1.Introduction
Pro1 Health ("Pro1", "we", "us", "our") provides healthcare business process and knowledge process outsourcing services to healthcare providers, payers, health plans and their partners. Our services include Revenue Cycle Management (RCM), Risk Adjustment Coding, Home Health Coding, Clinical Documentation Improvement (CDI), HEDIS abstraction and RADV audit support, together with related medical coding, billing, accounts receivable, denial management and audit services.
Privacy and information security are core to our business. We handle sensitive health and financial information on behalf of our clients every day, and we treat that responsibility as fundamental rather than incidental. This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, how long we retain it, and the rights available to you.
This Policy is designed to meet our obligations under:
- The Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the HITECH Act, and its implementing Privacy, Security and Breach Notification Rules;
- The California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA), and comparable US state privacy laws;
- India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025; and
- The EU General Data Protection Regulation (GDPR) and the UK GDPR and Data Protection Act 2018, where these apply to our activities.
Region-specific and law-specific disclosures are set out in the Annexes, which prevail over the main body of this Policy for the individuals and information they cover.
2.Scope of this Policy
This Policy applies to personal data we process as a controller (a "Data Fiduciary" under the DPDP Act; a "business" under the CCPA), including personal data collected through:
- Our website at https://pro1.health and its subdomains;
- Enquiry, "Get in Touch" and contact forms;
- Marketing activities, events, webinars and published content;
- Our recruitment and careers process;
- Administration of client, partner and supplier relationships; and
- Account administration and support for the portals and tools we make available to client contacts.
This Policy does not apply to protected health information or other client data that we process on our clients’ instructions when delivering our coding, billing, abstraction and audit services. Please see Section 3 and Annex A.
3.When we act as a Business Associate or processor, not a controller
The great majority of the health information we handle belongs to our clients. When you engage us for medical coding, revenue cycle management, risk adjustment, HEDIS abstraction, CDI or audit support, we access and process medical records, encounter and claims data, charts, eligibility and demographic records, remittance information and related documentation from your systems or from systems you direct us to use. This information routinely contains personal data and protected health information (PHI), including patient names, dates of birth, medical record numbers, member and subscriber identifiers, diagnoses, procedures, dates of service and financial account details.
In relation to that data:
- our client (or the covered entity it serves) acts as the covered entity, controller, Data Fiduciary or business, as applicable;
- Pro1 Health acts as a business associate (or subcontractor business associate), processor, Data Processor or service provider, as applicable;
- our processing is governed by the applicable client agreement, Business Associate Agreement (BAA) and, where relevant, Data Processing Addendum (DPA), rather than by this Privacy Policy; and
- we process such data only in accordance with the client’s documented instructions and the terms of the BAA, except where processing is required by applicable law.
If you are a patient, member, employee or contractor of one of our clients and you wish to exercise privacy rights over information held about you — for example to obtain a copy of your medical record, request an amendment, or receive an accounting of disclosures — please contact your healthcare provider or health plan directly. They are the covered entity responsible for responding. We will assist them as required by our Business Associate Agreement.
4.Who we are and who is responsible for your data
Pro1 Health operates through the following entities:
| Entity | Registered / principal offices | Typically the controller for |
|---|---|---|
| Pro1 Health, Inc. | 9442 North Capital of Texas Hwy, Plaza One, Suite 500, Austin, TX 78759, United States | Individuals and clients located in the United States and the Americas |
| Pro1 Health Systems Pvt Ltd | Tek Meadows, Tower B, 4th Floor, 51 Rajiv Gandhi Salai (OMR), Sholinganallur, Chennai 600119, India. Additional delivery centres: Tiliconveli Tech Park, Tirunelveli 627007; TIDEL Neo IT Park, Thanjavur 613005; TIDEL Neo IT Park, Thoothukudi 628002 | Individuals and clients located in India and the rest of the world |
Where you have entered into a contract with a specific Pro1 Health entity, that entity acts as the controller of your personal data.
Where you interact solely with our website, marketing activities or other pre-contractual services, the controller will generally be the Pro1 Health entity responsible for your region, as described above.
The Pro1 Health entities may share personal data with one another for the purposes described in this Privacy Policy, including service delivery, client support, sales, administration, security and compliance, as further described in Section 9.
