Prescience, Inc.

The clause permits sale of personal data or information.

“If you choose to connect a Gmail account for insurance paperwork tracking, Prescience uses Google OAuth to confirm the connected email address and receives read-only access to Gmail. Prescience does not use this access to send email, delete or modify messages, change mailbox settings, or initiate payments. We use Gmail access only to find recent insurance-related messages from carrier and provider-billing sender d...”

The clause permits sale of personal data or information.

“We do not sell personal information or PHI. We may disclose information to the following categories of recipients when permitted by law and applicable agreements: Employers and plan sponsors - aggregate, de-identified, eligibility, financial, operational, and plan-administration information. The employer portal is designed not to show individual clinical records, individual claims, or individual care-navigation co...”

The clause permits sale of personal data or information.

“Depending on your location and relationship with us, you may have rights to know, access, correct, delete, port, restrict, or object to certain processing of personal information. California residents may have rights under the CCPA/CPRA, including rights to know, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information, and not be discriminated against for exercising rights...”

The clause permits sale of personal data or information.

“If you choose to connect a Gmail account for insurance paperwork tracking, Prescience uses Google OAuth to confirm the connected email address and receives read-only access to Gmail. Prescience does not use this access to send email, delete or modify messages, change mailbox settings, or initiate payments. We use Gmail access only to find recent insurance-related messages from carrier and provider-billing sender d...”

The clause permits sale of personal data or information.

“We do not sell personal information or PHI. We may disclose information to the following categories of recipients when permitted by law and applicable agreements: Employers and plan sponsors - aggregate, de-identified, eligibility, financial, operational, and plan-administration information. The employer portal is designed not to show individual clinical records, individual claims, or individual care-navigation co...”

Latest stance: training permitted on training use

“If you choose to connect a Gmail account for insurance paperwork tracking, Prescience uses Google OAuth to confirm the connected email address and receives read-only access to Gmail. Prescience does not use this access to send email, delete or modify messages, change mailbox settings, or initiate payments. We use Gmail access only to find recent insurance-related messages from carrier and provider-billing sender domains approved for your account. We process the sender, subject, received time, message text, and supported attachments, such as EOBs and provider statements, to classify insurance notices, extract billing details, match documents to visits, and route possible billing issues for authorized Prescience review. Messages that do not match these sender and insurance-signal restrictions are not retrieved by this workflow. OAuth tokens are encrypted. Relevant message content and supported attachments may be retained in our encrypted PHI storage with the related insurance case and visit records for as long as reasonably necessary to provide the service and meet healthcare, legal, contractual, audit, and security obligations. Access is limited to authorized personnel and service providers who need it to operate, secure, support, or review the insurance-paperwork service, subject to applicable confidentiality, security, and HIPAA obligations. We do not sell Google user data, use it for advertising, use it to determine creditworthiness or lending eligibility, or use it to train general-purpose AI models.”

Latest stance: no training claim on training use

“Crystal and related AI-assisted tools may process member messages, care-navigation context, plan information, provider options, connected records, and other information needed to respond. Crystal is not a medical provider, does not diagnose or prescribe, and is not for emergencies. We use AI-assisted tools to provide care navigation, summarize context, generate suggested next steps, and support operations. We do not use PHI for advertising or sale. We do not use PHI to train third-party foundation models unless permitted by HIPAA, the applicable BAA, individual authorization where required, and other applicable law. Voice and chat transcripts may be stored as part of the member record where permitted by member permissions, plan operations, HIPAA, and applicable agreements. Emergency or safety-related interactions may be logged or escalated as needed to protect health and safety.”

Latest stance: third party or vendor sharing on privacy data use

“Prescience, Inc. d/b/a Prescience Administrative Services ("Prescience," "we," "us," or "our") provides technology and administrative services for employer-sponsored health benefits, care navigation, provider workflows, claims and payment operations, and related financial workflows. This Privacy Policy explains how we collect, use, disclose, and protect information about employers, plan sponsors, members, patients, dependents, providers, brokers, consultants, partners, and website visitors. It does not apply to third-party websites or services that we do not control. When we handle protected health information (PHI) for a covered entity or another business associate, HIPAA, the applicable Business Associate Agreement (BAA), and related agreements govern that PHI. If this policy conflicts with a BAA or a legally required Notice of Privacy Practices, the BAA or required notice controls for the PHI at issue.”

