eClinicalWorks Privacy Policy

eClinicalWorks · agreement dated January 1, 2023 · Official agreement

Read the agreement

26 of 138 cards in Sharing & Disclosure

Sharing & Disclosure · Permission or license

Information may be used when exploring or completing a business transaction

If eCW is exploring or goes through a business transition or financial transaction, such as a merger, acquisition, divestiture, restructuring, reorganisation, dissolution, bankruptcy, securities offering or sale of all or part of its assets, it may use the reader’s information in connection with exploring or concluding the transaction.

Supporting quotations

In the event of a business transaction. If we are exploring or go through a business transition or financial transaction, such as a merger, acquisition, divestiture, restructuring, reorganization, dissolution, bankruptcy, securities offering, or sale of all or a portion of our assets, we may use your information in connection with exploring or concluding such transaction.

Qualifications & exceptions

  • The stated permission covers both exploring a transaction and concluding one.
  • The list of transaction types is illustrative rather than exhaustive.

Not stated here

  • What happens to the information after a completed transfer, including any notice to users, is not addressed here.

Sharing & Disclosure · Permission or license

eCW discloses Personal Information to third parties at the reader’s request

The first listed disclosure reason is disclosure at the reader’s request, direction or authorization. The example given is a reader directing eCW to disclose Personal Information to a third-party entity, whether an eCW business partner or another third party, so that the reader can use that third party’s service, in which case eCW says it will share the information.

Supporting quotations

7.1.1. At Your Request: eCW may disclose Personal Information to third parties at your request, direction, or authorization. For example, if you direct eCW to disclose your Personal Information to a third-party entity, whether an eCW business partner or other third party to use the third party's service, we will share your information with the third party.

Qualifications & exceptions

  • Conditioned on the reader’s request, direction or authorization.

Not stated here

  • Whether the third party’s own use is limited by contract is not addressed here.

Sharing & Disclosure · Company practice

Personal Information may be shared with affiliates, including Healow, without authorization

eCW may disclose Personal Information to its affiliates, described as parents, entities under common ownership and subsidiaries such as Healow, LLC, and to other related companies without authorization.

Supporting quotations

7.1.2. Internal Sharing: eCW may disclose Personal Information to its affiliates (including parents, entities under common ownership, and subsidiaries, such as Healow, LLC), and other related companies without authorization.

Qualifications & exceptions

  • The section states that affiliate sharing occurs without authorization, in contrast to the preceding at-your-request reason.
  • Affiliates are illustrated by Healow, LLC.

Not stated here

  • The policy does not describe what the affiliates do with the information after disclosure.

Sharing & Disclosure · Company practice

Service providers receive Personal Information to operate and improve the business

eCW may disclose Personal Information to service providers for the purposes of operating its business, delivering, improving and customizing its products or services, sending marketing and communications related to its business, payment processing, and other legitimate purposes permitted by applicable law. Marketing communications appear here as a purpose for which data reaches service providers.

Supporting quotations

7.1.3. With Our Service Providers: eCW may disclose Personal Information to service providers for the purposes of operating our business, delivering, improving, and customizing our products or services, sending marketing and communications related to our business, payment processing, and for other legitimate purposes permitted by applicable law.

Qualifications & exceptions

  • The final purpose is open-ended (“other legitimate purposes permitted by applicable law”).

Not stated here

  • The policy does not name the service providers or the contractual limits placed on them.

Sharing & Disclosure · Company practice

Customers receive Personal Information, including Sensitive Personal Information, per Customer Documents

eCW may disclose Personal Information, including Sensitive Personal Information, to its customers consistent with the Customer Documents. The disclosure to Provider customers is therefore bounded by the Customer Documents rather than by this policy alone.

Supporting quotations

eCW may disclose Personal Information, including Sensitive Personal Information, to its customers consistent with the Customer Documents.

Qualifications & exceptions

  • The disclosure is expressly conditioned on the Customer Documents.

Not stated here

  • What the Customer Documents require for these disclosures is not reproduced.

Sharing & Disclosure · Permission or license

Personal Information may be transferred to a third party in a sale, merger or transfer

If eCW sells all or part of its business, makes a sale or transfer of assets, or is otherwise involved in a merger or business transfer, it may transfer Personal Information to a third party as part of that transaction.

Supporting quotations

7.1.6. Business Transaction: If eCW sells all or part of its business or makes a sale or transfer of assets or is otherwise involved in a merger or business transfer, eCW may transfer your Personal Information to a third party as part of that transaction.

Qualifications & exceptions

  • Triggered by a sale or transfer of the business or assets, or a merger or business transfer.