Privacy contact: privacy@pro1.health
5.Personal data we collect
5.1 Website visitors
- Device and browser information (browser type and version, operating system, screen settings, language)
- IP address and approximate location derived from it (typically city or country level)
- Pages viewed, time on page, referring URL, exit pages and clickstream
- Cookie and similar identifiers, and your cookie preferences
- Security and abuse-prevention signals, such as request patterns, bot-detection signals and web application firewall (WAF) logs
5.2 Enquiries, proposal requests and prospective clients
When you contact us through our "Get in Touch" form or related channels, we may collect:
- First name and last name
- Work email address
- Company or organisation name
- The content of your message and any subsequent correspondence
- Job title, phone number and other business contact details where you provide them
- Records of meetings, calls and demonstrations, and notes made by our team
5.3 Client contacts, portal users and administrators
- Account and user profile details: name, business email, phone number, job title, organisation, role and permissions
- Authentication data: credentials, single sign-on identifiers, multi-factor authentication data, session and device information
- Usage and audit logs: sign-in records, actions taken in our coding production and quality platforms, configuration changes, feature usage
- Support and service data: tickets, chat transcripts, correspondence and call recordings where notified
- Billing and contract administration data: purchase orders, invoicing contacts, payment status
5.4 Client service delivery data and protected health information
When delivering coding, revenue cycle, abstraction and audit services, we access medical records, charts, encounter and claims data, eligibility and demographic records, remittance advice, denial correspondence and related documentation. This data contains personal data and, in the United States, PHI.
As explained in Section 3, we generally handle this as a business associate or processor on our client’s behalf, under a Business Associate Agreement or equivalent contract. This Privacy Policy does not govern that processing.
Where we process a limited subset of such data as a controller — for example to secure our own infrastructure, to maintain our own service and quality records, or to meet our own legal, audit and certification obligations — we do so as described in Section 7, and only to the extent permitted by our client agreements and applicable law.
5.4.1 De-identified data, quality analytics and technology improvement
We continuously improve the accuracy, productivity and quality-assurance capabilities of our coding production and performance-tracking platforms.
To do this, we may derive aggregated and de-identified datasets from coding output, audit findings and operational records across our client base — for example coding accuracy rates, denial and rework patterns, turnaround times, error taxonomies, auditor concordance and productivity benchmarks.
Before any such data is used for this purpose:
- Health information is de-identified in accordance with 45 CFR § 164.514(b), using either the Expert Determination method or the Safe Harbor method.
- Direct and indirect identifiers are removed or irreversibly transformed, including names, addresses, dates relating to an individual, medical record and member numbers, account numbers, device identifiers, biometric identifiers, IP addresses and client-identifying metadata.
- Data is aggregated so that it does not relate to, and cannot reasonably be used to identify, any individual, household or client.
- We apply technical and organisational measures to prevent re-identification, and we do not attempt to re-identify the data.
- We contractually prohibit our personnel and service providers from attempting re-identification.
- We do not use identifiable client content, identifiable personal data, protected health information, or any individual client’s data in isolation for the benefit of other clients.
Once data has been aggregated and de-identified to this standard it is no longer personal data or PHI, and this Policy does not apply to it. Our handling of client data for this purpose is also subject to the terms of the applicable Business Associate Agreement and client contract, which take precedence.
5.5 Job applicants
- Name, contact details and location
- CV/resume, cover letter, work history, education, qualifications and certifications (for example AAPC, AHIMA or BCHH-C credentials)
- Right-to-work and immigration status information
- Interview notes, assessment and coding test results
- References
- Background verification and screening results, including any healthcare exclusion-list checks required by our clients, where permitted by law and separately notified to you
- Diversity information, where you choose to provide it and where permitted by local law (provided voluntarily and used only in aggregate)
5.6 Partners, suppliers and other business contacts
- Business contact details, role and organisation
- Contract, procurement, due diligence and payment records
- Security, privacy and compliance assessment responses
5.7 Event, webinar and newsletter participants
- Registration information and attendance records
- Questions submitted during events and feedback
- Subscription preferences and engagement with our emails, including opens and clicks
5.8 Sensitive personal information
We do not intentionally collect special category data under Article 9 of the GDPR, or sensitive personal information, through our website or marketing activities.
Health information is central to the services we deliver, but we receive it in our capacity as a business associate or processor on behalf of our clients, as described in Section 3, and not for our own purposes.
Limited exceptions arise in recruitment and employment contexts, such as health information required for interview accommodations, and government-issued identifiers used for right-to-work verification and background screening.
Account credentials, government identifiers and health information, where collected, are treated as sensitive personal information under the CCPA. Please refer to Annex C for further details.
We do not use or disclose sensitive personal information for purposes other than those permitted under Section 7027(m) of the CCPA regulations.
6.How we collect personal data
- Directly from you: forms, email, calls, meetings, contracts, portal registration and job applications.
