This Privacy Notice explains how Merative L.P. and/or its subsidiaries (“Merative,” “we”, “us,” “our”) processes, collects, uses, and discloses information about individuals who use our websites (including, without limitation, https://www.merative.com, https://www.springbuk.com and https://www.healthiestemployers.com), our applications (including, mobile applications), products, services, tools and features, or otherwise interact with us, including attending in-person events (collectively, the “Services”) when we process such data for our own independent purposes (i.e., when we act as a controller/business, as such terms are defined under applicable law).

To the extent the European Union General Data Protection Regulation or the UK GDPR (together referred to as the “GDPR”) applies to our own independent processing activities, any of the entities listed on Attachment A may be the controllers of such data (unless otherwise stated).

Please read this Privacy Notice carefully. By using any of the Services, you agree to the collection, use, and disclosure of information about you as described in this Privacy Notice. If you do not agree to this Privacy Notice, please do not use or access the Services.

1. SCOPE OF PRIVACY NOTICE

This Privacy Statement does not apply to:

• Our services that present a separate privacy notice that do not reference or incorporate this Privacy Notice. We may provide additional supplementary privacy notices as needed.
• Information that is provided to, collected by, generated through, or processed by Merative on behalf of our business customer(s) who has entered into an agreement with us (“Client(s)”) in connection with the Services (such information, “Client Data”), regardless of whether such information is provided directly by our Client, an Authorized Representative, or is collected directly from the individual about whom such information pertains (an “Individual”).

If you are an Individual, our data handling practices regarding information about you is controlled by our Clients, unless otherwise described in a privacy notice provided to you at the time information about you is collected. We process Client Data as a processor/service provider on behalf of our Clients (and their affiliates) who are the controller of such information. We are not responsible for and have no control over the privacy and data security practices of our Clients, which may differ from those explained in this Privacy Notice. If information about you as an Individual has been submitted to us by or on behalf of a Client and you wish to exercise any rights you may have under applicable data protection laws, please inquire with them directly.

Depending on your role as noted below, this Privacy Notice will apply to you differently and sets out our practices for processing that information, as well as your rights in determining what we do with the information that we collect and hold about you.

This Privacy Notice applies to, and explains the types of information we process about you when you:

• Visit our website, make inquiries, request a demo of our Services, attend our events or otherwise interact with us offline or contact us (“General Contact(s)”).
• Set up, access, or operate an account on behalf of a Client for the use of our Services (each person, a “Authorized Representative(s)”).
• As it relates to Individuals, solely Account Information and Usage Data about you.

‍

2. CHANGES TO THIS PRIVACY NOTICE

We may modify this Privacy Notice from time to time, in which case we will update the “Last Updated” date at the top of this Privacy Notice. If we make material changes to how we use or disclose information we collect or process, we will use reasonable efforts to notify you (such as posting notice of such changes on the Services) and will take additional steps as required by applicable law.

We encourage you to periodically review this Privacy Notice to stay informed about our collection, processing and sharing of information about you.

If you do not agree to any updates to this Privacy Notice, please do not continue using or accessing the Services.

‍

3. COLLECTION OF INFORMATION

When you use or access the Services, where required or permitted by local laws, we collect certain categories of information about you from a variety of sources.

Information You Provide to Us

Some features of the Services may require you to directly provide us with certain information about yourself. You may elect not to provide this information, but doing so may prevent you from using or accessing these features. Information that you directly submit through our Services includes:

