Privacy Notice

1. Introduction

This Website Privacy Notice (“Notice”) explains how Machinify collects and uses your personal information when you visit our websites, use our platform and portals, or interact with us. Please read this Notice carefully to understand your rights and our practices.

Machinify, Inc. and its subsidiaries and affiliates, including The Rawlings Company LLC, Rawlings Financial Services LLC, Apixio Holdings, LLC, Performant Recovery, Inc. (d/b/a Performant Healthcare Solutions), and Varis, LLC (collectively, “Machinify,” “our,” “we,” or “us”) operate websites, platforms, and portals, and other online properties, including machinify.com, trgclaimsinfo.com, rawlingspayments.com, cobupdate.com, performanthealthcare.com, and other websites, pages, platforms, and portals operated by Machinify or authorized third parties on our behalf that link to this Notice (each, a “Site,” and collectively, the “Sites”). Machinify also provides products and services (collectively, the “Services”) and engages in marketing activities, events, and other business interactions.

When we refer to “you” in this Notice, we mean any individual who visits our Sites, uses our Services, or otherwise interacts with Machinify. When we refer to “personal information” in this Notice, we mean information that identifies or could reasonably identify you, such as your name, email address, phone number, or IP address. Machinify, Inc. is the controller of your personal information as described in this Notice. If you are a California resident, this Notice provides information required by the California Consumer Privacy Act of 2018 (“CCPA”), including the categories of personal information (including sensitive personal information) we collect, the purposes for which we collect, use, and disclose that information, our retention practices, whether the information is sold or shared, how to opt out of the sale or sharing of personal information, and how to exercise your privacy rights. You can find those details by following the links in this paragraph.

This Notice does not apply to our handling of personal information we collect about our employees, interns, directors, officers, independent contractors, consultants, or job applicants. We provide separate privacy notices to those individuals. This Notice does not apply to portals or other nonpublic systems operated on behalf of a government agency under a government contract. Information handled through those excluded systems is governed by applicable contractual and legal requirements.

Information Processed on Behalf of our Customers: In providing our Services, Machinify receives, creates, and processes information on behalf of our customers, including Protected Health Information ("PHI") and other information provided by healthcare providers, health plans, members, and other authorized parties ("Customer Content"). Customer Content may be submitted through our Sites or received through other channels, including mail, fax, and electronic transmission.

When Machinify processes PHI as a Business Associate under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), our use and disclosure of that information are governed by applicable law and our contractual obligations, including Business Associate Agreements with our customers. The provisions of this Privacy Notice describing Machinify's collection, use, and disclosure of personal information for its own business purposes do not govern our processing of Customer Content on behalf of our customers. However, this Notice continues to apply to personal information that Machinify collects and processes for its own business purposes, including through our Sites, Services, marketing activities, events, and other business interactions. Individuals seeking to exercise their HIPAA privacy rights regarding PHI should contact the health plan or healthcare provider responsible for that information. Questions about coverage, benefits, or reimbursement matters should be directed to your health plan or payor.

2. Types of Personal Information We Collect and Disclose

In the past 12 months, we have collected, processed, and disclosed the following categories of personal information about you for the business and commercial purposes described in this Notice.