- Automatically: cookies, tags, server logs, platform telemetry and security monitoring. See Section 8.
- From third parties: our clients (where you are their personnel), their electronic health record, practice management and clearinghouse systems (where we are granted access to deliver services), channel and technology partners, referrers, publicly available sources, professional networks such as LinkedIn, business data enrichment providers, background screening vendors, and fraud and security intelligence providers.
7.Why we use personal data, and our legal bases
| # | Purpose | Data used | GDPR / UK GDPR legal basis (where applicable) | DPDP basis |
|---|---|---|---|---|
| 1 | Respond to enquiries, proposal requests and sales conversations | 5.2 | Steps at your request prior to entering a contract (Art. 6(1)(b)); legitimate interests in responding to business enquiries (Art. 6(1)(f)) | Consent, or legitimate use where you have voluntarily provided data for this purpose |
| 2 | Provide, administer and support our services and client portals | 5.3, 5.4 | Performance of a contract (Art. 6(1)(b)); legitimate interests where you are a contact of a corporate client (Art. 6(1)(f)) | Performance of a contract with your employer / consent |
| 3 | Service, security and administrative communications | 5.2, 5.3 | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) | Legitimate use |
| 4 | Marketing communications, events and content | 5.2, 5.7 | Consent (Art. 6(1)(a)) where required; otherwise legitimate interests in B2B marketing (Art. 6(1)(f)) | Consent |
| 5 | Website analytics, service improvement and personalisation | 5.1, 5.3 | Consent for non-essential cookies; legitimate interests for aggregate analysis (Art. 6(1)(f)) | Consent |
| 6 | Securing our own systems and facilities, preventing fraud and abuse, and investigating incidents | 5.1, 5.3, 5.4 | Legitimate interests in network and information security (Art. 6(1)(f), Recital 49); legal obligation (Art. 6(1)(c)) | Legitimate use — for security, prevention and detection of unlawful activity |
| 7 | Quality assurance, auditing coding accuracy, productivity monitoring and improving our platforms | Aggregated and de-identified datasets derived from 5.3 and 5.4 (see 5.4.1) | Legitimate interests (Art. 6(1)(f)) for the act of aggregating and de-identifying; once anonymised, the GDPR no longer applies to the resulting dataset | Legitimate use for the act of de-identification; the DPDP Act does not apply to the resulting non-personal dataset |
| 8 | Recruitment and hiring | 5.5 | Steps prior to entering a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)); consent for talent-pool retention; Art. 9(2)(b) where special category data is processed for employment law purposes | Legitimate use — employment purposes |
| 9 | Managing partner and supplier relationships | 5.6 | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) | Contract / legitimate use |
| 10 | Legal and regulatory compliance, audits, certifications (including HITRUST, SOC 2 and ISO 27001) and responding to lawful requests | All | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) | Compliance with law |
| 11 | Establishing, exercising or defending legal claims | All | Legitimate interests (Art. 6(1)(f)); legal claims exemption (Art. 9(2)(f)) | Compliance with law / enforcement of legal rights |
| 12 | Corporate transactions (merger, acquisition, financing, restructuring) | All | Legitimate interests (Art. 6(1)(f)) | Legitimate use |
Where we rely on legitimate interests, we have carried out a balancing assessment. You may request a summary of the relevant assessment using the contacts in Section 19.
Our use of protected health information is separately governed by HIPAA and by the Business Associate Agreement with the relevant covered entity. See Annex A.
We do not use your personal data for purposes materially different from those described here without first providing notice and, where required, obtaining your consent.
10.International transfers of personal data
We operate a global delivery model. As a result, personal data may be transferred to, stored in, or accessed from the United States, India and other countries in which our group companies or service providers operate.
Offshore access to US health information
Our delivery centres in Chennai, Tirunelveli, Thanjavur and Thoothukudi, India may access data originating from our United States clients, including protected health information, for the purpose of delivering contracted services. Such access takes place only where permitted by the applicable client agreement and Business Associate Agreement, and is subject to controls including restricted and monitored access environments, prohibition of removable media and local storage, access logging, personnel screening and confidentiality undertakings. Where a client requires onshore-only processing, we honour that requirement contractually and operationally.
From the EEA and the United Kingdom
Where we transfer personal data outside the EEA or the United Kingdom to a country that is not subject to an adequacy decision, we rely on appropriate safeguards, including:
- the European Commission’s Standard Contractual Clauses (SCCs) (Decision 2021/914) for EEA transfers;
- the UK International Data Transfer Addendum (UK Addendum) or the UK International Data Transfer Agreement (IDTA), as applicable, for transfers from the United Kingdom; and
- transfer impact assessments and, where appropriate, supplementary technical, organisational and contractual measures such as encryption, access controls and government-request transparency commitments.
