eClinicalWorks Privacy Policy

Legal Rights & Agreement Rules · Context

Policy header carries a 2023 effective date and an April 2026 last update

The policy header states an effective date of January 1, 2023 and a last-updated date of April 3, 2026, so the posted text presents itself as a policy in force since 2023 that was revised in April 2026. Both dates sit at the top of the document, above the introduction.

Supporting quotations

Effective Date: January 1, 2023

Last Updated: April 3, 2026

Qualifications & exceptions

• Applies to the text as posted at capture.

Not stated here

• What the April 3, 2026 update changed; the source contains no prior version or redline.

Data Access & Collection · Context

Policy describes what Personal Information eCW collects and how it is used

eCW describes the policy as telling readers what Personal Information eClinicalWorks, LLC may collect, how it collects it, how it uses it in connection with Services provided to the reader or to Provider customers, and what choices the reader has. The policy defines Personal Information as information that identifies an individual or relates to an identifiable individual or household, with the types collected depending on the purpose and the reader’s role. The same section states that Personal Information as used in the policy excludes Protected Health Information.

Supporting quotations

This Privacy Policy (this "Privacy Policy") informs you what Personal Information eClinicalWorks, LLC ("eCW," "we," "us," or "our") may collect, how eCW collects such Personal Information, how eCW uses such Personal Information in connection with the Services we provide to you or our customers (i.e., Providers as defined below), and your choices related to your Personal Information.

"Personal Information" is information that identifies an individual or relates to an identifiable individual or household.

Qualifications & exceptions

• Collection is expressed permissively ("may collect") and the categories collected depend on role and purpose.
• Personal Information excludes Protected Health Information.

Use & Processing · Context

Services means eCW products and services, illustrated by sites, records and portals

The policy defines Services as eCW’s products and services, illustrated by websites (Sites), electronic medical records systems, practice management systems, healthcare provider customer portals and patient portals, and software and mobile applications for those products. The list closes with "etc.," so it is illustrative rather than a closed set.

Supporting quotations

1.1.1. "Services" means eCW's products and services, such as our websites ("Sites"), electronic medical records systems, practice management systems, healthcare provider customer portals ("Provider Portals"), patient portals ("Patient Portals", collectively with Provider Portals, "Portals"), software and mobile applications for the foregoing, etc.

Qualifications & exceptions

• Illustrative list; the definition is open-ended.

Not stated here

• Whether a given eCW offering falls outside the illustrative list.

Legal Rights & Agreement Rules · Restriction or exception

PHI is outside Personal Information and is governed by Customer Documents and HIPAA

The policy excludes Protected Health Information from its definition of Personal Information because PHI has different treatment under HIPAA, other applicable laws and the Customer Documents. PHI is defined as individually identifiable health information protected by HIPAA and its implementing regulations, and the Customer Documents are the service agreement, business associate agreement or other Services terms eCW holds with its Provider customers. For a patient of a Provider, use and disclosure of PHI is governed by HIPAA and the Customer Documents with that Provider, not by this policy, and requests about PHI are directed to the Provider.

Supporting quotations

1.2. In this Privacy Policy, we do not include Protected Health Information in the definition of Personal Information because, as discussed in Sections 2 and 4, Protected Health Information has different treatment under HIPAA (as defined below), other applicable laws, and the Customer Documents (as defined below). Accordingly, because Protected Health Information is handled differently under the Customer Documents, if you are a patient of a Provider (as defined below), your Protected Health Information is subject to the Customer Documents and your Provider's terms of service and privacy practices.

2.1.2. "Protected Health Information" or "PHI" is individually identifiable health information that is protected by the Health Insurance Portability and Accountability Act of 1996, as amended, and its implementing regulations ("HIPAA").

(the "Customer Documents") that we have entered with our customers (health care providers or their firms, "Providers") that also govern our use of PHI

If you are a patient of a Provider, our use and disclosure of your Protected Health Information is governed by HIPAA and other applicable law and the Customer Documents with your Provider not by this Privacy Policy.

Qualifications & exceptions

• The carve-out is framed as a definitional exclusion of PHI from Personal Information, backed by the governing-document allocation in Section 4.1.2.

Not stated here

• The Customer Documents and the Provider’s own terms are not in the supplied source, so their substantive PHI terms are not evidenced here.

