This Privacy Policy (this "Privacy Policy") describes how Yuzu Health Inc., a Delaware corporation with offices at 154 W 14th Street, Floor 11, New York, NY 10011 ("Yuzu Health", the "Company", "we", "us", or "our"), collects, uses, and discloses Personal Information about you in connection with Yuzu Health's health plan administration platform, member portal, publicly accessible guides portal, and related websites, applications, and services (collectively, the "Platform" or the "Services"). This Privacy Policy is incorporated into and forms part of the Yuzu Health Terms of Service (the "Terms").
Yuzu Health administers health benefit plans on behalf of employers, plan sponsors, and other Customers. Much of the health information processed through the Platform is protected health information ("PHI") governed by the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, as amended ("HIPAA"). Yuzu Health's creation, receipt, maintenance, and transmission of PHI on behalf of a covered entity, group health plan, or other Customer is governed by the applicable business associate agreement (the "BAA") and, where applicable, the plan's notice of privacy practices, and not by this Privacy Policy. If any term of this Privacy Policy conflicts with the BAA or HIPAA with respect to PHI, the BAA and HIPAA control. This Privacy Policy addresses Personal Information that is not PHI.
In this Privacy Policy, "Personal Information" (also referred to as "Personal Data" in the Terms) means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with an identified or identifiable individual, as defined under applicable law. Personal Information does not include PHI, de-identified or aggregated information, or publicly available information.
This Privacy Policy applies to visitors who view only publicly available content on the Platform, including the guides portal ("Visitors"); individuals a Customer authorizes to access the Platform on its behalf, including employees, contractors, Providers, Brokers, agents, and representatives ("Authorized Users"); and individuals enrolled in or eligible for a health benefit plan administered through the Platform ("Members"). Capitalized terms such as "Member", "Employer", "Broker", "Provider", "Plan Designer", and "Authorized User" have the meanings given in the Terms.
1. YOUR CONSENT; RELATIONSHIP TO THE TERMS, THE BAA, AND THE DPA
1.1 Your Consent. By accessing or using the Platform, or by providing us with Personal Information, you agree to the practices described in this Privacy Policy. If you withdraw your consent, Yuzu Health may continue to use Personal Information previously provided to the extent it is legally or contractually obligated or permitted to do so, and you may no longer be able to use some or all of the Services.
1.2 PHI and the BAA. This Privacy Policy does not govern PHI. Yuzu Health's processing of PHI is governed by the BAA, HIPAA, and any applicable notice of privacy practices, as described in the Terms. This Privacy Policy governs Personal Information that is not PHI.
1.3 Controller, Processor, and Service-Provider Roles. When Yuzu Health processes Personal Information to operate, secure, support, and improve the Platform, it determines the purposes and means of that processing and acts as a controller. When Yuzu Health processes Personal Information on behalf of, and under the instructions of, a Customer, it acts as a processor or service provider, and that processing is also governed by the data processing addendum (the "DPA"). The allocation of these roles is further described in the Terms and the DPA.
2. PERSONAL INFORMATION WE COLLECT
2.1 Information You Provide to Us. When you use the Services, you may provide us with the following categories of Personal Information:
2.1.1 Identifiers. Your name, job title, employer or organization name, postal and work address, email address, telephone number, and demographic details such as your sex.
2.1.2 Government Identifiers and Date of Birth. Your Social Security number, other government-issued identification numbers, and date of birth, which we collect for enrollment, eligibility, and identity-verification purposes. Where this information constitutes PHI, it is governed by the BAA and HIPAA rather than this Privacy Policy.
2.1.3 Account and Credential Information. Your username, password, and other unique identifiers used to access the Platform.
2.1.4 Communications and Support Information. The contents of messages, chats, call recordings and transcripts, and other information you provide when you contact us or use support features. Call recordings and transcripts may contain PHI, which is governed by the BAA and HIPAA.