From India
Transfers of personal data outside India are made in accordance with Section 16 of the DPDP Act and Rule 15 of the DPDP Rules, 2025, subject to any restrictions notified by the Central Government and to any sector-specific requirements applicable to our clients.
You may request information about the safeguards we rely upon by contacting us using the details provided in Section 19. Where appropriate, copies of the Standard Contractual Clauses may be redacted to protect confidential commercial information.
11.How long we keep personal data
We retain personal data only for as long as necessary to fulfil the purposes described in Section 7, after which it is securely deleted or irreversibly anonymised.
Our indicative retention periods are as follows:
| Data | Retention |
|---|---|
| Website enquiry and contact form submissions | 24 months from last interaction |
| Marketing contacts and subscriptions | Until you unsubscribe or withdraw your consent, after which we retain a suppression record indefinitely to honour your opt-out request |
| Client contract and account records | The duration of the contract plus seven (7) years for tax, audit and limitation period requirements |
| Protected health information and client service delivery data | As directed by the client in the applicable Business Associate Agreement or client contract. On termination we return or securely destroy PHI in accordance with 45 CFR § 164.504(e)(2)(ii)(J), except where return or destruction is infeasible, in which case protections continue to apply for as long as the information is retained |
| Platform usage and audit logs | 12 months, or as specified in the applicable client agreement. Certain logs may be retained for one year in accordance with Rule 6 of the DPDP Rules, 2025 |
| Security monitoring and incident records | 24 months, or longer where required for an ongoing investigation, legal claim or regulatory matter. HIPAA-required documentation is retained for six (6) years |
| Unsuccessful job applicants | 12 months, or longer where you have consented to inclusion in our talent pool |
| Supplier and partner records | The duration of the relationship plus seven (7) years |
| Cookie data | As described in our Cookie Policy |
Where we are legally required to retain personal data for a longer period, or where it is relevant to an actual or anticipated legal claim, regulatory investigation or audit, we will retain it for that extended period.
Client data processed under a Business Associate Agreement or Data Processing Addendum is retained and deleted in accordance with the terms of that agreement, which prevail over the table above.
12.How we protect personal data
We handle sensitive health and financial information, and our security programme is built accordingly. Our controls include:
- An information security management system certified to ISO/IEC 27001, with HITRUST e1 certification and SOC 2 Type 2 attestation.
- A HIPAA compliance programme covering the Privacy, Security and Breach Notification Rules, including documented administrative, physical and technical safeguards.
- Encryption of personal data in transit (TLS) and at rest.
- Role-based access control, least-privilege access, unique user identification and multi-factor authentication.
- Restricted and monitored delivery-floor environments, with controls on removable media, printing, personal devices and local storage.
- Network segmentation, endpoint protection, logging and continuous monitoring.
- Secure development practices, code review and dependency management.
- Regular vulnerability scanning, risk analysis and independent penetration testing.
- Vendor security due diligence, Business Associate Agreements and contractual security obligations.
- Documented incident response, disaster recovery and business continuity procedures.
- Personnel background screening (where lawful), healthcare exclusion-list checks, confidentiality obligations, and mandatory annual HIPAA, security and privacy training.
Although we implement robust security measures, no system can be guaranteed to be completely secure.
If we experience a personal data breach, we will notify the relevant clients, supervisory authorities and affected individuals where required by applicable law. This includes:
- reporting any use or disclosure of protected health information not permitted by the Business Associate Agreement, and any breach of unsecured PHI, to the affected covered entity without unreasonable delay and in accordance with 45 CFR § 164.410;
- notifying the Data Protection Board of India without undue delay, and affected Data Principals within the timeframes prescribed under the DPDP Rules, 2025;
- complying with applicable US federal and state data breach notification requirements; and
- notifying the competent supervisory authority within 72 hours where required under the GDPR and UK GDPR.
13.Your privacy rights
Depending on where you are located and the capacity in which we hold your data, you may have some or all of the following rights:
- Access: obtain confirmation of whether we process your personal data and a copy of it, together with information about the processing
- Rectification / correction: have inaccurate or incomplete data corrected or completed
- Erasure / deletion: have your personal data deleted in certain circumstances
- Restriction: restrict our processing in certain circumstances
- Portability: receive certain data in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible
- Objection: object to processing based on legitimate interests, and object at any time to direct marketing
- Withdraw consent: withdraw consent at any time, without affecting the lawfulness of processing before withdrawal
- Automated decision-making: not be subject to a decision based solely on automated processing that produces legal or similarly significant effects
- Opt out of sale, sharing and targeted advertising: and limit the use of sensitive personal information (US states)
- Non-discrimination: for exercising your rights
- Nominate: another individual to exercise your rights in the event of death or incapacity (India)
- Grievance redressal: (India)
- Complain: to a supervisory authority or regulator
These rights are not absolute and are subject to the conditions, limitations and exemptions set out in applicable law. Please refer to the relevant Annexes for region-specific information.
