Privacy Policy

Effective Date: July 27, 2026  |  Last Updated: August 2, 2026

Andora Health Services, LLC d/b/a Andora Private Duty Home Health ("Andora," "we," "us," "our") is committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, and safeguard information obtained through andorahealth.com and through our general business communications.

1. Information We Collect

Information You Provide Directly

• Contact data: name, mailing address, email address, telephone and mobile numbers
• Inquiry data: relationship to the prospective client, general description of care needs, preferred contact method and timing, referral source
• Limited health-related data: where you voluntarily describe a diagnosis, condition, or care need in a form or message
• Payer data: insurance carrier or payment method, where you choose to provide it
• Employment data: for applicants, this includes resume, work history, licensure and certification numbers, education, references, and screening authorizations

Information Collected Automatically

• IP address and approximate geographic location derived from it
• Device type, operating system, browser type and version, screen resolution
• Pages viewed, time on page, scroll depth, links clicked, referring URL, exit pages
• Date and time of access and session duration
• Cookies, pixels, tags, and similar tracking technologies

Information From Third Parties

• Referring healthcare providers, hospitals, case managers, and discharge planners
• Referral platforms and networks through which a referral is transmitted to us
• Advertising and analytics platforms, which may provide aggregated performance data
• Background screening vendors, for employment applicants who have authorized screening

2. How We Use Information

3. Mobile Information and Text Messaging

Mobile numbers and SMS consent are collected and used solely to communicate with you about your inquiry, scheduling, care coordination, billing, or employment application. See our SMS and Text Messaging Terms, located in our Terms and Conditions, for full program details and opt-out instructions.

4. How We Disclose Information

Andora does not sell, rent, lease, or trade personal information. We disclose information only as described below.

Service Providers and Business Associates

We engage vendors to operate our business. These include electronic health record and scheduling platforms, customer relationship management and marketing automation platforms, secure fax and communication services, billing and payment processors, website hosting, and analytics providers.

These vendors are contractually restricted to using information only as necessary to perform services for Andora. Where a vendor creates, receives, maintains, or transmits PHI on our behalf, a HIPAA-compliant Business Associate Agreement is executed prior to disclosure.

Care Coordination

We share information with physicians, hospitals, rehabilitation facilities, pharmacies, durable medical equipment suppliers, and other providers involved in a client's care, consistent with HIPAA and applicable Texas law.

Payers

With long-term care insurers, workers' compensation carriers, and other payers, for the purposes of eligibility verification, authorization, and claims submission, where the client has authorized or where permitted by law.

Legal and Regulatory Disclosures

• In response to a subpoena, court order, warrant, or other lawful process
• To HHSC, the Texas Department of Family and Protective Services, or other regulators in connection with licensure, survey, audit, or investigation
• To fulfill mandatory reporting obligations regarding suspected abuse, neglect, or exploitation under Texas Health and Safety Code Section 142.018, 26 TAC Section 558.249, and Texas Human Resources Code Chapter 48
• To report communicable disease or other matters required to be reported to public health authorities

Safety

To prevent or lessen a serious and imminent threat to the health or safety of a client, staff member, or the public.

Business Transactions

In connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to the successor being bound by protections no less restrictive than those in this Policy and, as to PHI, by HIPAA.

5. Cookies and Tracking Technologies

Cookies are small text files placed on your device when you visit a website. Similar technologies include pixels, web beacons, tags, and local storage. They allow a site to recognize a device, remember preferences, and gather analytics.

Optional analytics and advertising technologies are disabled until you choose to allow them. You may accept, reject, or customize optional technologies through the cookie preference tool. We store your selection in local storage as a strictly necessary preference and retain it until you clear your browser data or we ask you to renew your choice. You can withdraw or change consent at any time using the Cookie Preferences link in the Site footer.

The cookie preference tool stores your selected cookie categories, an anonymous consent ID, the consent version, and the date and time of your choice in your browser. We may also transmit that limited consent record to a restricted Google spreadsheet for compliance and audit purposes. The preference tool does not record your name, email address, health information, IP address, or browsing activity. Google processes the centrally logged record as our service provider.

We also honor legally recognized browser-based opt-out preference signals where required. You may additionally refuse or delete cookies through your browser settings. Disabling strictly necessary storage may impair Site functionality.