Legal Rights & Agreement Rules · Company practice

Policy is part of, and incorporated into, the Terms of Use and Terms and Conditions

eCW states the policy applies wherever it is posted and is part of, and incorporated into, the applicable Terms of Use for the Sites, Portals and other Services and any Terms and Conditions for its software and mobile applications. Visiting or using the Services, or otherwise affirming acceptance of an agreement that incorporates the policy by reference, is treated as acceptance of the described collection, use, disclosure and transfer practices, and readers who do not agree are told not to use the Services. Capitalized terms the policy leaves undefined take their meaning from those agreements.

Supporting quotations

This Privacy Policy applies wherever it is posted, and it is part of and incorporated into applicable Terms of Use Agreements ("Terms of Use") for the Sites, the Portals, and other Services, and into any applicable Terms and Conditions for our software and mobile applications ("Terms and Conditions").

By visiting or using the Services or otherwise affirming the acceptance of an agreement into which this Privacy Policy is incorporated by reference, you acknowledge and agree to accept the practices described in this Privacy Policy regarding the collection, use, disclosure, and transfer of your Personal Information.

Qualifications & exceptions

• Acceptance arises by visiting or using the Services, or by affirming an agreement that incorporates the policy.

Not stated here

• The Terms of Use and Terms and Conditions are not in the supplied source, so their separate obligations are not evidenced here.

Legal Rights & Agreement Rules · Restriction or exception

Policy disclaims contractual status and points to the Terms for obligations

The introduction states that the policy is not a contract and does not create contractual rights or obligations, and that use of the Services is governed by the applicable Terms of Use or Terms and Conditions. Read with the incorporation sentence, the policy supplies content for those agreements while the agreements carry the contractual obligations.

Supporting quotations

This Privacy Policy is not a contract and does not create any contractual rights or obligations. Your use of the Services is governed by the applicable Terms of Use or Terms and Conditions of the respective Services.

Qualifications & exceptions

• The disclaimer appears in the policy text itself; how it interacts with incorporation into the Terms is not discussed in the source.

Legal Rights & Agreement Rules · Restriction or exception

Local law controls where rights differ; California and other-state notices apply by residence

eCW recognises that privacy rights and obligations may differ by location and says it will comply with local legal requirements where they do. California residents are referred to the Privacy Notice for California Residents in Section 18, phrased as possibly applicable, and residents of other states with applicable consumer privacy laws are referred to Section 19.

Supporting quotations

Please note that some privacy rights and obligations may differ in certain locations based on local law, in which case eCW will comply with the local legal requirements. If you are a California resident, our Privacy Notice for California Residents in Section 18 may apply to you. For residents of other states with applicable consumer privacy laws, please refer to Section 19.

Qualifications & exceptions

• The California notice is described as possibly applicable ("may apply") rather than as automatically governing every California resident.
• Section 19 is addressed to residents of states with applicable consumer privacy laws.

Legal Rights & Agreement Rules · Permission or license

eCW reserves the right to modify the policy at any time and posts revisions

eCW reserves the right to modify the policy at any time. Revisions that change how Personal Information is collected, used or shared are posted in the policy, and for material changes eCW may also notify readers beforehand through a site notice or a notification. Readers are told to review the policy periodically, and eCW notes the effective date of the latest version at the beginning of the policy.

Supporting quotations

eCW reserves the right, at any time, to modify this Privacy Policy. If we make revisions that change the way we collect, use, or share Personal Information, we will post those changes in this Privacy Policy. If we make material changes to our Privacy Policy, we may also notify you by other means prior to the changes taking effect, such as by posting a notice on our Site or sending you a notification. You should review this Privacy Policy periodically so that you keep up to date on our most current policies and practices. eCW will note the effective date of the latest version of our Privacy Policy at the beginning of this Privacy Policy.

Qualifications & exceptions

• Advance notice of material changes is discretionary ("we may also notify you").
• The introduction does not state when a posted revision becomes binding on a reader.

Not stated here

• Whether continued use after a revision is treated as acceptance; the introduction does not say so.

Legal Rights & Agreement Rules · Restriction or exception

Supplemental employee notice controls over the policy in case of conflict

Employees and job applicants who are California residents, or who reside in other states that require it, receive a supplemental privacy notice covering their employment or job-application relationship with eCW. Where that supplemental notice conflicts with the policy, the supplemental employee notice controls.

