Privacy Notice

1. Cookies

A. Cookie Overview

Cookie Settings 

“Cookies” are small text files that are placed on your hard drive by a Web server when you access our Site. We may use both session Cookies and persistent Cookies to identify that you’ve logged in to the Site and to tell us how and when you interact with our Site. We may also use Cookies to monitor aggregate usage and web traffic routing on our Site and to customize and improve our Site. Unlike persistent Cookies, session Cookies are deleted when you log off from the Site and close your browser. Although most browsers automatically accept Cookies, you can change your browser options to stop automatically accepting Cookies or to prompt you before accepting Cookies. Please note, however, that if you don’t accept Cookies, you may not be able to access all portions or features of the Site. Some third-party service providers that we engage (including third-party advertisers) may also place their own Cookies on your hard drive.  

 “Web Beacons” (also known as Web bugs, pixel tags or clear GIFs) are tiny graphics with a unique identifier that may be included on our Site for several purposes, including to deliver or communicate with Cookies, to track and measure the performance of our Site, to monitor how many visitors view our Site, and to monitor the effectiveness of our advertising. Unlike Cookies, which are stored on the user’s hard drive, Web Beacons are typically embedded invisibly on web pages (or in an e-mail).

B. Types of Cookies We Use

Strictly Necessary Cookies: These cookies are necessary for the Site to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.

Performance Cookies: These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies, we will not know when you have visited our site and will not be able to monitor its performance.

Functional Cookies: These cookies enable the Site to provide enhanced functionality and personalization. They may be set by us or by third-party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly.

Targeted/Advertising Cookies: These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly Personal Information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

C. Additional Cookie Information. 

We may use third-party vendors, such as Google, who use first-party cookies (such as Google Analytics cookie) and third-party cookies (such as DoubleClick cookie) together to inform, optimize and serve ads based on your past surfing activity, including Google Analytics for Display Advertising. The Personal Information collected may be used to, among other things, analyze and track data, determine the popularity of certain content and better understand online activity. If you do not want any Personal Information to be collected and used by google analytics, you can install an opt out in your web browser (https://tools.google.com/dlpage/gaoptout/) and/or opt out from Google Analytics for Display Advertising or the Google Display Network by using Google’s ads Settings.

3. State Privacy Addendum

A. Residents of California

Effective Date:  

This California Privacy Notice supplements the information contained in Surescripts’ Privacy Notice and applies solely to visitors and others who reside in the State of California (“consumers” or “you”) who use and interact with our website, surescripts.com, including any content, functionality, and services offered on, by, or through it (collectively, the “Services”). We adopt this notice to comply with the California Consumer Privacy Act as amended by the California Privacy Rights Act (together “CCPA”) and other California privacy laws. Any terms defined in the CCPA have the same meaning when used in this notice. 

 This CCPA Privacy Notice explains the following: 

• What is Surescripts 
• Types of Information We Collect 
• We Use Your Information 
• How We How Share Your Information 
• How We Protect and Store Your Information 
• Privacy Rights
• Making a Request
• Other California Privacy Rights
• Updates to Our Privacy Notice 
• Contact Information

1. What is Surescripts? 

Surescripts, LLC (Surescripts) operates a network to allow for the secure and reliable movement of electronic clinical and prescription information between different healthcare providers and organizations. For purposes of the CCPA, our Services are intended only to provide information to our business partners, prospective business partners, and job applicants. In certain circumstances (subject to various exceptions and limitations under the CCPA), if you are a California resident, you may also make more specific requests regarding your Personal Information. 

2. Types of Information We Collect 

For purposes of this Notice, “Personal information” also includes information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household, or device (“Personal Information”). 

Personal Information does not include: 

• Publicly available information from government records; 
• Deidentified or aggregated consumer information; and 
• Information excluded from the CCPA’s scope, such as: 
• health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data; 
• Personal Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994; 

Information you provide us may include: 

• Contact Information received from you in communications and responses to inquiries you send to us. 
• Biographical information when you inquire about or apply for a position with us. 
• Information you provide when you complete a survey administered by us or a service provider acting on our behalf. 