Latest stance: sale or sell on training use

“If you choose to connect a Gmail account for insurance paperwork tracking, Prescience uses Google OAuth to confirm the connected email address and receives read-only access to Gmail. Prescience does not use this access to send email, delete or modify messages, change mailbox settings, or initiate payments. We use Gmail access only to find recent insurance-related messages from carrier and provider-billing sender domains approved for your account. We process the sender, subject, received time, message text, and supported attachments, such as EOBs and provider statements, to classify insurance notices, extract billing details, match documents to visits, and route possible billing issues for authorized Prescience review. Messages that do not match these sender and insurance-signal restrictions are not retrieved by this workflow. OAuth tokens are encrypted. Relevant message content and supported attachments may be retained in our encrypted PHI storage with the related insurance case and visit records for as long as reasonably necessary to provide the service and meet healthcare, legal, contractual, audit, and security obligations. Access is limited to authorized personnel and service providers who need it to operate, secure, support, or review the insurance-paperwork service, subject to applicable confidentiality, security, and HIPAA obligations. We do not sell Google user data, use it for advertising, use it to determine creditworthiness or lending eligibility, or use it to train general-purpose AI models.”

Latest stance: sale or sell on privacy data use

“We do not sell personal information or PHI. We may disclose information to the following categories of recipients when permitted by law and applicable agreements: Employers and plan sponsors - aggregate, de-identified, eligibility, financial, operational, and plan-administration information. The employer portal is designed not to show individual clinical records, individual claims, or individual care-navigation content to employers. Employer-sponsored health plans and covered entities - information needed for treatment, payment, healthcare operations, plan administration, eligibility, oversight, audits, and legal compliance, as permitted by HIPAA and plan documents. Members, patients, and authorized representatives - information about their own account, benefits, care-navigation history, permissions, records, payments, and available services. Healthcare providers, provider groups, and networks - information needed to coordinate care, schedule visits, verify eligibility, process claims, support payment, and respond to member requests. Brokers, consultants, TPAs, PBMs, carriers, stop-loss partners, and administrators - information needed for plan design, implementation, administration, claims, pharmacy benefits, risk protection, funding, reporting, and support. Banking, card, payment, HSA, and financial partners - information needed to process payments, reimbursements, funding, cards, transfers, invoices, and related records.”

Latest stance: third party or vendor sharing on privacy data use

“Service providers and subprocessors - vendors that support hosting, security, analytics, AI infrastructure, communications, support, email, document processing, data storage, and operations under confidentiality, security, and where applicable, HIPAA-compliant obligations. Professional advisors - lawyers, auditors, accountants, insurers, and compliance advisors. Legal, regulatory, and safety recipients - when required by law, subpoena, legal process, regulator request, public health obligation, or to protect rights, safety, security, and integrity. Business transfer recipients - in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate safeguards and applicable law. Where shared information is PHI, we share it only as permitted or required by the applicable BAA, HIPAA, individual authorization where required, and other applicable law.”

Latest stance: sale or sell on data retention

“Depending on your location and relationship with us, you may have rights to know, access, correct, delete, port, restrict, or object to certain processing of personal information. California residents may have rights under the CCPA/CPRA, including rights to know, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information, and not be discriminated against for exercising rights. We do not sell personal information or PHI. If any activity is considered a "sale" or "sharing" under applicable privacy law, we will provide legally required notice and opt-out mechanisms. To exercise privacy rights, contact privacy@getprescience.com . We may need to verify your identity and may direct requests about employer-controlled, health-plan-controlled, provider-controlled, or HIPAA-regulated information to the appropriate entity.”

Latest stance: sale or sell on privacy data use

“We do not sell personal information or PHI. We may disclose information to the following categories of recipients when permitted by law and applicable agreements: Employers and plan sponsors - aggregate, de-identified, eligibility, financial, operational, and plan-administration information. The employer portal is designed not to show individual clinical records, individual claims, or individual care-navigation content to employers. Employer-sponsored health plans and covered entities - information needed for treatment, payment, healthcare operations, plan administration, eligibility, oversight, audits, and legal compliance, as permitted by HIPAA and plan documents. Members, patients, and authorized representatives - information about their own account, benefits, care-navigation history, permissions, records, payments, and available services. Healthcare providers, provider groups, and networks - information needed to coordinate care, schedule visits, verify eligibility, process claims, support payment, and respond to member requests. Brokers, consultants, TPAs, PBMs, carriers, stop-loss partners, and administrators - information needed for plan design, implementation, administration, claims, pharmacy benefits, risk protection, funding, reporting, and support. Banking, card, payment, HSA, and financial partners - information needed to process payments, reimbursements, funding, cards, transfers, invoices, and related records.”