Legal
Privacy Policy
Gravita Oasis Review Solutions ("Gravita Oasis," "we," "us," or "our") provides revenue cycle management, medical coding, OASIS review, clinical review, and related support services to home health agencies and other healthcare organizations in the United States.
This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information through our website, www.gravitaoasisreview.com, and through our business interactions with clients, prospective clients, job applicants, and website visitors.
By using our website or providing information to us, you acknowledge that you have read this Privacy Policy. Where applicable law requires consent or another legal basis for processing, we will obtain or rely on that basis as required by law.
1. Scope of This Privacy Policy
This Privacy Policy primarily applies to personal information collected through our website and through ordinary business interactions.
It covers information relating to:
- Website visitors
- Prospective and existing business clients
- Individuals who contact us
- Job applicants
- Business contacts and representatives of organizations that work with us
Protected Health Information
When Gravita Oasis receives, accesses, maintains, or processes Protected Health Information ("PHI") on behalf of a healthcare organization in our capacity as a HIPAA Business Associate, that PHI is handled in accordance with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), applicable regulations, and the applicable Business Associate Agreement ("BAA").
This Privacy Policy does not replace or modify any BAA or other contractual agreement governing PHI.
We do not control how our client healthcare organizations collect, use, or disclose PHI. Patients who have questions about their health information or wish to exercise HIPAA rights should contact the healthcare provider or home health agency responsible for their care.
2. Information We Collect
A. Information You Provide Directly
Depending on how you interact with us, we may collect:
- Name
- Job title or professional role
- Company or organization name
- Business email address
- Telephone number
- Business address
- Information included in consultation or contact requests
- Information provided when requesting a coding evaluation or service
- Information provided during client onboarding
- Information provided through email, telephone, or other business communications
- Resume, employment history, qualifications, and other information submitted as part of a job application
Please do not submit patient medical records, PHI, Social Security numbers, insurance information, or other sensitive patient information through publicly available website forms.
If clinical information needs to be shared with Gravita Oasis, it should be transmitted only through secure systems and channels approved under the applicable service agreement or BAA.
B. Information Collected Automatically
When you visit our website, we may automatically collect certain technical and usage information, including:
- IP address
- Browser type and version
- Device type
- Operating system
- Referring website or URL
- Pages visited
- Date and time of visits
- Approximate geographic information derived from technical data
- Website interaction and usage information
We use this information primarily for website functionality, security, analytics, performance monitoring, and improving our website and services.
3. How We Use Personal Information
We may use personal information for the following purposes:
- Responding to enquiries and requests
- Providing consultations, evaluations, and requested services
- Communicating with current and prospective clients
- Managing client relationships and accounts
- Providing reports, project updates, invoices, and other business communications
- Evaluating and processing employment applications
- Communicating with job applicants
- Understanding website usage and improving website functionality
- Monitoring and maintaining website security
- Complying with applicable legal, regulatory, tax, accounting, and contractual requirements
- Establishing, exercising, or defending legal claims
- Protecting the rights, safety, and property of Gravita Oasis, our clients, employees, and other individuals
- Performing other purposes disclosed to you at or before the time information is collected
We do not sell personal information for monetary consideration.
We do not knowingly share personal information with third parties for their own independent advertising purposes.
4. Legal Bases for Processing
Where applicable privacy laws require us to identify a legal basis for processing personal information, we may rely on one or more of the following:
- Contract: where processing is necessary to provide services or perform a contract with you or the organization you represent.
- Legitimate interests: where processing is reasonably necessary for activities such as responding to business enquiries, managing business relationships, securing our systems, improving our services, or protecting our legal interests.
- Legal obligations: where processing is necessary to comply with applicable laws, regulations, court orders, or other legal requirements.
- Other lawful bases: where another lawful basis is available under applicable law.
Where processing is based on consent, you may withdraw your consent at any time, subject to applicable legal limitations.
5. Cookies and Similar Technologies
Our website may use cookies, pixels, tags, local storage, and similar technologies.
These technologies may be used for:
Essential Technologies
These technologies are necessary for website functionality, security, and basic operations.
Analytics Technologies
We may use analytics technologies to understand how visitors use our website, identify technical issues, measure website performance, and improve our content and services.
Marketing Technologies
Where applicable, we may use advertising or marketing technologies to measure campaigns, understand engagement, or provide relevant communications.
Third-party providers operating these technologies may process information according to their own privacy policies.
You can manage or disable cookies through your browser settings. Certain website features may not function correctly if essential cookies are disabled.
