Privacy Policy

OpenBots Inc. ("OpenBots," "we," "us," or "our") provides the Coordio Healthcare Platform ("Coordio" or the "Platform"). This Privacy Policy explains how we collect, use, disclose, retain, and protect Personal Information in connection with the Platform, our websites and Trust Center, customer and support interactions, and related services (collectively, the "Services").

This Policy is intended for United States users and addresses our practices under applicable U.S. privacy laws. Additional notices or contract terms may apply to a particular product, customer, jurisdiction, or data type. If another notice conflicts with this Policy, the more specific notice controls for the information and processing it covers.

1. Privacy at a Glance

• Healthcare organizations control the patient and workforce data they submit to Coordio. OpenBots generally processes that data as their service provider, processor, and, when the data is Protected Health Information ("PHI"), HIPAA Business Associate.
• OpenBots does not sell Personal Information and does not share Personal Information for cross-context behavioral advertising.
• We do not use PHI or Consumer Health Data for advertising, data-broker activity, or independent marketing profiles.
• We use Personal Information to provide and secure the Services, perform customer-configured healthcare revenue and administrative workflows, support users, comply with law and contracts, and improve the Services as described below.
• Depending on where you live and the information involved, you may have rights to access, correct, delete, or obtain a copy of Personal Information and to opt out of certain processing.
• For rights concerning PHI or other Customer Data, contact the healthcare organization that collected the information. We assist that organization as required by law and our contract.
• Privacy questions and requests may be submitted through the Privacy Rights Center or to privacy@coordio.com.

2. Scope and Our Privacy Roles

This Policy applies to Personal Information processed through:

• Coordio products, including eligibility and benefits verification, document and fax intake, prior authorization, referral management, appointment workflows, claims, remittance and denial intelligence, payment posting, accounts-receivable workflows, and related integrations;
• websites, demonstration and contact forms, the Trust Center, events, marketing, and sales activities;
• customer account administration, implementation, training, support, security, and billing; and
• approved application programming interfaces, electronic health record ("EHR") integrations, practice-management systems, payer and clearinghouse connections, secure file transfers, email, fax, messaging, and other customer-configured channels.

Our role depends on why and how information is processed:

2.1 Customer Data - processor, service provider, or Business Associate

For information submitted to or accessed by Coordio on behalf of a healthcare provider, health plan, or other customer ("Customer Data"), the customer determines the purpose and means of processing. OpenBots processes Customer Data only under the customer's documented instructions, the applicable services agreement, Data Processing Addendum, Business Associate Agreement ("BAA"), and law.

The customer's privacy notice and, where applicable, HIPAA Notice of Privacy Practices govern the customer's collection and use of Customer Data. Questions and rights requests about Customer Data should be directed to that customer. We will support the customer in responding.

2.2 OpenBots Data - business or controller

OpenBots determines the purposes and means of processing for information it collects for its own website, sales, account administration, billing, security, legal compliance, and business operations ("OpenBots Data"). For OpenBots Data, OpenBots acts as the business or controller and handles applicable privacy requests directly.

2.3 Information outside this Policy

This Policy does not apply to information governed solely by a customer's own systems and practices, third-party services chosen and used independently by a customer or user, or OpenBots workforce and job-applicant information covered by a separate workforce privacy notice.

We make this Policy, or another applicable privacy notice, available at or before collecting Personal Information directly from an individual within its scope, including through relevant websites, forms, account flows, or direct delivery as appropriate. OpenBots workforce members and job applicants receive a separate notice applicable to their information.

3. Personal Information We Collect

The following table describes the categories of Personal Information we may have collected during the preceding 12 months. The actual information depends on the Services a customer configures and how a person interacts with us.

We do not intentionally collect precise geolocation or biometric identifiers to identify website visitors. Customer Data may contain these or other sensitive categories when a customer submits them for a configured workflow. Customers must collect and disclose Customer Data lawfully and limit it to what is necessary.

4. How We Use Personal Information

We use Personal Information to:

• provide, configure, maintain, support, and improve the Services;
• authenticate users, administer accounts and permissions, and segregate customer environments;
• perform customer-configured healthcare administrative and revenue-cycle workflows;
• classify documents, extract fields, detect exceptions, generate predictions or recommendations, route work, and support human review;
• connect to EHRs, practice-management systems, payers, clearinghouses, fax, email, messaging, and other customer-designated systems;
• communicate about accounts, Services, security, support, transactions, appointments, and customer-requested workflows;
• invoice customers, process business payments, maintain business records, and enforce agreements;
• monitor performance, prevent fraud and abuse, investigate incidents, maintain audit trails, and protect people, systems, and data;
• comply with legal, regulatory, contractual, and professional obligations and establish, exercise, or defend legal claims;
• analyze and improve the Services using aggregated or de-identified information where reasonably possible; and
• send business marketing communications where permitted by law and subject to opt-out rights.

