Privacy Policy
MultiPlan, Inc. (MultiPlan, we, us, or our) is committed to maintaining confidentiality for all of the information received from our customers, including information received from this website. When we receive personal data, we respect the privacy and the confidentiality of that information. We collect and maintain information to administer our business and to provide products and services to our health care customers and their members. We provide security safeguards in handling and maintaining personal data to protect against risks such as loss, destruction, or misuse. We do not engage in the sale or trading of mailing lists or personal data. We require our business affiliates to follow the same or substantially similar privacy principles.
A. Scope
This Privacy Policy applies to information we collect from you or that you may provide when you visit our website. This Privacy Policy does not apply to information collected by MultiPlan offline or through any other means. In certain situations, we function as a service provider for our business customers (e.g., health plans) pursuant to the Health Insurance Portability and Accountability Act (HIPAA). In the course of providing services for our business customers, we may collect your personal data on their behalf pursuant to our contracts with them, including HIPAA business associate agreements. Notwithstanding anything to the contrary, this Privacy Policy does not apply to our collection and processing of this data. We recommend referring to the Notice of Privacy Practices of the entity with which you have a relationship (e.g., health plans) for information on how they engage service providers, like us, to collect and process such data on their behalf.
If you do not agree with our policies and practices, your choice is not to use our website.
B. Definitions
In this Privacy Policy, the following terms will be used:
Personal data: means any data collected during your visit to our website that can be used to identify an individual, directly or indirectly; personal data includes attributes such as a name, location data, an online identifier, or other factors specific to the physical, cultural, or social identity of the person.
Processing: means any operation which is performed on personal data, including the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, restriction, destruction, or any kind of disclosure of personal data.
C. Data Collection and Processing
MultiPlan will only use the personal data that we gather from operating this website as set forth in this Privacy Policy. Please review the way we collect and use personal data; for what purposes we collect and use personal data; with whom we may share personal data; and what control and information rights you may have with respect to your personal data.
Personal Data Collected From You
When you use the website, we may collect the following information from you:
• Contact Information. When you contact us, we may collect your first and last name, company name, job title, email address, phone number, and any other information you choose to provide to us. We use this information to communicate with you directly, and to send communications in accordance with your preferences.
• Newsletter and Marketing Emails. You may choose to supply your information to subscribe to a newsletter, including your email address and applicable interests and communications preferences. This information will be used to communicate with you as needed, and will not be shared with any third party. If you wish to stop receiving email messages from us, simply click the “unsubscribe link” provided at the bottom of the email communication. Note that you cannot unsubscribe from certain services-related email communications (e.g., technical or legal notices).
• Provider Directory. When you use our searchable provider directory, we may collect any information that you include in your search, including provider network, the type of facility you are interested in, and zip code. We use this information to facilitate your searches in the provider directory.
Personal Data Automatically Collected
As is true of most digital properties, we and our third-party service providers may automatically collect certain information from or in connection with your device when visiting or interacting with our website, including our searchable provider directory. For example:
• Log data, including the date and time of your visit; your device type, screen resolution, and browser version; your internet service provider; information on your operating system, including language settings; and information on how you arrived at our website.
• Analytics data, including the electronic path you take to our website, through our website and when exiting our website, UTM source, as well as your usage and activity on our services, such as the time zone, activity information (first and last active date and time), usage history (flows created, campaigns scheduled, emails opened, total log-ins) as well as the pages, links, objects, products and benefits you view, click or otherwise interact with.
• Location data, such as general geographic location that we may derive from your IP address.
Such information is necessary for us to administer the website, and we use this data only to assist us in providing an effective service (e.g., to ensure our content is accessible on your device), maintain security, and to collect broad demographic information for anonymized, aggregated use.
For all visitors to our website, we deposit and track cookies. Cookies are files with small amount of data, which may include an anonymous unique identifier for each visitor. We may use this information to enable our website to recognize repeat users and track usage patterns to better serve visitors when they return to the website. Most browsers provide a simple procedure that enables users to control whether or not they want to receive cookies or notifies them when a website is about to deposit a cookie file. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our website.
D. Information Sharing
We may also share, transmit, disclose, grant access to, make available, and provide personal information with and to third parties, as follows:
• Anonymous or Aggregate Data or Statistics. We may disclose anonymized, aggregated data and statistics about our website and its users to third parties, including, for example, prospective clients or partners. This statistical information will not include personal data. Please note where we maintain deidentified information, we will maintain and use the information in deidentified form and not attempt to reidentify the information except as required or permitted by law.
• Company Reorganization or Acquisition. We may disclose personal data in the context of a company reorganization or acquisition by a third party, or if we are legally entitled or required to do so.
E. Data Security and Retention
We have implemented appropriate safeguards to secure your personal data, and only authorized personnel have access to personal data. Our security program and its related policies are regularly reviewed. We cannot guarantee the security of information submitted while it is in transit, however, and the submission of personal data is at your own risk.
We will retain data about you only as long as necessary to fulfill the purposes for which we collected it. If applicable regulatory or contractual retention timelines apply, we will retain your personal data as required.