Not stated here

  • Whether the recipient must honour the same commitments after transfer is not stated here.

Sharing & Disclosure · Permission or license

eCW disclaims traditional sale but shares data with advertising and marketing partners

eCW says it does not generally sell Personal Information as “sell” is traditionally understood, meaning an exchange of a good or service in return for money, but that it may disclose certain Personal Information to advertising and marketing partners, generally though not exclusively in hashed or pseudonymized form, to support its marketing activities and to offer services it believes may interest the reader.

Supporting quotations

7.1.7. Sell or Sharing of Data: eCW does not generally sell your Personal Information as the term "sell" is traditionally understood (i.e., an exchange of a good or service in return for money). However, we may disclose certain Personal Information to advertising and marketing partners generally but not exclusively in hashed or pseudonymized form. We do so in order to support our marketing activities and to provide you with offers of services that we believe you may be interested in.

Qualifications & exceptions

  • The no-sale statement is qualified by “generally” and tied to a money-for-data understanding of sale.
  • Hashed or pseudonymized form applies generally but not exclusively.

Not stated here

  • Which marketing partners receive the data is not identified in this paragraph.

Sharing & Disclosure · Restriction or exception

Text messaging originator opt-in data and consent are not shared with third parties

Notwithstanding the preceding disclosure reasons, eCW states that text messaging originator opt-in data and consent will not be shared with third parties.

Supporting quotations

7.1.8 Text Messaging Originator Opt-In Data and Consent. Notwithstanding the foregoing, text messaging originator opt-in data and consent will not be shared with third parties.

Qualifications & exceptions

  • Stated as an override of the disclosure reasons that precede it.
  • The limitation covers opt-in data and consent, not message content generally.

Not stated here

  • Which messaging programmes the clause covers is not identified.

Sharing & Disclosure · Company practice

Third-party advertisers may collect Site data to measure and personalize ads

eCW may enter into relationships with third-party advertising companies to drive traffic to and serve ads on its Site. Those companies may also collect information through the Data Collection Technologies described in Section 6 to measure the effectiveness of their ads and to personalize advertising content. eCW points to the Network Advertising Initiative for information about ad networks and how to opt out of their collection, and says it does not use such providers on its Portals.

Supporting quotations

eCW may enter into relationships with third-party advertising companies to drive traffic to and serve ads on our Site. These third-party companies may also collect information through Data Collection Technologies described in Section 6 to measure the effectiveness of their ads and to personalize advertising content. The Network Advertising Initiative offers useful information about Internet advertising companies (also called "ad networks" or "network advertisers"), including information about how to opt-out of their information collection. We do not use such providers on our Portals.

Qualifications & exceptions

  • Collection by the advertising companies is described as possible (“may also collect”).
  • The Portals are excluded from these third-party advertising arrangements.

Not stated here

  • How the advertising companies use the data beyond ad measurement and personalization is not described.

Sharing & Disclosure · Company commitment

eCW will not sell, lease or trade biometric information

eCW states that it will not sell, lease or trade the reader’s biometric information. The commitment is stated absolutely, without the qualifications attached to the policy’s general no-sale statement.

Supporting quotations

We will not sell, lease, or trade your biometric information.

Qualifications & exceptions

  • Three verbs are used: sell, lease and trade.

Sharing & Disclosure · Context

Disclosure is framed as occurring for an enumerated list of reasons

The disclosure section is introduced by a single sentence saying eCW may disclose Personal Information for the following reasons, after which each reason is stated in its own subsection, from at-your-request disclosure through to text messaging opt-in data. The policy presents disclosure as purpose-bound by that list, though it does not say the list is exhaustive.

Supporting quotations

We may disclose your Personal Information for the following reasons:

Qualifications & exceptions

  • The introduction does not state that the listed reasons are the only permitted disclosures.

Not stated here

  • No general prohibition on disclosure outside the list appears in this section.

Sharing & Disclosure · Company practice

Aggregated information said not to identify individuals is shared with business partners

eCW may provide aggregated information related to the reader’s Personal Information to some of its business partners, saying the information is used in a collective manner and does not identify the reader individually in any way.

Supporting quotations

eCW may provide aggregated information related to your Personal Information to some of eCW's business partners. This information is used in a collective manner and does not identify you individually in any way.

Qualifications & exceptions

  • The reassurance rests on the aggregation claim rather than on a described de-identification method.

Not stated here

  • The policy does not define what aggregation technique is used or whether re-identification is prohibited.

