Privacy Policy

Avico Health, Inc. ("Avico Health," "we," "us," or "our") is committed to protecting the privacy and security of our users and customers ("you" or "your"). We recognize that we support healthcare operations that involve sensitive information, and we design our products and internal practices with privacy, security, and trust at the forefront.

Avico Health provides a front-office automation platform that supports healthcare practices with referrals, insurance benefit verification, patient engagement, and prior authorization workflows, along with related websites, applications, and services (collectively, the "Services").

This Privacy Policy explains how we collect, use, disclose, and safeguard personal information in connection with the Services. Avico Health primarily serves healthcare organizations. In certain circumstances, we process protected health information ("PHI") on behalf of our customers as a Business Associate under HIPAA. This Privacy Policy does not apply to patient PHI that we process solely on behalf of a covered entity pursuant to a Business Associate Agreement ("BAA"). Information about our handling of PHI is governed by applicable BAAs and HIPAA requirements.

We encourage you to review this Privacy Policy carefully to understand our data practices and your rights. By using our Services, you acknowledge and agree to the practices described here.

Avico Health may update this Privacy Policy from time to time. If we make material changes, we will provide notice by updating the effective date, posting a prominent notice within the Services, and/or notifying you via email. Continued use of the Services after changes become effective constitutes acceptance of the revised Privacy Policy.

This Privacy Policy applies to:

• Website visitors who browse publicly available content ("Visitors");
• Customers who subscribe to and use the Avico Health platform ("Customers"); and
• Authorized users, including employees, contractors, or agents authorized by a Customer to access the platform ("Authorized Users").

By accessing or using our website, Visitors agree to this Privacy Policy and our Terms of Use.

By accessing or using the Avico Health platform, Customers and Authorized Users agree to this Privacy Policy and our Terms of Service.

Capitalized terms not defined in this Privacy Policy have the meanings set forth in our Terms of Service.

We collect information necessary to operate, maintain, and improve our Services, while limiting collection to what is reasonably required for legitimate business purposes.

A. Personal and Professional Information

• Contact details: name, email address, phone number, mailing address
• Professional details: employer or practice name, role or title, and related business information

B. Account and Authentication Information

• Account credentials: usernames, passwords, authentication tokens, and similar security information used to access the Services

C. Technical and Usage Information

• Device and log data: IP address, browser type, operating system, device identifiers, access times, and usage patterns
• Interaction data: pages viewed, features used, and actions taken within the platform

D. Information from Third Parties

• Supplemental data: information obtained from third-party sources such as insurance payors, clearinghouses, healthcare partners, or integrated service providers, as authorized by the Customer

E. Information We Process on Behalf of Customers

When acting as a Business Associate, we may process PHI strictly in accordance with customer instructions, applicable law, and the terms of the relevant BAA.

We use collected information for the following purposes:

A. Providing and Operating the Services

• Enabling referral management, benefit verification, prior authorization workflows, and patient engagement tools
• Creating and administering user accounts
• Providing customer support and responding to inquiries

B. Improving and Personalizing the Services

• Monitoring performance and reliability
• Analyzing usage trends to enhance features and usability
• Customizing experiences based on user roles and preferences

C. Communications

• Sending service-related notices, updates, and operational messages
• Providing information about new features or changes to the Services
• Sending marketing communications where permitted, with opt-out options

D. Research, Analytics, and Product Development

• Conducting internal research and analysis
• Using aggregated or de-identified data to improve our platform

E. Security, Compliance, and Legal Obligations

• Detecting and preventing fraud, abuse, or security incidents
• Enforcing our agreements and policies
• Complying with applicable laws and regulations

We use cookies and similar technologies (such as pixels, SDKs, and web beacons) to support functionality, analytics, and performance optimization.

Purposes

• Operating and securing the website and platform
• Understanding usage patterns and improving the Services
• Remembering preferences and settings

Examples of Vendors

• Analytics: Google Analytics, Segment, Mixpanel
• Communications: Twilio, SendGrid
• Infrastructure: Amazon Web Services (AWS)
• Authentication: Frontegg

You can control cookies through your browser settings or available consent tools, subject to vendor-specific limitations.

We may disclose personal information in the following limited circumstances:

• Service providers: trusted vendors who support hosting, infrastructure, analytics, communications, and customer support, under contractual confidentiality obligations
• Legal and regulatory requirements: when required by law, subpoena, court order, or governmental request
• Business transactions: in connection with a merger, acquisition, financing, reorganization, or sale of assets
• Protection of rights and safety: to protect Avico Health, our customers, users, or the public

We do not sell personal information.

We implement administrative, technical, and physical safeguards designed to protect personal information, including:

• Encryption of data in transit and at rest
• Role-based access controls and multi-factor authentication
• Ongoing security monitoring and testing
• Incident response and breach notification procedures
• Limiting employee access to data on a need-to-know basis

We retain personal information only as long as necessary to fulfill the purposes described in this Privacy Policy, comply with legal obligations, or as otherwise permitted by contract or law.

Depending on your location and applicable law, you may have the right to:

• Access or update your personal information
• Request deletion or restriction of certain data
• Object to certain processing activities
• Receive a copy of your personal information
• Opt out of non-essential communications

Requests may be submitted using the contact information in Section 14.

• Browser controls: Most browsers allow you to manage or block cookies
• Analytics opt-out: Google Analytics opt-out tools are available from Google
• Email communications: Marketing emails include unsubscribe links; transactional messages are not optional

California residents have rights under the California Consumer Privacy Act (CCPA), including rights to access, delete, and receive information about personal data practices.

• Non-discrimination: We do not discriminate for exercising privacy rights
• Sale of information: We do not sell personal information
• Shine the Light: California residents may request information about certain disclosures for direct marketing purposes