Health Privacy Policy

Xport Health, Inc. (“Xport Health,” “we,” “us,” or “our”) respects the privacy of health information and other personal information. This Health Privacy Policy explains the information we collect through our websites, mobile applications, patient engagement tools, provider-facing platforms, integrations, and related services (collectively, the “Services”), how we collect it, how we use it, when we share it, and the choices available to users.

​

This policy is intended to describe Xport Health’s privacy practices in clear language. It does not replace any separate Notice of Privacy Practices issued by a physician, clinic, hospital, health plan, or other healthcare provider or covered entity that uses Xport Health’s Services.

​

By using the Services, or by providing information to us through the Services, you acknowledge that you have read and understand this policy.

1. Scope and Role of Xport Health

Xport Health provides digital health technology, patient engagement tools, remote monitoring workflows, care coordination support, analytics, and related services.

Depending on the context, Xport Health may act in different roles:

1. Service Provider / Business Associate to Healthcare Organizations. When Xport Health provides services to or on behalf of a healthcare provider, health plan, or other regulated healthcare organization, we may create, receive, maintain, or transmit protected health information (“PHI”) under a contract such as a Business Associate Agreement.

2. Direct Provider of Consumer-Facing Digital Services. In some cases, Xport Health may collect information directly from users of our mobile application, website, forms, support channels, or digital tools.

3. Independent Controller of Certain Operational Data. Xport Health may act independently with respect to certain business, administrative, security, technical, and legal compliance data.

Because our role can vary depending on the service and relationship, some privacy rights and disclosures may be handled directly by the healthcare organization with which you interact.

2. What Data We Collect

Depending on the Services used, the permissions granted, the settings selected, and the relationship involved, Xport Health may collect, receive, generate, infer, use, store, transmit, or otherwise process the following categories of information:

• Personal identifiers and contact information, such as name, date of birth, email address, phone number, mailing address, username, password, account credentials, and similar identifiers

• Health and health-related information, such as symptoms, diagnoses, conditions, medications, allergies, treatment information, care plans, clinical notes, laboratory information, questionnaires, assessments, surveys, patient-reported outcomes, and similar health or wellness information

• Vital signs, biometric information, remote monitoring data, device-generated readings, wellness information, activity-related information, and other information made available through the Services

• Provider, billing, eligibility, referral, scheduling, enrollment, insurance-related, and program participation information

• Technical, device, log, usage, diagnostic, security, and online activity information, such as IP address, device identifiers, browser type, operating system, app version, timestamps, crash reports, cookies, SDK data, access history, and similar data

• Communications and content submitted through the Services, including messages, support requests, prompts, uploads, attachments, free-text entries, and other information provided through forms, questionnaires, chat, or related tools

• Information obtained from healthcare providers, care teams, health plans, pharmacies, laboratories, caregivers, authorized representatives, connected devices, electronic health records, practice management systems, health information exchanges, APIs, and other authorized integrations or sources

• De-identified, aggregated, derived, operational, analytics, and similar information generated from or relating to the use of the Services where permitted by law

Xport Health may collect only some of these categories in a particular workflow, and the specific information collected may vary depending on the feature used, the permissions granted, the applicable legal relationship, and the user’s interactions with the Services.

3. How We Collect Information

Xport Health may collect information in multiple ways, including:

• Directly from users, patients, caregivers, providers, customer support requests, forms, surveys, assessments, questionnaires, uploads, prompts, free-text entries, communications, and other interactions with the Services

• Automatically through the operation of our websites, mobile applications, platforms, devices, logs, cookies, software development kits, analytics tools, security tools, application programming interfaces, and similar technologies

• From healthcare providers, healthcare organizations, care teams, health plans, employer-sponsored programs, payers, pharmacies, laboratories, and other authorized organizations

• From connected devices, interoperability tools, electronic health records, practice management systems, health information exchanges, operating system permissions, and other authorized third-party integrations or data sources

• From caregivers, family members, authorized representatives, or others acting on a user’s behalf where permitted by law

• From data generated, inferred, de-identified, aggregated, or otherwise created in connection with the operation, analysis, security, maintenance, or improvement of the Services

The method of collection depends on the feature used, the data source involved, the permissions granted, and the relationship between Xport Health, the user, and the applicable healthcare organization.

