Privacy Policy

This Privacy Policy applies when you visit our website, submit a form, create an account, purchase a service, schedule or attend an appointment, upload records, communicate with us, opt in to SMS/MMS messages, or otherwise use Evidence Command’s services.

By using our website or services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, please do not use our website or services.

1. Summary of Key Points

Information we collect: We collect information you provide directly, information collected automatically through our website and technology tools, information received from authorized referral or service partners, and information needed to coordinate and provide the services you request.

Health and medical information: You may provide medical records, symptoms, diagnoses, treatment history, disability information, military-service information, VA-related information, appointment details, and other sensitive information needed for an evaluation or medical-evidence service.

How we use information: We use personal information to verify eligibility and location, coordinate licensed providers, schedule appointments, review records, deliver requested services and documents, process payments, communicate with you, maintain security, comply with law, and operate our business.

SMS/MMS privacy: We do not sell, rent, or share mobile phone numbers, SMS/MMS opt-in data, or SMS/MMS consent data with third parties or affiliates for their own marketing or promotional purposes.

Your choices: You may unsubscribe from marketing emails, reply STOP to opt out of SMS/MMS messages, manage cookies where available, and contact us to request access, correction, deletion, or other privacy rights where applicable.

2. Information We Collect

We collect personal information in several ways, including information you provide directly, information generated through your use of our services, information collected automatically, and information provided by third parties at your direction or with appropriate authorization.

Information You Provide Directly

We may collect personal information when you:

• Visit our website or submit a form;
• Request information or customer support;
• Create an account or use a secure portal;
• Purchase a service or pay an invoice;
• Schedule, reschedule, or attend an appointment;
• Complete intake forms, questionnaires, consents, or assessments;
• Upload medical records or other supporting documents;
• Participate in a telehealth or video appointment;
• Communicate by email, telephone, text message, chat, portal, or video;
• Opt in to receive email or SMS/MMS communications; or
• Submit a review, testimonial, survey response, or other feedback.

Information you provide may include:

• Name, date of birth, age, and identity-verification information;
• Email address, mobile phone number, mailing address, and billing address;
• Account credentials and communication preferences;
• Current physical location and state of residence;
• Appointment, scheduling, and provider-assignment information;
• Payment, invoice, refund, and transaction information;
• Military-service, veteran-status, and VA-related information;
• Medical history, symptoms, diagnoses, conditions, medications, treatment history, functional limitations, and disability information;
• Medical records, service treatment records, VA records, private treatment records, rating decisions, prior medical opinions, DBQs, nexus letters, and other documents you submit;
• Intake responses, screening results, questionnaires, consents, authorizations, and acknowledgments;
• Customer-support messages and other communications; and
• Any other information you voluntarily provide.

Health, Medical, Disability, and VA-Related Information

Because Evidence Command coordinates medical evaluations and medical-evidence services, you may provide information that is considered sensitive personal information, consumer health data, medical information, or protected health information under applicable law.

We collect and use this information only as reasonably necessary to coordinate and provide the services you request, assign an appropriately licensed professional, support the evaluation, prepare or deliver medical documentation, process payment, respond to support requests, maintain records, comply with law, and protect our rights and systems.

Telehealth and Appointment Information

We may collect the state and physical location from which you attend an appointment, time-zone information, provider availability, attendance status, technology or connectivity information, and communications related to scheduling or the evaluation.

Telehealth sessions are not recorded by Evidence Command unless recording is specifically disclosed and appropriate consent is obtained. We may collect audio, video, photographs, or similar information when you voluntarily submit it or when a communication is recorded with legally required notice and consent.

Payment Information

If you purchase a service, pay an invoice, or receive a refund, we may collect information needed to process the transaction, including your name, billing address, payment method, transaction history, invoice details, and payment status.

Payment card, bank-account, and ACH information may be processed by third-party payment processors. Evidence Command generally does not store full payment-card numbers.

