Marea
Legal

Global Privacy Policy – Marea Software Inc.

Last Updated: March 26, 2026

1. Introduction

This Global Privacy Policy (“Policy”) explains how Marea Software Inc. (“Marea,” “we,” “our,” or “us”) collects, uses, shares, stores, transfers, and protects personal information when you visit useMarea.com (the “Site”) or use the Marea platform and associated services (the “Services”).

The Services are provided to healthcare provider businesses (including dental clinics, medical practices, and similar organizations) (“Customers” or “you”) to support clinical documentation, patient intake, and front-desk communications. In the course of providing the Services, Marea may process personal information about Customers' patients and other individuals (“Patients”) on behalf of and under the instructions of the Customer. This Policy addresses both the personal information Marea collects directly from Customers and its handling of Patient data processed on Customers' behalf.

This Policy complies with: Québec Law 25; PIPEDA; California CMIA, CIPA, CCPA/CPRA, and CalOPPA; Illinois BIPA; Texas CUBI; Washington My Health MY Data Act (MHMDA); Nevada SB 370; HIPAA and HITECH; and other applicable privacy standards.

By using the Services, you acknowledge and agree to the practices described in this Policy.

2. Understanding the Three-Party Relationship

Marea's Services involve three distinct parties whose roles must be understood to apply this Policy correctly:

  • Marea: the technology provider. Marea operates and maintains the platform. Marea acts as a data controller for information it collects directly from Customers and website visitors, and as a data processor (or Business Associate under HIPAA) when processing Patient data on behalf of a Customer.
  • Customer (You):the healthcare provider. The Customer is the dental clinic, medical practice, or similar organization that contracts with Marea and uses the Services. The Customer is the Covered Entity under HIPAA and is responsible for the lawful collection of Patient data, obtaining required Patient consents and authorizations, and directing Marea's processing of that data under the applicable Business Associate Agreement and the Marea SaaS Terms.
  • Patients: your patients. Patients are the individuals whose personal and health information is submitted to the Services by the Customer. Patients do not have a direct contractual relationship with Marea. Customer, not Marea, is responsible for providing Patients with any required privacy notices and obtaining any required authorizations before submitting Patient data to the Services.

Where this Policy uses the word “you,” it refers to the Customer unless the context expressly indicates otherwise.

3. Marea's Role: Controller, Processor, and CMIA Contractor

Depending on the context, Marea acts as both a Data Controller and a Data Processor.

  • Controller: We control data related to website visitors, account information, Customer account and billing data, analytics, security logs, and customer support interactions.
  • Processor / Business Associate: We process Patient data (including Protected Health Information (PHI)) uploaded by Customers strictly according to Customer instructions and pursuant to an executed Business Associate Agreement (BAA). Customer, as the Covered Entity, remains responsible for directing that processing and for ensuring it has a valid legal basis for each disclosure of Patient data to Marea.
  • CMIA-Bound Contractor (California): For Customers whose Patients are California residents, Marea operates as a contractor under the California Confidentiality of Medical Information Act (Cal. Civ. Code §56 et seq.) and is subject to the same confidentiality obligations as the originating provider. Disclosure of medical information beyond the contracted service function requires valid written Patient authorization meeting the requirements of CMIA §56.11, which the Customer is responsible for obtaining.

4. Information We Collect and Process

4.1 Account and Profile Information (Controller)

  • Customer name, authorized user names, email addresses, authentication credentials, and user roles.

4.2 Usage and Device Information (Controller)

  • IP address, approximate location, browser details, device identifiers, pages visited, and performance logs generated through use of the Site or Services.

4.3 Patient Health Information and Clinical Data (Processor / Business Associate)

When Customers use the Services, they may submit Patient data to the platform, including PHI as defined under HIPAA (45 C.F.R. §160.103). Marea processes this data solely as a processor acting on Customer's instructions under the applicable BAA.

Customer is solely responsible for: (a) ensuring it has a valid legal basis under HIPAA and all Applicable Health Privacy Laws for submitting Patient data to the Services; (b) obtaining all required written Patient authorizations or consents before submission; and (c) providing Patients with all required notices of privacy practices. These obligations are set out in full in Section 5.9 of the Marea SaaS Terms.