Important Note for Patients and Health Plan Members
If your request concerns health information held in a healthcare provider’s or health plan’s records that we process on their behalf, you must direct your request to that organisation. HIPAA rights of access and amendment are exercised against the covered entity, not against its business associates.
14.How to exercise your rights
You may submit a privacy rights request using any of the following methods:
- Email: privacy@pro1.health
- Web form: https://stakflo.io/data-subject-access-request
- Post: to the relevant entity address in Section 4
Verification
To protect your data, we will take reasonable steps to verify your identity before responding to a request. We may ask for information that allows us to match you with our records. Any information collected for verification purposes will be used solely for that purpose.
Authorised agents
You may appoint an authorised agent to submit a request on your behalf. We may require written authorisation from you and may separately verify your identity before processing the request.
Response timeframes
- California and other US states: we will acknowledge within 10 business days and respond within 45 calendar days, extendable by a further 45 days with notice.
- India: we will respond to rights requests within the periods prescribed under the DPDP Rules and will resolve grievances within a reasonable period not exceeding 90 days from receipt.
- EEA / UK: within one month of receipt, extendable by two further months for complex or numerous requests, in which case we will tell you within the first month.
Fees
Requests are free of charge. However, where permitted by applicable law, we may charge a reasonable fee or decline to act on a request that is manifestly unfounded, excessive or repetitive. Where this occurs, we will explain the reasons for our decision.
15.Children
Our website and services are directed at healthcare organisations and businesses, and are not intended for children.
We do not knowingly collect personal data directly from individuals under the age of 18 in India, or under 16 in the EEA/UK (or the lower age set by an EEA member state, no lower than 13), through our website, marketing or recruitment channels.
Where the records we process on behalf of a client relate to paediatric patients, we handle that information solely as a business associate or processor under the client’s instructions and the applicable Business Associate Agreement, and we do not use it for any purpose of our own.
Under the DPDP Act, where we act as a Data Fiduciary and process the personal data of a child (an individual under 18 in India) or a person with a disability who has a lawful guardian, we obtain verifiable consent from the parent or lawful guardian. We do not undertake tracking, behavioural monitoring or targeted advertising directed at children.
Under the CCPA, we do not sell or share the personal information of consumers whom we know to be under the age of 16.
If you believe that a child has provided us with personal data, please contact us at privacy@pro1.health, and we will take appropriate steps to delete the information.
16.Automated decision-making, profiling and technology
Our coding production and quality platforms use automated rules, validation logic and analytics to support code assignment, flag documentation gaps, route work, check compliance with coding guidelines, and measure accuracy and productivity. These systems operate on client data for the purpose of producing accurate coding and billing output, and all coding, audit and quality outcomes are subject to review by qualified, certified human coders and auditors.
We do not make decisions about individuals based solely on automated processing that produce legal effects or similarly significant effects concerning them. In particular, we do not use automated processing to determine any individual’s eligibility for care, coverage or benefits; those determinations are made by the healthcare provider or payer.
We do use limited profiling for legitimate business purposes, such as segmenting business contacts by industry or engagement with our content. You have the right to object to such profiling at any time, where permitted by applicable law.
Our workforce productivity and quality monitoring tools are used to measure the output of our own personnel in the course of their employment. Employee monitoring is governed by our internal employee privacy notice rather than by this Policy.
17.Third-party links and services
Our website may contain links to third-party websites and platforms, including LinkedIn, Facebook and Instagram. We are not responsible for the privacy practices, content or policies of those third parties. We encourage you to review their privacy policies before providing them with any personal data.
18.Changes to this Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal obligations or regulatory requirements. The latest version will always be published on this page, and the "Last updated" date will be revised accordingly.
Where changes are material, we will provide appropriate notice and, where required by applicable law, obtain your consent before the changes take effect.
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.
