Loading...
Loading...
Legal
Last updated: February 2026
Procure Healthcare ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our website and services.
We use collected information to:
When Procure Healthcare provides services to group health plans, health insurance issuers, or other HIPAA covered entities that involve access to Protected Health Information (PHI), we act as a "Business Associate" as defined under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations.
Before we receive, access, maintain, or transmit any PHI on behalf of a covered entity, we will enter into a Business Associate Agreement (BAA) that complies with 45 CFR § 164.504(e). We will not request or accept PHI until a BAA is fully executed.
When acting as a Business Associate, we will only use or disclose PHI:
We apply the "minimum necessary" standard when using or disclosing PHI, limiting our use to the minimum amount needed to accomplish the intended purpose.
We implement administrative, physical, and technical safeguards including:
We require any subcontractors that create, receive, maintain, or transmit PHI on our behalf to agree to the same restrictions and conditions that apply to us as a Business Associate, including entering into appropriate Business Associate Agreements.
In the event of a breach of unsecured PHI, we will notify the applicable covered entity without unreasonable delay, and in no case later than 60 days after discovery of the breach, as required by the HIPAA Breach Notification Rule (45 CFR §§ 164.400-414). Our notification will include the information required under 45 CFR § 164.410.
HIPAA provides individuals with certain rights regarding their PHI. When we receive requests related to these rights, we will assist the covered entity in responding as required by our BAA. These rights include:
Where possible, we design our analyses to use de-identified data that does not constitute PHI under HIPAA. Data is considered de-identified when it meets the requirements of 45 CFR § 164.514(b), either through expert determination or safe harbor methods.
For questions or concerns regarding our HIPAA compliance practices, or to exercise rights related to PHI, please contact us.
For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable local data protection laws.
We process your personal data on the following legal bases:
If you are in the EEA, UK, or Switzerland, you have the following rights:
To exercise these rights, please contact us. We will respond to your request within one month, as required by law.
Your personal data may be transferred to and processed in countries outside the EEA, including the United States. When we transfer data outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, or transfers to countries with an adequacy decision.
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. When determining retention periods, we consider the amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, and applicable legal requirements.
If you are in the EEA or UK, you have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not complied with applicable data protection laws.
For questions or concerns regarding our GDPR compliance or to exercise your data protection rights, please contact us.
We use cookies and similar tracking technologies to collect information about your browsing activities and to distinguish you from other users of our website.
When you first visit our website, we will ask for your consent before placing non-essential cookies. You can change your cookie preferences at any time by clearing your browser cookies and revisiting the site, or by adjusting your browser settings to block or delete cookies.
Please note that blocking certain cookies may impact your experience on our website and limit the services we can provide.
Some browsers include a "Do Not Track" (DNT) feature. We currently do not respond to DNT signals, but we do respect cookie consent preferences as described above.
We do not sell your personal information. We may share information with:
We retain your information for as long as necessary to provide our Services and fulfill the purposes described in this Policy, unless a longer retention period is required by law.
Depending on your location, you may have rights to:
To exercise these rights, please contact us. See also Section 5 above for specific rights under GDPR.
We implement appropriate technical and organizational measures to protect your information. However, no method of transmission over the Internet or electronic storage is completely secure.
Our Services may contain links to third-party websites. We are not responsible for the privacy practices of these websites.
Our Services are not directed to individuals under 18. We do not knowingly collect personal information from children.
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated Policy on our website with a new "Last updated" date.
For questions about this Privacy Policy or our data practices, please contact us.