• Contact Information, such as name, date of birth, shipping addresses, email address, phone number, country of residence, and demographic information (e.g., age, gender, etc.).
• Account Information, such as contact information, username, password, and in some cases, profile photo, job title, and other details associated with your account. If you choose to register an account, you are responsible for keeping your account credentials safe. We recommend you do not share your access details with anyone else. If you believe your account has been compromised, please contact us immediately.
• Professional Information, such as business contact information (e.g., name, phone number, work address, and email address) and National Provider Number.
• Payment Information, such as bank account, credit or debit card information, billing address and other related billing information.
• Event-Related Information, such as registration details, attendance records, dietary restrictions or preferences, accessibility requirements, and session or workshop selections.
• Communication Records, such as call recordings, videoconference recordings, webinar recordings, voicemail recordings, and live chat transcripts.
• User-Generated Content, such as messages, product ideas and support information, submitted by you through our support communities and idea portals (“UGC”). We or others may store, display, reproduce, publish, or otherwise use UGC, and may or may not attribute it to you. Others may also have access to UGC and may have the ability to share it with third parties. You understand that, even after removal, copies of UGC may remain viewable in cached and archived pages and may have been copied or stored by Internet archives and others. If you choose to submit UGC to any public area of the Services, your UGC will be considered “public” and will be accessible by anyone, including us.
• Physical Security Information, such as name, photograph, government-issued identification presented for verification purposes, visitor badge records, vehicle information, and CCTV or surveillance footage collected at Merative facilities or appropriate meeting locations.
• Any other information you choose to include in communications with us or provide to us, for example, when sending a message through the Services or submitting information about you via a form through the Services, completing a survey, or conducting a product review.

Information We Collect Automatically

We also automatically collect certain information about your interaction with the Services or when you open an email (“Usage Data”). To do this, we may use cookies, pixels, SDKs, web beacons/clear gif, and other geolocation tracking technologies (“Tracking Technologies”). Usage Data includes:

• Device information, such as device type, operating system, device ID, unique device identifier, screen resolution, media access control (MAC) address, and internet protocol (IP) address.
• Location information, such as approximate location based on IP address.
• Other information regarding your interaction with the Services, such as operating system, browser type, log data, date and time stamps, pages you access on the Services, websites you access before and after visiting the Services, length of time spent on the Services (including specific webpages), crash logs, clickstream data, and ad impressions.

For more information on how we use Tracking Technologies and your choices, see the section below, Cookies and Other Tracking Technologies.

Information Collected From Other Sources

We may obtain information about you from outside sources, including information that we collect directly from third parties and information that you choose to have shared with us. Such third parties and information includes:

• Publicly Available Sources. Contact Information and Professional Information that we obtain from publicly available sources, including without limitation public records, professional directories, news articles, publicly accessible social media profiles, State Departments of Insurance (DOI) databases, U.S. Government Filings (Form 5500), Definitive Healthcare: CMS (Centers for Medicare & Medicaid Services) datasets, National Plan and Provider Enumeration System (NPPES) for NPI data, and State licensing databases.
• Business Partners and Referrals. Contact Information and Professional Information that we receive from resellers, integration partners, co-marketing partners, referral programs, or event co-sponsors, for example when we sell or create co-branded services or marketing.
• Data Enrichment and Analytics Providers. Contact Information or other information such as firmographic data (e.g., company size, industry, revenue range), technographic data, intent signals, and inferred professional interests that we receive from third-party data enrichment or analytics providers such as ZoomInfo, HubSpot, and 6sense.
• Data Brokers. Identifiers and Contact Information, Professional Information, and demographic information that we purchase or obtain from data brokers or commercially available sources such as Definitive Healthcare, ZoomInfo, and 6Sense.
• Fraud Prevention and Identity Verification Providers. Identifiers and Contact Information and verification results, risk scores, and identity confirmation data that we receive from third party fraud prevention, identity verification, or security screening providers.
• Event Organizers and Sponsors. Contact Information and Professional Information that we receive from trade show organizers, conference hosts, or event sponsors when you attend or register for an event where we are a participant or sponsor.
• Advertising Partners. Information such as conversion reports, matched audience segments, inferred interest profiles, and campaign performance data that we receive from advertising or retargeting partners such as e.g., Google Ads, 6sense, and LinkedIn.
• Social Media Platforms. Contact Information and Usage Data (such as interactions with our pages or posts, engagement data, and profile information you have made publicly available based on your settings) that we receive from social media platforms.
• Single Sign-On and Linked Accounts. Contact Information and Account Information (such as email address, username, profile information, and authentication tokens) that we receive when you choose to link a third-party account (e.g., Google, Microsoft) or use single sign-on to access our Services.