4. How We Use Information

Xport Health may use collected information for healthcare, care coordination, operational, administrative, technical, legal, security, quality, support, product, and compliance purposes, including to:

• Provide, operate, host, maintain, secure, troubleshoot, support, and improve the Services

• Create, manage, verify, authenticate, and administer accounts, profiles, access rights, permissions, settings, and user relationships

• Receive, collect, organize, store, display, retrieve, process, analyze, summarize, transmit, exchange, and otherwise make available information through the Services

• Support remote monitoring, chronic care management, patient engagement, care coordination, documentation support, reporting, reminders, summaries, notifications, escalations, workflows, and related functions

• Facilitate communications among users, providers, care teams, caregivers, customer support personnel, authorized representatives, and organizations using the Services

• Personalize the user experience, configure workflows, improve usability, maintain continuity of care, and support service functionality requested by users or healthcare organizations

• Detect, investigate, prevent, and respond to fraud, misuse, abuse, unauthorized activity, technical issues, incidents, security events, and other harmful or unlawful activity

• Conduct analytics, quality assurance, auditing, system monitoring, debugging, product development, training, performance measurement, financial administration, corporate governance, and other internal business operations

• Comply with contractual, legal, regulatory, compliance, audit, billing, accounting, tax, recordkeeping, enforcement, and public health obligations

• Protect the rights, safety, property, systems, users, providers, Xport Health, and the public

• Create, use, and disclose de-identified or aggregated information where permitted by law

• Carry out any other purpose disclosed at the time of collection, authorized by the user, required by a healthcare organization relationship, or otherwise permitted by law

The specific uses of information may vary depending on the Services used, the permissions granted, the data involved, and the relationship between Xport Health, the user, and any applicable healthcare organization.

5. Third-Party Service Providers and AI-Enabled Features

Xport Health may use third-party service providers, sub-processors, contractors, consultants, infrastructure providers, cloud providers, communications providers, analytics providers, security providers, customer support providers, interoperability providers, and artificial intelligence or machine learning service providers to help operate, secure, support, maintain, enhance, and provide the Services.

When Xport Health shares personal information, health-related information, or other data with a third party in connection with the Services, Xport Health requires that third party to protect the information using privacy, confidentiality, and security protections that are the same as or substantially similar to those required by applicable law, our contractual obligations, and our internal security standards, as applicable to the services being performed.

Depending on the feature used, Xport Health may use AI-enabled, automated, algorithmic, or machine-learning-supported tools to assist with operational, support, documentation, summarization, workflow, communication, analytics, or related functions.

If Xport Health sends personal information or health-related information to a third party in connection with an AI-enabled or automated feature, Xport Health may disclose the applicable recipient, category of recipient, or applicable service relationship within the app, at the point of use, in the user profile, in feature-specific terms, in the Terms of Service, or through another legally sufficient notice or consent flow, as permitted by applicable law.

Where required by law, platform rules, contract, or the nature of the feature, Xport Health will provide additional notice, obtain consent, or provide user choice before transmitting information to a third party in connection with an AI-enabled or other third-party-supported feature.

Xport Health does not authorize third parties that receive personal information from us to use identifiable user information for their own advertising purposes or unrelated product development purposes except where expressly disclosed to the user and permitted by applicable law and contract.

6. How We Share Information

We may share information in the following circumstances:

A. With Healthcare Organizations and Care Teams

We may share information with healthcare providers, care teams, health plans, and authorized healthcare organizations in connection with providing the Services and supporting care, operations, coordination, and related permitted activities.

B. With Service Providers and Contractors

We may share information with vendors, contractors, consultants, service providers, infrastructure providers, cloud providers, communications providers, analytics providers, security providers, interoperability providers, AI-enabled service providers, customer support providers, and other third parties that perform services on our behalf or support the Services. These parties may access information only as reasonably necessary to perform services for Xport Health or support the requested functionality and are required to protect the information they receive using privacy, confidentiality, and security protections that are the same as or substantially similar to those required by applicable law, our contracts, and our internal security standards, as applicable.

C. With Third Parties Supporting Features and Integrations

We may share information with third parties that support specific features, integrations, workflows, automations, analytics, AI-enabled tools, communications, connected devices, interoperability functions, customer support functions, or other components of the Services. Where required by law, platform requirements, contract, or the nature of the feature, we will provide additional notice, obtain consent, or provide user choice before transmitting information in connection with such features.

D. With Your Direction or Consent

We may share information when you direct us to do so, consent to the disclosure, or authorize an integration or connection.

E. For Legal, Regulatory, and Safety Reasons

We may disclose information as required or permitted by law, regulation, subpoena, court order, governmental request, public health obligation, or similar legal process, or when we believe disclosure is necessary to protect health, safety, rights, property, or the security of the Services.

F. Business Transfers

We may disclose information in connection with a merger, acquisition, financing, restructuring, asset sale, bankruptcy, or other corporate transaction, subject to applicable confidentiality and legal requirements.