19.How to contact us
If you have any questions about this Privacy Policy or our privacy practices, please contact us using the details below:
| Contact | Details |
|---|---|
| General privacy enquiries | privacy@pro1.health |
| Privacy Officer / Data Protection Officer | dpo@pro1.health |
| HIPAA Privacy and Security Officer | hipaa@pro1.health |
| United States contact | Pro1 Health, Inc., 9442 North Capital of Texas Hwy, Plaza One, Suite 500, Austin, TX 78759 |
| India contact | Pro1 Health Systems Pvt Ltd, Tek Meadows, Tower B, 4th Floor, 51 Rajiv Gandhi Salai (OMR), Sholinganallur, Chennai 600119 |
| Security vulnerability reports | security@pro1.health |
Protected health information and HIPAA (United States)
This Annex explains how we handle protected health information (PHI) under the Health Insurance Portability and Accountability Act of 1996, as amended by the HITECH Act, and its implementing regulations at 45 CFR Parts 160 and 164.
A.1 Our role
Pro1 Health is not a covered entity. We act as a business associate to healthcare providers, health plans and healthcare clearinghouses, and as a subcontractor business associate to other business associates, when we perform coding, revenue cycle management, risk adjustment, abstraction, CDI and audit services that involve access to PHI.
We enter into a written Business Associate Agreement with each client before receiving PHI, and we flow down equivalent obligations to any subcontractor that may access PHI on our behalf.
A.2 Our obligations
Under HIPAA and our Business Associate Agreements, we:
- use and disclose PHI only as permitted by the Business Associate Agreement or as required by law;
- apply the minimum necessary standard to our requests for, uses of and disclosures of PHI;
- implement the administrative, physical and technical safeguards required by the HIPAA Security Rule (45 CFR §§ 164.308, 164.310, 164.312) and maintain the required documentation;
- do not use or disclose PHI for marketing, fundraising or sale, and do not use PHI for our own commercial purposes;
- report any use or disclosure not permitted by the agreement, any security incident, and any breach of unsecured PHI to the affected covered entity in accordance with 45 CFR § 164.410;
- make PHI available to the covered entity as necessary to allow it to satisfy an individual’s right of access (§ 164.524), amendment (§ 164.526) and accounting of disclosures (§ 164.528);
- make our internal practices, books and records available to the Secretary of the US Department of Health and Human Services for determining compliance; and
- return or destroy PHI on termination of the agreement where feasible, and otherwise extend protections for as long as we retain it.
A.3 Your rights over your health information
If you are a patient or health plan member, your HIPAA rights — including the right to access your records, request corrections, request restrictions on use and disclosure, request confidential communications, and receive an accounting of disclosures — are exercised against the healthcare provider or health plan that holds your records, not against Pro1 Health.
Please contact that organisation directly. Its Notice of Privacy Practices will explain how to submit a request. If you contact us instead, we will not be able to act on the request, but we will refer it to the relevant client where we can identify them.
You may also file a complaint with the US Department of Health and Human Services, Office for Civil Rights, at www.hhs.gov/ocr/complaints.
A.4 De-identified information
Health information that has been de-identified in accordance with 45 CFR § 164.514(b) is not PHI and is not subject to HIPAA. Our use of de-identified and aggregated information is described in Section 5.4.1 and is further limited by our client agreements.
A.5 Offshore access
As described in Section 10, our India-based delivery centres may access PHI to deliver contracted services, where the applicable client agreement and Business Associate Agreement permit it. All personnel with such access are subject to background screening, confidentiality undertakings, HIPAA training and controlled-access working environments. Clients requiring onshore-only processing may elect that arrangement contractually.
A.6 State health privacy laws
Where applicable, we also support our clients’ compliance with state health information privacy laws, including the California Confidentiality of Medical Information Act (CMIA), 42 CFR Part 2 for substance use disorder records where a client so notifies us, and state genetic and reproductive health privacy laws. Our obligations in these areas are set out in the applicable client agreement.
Additional information for individuals in the EEA and the United Kingdom
This Annex applies where the GDPR or UK GDPR applies to our processing — for example where we market to, correspond with, or recruit individuals located in the EEA or the United Kingdom.
B.1 Controller
The controller is the relevant Pro1 Health entity identified in Section 4. We do not currently maintain an establishment in the EEA or the United Kingdom. Where the GDPR or UK GDPR applies to us on an extraterritorial basis under Article 3(2), we will appoint a representative where required by Article 27 and will publish those details here.
B.2 Your rights in detail
You have the rights listed in Section 13. In addition:
- Right to object to direct marketing: is absolute. If you object, we will stop.
- Right to object to processing based on legitimate interests: we will stop unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is for legal claims.
