Privacy Policy

This Privacy Policy describes how Wren Clinical LLC ("Wren Clinical," "we," "us"), a Washington limited liability company, collects, uses, and handles information in connection with WrenEHR, the electronic health record and practice-management platform at ehr.wrenclinical.com – including its clinician application, client portal, telehealth rooms, the Wren Recorder browser extension when connected to WrenEHR, and any WrenEHR mobile application we make available (together, the "Platform"). Capitalized terms not defined here have the meanings given in the WrenEHR Terms of Service.

The Platform is used by mental health practices ("Practices") and their staff ("Authorized Users"), and by the Practices' clients and their parents or guardians ("Clients") when a Practice invites them to its client portal, sends them messages, or meets with them by telehealth.

Wren Clinical is a HIPAA Business Associate of each Practice. Information about Clients that a Practice keeps in the Platform – including information a Client enters in the client portal – is Protected Health Information (PHI) that Wren Clinical handles on the Practice's behalf. That handling is governed by the Business Associate Agreement between Wren Clinical and the Practice, and by the Practice's own Notice of Privacy Practices, not by this Privacy Policy; Sections 4 and 5 describe it for transparency. This Privacy Policy governs account information about Practices and Authorized Users, usage data, and the other information described below.

1. Information We Collect

The categories of information in this Section (account, profile, payment-account, usage, support, technical, and log data) are information about Practices and Authorized Users. Except where noted, they are not Client information. Client information is described in Sections 4 and 5.

Account Information. When a Practice account is created or an Authorized User accepts an invitation, we collect the user's name and email address and the Practice's name. Staff sign-in is processed by Clerk, our authentication provider for Authorized Users, which holds the user's sign-in credentials. When an Authorized User accepts the Terms of Service, this Privacy Policy, or the Business Associate Agreement, we record their name and email address, the Practice's name, the date and time, the version accepted with a fingerprint of its exact text, and the IP address and browser they used. These acceptance records are kept as the record of the agreement, including after an account is closed.

Profile and Practice Information. The Platform stores information used to operate the Practice, including each Authorized User's role, phone number, professional credentials, license states and numbers, National Provider Identifier, taxonomy code, signature image used on documents, time zone and display preferences, supervision relationships, default telehealth link, and the devices and browser extensions connected to their login; and Practice details such as its address, phone number, billing email, NPI, tax identification number, Medicare and clearinghouse provider identifiers, and logos. Where a clinician bills insurance under their own tax identification number, a Practice administrator or biller enters that number – which may be the clinician's Social Security number – and a billing address. The number is stored, included in that clinician's claims and enrollment requests, and kept in the Platform's copy of each submitted claim.

Continuing Education Records. If you use continuing-education tracking, we store the license requirements, course details, hours, and certificates you enter or upload. AI may read an uploaded certificate to fill in its details.

Payment-Account Information. Practices – or, if the Practice chooses, individual clinicians – accept card payments through their own Stripe accounts. When an account is set up, Wren Clinical gives Stripe the Practice's name, the email address of the person setting it up, and a description of the business as an outpatient mental health practice; Stripe collects the business, identity, and bank-account information it requires directly. Wren Clinical stores the Stripe account identifier and the account's status. Wren Clinical does not currently charge Practices for the Platform and does not hold a payment card for any Practice.

Usage Data. We log each use of AI and transcription features, including the type of action, the AI model used, token or audio-duration counts, the estimated cost at the time, the outcome, and timestamps. These records are associated with the Practice and the Authorized User and contain no PHI or Client identifiers. We also meter telehealth minutes and insurance transactions; those records are linked to the appointment, Client, or claim involved and are kept with the Practice's records, and only Practice-level totals are used outside the Practice's account. Usage data is used for metering and billing accuracy, platform monitoring, and aggregate analytics.

Support Communications. Messages and feedback you send through the Platform's support features, and your conversations with the in-app help assistant, are stored and can be read by Wren Clinical personnel, together with your name and email address. Feedback can include a screenshot of the page you were viewing, the page address, and your browser details – so a screenshot can capture whatever was on your screen. Please do not include Client information in support messages or feedback. If you do, we handle that information as PHI under the Business Associate Agreement.

Technical Data. Our hosting infrastructure collects standard technical information such as IP address, browser type, and device information. Our web application firewall logs requests to the Platform, including IP addresses, request addresses (URLs), and request headers, with authorization headers and cookies removed. A request address can include a one-time link token, such as the token in a portal invitation link.