Any information we receive from outside sources will be treated in accordance with this Privacy Notice. We are not responsible for the accuracy of the information provided to us by third parties and are not responsible for any third party’s policies or practices. For more information, see the section below, Third Party Websites and Links.

Examples of How Collection Applies to You

The information we collect depends on how you interact with us and the Services you or our Clients use. For example, if you:

• Are a General Contact who inquires about our Services, downloads content, or subscribes to our publications, we may collect Contact Information (e.g., name, email address, phone number) and Professional Information (e.g., job title, company name, industry).
• Are an Authorized Representative accessing and using the Service, we will collect Account Information when you register for the Services.
• Visit our offices or other premises, we may collect Contact Information, Physical Security Information, and other visitor log information (e.g., time of entry, host visited).
• Register for, attend, or participate in our events, webinars, programs, trainings, or certifications, we may collect Basic Contact Details, Professional Information, and Event-Related Information (e.g., registration details, dietary restrictions, accessibility requirements, session selections).
• Act on behalf of or work for a service provider, supplier, or Business Partner of Merative, we may collect Contact Information, Professional Information (e.g., role, company, area of responsibility), and Transaction and Billing Information.
• Are employed by or associated with a Client and your information is shared with us in our capacity as a controller (for example, during the sales, contracting, or account management process), we may collect Contact Information and Professional Information.
• Participate in surveys, research or other similar data collection facilitated by us.

If you interact with us in any other capacity, we may collect information relevant to that interaction, as described in the sections above.

‍

4. USES OF INFORMATION AND LEGAL BASES

With respect to the categories of information we collect, as permitted or required by law in the relevant jurisdiction, we use information about you as described below. Where required by applicable law, we process personal information only where we have a valid legal basis to do so.

 

We may combine information we collect directly from you with information we collect automatically and information we receive from third parties. We may also combine information collected across devices, sessions, or Services. The combined information will be used for the purposes described in this Privacy Notice.

We may deidentify or anonymize information about you (depending on the relevant jurisdiction) such that it cannot reasonably be used to infer information about you or otherwise be linked to you (or we may collect information that has already been deidentified or anonymized), and we may use and disclose such deidentified or anonymized information for any purpose. To the extent we possess or process any deidentified or anonymized information, we will maintain and use such information in such form and not attempt to re-identify the information, except solely for the purpose of determining whether our deidentification/anonymization process satisfies legal requirements.

‍

5. COOKIES AND OTHER TRACKING TECHNOLOGIES

The Services use Tracking Technologies to facilitate and enhance your experience on the Services; understand how you access and use the Services (including which pages you visit and how often); analyze usage trends; personalize content; provide advertising and retargeting; and for the other purposes described in this Privacy Notice.

Third parties, including Analytics Providers and Advertising Partners, may also place Tracking Technologies on your device when you use the Services. The information collected by these third party Tracking Technologies is governed by the privacy policies of those third parties.

Where required by applicable law, we obtain your consent before placing non-essential Tracking Technologies on your device. You may withdraw your consent or adjust your preferences at any time through our cookie preference center.

Most browsers accept cookies and other Tracking Technologies automatically, but you may be able to adjust your browser or device settings to refuse or delete them. If you choose to block or delete cookies, some features or functionality of the Services may not operate correctly. Cookie settings typically apply only to the specific browser or device you are using, so changes made in one browser or device will not necessarily carry over to others.

For more information about the specific Tracking Technologies we use, including the categories of cookies, their providers, purposes, and duration, please see our Cookie Notice. You can find more information about cookies and how to manage them here.

If you have questions regarding the specific information about you that we process or retain, or your choices regarding our collection and use practices, please contact us using the information listed below.

Do Not Track & Global Privacy Controls

Your browser settings may allow you to transmit a “do not track” signal, “opt-out preference” signal, or other mechanism for exercising your choice regarding the collection of information about you when you visit various websites.

Our website recognizes the Global Privacy Control (GPC) signal which enables you to opt out of certain uses or disclosures of information about you. If you notify us of your preference through GPC, we will honor your request only for the browser or device that sends the GPC signal. If you do not have an account or are not logged into your account, your request to opt out through the GPC will not apply to any account information. To learn more about Global Privacy Control, you can visit https://globalprivacycontrol.org.

‍

6. DISCLOSURE OF INFORMATION

We may disclose information about you to third parties for legitimate purposes subject to this Privacy Notice, including the following categories of third parties:

• Related Entities. Our parent companies, affiliates, subsidiaries, or others within our corporate group (e.g., under common ownership or control).
• Clients. The entity that provides you with access to the Services and on whose behalf we process information about you.
• Service Providers. Vendors or other service providers who help us provide the Services, including without limitation for system administration, cloud storage, security, website hosting, mailing, Client relationship management, providers of artificial intelligence and machine learning technologies that support the functionality of the Services, marketing communications, web analytics, payment networks, and payment processing, and other operational functions.
• Business Partners. Third parties who assist us with receiving and providing referrals, such as businesses with whom we may create a joint product with.
• Analytics Providers. Third party analytics providers who help us understand usage patterns and improve the Services.
• Advertising Providers. Third parties who assist with advertising, retargeting, measurement, audience insights, or marketing activities, including ad platforms and ad networks.
• Professional Advisors. Auditors, law firms, accounting firms, and other professional advisors who support our business.
• Business Transactions. Third parties in connection with or anticipation of a bankruptcy, asset sale, merger, reorganization, financing, or other business transaction.
• At Your Direction. Third parties to whom you request or direct us to disclose information, including through your use of social media widgets, plug-ins, or single sign-on integrations.

We may also disclose information about you as needed to comply with applicable law (e.g., respond to a subpoena or other lawful request) or any obligations thereunder or to cooperate with law enforcement, judicial orders, and regulatory inquiries, to respond to requests from data subjects, to enforce any applicable terms of service, and to ensure the safety and security of our business, employees, and users.

‍

7. INTERNATIONAL TRANSFERS AND STORAGE

Information that we collect from you will be transferred to and stored at/processed in countries outside the European Economic Area (“EEA”) and the United Kingdom (“UK”). Information about you is also processed by staff operating outside the EEA and the UK who work for us or one of our third party service providers or business partners. We will take appropriate safeguards as required by applicable law to ensure that personal information about you is treated securely and in accordance with this Privacy Notice.

For any transfers of data outside the EEA or the UK, the data transfer will be under the European Commission’s standard contractual clauses for the transfer of personal information to third countries (specifically, module one (controller to controller transfer) and/or module two (controller to processor transfer) and/or module three (processor to processor transfer), as relevant), or the UK Information Commissioner’s international data transfer addendum to the EU standard contractual clauses or the UK International Data Transfer Agreement, as relevant, unless the data transfer is to a country that has been determined by the European Commission or the relevant UK authorities, as applicable, to provide an adequate level of protection for individuals’ rights and freedoms for their personal data. Please contact us at Privacy@Merative.com should you wish to examine a copy of the EU standard contractual clauses or UK international data transfer addendum.

‍

8. SOCIAL FEATURES

Certain features of the Services allow you to initiate interactions between the Services and third party services or platforms, such as social networks (“Social Features”). Social Features include features that allow you to access our pages on third party platforms, and from there “like” or “share” our content. Use of Social Features may allow a third party to collect and/or use information about you. If you use Social Features, information you post or make accessible may be publicly displayed by the third party service. Both we and the third party may have access to information about you and your use of both the Services and the third party service. For more information, see the section below, Third Party Websites and Links.

‍

9. THIRD PARTY WEBSITES; LINKS AND EMBEDDED CONTENT

We may provide links to third party websites or platforms. If you follow links to sites or platforms that we do not control and are not affiliated with us, you should review the applicable privacy notice, policies and other terms. We are not responsible for the privacy or security of, or information found on, these sites or platforms. Information you provide on public or semi-public venues, such as third party social networking platforms, may also be viewable by other users of the Services and/or users of those third party platforms without limitation as to its use. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owner or operators.

The Services may also incorporate features, add-ons, portals, and content including feeds, scripts embedded in the Services’ code, and visible content (e.g., videos), provided by third parties. In some cases, those third parties collect data about how you interact with their content.

Google Maps Features

The Services may also include Google Maps features and content. Google Maps features and content is subject to the then-current versions of Google Maps/Google Earth Additional Terms of Service and Google Privacy Policy.

‍

10. DATA SECURITY AND RETENTION

Despite our reasonable efforts to protect your information, no security measures are impenetrable, and we cannot guarantee “perfect security.” Any information you send to us electronically, while using the Services or otherwise interacting with us, may not be secure while in transit. We recommend that you do not use unsecure channels to send us sensitive or confidential information.

Information you provide to us should be relevant to the purposes for which it is to be used, and, to the extent necessary for those purposes, should be accurate, complete, and up to date. We retain information about you for as long as it is reasonably necessary for the purposes specified in this Privacy Notice. When determining the length of time to retain information about you, we consider various criteria, including whether we need the information to continue to provide you with the Services, resolve a dispute, enforce our contractual agreements, prevent harm, promote safety, security and integrity, protect ourselves, including our rights, property or product, or otherwise in accordance with applicable law.

‍

11. CALIFORNIA RESIDENTS

This section applies to you only if you are a California resident. For purposes of this section, references to “personal information” shall include “sensitive personal information,” as these terms are defined under the California Consumer Privacy Act (“CCPA”).

Processing of Personal Information

In the preceding 12 months, we collected the categories of personal information listed in the table below (as each are enumerated and defined in the CCPA). For each category of personal information, we indicate: (i) the business or commercial purposes for which the information was collected or used, as described in the Uses of Information and Legal Bases section above, and (ii) the categories of recipients to whom we disclosed the information for a business purpose, as described in the Disclosure of Information section above.

We only use and disclose sensitive personal information for the purposes permitted under the CCPA.

 

The criteria we use to determine how long to retain personal information about you is described in the section above, Data Security and Retention.

Selling and/or Sharing of Personal Information

We do not have actual knowledge that we “sell” or “share” (as those terms are defined under the CCPA and used throughout this section) personal information of residents under 16 years of age.

However, we do “sell” and/or “share” certain categories of personal information for cross-context behavioral advertising. In the preceding 12 months, we sold and/or shared the categories listed below:

 

12. YOUR PRIVACY RIGHTS

Depending on where you are located, you may have certain rights regarding your personal information, subject to applicable law and any exceptions. Where available to you, these rights include:

• Know/Access. Request a copy of the personal data we hold about you, along with information about how we process that data.
• Portability. Receive a copy of personal information we process about you in a structured, commonly used, and machine-readable format, and request that we transmit it to a third party where technically feasible.
• Correction. Request correction of personal information that is inaccurate, incomplete, or out of date.‍
• Deletion. Request deletion of personal information about you, subject to certain exceptions. You may request that we delete your personal data in certain circumstances, such as when it is no longer necessary for the purposes for which it was collected, or if you have withdrawn your consent (where applicable). Please note that there are exceptions where we may be required by law to retain certain information.‍
• Withdrawal of Consent. Where we rely on consent to process personal information about you, withdraw that consent at any time, without affecting the lawfulness of processing before withdrawal.‍
• Objection to Marketing. Object to the use of personal information about you for direct marketing purposes at any time.‍
• Restriction of Processing. Request that we stop processing personal information about you other than for storage purposes, in certain circumstances. You have the right to request that we limit the processing of your personal data under specific conditions, such as when you contest the accuracy of the data or object to its processing. In some instances, we may continue processing the data if it is necessary for legal claims or compliance with other legal obligations.‍
• Objection to Processing. Object to our processing of personal information about you where we rely on legitimate interests as our legal basis.‍
• Right to Opt Out of Selling or Sharing. Opt out of (i) the sale of personal information about you; and/or (ii) the use of personal information about you for targeted advertising purposes. Exercise this right by using the Global Privacy Control as noted in the Do Not Track & Global Privacy Controls section above or via the Do Not Sell or Share My Personal Information link.

‍

• ‍Limit Use of Sensitive Personal Information. Direct us to limit our use and disclosure of your sensitive personal information. ‍
• Non-Discrimination. Not receive discriminatory treatment for exercising your privacy rights. ‍
• Lodge a Complaint. Lodge a complaint with a supervisory authority, such as the data protection authority in the country where you live or work or where an alleged infringement occurred or, for the UK, the Information Commissioner’s Office.

As described above, we may also process Client Data submitted by or for a Client to our services. If not stated otherwise in this Privacy Notice or in a separate disclosure, we process such data as a processor on behalf of our Client (and its affiliates) who is the controller of data (see Section 1 above). We are not responsible for and have no control over the privacy and data security practices of our Clients, which may differ from those explained in this Privacy Notice. If information about you has been submitted to us by a Client and you wish to exercise any rights you may have under applicable data protection laws, please inquire with them directly.

‍

13. EXERCISE YOUR RIGHTS

If this Privacy Notice expressly states that you have certain rights, or applicable law grants you certain rights as it relates to the Services and information, we collect about you, you may exercise any of these rights by contacting us using the information provided below. You may submit a request to us by:

• Emailing: Privacy@Merative.com
• Calling: 1-866-457-3206 (toll-free)
• Visiting: https://www.merative.com/privacy-request

Or by following the opt-out methods and processes identified above. For clarity, to exercise your rights to opt-out of the “selling” or “sharing” of personal information about you, you must follow the instructions provided under the Your California Privacy Rights section noted above.

Verification

To verify certain requests, for example, requests to know, delete, or correct, we may need to collect additional information to verify your identity and the request, such as your email address, government-issued ID, residence address, or date of birth, before providing a substantive response to the request.

Some jurisdictions, depending on your location, permit you to authorize an agent to make requests on your behalf to exercise your rights. If you have a registered agent to act on your behalf, we have the right to authenticate such agent’s authority to act.

‍

14. LANGUAGE

Except as otherwise prescribed by applicable law, in the event of any inconsistency between the English language version and local language version of this Privacy Notice, the English language version will prevail.

‍

15. HOW TO CONTACT US

Should you have any questions about our privacy practices or this Privacy Notice, please email Privacy@Merative.com or contact us at 100 Phoenix Drive, Suite 200, Ann Arbor, Michigan 48108.

ATTACHMENT A

Merative L.P.

Merative US L.P.

Micromedex LLC

Zelta Trials LLC

Curam Innovations LLC

Springbuk Inc.

Merge Healthcare Solutions Inc.

Merative Healthcare Parent International Holdco Ltd.

Merative Canada Holdco ULC

Merge Canada Holdco ULC

Merative Technologies Private India Ltd.

Merative UK Ltd.

Merative Healthcare Ireland Ltd.

Merative Germany GmbH

Merative Singapore Ltd.

Merative France SAS

Merative Finland Oy