SMS/MMS Opt-In Information

If you opt in to SMS/MMS messages, we may collect and retain:

• Your mobile phone number;
• Your SMS/MMS consent status;
• The date and time of your opt-in;
• The source and method of your opt-in;
• The consent language shown when you opted in;
• Your IP address or device information, where available;
• Message history and delivery information;
• STOP, HELP, and other response records; and
• Records needed for carrier, legal, and compliance requirements.

Information Collected Automatically

When you interact with our website or digital services, we may automatically collect:

• IP address;
• Browser and device type;
• Operating system;
• Referring website or URL;
• Pages viewed and features used;
• Date, time, and duration of visits;
• Approximate location based on IP address;
• Interactions with pages, forms, emails, advertisements, and website features; and
• Cookie identifiers, pixel data, and similar online identifiers.

This information helps us operate and secure our website, understand performance, improve user experience, prevent fraud, measure general marketing effectiveness, and maintain our systems.

Information from Referral Partners and Other Sources

With your authorization, at your direction, or as otherwise permitted by law, we may receive information from referral partners, coordinating organizations, licensed healthcare professionals, scheduling platforms, payment processors, customer-support providers, or other persons or entities involved in providing the requested service.

This information may include contact details, service selection, payment status, appointment information, uploaded records, intake status, referral source, and other information reasonably necessary to coordinate your service.

3. How We Use Your Information

We may use personal information to:

• Operate, maintain, secure, and improve our website and services;
• Respond to inquiries and determine which service you requested;
• Verify identity, age, location, state, eligibility, and contact information;
• Match or assign you to an appropriately licensed healthcare professional;
• Schedule, coordinate, reschedule, and support appointments;
• Collect and organize intake forms, consents, records, and supporting documents;
• Provide information and records to the assigned healthcare professional for the requested evaluation or service;
• Support record review, clinical evaluation, medical-document preparation, quality review, and delivery;
• Provide secure portals, communications, and customer support;
• Process purchases, payments, invoices, refunds, disputes, and accounting records;
• Send service-related emails, text messages, reminders, notices, and updates;
• Send marketing communications where permitted and based on the preferences you select;
• Measure general website, advertising, and service performance;
• Request reviews, surveys, testimonials, or feedback;
• Detect and prevent fraud, misuse, security incidents, unauthorized access, or illegal activity;
• Enforce our Terms and Conditions, policies, consents, and agreements;
• Comply with legal, licensing, tax, accounting, regulatory, and reporting obligations; and
• Protect the rights, privacy, safety, property, and security of Evidence Command, our clients, providers, personnel, vendors, and others.

4. Health Information, HIPAA, and Provider Privacy Notices

HIPAA does not apply to every business or every type of health-related information. Depending on the specific relationship and service, a licensed healthcare professional may be a HIPAA-covered healthcare provider, and Evidence Command may act as a business associate, service provider, administrative coordinator, or other entity subject to applicable contractual and legal privacy obligations.

Where HIPAA applies, protected health information will be used and disclosed only as permitted by applicable law, applicable agreements, and the relevant healthcare professional’s Notice of Privacy Practices.

This Privacy Policy is not intended to replace a HIPAA Notice of Privacy Practices. You may receive a separate Notice of Privacy Practices from the healthcare professional or covered entity responsible for the clinical service. That notice may provide additional information about uses and disclosures of protected health information, your HIPAA rights, complaint procedures, and the provider’s legal duties.

Where HIPAA does not apply, other federal or state privacy, consumer-protection, data-security, medical-record, or breach-notification laws may still apply. Evidence Command handles health-related information in accordance with the laws applicable to its role.

Where required by law, we obtain consent before processing sensitive personal information. When you voluntarily submit health, disability, location, or other sensitive information to request a service, you direct us to process that information for the disclosed service purpose, subject to any additional consent requirements presented to you.

5. SMS/MMS Messaging and Mobile Opt-In Privacy

Evidence Command may offer recurring SMS/MMS messaging programs. If you voluntarily provide your mobile phone number and opt in through a form, checkbox, booking page, intake form, chat widget, checkout page, keyword, or other consent method, you agree to receive messages at the phone number you provide.

