner before activating any cookie or tracking technology in the Functional, Analytics, or Marketing categories.
Interoperly is based in the United States. The personal data we collect through this website is processed and stored in the United States by the vendors named in Section 6. If you access this site from outside the United States, your information will be transferred to and processed in the United States.
For visitors located in the European Economic Area or the United Kingdom, we rely on Standard Contractual Clauses adopted by the European Commission as the legal mechanism for cross-border transfers to our processors, in addition to any vendor-specific safeguards documented in our Data Processing Agreements.
We retain personal data only as long as necessary for the purposes described in Section 5:
If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights with respect to personal data we process about you:
To exercise these rights, write to privacy@interoperly.com. We respond within 30 days as required by GDPR Article 12(3).
If you are a California resident, you have the following rights with respect to personal information we process about you:
Interoperly does not sell personal information. As of April 29, 2026, Interoperly does not share personal information for cross-context behavioral advertising. Future activation of audience-insight or marketing-attribution vendors named as Planned in the Vendor Disclosure Table in Section 6 will be disclosed in an updated version of this policy and will be consent-gated through the cookie banner that will accompany those activations.
Interoperly does not knowingly collect or request Sensitive Personal Information as defined under CPRA on this site. We do not request health information, precise geolocation, government identifiers, racial or ethnic origin, religious beliefs, sexual orientation, or biometric identifiers through our website forms or analytics.
We will honor recognized opt-out preference signals, including the Global Privacy Control (GPC), when technologies subject to such opt-out rights are activated. Because we do not currently sell or share personal information for cross-context behavioral advertising, there is no opt-out preference signal workflow active on this site today.
To exercise these rights, write to privacy@interoperly.com. We respond within 45 days, with a possible 45-day extension as permitted under CPRA. Before fulfilling a request, we may need to verify your identity to a degree of certainty appropriate to the request type.
This site is not directed to children under 13 (or the equivalent minimum age in the relevant jurisdiction), and we do not knowingly collect personal information from children under that age. If you believe we have inadvertently collected information from a child, please contact privacy@interoperly.com so we can delete it.
This website is protected by industry-standard transport and delivery controls, including:
Our clinical platform, which is out of scope for this policy, is protected by separate HIPAA-governed controls.
Where we transmit personal data to a vendor acting as a processor, we maintain a Data Processing Agreement governing that relationship. The Vendor Disclosure Table in Section 6 names the legal counterparty and DPA basis for each vendor.
For Neon, our managed Postgres provider, the DPA is in force by reference via the Neon Platform Services Product Specific Schedule executed April 25, 2026, which incorporates Neon-specific modifications to the Databricks Data Processing Addendum maintained at https://www.databricks.com/sites/default/files/legal/dpa-20230721.pdf.
For Vercel and GitHub, our hosting and source-control providers, we rely on each vendor's standard data-processing terms for the services in use.
For analytics and marketing vendors named in Section 6 as Planned, no data is flowing to them today. Each will be activated only after appropriate data-processing terms are in place and recorded in our vendor registry. The Vendor Disclosure Table will be updated and a notice posted on this page before any such activation.
For all privacy inquiries, including to exercise your rights under GDPR or CPRA, please write to privacy@interoperly.com. We aim to acknowledge requests within 5 business days and respond substantively within the timelines specified in Sections 10 and 11.
A business mailing address for written privacy requests will be added to this policy before activation of visitor analytics, tracking technologies, or contact-form data intake. Until then, privacy@interoperly.com is the sole method for privacy requests on this site.
Before fulfilling a substantive request, we may ask you to verify your identity through information already in our possession or through a verifiable email exchange.
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" and "Effective date" lines at the top of this page. For material changes, including the activation of any new vendor that processes personal information, we will post an in-page notice at least 30 days before the change takes effect.