Audit Trails and Operational Logs. The Platform keeps an audit log of sign-ins and of access to and changes in records, including the user, time, IP address, and a request identifier. We also keep system logs for security, reliability, billing reconciliation, and compliance. Logs are designed to contain identifiers and event types, not PHI.

2. How We Use Information

We use information we collect to:

• Provide, maintain, and improve the Platform.
• Send messages, process payments, and transmit insurance transactions at the Practice's direction.
• Meter usage and manage Practice accounts.
• Respond to support requests.
• Monitor for abuse, security incidents, and compliance.
• Send you notices required under these policies or applicable law.
• Comply with legal obligations.

We do not sell your personal information. We do not use your information for advertising.

3. AI and Your Data

Wren Clinical uses Claude AI models provided by Anthropic, accessed through Amazon Web Services (AWS) Bedrock, to draft clinical documentation, answer Authorized Users' questions in Ask Wren, clean up dictated text, suggest treatment-plan content, and assist with other tasks. AWS is a HIPAA Business Associate with a signed BAA in force with Wren Clinical. Under AWS's terms for Bedrock, prompts and outputs are not used to train AI models and are not shared with Anthropic. Wren Clinical does not turn on Bedrock's model-invocation logging, so prompts and outputs are not written to a log.

What AI receives. Different AI features receive different information. For example:

• When Ask Wren is opened on a Client's chart, it receives that Client's name, pronouns, date of birth and age, sex and gender identity, active diagnoses, treatment plan, assigned clinician, appointment history, and excerpts of signed notes, and – when drafting – the open note and session transcript. It can retrieve further notes, form and assessment results, document names, psychotherapy notes, and images of handwritten notebook pages when the user's question calls for them. Without a chart open, it can look up basic details (such as names, dates of birth, and status) of the Clients in the user's caseload.
• Automatic note generation receives the session transcript, the templates the clinician selected, and the Practice's and clinician's custom AI instructions.
• Other features send the content they work on, such as dictated text, treatment-plan goals, sample notes used to build a documentation guide, images of handwritten notes being imported, uploaded form templates, and continuing-education certificates.

Reading a Client's record into Ask Wren is recorded in the Practice's audit log. At a clinician's request, Wren Clinical may also use AI to reformat that clinician's draft notes, keeping a copy of each original for ninety (90) days – or until the note is deleted – so the change can be undone.

Where AI processing happens. By default, AI requests are processed in AWS Regions in the United States. A Practice administrator may turn off the "Keep AI processing in the US" setting, after which AI requests for that Practice may be processed in AWS commercial Regions worldwide.

Transcription. When an Authorized User records a session, the audio is transmitted to AssemblyAI for transcription. When an Authorized User dictates into a note, their browser streams the audio directly to AssemblyAI. AssemblyAI is a HIPAA Business Associate with a signed BAA in force with Wren Clinical, and transcription is processed in the United States. After a recorded session's transcript is saved, Wren Clinical deletes the audio from its own storage and requests deletion of the transcription job from AssemblyAI.

Wren Clinical does not use Customer Data – including session audio, transcripts, Ask Wren conversations, clinical notes, or generated documentation – to train, fine-tune, or improve any AI model.

4. Customer Data and PHI

Customer Data is stored in AWS in the United States, in the US East (N. Virginia) Region, encrypted at rest (AES-256) and in transit (TLS) over public networks. Monthly database backups are also copied to the US West (Oregon) Region. Two exceptions: AI requests may be processed outside the United States if a Practice turns off "Keep AI processing in the US" (Section 3), and calendar feeds (described below) may be cached for up to sixty (60) seconds at AWS content-delivery locations in North America and Europe.

Client Records. The Platform stores the records a Practice keeps about its Clients, including demographics and contact details, emergency contacts, insurance information and insurance card images, diagnoses, treatment plans, appointments, progress notes, psychotherapy notes and notebook pages, forms and signatures, documents, consent statuses, billing records, telehealth session records, and copies of the messages sent to Clients. These records are kept for the life of the Practice account unless the Practice deletes them, and are handled at account closure as described in Section 10.

