Privacy Policy

1. Introduction and Scope

Population Health 125 respects the privacy of website visitors, employers, employees, eligible participants, brokers, partners, and other individuals who interact with our websites, forms, employer-sponsored programs, support services, email, SMS, or other communications. This Privacy Policy explains the categories of information we collect, where it comes from, how we use and disclose it, how we protect and retain it, and the choices and rights that may be available.

This Policy applies to PH125-controlled websites, forms, communication programs, and business operations. It does not replace an employer plan notice, a healthcare provider's Notice of Privacy Practices, or an independent vendor's privacy policy. Third-party services may have their own terms and privacy practices.

2. Information We Collect

3. Sources of Information

• directly from you through forms, enrollment, consent, support, surveys, email, SMS, phone calls, and website interactions;
• from your employer or another authorized plan/program sponsor for implementation, eligibility, enrollment, account, support, and administration;
• from brokers, partners, vendors, healthcare/benefit providers, communications platforms, and other service providers acting in connection with the program;
• automatically from websites, systems, devices, cookies, logs, and security tools;
• from public or business sources when needed for employer, broker, vendor, or fraud/security verification.

4. How We Use Information

• operate, administer, implement, and support employer-sponsored benefits, wellness, engagement, education, and related services;
• verify identity, eligibility, enrollment, consent, account status, access, and communication preferences;
• send requested, transactional, account, program, educational, engagement, email, SMS, phone, mail, portal, or support communications consistent with the individual's choices and applicable law;
• provide customer service, respond to inquiries, troubleshoot, document issues, and maintain service records;
• calculate or administer engagement points, incentive eligibility, program participation, or utilization reporting where applicable;
• secure systems, prevent fraud and abuse, authenticate users, monitor deliverability, maintain suppression lists, and investigate complaints or incidents;
• manage employer, broker, partner, and vendor relationships; process contracts; and improve services and website functionality;
• perform analytics, quality assurance, auditing, compliance testing, legal review, and records management;
• comply with law, legal process, regulatory/carrier requirements, contractual obligations, and protect rights, safety, and property;
• send business, educational, or marketing communications only where permitted and subject to applicable consent and opt-out rights.

5. Email Communications

• Emails may include account/program notifications, enrollment or eligibility information, benefit access and onboarding instructions, reminders, important updates, educational material, wellness engagement, surveys, incentive information, and support communications.
• Email frequency varies, generally 1-8 emails per month for recurring program communications, depending on the selected category and program activity.
• Optional educational, engagement, or marketing email is based on the applicable affirmative choice. Applicable emails include an unsubscribe or preference mechanism.
• You may update email preferences through the link in an email or by contacting support@populationhealth125.org. Narrowly necessary responses or account/security notices may still be sent when permitted by law.
• PH125 does not sell or share email addresses or email consent information with third parties for their independent marketing or promotional purposes.

6. SMS/Text Messaging

• Program name: Population Health 125 Program Notifications. SMS is used for account and program notifications, enrollment and eligibility information, benefit access and onboarding instructions, reminders, wellness activity notices, important updates, and customer support.
• PH125 requires direct, affirmative individual SMS consent. An employer's authorization or possession of a mobile number is not treated by PH125 as the individual's recurring SMS opt-in.
• Message frequency varies, generally 1-8 messages per month. Message and data rates may apply.
• Reply STOP to opt out at any time. Reply HELP for assistance. You may also contact PH125 by phone, email, or website. PH125 honors reasonable revocation requests and maintains suppression records.
• Consent to SMS is not a condition of purchasing goods or services, employment, benefits eligibility, or participation in an employer-sponsored PH125 program.
• No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. SMS opt-in data and consent will not be shared with third parties for their marketing.
• Limited mobile information may be provided to carriers, aggregators, SMS vendors, hosting/CRM providers, security providers, and other processors solely to deliver, route, secure, support, audit, or legally operate the PH125 SMS program. These providers are not authorized to use the information for their own marketing.
• For SMS terms, see the Population Health 125 Terms and Conditions.

7. How We Disclose Information

PH125 does not sell, rent, or trade personal information. PH125 does not share personal information for third parties' independent marketing or promotional purposes, including mobile numbers and SMS consent data.