2.1.5 Payment and Billing Information. Billing contact details and payment card or bank account information, which is processed by our payment processor.
2.1.6 Marketing and Communications Preferences. Your subscription, notification, and communication settings.
2.1.7 Other Information. Any other information you choose to provide in connection with the Services.
2.2 Health, Eligibility, and Claims Information. Eligibility, enrollment, claims, benefits, and other plan-related data submitted to or generated through the Platform is "Submitted Information" and "Member Data" as described in the Terms. Where that information constitutes PHI, it is governed by the BAA and HIPAA rather than this Privacy Policy.
2.3 Information We Collect Automatically. When you access the Platform, we may automatically collect the following:
2.3.1 System and Device Information. Internet Protocol (IP) address, browser type and language, operating system, device type, and device identifiers.
2.3.2 Usage and Activity Information. Pages and content viewed, features used, access times, referring and exit pages, and error logs.
2.3.3 Location Information. General location derived from your IP address.
2.4 Information We Collect From Third Parties. We may receive Personal Information from Employers, plan sponsors, human-resources information systems, medical networks and clearinghouses, pharmacy benefit managers, utilization-management vendors, Providers, analytics providers, and publicly available sources. Much of this information is Submitted Information and, where it constitutes PHI, is governed by the BAA and HIPAA.
2.5 Cookies and Similar Technologies. We and our service providers use cookies, web beacons, and similar technologies to operate and secure the Platform, remember your preferences, and analyze usage. We use the following categories of cookies:
2.5.1 Strictly Necessary. Cookies essential to operate the Platform and maintain secure areas.
2.5.2 Performance and Analytics. Cookies that collect information about how the Platform is used so we can improve it.
2.5.3 Functionality. Cookies that remember choices you make to personalize your experience.
2.6 Most browsers let you refuse or delete cookies through their settings, though some features of the Platform may not function properly if you do. The Platform does not currently respond to browser "Do Not Track" signals.
2.7 Inferences. Inferences we draw from any of the information described above to reflect your preferences and characteristics.
2.8 Accuracy of Information. Much of the Personal Information we process is provided by Employers, human-resources information systems, medical networks, pharmacy benefit managers, utilization-management vendors, Providers, and Members. We rely on the accuracy and completeness of that information and do not independently verify it, as further described in the Terms. You are responsible for providing accurate information and for keeping your Personal Information accurate and current.
3. HOW WE USE PERSONAL INFORMATION
3.1 Depending on how you interact with us and which Services you use, we may use Personal Information to:
3.1.1 Provide the Services. Operate, maintain, and provide the Platform and its features to you.
3.1.2 Authenticate and Secure. Authenticate accounts, maintain security, and detect and prevent fraud, abuse, and unauthorized activity.
3.1.3 Process Payments. Process payments and billing and administer your account.
3.1.4 Communicate. Respond to your inquiries, provide customer support, and send administrative and transactional communications.
3.1.5 Personalize and Improve. Personalize your experience and maintain, improve, and develop the Services.
3.1.6 Analytics and Development. Perform analytics and product development, in de-identified or aggregated form where practicable.
3.1.7 Marketing. Send marketing and promotional communications, subject to your communication choices and applicable law.
3.1.8 Comply and Enforce. Comply with applicable law and legal process, and enforce the Terms and our agreements.
3.1.9 Corporate Transactions. Evaluate or carry out a merger, financing, acquisition, or similar transaction.
3.2 Where information is PHI, Yuzu Health uses it only as permitted by the BAA and HIPAA.
4. HOW WE SHARE PERSONAL INFORMATION
4.1 Yuzu Health does not sell your Personal Information, and does not share it for cross-context behavioral advertising, in each case as those terms are defined under applicable law. We may share Personal Information in the following circumstances:
4.1.1 Subprocessors and Service Providers. With service providers and subprocessors that process Personal Information on our behalf to provide, secure, and support the Services, such as cloud hosting and infrastructure, artificial-intelligence, product analytics and error monitoring, member support and communications, and payment processing providers. Our service providers and subprocessors are subject to change from time to time, and we maintain a current list that we make available as described in the Terms and the DPA.