Session Audio. When a session is recorded – through the in-app recorder (including in a telehealth room), the Wren Recorder browser extension, or a WrenEHR mobile application – the audio is uploaded over TLS to Wren Clinical's storage and transmitted to AssemblyAI for transcription. After the transcript is saved, the audio is deleted from Wren Clinical's storage, including stored prior versions, and Wren Clinical requests deletion of the transcription job from AssemblyAI. Audio that fails to transcribe or is abandoned (for example, a browser tab closed mid-upload) is automatically and permanently deleted by a storage lifecycle rule, generally within seven (7) days.

Session Transcripts. Transcripts are stored in encrypted form in the Practice's account. Each Practice chooses how long transcripts are kept – seven (7), thirty (30), or ninety (90) days, or indefinitely – and the default is thirty (30) days. The period runs from when a transcript is completed or last changed, and a change to the setting applies to transcripts completed afterward. When the period ends, the transcript is removed from view and can be restored for seven (7) days, after which it is permanently deleted by a daily process. A transcript an Authorized User deletes can likewise be restored for seven (7) days and is then permanently deleted.

AI-Drafted Notes. If a clinician turns on automatic note generation, Wren Clinical uses AWS Bedrock to draft notes from the transcript of each recorded appointment – which may include a progress note, a psychotherapy note, or both – using the templates the clinician selected. Drafts are added to the Client's chart for the clinician's review and are never signed automatically. Once in the chart, a note is kept like any other note; it is not deleted when the transcript it came from is deleted.

Ask Wren Conversations. Ask Wren conversations, including the record content retrieved into them, are stored in encrypted form so the Authorized User can continue them, are visible only to the user who created them (and to Wren Clinical support personnel acting in a support session for that user), and are permanently deleted twenty-four (24) hours after the conversation's last message. The user may also delete a conversation sooner.

Dictation. Dictation audio streams directly from the Authorized User's browser to AssemblyAI and is never stored on Wren Clinical's infrastructure. The transcribed text goes into the note being written; if the user asks for it, the text is cleaned up by AWS Bedrock.

Guide Editor Drafts. While you are building or editing a documentation guide with AI assistance, Wren Clinical saves your in-progress draft, including any sample notes you paste in, in encrypted form. Drafts are automatically deleted within about ten (10) days after they were last saved.

Staff Notepad. Notes an Authorized User writes in their private notepad are visible only to that user and are kept until the user deletes them. A deleted notepad entry is permanently deleted thirty (30) days later.

Imported Data. When a Practice imports records from another system, the source files it uploads are stored in encrypted form and deleted fourteen (14) days after upload, with any remaining copy purged from version storage within a few days after that. A working copy of the source data, kept so that the Practice can review an import and undo it, is retained for the life of the Practice account. Documents uploaded to the form-template importer are kept for the life of the Practice account.

Messages. The Platform keeps a copy of the appointment reminders and notices, document notices, and birthday greetings it sends – their content, destination, and send status – as part of the Practice's record of communications.

Calendar Feeds. If an Authorized User subscribes an external calendar to their schedule, the feed file is stored in encrypted form and served over HTTPS at an unguessable address. The feed covers the user's appointments for a year before and after the current date, identifies Clients by initials by default or by a fuller form of their name if the user chooses, and includes the titles of the user's other calendar events unless the user turns them off. The calendar service the user subscribes with keeps its own copy, under that service's terms.

Guides and Practice Settings. Documentation guides, templates, and Practice settings you configure are stored in your account and are not PHI unless you include Client information in them.

Permanent deletion and backups. When a file is deleted through the Platform, it and its stored prior versions are deleted from active storage. Where a file is replaced, or is deleted by an automatic expiration rule, its prior versions are retained in version storage for up to three hundred sixty-five (365) days and then permanently deleted. When a database record is permanently deleted, it is removed from the live database immediately. Copies of the database remain in encrypted backups until those backups expire: continuous backups for thirty-five (35) days, monthly backups for one (1) year (also copied to the US West Region), and annual backups for three (3) years. Stored files are not included in these backups; their protection is the version history described above. Backups exist for disaster recovery, are locked so that they cannot be deleted before they expire – including on request – and remain protected under the Business Associate Agreement until then. Many records are not removed at once when deleted: an archived Client stays until the Practice permanently deletes them, a deleted transcript can be restored for seven (7) days, a deleted notepad entry is kept for thirty (30) days, and a deleted page of a handwritten notebook keeps its typed text.

