Privacy Policy

(a) Registration Information. To use the Services, you must register an account and provide certain Personal Information, including your name, email address, National Provider Identifier (NPI) number, specialty, practice name, practice location, and other information as specified during registration.

(b) Case Data. When you initiate a prior authorization call through the Services, you provide patient-related information including: patient name, date of birth, medical record number (MRN), diagnosis, contested order, insurance provider, insurance plan, group/BIN number, case ID, and callback number. Case Data constitutes Protected Health Information ("PHI") under HIPAA.

(c) Payment Information. If and when billing is enabled, we collect payment and billing information through secure payment processing methods. We do not store full payment card details on our systems.

(d) Communications. We collect information you provide when you contact us for support, submit feedback, or otherwise communicate with us.

(a) Call Data. When the Services place an outbound call on your behalf, we generate and collect: audio recordings of calls, call transcripts, call metadata (including duration, hold times, timestamps, and call outcomes), and records of interactions with insurance company phone systems.

(b) Insurance Callback Numbers. Callback numbers submitted by Users are aggregated by insurance provider and plan. These numbers are maintained as a shared resource and are not associated with individual patient information.

(a) Usage Data. We automatically collect information about your use of the Services, including: access dates and times, features used, pages or screens viewed, actions taken within the platform, and session duration.

(b) Device Information. We collect information about the device you use to access the Services, including: IP address, browser type and version, operating system, device identifiers, and general location information derived from IP address.

(c) Cookies and Similar Technologies. We use cookies and similar technologies on our websites for essential functions (authentication, security, session management) and analytics. See Section 8 for details.

(a) Providing the Services. To operate, maintain, and deliver the Services, including: authenticating your identity and credentials, placing and managing outbound calls on your behalf, navigating insurance company phone systems, providing Case Data to insurance company personnel, detecting medical reviewer connections, and notifying you for call handoff.

(b) Account Management. To create and manage your account, respond to inquiries, fulfill requests, and send administrative communications about the Services.

(c) Service Improvement. To analyze usage patterns, diagnose technical issues, develop new features, and improve the performance and reliability of the Services, including the AI agent's phone tree navigation and hold management capabilities.

(d) De-Identification and Aggregation. To de-identify PHI in accordance with HIPAA (45 C.F.R. Sections 164.502(d) and 164.514(a)-(c)) and to create aggregated, de-identified, or anonymous data for the purposes of improving our products and services, developing statistical analyses, and generating insights (such as average hold times by insurance carrier or common phone tree structures).

(e) Insurance Callback Database. To maintain and improve a shared database of insurance company callback numbers organized by provider and plan, available to all Users. No PHI is associated with callback number records.

(f) Security and Compliance. To detect, investigate, and prevent fraudulent, unauthorized, or illegal activity, enforce these Terms, and comply with legal obligations.

(g) Legal Obligations. To comply with applicable laws, regulations, legal processes, or governmental requests.

(a) Insurance Companies. When the AI agent places a call on your behalf, it provides Case Data (including patient information) to insurance company automated systems, intake staff, and other personnel as necessary to advance the prior authorization process. This disclosure is made as your Business Associate acting within the scope of treatment, payment, and healthcare operations.

(b) Service Providers. We work with third-party service providers who assist in delivering the Services, including: telecommunications and telephony providers (for placing and managing calls), cloud infrastructure and hosting providers (for data storage and processing), analytics providers (for service performance monitoring), and payment processors (for billing, when applicable). We require these service providers to agree to use Personal Information and PHI only for the purposes of providing services to us and to maintain appropriate safeguards. Service providers who handle PHI are bound by Business Associate Agreements or equivalent protections.

(c) Aggregated and De-Identified Data. We may share aggregated, de-identified, or anonymous data with third parties for any purpose. Such data cannot reasonably be used to identify any individual.

(d) Business Transfers. In connection with a merger, acquisition, reorganization, sale of assets, or bankruptcy, we reserve the right to transfer your information to the successor entity. In such event, your information will continue to be treated in accordance with this Privacy Policy.

(e) Legal Requirements. We may disclose Personal Information when we believe disclosure is: (i) required to comply with applicable law, regulation, legal process, or governmental request; (ii) necessary to enforce these Terms; (iii) necessary to detect, prevent, or address fraud, security, or technical issues; or (iv) necessary to protect the rights, property, or safety of Citeline Health, our Users, or the public.

(f) With Your Consent. We may share your information with third parties when you have given us your explicit consent to do so.

(a) Encryption of PHI and Personal Information in transit and at rest;

(b) Access controls limiting access to authorized personnel on a need-to-know basis;

(c) Employee training on data privacy and security;

(d) Regular security assessments and monitoring; and

(e) Incident response procedures for potential security events.

(a) Registration Information is retained for the duration of your active account and for a reasonable period thereafter for legal and compliance purposes.

(b) Case Data and Call Data are retained for the period necessary to support the associated prior authorization case and any related appeals, plus an additional period as required by applicable law and our legal obligations.

(c) Aggregated, de-identified, or anonymous data may be retained indefinitely.

(a) Essential Cookies. Required for authentication, security, and session management. These cannot be disabled.

(b) Analytics Cookies. Used to understand how visitors interact with our websites, measure performance, and improve user experience. We may use third-party analytics services such as Google Analytics for these purposes.

(a) Right to Access. You may request access to the Personal Information we hold about you.

(b) Right to Correction. You may request that we correct inaccurate or incomplete Personal Information.

(c) Right to Deletion. You may request that we delete your Personal Information, subject to certain exceptions (such as legal retention requirements).

(d) Right to Data Portability. You may request a copy of your Personal Information in a portable, machine-readable format.

(e) Right to Object. You may object to certain processing of your Personal Information.

(f) Right to Opt-Out. You may opt out of the sale or sharing of your Personal Information. Note that Citeline Health does not sell Personal Information.

Alera, Inc. d/b/a Citeline Health

Attn: Privacy Office

251 Little Falls Drive

Wilmington, DE 19808

Email: privacy@citelinehealth.com

Alera, Inc. d/b/a Citeline Health

Attn: Privacy Office

251 Little Falls Drive

Wilmington, DE 19808

Email: privacy@citelinehealth.com