4.1.2 Plan Participants. With medical networks, Providers, direct-primary-care providers, pharmacy benefit managers, and stop-loss carriers in connection with plan administration. Their access to PHI is governed by the BAA and HIPAA, and they are independently responsible for their own compliance with applicable law.
4.1.3 Affiliates. With our parent companies, subsidiaries, and other entities under common control with us.
4.1.4 Legal and Safety. Where necessary to comply with applicable law, legal process, or a governmental request, to enforce the Terms, or to protect the rights, property, or safety of Yuzu Health, its Users, or others.
4.1.5 Business Transfers. In connection with a merger, financing, acquisition, bankruptcy, or sale or transfer of all or part of our business or assets.
4.1.6 Aggregated or De-Identified Information. In de-identified or aggregated form that does not identify you, which we may disclose to partners, service providers, advertisers, and other third parties, including for marketing or promotional purposes.
4.1.7 With Your Consent. With your consent or at your direction.
5. AI FEATURES AND AUTOMATED PROCESSING
The Platform includes, or may in the future include, features that use artificial intelligence, as described in the Terms. The Guides Assistant searches only Yuzu Health's publicly available guides content and does not access Member Data or PHI. The Call-Center Assistant, which Yuzu Health intends to introduce, may record and transcribe calls, and transcripts may contain PHI, which Yuzu Health processes in accordance with the BAA, the DPA, and applicable law. Yuzu Health's AI service providers do not use Yuzu Health data, including Member Data and PHI, to train, fine-tune, or develop their generally available models.
6. TEXT MESSAGES
6.1 SMS Program. If you provide your mobile telephone number and opt in, Yuzu Health may send you text messages relating to your account, benefits, eligibility, care, and support, and, where you have separately consented, marketing or promotional messages. Message frequency varies depending on your interactions with us and the Services.
6.2 Message and Data Rates. Message and data rates may apply according to your mobile carrier plan. Yuzu Health does not charge for text messages, but your carrier may.
6.3 Opting Out and Help. You may opt out of text messages at any time by replying STOP to any message, and you may reply HELP for assistance. After you opt out, you may continue to receive non-marketing messages necessary to service your account or the Services where permitted by law. Mobile carriers are not liable for delayed or undelivered messages.
6.4 Your Consent to Text Messages. By providing your mobile telephone number and opting in, you consent to receive the text messages described above. Your consent to receive marketing text messages is not a condition of receiving the Services.
7. YOUR PRIVACY CHOICES AND RIGHTS
7.1 Communications Choices. You may unsubscribe from marketing emails using the link in each message, and you may opt out of SMS messages by replying STOP. You cannot opt out of transactional or administrative communications relating to your account or the Services.
7.2 Access and Update. If you have an account, you may access and update certain Personal Information by signing in to the Platform or by contacting us.
7.3 State Privacy Rights. Depending on your state of residence and subject to applicable law and its exceptions, you may have the right to:
7.3.1 Know and Access. Request the Personal Information we have collected about you.
7.3.2 Correct. Request correction of inaccurate Personal Information.
7.3.3 Delete. Request deletion of your Personal Information.
7.3.4 Portability. Request a copy of your Personal Information in a portable format.
7.3.5 Opt Out. Opt out of the sale or sharing of Personal Information and of targeted advertising.
7.3.6 Limit Sensitive Information. Limit the use and disclosure of sensitive Personal Information.
7.3.7 Non-Discrimination and Appeal. Not receive discriminatory treatment for exercising your rights, and to appeal a decision on your request.