Supporting quotations

1.5. Employees and job applicants who are California residents, or who reside in other states that require it, receive a supplemental privacy notice that applies to their relationship with eCW in the context of their employment or job application. In the event of any conflict with this Privacy Policy, the terms of the supplementary employee notice will control.

Qualifications & exceptions

• Applies to employees and job applicants in California or in other states that require a supplemental notice.

Not stated here

• The supplemental employee notice is not in the supplied source, so its terms are not evidenced here.

Data Access & Collection · Context

Personal Information is data identifying or relating to a person or household

The policy defines Personal Information as information that identifies an individual or relates to an identifiable individual or household. It adds that the types collected and the uses made of them depend on the purpose of collection, giving the examples of a Site visitor, a Portals user or a Services customer, and that Personal Information as used in the policy excludes Protected Health Information.

Supporting quotations

2.1.1. "Personal Information" is information that identifies an individual or relates to an identifiable individual or household. The types of Personal Information collected, and the uses thereof depend on the purposes for which we collect the Personal Information (e.g., whether you are a visitor to our Sites, a user of our Portals, or a customer of our Services). As used in this Privacy Policy, Personal Information does not include Protected Health Information.

Qualifications & exceptions

• The definition is functional rather than an enumerated list of data elements.
• Personal Information excludes Protected Health Information.

Not stated here

• Whether household-level data is collected outside the online context is not stated in this section.

Legal Rights & Agreement Rules · Context

Protected Health Information means HIPAA-protected identifiable health information

For the same section the policy defines Protected Health Information as individually identifiable health information protected by HIPAA and its implementing regulations. The definition is imported by reference to HIPAA rather than spelled out element by element.

Supporting quotations

2.1.2. "Protected Health Information" or "PHI" is individually identifiable health information that is protected by the Health Insurance Portability and Accountability Act of 1996, as amended, and its implementing regulations ("HIPAA").

Qualifications & exceptions

• The definition depends on the scope of HIPAA and its implementing regulations, which the policy does not reproduce.

Not stated here

• Which data eCW handles as PHI depends on the HIPAA framework and the Customer Documents, neither of which is in this section.

Data Access & Collection · Company practice

Collection is framed permissively and tied to accessing and using the Services

The collection section opens by saying that when a reader accesses and uses the Services, eCW may collect the types of information that follow. It then repeats that eCW may collect Personal Information in the ways described below. Collection is therefore framed as possible rather than as something that happens for every visitor in every case.

Supporting quotations

2.1. When you access and use the Services, we may collect the following types of information:

When you use the Services, eCW may collect Personal Information in the following ways described below.

Qualifications & exceptions

• Uses permissive language ("may collect") and ties collection to accessing and using the Services.

Not stated here

• The section does not say which of the listed information types every user necessarily provides.

Use & Processing · Company practice

Collected information is used to personalize the experience and provide the Services

eCW says it uses information collected from Services users to personalize and improve the visit and experience, to provide the Services to the reader or its customers, and for the other purposes set out later in the policy. The purposes are stated at this level of generality and cross-referenced to the later purpose section.

Supporting quotations

eCW uses information collected from users of the Services to personalize and improve your visit and experience, to provide the Services to you or our customers, and for other purposes set out below.

Qualifications & exceptions

• Improvement and personalization are stated without a description of the technique used.

Not stated here

• What the later purpose section adds is not part of this section.

Data Access & Collection · Company practice

Users provide Personal Information by message, form, office visit and social media

The policy describes collecting Personal Information that users provide when they interact with the Services, listing communication with eCW about the Services by letter, e-mail, online chat window or telephone; completing and submitting forms on the Sites or Provider Portals; visiting eCW offices; and visiting the Sites or interacting with eCW on social media and providing Personal Information. The list is introduced as examples ("such as when you").

Supporting quotations

3.2. Information You Provide to eCW: eCW collects Personal Information when you use and interact with the Services, such as when you:

3.2.1. Communicate with eCW about our Services whether by letter, e-mail, online chat window, or telephone;

3.2.2. Complete and submit forms to us on our Sites or Provider Portals (e.g., to register for an account on a Provider Portal, authenticate yourself to verify your authorized use of the Services, to register for our events, or to subscribe to our newsletters);

3.2.3. Visit our offices; or

3.2.4. Visit our Sites or interact with us on social media and provide us Personal Information.

Qualifications & exceptions

• The channels are introduced by "such as", so the list is illustrative rather than exhaustive.

