Terms Unconditional

EHR & Health Data Systems · EHR Vendor (Ambulatory/Practice) · Structural / no discrete incident

Tebra (formerly Kareo / PatientPop)

Headline

No breach, DOJ, OCR, FTC or state AG action against Tebra was verified this pass.

Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.

No breach, DOJ, OCR, FTC or state AG action against Tebra was verified this pass. The finding is structural, in the contract small practices sign. Tebra's customer Terms of Service (effective July 1, 2026) cap Tebra's total liability at what the practice paid in the prior six months and require any claim against Tebra to be brought within six months. They allow claims only on an individual basis (no class actions) and waive jury trial, after mandatory non-binding mediation in Orange County. The agreement renews automatically unless written notice is received at least 60 days before the term ends, the practice 'cannot cancel' mid-term, and there are no refunds for stopping early. If a practice asks for its data after its coverage ends, Tebra may charge $100 an hour, and exports come only as Excel or CSV.

  • SeveritySeverity 2 of 5, not independently verified. No breach, DOJ, OCR, FTC or state AG action against Tebra was verified this pass.
  • Evidence tierUnassigned
  • Claims confirmedNo sourced claims yet
  • Last verified2026-10-15

Primary source. www.tebra.com/tebra-terms-of-service — Unverified - heuristic first draft.

Last verified 24 days agoverified 24 days ago0180 days
Freshness. Last verified 24 days ago (2026-10-15); stale after 180 days.

Terms

Arbitration

Customer Terms of Service: no arbitration. Non-binding AAA mediation in Orange County comes first, then exclusive venue in C.D. Cal. or Orange County Superior Court. Individual-only claims (class waiver), jury waiver, a six-month liability cap and a six-month claim deadline. Patient Portal Terms: no arbitration, individual-only claims, and a $500 liability cap.

Data sharing

Website Privacy Policy effective Jan 20, 2025; a separate Platform Privacy Policy and California Supplemental Notice exist. Detailed sharing practices not reviewed this pass.

Who holds your data. Data chain: Tebra (formerly Kareo / PatientPop), then Tebra Technologies, Inc.; privately held, investor-backed (Golub Capital-led Series A/B; Dec 2025 round led by Hildred); no controlling PE owner identified (parent), then EHR vendor layer. See cross-cutting finding 16: THE EHR LAYER — THE COMPANY HOLDING YOUR CHART IS ONE YOU NEVER SIGNED WITH.

Fees and billing

Customer agreements renew automatically for equal terms, with non-renewal notice required at least 60 days in advance. No mid-term cancellation and no refunds. A reactivation fee applies after payment-related suspension. Post-termination data help costs $100/hour (30-minute minimum). Data is retained at least 60 days after termination and then disposed of. An account is deemed abandoned after 30 days without logins combined with unpaid fees.

Contacts

Privacy contact. Tebra Privacy, 888-775-2736; rights requests 1-844-422-7336 or https://www.tebra.com/privacy-web-form/

Legal notice. Tebra Technologies, Inc., 1111 Bayside Drive, Corona Del Mar, CA 92625. This is the address printed in the vendor's privacy notice, which is not necessarily the registered agent for service of process. For formal legal notice, check the notice clause in the practice's signed customer agreement and the Secretary of State registered-agent record in the state of incorporation.

Mailing address. Not recorded.

Written channel present
Paper trail: written. Written channel present.

Evidence

No claims have been itemized for this row yet.

Sources

SourceClaimTierStatusQuote
Company customer agreement · 2026-07-01
www.tebra.com/tebra-terms-of-service
whole rowUnassignedconfirmed“ANY CLAIM BY CUSTOMER AGAINST TEBRA MUST BE BROUGHT WITHIN SIX (6) MONTHS”
Quote basis: not recorded.
Company terms of use (patient) · 2023-10-16
www.tebra.com/patient-portal-terms-service
whole rowUnassignedconfirmed“does not exceed five hundred dollars ($500)”
Quote basis: not recorded.
Company policy page · 2026-10-14
www.tebra.com/term-termination-return-data-faq
whole rowUnassignedconfirmed“Tebra may charge the Customer the standard rate of $100 an hour (minimum 30 minutes)”
Quote basis: not recorded.
Company privacy policy · 2025-01-20
www.tebra.com/privacy-policy/
whole rowUnassignedconfirmed“Tebra Technologies, Inc. (formerly known as Kareo, Inc.)”
Quote basis: not recorded.
Trade press · 2024-12
histalk2.com/2024/12/08/morning-headlines-12-9-24
whole rowUnassignedconfirmed“Ambulatory health IT vendor Kareo, which merged with PatientPop in 2021, officially takes on the Tebra brand name.”
Quote basis: not recorded.

Source vault

Link status: Candidate - not yet fetched

DocumentLast fetchPDF
Privacy policy
https://www.tebra.com/privacy-policy/
Not fetched yetNOT CONFIRMED
Terms of service
https://www.tebra.com/tebra-terms-of-service
Not fetched yetNOT CONFIRMED
Website
https://www.tebra.com/
Not fetched yet—
Primary source
https://www.tebra.com/tebra-terms-of-service
Verification: Unverified - heuristic first draft
Not fetched yet—

Enforcement

No enforcement actions are linked to this row.

State statute

Headquarters on file: CA. Provisions of CCPA/CPRA on file:

ProvisionTypeSource
Right to Deletion
Cal. Civ. Code § 1798.105
hardsource
Right to Correction
Cal. Civ. Code § 1798.106
hardsource
Right to Know / Access
Cal. Civ. Code § 1798.110
hardsource
Right to Limit Use of Sensitive Personal Information
Cal. Civ. Code § 1798.121; Cal. Code Regs. tit. 11, § 7027
hardsource
Right to Data Portability
Cal. Civ. Code § 1798.130(a)(3)(B)(iii)
hardsource
Privacy Policy / Privacy Notice Requirements
Cal. Civ. Code § 1798.130(a)(5); Cal. Code Regs. tit. 11, § 7011
hardsource
Sensitive Personal Information — Categories
Cal. Civ. Code § 1798.140(ae)
hardsource
Service Provider and Contractor Contract Requirements
Cal. Civ. Code § 1798.140(ag); Cal. Code Regs. tit. 11, § 7051
hardsource
Applicability Threshold (2025 CPI-Adjusted)
Cal. Civ. Code § 1798.140(d)
thresholdsource
Privacy Risk Assessment — Mandatory for High-Risk Processing (Eff. Jan. 1, 2026)
Cal. Civ. Code § 1798.185(a)(15); Cal. Code Regs. tit. 11, §§ 7150-7157
hardsource
Right to Opt Out of Sale or Sharing
Cal. Civ. Code §§ 1798.120, 1798.135
hardsource
Sale vs. Sharing Distinction
Cal. Civ. Code §§ 1798.140(ad), 1798.140(ah)
hardsource
Enforcement — CPPA and AG; Civil Penalties (2025 CPI-Adjusted)
Cal. Civ. Code §§ 1798.155, 1798.199.90; Cal. Bus. & Prof. Code § 17206
hardsource
Notice at Collection
Cal. Code Regs. tit. 11, § 7012
hardsource
Cybersecurity Audit — Annual Independent Audit Requirement (Eff. Jan. 1, 2026)
Cal. Code Regs. tit. 11, §§ 7120-7124
hardsource
Automated Decision-Making Technology (ADMT) — Notice, Opt-Out, and Access Rights
Cal. Code Regs. tit. 11, §§ 7200-7222; Cal. Civ. Code § 1798.185(a)(16)
hardsource