Privacy Policy

This Privacy Policy describes how the WellPath Advantage platform ("WellPath Advantage," "we," "us," or "our") collects, uses, discloses, and protects information in connection with the Platform. It applies to the healthcare practices and authorized users ("Providers," "you") who license and use WellPath Advantage subaccounts, and it explains how WellPath Advantage handles data — including Protected Health Information (PHI) — on the Provider's behalf.

1. Important Notice — Informational Use Only

WellPath Advantage is a marketing and communications technology platform, not a provider of medical care. Content delivered through the Platform is for general informational and educational purposes only and does not constitute medical advice, diagnosis, or treatment. Patients and recipients should always consult their physician or qualified healthcare provider with any questions about a medical condition and should never disregard or delay professional medical advice because of content received through the Platform.

2. Our Role — Business Associate Framework

WellPath Advantage operates as a Business Associate under 45 CFR §164.504(e). The healthcare practice is the covered entity and owns the patient relationship, the patient data, and the patient consent. WellPath360 provides the software infrastructure that stores, processes, and transmits data on the Provider's behalf — analogous to an EHR, email provider, or practice-management system.

• Patients consent to marketing communications from the practice, not from WellPath Advantage specifically, consistent with 45 CFR §164.508(a)(3).

• All platform-layer obligations regarding PHI are governed by the Business Associate Agreement (BAA) executed between the Provider and WellPath Advantage.

• The Provider is responsible for obtaining and maintaining valid patient authorization and a current BAA before PHI is processed through the Platform.

3. Information We Collect

3.1 Provider (Account) Information

When you register and use a subaccount, we collect information such as your name, practice name, business address, email address, phone number, login credentials, and billing information.

3.2 Patient Information (PHI) — Processed on the Provider's Behalf

On behalf of the Provider, the Platform stores and processes patient contact information, which may include name, email address, phone number, and communication and engagement history. Because this data identifies individuals as patients of a covered entity, it may constitute PHI under 45 CFR §160.103. This information is handled strictly in accordance with the BAA and applicable law.

3.3 Usage Data

We automatically collect certain technical data when the Platform is used, including IP address, browser type, device information, pages visited, timestamps, and diagnostic data, for security, analytics, and service-improvement purposes.

3.4 Cookies and Tracking

We use cookies and similar technologies for essential platform functions, session management, and analytics. You can control cookies through your browser settings, though some features may not function properly without them.

4. How We Use Information

• To provide, maintain, and improve the Platform and its features;

• To enable Providers to deliver authorized marketing and communication programs to their patients;

• To manage accounts, authenticate users, and process billing;

• To provide support, respond to inquiries, and communicate service updates;

• To monitor security, detect fraud, and protect the integrity of the Platform;

• To comply with legal obligations.

WellPath Advantage uses PHI solely as permitted by the BAA and applicable law, and does not use or disclose PHI for its own marketing purposes.

5. How We Share Information

We may share information in the following limited circumstances:

• Service Providers / Subcontractors: With vendors who process data on our behalf (e.g., hosting, email delivery, analytics). Any subcontractor handling PHI is bound by terms equivalent to the BAA, consistent with §164.504(e).

• At the Provider's Direction: To deliver communications and integrations the Provider configures.

• Legal Requirements: When required by law, subpoena, or to protect the rights, safety, or property of WellPath Advantage, Providers, patients, or others.

• Business Transfers: In connection with a merger, acquisition, or sale of assets, subject to continued protection of PHI under applicable law.

We do not sell personal information or PHI.

6. Data Security

We implement administrative, physical, and technical safeguards consistent with the HIPAA Security Rule (§164.308–§164.312), including access controls, encryption in transit, authentication measures, and monitoring. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Data Retention

We retain Provider and patient information only for as long as necessary to provide the Platform and fulfill the purposes described in this Policy, or as required by law and the BAA. Upon termination of services, PHI is returned or destroyed in accordance with the BAA.

8. Patient Rights and Provider Responsibilities

Because the Provider is the covered entity, patient rights under HIPAA — including access, amendment, and accounting of disclosures — are exercised through the Provider. WellPath Advantage supports the Provider in fulfilling these obligations as described in the BAA. Patients seeking to exercise their rights or revoke marketing consent should contact the practice directly; the Provider is responsible for honoring revocations and updating records accordingly.

9. Data Transfers

Information may be processed and stored at our operating facilities and those of our service providers, which may be located in jurisdictions different from yours. We take steps to ensure data is handled consistent with this Policy and applicable law.

10. Children's Privacy

The Platform is intended for use by healthcare practices and authorized adults. It is not directed to individuals under 18 for account use. Any patient data concerning minors is processed on the Provider's behalf under the Provider's authority and applicable law.

11. Third-Party Links and Services

The Platform may contain links to or integrate with third-party services. We are not responsible for the privacy practices of those services and encourage you to review their policies.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated within the Platform and reflected in the "Last updated" date above.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact your WellPath Advantage account representative at The Zack Greenfield Company.