Sharing & Disclosure · Permission or license

eCW denies traditional sale but shares data with advertising and marketing partners

The California notice repeats that eCW does not generally sell CCPA/CPRA Personal Information as “sell” is traditionally understood, but that it may disclose certain CCPA/CPRA Personal Information to advertising and marketing partners, generally though not exclusively in hashed or pseudonymized form, to support marketing activities and offer services the reader may be interested in. It adds that it may use advertising technologies such as those described in the targeting-cookies and third-party advertising sections and will comply with applicable law including the CCPA/CPRA, and that a reader or authorised representative may opt out of sale or sharing by using the “Your Privacy Choices” section of the website.

Supporting quotations

eCW does not generally sell CCPA/CPRA Personal Information as the term "sell" is traditionally understood (i.e., an exchange of a good or service in return for money). However, we may disclose certain CCPA/CPRA Personal Information to advertising and marketing partners generally but not exclusively in hashed or pseudonymized form. We do so in order to support our marketing activities and to provide you with offers of services that we believe you may be interested in.
To exercise the right to opt-out of the sale or sharing of your CCPA/CPRA Personal Information, you (or your authorized representative) may submit a request to us by visiting the "Your Privacy Choices" section of our website.

Qualifications & exceptions

  • The no-sale statement is qualified by “generally” and by a money-for-data understanding of sale.
  • Hashed or pseudonymized form applies generally but not exclusively.
  • Opt-out covers both sale and sharing and is exercised through the website rather than by a single named link here.

Not stated here

  • The notice does not name the advertising and marketing partners.

Sharing & Disclosure · Company commitment

eCW states no actual knowledge of selling or sharing data of consumers under 16

The notice states that eCW has no actual knowledge that it sells CCPA/CPRA Personal Information of consumers under 16 years of age to non-service provider third parties, and no actual knowledge that it shares such information with those parties. The statement is framed as absence of knowledge rather than as a prohibition or an opt-in regime.

Supporting quotations

eCW has no actual knowledge that it sells CCPA/CPRA Personal Information of consumers under 16 years of age to non-service provider third parties.

Qualifications & exceptions

  • Limited to non-service provider third parties.
  • Framed as absence of actual knowledge, not as a guarantee.

Not stated here

  • The notice does not describe any age-verification or opt-in process for minors in this paragraph.

Sharing & Disclosure · Company practice

Identifiers and internet activity are shared with advertising and marketing partners

The sharing table lists two categories shared with advertising and marketing partners: identifiers, and internet and other similar network activity.

Supporting quotations

Identifiers Advertising and marketing partners
Internet and other similar network activity Advertising and marketing partners

Qualifications & exceptions

  • The third-party recipient column names advertising and marketing partners for both rows.

Sharing & Disclosure · Company practice

The stated purpose for that sharing is marketing and communicating about offerings

The purpose given for the sharing of those categories is to market and communicate about eCW’s products, services, events and other offerings.

Supporting quotations

To market and communicate about our products, services, events, and other offerings

Sharing & Disclosure · Company practice

Disclosure recipients include affiliates, providers, payors, patients and authorities

To facilitate the provision of Services and to comply with applicable law, eCW says it may disclose CCPA/CPRA Personal Information to third parties such as its affiliates, its service providers, other medical providers, third-party payors or clearinghouses, patients, government authorities, third parties providing the services the reader contracted for, third parties the reader or the reader’s agents authorize or to which disclosure is needed to provide services, and third parties needed to comply with applicable law such as law enforcement.

Supporting quotations

To facilitate the provision of Services to you and to comply with applicable law, we may disclose Your CCPA/CPRA Personal Information to third parties such as our affiliates; our service providers; other medical providers, third party payors, or clearinghouses; patients; government authorities; third parties for providing the services for which you have contracted; third parties to whom you or your agents authorize us to disclose your CCPA/CPRA Personal Information or to which we must provide your CCPA/CPRA Personal Information to provide services to you; and third parties to comply with applicable law, such as law enforcement.

Qualifications & exceptions

  • The recipient list is introduced by “such as”.
  • Patients appear as a recipient category.
  • Disclosure is framed around facilitating Services and legal compliance.

Not stated here

  • Which recipient receives which data elements is shown only in the following table.

Sharing & Disclosure · Company practice

The disclosure table maps identifiers and customer-record data to the same recipient set

The disclosure table gives, for identifiers and for the categories described in California Civil Code section 1798.80(e), the recipients service providers, affiliates, third parties for providing contracted services, third parties the reader or its agents authorize, other medical providers, third-party payors or clearinghouses, and, for identifiers only, patients.