To opt out of Google Analytics across all sites, install the Google Analytics Opt-out Browser Add-on. To manage interest-based advertising, visit optout.aboutads.info or optout.networkadvertising.org.

6. Legal Bases and Authorization

Where required by HIPAA or Texas law, Andora obtains written authorization before using or disclosing PHI for purposes other than treatment, payment, or healthcare operations. Marketing communications that constitute marketing under HIPAA will not be sent without prior written authorization. You may revoke any authorization in writing at any time, except to the extent action has already been taken in reliance on it.

7. Data Security

Andora maintains administrative, physical, and technical safeguards designed to protect information against unauthorized access, use, disclosure, alteration, and destruction. These include access controls and role-based permissions, encryption of data in transit and at rest where applicable, workforce confidentiality agreements and annual HIPAA training, secure disposal of records, and vendor due diligence with executed Business Associate Agreements.

No system is impenetrable. While we work to protect your information, we cannot guarantee absolute security of information transmitted over the internet or stored electronically. You transmit information at your own risk.

8. Data Retention

We retain information only as long as necessary for the purposes described in this Policy and to satisfy legal, regulatory, licensure, accreditation, and accounting requirements. Client clinical records are retained in accordance with 26 TAC Chapter 558 and other applicable Texas and federal requirements. Website analytics data is retained per the settings of our analytics providers. Employment application records are retained in accordance with applicable federal and Texas employment law.

9. Your Choices and Rights

• Access and correction: Request a copy of, or correction to, personal information we hold about you
• Deletion: Request deletion, subject to our legal and regulatory retention obligations
• Marketing opt-out: Unsubscribe from marketing email using the link in any message, or contact us
• SMS opt-out: Reply STOP to any text message
• Cookies: Manage or disable cookies through your browser or our cookie preference tool
• Do Not Track: Our Site does not currently respond to browser Do Not Track signals
• HIPAA rights: Rights regarding PHI, including access, amendment, accounting of disclosures, restriction requests, confidential communications, and the right to a paper copy of the Notice, are described in our HIPAA Notice of Privacy Practices

To exercise any right, contact us at privatecare@andorahealth.com or (832) 679-3716. We will respond within the timeframes required by applicable law.

10. Texas Residents

Andora does not sell personal data and does not process personal data for targeted advertising.

Texas residents may contact us at privatecare@andorahealth.com or (832) 679-3716 to request access to, correction of, or deletion of personal data we hold, or to obtain a copy of data you have provided to us. We will respond within 45 days, or notify you if additional time is required. If we decline a request, you may appeal by contacting us in writing using the same contact information, and we will respond to the appeal within 60 days. If an appeal is denied, you may submit a complaint to the Texas Attorney General at texasattorneygeneral.gov.

Requests concerning protected health information are handled under HIPAA and our HIPAA Notice of Privacy Practices rather than under this section.

11. Children's Privacy

The Site is intended for adults and is not directed to children under 13. We do not knowingly collect personal information from children under 13 through the Site. Where Andora provides pediatric home health services, all clinical and demographic information is collected directly from a parent or legal guardian as part of the clinical intake process and is governed by HIPAA and our HIPAA Notice of Privacy Practices. If you believe a child under 13 has provided information through the Site, contact us and we will delete it.

12. Breach Notification

In the event of a breach of unsecured protected health information, Andora will provide notification to affected individuals, the United States Department of Health and Human Services, and, where required, the media, in accordance with the HIPAA Breach Notification Rule (45 C.F.R. Sections 164.400 through 164.414). Breaches involving sensitive personal information will additionally be handled in accordance with Texas Business and Commerce Code Chapter 521.

13. Changes to This Policy

We may update this Privacy Policy periodically. Changes take effect when posted to this page with an updated Last Updated date. Where a change materially affects your rights, we will provide notice by email to any address you have provided.

14. Contact and Privacy Officer

You may also file a privacy complaint with the United States Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue SW, Washington, DC 20201, at 1-800-368-1019 (TDD 1-800-537-7697), or at hhs.gov/ocr/privacy/hipaa/complaints. Andora will not retaliate against any person for filing a complaint.