We use Personal Information only for the purposes described in this Policy or otherwise disclosed at the time of collection, unless a different use is compatible with the disclosed purpose or is permitted or required by applicable law. Before using previously collected Personal Information for a materially new purpose that was not previously disclosed, we provide notice to the affected individual before the new use and obtain consent or authorization when required.

We do not use PHI or other Customer Data for OpenBots' independent advertising. We do not permit a third-party model provider to use PHI for its own advertising or to train a general-purpose model. Any use of PHI for product improvement, model development, or another purpose must be permitted by HIPAA, the BAA, customer instructions, and other applicable law, including de-identification or authorization requirements.

AI-assisted outputs support administrative workflows and are not medical advice, diagnosis, or treatment recommendations. Customers are responsible for appropriate human oversight and for decisions made using the Services. When OpenBots acts as a controller, we do not use solely automated processing to make a decision that produces legal or similarly significant effects about a consumer unless we first provide any notice, choice, assessment, and human-review rights required by law.

5. Collection Limitation, Consent, and Choices

We seek to collect Personal Information that is reasonably necessary and proportionate for the disclosed purpose. At or before collecting Personal Information directly from an individual, we provide notice of the categories being collected and the purposes for which they will be used through this Policy and, where appropriate, a form-specific, product-specific, cookie, communication, or health-data notice. Where applicable, the collection experience identifies information or fields as required or essential versus optional.

If required or essential information is not provided, we may be unable to provide the relevant Service, feature, or transaction. Declining optional processing will not prevent access to unrelated Services.

We obtain and document consent when required, including for non-essential cookies, certain marketing communications, certain processing of Sensitive Personal Information or Consumer Health Data, and any materially different secondary use that requires consent. Consent or authorization is obtained before the collection, use, transfer, retention, disclosure, or other activity for which it is required. We record consent and privacy preferences electronically and/or in writing, retain the version of the notice or mechanism presented, and implement the individual's choice promptly. A request for consent will describe the information, purpose, recipients or sharing, and how to withdraw consent. If previously collected Personal Information will be used for a new purpose that requires consent or authorization, we provide notice and obtain the updated consent or authorization before the new use.

You may:

• use the cookie preference center to accept, reject, or change non-essential cookie choices;
• unsubscribe from marketing email through the message link;
• reply STOP to an automated marketing text where that mechanism is offered;
• withdraw consent through the same or an equally easy method used to provide it; and
• submit other choices through the Privacy Rights Center.

Withdrawal does not affect processing that was lawful before withdrawal or processing supported by another lawful basis.

6. How We Disclose Personal Information

We may disclose Personal Information to the following categories of recipients for the purposes described in this Policy:

• Customers and authorized users. We make Customer Data available to the customer that provided or authorized it and to users the customer authorizes.
• Service providers, processors, and HIPAA subcontractors. Vendors may host data, provide identity, security, communications, support, analytics, document, integration, or other functions under contracts that restrict their use of Personal Information. A vendor that creates, receives, maintains, or transmits PHI must enter an applicable BAA before receiving PHI.
• Customer-directed integrations and healthcare participants. At a customer's direction, we exchange data with EHR and practice-management vendors, payers, clearinghouses, pharmacies, healthcare providers, fax or messaging services, and other designated systems or recipients.
• Professional advisers and auditors. Lawyers, accountants, insurers, assessors, and auditors may receive limited information subject to professional or contractual duties.
• Government, legal, and safety recipients. We may disclose information when reasonably necessary to comply with law or valid process, protect rights and safety, investigate fraud or security incidents, or establish or defend claims.
• Corporate transaction recipients. Information may be reviewed or transferred in a financing, merger, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate confidentiality and notice obligations.
• At your direction or with consent. We disclose information when you or the applicable customer directs us or when valid consent or authorization permits it.

When applicable law requires it, after completing a valid request to correct, erase, or restrict Personal Information, we communicate the change to authorized users and relevant service providers, processors, affiliates, or other recipients to which the information was disclosed so they can update, remove, or restrict it. We do not make that communication where an applicable exception permits otherwise or where it would be impossible or involve disproportionate effort.