Message Types

Messages may include:

• Appointment confirmations and reminders;
• Intake and document reminders;
• Service-related updates;
• Customer-support messages;
• Account or portal notifications;
• Billing or payment-related messages;
• Follow-up communications;
• Educational information; and
• Marketing or promotional messages where you have provided appropriate consent.

Message frequency varies. Message and data rates may apply. Contact your wireless provider for information about your mobile plan.

Opt out: Reply STOP to any message to unsubscribe. We may send one final confirmation message. You may also contact [email protected].

Help: Reply HELP or contact [email protected].

Consent is not required to purchase: Your consent to receive marketing SMS/MMS messages is not a condition of purchasing a product or service.

Mobile Information Sharing Statement

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use-case categories exclude text-messaging originator opt-in data and consent; this information will not be shared with any third parties.

We do not sell, rent, release, or provide mobile phone numbers, SMS/MMS opt-in data, or SMS/MMS consent data to third parties or affiliates for their own marketing or promotional purposes.

We may use messaging and technology providers only as needed to operate the messaging program, deliver messages, manage opt-outs, provide support, maintain records, prevent abuse, and comply with legal, carrier, or platform requirements.

6. How We Disclose Personal Information

We may disclose personal information only as reasonably necessary to provide requested services, operate our business, comply with legal obligations, protect our rights, and support our clients.

Assigned Healthcare Professionals

We may disclose contact information, location, appointment information, intake responses, medical records, health information, military or VA-related information, and other relevant materials to the licensed healthcare professional assigned to perform your evaluation or prepare the requested medical documentation.

The assigned professional may maintain clinical or professional records under applicable licensing, medical-record, privacy, and retention requirements.

Service Providers and Vendors

We may disclose information to vendors and contractors that perform services for us, including:

• Secure intake, electronic-health-record, portal, and form platforms;
• Telehealth and video-conferencing providers;
• Scheduling and appointment-management platforms;
• Website hosting and cloud-storage providers;
• Customer-relationship-management and customer-support platforms;
• Email and SMS/MMS providers;
• Payment processors and fraud-prevention providers;
• Information-security and technology providers;
• Document-management and electronic-signature providers;
• Analytics and advertising providers for general website activity;
• Accounting, finance, legal, insurance, and compliance professionals; and
• Other vendors needed to operate our business or provide the requested service.

Service providers may use personal information only as permitted by their agreements with us, as needed to provide contracted services, or as required by law.

Important SMS limitation: These categories exclude text-messaging originator opt-in data and consent. SMS/MMS opt-in data and consent will not be shared with third parties or affiliates for their own marketing or promotional purposes.

At Your Direction or With Your Authorization

We may disclose information to a person, organization, representative, healthcare professional, attorney, accredited representative, caregiver, referral partner, or other recipient when you direct us to do so, provide valid authorization, or otherwise request the disclosure.

Legal, Safety, Licensing, and Compliance Reasons

We may disclose personal information when we reasonably believe disclosure is necessary to:

• Comply with applicable law, regulation, subpoena, court order, licensing-board request, or government process;
• Respond to a lawful request or fulfill a reporting obligation;
• Protect the rights, privacy, safety, property, systems, clients, providers, personnel, vendors, or others;
• Detect, prevent, investigate, or respond to fraud, abuse, security incidents, unauthorized access, or illegal activity;
• Establish, exercise, or defend legal claims; or
• Enforce our Terms and Conditions, consents, policies, or agreements.

Business Transfers

We may disclose or transfer information in connection with a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar transaction, subject to applicable privacy and confidentiality requirements.

No Sale of Personal Information

We do not sell personal information for money. Some privacy laws define “sale,” “sharing,” or “targeted advertising” broadly. Where required by law, you may have the right to opt out of covered advertising or tracking activities.