Where required by applicable law, we will provide appropriate cookie choices or consent mechanisms.
Where applicable, we honor legally recognized browser-based privacy signals, including Global Privacy Control, in accordance with applicable law.
6. How We Share Personal Information
We may disclose personal information in the following circumstances:
Service Providers
We may use third-party companies to provide services such as:
- Website hosting
- Cloud storage
- Email delivery
- Customer relationship management
- Analytics
- Information technology
- Cybersecurity
- Recruiting and applicant management
- Business administration
These providers may process personal information on our behalf and are expected to use it only for authorized purposes and in accordance with applicable contractual requirements.
Client Organizations
We may provide information, reports, documentation, or other work product to the client organization that engaged us, as necessary to provide our services.
PHI handled on behalf of a covered entity is subject to the applicable BAA and HIPAA requirements.
Subcontractors
Where subcontractors are authorized to access PHI, we require appropriate written agreements and safeguards consistent with HIPAA and our contractual obligations.
Legal and Regulatory Requirements
We may disclose information where reasonably necessary to:
- Comply with applicable law
- Comply with subpoenas, court orders, or legal processes
- Protect our rights, property, or safety
- Investigate fraud, security incidents, or unlawful activity
- Establish, exercise, or defend legal claims
Business Transfers
Personal information may be disclosed as part of a merger, acquisition, financing, restructuring, sale of assets, or similar business transaction, subject to applicable legal requirements and appropriate safeguards.
7. HIPAA and Protected Health Information
When acting as a HIPAA Business Associate, Gravita Oasis handles PHI in accordance with HIPAA, applicable regulations, and the applicable BAA.
Our HIPAA-related practices may include:
- Executing Business Associate Agreements where required
- Using and disclosing PHI only as permitted by the applicable BAA and law
- Applying administrative, physical, and technical safeguards appropriate to the information and systems involved
- Providing HIPAA and privacy training to personnel who require access to PHI
- Using secure systems and transmission methods for PHI
- Working within client-controlled systems where appropriate
- Maintaining procedures for identifying, investigating, and responding to security incidents
- Notifying the applicable covered entity of breaches of unsecured PHI as required by HIPAA and the applicable BAA
- Returning or securely destroying PHI when required by the applicable BAA or law
Patients who wish to exercise HIPAA rights, including rights relating to access, amendment, or other aspects of their health information, should contact the healthcare provider or home health agency responsible for their records.
8. Data Security
We maintain administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, loss, or destruction.
Depending on the system and type of information involved, our security measures may include:
- Role-based access controls
- Multi-factor authentication
- Encryption in transit and, where appropriate, at rest
- Endpoint and network security controls
- Secure remote-work practices
- Activity and access monitoring
- Security reviews
- Employee security and privacy training
- Incident response procedures
- Access restrictions based on business need
No method of transmitting or storing information is completely secure. Accordingly, we cannot guarantee absolute security of information transmitted over the internet.
9. Data Retention
We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to:
- Provide requested services
- Maintain business and contractual records
- Comply with legal, tax, accounting, regulatory, and audit requirements
- Resolve disputes
- Establish, exercise, or defend legal claims
- Maintain appropriate security and business records
Retention periods vary depending on the type of information, the purpose for which it was collected, contractual requirements, and applicable law.
Marketing information may be retained until you unsubscribe or until it is no longer reasonably necessary for the purpose for which it was collected, subject to applicable law.
PHI is retained and destroyed in accordance with applicable law, contractual requirements, and the applicable BAA.
When information is no longer required, we take reasonable steps to securely delete, destroy, or de-identify it, where appropriate.
10. International Data Transfers
Gravita Oasis has operations and personnel in both the United States and India.
Depending on the services we provide and the nature of the business relationship, personal information may be accessed, processed, or stored in countries other than the country in which the information was originally collected.
Where applicable law imposes requirements for international transfers, we will use an appropriate lawful transfer mechanism and contractual or other safeguards.
For client information and PHI, applicable data locations and transfer requirements may also be addressed through the relevant service agreement, BAA, or other contractual documentation.
11. Your Privacy Rights
Depending on where you live and the laws that apply to you, you may have rights regarding your personal information.
These rights may include:
- The right to know whether we process your personal information
- The right to request access to personal information we hold about you
- The right to request correction of inaccurate personal information
- The right to request deletion of personal information
- The right to obtain a copy of certain personal information
- The right to withdraw consent where processing is based on consent
- The right to opt out of certain marketing communications
- The right to opt out of certain forms of sale or sharing of personal information where applicable
- The right to object to or restrict certain processing
- The right to appeal certain decisions regarding privacy requests where required by applicable law
These rights are not absolute and may be subject to exceptions and limitations under applicable law.
