Privacy Notice

II. We have a legal duty to safeguard protected health information (PHI).

We are legally required to protect the privacy of health information. This information is called “protected health information,” or “PHI” for short, and it includes information that can be used to identify a patient that we received about a past, present, or future health problem or condition or issue; the provision of healthcare to the patient; or the payment of this healthcare. We are providing this notice to trading partners, business associates, and other covered entities about our privacy practices that explains how, when, and why we use and disclose PHI. With some exceptions, we may not use or disclose any more PHI than is necessary to accomplish the purpose of the use or disclosure. We are legally required to follow the privacy practices that are described in this notice and subsequently explained in our business associate agreement (BAA).

Any changes will apply to the current processes by which we handle PHI today. You can request a copy of this notice by calling our support line.

III. Approved sources and methods of PHI collection

How is PHI collected?

Protected Health Information (PHI) may originate from members, their dependents, employers, or providers and is collected through the following approved and secure channels:

1. Email (Outlook) – PHI submitted via secure email communications.
2. Contact Us Form (Website & In-App) – Submitted on the secure curaechoice.com website or via the in-app contact form, which routes through the same secure process.
3. Mobile Apps (Android & Apple) – PHI entered directly by the user through secure mobile workflows.
4. 3CX Phone Calls – PHI is updated or added in the Choiceoptimizer.cc (2.0) system when entered by authorized personnel during or after the call.
5. 3CX Live Chat – PHI provided in live chat is securely documented and may result in updates to Choiceoptimizer.cc (2.0).
6. JotForm – Used for registration forms; submissions are encrypted in transit and at rest.
7. Clinekt OrthoCheck – Symptom checker integrated into the Curaechoice.cc Provider Directory (PD) and mobile apps. Based on responses, users may schedule an appointment. Symptom results and scheduling data are securely stored in the PD/App database.
8. Eligibility Data Sources – Choiceoptimizer.cc (2.0) also pulls data from external eligibility sources to verify member status. This data may update, activate, or deactivate a user account in real time based on eligibility results. Ineligible users cannot access the mobile apps or Curachoice.cc PD.

Security Controls: All PHI is transmitted over HTTPS, stored encrypted at rest, and access is restricted using role-based access controls (RBAC) as outlined in our Business Associate Agreements (BAAs) and privacy policy. Access and disclosure activity is logged and reviewed regularly per SOC 2 control requirements.

IV. How we may use and disclose PHI.

We use and disclose health information for several key reasons. These disclosures are further outlined in the respective Business Associate Contract. Below, we describe the different categories of our uses and disclosures and give some examples of each category.

High Level Overview:

1. For Business Functions. We may share PHI with vendors and subprocessors critical to the Curaechoice application. PHI shared with vendors and service providers is limited to what is necessary for their services, and they are required to maintain strict confidentiality and security. We keep records of all PHI disclosures and regularly review our vendors’ data protection practices to ensure ongoing compliance. A list of all subprocessors can be provided upon request.

2. For healthcare operations. We use and disclose PHI to the appropriate clinicians, clinical support and billing and claims personnel that are involved in providing key care coordination, clinical and billing and claims support services to you and your authorized stakeholders.

1. When a disclosure is required by federal, state, or local law; judicial or administrative proceedings; or law enforcement. We will make disclosures when a law requires that we report information to government agencies and law enforcement personnel, or when ordered in a judicial or administrative proceeding.

2. For health oversight activities. If requested by law, federal, or state mandate, we will provide information to assist the government when it conducts an investigation or inspection of a healthcare provider or organization.

3. For research and educational purposes. We may provide PHI in order to facilitate data collection efforts used in medical research initiatives, but only after the explicit approval from the provider institution. As a provider of care coordination services as well as complimentary clinical software like peer review software applications, we may provide PHI to authorized personnel to facilitate key peer review services by which they are contracted with us to provide.

4. For specific government functions. We may disclose PHI of organizations serving military personnel and veterans in certain situations. And we may disclose PHI for national security purposes or conducting intelligence operations.

In any other situation not described in sections A or B, above, we will ask for written authorization before using or disclosing any trading partners’, business associates’ and other covered entities’ PHI. This authorization can later be revoked in writing to stop any future uses and disclosures—to the extent that we have not taken any action relying on the authorization.