Not stated here

• The policy does not describe retention periods or sensitivity limits for data arriving through each channel in this section.

Account & Service Control · Company practice

Provider Portal forms cover account registration and identity authentication

Among the forms a user may submit are forms on the Sites or Provider Portals used to register for an account on a Provider Portal, to authenticate the user to verify authorized use of the Services, to register for eCW events, and to subscribe to newsletters. The authentication example ties form-based collection to verifying that a person is authorized to use the Services.

Supporting quotations

Complete and submit forms to us on our Sites or Provider Portals (e.g., to register for an account on a Provider Portal, authenticate yourself to verify your authorized use of the Services, to register for our events, or to subscribe to our newsletters

Qualifications & exceptions

• Presented as examples ("e.g.") of form-based collection.

Not stated here

• What data elements each form requests is not stated in this section.

Data Access & Collection · Context

Usage Data covers logs, cookies, device and connection details about Site use

Usage Data is defined as information eCW automatically collects about use of the Sites through Web server logs, Web beacons, cookies and similar tracking technologies, including how a visitor interacts with the Sites. The definition lists IP address and connection details, browser type and version, operating system and platform, confirmation that an e-mail was opened, purchase history, and the URLs that lead to and around the Site with date and time of access. It notes that Usage Data may overlap Location Information and generally does not directly identify an individual but may be Personal Information in some instances, and that eCW does not deploy non-essential third-party cookies or similar tracking technologies on the Portals.

Supporting quotations

2.1.3. "Usage Data" is information that we automatically collect about your use of the Sites and includes the sort that Web browsers and servers typically make available, through Web server logs, Web beacons, cookies and other similar tracking technologies, about the devices you use to access our Sites, as well as information on how you interact with our Sites. We do not deploy non-essential third-party cookies or similar tracking technologies on the Portals; however, we may collect log information including Usage Data for internal uses or uses by our service providers on our behalf, such as ensuring the security and integrity of our Services. Usage Data may include the IP address of a device or internet service used to connect your device to the Internet and may provide information about your Location; computer and connection information such as your browser type and version; operating system and platform; confirmation when you open e-mail that we send you; purchase history; and the URLs which lead you to and around the Site including the date and time of access. Usage Data may overlap with Location Information. Usage Data generally does not directly identify an individual, but may constitute Personal Information in some instances.

Qualifications & exceptions

• Usage Data is described as usually not directly identifying, but as Personal Information in some instances.
• The Portals cookie limit covers non-essential third-party cookies and similar tracking technologies, not all collection.

Not stated here

• The precise set of tracking technologies deployed on the Sites is described only in general terms here.

Data Access & Collection · Company practice

Automatic Usage Data collection runs subject to device settings and consent

When a reader uses the Services, eCW may automatically collect Usage Data subject to the settings of the device used to access the Services, and with consent may collect device information to facilitate use of certain features. eCW says it may use the data to analyze trends and statistics to improve the online experience or customer service, and that although it does not deploy non-essential third-party cookies on the Portals it may still collect Usage Data for purposes such as ensuring the security and integrity of the Services.

Supporting quotations

3.3. Information that eCW Collects Automatically: When you use the Services, eCW may automatically collect Usage Data subject to the settings of your device that you use to access the Services. With your consent, we may also collect information from your device to facilitate your use of certain features of the Services. eCW may use this data to analyze trends and statistics to improve your online experience or our customer service. We do not deploy non-essential third-party cookies or similar tracking technologies on our Portals but may collect Usage Data for purposes such as ensuring the security and integrity of our Services.

Qualifications & exceptions

• Automatic collection is qualified by device settings; additional device collection is qualified by consent.
• The Portals limitation is specific to non-essential third-party cookies and does not exclude first-party or security-related collection.

Not stated here

• Which features require the consented device collection is not identified.

Data Access & Collection · Company practice

eCW also collects Personal Information from public, commercial and authorized sources

eCW says it may collect Personal Information from the Internet and other publicly available sources and databases, data aggregators, marketing companies and other third parties, including sources the reader authorizes eCW to obtain information from on the reader’s behalf. If a reader later withdraws an authorization, the policy says the reader may need to contact the third-party source directly to stop the transmission, and it gives the example of authorizing eCW to obtain claims information directly from CMS. Readers are referred to the third party’s own privacy policy for how that party collected and used the information.