Categories of Personal Information Collected	Disclosed for Business Purposes to
Identifiers and contact details, such as your name, address, email, phone number, unique personal identifiers, online identifiers, IP address, user ID, session ID, other similar identifiers, information provided when you create an account for a Machinify Service, register for or attend an event, or obtain access to marketing material Records about you (defined by California law), such as your signature and transcriptions of meetings and calls with our teams Inferences drawn from other personal information (defined by California law), such as marketing you may respond positively to Other information you voluntarily provide to us, such as the content of your communications when you contact us for customer support, provide feedback, or otherwise voluntarily provide information to us	Categories 1 through 4: Machinify subsidiaries and affiliates Service providers to enable them to perform services on our behalf Third parties at your direction or with your consent, such as event sponsors Your organization that is a Machinify customer Providers of cookies and similar technologies, and other business partners Parties to a corporate transaction, such as a proposed or actual merger, acquisition, investment, reorganization, or sale of all or part of our business or assets Professional advisors, such as lawyers, auditors, insurers, and accountants Government authorities, in response to lawful requests or as required to comply with applicable legal obligations
Commercial information, such as your marketing preferences, records of your registration for events, downloads of our marketing content, purchasing history, transactional information, and log files Internet or other electronic network activity information, such as browsing and search history, user interface interactions, device and browser information, engagement with our marketing communications, operating system and device, how you interact with our Site and Services, web page referrers, metrics and analytics Geolocation data, such as approximate location based on IP address, and city/state provided to us Audio, electronic, visual, or similar information, such as security camera footage recorded in our offices, recordings and transcriptions of meetings and calls with our teams, messaging logs, and photographs and videos at events and our offices Professional or employment-related information, such as your employer, job title, and professional role, provided when you register for an event, request a demonstration, or subscribe to communications, or obtained from business contact data providers	Categories 5 through 9: Machinify subsidiaries Service providers to enable them to perform services on our behalf Third parties at your direction or with your consent, such as event sponsors Your organization that is a Machinify customer Providers of cookies and similar technologies, and other business partners Parties to a corporate transaction, such as a proposed or actual merger, acquisition, investment, reorganization, or sale of all or part of our business or assets Professional advisors, such as lawyers, auditors, insurers, and accountants Government authorities, in response to lawful requests or as required to comply with applicable legal obligations

Categories of Personal Information Collected

Disclosed for Business Purposes to

Identifiers and contact details, such as your name, address, email, phone number, unique personal identifiers, online identifiers, IP address, user ID, session ID, other similar identifiers, information provided when you create an account for a Machinify Service, register for or attend an event, or obtain access to marketing material
Records about you (defined by California law), such as your signature and transcriptions of meetings and calls with our teams
Inferences drawn from other personal information (defined by California law), such as marketing you may respond positively to
Other information you voluntarily provide to us, such as the content of your communications when you contact us for customer support, provide feedback, or otherwise voluntarily provide information to us

Categories 1 through 4:

Machinify subsidiaries and affiliates
Service providers to enable them to perform services on our behalf
Third parties at your direction or with your consent, such as event sponsors
Your organization that is a Machinify customer
Providers of cookies and similar technologies, and other business partners
Parties to a corporate transaction, such as a proposed or actual merger, acquisition, investment, reorganization, or sale of all or part of our business or assets
Professional advisors, such as lawyers, auditors, insurers, and accountants
Government authorities, in response to lawful requests or as required to comply with applicable legal obligations

Commercial information, such as your marketing preferences, records of your registration for events, downloads of our marketing content, purchasing history, transactional information, and log files
Internet or other electronic network activity information, such as browsing and search history, user interface interactions, device and browser information, engagement with our marketing communications, operating system and device, how you interact with our Site and Services, web page referrers, metrics and analytics
Geolocation data, such as approximate location based on IP address, and city/state provided to us
Audio, electronic, visual, or similar information, such as security camera footage recorded in our offices, recordings and transcriptions of meetings and calls with our teams, messaging logs, and photographs and videos at events and our offices
Professional or employment-related information, such as your employer, job title, and professional role, provided when you register for an event, request a demonstration, or subscribe to communications, or obtained from business contact data providers

Categories 5 through 9:

Machinify subsidiaries
Service providers to enable them to perform services on our behalf
Third parties at your direction or with your consent, such as event sponsors
Your organization that is a Machinify customer
Providers of cookies and similar technologies, and other business partners
Parties to a corporate transaction, such as a proposed or actual merger, acquisition, investment, reorganization, or sale of all or part of our business or assets
Professional advisors, such as lawyers, auditors, insurers, and accountants
Government authorities, in response to lawful requests or as required to comply with applicable legal obligations

We may also disclose personal information where you have provided your consent, for any other purpose you authorize or direct, or as we otherwise disclose at the time we collect your personal information.

We may use de-identified, anonymized, or aggregated information for any purpose permitted by law. We maintain and use de-identified information in de-identified form, do not attempt to re-identify it except to determine whether our de-identification processes meet the requirements of California law, and contractually require recipients to do the same.

