Legal · Effective November 2, 2026

Privacy policy

What information Attria handles, why, and how we protect it.

This version takes effect on November 2, 2026. Earlier versions apply until that date, and each one stays at its own dated link.

ATTRIA LLC ("Attria", "we") runs Attria, a service that shows healthcare practices which of their marketing brings in new patients. This policy covers the Attria app, our website at attria.ai, and the ways people reach us, such as sales calls, demos, support and events. It explains what information we handle, how we use it and what choices you have. Where it says patients, it also means the people a practice calls clients. If you don't agree with it, please don't use Attria or our website. Send questions to privacy@attria.ai.

Summary

  • What we collect: information practices send through Attria about their patients and callers, information you give us, such as your name and email, and information your browser sends when you visit, such as your IP address.
  • Sensitive information: patient information reaches us only for a practice, under its business associate agreement, and we use it only to run Attria for that practice.
  • Where it comes from: from you, from your practice, and from the systems your practice connects, such as its practice management system and ad accounts.
  • How we use it: to run, secure and improve Attria, to support you, to tell you about Attria, and to meet the law.
  • Who gets it: your practice, the vendors that run Attria for us, and others only as this policy describes.
  • Keeping it safe: we protect it with care, but no system online can be guaranteed to be completely secure.
  • Your rights: depending on where you live, you may have rights to see, correct or delete your information. Email privacy@attria.ai.

Two roles

We handle information in two different roles.

  • For healthcare practices, we are a service provider. We handle information about their patients, the people who call or text their tracking numbers, and visitors to their websites, only on the practice's instructions. When that information is protected health information, we are the practice's business associate under HIPAA and bound by a business associate agreement. A practice HIPAA does not cover, such as a veterinary practice, gets the same agreement as a contract. The practice's own privacy notice governs that information, so patients should take questions about it to their practice.
  • For people who sign in to Attria, visitors to our website and people who contact us, we decide how the information is used, and this policy applies directly.

What we collect for practices

  • Calls to a practice's tracking numbers: the caller's number and caller ID name, call times and length, and recordings once the practice turns recording on. We record nothing until the practice chooses to record, and it can turn recording off again. With recording on, recording starts when the office answers, and we play nothing on the line. A practice can turn on a "This call may be recorded" notice, which then plays before its office line rings. With the notice on, recording starts before the notice and includes the time spent waiting for an answer, even if the office never answers. We transcribe answered calls' recordings to find details such as whether an appointment was booked or the office's voicemail took the call. Recordings of unanswered calls stay with our phone vendor and are not transcribed.
  • Texts to tracking numbers: the sender's number, the message and the time.
  • Website visits and forms: when a practice adds our snippet to its website, we record the page a visitor lands on, the ad that sent them, such as UTM tags and ad click ids, and what they submit in a form. We drop card numbers, Social Security and insurance member numbers, file names, and answers to medical-history questions, such as medications, allergies, conditions or past surgeries, with their follow-ups. Anything else a visitor types, such as a message about their visit, is kept as written. The snippet keeps a random visitor id in a cookie named _attria_visitor on the practice's website for 180 days, with _attria_visitor_at holding when it last wrote that id. On Safari and other WebKit browsers it also keeps _attria_cookie_cal, a timestamp, for 30 days, to learn how long the browser keeps its cookies. On an office device the practice marks as its own, it keeps _attria_internal and _attria_internal_at for 400 days, so staff visits are left out. It sets a test cookie, _attria_probe, and deletes it at once to find which domain to use. While a tab is open, it keeps the tab's landing details, a short record of its recent form submits and any form not yet sent in that tab's session storage, which the browser clears when the tab closes; an unsent form is dropped after an hour. We don't store visitors' IP addresses with their visits.
  • Practice records: we read patients, appointments, procedures and payments from the practice's management system.
  • Ad accounts: with the practice's permission, we read ad spend and campaign results from Google Ads and Meta, and lead details from Google Local Services. A practice, its agency or our staff can connect these accounts.
  • Marketing bills: a practice can ask the companies that bill it for marketing to copy a private Attria email address on their bills. We keep each email and any PDF sent to that address, and record the sender, subject, date, kind of bill, amount and month, so the practice's reports can count what it spent.