Supporting quotations

3.4. Information from Other Sources: eCW may collect Personal Information from other sources such as the Internet and other publicly-available sources and databases, data aggregators, marketing companies, and other third parties, including sources from which you authorize us to obtain Personal Information about you on your behalf. If you authorize us to collect information from a third party, or if you authorize a third party to send us information, and you later decide that you no longer want us to obtain that information, you may need to contact the third-party source directly and request that they stop transmitting information to us. For example, if you submit claims to the Centers for Medicare and Medicaid Services ("CMS"), you may decide to authorize us to obtain information directly from CMS. For more information about how those third parties collected and used your Personal Information, please review the privacy policy of the respective third party.

Qualifications & exceptions

• Includes sources the reader authorizes, not only unrelated third parties.
• Withdrawal of an authorization is handled with the third-party source, not solely through eCW.

Not stated here

• The policy does not list which data aggregators or marketing companies supply information.

Legal Rights & Agreement Rules · Context

Portal services and support operations involve PHI supplied under Customer Documents

The policy says certain Services provided to customers or made available to their patients, such as the Portals, and certain support operations, involve access to and processing of PHI. That PHI is provided under a service agreement, business associate agreement or other document with terms and conditions for the Services, defined as the Customer Documents, entered with customers who are health care providers or their firms, defined as Providers. The Customer Documents also govern eCW’s use of the PHI of the Provider’s patients.

Supporting quotations

Certain Services we provide to our customers or make available to their patients, such as the Portals, as well as certain support operations, involve access to, and the processing of, PHI.

This PHI is provided to us pursuant to a service agreement, business associate agreement, or other document with terms and conditions for the Services (the "Customer Documents") that we have entered with our customers (health care providers or their firms, "Providers") that also govern our use of PHI of their patients provided by our Provider customers or their patient users.

Qualifications & exceptions

• The PHI described here is limited to Services and support operations that involve patient data, not every eCW product.

Not stated here

• The Customer Documents are not reproduced in the source, so their specific use and disclosure terms are not evidenced.

Use & Processing · Company commitment

eCW uses PHI as a business associate only on Provider instructions under HIPAA

The policy states that it supplements the Customer Documents and that eCW uses PHI only as a business associate of its Providers, who are covered entities, in accordance with instructions or restrictions the Provider gives it and in full compliance with the applicable HIPAA provisions. The commitment is bounded by the Provider’s instructions and by HIPAA rather than by the policy alone.

Supporting quotations

4.1.1. This Privacy Policy supplements the Customer Documents. eCW only uses such PHI as a "business associate" of its Providers, who are "covered entities," in accordance with any instructions or restrictions provided to eCW by the Provider and in full compliance with the applicable provisions of HIPAA.

Qualifications & exceptions

• Use of PHI is limited to the Provider’s instructions or restrictions and to HIPAA compliance.
• eCW describes itself as a business associate and its Provider customers as covered entities.

Not stated here

• The instructions and any additional restrictions are in the Customer Documents, which are not supplied.

Legal Rights & Agreement Rules · Restriction or exception

PHI requests go to the Provider, and eCW disclaims responsibility for Provider handling

Patients are told to submit all requests and questions about their PHI directly to their Provider. eCW also says it is not responsible for how its Provider customers treat PHI it collects on their behalf and recommends that patients review the Provider’s own privacy policies.

Supporting quotations

Please submit all requests and questions related to your PHI directly to your Provider. We are not responsible for how our Provider customers treat PHI we collect on their behalf, and we recommend you review their own privacy policies.

Qualifications & exceptions

• Addressed to patients of a Provider.

Not stated here

• The policy does not describe what a patient can obtain from eCW directly about PHI held on a Provider’s behalf.

Data Access & Collection · Restriction or exception

Sites are generally not intended to collect PHI, so Site collection rules do not apply to it

eCW says its Sites are generally not intended to collect or retain PHI, so the policy sections describing Personal Information collection on the Sites do not apply to PHI, and eCW says it does not request, obtain, use or disclose PHI through its Sites.

Supporting quotations

4.1.3. Our Sites are generally not intended to collect or retain any PHI. Thus, sections of this Privacy Policy that discuss Personal Information collection on the Sites do not apply to PHI, and we do not request, obtain, use or disclose any PHI through our Sites

Qualifications & exceptions

• Qualified by “generally”, so the exclusion is not framed as absolute.