Heightened Protection:Records relating to mental health, substance use disorder, and HIV/AIDS status are subject to heightened protection under CMIA §56.10(d), California Welfare and Institutions Code §5328, and 42 C.F.R. Part 2. Marea processes such records only pursuant to specific, valid written authorization provided by the Customer and never uses them for any secondary purpose.

4.4 Audio Recordings and Voice Data (Processor / Controller)

Where Customers use the AI Dental Receptionist or Scribe features, the Services may process audio of patient-provider interactions for the purpose of generating clinical documentation on the Customer's behalf. Marea does not store audio recordings; audio is processed in real time and is not retained after transcription is complete.

All-Party Consent (California / CIPA): Under Cal. Penal Code §632 and §632.7, all parties to a confidential communication must consent to recording. Customer is responsible for ensuring that all required consents are obtained from Patients prior to initiating any recording. Where Marea's system delivers an automated disclosure at the start of a call, this is a technical facilitation only; the legal obligation to obtain valid consent remains with Customer.

Biometric Identifiers:Where voice characteristics are processed for speaker identification or diarization, such data may constitute a biometric identifier under Illinois BIPA (740 ILCS 14/10) and Texas CUBI (Bus. and Com. Code §503.001). See Section 4.6 for applicable protections.

4.5 Health Data Under Washington My Health MY Data Act (MHMDA)

The Washington My Health MY Data Act (SB 1155, eff. March 31, 2024) applies to any entity that collects consumer health data from Washington State residents regardless of HIPAA coverage. To the extent Marea collects consumer health data from Washington residents directly (e.g., through AI agent interactions), Marea does so only with valid authorization. Customer is responsible for ensuring that Patient data submitted to the Services from Washington residents is collected and transmitted in compliance with MHMDA.

4.6 Biometric Data (BIPA / CUBI)

Where Marea's AI voice systems process voice characteristics for speaker identification or diarization, Marea maintains the following protections that apply directly to individuals regardless of the Customer intermediary:

  • Written Policy: Marea maintains a written Biometric Data Retention and Destruction Policy, available upon request, specifying the purpose and duration of biometric data collection.
  • Informed Written Consent (BIPA §15(b)): Biometric identifiers are not collected from Illinois residents without prior written informed consent specifying the purpose, length of term, and storage and use of the data. Customer is responsible for facilitating this consent for their Patients.
  • No Profit from Biometric Data (BIPA §15(c)): Marea does not sell, lease, trade, or otherwise profit from biometric identifiers or biometric information.
  • Destruction Schedule: Biometric data is destroyed when the initial purpose for collection has been satisfied, or within 3 years of the individual's last interaction with Marea, whichever comes first. Texas biometric identifiers are destroyed within a reasonable time not exceeding one year after the purpose is satisfied (CUBI).

4.7 Customer-Uploaded Data (Processor)

  • Business workflow data, clinical records, intake forms, and other data uploaded by Customers through the platform.

4.8 Integration Data (Processor / Controller)

  • Data pulled from third-party systems at Customer direction.
  • Metadata logs and API operational information handled as Controller.

4.9 Cookies and Tracking Technologies / CalOPPA

Our Site does not use advertising cookies or behavioral tracking. We do not share personal information with third parties for cross-context behavioral advertising. Marea's Site does not respond to Do Not Track (DNT) signals at this time as no universal standard has been established (Cal. Bus. and Prof. Code §22575).

4.10 Contract and Marketing Information (Controller)

We collect personal information such as your name, email address, and phone number when you contact us or use the Services. Where required by Canadian law, we collect and process this information with your express or implied consent depending on the sensitivity of the information.

5. How We Use Personal Information

5.1 Service Provision and Operation

  • Enable platform access, transcribe clinical interactions, generate scribe documentation, synchronize data, and provide Customer support.