We engage in routine targeted advertising practices involving third parties that could be considered a “sale” or “sharing” as defined under California law. In the past 12 months, we have “sold” or “shared” for a commercial purpose the data described in categories 1, 3, 5, 6, 7, and 9 above to advertising networks, social media platforms, data analytics providers, and marketing and business intelligence providers for targeted advertising, measuring the effectiveness of our marketing, and understanding which organizations and individuals interact with our Sites.

Sensitive personal information: In the past 12 months, we have collected account log-in information in combination with the password or other credentials that allow access to an account on our platform or on a portal that requires a log-in. We use this information to authenticate users and secure our Services, and we disclose it for those business purposes to service providers that help us operate and secure our Services. When someone other than a health plan member, such as an attorney, pays us by credit card over the phone, we also collect a debit or credit card number in combination with the required security code and expiration date. We use this information to process the payment, and we disclose it to our payment processor. When you register for an event, you may choose to tell us about dietary needs or accommodations, which may reveal information about your health or religious beliefs. We use this information to provide the meals and accommodations you request, and we disclose it to service providers that help us run the event. We do not sell or share sensitive personal information. We do not use or disclose sensitive personal information for purposes other than those permitted under Cal. Code Regs. tit. 11, § 7027(m), and we do not use it to infer characteristics about you.

3. Sources of Personal Information

We may collect personal information from:

You directly, when you visit our Sites, create log-in credentials for our Services, register for and attend events, or otherwise interact with us
Third parties, such as joint marketing/co-hosted event providers, payment processors, your employer, social media, advertising partners, analytics providers, business contact data providers, and publicly available sources
You automatically, when you use our Sites or Services, through cookies, event logging, and similar technologies.

4. Purposes for Processing Personal Information

We use your personal information for purposes including:

Processing Purposes
Providing, operating, auditing, and improving our Services, Sites, and our business, as well as developing new products or services (including algorithms, artificial intelligence and machine learning tools and models). Communicating with you, such as sending invoices, announcements, updates, security alerts, surveys, support and administrative messages about our Sites, Services, and events. Detecting, preventing, and responding to security incidents, fraud, and other harmful activities. This includes protecting our property, Sites, Services, and personnel, and enforcing our contractual terms. Sales and marketing, such as advertising and marketing our Services, conducting market research, delivering targeted advertising, measuring the effectiveness of our marketing, maintaining and enriching our business contact records, sending event invitations, and communicating with you. Feedback and interviews, such as requesting, collecting, and publishing customer feedback. Responding to and complying with lawful requests from government authorities and complying with applicable legal obligations. Establishing, exercising, or defending legal claims and protecting our rights and property. Providing reasonable accommodations. Other purposes required by applicable law. Other purposes with your consent.

Processing Purposes

Providing, operating, auditing, and improving our Services, Sites, and our business, as well as developing new products or services (including algorithms, artificial intelligence and machine learning tools and models).
Communicating with you, such as sending invoices, announcements, updates, security alerts, surveys, support and administrative messages about our Sites, Services, and events.
Detecting, preventing, and responding to security incidents, fraud, and other harmful activities. This includes protecting our property, Sites, Services, and personnel, and enforcing our contractual terms.
Sales and marketing, such as advertising and marketing our Services, conducting market research, delivering targeted advertising, measuring the effectiveness of our marketing, maintaining and enriching our business contact records, sending event invitations, and communicating with you.
Feedback and interviews, such as requesting, collecting, and publishing customer feedback.
Responding to and complying with lawful requests from government authorities and complying with applicable legal obligations.
Establishing, exercising, or defending legal claims and protecting our rights and property.
Providing reasonable accommodations.
Other purposes required by applicable law.
Other purposes with your consent.

When we share your personal information with third parties, those third parties have their own privacy notices that govern how they process your data. We recommend reviewing their privacy notices if you interact with them directly or if they use your personal information for their own business purposes.