F. Data Analytics
To improve and optimize our website, we use Google Analytics and our own proprietary analytics tools to collect information about the use of our site. Generally, we collect information such as device and browser information, IP addresses, geographic locations, time and length of visit, pages accessed, and referring site. For information on how Google Analytics collects and processes data, as well as how you can control information sent to Google, review Google’s website, “How Google uses data when you use our partners’ sites or apps” located at www.google.com/policies/privacy/partners/. You can learn about Google Analytics’ currently available opt-outs, including the Google Analytics Browser Ad-On here: https://tools.google.com/dlpage/gaoptout/.
G. Region-Specific Disclosures
Under the laws applicable to you and your personal data, you may be entitled to exercise certain rights with respect to the way MultiPlan collects or processes your personal data.
1. California
If you are a California Resident, please see our California Privacy Notice for additional California-specific privacy information.
2. Colorado, Connecticut, Virginia, and Utah
If you are a Colorado, Connecticut, Virginia, or Utah Resident, please see our State Privacy Notice for additional state-specific privacy information.
H. Children’s Personal Data
Our website is not intended for children under 13 years of age, and we do not knowingly collect personal data from children under 13. If you are under 13, do not use or provide any information on this website. If we learn we have collected or received personal data from a child under 13 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 13, please contact us at 16 Crosby Drive, Bedford, MA 01730, or by email at [email protected].
I. Third-Party Websites
Our website may include links to third-party websites, plug-ins and applications. Except where we post, link to or expressly adopt or refer to this Privacy Policy, this Privacy Policy does not apply to, and we are not responsible for, any personal data practices of third-party websites and online services or the practices of other third parties. To learn about the personal data practices of third parties, please visit their respective privacy policies.
J. Contacting MultiPlan
If you have any questions or concerns about this Privacy Policy, you may email us at [email protected]. Any information you provide when contacting us will be used only to handle your request, and will be deleted upon resolution of your question or concern, unless a statutory retention period applies. To raise a Privacy related inquiry or concern please contact [email protected]. To raise a Security related inquiry or concern please contact [email protected].
K. Amendments to This Privacy Policy
We reserve the right to change this Privacy Policy from time to time by publishing the updated policy to our website.
This Privacy Policy was last updated on December 23, 2022.
California Privacy Notice
This California Privacy Notice (the CA Notice) supplements the information contained in our Privacy Policy above and applies solely to individual residents of the State of California (consumers or you). This CA Notice describes how we collect, use, disclose, and otherwise process personal information of individual residents of the State of California through our website within the scope of the California Consumer Privacy Act of 2018 (CCPA).
Unless otherwise expressly stated, all terms in this CA Notice have the same meaning as defined in our Privacy Policy or as otherwise defined in the CCPA.
COLLECTION AND USE OF PERSONAL INFORMATION
In the last 12 months, we have collected the following categories of personal information:
• Identifiers, such as your first and last name, email address, and phone number;
• California Customer Records (Cal. Civ. Code § 1798.80(e)), such as phone number
• Internet/Network Information, such as device information, logs and analytics data; and
• Geolocation Data, such as your approximate location based upon your IP address.
We collect personal information from and about consumers for a variety of purposes. To learn more about the types of personal information we collect, the sources from which we collect or receive personal information, and the purposes for which we use this information, please refer to the “Data Collection and Processing” section of our Privacy Policy.
DISCLOSURE OF PERSONAL INFORMATION
As described in the “Information Sharing” section of our Privacy Policy, we share personal information with third parties for business purposes. The categories of third parties to whom we disclose your personal information for a business purpose may include: (i) other brands and affiliates in our family of companies; (ii) our service providers and advisors; or (iii) analytics providers.
In the last 12 months, we have not knowingly “sold” personal information or “shared” personal information for “cross-context behavioral advertising.” We do not have actual knowledge of “selling” or “sharing” personal information of individuals under 16 years of age.
YOUR CALIFORNIA PRIVACY RIGHTS
As a California resident, you may be able to exercise the following rights in relation to the personal information that we have collected about you (subject to certain limitations at law):
The Right to Access/Know | You have the right to request any or all of the following information relating to your personal information we have collected and disclosed in the last 12 months, upon verification of your identity:
|
The Right to Request Deletion | You have the right to request the deletion of personal information we have collected from you, subject to certain exceptions. |
The Right to Correction | You have the right to request that any inaccuracies in your personal information be corrected, taking into account the nature of the personal data and the purposes of the processing of the consumer’s personal information. |
The Right to Non-Discrimination | You have the right not to receive discriminatory treatment for exercising these rights. However, please note that if the exercise of these rights limits our ability to process personal information (such as in the case of a deletion request), we may no longer be able to provide you our products and services or engage with you in the same manner. |
HOW TO EXERCISE YOUR CALIFORNIA CONSUMER RIGHTS
To Exercise Your Right to Access, Right to Know, Right to Deletion, or Right to Correction
Please submit a request by emailing us at [email protected] with the subject line, “California Rights Request.”
