01Scope and our role
This Privacy Policy explains how OptimNav (“OptimNav,” “we,” “us” or “our”) handles personal information in connection with this website (the “Site”) and the OptimNav platform (the “Services”). Our role depends on whose information it is.
Where we decide how information is used
For information about Site visitors, prospective customers, business contacts and the Authorized Users who log in to the Services, OptimNav decides how and why the information is used. This policy describes those practices.
Where we act for our customers
When we provide the Services, we process information, including patients’ protected health information (“PHI”), on behalf of our customers: 340B covered entities, hospitals, health systems and their representatives. For that information, OptimNav is a business associate under the Health Insurance Portability and Accountability Act (“HIPAA”) and a service provider or processor under state privacy laws. Our customer’s own privacy notices, including its HIPAA Notice of Privacy Practices, govern that information. Our handling of it is governed by our agreements with the customer, including a Business Associate Agreement (“BAA”). Section 6 summarizes our commitments.
This policy does not cover third-party websites or services that the Site links to.
02Information we collect
Information you give us
- Contact and business details, such as your name, work email, phone number, job title and organization, when you contact us, request a demo, attend an event or correspond with us.
- Account information for Authorized Users, such as name, work email, role, organization, login credentials, multi-factor authentication settings and preferences.
- Support and feedback, including the content of messages and support requests. Please do not include PHI in general email or Site communications.
- Billing contacts and related records for customer organizations.
Information collected automatically
- Site logs. When you visit the Site, our hosting and security providers record technical information such as IP address, browser and device type, operating system, referring page, pages requested and the date and time, to deliver the Site, keep it secure and prevent abuse.
- Service activity. In the Services, we record activity such as sign-ins, actions taken, approvals, corrections and the agent’s own activity, to provide audit trails, security monitoring and support.
Information from others
- Customer organizations that create accounts for their Authorized Users.
- Business partners, such as 340B consultants and administrators, who introduce us to their clients.
- Publicly available professional sources, such as company websites and professional profiles, used for business development.
04How we use information
We use the personal information described in Sections 2 and 3 to:
- Provide, operate and maintain the Site and the Services, including authenticating users and managing accounts.
- Respond to inquiries, provide support and send service, security and administrative messages.
- Protect the Site, the Services, our customers and individuals, including by detecting and investigating fraud, abuse and security incidents and by maintaining audit logs.
- Understand and improve how the Site and the Services perform, using usage information and feedback. We do not use PHI for this purpose except as the BAA permits.
- Send business contacts information about OptimNav that may interest them. You can opt out at any time.
- Comply with law, respond to lawful requests, enforce our agreements and protect our rights.
- Carry out other purposes we describe to you when we collect the information, or with your consent.
05How we disclose information
- Service providers and subprocessors, including cloud hosting, AI model, email, support and security providers, who process information for us under contracts that limit their use of it. Any provider that handles PHI must sign a business associate agreement.
- Customer organizations, which can see information about the Authorized Users and activity in their own accounts.
- Professional advisors, such as lawyers, auditors and insurers, under duties of confidentiality.
- Legal and safety reasons, when we believe disclosure is required by law, subpoena, court order or a lawful government request, including from the Department of Health and Human Services, or is needed to protect the rights, property or safety of OptimNav, our customers or others.
- Business transfers, in connection with a merger, acquisition, financing, reorganization or sale of assets. Any PHI remains subject to HIPAA and the applicable BAA.
- With your consent or at your direction.
We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done either in the past 12 months.
06Patient information and PHI
The Services read patient records in our customers’ systems to find referral documentation, match prescriptions and contract pharmacy claims to referrals, check them against the customer’s written 340B policies, and build evidence documentation. When we handle PHI for a customer, we commit to the following:
- Purpose. We use and disclose PHI only to provide the Services to that customer, as the BAA permits, and as required by law.
- Minimum necessary. We design the Services to access only the information needed for the task and to honor the access limits each customer sets.
- No sale and no marketing. We never sell PHI and never use it for marketing or advertising.
- No training for others. We do not use a customer’s PHI to train or fine-tune AI models made available to other customers unless that customer authorizes it in writing and HIPAA permits it. Third-party AI model providers we use are bound by business associate agreements and are not permitted to use customer data to train their models.
- De-identification. We de-identify PHI only where the BAA permits it, and only using the methods HIPAA requires.
- Heightened protections. We handle substance use disorder records protected by 42 C.F.R. Part 2, and other information with heightened protection under federal or state law, as those laws and our customer’s instructions require.
- Breach notification. We notify our customers of breaches of unsecured PHI as the BAA and HIPAA require. Our customers are responsible for notifying affected individuals.
If you are a patient
Your healthcare provider controls your health information and decides how it is used. To access, correct or request an accounting of disclosures of your health information, or to ask about its use, please contact your provider directly. If you contact us, we will direct you to your provider and assist them in responding, as our agreements require.