5. California Rights

This section 5 only applies to California residents.

a. Privacy Rights: Your rights under the CCPA include:

Right to Correct: You have the right to request that we correct inaccurate personal information that we maintain about you.
Right to Delete: You have the right to request that we delete the personal information that we collect from you.
Right to Know: You have the right to request to know: (i) the specific pieces of personal information we collected about you; (ii) the categories of personal information that we collected about you in the past 12 months; (iii) the categories of sources from which the personal information was collected; (iv) the categories of your personal information that we sold, shared, or disclosed in the past 12 months; (v) the categories of third parties to whom your personal information was sold, shared, or disclosed; and (vi) the purpose for collecting, selling, or sharing your personal information in the past 12 months. You may also request personal information we collected beyond the past 12 months, back to January 1, 2022, and we will provide it unless doing so proves impossible or would involve disproportionate effort. You may exercise your right to know twice in a 12-month period, free of charge.
Right to Opt-Out of Sale or Sharing: You have the right to opt out of the sale or sharing of your personal information. For personal information collected online through cookies and similar technologies, you can exercise this right through the Your Privacy Choices link in the footer of each of our Sites. For any other sale or sharing, email us at privacy@machinify.com, as described in Section 5(c).
Right to Non-Discrimination and Non-Retaliation: If you choose to exercise any of your rights under the CCPA, we will not discriminate or retaliate against you in any way.

b. Notice of Financial Incentive:

From time to time, we offer incentives, such as entries in prize drawings or giveaways, gift cards, or event swag, in exchange for personal information, such as your name, business contact information, company, and job title (categories 1 and 9 in Section 2). Participation is optional. You opt in by completing the entry or sign-up form for the incentive, and the rules or terms for each incentive describe the incentive and how to participate. We use the information to administer the incentive and contact winners or recipients. You may withdraw at any time by emailing privacy@machinify.com, and you may unsubscribe from our marketing emails at any time. Based on a good-faith estimate, we value the personal information you provide for an incentive at an amount equal to the value of that incentive. We calculated this estimate from the costs of offering the incentive and of collecting and processing the information.

c. Exercising Your Rights Under the CCPA:

To make a privacy rights request, please contact us at 844-584-7022 (California only) or email us at privacy@machinify.com.

To exercise the Right to Opt-Out of Sale or Sharing with respect to any “sale” or “sharing” of information automatically collected online through cookies and other tracking technologies, you may:

You can reject non-essential cookies (advertising, analytics, and other tracking technologies) through our cookie banner or Cookie Preferences link in the footer of each of our Sites. Cookie-based preferences may need to be set separately for each Site, browser, and device; recognized opt-out preference signals will be processed as required by law. If you clear cookies, you will need to disable the use of non-essential cookies in the Cookie Preferences link in the footer of each of our Sites again from each browser and from each device that you use where you have cleared cookies.
You may use Global Privacy Control (“GPC”), a privacy preference signal supported by certain browsers and browser extensions (see globalprivacycontrol.org). GPC is generally transmitted independently of cookies and may need to be enabled separately on different browsers or devices. When we detect a GPC signal, we treat it as a valid request to opt out of the sale or sharing of personal information for that browser or device. We will process this signal without any additional confirmation from you. Our Site displays whether we have processed your signal as an opt-out request.

To opt out of sale or sharing that does not rely on cookies or similar technologies, such as any sharing of your contact information (including in hashed form) with advertising platforms for audience matching or conversion measurement, email us at privacy@machinify.com. Some browsers have incorporated a “Do Not Track” (“DNT”) preference. Because there is no common industry standard for responding to DNT signals, we do not currently respond to them.

d. Verification:

Only you or your authorized agent may submit a privacy rights request. You may submit a privacy rights request on behalf of your minor child. Except for requests to opt out of sale or sharing, to respond to your privacy rights request, we will take steps to verify your identity. Where necessary, we may request additional information about you so that we can verify your identity. Where we did not already hold that information, we will use it only to verify your identity and process your request. If we cannot verify your identity based on the information provided, we will let you know that we are unable to fulfill your request. If we maintain your personal information on behalf of a third party, we may need to refer you to that third party in order to respond to your request. If we cannot comply with your request, or with part of your request, we will explain the reasons in our response.