Specific PHI Uses:

PHI from the above sources is collected and processed for specific, approved purposes:

• Authentication & Security – When accessing the Curaechoice.cc PD or mobile apps (Android & Apple), users must input their phone number. This enables secure authentication and tracking of login activity (success/failure events, device type, IP address) for fraud prevention and account security.
• Operational Improvement – We collect user activity data such as searches, navigation patterns, and user preferences within the Curaechoice.cc PD and mobile apps solely for service functionality and performance enhancements.
• Care Coordination – Clinekt OrthoCheck responses and related appointment scheduling details are securely stored in the PD/App database to support follow-up and care coordination.
• PHI Updates via 3CX – Both phone calls and live chat interactions may result in PHI updates in Choiceoptimizer.cc (2.0) when authorized staff enter new or updated data.
• Eligibility Verification & Access Control – Eligibility data from approved sources is used by Choiceoptimizer.cc (2.0) to determine if a user can access the mobile apps or Curaechoice.cc PD. Accounts are activated, deactivated, or updated based on eligibility status to ensure only authorized users have access.

V. Rights regarding PHI

As a business associate, we have, and will make available, to those who are authorized to receive it, our BAA that further outlines what roles and responsibilities we have to protect our use of PHI in our business duties. For a copy of this BAA, please call our support line.

Curaechoice maintains detailed, secure records to comply with SOC 2 Type 1 and 2 and privacy regulations. These include user consents for PHI collection and use, verified requests to access, modify, or delete information, records of third-party PHI disclosures with legal basis, and documentation of privacy complaints and resolutions. All records are securely stored and retained per legal requirements, supporting transparency and accountability in protecting user privacy.

We respect your privacy and protect your personal and protected health information (“PHI”). We collect, use, and disclose PHI only with your explicit consent or as permitted by law.

1. Consent: We obtain your informed consent before collecting or using your PHI for any purpose beyond the original intent. All consents are documented and securely maintained.
2. Your Rights: You have the right to access, update, and request removal of your personal information and PHI, subject to legal requirements. You may also withdraw your consent at any time, though this may affect your access to certain services.
3. Authorized Representatives: You may authorize a third party or guardian to manage your PHI. We verify their identity before granting access.
4. Security: Requests to access, modify, or withdraw consent are subject to strict verification to safeguard your privacy.

For questions or to exercise your rights, please contact us at support@curaechoice.com.

VI. How we use healthcare provider (HCP) information

As a care coordination and technology company, we often partner with HCPs who use our application to participate in special health care oriented programs, such as clinical referrals, billing and claims review and peer review educational services. Throughout the course of this partnership, we will collect data that is limited to the participating facility name, address, facility contact name, and phone number, and the HCP that will be using our applications. We, with our program sponsors, will limit the use of information collected on this site to only administer and improve the program and will not sell your information to a third party for promotional purposes. Upon conclusion of this partnership, all related information for the HCP and his/her facility is immediately deleted and purged from our servers.

VII. How to submit a complaint regarding our privacy practices

If you believe that we have violated PHI privacy policies, or you disagree with a decision we have made in handling PHI in the course of doing business, you may file a complaint through our Compliance Support team by calling at 1-800-646-9823, ext. 9002. We will conduct a thorough investigation and if necessary, implement proper resolution measures to address highlighted concerns. You also may send a written complaint to the Secretary of the Department of Health and Human Services at Region VII, Office for Civil Rights, U.S. Department of Health and Human Services, 601 East 12th Street, Room 248, Kansas City, MO 64106; or e-mail at OCRComplaint@hhs.gov; or fax at 816-426-3686. No retaliatory action will be taken for such filings. However, if discovery later finds that such filings were fraudulently made, we reserve the right to consider and pursue courses of legal action allowable under the law.

VIII. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our website, analyze site usage, and support our marketing efforts. Cookies are small text files that are stored on your device when you visit a website.

You can control or disable cookies through your browser settings at any time. However, some cookies are essential for the functionality of the site and opting out of them may affect your user experience.

Curaechoice allows the option to opt-out of cookies. You can opt out of non-essential cookies by reaching out to support@curaechoice.com or by configuring your browser settings to reject cookies. To learn more about how to manage cookies, visit www.allaboutcookies.org..

VIIII. Policy Reviews

This Privacy Policy is reviewed at least annually. The scope of the reviews reviews include PHI collection and disclosure methods, approved sources of PHI including third parties other than the user, which PHI should be essential or optional, approved purposes, consent procedures

This policy was last reviewed 7/17/2025