Health Information and Advertising

We do not intentionally provide medical records, diagnoses, symptoms, intake responses, provider notes, DBQs, nexus opinions, evaluation content, or other clinical documents to advertising platforms for targeted advertising.

We may use general information about visits to public website pages to measure traffic, conversions, and advertising performance. Sensitive forms and secure clinical portals should be accessed only through the systems designated for those purposes.

7. Cookies, Pixels, Analytics, and Tracking Technologies

We may use cookies, pixels, web beacons, tags, scripts, analytics tools, advertising tools, and similar technologies when you interact with public portions of our website, emails, advertisements, and online services.

We may use these technologies to:

• Operate and secure the website;
• Remember preferences;
• Improve website functionality and user experience;
• Understand traffic and website usage;
• Measure general marketing and advertising performance;
• Support relevant advertising on public pages;
• Prevent fraud and improve security; and
• Understand how users interact with forms and services.

Most browsers allow you to remove or reject cookies. Disabling cookies may affect website functionality. Where required by law, we may provide cookie banners, consent controls, or additional opt-out tools.

Analytics and advertising providers may collect information about interactions with public website pages and other websites over time. Their handling of information is governed by their own privacy policies.

8. How Long We Keep Information

We retain personal information for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, unless a longer period is required or permitted by law, professional licensing requirements, healthcare-record requirements, contractual obligations, or legitimate business needs.

We may retain information to:

• Provide and document services;
• Maintain accounts and portals;
• Maintain evaluation, appointment, and service records;
• Comply with medical-record, licensing, tax, accounting, legal, and reporting obligations;
• Process payments, refunds, disputes, and chargebacks;
• Respond to complaints and resolve disputes;
• Enforce agreements;
• Prevent fraud, misuse, or abuse;
• Maintain business and compliance records; and
• Document SMS/MMS opt-in, opt-out, and consent records.

When information is no longer needed, we may delete, de-identify, anonymize, or securely retain it in accordance with applicable obligations.

9. How We Protect Information

We use reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, disclosure, use, alteration, loss, or destruction.

Safeguards may include access controls, authentication, secure systems, encryption where appropriate, workforce and vendor controls, monitoring, backups, confidentiality requirements, and internal policies.

No website, platform, system, storage method, or electronic transmission is completely secure. We cannot guarantee absolute security.

You are responsible for using secure devices, protecting passwords and account credentials, avoiding public or unsecured networks when accessing sensitive information, and notifying us promptly if you believe your information or account has been compromised.

If a breach or security incident occurs, we will investigate and provide notices as required by applicable law.

10. Your Privacy Rights and Choices

Depending on where you live and the law that applies, you may have the right to:

• Request access to personal information we maintain about you;
• Request correction of inaccurate information;
• Request deletion of personal information;
• Request a portable copy of certain information;
• Confirm whether we process your personal information;
• Opt out of certain marketing communications;
• Opt out of certain targeted advertising, sale, or sharing activities;
• Withdraw consent where processing is based on consent;
• Limit certain uses of sensitive personal information where applicable;
• Appeal the denial of a privacy request where applicable; and
• Not be discriminated against for exercising applicable privacy rights.

These rights are not absolute. We may deny or limit a request when an exception applies, when retention is legally or professionally required, when information is part of a clinical or legal record, when identity cannot be verified, or when fulfilling the request would violate another person’s rights.

How to Exercise Your Rights

Submit a request to [email protected]. Describe the request and provide enough information for us to locate the relevant records.

We may verify your identity before processing a request. We will respond within the time required by applicable law.

If we decline a request and applicable law provides an appeal right, you may appeal by replying to our decision or emailing [email protected] with the subject line “Privacy Appeal.” We will provide any additional complaint information required by applicable law if an appeal is denied.

Healthcare Records and HIPAA Rights

Requests involving records maintained by a licensed healthcare professional may need to be directed to that professional or handled under the professional’s Notice of Privacy Practices. HIPAA rights, where applicable, may include rights to access, amend, restrict, or receive an accounting of certain disclosures of protected health information, subject to legal limitations.