What we collect about you

When you sign in to Attria, visit our website or contact us, we collect:

  • What you give us: your name, email address, phone number, job title and practice, and anything you write to us. Your password is held by our sign-in provider, not by us.
  • Your account: the practice you belong to and your role there.
  • Security records: when you sign in and out, your IP address and browser, and a log entry each time you open patient information.
  • What your browser sends: your IP address, browser and device type, operating system, language, the page that sent you, the pages you view and when, and the rough location your IP address points to.

Please keep what you give us accurate, and tell us when it changes.

Cookies and similar tools

  • The Attria app uses only the cookies that keep you signed in, which our sign-in provider sets. It carries no analytics or advertising cookies, pixels or tags, because the app shows patient information.
  • Our website, attria.ai, may use cookies, pixels and analytics tools to count visits, see which pages help, and show Attria ads to visitors on other websites. These tools see only our website, never the Attria app or patient information. You can block or delete cookies in your browser's settings.
  • The snippet a practice adds to its own website sets the cookies described above, for that practice.

How we use it

  • To run Attria for each practice: track calls, texts and forms, match them to patients, and report which marketing brought those patients in.
  • To create your account, sign you in and keep your account working.
  • To keep the service and its data secure, prevent fraud, and find and fix problems.
  • To answer support requests and ask for your feedback.
  • To send you notices about your account, the service, and changes to our terms and policies.
  • To send you news and offers about Attria. You can opt out of these emails at any time.
  • To show Attria ads to visitors of our website, and to learn which of our own marketing works.
  • To post testimonials people give us.
  • To understand how Attria is used, so we can improve it.
  • To make pooled, de-identified data from many practices' information, such as how a practice compares with others like it. No practice and no person can be identified from it, and it never includes data from a practice's Google or Meta accounts. We may use it for any purpose.
  • To meet our legal duties, and to establish or defend our legal rights.

We don't sell personal information. We never use patient information to market Attria, and we don't use it to train AI models. Pooled, de-identified data is not personal or patient information, so these limits don't cover it. The only patient-related data that reaches an ad platform is Ad Optimizer (also called conversion upload), which a practice can turn on for its own ad accounts, described below.

AI

Attria reads the transcripts of answered calls with an AI model run by one of our vendors under its business associate agreement with us, to find details such as whether an appointment was booked. An AI model run by one of our vendors under the same kind of agreement also reads the emails sent to a practice's bill address, to find the sender, the kind of bill, the amount and the month. We don't use patient information to train AI models.

Who we share it with

  • The practice the information belongs to.
  • The vendors that run Attria for us: hosting, the database, phone calls, the connection to practice software, sign-in, email and AI. Each vendor that handles patient information signs a business associate agreement with us before it gets any.
  • For information about you and our website visitors only, never patient information: analytics, advertising and retargeting networks, and the sales, marketing and support tools we use.
  • We'll share the list of our vendors on request. Each one may use the information only to do its work for us.
  • Google, Meta, Microsoft and OpenAI's ChatGPT Ads, only when a practice turns on Ad Optimizer. For each new patient the practice's system confirms, whose visit to the practice's website carried that platform's click id, we send that click id and a time to the practice's own account on that platform, with an event ID we generate and any event or conversion name that platform uses. The account can then count the new patient and use it to place the practice's ads. We never send a name, phone number, email address or amount.
  • Anyone we choose, for pooled, de-identified data only. We make them promise not to try to identify anyone from it.
  • Government authorities, when the law requires it.
  • A company that buys or invests in our business, or one we are in talks with about it, which must keep the promises in this policy. This doesn't cover data we read from a practice's Google account. In a merger, acquisition or sale of our assets, that data moves only after the practice gives its explicit prior consent, and we don't share it with investors or in talks about a deal.

We don't sell or share phone numbers or text messages with anyone for their own marketing.