5.2 AI-Powered Scribe and Automated Processing

Marea's Services involve automated processing of Patient data, including audio-to-text transcription and AI-generated clinical note drafting, strictly on Customer's behalf. Under Québec Law 25 (s. 12.1), where automated processing produces outputs that may directly affect individuals, Marea implements human review processes. Customers may contact us to request information about automated processing parameters.

5.3 Improving the Services

  • Enhance platform functionality and test new features using de-identified or aggregated data only. Identifiable PHI or audio recordings are never used to train AI models without explicit written consent from Customer.

5.4 Security and Fraud Prevention

  • Monitor suspicious activity, protect Customer accounts, and enforce the Marea SaaS Terms.

5.5 Communications and Marketing

We use Customer contact information to respond to inquiries, provide product updates and operational notices, and send communications about features or offerings that may be of interest. Where required by applicable law, we obtain your consent before sending marketing communications. For Customers in Canada, marketing communications are sent in accordance with CASL. You may opt out at any time via the unsubscribe mechanism or by contacting us.

6. Legal Bases for Processing

6.1 HIPAA and HITECH

Where Marea processes PHI on behalf of Customers that are Covered Entities under HIPAA, Marea acts as a Business Associate as defined under 45 C.F.R. §160.103 and processes PHI only pursuant to a valid and fully executed Business Associate Agreement. HIPAA compliance does not independently satisfy obligations under applicable state medical privacy laws, including CMIA and the statutes identified in this Section 6.

6.2 Québec Law 25

  • Express Consent: Required for PHI, audio recordings, biometric data, and automated decision-making that directly affects individuals.
  • Implied Consent: May apply to routine non-sensitive administrative processing where the purpose is evident.
  • Legal Obligation or Legitimate Interest: Where required by law or necessary for a legitimate purpose proportionate to privacy interests, with appropriate Privacy Impact Assessment (PIA) conducted.

6.3 PIPEDA

For Customers located in Canada outside Québec, processing is conducted in accordance with PIPEDA's consent and reasonableness requirements.

6.4 CMIA (California)

Processing of medical information for Customers serving California Patients is conducted pursuant to the patient-provider relationship and Marea's role as a CMIA-bound contractor (Cal. Civ. Code §56.10(c)). Disclosures outside that contracted function require valid written Patient authorization under §56.11, which Customer is responsible for obtaining.

6.5 CCPA / CPRA (California)

For Customer personal information that Marea processes as a controller, processing is conducted in accordance with the CCPA and CPRA. Marea does not sell personal information or use sensitive personal information for purposes beyond those permitted. For Patient data, Marea acts as a service provider under CCPA and processes such data only as directed by the Customer.

6.6 Washington MHMDA

For Washington residents, consumer health data is collected and processed only with valid authorization. No health data is sold or used for targeted advertising.

6.7 Illinois BIPA / Texas CUBI

Biometric data is collected only pursuant to the written informed consent and policy requirements of BIPA and CUBI respectively, as further described in Section 4.6.

7. Customer Obligations Regarding Patient Consent

Marea processes Patient data strictly on the Customer's instructions. Customer is solely responsible for:

  • Obtaining all written Patient authorizations, consents, and notices required under HIPAA and all Applicable Health Privacy Laws before submitting Patient data to the Services, as required by Section 5.9 of the Marea SaaS Terms.
  • Providing Patients with all required notices of privacy practices in accordance with 45 C.F.R. §164.520 and any applicable state law equivalent.
  • Ensuring compliance with all-party consent requirements under applicable state wiretapping and communications privacy laws (including CIPA) before initiating any audio recording or transcription through the Services.
  • Maintaining written records sufficient to demonstrate compliance with all of the above and making such records available to Marea upon request.

Marea provides a sample Patient consent form as a reference resource only. The sample form does not constitute legal advice and does not represent that it satisfies applicable legal requirements in any jurisdiction. Customer should consult qualified legal counsel before implementing any consent form in their practice.

8. How We Share Information

8.1 Subprocessors

We use cloud hosting, analytics, monitoring, transcription infrastructure, and support vendors. All subprocessors are contractually required to meet equivalent privacy and security standards, including Law 25 processor obligations and, for PHI, HIPAA and CMIA confidentiality requirements.