When a Practice permanently deletes a Client, the Client's records – including signed notes, claims, payments, documents, and transcripts – are removed from the Platform's active systems. The following remain: audit-log entries, which contain identifiers rather than record content; the working copy of any imported source data that included the Client, which is kept so that a later import can restore the Client; logs of insurance transactions and unmatched remittances; copies of messages sent to the Client's guardians; any mention of the Client in free text elsewhere, such as notepad entries or support messages; copies of handwritten notebook pages on paired iPads; information held by others, such as the customer record, saved cards, and payment history on the Practice's Stripe account and claim and eligibility records held by Stedi and payers; and backups until they expire.

5. Information About Clients

This Section is for Clients and their parents or guardians. Your Practice – not Wren Clinical – decides what information about you is kept in the Platform, who at the Practice can see it, and what is shared with you. Wren Clinical handles your information only on your Practice's behalf, under its agreement with your Practice. The client portal shows your Practice's name and logo; messages you receive are sent under your Practice's name from Wren Clinical addresses at wrenclinical.com, and replies to the shared text-message number reference Wren Clinical.

Your rights. Rights over your health information – including access, amendment, restriction, and an accounting of disclosures – are exercised through your Practice, which is your HIPAA covered entity. Please contact your Practice directly; your Practice responds using its records in the Platform. Wren Clinical cannot act on a request from you.

What you provide in the portal. Depending on what your Practice enables, you may provide or update your name, preferred name, date of birth, sex and gender identity, phone number, address, and time zone; emergency contacts; insurance information – including the policyholder's details and employer or school – and photos of your insurance card; answers to forms and questionnaires; electronic signatures; appointment requests, cancellations, and notes; reminder preferences; and payment cards, card nicknames, and your payment preference. When you sign a form electronically, the Platform records your typed name, the time, and your IP address. The Platform records your sign-ins and other portal actions in your Practice's audit log, generally with your IP address.

Signing in. Your portal password is sent over TLS through Wren Clinical's servers to AWS Cognito, which stores and checks it; Wren Clinical does not store your password. You are signed out after thirty (30) minutes of inactivity and after eight (8) hours in any case.

Payments. If you pay or save a card in the portal, your card details and billing ZIP code are sent from your browser directly to Stripe, on your Practice's own Stripe account; Wren Clinical never receives your full card number. Stripe handles payment information under its own privacy policy (stripe.com/privacy). Wren Clinical sends Stripe the payment amount and internal identifiers, not your name or information about your care. A card you use to pay in the portal is saved so your Practice can charge it in the future, and your Practice may set up automatic charges to your saved card (AutoPay); ask your Practice about its payment policies.

Email and text messages. Your Practice may send you appointment reminders, confirmation requests, rescheduling and cancellation notices, portal invitations, notices that documents or superbills are available, balance-due notices, birthday greetings, and other messages. Unless you or your Practice change your preferences, you may receive messages by email and, if your clinician uses text reminders, by text, at the contact details your Practice has on file. Text messages come from a toll-free number that Wren Clinical shares among the practices that use WrenEHR. Message and data rates may apply. You can manage your channels in the portal or ask your Practice. Replying STOP – or CANCEL, END, QUIT, or UNSUBSCRIBE – stops text messages to your phone number from every practice that uses WrenEHR, and START resumes them; replying HELP returns a short automated message; and replying YES confirms the appointment in the most recent text reminder that asked you to confirm. Other text replies do not reach your Practice – contact your Practice directly, and never use these messages for an emergency. Replies to emails go to your Practice – generally to your clinician. Email and text messages are not end-to-end encrypted and may show your Practice's and clinician's names on your device's lock screen.

Calendar links. Reminder emails may include links to add an appointment to your calendar. If you use the Google or Outlook link, the clinician's name, appointment time, and location name or video link are sent to that provider.

Telehealth. If your Practice uses WrenEHR telehealth, live audio and video are carried by the Amazon Chime SDK, part of AWS. You join from the portal or with the link in your reminder, and wait in a waiting room until your clinician admits you. Anyone with that link can reach the waiting room, so don't share it. Wren Clinical does not record telehealth video or store in-room chat messages. Your clinician may record a session's audio – including your voice – to create a transcript (using AssemblyAI) and draft notes (using AWS Bedrock). The Platform does not show you a notice when this happens; your Practice is responsible for asking for your consent and telling you about recording.

Children and guardians. For a minor Client, the portal account is held by a parent or guardian, who can switch between the children they are linked to. Your Practice sets the age at which a minor's own consent limits what a guardian can see in the portal, and the age at which a minor is treated as an adult.