You may also choose to submit information about you via other methods, including (i) interaction with us via social media, including any posts, pictures, videos and messages that you submit to us either via our social media sites (including by use of hashtags associated with us) or our Services; and (ii) interaction with our online forums and chatrooms, or by commenting on content posted on our Services. If you contact us, we may keep a record of that correspondence and any contact information provided. 

Information we automatically collect

When you interact with the Services, certain information about your use of our Services is automatically collected. For details regarding the types of information we collect, please see the section titled “Collection and Use of Information” above.

• Details of your visits to our Services and information generated in the course of using our Services (including the timing, frequency, and pattern of service use) including, but not limited to, traffic data, location data, weblogs and other communication data, the resources that you access, and how you reached our Services. 
• Details regarding the device you use to interact with some of our Services, such as its location (city, state), operating system, browser type, and your internet service provider. 
• Information about how you interact with our publications, including whether you open or click links in any correspondence. 
• Information that you make available to us on a social media platform (such as by clicking on a social media icon linked from our Services), including your account ID or username and other information included in your posts.

Cookies and other tracking technologies 

Any or all activities with regard to collecting usage information may be performed on our behalf by other companies. Much of this information is collected through cookies, web beacons, and other tracking technologies, as well as your web browser or device. We may rely on third parties to provide many features of our websites using data about your use of our website. 

Third parties may keep track of your browsing activities across third party websites. California Business & Professions Code Section 22575(b) provides that California residents are entitled to know whether we respond to “Do Not Track” browser signals. “Do Not Track” is a preference you can set in your web browser to let the sites you visit know that you do not want them collecting information about you. Our Site does not currently respond to “Do Not Track” settings. 

3. How We Use Your Information 

For details regarding how we use your Personal Information, please see the section titled “Information that we” above.

4. How We Share Your Information 

For details regarding the types of information we collect, please see the section titled “Information that we Disclose to Third Parties” above.

5. How We Protect and Store Your Information 

We use a combination of physical, technical, and administrative safeguards to protect the information we collect through the Services. While we use these precautions to safeguard your information, we cannot guarantee the security of the networks, systems, servers, devices, and databases we operate or that are operated on our behalf. 

Surescripts only operates in the United States. If you interact with our Services outside of the United States, you understand that we may collect, process, and store your Personal Information in the United States and other countries. The laws in the U.S. regarding Personal Information may differ from the laws of your jurisdiction. 

6. Privacy Rights 

Persons with disabilities may obtain this notice in an alternative format upon request by contacting us at PrivacyOfficer@Surescripts.com. 

The CCPA provides California residents with rights to receive certain disclosures regarding the collection, use, and sharing of information about them, as well as rights to know/access, delete, and limit sharing of Personal Information. You have the right to be free from discrimination based on your exercise of your CCPA rights.

To the extent that we collect Personal Information that is subject to the CCPA, that information, our practices, and your rights are described below. You may be entitled to the following privacy rights under California law: 

Notice at collection regarding the categories of Personal Information collected 

You have the right to receive notice of the categories of Personal Information we collect, and the purposes for which those categories of Personal Information will be used. The categories we use below to describe the information are those enumerated in the CCPA. 

This Surescripts Privacy Notice applies solely to visitors who use the Services. As outlined above, information that is excluded from CCPA’s scope includes health or medical information covered by HIPAA (and other laws as outlined above). Surescripts does not mine Protected Health Information available via the Surescripts network, which is regulated by HIPAA, either for Surescripts’ own purposes or for the purposes of third parties. Surescripts does not rent or sell Protected Health Information available via the Surescripts network. 

Surescripts has taken steps to prevent third parties from using the system to influence physician prescribing decisions inappropriately. Similarly, Surescripts has implemented procedures designed to protect a patient's pharmacy choice. Physicians connecting to the Surescripts network will not receive commercial messaging (like advertisements from pharmaceutical companies or other third parties) at the point of care. All software applications certified to connect to the Surescripts network are required to abide by these rules, and only technology companies that agree with this philosophy are allowed to connect. 

