Regulatory Compliance

In pursuit of collecting and securing your PRIVATE INFORMATION, the COMPANY actively complies with all relevant local, state, and federal regulations. For more information on our current regulatory practices, please contact us using the information at the end of this PRIVACY POLICY.

Data Categorization

The COMPANY categorizes PRIVATE INFORMATION into the following set of categories:

• Personal Identifiable Information (PII)

  We may collect Personal Identifiable Information (PII) and other information required to facilitate the user of our products and services (PRODUCTS AND SERVICES) to you.

  This data will only be shared with the parties necessary to provide our PRODUCTS AND SERVICES that you have registered for.

• Non-Personal Information (NPI)

  We may collect Non-Personal Information (NPI) which includes analytical information about you, such as your browser type, your internet service provider, your IP address, and more. This information lets us see how users find our PRODUCTS AND SERVICES, and it tells us which features users visit most frequently so we can make our PRODUCTS AND SERVICES more useful.

• Payment Card Information (PCI)

  In order to process any required payments, we may also collect Payment Card Information (PCI) from you, including your credit card account holder name, credit card number, and billing address. This information will be passed to our payments gateway for processing and will not be shared with anyone else.

• Protected Health Information (PHI)

  • We may need to gather and process Protected Health Information (PHI), as defined by the Health Insurance Portability and Accountability Act of 1996 (HIPAA). This information relates to past, present, and future health care and/or payment for such health care services of you or your dependents.
  • PHI may be shared with healthcare providers, insurance carriers, and/or other vendors to facilitate the processing of claims. The COMPANY may also provide your PHI to governmental regulatory bodies, including, but not limited to, a state insurance department, and the Office of Civil Rights, the Department of Health and Human Services, or law enforcement agencies.

Cookies

Information Usage

We use personal information we collect only for purposes that are clearly defined, proportionate to the service being provided, and permitted under applicable law. These purposes include:

• Service Delivery. To provide, operate, and maintain our PRODUCTS AND SERVICES, including responding to your inquiries in a neutral, consumer-directed manner without influence from carrier relationships, compensation structures, or third-party commercial interests.
• Service Improvement. To evaluate, test, and improve the functionality, accuracy, reliability, and security of our PRODUCTS AND SERVICES, including through quality assurance reviews, performance monitoring, and analysis of usage patterns. Where AI-driven features are involved, improvement activities are conducted in accordance with the NIST AI Risk Management Framework (AI RMF) principles of transparency, accountability, and fairness.
• Administrative Communications. To provide administrative notices, such as informing you about changes to this Policy, our TERMS, or the operational status of services you use.
• Compliance and Enforcement. To comply with applicable legal, regulatory, and contractual obligations, including federal information security requirements, audit and reporting obligations, and enforcement of our contractual rights.
• Security and Integrity. To detect, investigate, and respond to security incidents, unauthorized access, fraud, or other threats to the integrity of our PRODUCTS AND SERVICES and the data entrusted to us.
• As Otherwise Authorized. For any additional purpose disclosed to you at the point of collection and to which you provide informed, affirmative consent prior to such use.
• Data Minimization. We collect and retain only the minimum personal information necessary to fulfill the stated purposes above. We do not use personal information collected through our PRODUCTS AND SERVICES for advertising, marketing, profiling, or the sale of data to third parties.
• De-Identified and Aggregate Data. We may generate and use de-identified or aggregate statistical data for operational analysis, service improvement, and reporting, provided that: (i) such data has been processed to remove direct and reasonably linkable identifiers in accordance with applicable de-identification standards; (ii) we maintain administrative, technical, and organizational safeguards to prevent re-identification; and (iii) any use of such data complies with applicable federal requirements governing the original information.
• Federal Contract Addendum. Where our PRODUCTS AND SERVICES are delivered under or in support of a federal contract, all data usage is further constrained by the applicable System Security Plan (SSP), Privacy Impact Assessment (PIA), and any agency-specific data handling requirements. AI model training, fine-tuning, or improvement activities using federal data are prohibited unless explicitly authorized in writing by the contracting agency. In the event of a conflict between this Policy and federal contract requirements, the federal contract requirements shall prevail.

Information Sharing

We do not disclose PRIVATE INFORMATION to third parties without your consent, except in the following limited circumstances:

• At Your Direction. We may share information as you explicitly direct, such as with healthcare insurance providers, health plans, or government benefit programs to which you have applied using our PRODUCTS AND SERVICES, and solely for the purposes you specify.
• Authorized Service Providers. We may share information with service providers operating under written agreements that require them to: (i) process data only as necessary to perform defined functions on our behalf; (ii) maintain security controls consistent with NIST SP 800-53 and applicable FedRAMP authorization requirements; (iii) restrict use, retention, and further disclosure of such data; and (iv) return or securely destroy data upon termination of the service relationship.
• Affiliated Entities. We may share information with entities under common ownership only where necessary to fulfill a service you have requested, subject to documented data access controls, role-based access limitations, and separation-of-duties requirements consistent with our authorization boundary.
• Legal and Safety Obligations. We may disclose information about you: (i) when required by law, regulation, subpoena, court order, or other valid legal process; (ii) when disclosure is necessary to prevent imminent harm or threats to safety; (iii) in connection with an investigation of suspected or actual fraudulent or illegal activity conducted by an authorized law enforcement or regulatory body; or (iv) to comply with mandatory incident reporting obligations under federal cybersecurity directives.
• Business Transitions. In the event of a merger, acquisition, or transfer of business assets, any transfer of personal information will be subject to: (i) prior notice to affected users and, where applicable, to authorizing federal agencies; (ii) continued application of the privacy and security commitments described in these TERMS; and (iii) compliance with all applicable federal data disposition and transfer requirements, including any obligations under active federal contracts or authorizations.
• Federal Contract Addendum. Where our PRODUCTS AND SERVICES are delivered under or in support of a federal contract, information sharing is further governed by the terms of that contract, the applicable System Security Plan (SSP), and all FedRAMP or agency-specific authorization conditions. In the event of a conflict between this Policy and federal contract requirements, the federal contract requirements shall prevail.

Advertising and Tracking

We do not engage in targeted advertising based on your activity within our PRODUCTS AND SERVICES, and we do not share personal information with advertising networks or data brokers. Where third-party analytics tools are used on our websites for operational purposes such as site performance and traffic analysis, such tools operate under contractual restrictions that prohibit the use of collected data for advertising purposes. If you access third-party products or services through links on our platform, those services are governed by their own privacy policies.

Rights and Choices

We offer you certain choices about what PRIVATE INFORMATION we collect from you, how we use and disclose the information, and how we communicate with you.

• Emails

  From time to time, we may contact you via email or through other channels for the purpose of providing announcements, promotional information and/or other general communications. We will not use your PHI for marketing except as permitted by HIPAA, such as with your written authorization. If you wish to opt out of receiving any marketing emails or other such communications from us, you will be provided with the opportunity to unsubscribe.

• Cookies

  Web browsers may offer users the ability to disable receiving certain types of cookies; however, if cookies are disabled, some features or functionality of our PRODUCTS AND SERVICES may not function correctly.

• Patient Records

  You are entitled under HIPAA to exercise certain rights regarding your PHI, such as access to patient records. For more information, please see your applicable HIPAA Policy.

Contact

If you have any questions, concerns, or comments about this PRIVACY POLICY, our privacy practices, or if you would like us to update information or preferences you provide to us, please contact us via:

• Email: contact@entratus.ai
• Phone: (855) 553-0850
• Address: Entratus®, LLC, 1002 East Newport Center Drive, Suite 200, Deerfield Beach, FL 33442