Privacy & data handling

Scope

When this notice applies

This notice applies to personal information Britepath handles through britepath.com, the Britepath dashboard, our business communications, and the services we provide to prospective and current customers. Customer audit data is also governed by the applicable services agreement and, where required, a Business Associate Agreement. If those terms conflict with this notice, the applicable agreement controls for that customer data.

Information we collect

Depending on how you interact with Britepath, we may collect:

• Contact and business information, such as your name, email address, organization, role, and the content of your inquiry or correspondence.
• Account and service information, such as account details, authentication records, dashboard activity, service requests, and support communications.
• Customer audit data, such as claims, service lines, payer activity, remittances, payments, posting data, contracts, fee schedules, and related records provided or authorized by a customer. This data may include protected health information.
• Technical information, such as IP address, browser and device information, timestamps, pages requested, and security or diagnostic logs.

How we collect information

We collect information directly from you, from customers and other sources they authorize, and automatically through the systems used to operate and secure our website and services. Please do not send patient information through the public website or ordinary email unless Britepath has directed you to an approved secure channel.

How we use information

We use information as reasonably necessary to:

• respond to inquiries and communicate about our services;
• evaluate, establish, and manage customer engagements;
• provide audits, reports, dashboards, and support;
• authenticate users and operate, maintain, troubleshoot, and secure our systems;
• administer our business, enforce agreements, and maintain appropriate records; and
• comply with legal obligations and protect the rights, safety, and security of Britepath, our customers, and others.

Britepath does not sell personal information or use customer audit data for targeted advertising.

How we disclose information

We may disclose information:

• to personnel and contractors who need it to perform their responsibilities and are subject to confidentiality obligations;
• to service providers that support hosting, storage, security, communications, and other business operations;
• to professional advisers, such as attorneys, accountants, and insurers;
• when required by law or reasonably necessary to protect rights, safety, or security;
• in connection with a merger, financing, acquisition, reorganization, or sale of all or part of the business, subject to appropriate protections; or
• at the direction or with the authorization of a customer.

When a service provider handles protected health information on our behalf, we require the protections applicable to that relationship.

Protected health information

When Britepath processes protected health information on behalf of a healthcare provider or another regulated organization, we do so as permitted by the applicable agreement and Business Associate Agreement. Those agreements define the permitted uses and disclosures, safeguards, incident reporting obligations, subcontractor requirements, and return or disposal of protected health information.

Patients should direct requests concerning their medical or billing records to their healthcare provider. Britepath assists the provider with those requests as required by the applicable agreement and law.

Cookies and similar technologies

Britepath may use technologies necessary to operate the dashboard, authenticate users, maintain sessions, remember settings, prevent fraud, and protect our services. We do not use customer audit data for advertising. Browser settings may allow you to block or delete cookies, but doing so may prevent parts of the dashboard from functioning correctly.

Data retention

We retain information for as long as reasonably necessary to provide the services, maintain security and business records, comply with applicable agreements and legal obligations, resolve disputes, and enforce our rights. Retention periods vary based on the type and sensitivity of the information and the purpose for which it is held. When information is no longer required, we delete, de-identify, or securely dispose of it in accordance with our obligations.

Data protection

We use reasonable administrative, technical, and organizational safeguards designed to protect information from unauthorized access, use, alteration, or disclosure. Access is limited based on role and business need. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Your privacy choices and rights

Depending on where you live and subject to applicable exceptions, you may have the right to request access to, correction of, or deletion of your personal information, or to obtain additional information about how it is used and disclosed. We may need to verify your identity and authority before completing a request. We may retain information when required by law, an applicable agreement, or another permitted purpose.

These rights do not replace the process for requesting medical records from your healthcare provider.

Children's privacy

Britepath services are intended for organizations and professionals, not children. We do not knowingly collect personal information directly from children through the website or dashboard.

Changes to this notice

We may update this notice as our services or legal obligations change. We will post the revised notice here and update the effective date. When appropriate, we may provide additional notice of material changes.

Questions or requests

For questions about this notice or to submit a privacy request, contact Britepath.