1. Information We Collect

Account and business information. Names, business names, job titles, email addresses, phone numbers, account identifiers, subscription details, billing/contact information, and authentication information.

Client and healthcare data. Depending on Client use, the Platform may process patient/member names, dates of birth, addresses, Medicaid or insurance identifiers, eligibility information, service information, healthcare claims, billing information, remittance information, documents, PHI, ePHI, PII, and other data submitted by or on behalf of Client.

Usage, device, and security information. Login activity, timestamps, IP addresses, browser/device information, audit logs, pages and functions used, records accessed or modified, exports, configuration changes, support events, error logs, and security-related information.

Support information. Support tickets, emails, call or chat content, screenshots, session information, diagnostic logs, and information viewed during an authorized remote-support session.

Cookies and similar technologies. Zeumatic may use cookies or similar technologies necessary for authentication, security, session management, user preferences, and service functionality. We may also use limited analytics technologies where permitted by law and contract.

2. How We Use Information

3. PHI and HIPAA

When Zeumatic acts as a business associate, Zeumatic may use or disclose PHI only as permitted or required by the applicable BAA or as required by law. Zeumatic does not sell PHI. Zeumatic does not use Client PHI for unrelated advertising. Uses of PHI for support, maintenance, security, hosting, processing, and other services are limited by the BAA and applicable law.

4. AI and Automated Processing

Certain ZEUMATIC features may use AI, machine learning, or automation. Client data submitted to AI-enabled features may be processed to provide the requested feature, subject to the Client agreement, BAA, and applicable safeguards. Zeumatic will not authorize a third-party AI provider to use PHI for unrelated purposes where prohibited by the BAA or law. AI output may be inaccurate and should be reviewed by an appropriate human.

5. How We Disclose Information

Where a subprocessor creates, receives, maintains, or transmits PHI on Zeumatic's behalf, Zeumatic will require appropriate contractual safeguards as required by HIPAA.

6. Support and Administrative Access

Authorized Zeumatic personnel may access Client accounts, logs, configurations, records, PHI, PII, and active or historical session information when reasonably necessary to provide support, troubleshooting, implementation, security, maintenance, upgrades, restoration, incident response, or other services. Such access is limited to legitimate operational purposes and may be logged and audited.

7. Data Security

Zeumatic maintains reasonable administrative, physical, technical, and organizational safeguards designed to protect information against unauthorized access, use, alteration, loss, or disclosure. Safeguards may include access controls, authentication, logging, encryption or secure transmission mechanisms, backup procedures, security monitoring, workforce controls, and incident-response processes. No method of transmission or storage is completely secure.

8. Data Retention and Deletion

Zeumatic retains information for as long as reasonably necessary to provide the Platform, comply with contractual obligations, maintain business and security records, resolve disputes, enforce agreements, and satisfy legal, regulatory, payer, tax, audit, and record-retention requirements. PHI will be returned, destroyed, or retained at termination as required by the applicable BAA and law. Backup copies may persist for a limited period in secure backup systems before ordinary deletion cycles complete.

9. Client Control and Individual Rights

For data controlled by a Client, the Client generally determines the purposes and means of processing and is the primary point of contact for patient/member requests. Where applicable law gives an individual rights to access, correct, delete, restrict, or obtain a copy of personal information, Zeumatic will reasonably assist the Client as required by law and contract. HIPAA rights relating to PHI are generally exercised through the applicable covered entity.

10. Children's Information

ZEUMATIC is a business platform and is not directed to children for their own independent use. The Platform may process information about minors when a Client lawfully submits such information in connection with healthcare or other authorized services.

11. International Processing

Client data may be processed in locations where Zeumatic or its authorized service providers operate, subject to contractual, legal, and security requirements applicable to the data. Clients are responsible for determining whether additional cross-border data-transfer terms are required for their use case.

12. Sale or Sharing of Personal Information

Zeumatic does not sell PHI. Zeumatic does not use Client patient data for unrelated behavioral advertising. If applicable privacy law defines certain analytics or advertising activities as a "sale" or "sharing," Zeumatic will provide legally required disclosures or controls for any such activity that Zeumatic elects to conduct outside the HIPAA-regulated context.

13. Security Incidents and Breach Reporting

Suspected security incidents, unauthorized access, or suspected data breaches should be reported promptly to security@zeumatic.com. HIPAA-related privacy questions may be sent to privacy@zeumatic.com.

14. Changes to This Privacy Policy

Zeumatic may update this Privacy Policy as the Platform, legal requirements, or business practices change. Material updates may be presented in the Platform, posted on our website, or communicated by email. The effective date at the top identifies the current version.

15. Contact Information