Google user data

When a practice connects its Google Ads account, Attria keeps an encrypted sign-in token for that login and lists the accounts it can reach, so the person connecting can pick one. For the chosen account, Attria keeps the account's ID and name and reads its time zone, currency, conversion actions, campaigns, ad spend, clicks and impressions, and its Local Services leads, including each lead's name and phone number.

The person connecting picks a conversion action or asks Attria to add one. If asked, Attria creates an action named "Attria booked" in that account. That is the only change Attria makes to the account's setup.

If the practice turns on Ad Optimizer, Attria also sends that account the Google click id and a time for each new patient, as described above, with an event ID we generate. Each upload tells Google that ad user data consent is granted, which rests on the practice confirming it has the permissions it needs when it turns Ad Optimizer on. Attria then asks Google whether it accepted the upload.

We use the data we read from Google only to set up and maintain the practice's connection, send the uploads it turned on, match its Local Services leads to its calls and patients, and show the practice, and any agency it has approved, its own reports and leads. We don't transfer it to anyone except as this policy describes, and we never use it to serve or target ads. People at Attria read it only when the practice has first agreed to let us view that specific data, when it is needed for security, such as investigating a bug or abuse, or when the law requires it.

Disconnecting Google in Settings deletes the sign-in token and stops new reads and uploads. Attria stays listed in that Google Account until the account holder removes it there. Data Attria already read stays until the practice leaves, as the How long we keep it section says.

Attria's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Texts from Attria

We may text you about your account or a practice's setup, such as a code to confirm a phone number. How often depends on what you set up. Message and data rates may apply. Reply STOP to stop them, or email privacy@attria.ai.

How long we keep it

  • Practice information, including call recordings and emailed bills, stays while the practice is a customer. We delete it within 30 days after the practice leaves, and our backups drop it within another 30 days. Pooled, de-identified data we have already made stays.
  • Account information stays while you have access. We delete it with your practice's information, or sooner if you ask. We may keep what we need to prevent fraud, settle a dispute or meet the law.
  • Information from website visits and sales contacts stays while we need it for the reasons above, and we delete it when you ask unless the law needs it kept.
  • Security logs stay for six years. They record who opened patient information, not the information itself.

How we protect it

We encrypt patient names, phone numbers, email addresses, birth dates and messages one value at a time before storing them. A browser that has not signed in before needs a code we email before it can sign in. Each practice sees only its own data, and we log every time someone opens patient information. We and our vendors store the data in the United States. No system online can be guaranteed to be completely secure, so we can't promise that no one will ever get past these protections.

Your choices and rights

  • If you are a patient or a caller, contact the practice you visit. It controls your information and can ask us to correct or delete it.
  • If you sign in to Attria or have contacted us, email privacy@attria.ai to see, correct or delete your information. Your practice can also remove your access.
  • Every marketing email has a link to stop them.
  • Browsers can send a Do Not Track signal, but there is no agreed standard for it, so we don't respond to it.

Depending on where you live in the United States, such as California, Colorado, Connecticut, Utah or Virginia, you may have the right to:

  • know whether we process your personal information, and get a copy of it
  • correct it or have it deleted
  • opt out of targeted advertising, of any sale of it, and of profiling that has legal or similarly significant effects on you
  • get the list of the kinds of companies we have shared it with
  • not be treated differently for using these rights

These rights cover the information we decide how to use, not patient information, which belongs to the practice. To use them, email privacy@attria.ai. We will confirm your identity first, using the information we already have, and may ask for a little more. Someone you authorize in writing can ask for you. If we turn down your request, you can appeal by replying to our answer, and if we turn down the appeal, you can complain to your state's attorney general. If you live in California, you may also ask once a year which companies, if any, we shared your information with for their own direct marketing.

Children

The Attria app and our website are for businesses, and not for anyone under 18. If we learn that we have information about someone under 18 who used them, we will delete it. A practice may hold records about patients who are children. The practice controls those records, and the patient rules above apply to them.

Changes

We may change this policy by posting a new version here with a new effective date. Each version stays at its own dated link. For a significant change, we may also tell you directly, such as by email.

Contact

ATTRIA LLC, California. privacy@attria.ai