8.2 Healthcare Provider Customers

PHI processed through the Services is disclosed only to the Customer that authorized the interaction, or as otherwise required by law. Disclosure outside the contracted service function requires valid Patient authorization, which Customer is responsible for obtaining. Marea does not independently disclose PHI to any third party outside its processing role.

8.3 Biometric Data (BIPA / CUBI)

Biometric identifiers and biometric information are not sold, leased, traded, or otherwise disclosed to any third party without informed written consent or unless required by a valid court order or law. Texas biometric identifiers are not sold under any circumstances (CUBI §503.001(b)).

8.4 Legal Compliance

We may disclose data to comply with laws, court orders, or regulatory requirements, or to protect rights and safety.

8.5 Business Transfers

In mergers or acquisitions, data may be transferred to the successor entity, subject to equivalent privacy protections and, where required, notice to affected Customers. Biometric data transferred in a business acquisition is governed by the acquiror's BIPA/CUBI compliance obligations.

8.6 Aggregated and De-Identified Data

We may use de-identified or aggregated data for benchmarking, analytics, or product development. De-identified data is processed in a manner that cannot reasonably be used to re-identify individuals. Biometric data is never included in de-identified datasets.

8.7 No Sale of Personal or Health Information

Marea does not sell personal information, medical information, consumer health data, or biometric data to any third party. This applies under CCPA/CPRA, CMIA, MHMDA, BIPA, and CUBI.

9. Data Retention

We retain personal data only as long as necessary for service delivery, legal obligations, security requirements, and Customer contracts.

  • PHI and Clinical Data: Retained for the duration necessary to complete transcription and documentation, plus any period required by applicable health records legislation or Customer agreement.
  • Audio: Marea does not store audio recordings. Audio is processed in real time for transcription and is not retained.
  • Biometric Data:Destroyed when the initial purpose for collection has been satisfied or within 3 years of the individual's last interaction with Marea, whichever comes first (BIPA). Texas biometric identifiers are destroyed within a reasonable time not exceeding one year after the purpose is satisfied (CUBI).
  • Customer Account and Contact Information: Retained for the duration of the Customer's subscription and for such additional period as required by applicable law or legitimate business need.
  • Marketing Information: Retained until you unsubscribe or request deletion, unless a longer period is required by law.

Processor data is retained according to Customer instructions. For Québec personal information, retention is governed by Law 25 and applicable health legislation.

10. Data Security and Breach Notification

10.1 Security Measures

We implement administrative, technical, and physical safeguards appropriate to the sensitivity of the information processed, including encryption in transit and at rest, access controls, audit logging, and regular security assessments. Enhanced security measures apply to Services infrastructure given the sensitivity of PHI, audio recordings, and biometric data.

10.2 Breach Notification

Québec (Law 25, s. 63.3–63.10): In the event of a confidentiality incident presenting a risk of serious injury, Marea will notify the Commission d'accès à l'information (CAI) and will maintain a Confidentiality Incident Register.

HIPAA / California (CMIA §56.36 / CCPA): In the event of a breach of unsecured PHI or medical information, Marea will notify the affected Customer without undue delay in accordance with the applicable BAA and HIPAA breach notification requirements (45 C.F.R. Part 164, Subpart D). Customer, as the Covered Entity, remains responsible for notifying affected Patients and, where required, the relevant regulatory authorities. Where Marea processes medical information as a direct CMIA-bound contractor independent of a Customer relationship, Marea will provide notice directly to affected California individuals as required by law.

Washington (MHMDA): Unauthorized acquisition of consumer health data will be notified to the affected Customer and, where required, to the Washington Attorney General.

Illinois (BIPA): Unauthorized acquisition of biometric data will be treated as a reportable security breach under the Illinois Personal Information Protection Act (815 ILCS 530) in addition to BIPA obligations.

11. International and Cross-Border Data Transfers

Data may be processed in the United Kingdom, Canada, the United States, or other regions where our subprocessors operate. Where necessary, we use legal transfer mechanisms such as Standard Contractual Clauses (SCCs), UK Addendum / IDTA, or adequacy decisions.