- Right to lodge a complaint: you may complain to your local supervisory authority. In the UK this is the Information Commissioner’s Office (ICO), www.ico.org.uk, helpline 0303 123 1113. Within the EEA, a list of supervisory authorities is maintained by the European Data Protection Board. We would, however, appreciate the opportunity to address your concerns before you contact a supervisory authority.
B.3 Provision of data
Where we require your personal data to enter into or perform a contract with you, or to comply with a legal obligation, providing that data is mandatory. Failure to provide it may prevent us from delivering the relevant services.
Where we rely on your consent or our legitimate interests, providing your personal data is voluntary. We will inform you of the applicable legal basis at the point of collection.
B.4 International transfers
Please refer to Section 10 for information about international transfers of personal data.
Additional information for residents of California and other US states
This Annex supplements the main Policy for residents of California under the CCPA, and — where applicable — residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Tennessee, Indiana, Kentucky, Rhode Island and other states with comprehensive privacy laws in force. It also serves as our Notice at Collection.
C.1 Information exempt from these laws
The CCPA and comparable state privacy laws do not apply to protected health information collected by a covered entity or business associate governed by HIPAA, to medical information governed by the California Confidentiality of Medical Information Act, or to information used only in an employment or business-to-business context in states that retain those exemptions.
Because most of the health information we handle is PHI processed under a Business Associate Agreement, it falls outside the scope of this Annex. The table below therefore describes the personal information we collect and control in our own right — principally from website visitors, business contacts and job applicants.
C.2 Categories of personal information collected in the past 12 months
| CCPA category | Collected | Examples | Sources | Business purpose | Disclosed to |
|---|---|---|---|---|---|
| A. Identifiers | Yes | Name, work email, postal address, phone, IP address, account identifiers, cookie IDs | You; automatically; third parties | Sales, service delivery, support, marketing, security | Group companies; service providers; advisers |
| B. Customer records (Cal. Civ. Code §1798.80) | Yes | Name, contact details, employment information, financial account information for billing | You; clients | Contract administration, billing | Group companies; service providers; payment providers |
| C. Protected classifications | Limited | Only where voluntarily provided in recruitment, and where lawful | You | Equal opportunity monitoring | Retained internally; aggregated only |
| D. Commercial information | Yes | Services purchased or considered, contract history | You; clients | Contract administration, account management | Group companies; service providers |
| E. Biometric information | No | — | — | — | — |
| F. Internet or network activity | Yes | Browsing on our site, interactions with content and emails, platform usage logs | Automatically | Analytics, service improvement, security | Group companies; analytics providers (as service providers) |
| G. Geolocation data | Yes (approximate) | City / country inferred from IP | Automatically | Localisation, security, analytics | Group companies; service providers |
| H. Sensory data | Limited | Call and meeting recordings where notified and consented | You | Training, quality, record-keeping | Group companies; service providers |
| I. Professional or employment information | Yes | Job title, employer, work history, CV, coding certifications, references, screening results | You; third parties | Sales, recruitment | Group companies; recruitment vendors |
| J. Education information | Yes (applicants) | Degrees, certifications | You; verification vendors | Recruitment | Group companies; screening vendors |
| K. Inferences | Yes | Preferences, likely interest in services, segmentation | Derived | Marketing, service improvement | Group companies; marketing providers |
| L. Sensitive personal information | Yes (limited) | Account log-in credentials; government identifiers and immigration status in recruitment; health information provided for workplace accommodation | You | Account security; legal compliance; employment | Group companies; service providers |
Retention: see Section 11.
C.3 Sale and sharing
We do not sell personal information, and we have not sold personal information in the preceding 12 months. We do not sell personal information in exchange for monetary or other valuable consideration.
We do not share personal information for cross-context behavioural advertising, and we have not done so in the preceding 12 months. We do not place third-party advertising pixels or tags on our site, and we do not disclose personal information to advertising networks, data brokers or ad-tech intermediaries.
Because we neither sell nor share personal information, no "Do Not Sell or Share My Personal Information" link is required on our site. We nonetheless honour Global Privacy Control (GPC) signals in respect of non-essential cookies.
We do not sell or share the personal information of consumers we know to be under 16 years of age.
Disclosures we make to our service providers and contractors — such as cloud hosting, analytics, CRM and support providers, as listed in Section 9 — are made for the business purposes described in Section 7 under written contracts that prohibit those providers from retaining, using or disclosing the personal information for any other purpose. Under the CCPA, these disclosures are not sales or shares.