07AI and automated processing
OptimNav uses artificial intelligence, including large language models, and automation to review records, recognize referrals written in plain language, match them to claims and assign confidence scores. These results are recommendations for our customer’s staff:
- Cases below the customer’s review threshold are routed to a person, and customers keep human review over determinations.
- Each conclusion is linked to the records it relied on, and the agent’s activity is logged.
- The Services do not make decisions about a patient’s care, insurance coverage, eligibility for benefits, employment or any other matter that produces legal or similarly significant effects for an individual. They support the customer’s administration of its 340B program and do not affect the care a patient receives.
08Security
We maintain administrative, technical and physical safeguards designed to protect personal information and PHI, consistent with the HIPAA Security Rule. They include encryption in transit and at rest, role-based and least-privilege access, multi-factor authentication for workforce access to production systems, logging and monitoring, vulnerability management, workforce training, vendor risk review and incident response procedures.
No system is perfectly secure, and we cannot guarantee the security of information. If you believe you have found a security vulnerability, please report it to security@optimnav.com.
09Retention
- Business contact information is kept for as long as it is useful for the relationship or until you ask us to delete it, unless we must keep it longer.
- Site logs are kept for a limited period for security and troubleshooting.
- Authorized User account information and activity logs are kept for the duration of the customer relationship and afterward for as long as needed for security, audit and legal purposes.
- Customer data, including PHI, is retained, returned or destroyed as set out in the customer’s agreement and BAA.
We may keep information longer where the law requires it, or to resolve disputes or enforce our agreements.
10Your privacy rights
Depending on where you live, including California, Colorado, Connecticut, Virginia, Texas, Oregon and other states with consumer privacy laws, you may have the right to:
- Know what personal information we hold about you and obtain a copy of it.
- Correct inaccurate personal information.
- Delete personal information.
- Opt out of the sale or sharing of personal information, targeted advertising and certain profiling. We do not engage in these activities.
- Limit the use of sensitive personal information. We use it only to provide the Services and keep accounts secure.
- Appeal our decision on your request.
To make a request, email privacy@optimnav.com with the subject “Privacy request.” We will verify your identity before acting, which may require you to confirm information we already hold. You may use an authorized agent, and we may ask for proof of the agent’s authority. We respond within the time the law requires. To appeal a decision, reply to our response with the subject “Appeal.” We will not discriminate against you for exercising your rights.
Information we process on behalf of a customer, including PHI governed by HIPAA, is generally handled through that customer. If you send us a request about that information, we will forward it to the customer and assist them in responding.
Marketing. You can unsubscribe from marketing emails using the link in any message or by writing to us. We will still send service and security messages to Authorized Users.
Browser signals. We honor Global Privacy Control signals as a request to opt out of the sale or sharing of personal information where the law requires it. There is no common standard for “Do Not Track” signals, so we do not respond to them.
11Notice to California residents
This notice supplements this policy for California residents under the California Consumer Privacy Act, as amended. In the past 12 months we have collected the following categories of personal information, from the sources described in Section 2, for the purposes described in Section 4, and disclosed them for business purposes to the recipients described in Section 5. We keep each category for the periods described in Section 9.
| Category | Examples | Disclosed to |
|---|---|---|
| Identifiers | Name, work email, phone number, IP address, account username | Service providers, customer organizations, advisors, as required by law |
| Professional information | Job title, organization, role | Service providers, customer organizations |
| Internet or network activity | Site logs, Service activity and audit logs | Service providers, customer organizations |
| Commercial information | Products and services purchased, billing contacts | Service providers, advisors |
| Sensitive personal information | Account login credentials | Service providers, used only to provide access and security |
We do not sell or share personal information, we do not use sensitive personal information to infer characteristics about anyone, and we do not knowingly sell or share the personal information of consumers under 16. Medical information and PHI governed by HIPAA or the California Confidentiality of Medical Information Act are handled under those laws and our customer agreements rather than this notice.
12Children
The Site and the Services are intended for healthcare organizations and their personnel, not for children. We do not knowingly collect personal information from children under 16 through the Site. Customer records processed in the Services may include information about patients who are minors. We handle that information on our customer’s behalf under HIPAA and the applicable BAA.
13Where we process information
OptimNav is based in the United States, and the Site and the Services are intended for use in the United States. We store and process information in the United States. Customer data, including PHI, is stored and processed in the United States unless the customer agrees otherwise in writing.
14Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated policy on this page and change the “Last updated” date. If we make material changes, we will provide notice by posting it prominently on the Site or by email before the changes take effect.
15Contact us
Questions or requests about this policy can be sent to OptimNav at:
- Privacy questions and requestsprivacy@optimnav.com
- Security and vulnerability reportssecurity@optimnav.com
- Legal and noticeslegal@optimnav.com