Privacy

Last updated November 10, 2026.

Who we are

IntegraFlows is a registered trade name of Allevate Health LLC. "We" and "us" on this page mean Allevate Health LLC, doing business as IntegraFlows.

What this page covers

This policy covers the public website at integraflows.com, the text messages practices send their patients through IntegraFlows, and the practice mailboxes a practice connects to IntegraFlows to send REMS forms (both described below). Otherwise it does not cover the IntegraFlows software itself. The modules run inside your practice's DrChrono account, and clinical records created through them live in that chart under your practice's own agreements. We sign Business Associate Agreements with practices that use the software. Ask us about data handling directly and we will answer specifically.

What the website collects

Nothing that identifies you, through the pages themselves. Concretely:

• No cookies are set.
• No analytics, tag managers, advertising pixels or session recording.
• No content is loaded from other companies, so no third party sees your visit.
• Nothing is written to your browser's local or session storage.
• The only form that sends anything is the contact form, described below. The value calculator runs in the page: what you type there is not sent anywhere or saved.

If you use the contact form

The contact form sends what you type into it: your name, work email, practice name, and, if you fill them in, your phone number, number of providers, EHR and message. It goes from your browser to our server and from there into our customer relationship management system, which runs on Odoo. Odoo hosts that system for us as our service provider.

We use what you send to reply to you and to evaluate whether IntegraFlows fits your workflow. We do not sell it or pass it to anyone outside IntegraFlows. The form sets no cookies. Please do not include patient information: we do not need it to answer questions about the product.

Server logs

The site runs on Fly.io, our hosting provider. Like any web server, it records ordinary request logs that include your IP address, the page requested, the time, and your browser's user agent string. These exist to keep the site running and secure. We do not use them to build a profile of you, we do not combine them with anything else, and we do not sell or share them. Fly.io processes them on our behalf as our hosting provider.

If you email us

Every contact link on this site opens your own email program addressed to info@integraflows.com. When you write to us we receive what you send: your email address, your name if you include it, and whatever you tell us about your practice. We use it to reply and to evaluate whether IntegraFlows fits your workflow. We keep that correspondence in our business email account and do not sell it or pass it to anyone outside IntegraFlows.

Please do not send patient information by email. Email is not a suitable channel for it, and we do not need it to answer questions about the product.

Text messages to patients

Practices that use IntegraFlows can text their patients a secure link to a check-in form or a form to sign (see our SMS Terms). For those messages:

• What we use: the patient's mobile number, which the practice provides, and a record of each message and whether it was delivered. The messages carry no medical details.
• Who sees it: the practice, and IntegraFlows as the practice's business associate under a Business Associate Agreement. Messages are sent through Amazon Web Services, which handles them under its own Business Associate Agreement with us.
• What we never do: sell mobile numbers, or share them or any consent to receive texts with anyone for marketing. Mobile opt-in data and consent are not shared with third parties.
• Stopping and deletion: reply STOP to any message to stop texts. To ask about or delete texting records, contact your practice or email info@integraflows.com.

Practice mailboxes connected to IntegraFlows

A practice can have IntegraFlows email its REMS forms (the SPRAVATO REMS Patient Monitoring and Patient Enrollment forms) to the REMS program from the practice's own mailbox, such as its front desk address, instead of faxing them. The practice connects the mailbox either by signing in to it with Google or Microsoft, or by having its Google Workspace or Microsoft 365 administrator approve IntegraFlows for that purpose. For those mailboxes:

• The one permission we ask for: to send email as that mailbox (Google'sgmail.send, Microsoft's Mail.Send). We cannot read, search, delete or change any email, contacts or settings in the mailbox, and we never ask for that.
• What we send: only a REMS form that the practice's staff signed and submitted in IntegraFlows, addressed to the REMS program address the practice uses. Each email names the practice and the form. We send nothing else from the mailbox: no marketing, no other messages.
• What we keep: the mailbox address, the encrypted connection Google or Microsoft gives us when a mailbox is connected by signing in, and a record of each form we sent (when, to which address, and whether it was accepted). The forms themselves are patient health information, handled for the practice as its business associate under our Business Associate Agreement.
• Who sees it: the practice and IntegraFlows. We do not sell this data, use it for advertising, use it to train AI models, or let anyone read it, except as the law requires or the practice asks.
• Disconnecting: the practice can disconnect a mailbox in IntegraFlows at any time, or remove our access from its Google or Microsoft account settings. When the practice disconnects in IntegraFlows, we also ask Google or Microsoft to revoke our access, then delete the stored connection; the send records stay as part of the practice's records.

