The MyORAYA SMS program.

MyORAYA is the patient application through which you view your health record, request appointments, request medication refills, and message your care team. The text messaging program exists to do one job: confirm that it is really you signing in, and tell you promptly if your sign-in credentials are changed by someone else.

The registered use case is Two-Factor Authentication. Every text we send is either a one-time passcode you asked for, or an alert that the credentials protecting your account have changed. Messages are event-driven, not scheduled: they are sent in direct response to an action you take, or when an authentication event occurs on your account. There is no recurring campaign, no promotional content, and no advertising of any kind.

We do not use this number for appointment reminders, record updates, billing, or any other general account notification. Those reach you by email and in-app push instead, so the SMS channel stays authentication-only.

Text messages are deliberately kept short and free of clinical detail. They do not contain diagnoses, test results, medications, or other Protected Health Information beyond the fact that you have a MyORAYA account.

1. You enter your own mobile number yourself, either in the MyORAYA app or at an ORAYA patient check-in kiosk.
2. The consent checkbox and its full disclosure are displayed on that same screen, directly beneath the number field. The box is unchecked by default and is not bundled into any other agreement, including consent to treat or the HIPAA notice.
3. Checking the box is optional. Leaving it unchecked still lets you check in and use the Services; it simply means we send you no texts.
4. If you check it, we send a one-time passcode to that number. Only after you enter that passcode correctly is the number stored and enrolled.

A number that is never verified is never enrolled, and never receives a message beyond the single verification code you requested.

Passcodes are single-use, time-limited, and never shared. Messages 3 and 4 are authentication tripwires: sent once, at the moment the credentials guarding your account change, so you learn immediately if someone else is trying to take the account over.

Nothing else is sent to this number. Appointment reminders, new documents, record updates, and every other general account notification are delivered by email and in-app push only.

Message delivery is subject to your carrier's network availability, and we cannot guarantee that every message will be delivered. Carriers are not liable for delayed or undelivered messages. Messaging is supported on major U.S. wireless carriers; carrier support may change without notice.

• To stop messages: reply STOP to any ORAYA text message. You will receive a single confirmation that you have been unsubscribed, after which we will send no further texts to that number. You can also remove or replace your mobile number in the MyORAYA app.
• To resume messages: reply START to the same number, or re-verify your mobile number in the MyORAYA app.
• For help: reply HELP to any ORAYA text message, or contact us at info@orayasolutions.com or 332-323-0287.

No mobile information (including your mobile phone number, your consent to receive text messages, or your opt-in status) will be sold, rented, leased, shared, or otherwise transferred to any third party or affiliate for that party's own marketing or promotional purposes. Mobile information is not shared with third parties for marketing purposes under any circumstances.

The only disclosures of your mobile number that we make are:

1. To our communications vendor (Twilio) and the underlying wireless carriers, strictly as necessary to transmit and deliver the messages you have asked to receive. These vendors act as service providers, are contractually bound to use the information only to provide that service, and may not use it for their own purposes.
2. To your healthcare provider, as part of your patient contact record, in ORAYA's role as their HIPAA Business Associate.
3. As required by law, by subpoena, court order, or other legal process.

Text message originator opt-in data and consent are never shared with any third party for any purpose other than delivering the message. We do not sell your personal information, and we never share it with data brokers or advertising networks.