7.4 How to Exercise Your Rights. You may submit a request by emailing privacy@yuzu.health. We will take steps to verify your identity before responding, and you may use an authorized agent where permitted by law. Where Personal Information is PHI, your rights are governed by HIPAA and the applicable notice of privacy practices rather than this Privacy Policy.
7.5 Individuals Outside the United States. The Services are intended for users in the United States. If you access the Services from outside the United States, including from the European Economic Area, the United Kingdom, or Switzerland, you understand that your Personal Information will be processed in the United States as described in this Privacy Policy. To the extent Yuzu Health processes your Personal Information as a controller subject to the EU or UK General Data Protection Regulation, you have the rights available under applicable law, including to access, correct, delete, or object to our processing, to data portability, to withdraw consent where processing is based on consent, and to lodge a complaint with your local supervisory authority.
8. CONSUMER HEALTH DATA
To the extent health information is PHI or is otherwise exempt under the Washington My Health My Data Act, Nevada Senate Bill 370, or similar consumer-health-data laws, those laws do not apply to that information. For any consumer health data that is not exempt, Yuzu Health collects and uses it for the purposes described in this Privacy Policy, obtains consent where required, does not sell it, and honors applicable rights to access, withdraw consent, and request deletion.
9. DATA RETENTION
We keep Personal Information only for as long as needed to fulfill the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Retention and deletion of Member Data and PHI are governed by the BAA and the DPA. When Personal Information is no longer needed, we securely delete or de-identify it.
10. HOW WE PROTECT PERSONAL INFORMATION
Yuzu Health maintains commercially reasonable administrative, technical, and physical safeguards designed to protect Personal Information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials, as described in the Terms, and for notifying us promptly of any suspected unauthorized use or security breach.
11. CHILDREN
The Platform is used to administer health benefit plans and is made available to individuals through an Employer, plan sponsor, or other Customer. Accounts are established as part of plan administration, and an individual claims access to an account established for that individual rather than creating one independently. Where an individual under eighteen (18) is enrolled in or eligible for a plan administered through the Platform, we may receive and process information about that individual as a dependent or beneficiary, provided by an Employer, plan sponsor, parent or legal guardian, Provider, or other authorized source, as described in the Terms. An individual under eighteen (18) may access the Platform only by claiming an account established for that individual as part of plan administration. We do not knowingly permit an individual under thirteen (13) to claim an account or provide information to us directly. If you believe an individual has accessed the Platform or provided information to us without appropriate authorization, please contact us at privacy@yuzu.health and we will take appropriate steps.
12. THIRD-PARTY WEBSITES AND SERVICES
The Platform may contain links to, or interoperate with, third-party websites, resources, and services that Yuzu Health does not control. We are not responsible for the privacy practices or content of those third parties, and your use of them is governed by their own privacy notices and terms, as further described in the Terms.
13. INTERNATIONAL DATA TRANSFERS
13.1 United States Processing. The Platform is operated in the United States, and Personal Information we collect will be processed in the United States. By using the Services, you understand that your Personal Information will be processed in the United States, which may have data-protection laws that differ from those of your country of residence.
13.2 Transfer Mechanisms. When we transfer Personal Information from the European Economic Area, the United Kingdom, or Switzerland to the United States, we rely on appropriate safeguards where required by applicable law, such as the European Commission Standard Contractual Clauses and the United Kingdom International Data Transfer Addendum.
14. CHANGES TO THIS PRIVACY POLICY
We may modify this Privacy Policy from time to time. If we make changes, we will update the "Last Updated" date above and, where required, provide additional notice. Changes are effective when posted, and your continued use of the Platform after the effective date constitutes acceptance of the revised Privacy Policy.
15. HOW TO CONTACT US
If you have questions about this Privacy Policy or our privacy practices, please contact us at support@yuzu.health, or by mail to Yuzu Health Inc., 154 W 14th Street, Floor 11, New York, NY 10011. You may also contact our data protection officer, Russell Pekala, at russell@yuzu.health or (203)208-9898.