This State Privacy Law Notice (“Notice”) applies only to information collected by Greenway Health related to residents of certain states. It provides information required under certain state laws, which may include, but is not limited to the following state laws: the Colorado Privacy Act (CPA), the Delaware Personal Data Privacy Act (DPDPA), the Maryland Online Data Privacy Act (MODPA), the New Jersey Data Privacy Act (NJDPA), and the Oregon Consumer Privacy Act (OCPA) (collectively, “State Privacy Laws”).

  1. Overview

This Notice describes our practices regarding the collection, use, and disclosure of personal information and provides instructions for how you may seek to apply your rights, to the extent allowed by the State Privacy Laws. This Notice supplements, and should be read in conjunction with, the information set out in our Privacy Statement , along with certain information set out in the Privacy Notice for California Residents. Some sections of this Notice apply only to consumers in particular states. 

Certain state laws DO NOT apply to covered entities or business associates under the Health Insurance Portability and Accountability Act (“HIPAA”) and the Health Information Technology for Economic and Clinical Health Act. In many instances, Greenway Health is deemed to be a “business associate,” and therefore is not subject to that state’s law. This includes, without limitation, the Connecticut Data Privacy Act (CTDPA), the Florida Digital Bill of Rights, the Texas Data Privacy and Security Act (TDPSA), the Utah Consumer Privacy Act (UCPA), the Virginia Consumer Data Protection Act (VCDPA), and any other state data privacy laws with similar exemptions. 

Even if your state’s laws generally apply to covered entities and business associates, most state laws do not apply as related to health or medical information covered by HIPAA. As Greenway provides software and solutions for healthcare providers, this means that much of the personal information which we maintain on your behalf is protected health information (PHI) under HIPAA. 

State privacy laws are rapidly changing, and we are working to stay updated. As the list of states set out in this Notice may not be exhaustive, if you believe your state provides you with certain rights, you may contact us through the means set out below. Upon receipt of your inquiry, we will review your request, and applicable state law, to determine the proper response.

  1. Details about Personal Information We Collect and How We Use and Disclose Such Information

For information about what personal information we collect about consumers, how we collect such information, how we may use and disclose such information, along with additional information about such personal information, please see the Privacy Notice for California Residents. 

  1. California Residents

Please see the Privacy Notice for California Residents. 

  1. Your Rights

    • Confirm whether we are processing your personal information;

    • Gain access to certain personal information that we are processing about you;

    • Have inaccuracies corrected, or updates made, to certain of your personal information;

    • Have certain personal information provided by, or obtained about, you deleted;

    • Obtain a copy of certain of the personal information we process about you (in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance, to the extent the process is carried out by automated means);

    • Opt-out of the processing of personal information for purposes of:

      • Targeted advertising;

      • The “sale” or “sharing” (as such terms are defined by the State Privacy Laws) of personal information; or

      • Profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. For clarity, we do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects concerning you; and

    • Not be discriminated against, in relation to how we process your information or for you exercising your rights under the State Privacy Laws.

  2. How to Exercise Your Rights

If you are a resident of a state subject to the State Privacy Laws, you may have certain rights, including the rights to:

You may seek to exercise these rights by:

Verifiable Request

Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.

The verifiable consumer request must:

  • Be submitted through any of the channels listed above.

  • Provide sufficient information that allows us to reasonably verify you are the person about whom we collected the personal information (or are an authorized representative of such individual).

  • Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to your request in compliance with the State Privacy Laws.

 

Authorized Agent

If an authorized agent makes a request on your behalf, they too are subject to the contents of this notice, and in addition, we may require the authorized agent to provide proof of signed permission, and we may also require you to verify your own identity and/or directly confirm to Greenway that you provided the authorized agent with permission to submit the request.

Response Timing and Format

We endeavor to respond to a verifiable consumer request within the parameters set out in the State Privacy Laws. Greenway has adopted an industry standard, and best practice, that requires Greenway to respond within forty-five (45) calendar days from receipt of a verifiable request. Additionally, if we require more time, we will inform you of the reason and extension period in writing.

Any disclosures provided will cover the 12-month period preceding the verifiable consumer request’s receipt. The response provided will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Appeals Process 

Certain states require an appeals process in the event a consumer’s request is denied. If your state requires this, and we have denied all or part of your request, you may seek to appeal this decision by contacting us through any of the methods set out at the beginning of this Section 5. 

How to Opt Out

We may process your personal information for the purposes of targeted advertising, and/or our processing may qualify as a “sale” or “sharing” under certain State Privacy Laws. As an example, we may share your Internet activity, such as your Internet Protocol (“IP”) address, device information, browsing history, your search history and/or information on your interaction with our website, with a third-party advertising or marketing partner. To opt-out of any of the foregoing, you may contact us via any of the methods set forth at the beginning of this Section 5. 

  1. Greenway Health as Business vs Service Provider (Similar to Processer vs Controller)

Greenway Health is a leading provider of healthcare software solutions and services to healthcare providers. Therefore, if the reason we have your personal information is because we are providing those solutions and services to your healthcare provider, then your direct relationship, and main point of contact, is your provider (in this situation, your healthcare provider is the “business” as defined under certain State Privacy Laws, and we are the “service provider”). In order to pursue your rights, you generally would need to start with the business that you have a direct relationship with (here, your healthcare provider). If we are providing solutions or services on behalf of your healthcare provider (we would be the “service provider”), then we often are not legally allowed to comply with your requests, as your request should be directed to your healthcare provider. 

  1. HIPAA/PHI Exemption Which May Impact Your Rights

Most state laws do not apply as related to health or medical information covered by HIPAA. As Greenway provides software and solutions to healthcare providers, this means that much of the personal information which we maintain on your behalf is PHI under HIPAA. Therefore, if your request relates to PHI, your state’s law likely doesn’t apply as related to that information. 

  1. How we Protect, and Retain, Personal Information

We are committed to keeping your information secure, and we take reasonable precautions to protect your personal information from loss, misuse, or alteration. We maintain your information using reasonable administrative, physical, and technical safeguards. We keep your personal information as long as we need it to provide our services, comply with legal obligations, or protect ours or others’ interest. We decide how long we keep each category of personal information on a case-by-case basis, and retention periods are set forth in our internal records retention policy.

  1. Third Party Websites

Our website may provide, or third parties may provide, links to other websites or online resources. This notice solely applies to our website. It does not apply to services offered by third parties, including websites and other online services to which our website may display links. When you click on such links, you may be visiting websites or interactive services operated by third parties who have their own information collection practices. We do not have control over how any third party collects or uses information, so we recommend that you review their policies to learn about their practices.

  1. Changes to This Notice

Greenway Health reserves the right to amend this Notice at our discretion and at any time. Unless otherwise noted, any such changes will be immediately incorporated into this Notice, and the “Date Last Updated” below will show when the latest changes were made. You should review the page often to ensure you have the most up-to-date information. Your continued use of our website following any changes indicates your consent to the terms and practices described in the most-current version of this Notice.

  1. Contact Information

If you have any questions or comments about this Notice, the ways in which Greenway Health collects and uses your information described above and in the Privacy Statement, your choices and rights regarding such use, or wish to exercise your rights under applicable state law, you may contact us at:

State Privacy Law Notice

Date Last Updated: February 4, 2025