How we protect sensitive data

This covers the data described above that IntegraFlows holds for practices: the Google and Microsoft mailbox connections, the forms we send and their send records, and the patient health information the practice uses IntegraFlows for. We protect it as follows:

• Encrypted in transit: every connection to IntegraFlows, and from IntegraFlows to Google, Microsoft and the practice's electronic health record, uses HTTPS (TLS). Plain HTTP is redirected to HTTPS.
• Mailbox and sign-in tokens encrypted at rest: the access Google or Microsoft gives us for a connected mailbox, and the practice's electronic health record sign-in tokens, are stored only in encrypted form, using AES-256-GCM. The encryption keys are kept separately from the data, as protected secrets of our hosting platform, and can be rotated. Each stored token is bound to its own record, so a copy moved elsewhere cannot be decrypted.
• Encrypted storage: IntegraFlows' database is kept on encrypted storage volumes at our hosting provider.
• Least access: we ask Google and Microsoft only for permission to send email, never to read it. Inside IntegraFlows, each practice sees only its own data, and staff see only what their role allows. IntegraFlows' own administration screens do not show patients.
• Nothing sensitive in logs: tokens and keys are never written to logs, and our logs and operational records are kept free of patient names and identifiers.
• Limited keeping: we keep a mailbox connection only while the practice uses it, and delete it when the practice disconnects or removes our access.
• Under a Business Associate Agreement: patient health information is handled for the practice as its business associate, with the safeguards and breach notification that agreement and HIPAA require.

Questions about how we protect data can go to info@integraflows.com.

Google user data

This section covers the information IntegraFlows receives from Google when a practice connects a Gmail or Google Workspace mailbox to send its REMS forms.

• What we access: permission to send email as that mailbox (gmail.send), and the mailbox's email address, which Google gives us when the practice signs in (openid andemail). We cannot read, search, change or delete any email, and we do not access contacts, calendars, files or any other Google data.
• How we use it: only to send the REMS forms the practice's staff submitted in IntegraFlows, from that mailbox, to the REMS program address the practice uses, and to show the practice which mailbox is connected.
• Sharing: we do not sell Google user data, transfer it to anyone, use it for advertising, or use it to develop, improve or train AI or machine learning models. People at IntegraFlows do not read it. The exceptions are sending the forms the practice asks us to send, and what the law requires.

How we protect Google user data

• Tokens encrypted at rest: the refresh token Google issues for a connected mailbox is stored only in encrypted form, using AES-256-GCM, and is bound to that mailbox's own record so a copy moved elsewhere cannot be decrypted. The encryption keys are kept separately from the data, as protected secrets of our hosting platform, and can be rotated.
• Access tokens never stored: the short-lived access tokens used to send are held only in server memory until they expire, and are never written to storage.
• Encrypted in transit: every connection between IntegraFlows and Google, and between the practice and IntegraFlows, uses HTTPS (TLS).
• Encrypted storage: IntegraFlows' database is kept on encrypted storage volumes at our hosting provider.
• Access control: a mailbox can be used only by the practice that connected it. Every send is checked against that practice's connected mailbox and the address it names before Google is contacted.
• Nothing sensitive in logs: tokens and keys are never written to logs.
• Keeping and deleting: we keep a mailbox connection only while the practice uses it. When the practice disconnects in IntegraFlows, we revoke our access with Google and delete the stored token. Removing IntegraFlows in the Google account's security settings ends our access at once. To ask us to delete any Google user data we hold, email info@integraflows.com.

IntegraFlows' use and transfer to any other app of information received from Google APIs will adhere to theGoogle API Services User Data Policy, including the Limited Use requirements.

Your choices

Because the site stores nothing on your device, there is nothing to opt out of and no cookie banner to dismiss. If you have written to us and want your correspondence deleted, or want to know what we hold, email info@integraflows.com and we will action it.

Children

This website is intended for clinicians and practice staff. It is not directed at children and we do not knowingly collect information from them.

Changes

If we change how this site handles information, we will update this page and the date above. Material changes will be described here rather than made quietly.

Contact

Questions about this policy can go to info@integraflows.com, or by post to: