This Privacy Notice for California Residents supplements the information contained in Greenway Health’s (“Greenway,” “we,” or “us”) Privacy Statement and applies solely to California residents (“consumers” or “you”) to the extent the California Consumer Privacy Act (CCPA) applies to you. We adopt this notice to comply with the CCPA of 2018, as amended by the California Privacy Rights Act and any future amendments. Terms defined in the CCPA have the same meaning when used in this notice.
Overview
The CCPA grants California residents specific rights regarding their personal information. This notice details what personal information we may collect, use, and share. It also explains your rights and how to exercise them.
California consumers have the right to:
- Know, access, correct, and delete their personal information.
- Opt out of the sale or sharing of their personal information.
- Limit how their sensitive information is used.
- Be free from discrimination for exercising these rights.
Please note:
- Certain rights—such as the right to delete information—are limited under the CCPA when we need to retain your information to continue providing services or meet legal and regulatory obligations.
- Greenway Health provides software solutions and services to healthcare providers. If we process your information while providing those services, we are considered a “service provider” under the CCPA, and your healthcare provider is the “business.” In such cases, you should direct privacy rights requests (e.g., deletion, access) to your provider, not to Greenway.
- Protected health information (PHI), as defined under HIPAA, is exempt from the CCPA.
Information We Collect
Greenway Health may collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or your device.
Greenway Health has collected the following categories of personal information (each an “Information Type”) from consumers within the last twelve (12) months:
- Identifiers: Name, address, phone number, IP address
- Customer records: Contact details, credit card numbers, government issued ID numbers
- Protected information under California Law: Demographic or financial data
- Internet or other electronic activity: Interactions with our sites, applications, or ads
- Inferences: Profiles based on preferences, behavior, or characteristics
- Geolocation data: General location based on IP address
- Professional or employment-related information: Job history, performance data
- Sensitive information: Personal identification numbers (e.g., driver’s license, passport), account log-in credentials, financial information combined with access codes, religious beliefs, racial or ethnic origin, or other legally protected classifications
Personal information does not include:
- Publicly available information
- Deidentified or aggregated consumer information
- Information excluded from the CCPA’s scope, such as:
- Health or medical information governed by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the California Confidentiality of Medical Information Act (CMIA), or clinical trial data
- Personal information covered by sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA), the California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994.
How We Collect Information
Greenway Health may obtain personal information from the following categories of sources:
- Directly from you: For example, from forms you submit, Greenway products and services you purchase, phone calls, live chats, emails, or in-person interactions at events.
- Indirectly from you: For example, by observing your actions on our websites or from (or about) the devices you use to access our websites.
- From third parties: For example, from data analytics providers or third-party data brokers.
- From your representative: For example, if someone registers an account on your behalf or otherwise provides us with information about you.
Why We Use and Disclose Personal Information
We may use or disclose the personal information we collect for one or more of the business purposes described below. When we disclose personal information for a business purpose, we enter into a contract that:
- Describes the specific purpose for sharing the information.
- Requires the recipient to keep that personal information confidential and use it only to fulfill the terms of the contract.
In the past 12 months, we may have used or disclosed personal information (to the extent applicable to a consumer) for the following purposes:
- To fulfill or meet the reason you provided the information, such as responding to inquiries, processing transactions, or delivering requested products and services.
- To provide, maintain, support, personalize, and improve our websites, products, and services.
- To create, maintain, customize, and secure your account with us.
- To process payments and prevent transactional fraud.
- To provide you with support and respond to inquiries, including investigating and addressing concerns and monitoring or improving service response quality.
- To help maintain the safety, security, and integrity of our systems, services, technology infrastructure, and business operations.
- To personalize your website or application experience and deliver content, products, or offers relevant to your interests—including targeted advertising through our websites, third-party sites, or communications (with your consent, where required by law).
- For testing, research, analysis, and product development, including improving our websites, services, and user experience.
- To respond to law enforcement requests or comply with applicable laws, court orders, or governmental regulations, including verifying employment eligibility or fulfilling contractual obligations.
- In our capacity as an employer, to satisfy legal obligations, provide employment benefits, and support internal human resources operations.
- To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets.
- As otherwise described to you at the time of data collection, or as permitted under the CCPA.
We do not use the personal information we collect for materially different, unrelated, or incompatible purposes without providing notice and obtaining consent, where required by law.
Disclosing Your Information to Third Parties
As set forth in this notice, we may disclose or share your personal information (which may include one or more of the information types described in the “Information We Collection” section) with the following categories of third parties:
- Service Providers: We may share personal information with third-party service providers and vendors that help deliver our solutions and services. This includes providers and vendors that provide services including, but not limited to, IT support, data hosting, website development and operation, payment processing, and customer service.
- Business Partners: We may share your personal information with business partners to provide solutions or services requested, or with partners with whom we jointly offer products or services.
- Affiliates: We may share personal information with our affiliated corporate entities.
- Advertising and Marketing Partners: We may share your personal information with third-party advertising and marketing partners. These partners may use this information (along with similar data collected from other websites) to deliver targeted advertisements for Greenway on websites and digital properties within their network. This practice is commonly referred to as “interest-based advertising” or “online behavioral advertising.”
- Third Parties in Order to Comply with Law or Otherwise Protect Our Interest or Those of Others: We may access, preserve, and disclose any information we store associated with you to certain external parties if we, in good faith, believe it is necessary or appropriate to:
- Comply with legal requirements, law enforcement requests, or national security obligations.
- Respond to court orders, subpoenas, or legal processes.
- Protect our rights, property, safety, or those of others.
- Enforce our policies or contracts.
- Collect outstanding debts.
- Assist with investigations or legal proceedings.
- Third Parties in the Event of the Analysis of, or for Conducting a Merger, Sale, or Other Asset Transfer: If Greenway is involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, or sale or transfer of assets, your personal information may be sold or transferred as part of that transaction, to the extent permitted by law and contractual obligations.
Sharing Personal Information
Under the CCPA, the term “share” means the disclosure of personal information to a third party for cross-context behavioral advertising, whether for money or other valuable consideration.
Pursuant to the CCPA, Greenway Health has the right to sell or share your personal information, subject to your right to opt out of such sharing (as outlined below). Pursuant to CCPA, third parties that receive shared personal information are prohibited from reselling it unless you have received explicit notice and an opportunity to opt out of further sales.
We may share your personal information with the following category of third parties:
- Advertising and marketing partners
The personal information we share, or use for these purposes, may include any of the information types described in the “Information We Collect” section above.
Sale of Personal Information
Under the CCPA, the term “sale” means the disclosure of personal information in exchange for money or other valuable consideration.
Greenway Health has not had any unauthorized sales of personal information for any purpose.
How We Protect and Retain Your Information
We implement reasonable administrative, physical, and technical safeguards to protect your personal information from unauthorized access, disclosure, or misuse. Access to personal data is limited to personnel who need it for legitimate business purposes and are trained in privacy and security practices.
We retain your information only as long as necessary to:
- Provide services
- Comply with applicable laws and regulations
- Protect our legal interests or those of others
Our retention periods vary depending on the nature of the information and the purpose for which it was collected. These periods are determined based on factors such as legal requirements, business needs, and contractual obligations, and are outlined in our internal records retention policy.
Your Rights and Choices
The CCPA provides consumers (California residents) with specific rights regarding their personal and sensitive information. This section describes your CCPA rights and explains how to exercise them.
-
Right to Access Specific Information and Data Portability
You have the right to request that Greenway Health disclose certain information about our collection, use, and disclosure of your personal and sensitive information during the preceding 12 months. You also have the right to request that the specific pieces of personal information we collect be provided in a portable and readily usable format, to the extent technically feasible (“data portability").
- Depending on your request, and once we verify it (as described below), we may disclose to you:
- The categories of personal and sensitive information we collected about you.
- The categories of sources from which that information was collected.
- Our business or commercial purpose for collecting, using, or disclosing that information.
- The categories of third parties with whom we shared that information.
- The specific pieces of personal information we collected about you.
- If we sold your personal information: the categories of personal information we sold and the categories of third parties who received it.
- If we disclosed your personal information for a business purpose: the categories of personal information sold and the categories of third parties who received it.
- The planned retention period for each category of personal information, or the criteria used to determine that period.
-
Right to Request Deletion
You have the right to request that Greenway Health delete the personal information we have collected and retained about you, subject to certain exceptions. Once we receive and verify your request, we will delete (and direct our service providers to delete) your information unless an exception applies—in which case, we will notify you.
- We may deny your deletion request if retaining the information is necessary for us or our service providers to:
- Verify the request. If we cannot verify your identity or authority to make the request, we have the right to deny your request.
- Complete a transaction or provide a requested service, including fulfilling contractual obligations or taking actions reasonably anticipated within the context of our ongoing business relationship with you.
- Detect security incidents, protect against malicious or fraudulent activity, or prosecute those responsible for such activities.
- Debug products to identify and repair errors that impair existing intended functionality.
- Exercise free speech or ensure the right of another consumer to exercise their free speech rights, or exercise another legal right.
- Comply with legal obligations, including the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
- Engage in public or peer-reviewed research that adheres to applicable ethics and privacy laws, where deletion may render the research impossible or significantly impair its objectives, and if you previously provided informed consent.
- Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
- Make other internal and lawful uses of the information that are compatible with the context in which you provided it.
- Retain information as required under other laws or exemptions from the CCPA, such as records containing PHI under HIPAA.
We do not provide deletion rights for personal information defined as PHI under HIPAA that is controlled by our clients that are healthcare providers or other Covered Entities. If you have questions about such information, please contact your healthcare provider directly.
-
Right to Limit Use of Sensitive Personal Information
You have the right to request that we limit the use and disclosure of your sensitive personal information to those purposes that are reasonably necessary to provide the requested goods and services, or as otherwise permitted under applicable privacy laws.
Greenway Health only collects, uses, and discloses sensitive personal information in accordance with federal and state privacy laws, including:
- Performing reasonably expected services.
- Ensuring Greenway’s security and legal compliance.
- Conducting internal quality assurance.
We do not collect, use, or disclose sensitive personal information for purposes not permitted by relevant privacy laws.
For more information on how we handle sensitive personal information and your rights under applicable state laws, please review our State Privacy Law Notice.
-
Right to Correct Personal Information
You have the right to request correction of inaccurate personal information that we maintain about you. Once we receive a verified request, we will use commercially reasonable efforts to make the correction as required by law or explain why the request cannot be fulfilled.
-
Right to Opt-Out or Opt-In to Selling or Sharing
You have the right to direct Greenway to not sell or share your personal information, or to prohibit the use your personal information for “targeted advertising,” at any time (this is known as the “right to opt-out”).
We do not knowingly sell or share the personal information of individuals under the age of 16 without affirmative authorization:
- If the consumer is between 13 and 16 years old, we require direct opt-in consent from the consumer.
- If the consumer is under 13 years old, we require opt-in consent from a parent or guardian.
To exercise your opt-out rights, you or your authorized representative may submit a request to us through our Do Not Sell or Share My Personal Information link.
Once you make an opt-out request, we will wait at least 12 months before requesting reauthorization to sell or share your personal information. However, you may change your preferences and opt back in at any time.
We will only use personal information collected in connection with an opt-out request to process and comply with that request.
-
Right to Non-Discrimination
We will not discriminate or retaliate against you for exercising any of your rights under the CCPA. This means that, except as permitted by law, we will not:
- Deny you goods or services
- Charge you different prices or rates for goods or services, including through discounts, penalties, or other benefits
- Provide a different level or quality of goods or services
- Suggest that you may receive a different price or quality of service
- Retaliate against an employee, applicant for employment, or independent contractor for exercising their CCPA rights
However, we may offer financial incentives permitted under the CCPA that can result in different prices, rates, or service levels. Any such incentive program will be reasonably related to the value of your personal information and will include written terms that describe the material aspects of the program.
Participation in a financial incentive program is voluntary and requires your prior opt-in consent, which you may revoke at any time.
How to Submit a Request
To exercise any of your rights under the CCPA, you or your authorized representative may submit a request using any of the following methods:
Electronically: Consumer Privacy Request Form
Phone: 1-855-343-7202
Letter: Greenway Health
ATTN Privacy Officer
4301 W. Boy Scout Blvd, Suite 800
Tampa, FL 33607
Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. If submitting a request on behalf of your minor child, you must have the legal authority to act on their behalf.
You may only make a verifiable consumer request for access or data portability twice within a 12-month period.
To be considered a verifiable consumer request, the request must:
Provide sufficient information to allow us to reasonably verify your identity or the identity of the authorized representative making the request.
Describe the request with sufficient detail to enable us to properly understand, evaluate, and respond to it.
Authorized Agent
If an authorized agent makes a request on your behalf, we may:
- Require the authorized agent to provide proof of signed permission to act on your behalf.
- Require you to verify your identity directly with us.
- Request that you directly confirm to Greenway that you have authorized the agent to submit the request.
Response Timing and Format
For requests to access, delete, or correct personal information, we will endeavor to respond to a verifiable consumer request within forty-five (45) calendar days of its receipt. If we require more time (up to an additional 45 calendar days), we will notify you of the reason for the extension and the anticipated response date in writing.
For requests to opt out of the sale or sharing of personal information, or to limit the use of sensitive personal information, we endeavor to respond to a verifiable consumer request within fifteen (15) business days of receiving a verifiable consumer request.
Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable.
For data portability requests, we will select a format that is readily usable and should allow you to transmit the information from one entity to another without hindrance.
If we are unable to comply with a request, we will provide you with an explanation in our response.
Fees: We do not charge a fee to process or respond to verifiable consumer requests unless they are excessive, repetitive, or unfounded. If a fee is warranted, we will notify you of the reason and provide a cost estimate before proceeding.
Other California Privacy Rights
California’s “Shine the Light” law (Civil Code Section § 1798.83) permits users of our websites that are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes.
To make such a request, please use the contact methods outlined in the “How to Submit a Request” section of this document.
Third-Party Websites
Our website may provide, or third parties may provide, links to other websites or online resources. This notice applies solely to our website and online services. It does not apply to services offered by third parties, including websites and other online services to which our website may display links.
When you click on such links, you may be visiting websites or interactive services operated by third parties who have their own information collection practices. We do not control how these third parties collect, use, or disclose your information.
We recommend that you review the privacy policies of those third-party websites to understand their data practices before providing any personal information.
Changes to Our Privacy Notice
Greenway Health reserves the right to amend this notice at our discretion and at any time. Unless otherwise stated, any changes will become effective immediately upon posting of the revised notice. The “Date Last Updated” below indicates when the latest changes were made. You should review the page often to ensure you have the most up-to-date information.
Your continued use of our website and services following any changes constitutes your acceptance of the updated notice. We encourage you to review this notice periodically to stay informed about how we collect, use, and protect your information.
Contact Information
If you have any questions or comments about this notice, the ways in which Greenway Health collects and uses your information described below and in the Privacy Statement, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at:
Phone: 1-855-343-7202
Website: http://greenwayhealth.com
Web Form Link: https://www.greenwayhealth.com/consumer-privacy-request
Postal Address:
Greenway Health
Attn: Privacy Officer
4301 West Boy Scout Blvd, Suite 800
Tampa, Florida 33607
Privacy Notice for California Residents
Date Last Updated: May 2025