Québec Residents, Cross-Border Transfer Notice (Law 25, s. 17): Before transferring personal information outside Québec, Marea conducts a Privacy Impact Assessment (PIA) to evaluate the protection provided by the receiving jurisdiction. Transfers proceed only if adequate protection is confirmed.

For California Patients, cross-border transfers of medical information remain subject to CMIA confidentiality obligations regardless of destination jurisdiction. Receiving parties are contractually bound to equivalent protections.

For Canadian personal information, appropriate contractual protections are in place. Foreign governments, courts, or law enforcement may access information under their local laws.

12. Privacy Impact Assessments

Before implementing any system or service involving personal information (including AI voice agents, audio recording technology, and automated processing systems), Marea conducts a Privacy Impact Assessment (PIA) in accordance with Québec Law 25 (s. 3.3). Summaries are available upon request where disclosure does not prejudice security or confidentiality.

13. Your Privacy Rights

Depending on your jurisdiction, you as a Customer may have the following rights with respect to personal information Marea holds about you as a controller:

  • Access, correct, or delete your personal information held by Marea.
  • Restrict or object to processing.
  • Data portability.
  • Withdraw consent.
  • Opt-out of sale or sharing of data (Marea does not sell data).

Patient Rights:Patients' rights with respect to their PHI and personal information submitted to the Services run through the Customer. Patients should contact their healthcare provider directly to exercise rights of access, correction, deletion, or portability with respect to their medical records. Marea will assist the Customer in responding to Patient data subject requests as required under the applicable BAA and Data Processing Addendum.

BIPA / CUBI / MHMDA Direct Rights: Notwithstanding the above, individuals (including Patients) have direct rights against Marea with respect to biometric data collected by Marea's systems (BIPA §15; CUBI) and consumer health data collected directly by Marea from Washington residents (MHMDA). These requests may be submitted directly to Marea at info@useMarea.com.

Submit Customer requests and direct individual rights requests to: info@useMarea.com

We will respond within the timelines required by applicable law (30 days under Law 25, 45 days under CCPA, 30 days under MHMDA, with possible extensions on notice).

14. Designated Privacy Officer

In accordance with Québec Law 25, Marea has designated a Privacy Officer responsible for the protection of personal information and compliance with applicable privacy laws.

Privacy Officer Contact: Privacy Officer, Marea Software Inc., info@useMarea.com

The Privacy Officer's title and contact information are published on useMarea.com. You may contact the Privacy Officer for any privacy-related concern, complaint, or inquiry relating to Marea's processing of personal information.

15. Children's Privacy

The Services are intended for professional and business use by healthcare provider Customers and are not directed to children under 16. We do not knowingly collect personal information directly from children. Where Marea's Services involve minor Patients, PHI is collected and processed solely in the context of the Customer's authorized clinical relationship with the Patient, subject to all applicable consent and privacy requirements including parental consent where required.

16. Third-Party Services

The Services may integrate with external platforms including practice management systems and EHRs. Each platform has its own privacy practices. Marea is not responsible for third-party privacy policies. Customers are responsible for ensuring that any third-party integrations they configure comply with applicable privacy and data protection laws.

17. Changes to This Privacy Policy

We may update this Policy periodically. Material updates will be communicated to Customers at least 30 days before taking effect. Continued use of the Services after the effective date constitutes acceptance of the updated Policy. For changes affecting the processing of PHI, automated processing, or audio recording practices, we will seek fresh consent where required by applicable law.

This Policy is intended to comply with all applicable federal, state, provincial, and local laws governing the privacy, security, and processing of personal information, medical information, consumer health data, and biometric identifiers, including laws enacted or amended after the date of this Policy. The enumeration of specific statutes is illustrative and does not limit the scope of Marea's privacy practices to those statutes named.

18. Contact Us

For privacy inquiries, data subject requests, CMIA authorizations, BIPA/CUBI written requests, or to contact the Privacy Officer:

Privacy Officer, Marea Software Inc.
Email: info@useMarea.com
Website: useMarea.com