e. Authorized Agent:

You may use an authorized agent to submit a privacy rights request. Authorized agents may exercise privacy rights on your behalf by submitting a request via phone at 844-584-7022 (California only) or by email at privacy@machinify.com and indicating that they are submitting the privacy rights request as an agent. When we verify your agent’s request, we may verify your identity and your agent’s identity and request a signed declaration from you that authorizes your agent to make the request on your behalf. To protect your personal information, we reserve the right to deny a request from an agent that does not submit proof that they have been authorized by you to act on your behalf.

f. Marketing Opt-Out Preferences:

If you do not wish to receive marketing-related communications from us, please click the unsubscribe link at the bottom of the marketing email or email us at privacy@machinify.com. Please note that if you opt out of, or do not consent to, marketing-related messages from us, we may still send you non-marketing messages, such as communications relating to the provision of the Site or Services.

g. Cookies and Tracking Technologies:

We, and third parties we allow, may collect information about your online activities over time and across third party websites or online services. We honor Global Privacy Control signals as described in Section 5(c). See Section 8 below for more details.

6. Security and Retention

Security: We maintain reasonable precautions intended to help protect the personal information that we collect and store; however, no system or online transmission of data is completely secure. We cannot guarantee the security of your information transmitted to or through our Sites or Services. Any transmission is at your own risk. Please use security measures to protect your personal information.

Retention periods: We retain your personal information for as long as necessary to fulfill the purposes described in this Notice, as required to operate our business, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, and comply with applicable laws. This includes retaining your information in accordance with our business relationship with your employer (our customer), enhancing our business operations, demonstrating our compliance with contractual and legal obligations, and adhering to applicable legal requirements. To determine the appropriate retention period for personal information, we consider the quantity, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of the personal information, the purposes for which we process the personal information, and applicable legal requirements (such as applicable statutes of limitation). How long we keep personal information depends on why we collected it and, for many records, on our relationship with your employer or organization, therefore we cannot state a single fixed retention period for each category of personal information. We retain records of privacy rights requests for a minimum of 24 months.

7. International Visitors

Our Site and Services are controlled and operated by Machinify from the United States and are not intended to subject us to the laws or jurisdiction of any state, country, or territory other than the United States. Your personal information may be stored and processed in any country where we have facilities or in which we engage service providers. Your use of our Site or Services may involve the collection, processing, and transfer of information to or from countries outside of your country of residence, including the United States, which may have different data protection rules than those of your country.

8. Your Information Choices

We, our service providers, and other third parties we allow may use cookies and similar tracking technologies on our Sites to collect information about your interactions. For more information, please see our Cookie Notice. Cookies may generally be disabled or removed using tools available as part of most commercial browsers, and in some instances, blocked in the future by selecting certain settings. The choices available, and the mechanism used, will vary from browser to browser. Some web browsers (including some mobile browsers) provide settings that allow you to control or reject cookies or alert you when a cookie is placed on your computer or device. You may also be able to reject mobile device identifiers by adjusting the appropriate settings on your mobile device. Such browser settings are typically found in the “options,” “tools,” or “preferences” menu of your browser. You may also consult your browser’s help menu. Browser tools may not be effective on HTML5 local storage or other tracking technologies. If you disable or remove these technologies, some parts of our Site may not work, and when you revisit our Site, your ability to limit browser-based tracking technologies is subject to your browser settings and limitations. Although you are not required to accept cookies or mobile device identifiers, if you block or reject them, you may not have access to all features available through our Sites or Services. If you change computers, devices, or browsers; use multiple computers, devices, or browsers; or delete your cookies, you may need to repeat this process for each computer, device, or browser. Where required by applicable law, we present a cookie banner or enable cookie preference controls through the Cookie Preferences link in the footer of our Sites.