To submit a privacy request, contact:
Email: info@gravitaoasisreview.com
Subject: Privacy Request
We may need to verify your identity before completing certain requests. We will respond within the timeframe required by applicable law.
We will not discriminate against you for exercising privacy rights available to you under applicable law.
12. California Privacy Rights
If you are a California resident and the California Consumer Privacy Act ("CCPA"), as amended, applies to our processing of your information, you may have additional rights.
Depending on the circumstances, these rights may include:
- The right to know about personal information we collect, use, disclose, or otherwise process
- The right to request deletion of personal information, subject to applicable exceptions
- The right to correct inaccurate personal information
- The right to opt out of the sale or sharing of personal information, where applicable
- The right to limit certain uses and disclosures of sensitive personal information where applicable
- The right not to receive discriminatory treatment for exercising applicable privacy rights
- The right to appeal certain decisions concerning privacy requests
We do not sell personal information for monetary consideration.
We also do not knowingly share personal information for cross-context behavioral advertising unless our practices and applicable law permit us to do so and the required disclosures and opt-out mechanisms are provided.
California residents may submit privacy requests using:
Email: info@gravitaoasisreview.com
Subject: California Privacy Request
We may request information necessary to verify your identity before processing a request.
13. Other U.S. State Privacy Rights
Residents of states with applicable comprehensive privacy laws may have additional rights regarding their personal information.
Depending on the applicable law and circumstances, these rights may include access, correction, deletion, portability, consent withdrawal, objection, and opt-out rights relating to certain processing activities.
Where required by applicable state law, we will provide additional notices, mechanisms, or appeal procedures.
If you believe a privacy request has not been properly addressed, you may contact us at:
info@gravitaoasisreview.com
14. Marketing Communications
We may send business communications, educational materials, newsletters, or marketing communications where permitted by law.
You may unsubscribe from marketing emails by:
- Clicking the unsubscribe link included in the email; or
- Contacting us at info@gravitaoasisreview.com.
Even if you unsubscribe from marketing communications, we may continue to send transactional or service-related communications that are necessary for our business relationship.
15. Job Applicants
If you apply for a position with Gravita Oasis, we may collect information such as:
- Name and contact details
- Resume and employment history
- Education and professional qualifications
- Skills and certifications
- References
- Information provided during interviews
- Other information reasonably necessary to evaluate your application
We use applicant information to evaluate qualifications, communicate with applicants, manage recruitment, and comply with applicable employment laws.
We may retain applicant information for future opportunities where permitted by law. You may contact us to request correction or deletion of your information, subject to applicable legal and business requirements.
Please do not provide unnecessary sensitive personal information as part of your application.
16. Children's Privacy
Our website and business services are intended for businesses, professionals, healthcare organizations, and other adult users.
We do not knowingly collect personal information from children through our website.
If you believe that a child has provided personal information to us, please contact us at info@gravitaoasisreview.com. If required by applicable law, we will take reasonable steps to delete the information.
17. Third-Party Websites and Services
Our website may contain links to third-party websites, platforms, social media services, healthcare technology providers, or other external resources.
We are not responsible for the privacy, security, or content practices of third-party websites or services.
We encourage you to review the privacy policies of third parties before providing them with personal information.
18. Do Not Track and Browser Privacy Signals
Some browsers and devices offer privacy preference signals.
Where required by applicable law, we will recognize and respond to legally recognized privacy signals, including Global Privacy Control.
Browser settings and privacy signals may not affect all types of processing, particularly processing that is necessary to provide requested services, comply with legal obligations, maintain security, or perform other activities permitted by applicable law.
19. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our business, services, technology, legal requirements, or privacy practices.
When we make changes, we will update the "Last Updated" date at the top of this Privacy Policy.
Where required by applicable law, we will provide additional notice of material changes.
We encourage you to review this Privacy Policy periodically.
20. Contact Us
If you have questions about this Privacy Policy or how we handle personal information, please contact us:
Gravita Oasis Review Solutions
Email: info@gravitaoasisreview.com
U.S. Phone: +1 (813) 708-1643
India Phone: +91 80191 98037
For HIPAA or Business Associate inquiries, please use the subject line:
"HIPAA Inquiry"
For privacy requests, please use the subject line:
"Privacy Request"
We will review and respond to privacy inquiries in accordance with applicable law.