6. Cookies and Similar Technologies

We use cookies and browser storage only to operate the Platform. We do not use advertising or analytics cookies.

• Staff sign-in. Clerk sets cookies to keep Authorized Users signed in. Clerk's sign-in script loads on every Platform page, including client portal and telehealth pages, so visitors' browsers connect to Clerk, share standard connection information (such as IP address and browser type), and may receive Clerk's sign-in-state cookies even when no one is signed in. Clerk does not receive Client portal account information or health information. During a Wren Clinical support session, a cookie identifies the session for up to one (1) hour.
• Client portal. The portal sets three cookies, each limited to your Practice's portal: wren_portal, a signed session token whose session ends after eight (8) hours; wren_portal_subject, which records which person (you or a child you are linked to) you are acting for, for the same period; and wren_portal_hint, which, after you set your password, holds your email address for ten (10) minutes to prefill the sign-in form.
• Browser storage. The Platform stores last-activity times in your browser to sign you out after inactivity, and stores display preferences and, for clinicians, the identifiers of recent recordings. If your portal session ends or the page reloads while you are filling in a form, your in-progress answers, including a typed signature, are kept in your browser's session storage for that tab – which the browser clears when the tab is closed – and are restored only within thirty (30) minutes.
• Third-party content. Every Platform page loads fonts from Google Fonts, so your browser connects to Google and shares standard connection information. Portal pages that set up or take payments load Stripe's payment software, which sets Stripe's own cookies for fraud prevention. Telehealth rooms load components from AWS. If a Practice's logo is hosted elsewhere, your browser loads it from that address.

7. Data Retention Summary

8. Data Sharing and Subprocessors

We share data only as necessary to provide the Platform. Our current subprocessors are listed at ehr.wrenclinical.com/legal/subprocessors. Subprocessors that process PHI are required to execute a HIPAA-compliant Business Associate Agreement with Wren Clinical.

At the Practice's direction, the Platform also sends information to recipients the Practice chooses, including: Clients and guardians, through the portal, email, and text messages; insurance payers, through our clearinghouse (Stedi); Stripe, for card payments; the external calendar services Authorized Users subscribe with; and any external video service the Practice uses for telehealth.

We do not share your personal information or Customer Data with third parties for their own marketing or commercial purposes.

We may disclose information if required by law, legal process, or government request, or to protect the rights, property, or safety of Wren Clinical, its users, or others.

9. Security

Wren Clinical maintains administrative, physical, and technical safeguards to protect the information we hold, including:

• Encryption at rest (AES-256) for databases, file storage, and backups, and encryption in transit (TLS) between browsers and the Platform and between the Platform and its subprocessors. Email and text messages to Clients travel over standard email and carrier networks, which may not be encrypted end to end.
• Separation of each Practice's data, enforced in the database by row-level security.
• Role-based access within each Practice.
• Automatic sign-out after a period of inactivity.
• An audit log of access to and changes in records.
• Threat detection, and a web application firewall in front of the Platform's web application and API.
• Continuous database backups, with monthly database backups copied to a second US Region, and version history for stored files.

Within the Platform, Wren Clinical personnel can access a Practice's records only through time-limited support sessions; actions taken in a support session are recorded in the Practice's audit log and attributed to Wren Support. Wren Clinical personnel can also see support messages and feedback, and the names and email addresses of Authorized Users, without a support session, and the people who administer Wren Clinical's infrastructure have technical access to its databases to operate, back up, and restore the Platform. Security measures applicable to PHI are described in the Business Associate Agreement.

No system is perfectly secure. If you become aware of a security issue, please contact us at support@wrenclinical.com.

In the event of a security breach affecting personal information of Washington residents that Wren Clinical owns or licenses (including Authorized Users' account information or a clinician's Social Security number), Wren Clinical will notify affected Washington residents in accordance with RCW 19.255.010 without unreasonable delay and no later than thirty (30) calendar days after discovery. Notifications will include our contact information, the types of personal information involved, the timeframe of exposure (including breach and discovery dates), and the toll-free telephone numbers and addresses of the major credit reporting agencies. If a breach affects more than 500 Washington residents, Wren Clinical will also notify the Washington State Attorney General's Office within thirty (30) days as required by RCW 19.255.010(7). Where a breach involves information that Wren Clinical maintains for a Practice – including PHI – Wren Clinical will notify the Practice as required by RCW 19.255.010(2) and the Business Associate Agreement.