C.4 Your California rights
- Right to know: the categories and specific pieces of personal information we collected, the sources, purposes, and the categories of third parties to whom we disclosed it (covering the preceding 12 months, and beyond 12 months on request unless it would be impossible or involve disproportionate effort)
- Right to delete: personal information, subject to statutory exceptions
- Right to correct: inaccurate personal information
- Right to opt out: of the sale or sharing of personal information
- Right to limit: the use and disclosure of sensitive personal information
- Right to non-discrimination: we will not deny goods or services, charge different prices, or provide a different level of quality because you exercised your rights
- Right to use an authorised agent
C.5 Rights under other US state laws
Residents of certain other states additionally have the right to opt out of targeted advertising and of profiling in furtherance of decisions producing legal or similarly significant effects. As explained in C.3 and Section 16, we do not engage in targeted advertising, and we do not carry out profiling that produces legal or similarly significant effects concerning you, so there is currently nothing to opt out of. We will update this Annex if that changes.
Residents of those states also have the right to appeal a refusal of a rights request. To appeal, reply to our decision or contact privacy@pro1.health with "Privacy Appeal" in the subject line. We will respond within 45 days (60 days in some states). If your appeal is denied, you may contact your state Attorney General.
Where a state law requires a data protection assessment for certain processing activities, we conduct and document those assessments as required.
C.6 How to submit a request
See Section 14. We provide at least two designated methods: email and web form.
C.7 Shine the Light
California residents may request information about disclosures of personal information to third parties for their direct marketing purposes. We do not make such disclosures.
Additional information for Data Principals in India
This Annex applies to individuals whose personal data is processed under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.
D.1 Our role
Pro1 Health Systems Pvt Ltd acts as a Data Fiduciary for the personal data described in Section 5 for which it determines the purpose and means of processing — principally data relating to job applicants, employees, business contacts and website visitors. Where we process personal data on the instructions of a client, we act as a Data Processor — see Section 3.
D.2 Notice and consent
Where we rely on your consent, we provide a clear, standalone notice in plain language, available in English and in the languages specified in the Eighth Schedule to the Constitution of India on request, setting out:
- the personal data being collected and the specific purpose of processing;
- the goods, services or uses enabled by that processing;
- how you may withdraw consent, with the same ease as giving it;
- how you may exercise your rights; and
- how you may make a complaint to the Data Protection Board of India.
Your consent is free, specific, informed, unconditional and unambiguous, given by clear affirmative action, and limited to the personal data necessary for the stated purpose.
Withdrawing consent is as easy as giving it, and can be done at privacy@pro1.health. Withdrawal does not affect the lawfulness of processing before withdrawal. Following withdrawal, we will cease processing and cause our Data Processors to do the same, unless retention is required by law.
D.3 Legitimate uses
Where applicable, we process personal data for "legitimate uses" under Section 7 of the DPDP Act without consent, including where you have voluntarily provided data for a specified purpose, for employment purposes, for compliance with law, and to respond to a medical emergency or threat to public health or safety.
D.4 Your rights as a Data Principal
- Right to access: information about the personal data we process, a summary of processing activities, and the identities of other Data Fiduciaries and Data Processors with whom it has been shared
- Right to correction, completion, updating and erasure: of your personal data
- Right to grievance redressal: you must first raise a grievance with us before approaching the Data Protection Board
- Right to nominate: one or more individuals to exercise your rights in the event of your death or incapacity
- Right to withdraw consent: at any time
D.5 Grievance redressal
| Contact | Details |
|---|---|
| dpo@pro1.health | |
| Address | Pro1 Health Systems Pvt Ltd, Tek Meadows, Tower B, 4th Floor, 51 Rajiv Gandhi Salai (OMR), Sholinganallur, Chennai 600119, India |
We will acknowledge your grievance, issue a tracking reference, and respond within a reasonable period not exceeding 90 days from receipt. If you are not satisfied with our response, or do not receive a response within that period, you may make a complaint to the Data Protection Board of India.
D.6 Your duties as a Data Principal
The DPDP Act places duties on Data Principals, including to comply with applicable law when exercising rights, not to impersonate another person, not to suppress material information when providing personal data for a document or identifier, not to register a false or frivolous grievance or complaint, and to furnish only authentic information when seeking correction or erasure. Breach of these duties may attract a penalty of up to ₹10,000.
D.7 Children and persons with disabilities
We do not process the personal data of children (individuals under 18 in India) as a Data Fiduciary without verifiable consent from a parent or lawful guardian, and we do not undertake tracking, behavioural monitoring of children, or targeted advertising directed at children.
D.8 Data breaches
In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals in accordance with Rule 7 of the DPDP Rules, 2025, including notification to affected Data Principals within 72 hours.
D.9 Cross-border transfers
Please refer to Section 10 for information about cross-border transfers of personal data.