Supporting quotations

Identifiers Service Providers; Affiliates; Third parties for providing the services for which you have contracted; Third parties to whom you or your agents authorize us to disclose; Other medical providers, third party payors or clearinghouses; Patients
Categories described in Civ. Code § 1798.80(e) Service Providers; Affiliates; Third parties for providing the services for which you have contracted; Third parties to whom you or your agents authorize us to disclose; Other medical providers, third party payors or clearinghouses

Qualifications & exceptions

  • Patients appear as recipients for identifiers but not for the customer-records category row quoted here.

Not stated here

  • Rows for other categories are not included in this packet.

Sharing & Disclosure · Company practice

Most remaining table categories go to service providers, affiliates and authorized thirds

The disclosure table assigns protected-classification characteristics, internet or other electronic network activity, geolocation data, professional or employment-related information, education information and sensitive personal information to service providers, affiliates and third parties the reader or its agents authorize eCW to disclose to.

Supporting quotations

Characteristics of protected classifications under California or federal law Service Providers; Affiliates; Third parties to whom you or your agents authorize us to disclose
Internet or other electronic network activity information Service Providers; Affiliates; Third parties to whom you or your agents authorize us to disclose
Geolocation data Service Providers; Affiliates; Third parties to whom you or your agents authorize us to disclose
Professional or employment-related information Service Providers; Affiliates; Third parties to whom you or your agents authorize us to disclose
Education information Service Providers; Affiliates; Third parties to whom you or your agents authorize us to disclose
Sensitive personal information Service Providers; Affiliates; Third parties to whom you or your agents authorize us to disclose

Qualifications & exceptions

  • The recipient set is identical across these six rows.
  • Sensitive personal information appears in the same recipient set as ordinary categories.

Not stated here

  • The table does not say what each recipient does with the disclosed data.

Sharing & Disclosure · Company practice

Biometric and audio-visual data go to a narrower set of recipients

Biometric information is disclosed only to service providers. Audio, electronic, visual, thermal, olfactory or similar information is disclosed to service providers and affiliates, without the further third-party and agent-authorized recipients listed for other categories.

Supporting quotations

Biometric information Service Providers
Audio, electronic, visual, thermal, olfactory, or similar information Service Providers; Affiliates

Qualifications & exceptions

  • Biometric data has the narrowest recipient set in the rows quoted.
  • Audio and visual information adds affiliates but no agent-authorized third parties.

Sharing & Disclosure · Company practice

Disclosure purposes repeat provision, marketing, billing and diligence purposes

The purposes given for disclosing CCPA/CPRA Personal Information are to provide, support, personalize and develop eCW’s products, services, events and other offerings, to provide service to its customers including Providers, to market and communicate about its offerings, to process payments and resolve billing issues, and to conduct diligence and administer vendor and partner relationships.

Supporting quotations

To provide, support, personalize, and develop our products, services, events, and other offerings
To provide service to our customers, which include Providers
To market and communicate about our products, services, events, and other offerings
To process payments, administer fees, provide users with invoices, or resolve billing issues
To conduct diligence regarding our vendors and partners and administer vendor/partner relationships

Qualifications & exceptions

  • The list mirrors the earlier business-purpose list rather than adding new purposes.

Sharing & Disclosure · Company practice

Four categories are marked sold or shared for marketing with purposes-based retention

In the notice-at-collection table the identifiers row, the customer-records row, the internet or other similar network activity row and the professional or employment-related information row each answer the sold-or-shared column with “Yes, to Market and communicate about our products, services, events, and other offerings.” Each of those rows gives the same retention criteria: as necessary to fulfil the specified purposes for collection and use, or a reasonable time thereafter, or other compatible purposes including satisfying legal requirements.

Supporting quotations

Identifiers Market and communicate about our products, services, events, and other offerings Yes, to Market and communicate about our products, services, events, and other offerings. As necessary to fulfill the specified purposes for collection and use (or a reasonable time thereafter) or other compatible purposes including satisfying legal requirements.
Categories described in Civ. Code § 1798.80(e) Market and communicate about our products, services, events, and other offerings Yes, to Market and communicate about our products, services, events, and other offerings. As necessary to fulfill the specified purposes for collection and use (or a reasonable time thereafter) or other compatible purposes including satisfying legal requirements.
Internet or other similar network activity Market and communicate about our products, services, events, and other offerings Yes, to Market and communicate about our products, services, events, and other offerings. As necessary to fulfill the specified purposes for collection and use (or a reasonable time thereafter) or other compatible purposes including satisfying legal requirements.
Professional or employment-related information Administer user accounts Yes, to Market and communicate about our products, services, events, and other offerings. As necessary to fulfill the specified purposes for collection and use (or a reasonable time thereafter) or other compatible purposes including satisfying legal requirements.