10. Your Rights, Account Closure, and Data Export

Access and Correction. Authorized Users can view their own profile and update their professional details and signature in the Platform; a Practice administrator can change a user's name and email address. Practice administrators can view and update Practice information and manage Authorized Users.

Exports During the Account. Authorized Users can download individual documents, notes, forms, invoices, superbills, statements, and other records from the Platform, and Practice administrators can export the Practice's activity history and HIPAA audit log. A Client's assigned clinician, that clinician's supervisor, and Practice administrators can also export a Client's records – or all of a clinician's Clients' records – as a single downloadable file, optionally protected by a password. Psychotherapy notes are included only if the person exporting chooses to include them, and each export can be downloaded for seven days.

Account Closure. The Platform does not currently offer self-service account closure. A Practice administrator may close the Practice account by emailing support@wrenclinical.com. When the account is closed, the Practice's client portal, scheduled client messages, automatic payments, and automatic superbills stop, and links in messages already sent to Clients stop working; the same features are paused while an account is suspended (Terms of Service, Section 22). For ninety (90) days after closure, Practice administrators can sign in to view the Practice's records and download a copy of its Customer Data in commonly used electronic formats, but cannot change anything; other Authorized Users lose access at closure. Wren Clinical does not otherwise deliver copies. When that period ends – or sooner, at a Practice administrator's written request – administrators' access ends and Wren Clinical permanently deletes the Practice's Customer Data from the Platform's active systems; backup copies cannot be deleted early and are deleted as the backups expire (Section 4).

Removing an Authorized User. A Practice administrator may deactivate or remove an Authorized User, which ends their access; the Platform first requires the user's Clients to be reassigned, and does not allow the Practice's last administrator to be removed. Because clinical, billing, and audit records must stay accurate, a removed user's profile remains with the Practice's records and their name remains on the records and audit entries they created. To request deletion of your own account information beyond this, email support@wrenclinical.com; we will delete it except where it is part of a Practice's clinical, billing, or audit records or we are required to keep it.

Client Records. Practices can permanently delete Client records as described in Section 4. Clients should direct requests about their records to their Practice (Section 5).

11. Washington My Health MY Data Act

The Washington My Health MY Data Act (MHMD Act) grants Washington residents rights with respect to consumer health data.

Wren Clinical is a business-to-business platform. Our customers are mental health practices. Clients interact with the Platform only through their Practice's client portal, messages, and telehealth, and the information they provide is PHI that Wren Clinical processes on behalf of the Practice under HIPAA. That information is exempt from the MHMD Act under RCW 19.373.100(1)(a)(i) and (1)(b)(i). Clients who wish to exercise rights with respect to their own records should contact their Practice directly.

The information Wren Clinical collects about Authorized Users for their accounts (name, email address, practice name, professional and licensing details, authentication data, and usage metadata) is not "consumer health data" as defined by RCW 19.373.010(8), because it is not linked or reasonably linkable to any individual's past, present, or future physical or mental health status. It is also collected from individuals acting in an employment context, who are excluded from the definition of "consumer" in RCW 19.373.010(7). It therefore falls outside the scope of the MHMD Act.

Wren Clinical separately publishes a Washington Consumer Health Data Privacy Policy to satisfy the publication requirement of RCW 19.373.020(1).

Wren Clinical does not sell consumer health data. We do not share consumer health data for advertising or marketing purposes. We do not use health data to serve targeted advertising.

If you are an Authorized User and have questions about how we handle your account data, contact us at support@wrenclinical.com.

12. Children

The Platform's staff application is intended for mental health professionals, supervised trainees, and practice staff, and we do not knowingly collect account information from individuals under 18. Practices may keep records about minor Clients in the Platform; those records are PHI handled on the Practice's behalf, and a minor's portal account is held by a parent or guardian (Section 5).

13. Changes to This Policy

Wren Clinical may update this Privacy Policy at any time by posting a revised version at ehr.wrenclinical.com/legal/privacy and notifying each Practice's administrators by email or in the Platform. An update takes effect when it is posted, and continued use of the Platform after it is posted constitutes acceptance. When Wren Clinical requires an update to be accepted, Authorized Users are asked to accept it when they next sign in. If a Practice does not agree to an update, its remedy is to stop using the Platform and close its account.

14. Contact

Questions about this Privacy Policy may be directed to support@wrenclinical.com. Clients with questions about their records should contact their Practice.