G. De-Identified and Aggregated Information

We may use and disclose information that has been de-identified or aggregated so that it does not reasonably identify an individual, as permitted by law.

7. HIPAA and Protected Health Information

When Xport Health handles protected health information on behalf of a healthcare provider, health plan, or other HIPAA covered entity, our use and disclosure of that PHI is governed by applicable law and our contract with that covered entity, including any Business Associate Agreement.

In those circumstances:

• The healthcare provider or other covered entity is generally responsible for issuing its own Notice of Privacy Practices

• Patient rights requests relating to PHI may need to be directed to the relevant provider, plan, or other covered entity

• Xport Health may assist the covered entity in responding to such requests when required by law or contract

If you are a patient receiving care from a provider that uses Xport Health, please review that provider’s Notice of Privacy Practices for additional information about how your PHI may be used and disclosed.

8. Consumer Health Data and Non-HIPAA Data

Not all health-related information is regulated by HIPAA. In some circumstances, Xport Health may collect or process health-related information that falls outside HIPAA but is still protected by other federal or state privacy, consumer protection, or breach notification laws.

Xport Health does not sell personal health data in exchange for money. Xport Health does not share consumer health data for cross-context behavioral advertising or other uses prohibited by applicable law.

9. Data Retention

We retain information for as long as reasonably necessary to:

• Provide the Services

• Fulfill the purposes described in this policy

• Comply with contractual, legal, regulatory, accounting, tax, audit, billing, and recordkeeping obligations

• Resolve disputes and enforce agreements

• Maintain security, backup, disaster recovery, and business continuity processes

Retention periods may vary based on the type of information, the Services involved, applicable law, and contractual requirements.

10. Security Measures

We maintain administrative, technical, and physical safeguards designed to protect information from unauthorized access, use, disclosure, alteration, or destruction. These measures may include access controls, authentication procedures, encryption where appropriate, logging, monitoring, workforce training, incident response procedures, vendor oversight, and other security controls.

No system or method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Breach and Incident Response

If Xport Health becomes aware of a security incident or unauthorized disclosure involving information we maintain, we will investigate, take appropriate containment and remediation steps, and provide notice where required by applicable law, regulation, or contract.

Where Xport Health acts on behalf of a HIPAA covered entity, notification obligations may be governed by our contract and applicable breach notification requirements.

12. Individual Rights and Choices

Depending on applicable law and the nature of the relationship, individuals may have rights regarding their information, including the right to:

• Access certain information

• Request correction or amendment of certain information

• Request deletion of certain information, subject to legal exceptions

• Request restrictions on certain processing or disclosures

• Request a copy of information in a portable format where applicable

• Withdraw consent where processing is based on consent

• Opt out of certain non-essential communications

• Lodge a complaint with Xport Health or with an applicable regulator

These rights are not absolute and may be limited by law, patient safety considerations, contractual obligations, technical feasibility, and record retention requirements.

If Xport Health acts as a service provider or business associate for your healthcare provider or health plan, we may direct your request to that organization, which may be the appropriate party to respond.

13. Cookies, Analytics, and Similar Technologies

Our websites and applications may use cookies, software development kits, pixels, local storage, and similar technologies to:

• Operate and secure the Services

• Remember preferences and settings

• Measure performance and functionality

• Analyze usage trends

• Improve user experience

Where required by law, we will provide additional notice, obtain consent, or offer choices regarding certain optional technologies.

14. Third-Party Services and Links

The Services may contain links to third-party websites, tools, integrations, or services that are not controlled by Xport Health. This policy does not apply to the privacy practices of those third parties. We encourage users to review the privacy policies of any third-party service they use.

15. Children’s Privacy

Xport Health does not knowingly collect personal information directly from children except as permitted by law and as necessary to provide Services in connection with healthcare, caregiver-authorized use, or services arranged through a healthcare organization or authorized adult.

16. Cross-Border Processing

If information is processed or accessed outside the jurisdiction in which it was collected, it may be subject to the laws of those jurisdictions. Xport Health will take reasonable steps to ensure appropriate protections consistent with applicable law.

17. Changes to This Policy

We may update this policy from time to time. When we do, we will revise the “Last Updated” date above and take additional steps where required by law. Material changes may be communicated through the Services, by email, by posting an updated policy, or by other appropriate means.

18. Contact Information

If you have questions about this policy or wish to submit a privacy request, please contact:

Xport Health, Inc.

Attn: Privacy Officer 

3723 Greenville Avenue

Dallas, TX, 75206

care@xporthealth.com

 

If your concern relates to care provided by a physician, clinic, hospital, or health plan using Xport Health’s Services, you may also need to contact that organization directly.

​