Qualifications & exceptions

  • Sale or sharing is asserted for marketing and communications purposes, matching the earlier sharing section.
  • Retention is expressed as a criteria-based standard rather than a fixed period.

Not stated here

  • The table gives no numeric retention period for any category.
  • Whether the retention column differs for rows not quoted here is not yet known.

Sharing & Disclosure · Company practice

The audio and visual row answers No to sale or sharing and repeats the retention criteria

The audio, electronic, visual, thermal, olfactory or similar information row of the notice-at-collection table answers the sold-or-shared column with “No”, and gives the same retention criteria as the rows answered “Yes”: as necessary to fulfil the specified purposes for collection and use or a reasonable time thereafter, or other compatible purposes including satisfying legal requirements.

Supporting quotations

Audio, electronic, visual, thermal, olfactory, or similar information Market and communicate about our products, services, events, and other offering No As necessary to fulfill the specified purposes for collection and use (or a reasonable time thereafter) or other compatible purposes including satisfying legal requirements.

Qualifications & exceptions

  • This is the first quoted row whose sold-or-shared answer is No.
  • Retention wording is identical to the rows answered Yes.

Not stated here

  • The table does not explain why this category is excluded from sale or sharing.

Sharing & Disclosure · Permission or license

Opt-out rights cover sale or sharing and certain sensitive-information uses

The list includes the right to opt out of the sale or sharing of CCPA/CPRA Personal Information and the right to opt out of certain uses of CCPA/CPRA Sensitive Personal Information. The sensitive-information opt-out is limited to certain uses rather than all processing.

Supporting quotations

The right to opt-out of the sale or sharing of CCPA/CPRA Personal Information;
The right to opt-out of certain uses of CCPA/CPRA Sensitive Personal Information; and

Qualifications & exceptions

  • The sensitive-information opt-out is limited to certain uses.

Sharing & Disclosure · Company practice

Opt-out works through Your Privacy Choices and Global Privacy Control signals

To opt out of sale or sharing, the reader can use the “Your Privacy Choices” section of the website. eCW also says it processes opt-out preference signals in a frictionless manner communicated through Global Privacy Control settings the reader may turn on in certain browsers, through its vendor OneTrust.

Supporting quotations

As noted above, you have the right to opt out of the sale or sharing of your CCPA/CPRA Personal Information to third parties. To exercise this right, you can visit the "Your Privacy Choices" section of our website. Additionally, eCW processes opt-out preference signals in a frictionless manner communicated through Global Privacy Control settings you may turn on in certain browsers through its vendor, OneTrust.

Qualifications & exceptions

  • Global Privacy Control is named as the signal mechanism.
  • Signal processing runs through the vendor OneTrust.

Not stated here

  • The notice does not describe how a reader without GPC support can send an equivalent signal.

Sharing & Disclosure · User right or choice

Shine the Light opt-out covers sharing for third parties’ own direct marketing

The notice says California’s Shine the Light law lets California residents request details about how their information is shared with third parties, and in some cases affiliates, for those parties’ own direct marketing purposes, and that a business must either provide that information or let California customers opt in to or out of that sharing. eCW then says it may from time to time elect to share information collected through the Services with third parties or affiliates for their own direct marketing purposes, and that a California resident may opt out of future sharing of their personal information as defined by that law by contacting the Privacy Officer with “Do Not Share” in the subject line.

Supporting quotations

In addition to the rights already described, California's Shine the Light law permits California residents to request certain details about how their information is shared with third parties and, in some cases, affiliates, for those third parties' and affiliates' own direct marketing purposes. Under the law, a business must either provide this information or permit California customers to opt in to, or opt out of, this type of sharing. We may from time to time elect to share certain information about you collected by us through the Services with third parties or affiliates for those third parties' or affiliates' own direct marketing purposes. If you are a California resident, you may opt out of such future sharing of your personal information (as defined by the California Shine the Light law) by contacting our Privacy Officer at privacy-office with the phrase "Do Not Share" in the subject line.

Qualifications & exceptions

  • Sharing is described as something eCW “may from time to time elect” to do.
  • The opt-out is limited to sharing for the recipients’ own direct marketing.
  • The Shine the Light definition of personal information governs the opt-out.

Not stated here

  • The contact address is rendered incompletely in this source as “privacy-office”, so the full e-mail address cannot be stated.