Current core providers include:

The current list of subprocessors and locations is available at Subprocessors & Data Recipients. We assess vendors based on risk and require privacy, confidentiality, security, and incident-notification commitments appropriate to the data and service.

7. No Sale, Cross-Context Behavioral Advertising, or Financial Incentive

OpenBots does not sell Personal Information for money or other valuable consideration and does not share Personal Information for cross-context behavioral advertising as those terms are defined by the California Consumer Privacy Act ("CCPA"). We do not sell Consumer Health Data or PHI, and we do not use or disclose PHI for advertising.

During the preceding 12 months:

• categories of Personal Information sold: none;
• categories of Personal Information shared for cross-context behavioral advertising: none; and
• categories of Personal Information used for a financial incentive or price/service difference: none.

We honor Global Privacy Control ("GPC") and other legally recognized universal opt-out signals as required. A signal applies to the browser or device that sends it and, where we can reliably associate it with an account without creating new privacy or security risk, to that account. We do not respond to legacy "Do Not Track" signals for which no uniform legal standard exists.

8. Cookies and Similar Technologies

We use:

• essential technologies for security, session management, consent records, and core functions;
• functional technologies for requested preferences and features;
• analytics technologies to measure use and performance, enabled only after consent where required; and
• marketing technologies for business marketing, disabled by default and enabled only with required consent.

The website must not place PHI or patient Consumer Health Data in tracking URLs, analytics events, pixels, cookies, or other marketing technologies. A privacy policy or cookie banner alone does not authorize disclosure of PHI to a tracking vendor.

Details, provider names, durations, and preference controls are in the Cookie Policy. Browser controls may limit cookies, but disabling essential technologies may prevent features from working.

9. HIPAA and Other Regulated Health Information

9.1 OpenBots as a HIPAA Business Associate

When Coordio creates, receives, maintains, or transmits PHI for a HIPAA covered entity or another Business Associate, OpenBots acts as a Business Associate. In that role, we:

• use and disclose PHI only as permitted or required by the BAA or law and do not use PHI in a manner that would violate the HIPAA Privacy Rule if performed by the customer;
• apply the minimum-necessary standard where applicable and use role-based access controls;
• maintain administrative, physical, and technical safeguards designed to protect electronic PHI;
• require subcontractors handling PHI to accept applicable HIPAA restrictions and safeguards;
• report security incidents and breaches of unsecured PHI to the customer without unreasonable delay and within any shorter contractual deadline;
• assist customers with individual access, amendment, restriction, confidential-communication, and accounting-of-disclosure obligations as required by the BAA; and
• return or destroy PHI at termination when required and feasible, or continue to protect retained PHI when return or destruction is infeasible.

9.2 This Policy is not a HIPAA Notice of Privacy Practices

OpenBots generally does not determine how a healthcare customer may use PHI for treatment, payment, or healthcare operations. The HIPAA Privacy Rule does not require a Business Associate acting only in that role to issue its own Notice of Privacy Practices. This Policy therefore is not a substitute for the Notice of Privacy Practices of your healthcare provider or health plan.

To access, amend, restrict, or obtain an accounting concerning PHI, contact the provider, plan, or other organization that collected the information. If OpenBots receives the request, we will route or support it as permitted by the BAA and law. You may still contact OpenBots directly about OpenBots Data.

9.3 Breach notification

For a breach of unsecured PHI at or by OpenBots, we notify the applicable covered entity or upstream Business Associate without unreasonable delay and no later than 60 calendar days after discovery, or sooner if the BAA requires. The covered entity is generally responsible for notices to individuals, HHS, and the media, although the parties may assign notice activities by contract.

For health information outside HIPAA, we provide notifications required by the FTC Health Breach Notification Rule and state breach laws when those laws apply.

9.4 Substance-use-disorder and other specially protected records

When Customer Data contains records subject to 42 C.F.R. Part 2 or a state law that is more protective than HIPAA, we process the records only as permitted by the customer agreement, consent or authorization, and applicable law. We do not use such records in a civil, criminal, administrative, or legislative proceeding against an individual unless permitted by law.

9.5 Separate U.S. Consumer Health Data Notice

This subsection is intended to be separate and distinct from the general disclosures above for Consumer Health Data not governed by HIPAA and should be linked directly wherever a U.S. state consumer-health-data law requires a dedicated notice.