Collection and Disclosure of Personal Information

Our Services collect Personal Information for the purposes described in the "How We Use Your Information" section above. In the past 12 months, we have collected and disclosed the following categories of information. 

Please note that some of this Personal Information qualifies as Sensitive Personal Information under the CCPA. Specifically, in the past 12 months, we have collected and/or disclosed the following categories of Sensitive Personal Information: 

   i.    Precise geolocation information;

   ii.   Information collected and analyzed concerning your health;

   iii.  Racial or ethnic origin, religious or philosophical beliefs, or union membership; and

   iv.  Your social security, driver’s license, state identification card, or passport number

Surescripts may use this Sensitive Personal Information for purposes of providing the Services, completing your requests, and ensuring the security and integrity of its business, infrastructure, and the individuals it interacts with. 

Surescripts does not use or disclose Sensitive Personal Information for purposes other than those that are necessary and proportionate to accomplish the objectives set forth in Cal. Code Regs. tit §7027(m).

While Surescripts does not sell candidate Personal Information in the way the term “sell” is commonly used, it may disclose limited cookie data/personal identifiers with our analytics partners in order to provide and maintain the Services. Such a disclosure may constitute a “sale” for purposes of the CCPA. We have made such disclosures in the past 12 months. If you wish to limit these disclosures, you may do so by contacting us as instructed below. Please note that Surescripts does not knowingly sell the information of individuals under the age of sixteen (16). 

We do not share Personal Information as the term “share” is defined by the CCPA. 

The right to know. 

You have the right to request that we disclose the specific pieces of Personal Information that it has collected about you, such as:

• The categories of Personal Information we have collected about you in the last 12 months.
• The categories of sources for the Personal Information we have collected about you in the last 12 months.
• Our business or commercial purpose for collecting that Personal Information.
• The categories of third parties with whom we share that Personal Information.
• The specific pieces of Personal Information that we have collected about you.

The right to deletion. You have the right to request that we delete the Personal Information that we have collected or maintain about you. We may deny your request under certain circumstances, such as if we need to comply with our legal obligations or complete a transaction for which your Personal Information was collected. Certain exceptions under the California law may allow Surescripts to retain and use certain Personal Information notwithstanding your deletion request. If we deny your request for deletion, we will let you know the reason why. 

The right to opt out of the sharing of your Personal Information. You have the right to opt out of the sharing of your Personal Information. However, we do not share, as defined by the CCPA, your Personal Information, so you have no need to affirmatively opt out.

The right to equal service. If you choose to exercise any of these rights, Surescripts will not discriminate against you in anyway. If you exercise certain rights, understand that you may be unable to use or access certain features of Surescripts services. 

The right to correct. You have the right to correct any inaccurate Personal Information that we maintain about you. 

The right to limit use and disclosure of Sensitive Personal Information. You also have the right to request that we limit the use and disclosure of Sensitive Personal Information that we maintain about you to that which is reasonable and necessary to accomplish the goals outlined in Cal. Code Regs. tit. §7027(m). 

7. Making a Request 

You may only make a verifiable consumer request for access or data portability twice within a 12-month period. You may submit a request to exercise your rights to know/access or delete your Personal Information through one of two means: 

          1.  By emailing the PrivacyOfficer@surescripts.com

          2. By calling toll-free at 1-888-926-3776 

To protect your privacy and the security of your information, we may verify consumer requests by requesting identification documents and other documentation necessary to confirm your identity for certain requests. Any additional information you provide will be used only to verify your identity and not for any other purpose. 

You may use an authorized agent to submit a request to know or a request to delete. When we verify your agent’s request, we may verify both your and your agent’s identity and request a signed document from you that authorizes your agent to make the request on your behalf. To protect your Personal Information, we reserve the right to deny a request from an agent that does not submit proof that they have been authorized by you to act on their behalf. 