Not stated here

• What happens if PHI reaches the Sites incidentally, for example through a contact form, is not addressed here.

Use & Processing · Company practice

Personal Information is used to provide Services, improve experience and target offers

The use section says eCW uses collected Personal Information to provide Services to customers and their authorized users, to improve user experience with the Services and to communicate about requested information. It adds that eCW may use Personal Information to help target specific offers to customers and others and to develop and improve the Services, that it may disclose Personal Information as described in Section 7, and that the following list of uses applies.

Supporting quotations

5.1. eCW uses the Personal Information collected to provide Services to our customers and their authorized users to improve user experience with the Services, and to communicate with you about requested information. eCW may use Personal Information to help target specific offers to customers and others and to develop and improve its Services. Additionally, eCW may disclose your Personal Information as discussed below in Section 7, and use your Personal Information to:

Qualifications & exceptions

• Targeted offers are described as a possible use (“may use”).
• Disclosures are governed by a separate section that this text cross-references.

Not stated here

• The policy does not describe how targeted offers are selected in this section.

Account & Service Control · Company practice

Requests, questions and account administration are a stated use

eCW lists responding to user service requests, questions and concerns and administering user accounts as a use of information, saying it may verify identity, register the user, administer the account, or provide the information, products and services the user requests.

Supporting quotations

Respond to user service requests, user questions and concerns, and administer user accounts. We may use your information to verify your identity, register you, administer your account, or provide you the information, products, and services that you request.

Qualifications & exceptions

• Identity verification is tied to account administration and delivering requested products or services.

Use & Processing · Company practice

Information is used to provide service to Provider customers, including for their patients

eCW lists providing service to its customers, which include Providers, as a use of information, and says that where the reader is a patient of a Provider it uses the reader’s information when providing the Services to that Provider.

Supporting quotations

Provide service to our customers, which include Providers. If you are a patient of a Provider, we use your information when providing the Services to the Provider.

Qualifications & exceptions

• The stated use for patient data is tied to providing Services to the Provider.

Use & Processing · Company practice

Marketing use includes inferring interest and sending promotional materials

eCW says it may use information to communicate about its products, services and related issues, to try to identify whether a reader may be interested in the Services or its business partners’ products and services, and to send information and promotional materials when it thinks something may interest the reader. Marketing e-mails carry an unsubscribe link that the reader can use to stop receiving them.

Supporting quotations

Communicate with users about our products, services, and related issues. We may use your information to try to identify if you may be interested in any of the Services or our business partners' products and services. If we think something may interest you, we may send you information and promotional materials. You may unsubscribe from receiving marketing e-mails from us by using the unsubscribe link included in marketing e-mails.

Qualifications & exceptions

• Interest assessment covers both eCW offerings and business partners’ offerings.
• The stated opt-out covers marketing e-mails through the unsubscribe link.

Not stated here

• Whether other marketing channels, such as calls or text messages, carry the same opt-out is not stated here.

Charges & Financial Obligations · Company practice

Billing, invoices and fee administration is a stated use with identity verification

eCW lists administering fees, providing invoices and resolving billing issues as a use of information, and says it may verify identity in order to process payments.

Supporting quotations

Administer fees and provide users with invoices or resolve billing issues. We may use your information to verify your identity in order to process your payments.

Qualifications & exceptions

• Identity verification is expressly tied to payment processing.

Security & Safeguards · Company practice

Ensuring the security and integrity of the Services is a stated use

Ensuring the security and integrity of the Services appears as a standalone use of the collected information, stated without further detail about the measures involved.

Supporting quotations

Ensure the security and integrity of our Services.

Not stated here

• The section does not describe the security controls or standards applied.

Use & Processing · Company practice

Research and analysis, including advertising-impression auditing, uses information

eCW lists conducting research and analysis, including auditing related to advertising impressions, as a use, and says it may use information subject to the reader’s consent, or otherwise in de-identified or aggregate form, as part of research studies.

Supporting quotations

Conduct research and analysis, including auditing related to advertising impressions. We may use your information, subject to your consent, or otherwise in de-identified or aggregate form as part of research studies.

Qualifications & exceptions

• Identifiable use for research is conditioned on consent; otherwise the stated basis is de-identified or aggregate data.

Not stated here

• What counts as de-identified or aggregate data for this purpose is not defined in this section.