Some of the third parties we work with for advertising purposes participate in the Digital Advertising Alliance (“DAA”) and Network Advertising Initiative (“NAI”). The DAA and NAI provide mechanisms for you to opt out of interest-based advertising performed by participating members at https://optout.aboutads.info/ and https://optout.networkadvertising.org/. Opting out of interest-based advertising will not opt you out of all advertising, but rather only interest-based advertising from us or our agents or representatives. When you elect to opt out through these sites, they will place an opt-out cookie on your device indicating that you do not want to receive interest-based advertisements. Opt-out cookies only work on the internet browser and device they are downloaded onto. If you want to opt out of interest-based advertisements across your browsers and devices, you will need to opt out on each browser on each device you actively use. Some of these opt-outs may not be effective unless your browser is set to accept cookies. If you delete cookies, change your browser settings, switch browsers or computers, or use another operating system, you will need to opt out again. We are not responsible for the effectiveness of, or compliance with, any third-party opt-out options or programs or the accuracy of their statements regarding their programs. In addition, third parties may still use cookies to collect information about you, including for analytics and fraud prevention as well as any other purpose permitted under the DAA’s Principles.

Some web browsers incorporate a “Do Not Track” (“DNT”) or similar feature that signals to websites that a user does not want to have their online activity and behavior tracked. Because there is no common industry standard for responding to DNT signals, we do not currently respond to them. We honor Global Privacy Control signals as described in Section 5(c).

You may exercise choices regarding the use of cookies from certain Google advertising products by visiting Google’s Ad Settings at https://adssettings.google.com/, and the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout. You can learn more about Google’s practices with Google Analytics by visiting Google’s privacy policy at https://policies.google.com/technologies/partner-sites.

The Sites or Services may contain links to third-party websites or services, including social media platforms, that we do not operate. This Notice does not apply to personal information collected or processed independently by those third parties, whose privacy and security practices are governed by their own policies. We encourage you to review those policies before providing personal information. Links to third-party websites or services do not constitute our endorsement, and we are not responsible for their content or practices.

9. Children's Privacy

Our Site and Services are not directed to or intended for use by minors. If we learn that we have received information directly from a child under the age of 13 without their parent or legal guardian’s verified consent, we will use that information only to respond directly to that child (or their parent or legal guardian) to inform the child that they cannot use our Site or Services. Subsequently, we will make commercially reasonable efforts to delete such information. We do not have actual knowledge that we sell or share (as defined by California law) the personal information of consumers under 16 years of age.

10. Additional U.S. State Privacy Rights

Depending on your state of residence, you may have rights under your state’s consumer privacy law regarding personal information we process under this Notice. Subject to the exceptions in those laws, these rights may include the right to: confirm whether we process your personal information and access it; correct inaccuracies in it; delete it; obtain a portable copy of personal information you provided to us; opt out of the sale of your personal information, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects; and, where your state law provides it, obtain a list of the specific third parties to which we have disclosed personal information.

To exercise these rights, email us at privacy@machinify.com. You may opt out of targeted advertising and the sale of personal information collected through cookies and similar technologies by using the Your Privacy Choices link, the Cookie Preferences link, or Global Privacy Control, as described in Section 5(c). To opt out of sale or targeted advertising that does not rely on cookies or similar technologies, email us at privacy@machinify.com. We will verify requests as described in Section 5(d) and respond within the time required by applicable law. An authorized agent may submit a request on your behalf where your state law permits.

Appeals: If we decline to act on your request, you may appeal our decision by emailing privacy@machinify.com with the subject line “Privacy Request Appeal.” We will respond to your appeal within the time required by applicable law. If we deny your appeal, you may contact your state’s attorney general.

11. Contact Information

If you have any questions, complaints, or requests relating to this Notice or Machinify’s information handling practices, or wish to exercise your personal information rights, you may email us at privacy@machinify.com or contact us by mail at:

Attn: Chief Privacy Officer

Machinify, Inc.

8333 Douglas Ave., Suite 600

Dallas, TX 75225

12. Changes to this Notice

Machinify may update this Notice from time to time to reflect changes in legal requirements, operational practices, or other factors. When required by applicable law, we will notify you of such changes to this Notice by posting a notice on this page before any changes take effect or in another appropriate manner. You can see when this Notice was last updated by checking the “Last Updated” date displayed at the top of this Notice.