8. Health Information and HIPAA

Some PH125 programs relate to health, wellness, benefits, or healthcare access. Whether information is protected by HIPAA depends on the parties, data, and service arrangement. When PH125 receives protected health information as a business associate, PH125 handles it under the applicable business associate agreement and HIPAA requirements. Clinical providers, health plans, and other covered entities may provide separate Notices of Privacy Practices. This Privacy Policy is not a substitute for those notices.

PH125 minimizes health information in ordinary email and SMS. Detailed clinical or individualized health information should be exchanged through an approved secure portal or other authorized secure method. Do not send Social Security numbers, passwords, financial-account details, or detailed health information through ordinary SMS or email unless PH125 directs you to an approved secure channel.

9. Cookies, Analytics, and Online Technologies

• PH125 websites may use essential cookies for security, authentication, preferences, forms, and functionality.
• Analytics or similar technologies may be used to understand website performance and improve user experience. PH125 seeks to minimize unnecessary tracking, especially in sensitive contexts.
• Third-party tools may set their own cookies or collect usage information under their policies. Where required, PH125 provides notice or choice.
• Browser settings can block or delete cookies, but some features may not function correctly. PH125 does not use mobile/SMS consent information for cross-context behavioral advertising.
• Where legally required and technically applicable, PH125 will respond to recognized opt-out preference signals for covered online activities.

10. Data Security

• administrative, technical, and physical safeguards appropriate to the nature and sensitivity of the information;
• role-based access, least privilege, multifactor authentication where available, workforce confidentiality, and access review;
• encryption in transit and at rest where supported, secure credential/secret management, logging, monitoring, backup, and vulnerability management;
• vendor due diligence and contractual security, privacy, incident, subprocessor, and deletion requirements;
• data minimization, secure disposal, incident response, and periodic risk assessment and testing.

11. Data Retention

PH125 retains information only as long as reasonably necessary for the purpose collected, employer/program administration, consent and suppression evidence, security, audit, dispute resolution, legal or contractual obligations, and records management. Consent, communication, suppression, complaint, and related compliance evidence may be retained for at least seven years after the later of the last message or relevant program termination, subject to legal hold. When retention is no longer necessary, PH125 deletes, de-identifies, or securely disposes of information consistent with applicable requirements.

12. Your Choices and Rights

• access, correct, or request deletion of personal information, subject to identity verification and lawful exceptions;
• withdraw optional email or SMS consent and update communication preferences;
• reply STOP to SMS, reply HELP for SMS assistance, or use email unsubscribe/preference links;
• ask questions about collection, use, disclosure, retention, or security;
• exercise additional state-law rights that apply to you, such as rights concerning access, correction, deletion, portability, sensitive data, sale/sharing, targeted advertising, or appeal.
• receive non-discriminatory treatment for exercising applicable privacy rights.

To submit a privacy request, email support@populationhealth125.org, call 800-983-2611, or contact PH125 at 14 Wall Street, New York, NY 10005. PH125 may verify your identity and authority before completing a request. Authorized agents may be required to provide proof of authority. PH125 will respond within the period required by applicable law.

13. Children's Privacy

PH125 websites and general communications are not directed to children under 13, and PH125 does not knowingly collect personal information directly from a child under 13 through general website or marketing activities. Information concerning dependents may be processed when provided by a parent, guardian, employer, plan, or authorized provider for an employer-sponsored service and is handled according to the applicable arrangement and law.

14. Data Breach and Incident Notification

PH125 investigates suspected unauthorized access, use, or disclosure; preserves evidence; contains and remediates incidents; and provides notice to affected individuals, employers, partners, regulators, or others when required by applicable law or contract. Depending on the data and relationship, HIPAA, state breach laws, or the FTC Health Breach Notification Rule may apply.

15. Third-Party Websites and Services

PH125 may link to or integrate with independent websites and services. PH125 is not responsible for their content, security, or privacy practices. Review the third party's terms and privacy notice before providing information. When PH125 selects a service provider to process information for PH125, PH125 applies vendor and contractual controls appropriate to the service.

16. Changes to This Policy

PH125 may update this Privacy Policy to reflect legal, operational, technology, vendor, or service changes. The revised Policy will state a new effective date. PH125 will provide additional notice or obtain updated consent when required for a material change. Archived versions are maintained for compliance purposes.

17. Notice at Collection and Contact