Aurora CRM

STRATON SYSTEM LLC

Aurora CRM Privacy Policy

Effective date: November 1, 2026.

STRATON SYSTEM LLC provides Aurora CRM and the connected staff workspace at app.auroracrm.co. This policy explains the information handled through that service, including the iOS app, its web content, and connected forms and communications. It is a privacy notice, not a consent to treatment or a waiver of privacy rights.

Privacy: [email protected]. App support: [email protected]. Do not include passwords, verification codes, full payment-card details, or unnecessary health records in an initial email.

1. Our role and your workspace

The organization that administers your workspace decides which staff may use it, which client and business records to enter, and the lawful purposes for using those records. We provide the software and process workspace records to operate the service, support authorized instructions, protect the system, and meet obligations that apply to us.

For information handled on an organization's behalf, our role may be that of a processor or service provider under applicable law and the relevant agreement. For our own account administration, security, support, and legal records, we may determine the processing purposes ourselves. These roles depend on the actual activity; calling us a software provider does not remove duties imposed on us by law.

Your organization has its own responsibilities for notices, permissions, staff conduct, clinical decisions, and disclosures it makes. Its separate privacy or treatment notices may also apply. If a request concerns a workspace-controlled record, we may need to coordinate with its administrator. You may still contact us directly about our handling of information.

2. Information handled

The information depends on enabled features, permissions, and what authorized people provide. Categories include:

Information may be supplied by you, your workspace administrator, authorized colleagues, clients using connected forms or booking flows, or an integration enabled for the workspace. Required fields support the relevant workflow; not providing them can prevent that workflow from being completed.

3. Why we use information

We use information to provide sign-in and permissions, maintain client and appointment records, operate selected communication and payment-related workflows, produce requested documents and reports, support staff administration, resolve support requests, troubleshoot errors, prevent misuse, and maintain service security. We also process information when necessary to comply with applicable legal duties or respond to valid legal requests.

Workspace users remain responsible for deciding whether their business communications, record entries, and requested disclosures are authorized. Their instructions do not authorize us to disregard obligations that apply to us. We do not treat the fact that a person installed the iOS app as consent to an unrelated use of their information.

Where applicable law requires a legal basis, processing may be needed to perform an applicable service agreement, meet a legal obligation, or pursue a legitimate service or security interest after considering the affected person's rights. Consent is relied on where appropriate and legally required. Health or other specially protected information requires any additional condition the applicable law demands; a service agreement alone is not a blanket basis for every use.

4. Cookies, device access, and tracking

Session cookies and browser storage support authentication, security, navigation, and preferences. These are used by the connected web workspace even when it is displayed inside the iOS app. Blocking necessary storage may prevent sign-in or normal operation.

The current native app uses a nonpersistent web session. Closing the app process can clear that device session and require another sign-in; it does not delete records on the server. The app can request camera or photo access when a user chooses an attachment action. Permissions can be managed in iOS Settings. It does not request device geolocation or access to the phone's address book or advertising identifier.

The staff app does not display third-party advertisements or use collected information to track people across other companies' apps or websites for advertising. Workspace business communications are a separate function controlled by authorized staff. This notice does not grant permission to sell client or health records, provide them to data brokers, or use them for unrelated advertising.

5. Who can receive information

Authorized workspace staff can access information according to their permissions. Information may also be handled by providers needed to run an enabled function. The provider and information involved depend on the actual workflow:

This list describes roles, not a statement that every provider receives every record. A provider may also handle information under its own terms for services it supplies directly. We remain responsible for duties that apply to our own provider selection, instructions, configuration, and processing.

Information can be disclosed to recipients selected by an authorized user, to professional advisers where needed, or where a disclosure is lawfully required. A corporate transaction may require disclosure to an appropriate successor or adviser, subject to applicable restrictions and safeguards. A transaction does not itself authorize an unrelated use of sensitive information.

6. Health information and professional services

Aurora CRM supports administrative and recordkeeping work. STRATON does not provide the clinical treatment recorded in a workspace, establish a clinician-patient relationship through this notice, or replace professional judgment. Health information can still be sensitive and legally protected even though the app is not declared as a regulated medical device.

Applicable health-privacy obligations depend on the parties, records, purposes, and law. Where a business associate agreement or another data-processing agreement is required, the parties must have the appropriate agreement and controls in place. This public policy is not such an agreement and does not certify HIPAA compliance or remove any duty that applies to STRATON or the workspace organization.

7. Storage, security, and international processing

The app connects to the workspace over HTTPS. Accounts, permissions, and operational security controls restrict access. No system or transmission method can be guaranteed free from every interruption, vulnerability, or unauthorized act. That limitation is not a waiver of our obligation to use safeguards required by applicable law or an enforceable agreement.

Providers may process information in the United States or other countries where they operate. Where applicable law requires a particular transfer mechanism or additional safeguards, those requirements must be met; using the service is not a substitute for them. If an incident requires notification, the responsible parties must provide it as required by applicable law.

8. Retention, exports, and deletion

Workspace records are retained according to their purpose, authorized instructions, and applicable obligations. Relevant considerations include ongoing service needs, clinical or business recordkeeping requirements, security investigations, disputes, legal holds, and the rights of other people represented in the records. There is no single deletion period for every category.

Account closure, loss of staff access, uninstalling the app, and signing out do not automatically erase server records. A record may need to be retained or access-restricted instead of immediately deleted. Copies can remain in protected recovery backups until replaced or otherwise removed under the applicable backup lifecycle.

Temporary native document downloads receive iOS file protection and are cleaned up by the app. Copies that a user intentionally saves, prints, or shares outside Aurora CRM are controlled by their destination and are not removed by the app's temporary-file cleanup. Review recipients and retain only copies you are authorized to keep.

9. Requests and choices

Contact [email protected] with the subject "Aurora CRM privacy request" to request access, correction, deletion, account closure, or assistance exercising an applicable privacy right. Identify the relevant workspace and request without sending unnecessary sensitive records. We may verify identity and authority before acting.

Depending on applicable law, rights may also include obtaining a copy, portability, restriction, objection, withdrawal of consent where consent is the basis, an appeal, or a complaint to an appropriate authority. Rights and exceptions depend on the circumstances; we will explain applicable limits rather than promise a result that the law or another person's rights do not allow. We will not require a waiver of mandatory rights to process a request.

Your administrator can help with staff access and workspace-controlled records. Camera and photo permissions can be changed in iOS Settings. For business-message opt-outs, contact the sending business or follow the instructions actually provided in the message. Opting out of messages does not itself delete a client record.

10. Age and changes to this policy

The staff app is intended for authorized users aged 16 or older and is not directed at children. Account authority and any required adult or organizational approval must satisfy applicable law. An organization's records may concern younger clients; the organization must have a lawful basis and any required permissions for those records. An App Store age rating is not a statement that the app automatically verifies age or that a clinical service is appropriate for a minor.

We will identify the current policy revision when it is published. Material changes will receive the notice, and any consent, required by applicable law. A revised policy will not retroactively authorize an unrelated use of information. Any service limitation or liability clause remains subject to nonwaivable privacy rights and obligations.