Before processing your request, we will need to verify your identity and confirm you are a resident of the State of California. In order to verify your identity, we will generally either require the successful authentication of your account, or the matching of sufficient information you provide us to the information we maintain about you in our systems. This process may require us to request additional personal information from you, including, but not limited to, your name, email address, or phone number.
In certain circumstances, we may decline a request to exercise the rights described above, particularly where we are unable to verify your identity or locate your information in our systems. If we are unable to comply with all or a portion of your request, we will explain the reasons for declining to comply with the request.
Authorized Agents
In certain circumstances, you are permitted to use an authorized agent (as that term is defined by the CCPA) to submit requests on your behalf through the designated methods set forth in this CA Notice where we can verify the authorized agent’s authority to act on your behalf.
For requests to know, delete, or correct personal information, we require the following for verification purposes:
(a) a power of attorney valid under the laws of California from you or your authorized agent; or
(b) sufficient evidence to show that you have:
1. provided the authorized agent signed permission to act on your behalf; and
2. verified your own identity directly with us pursuant to the instructions set forth in this CA Notice; or directly confirmed with us that you provided the authorized agent permission to submit the request on your behalf.
State Privacy Notice
This State Privacy Notice (the State Notice) supplements the information contained in our Privacy Policy above and applies solely to individual residents of the States of Colorado, Connecticut, Utah, and Virginia (consumers or you). This State Notice describes how we collect, use, disclose, and otherwise process personal information of individual residents of the States of Colorado, Connecticut, Utah, and Virginia through our website within the scope of applicable state privacy laws. If you are a California Resident, please see our California Privacy Notice for additional California-specific privacy information.
Unless otherwise expressly stated, all terms in this State Notice have the same meaning as defined in our Privacy Policy or as otherwise defined under applicable state law.
COLLECTION, USE AND DISCLOSURE OF PERSONAL DATA
We collect personal data from and about consumers for a variety of purposes. To learn more about the types of personal data we collect, the sources from which we collect or receive personal information, the purposes for which we use this information, and how this information is shared please refer to the “Data Collection and Processing” and “Information Sharing” sections of our Privacy Policy.
YOUR STATE PRIVACY RIGHTS
As a Colorado, Connecticut, Utah, or Virginia resident, you may be able to exercise the following rights in relation to the personal data that we have collected about you (subject to certain limitations at law):
In accordance with applicable privacy law, and depending upon the jurisdiction in which you reside, you may have some or all of the following rights in respect of your personal data:
• Right of access. Obtain information about whether your personal data is being retained, and for what purpose, and obtain access to the personal data retained;
• Right to deletion. Request deletion or restriction of use of your personal data;
• Right to correction. Request correction of any inaccurate or incomplete personal data we hold about you;
• Right to withdraw consent. Withdraw your consent to the processing of your personal data, or object on particular grounds that your personal data is subject to processing;
• Right of portability. Require your personal data in a particular machine-readable format be transferred to you, or to another personal data controller;
• Right to control over automated decision-making/profiling. Refuse to be subjected to automated decision making that would produce legal or similarly significant effects; or
• Right to appeal. In the event that we decline to take action on a request exercising one of your rights set forth above, appeal our decision.
o Colorado Residents: If your appeal is denied, you may contact the Colorado Attorney General to address your concerns here.
o Connecticut Residents: If your appeal is denied, you may contact the Connecticut Attorney General to submit a complaint here.
o Virginia Residents: If your appeal is denied, you may contact the Virginia Attorney General to submit a complaint here.
Depending on your state of residency, you may also have the right to not receive retaliatory or discriminatory treatment in connection with a request to exercise the above rights. However, the exercise of the rights described above may result in a different price, rate or quality level of product or service where that difference is reasonably related to the impact the right has on our relationship or is otherwise permitted by law.
How To Exercise Your Right to Access, Right of Portability, Right to Correction, Right to Deletion, or Right to Appeal
Please submit a request by emailing us at [email protected].
Before processing your request, we will need to verify your identity and confirm you are a resident of the State of Colorado, Connecticut, Utah, or Virginia. In order to verify your identity, we will generally either require the successful authentication of your account, or the matching of sufficient information you provide us to the information we maintain about you in our systems. This process may require us to request additional personal information from you, including, but not limited to, your name, email address, and/or phone number.
In certain circumstances, we may decline a request to exercise the rights described above, particularly where we are unable to verify your identity or locate your information in our systems. If we are unable to comply with all or a portion of your request, we will explain the reasons for declining to comply with the request.
Submitting Authorized Agent Requests
In certain circumstances, you are permitted to use an authorized agent to submit requests on your behalf through the designated methods set forth above where we can verify the authorized agent’s authority to act on your behalf. In order to verify the authorized agent’s authority, we generally require evidence of either (i) a valid power of attorney or (ii) a signed letter containing your name and contact information, the name and contact information of the authorized agent, and a statement of authorization for the request. Depending on the evidence provided and your state of residency, we may still need to separately reach out to you to confirm the authorized agent has permission to act on your behalf and to verify your identity in connection with the request.