Authorized Agents

Where permitted by law, an authorized agent may submit a request on your behalf. We may require proof of authorization and may require you to verify your identity directly.

11. Marketing and Communication Choices

Email Marketing

You may unsubscribe from marketing emails using the unsubscribe link in the message or by contacting [email protected].

Even after you unsubscribe from marketing emails, we may continue to send non-marketing communications such as appointment reminders, intake notices, account messages, payment notices, document-delivery notices, security alerts, legal notices, and support responses.

SMS/MMS Messages

Reply STOP to opt out of SMS/MMS messages. Reply HELP for help. You may also contact [email protected].

Cookies and Targeted Advertising

You may manage cookies through browser settings, device settings, platform settings, or tools made available on our website. Where required by law, you may have the right to opt out of certain targeted advertising or sharing activities.

12. United States State Privacy Disclosures

The categories below describe personal information we may collect depending on how you interact with us:

Sources of Information

We may collect information from you directly, your device or browser, assigned healthcare professionals, authorized referral partners, payment processors, scheduling platforms, secure intake and portal providers, customer-support and messaging systems, analytics tools, service providers, and publicly available sources where permitted by law.

Purposes for Collection

We use the categories above for the purposes described in this Privacy Policy, including service delivery, provider coordination, appointment management, clinical and administrative support, billing, communications, security, analytics, legal compliance, and business operations.

Disclosure of Information

We may disclose information to assigned healthcare professionals and service providers that help us coordinate evaluations, operate systems, communicate with clients, process payments, protect data, and provide requested services.

We do not sell mobile phone numbers, SMS/MMS opt-in data, or SMS/MMS consent data. We do not share mobile information with third parties or affiliates for their own marketing or promotional purposes.

13. Do Not Track and Opt-Out Preference Signals

Some browsers and devices offer “Do Not Track” signals. Because there is no uniform industry standard, we may not respond to those signals unless required by law.

Where required by applicable law, we will recognize legally required opt-out preference signals, such as supported universal opt-out mechanisms, in the manner required by that law.

14. Third-Party Websites and Services

Our website and services may link to or integrate with outside websites, applications, portals, payment platforms, telehealth tools, scheduling systems, or other services.

We are not responsible for the privacy practices, security, content, policies, or actions of third-party services that operate independently from Evidence Command. Information you provide directly to those services may be governed by their privacy policies and terms.

We encourage you to review the privacy policies and security practices of third-party services you use.

15. Children’s Privacy

Our website and services are intended for individuals who are at least 18 years old. We do not knowingly collect or solicit personal information from children under 18.

If we learn that we collected personal information from a child under 18 without appropriate legal authorization, we will take reasonable steps to delete it. Contact [email protected] if you believe a child submitted information to us.

16. Updates to This Privacy Policy

We may update this Privacy Policy from time to time. When we update it, we will revise the “Last Updated” date at the top of the page.

If we make material changes, we may provide notice by posting an announcement, sending an email, displaying a notice during account access, or using another reasonable method.

Your continued use of our website or services after an updated Privacy Policy is posted means you acknowledge the updated policy, except where additional notice or consent is required by law.

17. Terms and Conditions

Your use of our website and services is also governed by our Terms and Conditions.

Review the Terms and Conditions at evidencecommand.com/terms-and-conditions.

18. Contact Us

For questions, concerns, privacy requests, or complaints regarding this Privacy Policy or how we handle personal information, contact:

19. How to Review, Update, Correct, or Delete Information

You may request to review, update, correct, or delete personal information maintained by Evidence Command by contacting [email protected].

We may verify your identity before completing a request. We may retain information as required or permitted by law, including information needed for healthcare-record obligations, provider licensing, legal compliance, security, fraud prevention, dispute resolution, payment records, tax and accounting records, contractual obligations, and SMS/MMS consent records.

Requests involving clinical records maintained by an assigned healthcare professional may need to be submitted directly to that professional in accordance with the professional’s Notice of Privacy Practices and applicable law.