When OpenBots controls Consumer Health Data outside its processor or HIPAA Business Associate role, the following applies:

We do not sell Consumer Health Data. We do not use a geofence around a healthcare facility to identify or track a consumer, collect Consumer Health Data, or send health-related messages or advertisements. We collect or share Consumer Health Data only as necessary to provide a product or Service the consumer requested or with the separate consent required by law. We obtain a valid, separate authorization before any sale if our practice ever changes.

Subject to applicable law, a consumer may confirm whether we collect or share Consumer Health Data, access it, obtain a list of third parties or affiliates with which it was shared, withdraw consent, or request deletion. A deletion request will be transmitted to processors, affiliates, and other recipients when required. Submit a request or appeal through the Privacy Rights Center or email privacy@coordio.com.

10. Data Retention and Disposal

We retain Personal Information only as long as reasonably necessary and proportionate for the disclosed purpose, customer instructions, contract, security and audit needs, legal obligations, disputes, and enforcement. In particular:

• Customer Data is retained according to the customer agreement, customer instructions, BAA where applicable, legal holds, and the applicable backup schedule.
• Account, contract, billing, and transaction records are retained during the relationship and afterward for tax, accounting, audit, limitation, and dispute periods.
• Website, sales, and marketing information is retained while relevant to the relationship or until an opt-out, deletion requirement, or documented inactivity standard applies.
• Support, security, and audit records are retained for the period needed to investigate issues, demonstrate control operation, meet contractual commitments, and comply with law.
• Consent, authorization, rights-request, disclosure, and complaint records are retained long enough to demonstrate compliance. HIPAA-required policies and documentation are retained for at least six years from creation or the date last in effect, whichever is later; this six-year rule does not automatically establish the retention period for all PHI.

Upon confirmation of a valid deletion request, or at the end of the applicable retention period, we delete, de-identify, aggregate, destroy, or render information unreadable using methods appropriate to the media and sensitivity, subject to applicable exceptions. Data in backups is isolated from ordinary use and expires under the backup schedule unless restoration, security, legal hold, or disaster-recovery needs require temporary continued retention.

11. Security

We use administrative, technical, and physical safeguards designed to protect Personal Information, including risk management, access controls, least privilege, authentication, encryption, logging and monitoring, vulnerability management, secure development, workforce training, incident response, resilience measures, vendor review, and secure disposal. Safeguards are selected based on the sensitivity, volume, context, and risk of the processing.

No method of transmission or storage is completely secure. Users and customers are responsible for protecting their credentials, configuring permissions appropriately, using approved secure channels, and notifying us of suspected unauthorized activity.

12. Privacy Rights and How to Exercise Them

Depending on your state, relationship with OpenBots, and the information involved, you may have the right to:

• confirm whether we process your Personal Information;
• access the categories or specific pieces of Personal Information we hold about you;
• correct inaccuracies;
• delete Personal Information, subject to exceptions;
• obtain a portable copy;
• obtain information about sources, purposes, categories of recipients, or specific third parties;
• opt out of sale, targeted advertising, or profiling in furtherance of decisions producing legal or similarly significant effects;
• limit certain uses or disclosures of Sensitive Personal Information;
• withdraw consent or revoke an authorization for future processing;
• use an authorized agent where permitted; and
• appeal a denial of a request.

Submit a request through the Privacy Rights Center, email privacy@coordio.com, or write to the address in Section 20.

We will acknowledge and respond within the period required by applicable law, ordinarily within 45 days for U.S. state privacy requests. We may extend the response period when law permits and will explain the extension. Appeals should state "Privacy Appeal" and identify the prior request. We will respond to an appeal within the legally required period and, if denied, provide a method to contact the applicable regulator when required.

We verify requests in a manner proportionate to the request's sensitivity and do not disclose sensitive information until verification is complete. An authorized agent may be required to provide signed authorization, and we may verify the consumer directly. We use information submitted with a request only to verify and fulfill it, prevent fraud, and keep required records. We record the request, verification performed, scope, decision, actions taken, communications, and response or completion date as necessary to demonstrate compliance.

We do not charge a fee unless a request is manifestly unfounded, excessive, repetitive, or another fee is permitted by law. We will not discriminate or retaliate because a person exercised a privacy right.

If a request concerns Customer Data, including PHI, we may direct the requester to the customer and assist that customer. For a request received from a customer or other data controller, we verify the requester's identity and authority as appropriate, determine the legitimacy and scope of the request, and assist in fulfilling or denying it within applicable contractual, regulatory, and agreed service timeframes. Legal exemptions for PHI or other regulated data do not necessarily apply to all information OpenBots holds about the same person.

13. California Privacy Notice

This section supplements the Policy for California residents and uses terms defined by the CCPA.