Making a verifiable consumer request does not require you to create an account with us. 

8. Other California Privacy Rights 

You may request and obtain from Surescripts once per calendar year information about any of your Personal Information shared with third parties for their own direct marketing purposes, including the categories of information and the names and addresses of those businesses with which we have shared such information. We do not share Personal Information with third parties for direct marketing purposes to consumers. 

9. Updates to Our Privacy Notice 

We reserve the right to amend this Notice at our discretion and at any time. When we amend this Notice, we will post the updated notice and update the notice’s effective date. To the extent legally required, we will also reach out to you directly to inform you of an update. Your continued use of our Services following the posting of changes constitutes your acceptance of any such amendments. 

B. Additional Privacy Notice to Colorado, Virginia, Utah, and Connecticut Residents

This Privacy Notice supplements the information contained in Surescripts Privacy Notice and applies solely to visitors and others who reside in the States of Colorado, Virginia, Utah, and Connecticut (“consumers” or “you”) who use and interact with our main website, surescripts.com, including any content, functionality, and services offered on, by, or through it (collectively, the “Services”). We adopt this notice in accordance with the Colorado Privacy Act, Virginia Consumer Data Protection Act, Utah Consumer Privacy Act, and Connecticut Data Privacy Act (collectively the “Applicable Laws,” each an “Applicable Law”). Any terms defined in your state’s Applicable Law have the same meaning when used in this notice. 

This Privacy Notice explains the following: 

• Your Rights
• How to Exercise Your Rights
• Contact Information

We may collect several types of information from and about you depending on the nature of our relationship. Our general privacy policy applicable to all individuals can be found at [insert URL when finalized].

This section provides additional details regarding the Personal Information that we collect or process about you. For purposes of this section, “Personal Information” means any information that is linked or reasonably linkable to an identified or identifiable natural person.

In the last 12 months, we have not sold your Personal Information as such term has been defined by the Applicable Laws.

1. Your Rights

Under Colorado, Virginia, Connecticut, and Utah law, users who are residents of these states have specific rights regarding their Personal Information. These rights are subject to certain exceptions described below. When required, we will respond to most requests within 45 days unless it is reasonably necessary to extend the response time. Subject to certain limitations, you have the following rights:

• Right to Access: You have the right to confirm whether we process your Personal Information and request to access to such Personal Information.
• Right to Deletion: You have the right to request that we delete the Personal Information we have collected about you.
• Right to Data Portability: You have the right to request that we provide you with your Personal Information in a portable format.
• Right to Opt Out: You have the right to opt out of targeted advertising and the sale of your Personal Information. 

Colorado, Connecticut, and Virginia only:

• Right to Correction: You have the right to correct inaccuracies in your Personal Information.
• Right to Opt Out of Profiling: You have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. However, we do not “profile”, as defined by applicable privacy laws, so you have no need to affirmatively opt out.

At this time, we do not process your Personal Information for purposes of profiling in furtherance of decisions that produce legally or similarly significant effects concerning a consumer, and therefore, such opt-out rights are not available. 

2. How to Exercise Your Rights

To exercise the access, data portability, and deletion rights described above, please submit a verifiable consumer request to us by either:

• Calling us at (Toll-free number): 1-888-926-3776 
• Email us at: PrivacyOfficer@surescripts.com

We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to a total of 90 days), we will inform you of the reason and extension period in writing.

To protect your privacy and the security of your information, we may verify consumer requests by requesting identification documents and other documentation necessary to confirm your identity for certain requests. Any additional information you provide will be used only to verify your identity and not for any other purpose.

Making a verifiable consumer request does not require you to create an account with us. 

Authorized Agents in Colorado and Connecticut

You may use an authorized agent to submit a request to know or a request to delete. When we verify your agent’s request, we may verify both your and your agent’s identity and request a signed document from you that authorizes your agent to make the request on your behalf. To protect your Personal Information, we reserve the right to deny a request from an agent that does not submit proof that they have been authorized by you to act on their behalf.