13.1 Preceding 12-month practices

The sources, business or commercial purposes, recipient categories, and retention criteria for each category are described in Sections 3, 4, 6, and 10. Business-purpose disclosures are limited to service providers or contractors, the applicable customer and its authorized users, customer-directed integrations, professional advisers, transaction recipients, and government or legal recipients as described in Section 6.

13.2 California rights

California residents may exercise rights to know, access, correct, delete, opt out of sale or sharing, limit certain uses and disclosures of Sensitive Personal Information, and receive equal service and pricing. Because we do not sell or share Personal Information and use Sensitive Personal Information only for permitted Service, security, legal, and customer-directed purposes, there is no additional sale/share or sensitive-use activity to opt out of as of the Last Updated date. We nevertheless provide opt-out methods and honor GPC.

We do not disclose Personal Information to third parties for their own direct marketing as contemplated by California's "Shine the Light" law. We do not offer a CCPA financial incentive.

14. Rights Under Other U.S. State Privacy Laws

Residents of states with comprehensive privacy laws may exercise the applicable rights described in Section 12. Where required, we obtain consent before processing Sensitive Personal Information; provide an appeal process; honor recognized universal opt-out mechanisms; conduct data-protection assessments for high-risk processing; and maintain contracts with processors.

Nevada residents may direct us not to make a future sale of covered information as defined by Nevada law. We do not currently make such sales.

Some state privacy laws exempt an entity, PHI, healthcare information, or data maintained under another regulatory framework. We apply an exemption only to the entity, information, or processing the law actually exempts.

15. Children and Minors

The Services are designed for healthcare organizations and authorized adult users, not for children under 13. We do not knowingly collect Personal Information directly online from a child under 13 for OpenBots' own purposes. If we learn that we did so without legally valid parental consent, we will delete it as required.

Healthcare customers may submit pediatric Patient Data to Coordio. We process that data only as Customer Data under the customer's instructions, BAA or other agreement, and applicable law. The customer is responsible for the notices, consents, authorizations, and parental or guardian rights applicable to its collection of that data.

If you believe a child submitted Personal Information directly to OpenBots, contact privacy@coordio.com.

16. Communications and Marketing

We send transactional and Service communications as necessary for an account, contract, support request, security issue, or customer-configured healthcare workflow. A healthcare customer is responsible for establishing the lawful basis and content for patient communications it directs through Coordio, including any consent or opt-out required for calls or texts.

We send OpenBots business marketing only where permitted. Marketing email includes an unsubscribe method. Marketing text consent, where used, is not a condition of purchase. Opting out of marketing does not stop non-marketing communications that are necessary to provide a requested Service, protect an account, or meet a legal obligation.

17. Data Quality

We take reasonable steps to keep OpenBots Data accurate, complete, current, and relevant for its intended use. Individuals, customers, and designated account holders may update certain account information through the Platform, where available, or submit a correction request through the Privacy Rights Center or the contacts in Section 20. For Customer Data, the applicable customer is responsible for the authoritative record; we propagate or support corrections as directed and required by contract or law.

18. Privacy Complaints, Monitoring, and Non-Retaliation

The Privacy Officer receives, investigates, tracks, resolves, and communicates the outcome of privacy inquiries and complaints. OpenBots periodically assesses its privacy program, reviews its Personal Information collection and use practices when changes occur, reviews this Policy at least annually and upon material change, and tracks remediation of identified issues so this Policy remains consistent with actual practices.

We will not retaliate or unlawfully discriminate against a person for raising a privacy concern, filing a complaint with OpenBots or a regulator, or exercising a privacy right. HIPAA complaints may also be filed with the U.S. Department of Health and Human Services Office for Civil Rights.

19. Changes to This Policy

We may update this Policy to reflect changes in the Services, data practices, law, or contracts. We will post the revised Policy with a new Last Updated date and maintain prior versions as required. We will provide additional notice when a change is material or law requires it. We will obtain affirmative consent before collecting, using, or disclosing additional categories of Consumer Health Data or using them for materially new purposes when law requires consent; continued use alone will not substitute for required consent.

20. Contact Us

OpenBots Inc.
Attn: Privacy Officer - Coordio Healthcare Platform
440 Sawgrass Corporate Expressway, Suite 210
Sunrise, FL 33325
United States

Privacy Officer: privacy@coordio.com
Compliance: compliance@coordio.com
Privacy Rights Center: Open Privacy Rights Center
Security concerns: security@coordio.com

Appendix A - Definitions