Use & Processing · Company practice

Quality verification, improvement and new-Service development are stated uses

eCW also lists verifying and maintaining the quality of the Services, improving the Services and developing new Services as uses of the collected information.

Supporting quotations

Verify and maintain the quality of our Services, improve the Services, or develop new Services.

Sharing & Disclosure · Permission or license

Information may be used when exploring or completing a business transaction

If eCW is exploring or goes through a business transition or financial transaction, such as a merger, acquisition, divestiture, restructuring, reorganisation, dissolution, bankruptcy, securities offering or sale of all or part of its assets, it may use the reader’s information in connection with exploring or concluding the transaction.

Supporting quotations

In the event of a business transaction. If we are exploring or go through a business transition or financial transaction, such as a merger, acquisition, divestiture, restructuring, reorganization, dissolution, bankruptcy, securities offering, or sale of all or a portion of our assets, we may use your information in connection with exploring or concluding such transaction.

Qualifications & exceptions

• The stated permission covers both exploring a transaction and concluding one.
• The list of transaction types is illustrative rather than exhaustive.

Not stated here

• What happens to the information after a completed transfer, including any notice to users, is not addressed here.

Legal Rights & Agreement Rules · Permission or license

Information may be disclosed to comply with law and valid legal process

eCW says it may disclose information to comply with applicable laws or regulations, including valid legal processes such as a search warrant, subpoena or court order from a tribunal of competent jurisdiction.

Supporting quotations

To comply with law. We may disclose your information to comply with any applicable laws and/or regulations, such as to comply with valid legal processes such as a search warrant, subpoena, or order from a court or tribunal of competent jurisdiction.

Qualifications & exceptions

• The stated triggers are applicable law and valid legal process.

Not stated here

• Whether eCW notifies users of legal-process requests is not stated in this section.

Data Access & Collection · Company practice

Sites use cookies, beacons and log files, but Portals avoid non-essential third-party cookies

eCW says it and its service providers may use cookies, Web beacons, log files and other technologies, collectively called Data Collection Technologies, to help provide, customize and improve the Sites, and it lists the technologies it uses on the Sites. In the same paragraph it states that it does not deploy non-essential third-party cookies or similar tracking technologies on its Portals.

Supporting quotations

6.1. We and our service providers may use cookies, Web beacons, log files, and other technologies (collectively, "Data Collection Technologies") to help us provide, customize, and improve the Sites. We do not deploy non-essential third-party cookies or similar tracking technologies on our Portals. The Data Collection Technologies we use on our Sites include:

Qualifications & exceptions

• Collection by service providers as well as by eCW is contemplated.
• The Portals limitation covers non-essential third-party cookies and similar tracking technologies, not all collection.

Not stated here

• The policy does not identify which service providers deploy these technologies.

Data Access & Collection · Company practice

Web beacons in Sites and e-mails can record clickstream data

A Web Beacon is described as a Web page element, such as a clear gif, pixel tag or single-pixel gif, that may be embedded in the Sites or in e-mail communications and may employ cookie technology to enable eCW to record clickstream data. The description confirms that tracking extends to e-mail communications and not only to pages on the Sites.

Supporting quotations

6.1.1. Web Beacons: A Web Beacon is a Web page element (such as a clear gif, pixel tag or single-pixel gif) that may be embedded into our Sites or e-mail communications, and which may employ cookie technology to enable eCW to record clickstream data

Qualifications & exceptions

• Described in permissive terms (“may be embedded”, “may employ”).

Not stated here

• The policy does not say which e-mails carry beacons or what is recorded about recipients.

Data Access & Collection · Context

Cookies collect clickstream and traffic data, and browsers can reject them

Cookies are described as small text files placed on a device to store data that a Web server in the domain that placed the cookie can recall, enabling eCW to collect clickstream data including traffic on the Sites. Readers can set their browser to reject certain cookies or to notify them when a cookie is sent, though rejecting cookies may limit Site functionality, and third-party software exists that allows visiting the Sites without providing certain types of this information.

Supporting quotations

6.1.2. Cookies: Cookies are small text files placed on your device to store data that can be recalled by a Web server in the domain that placed the cookie. Cookies enable eCW to collect clickstream data, including traffic on the Sites. You may set your browser to reject certain cookies or to notify you when you are sent a cookie. Rejecting cookies may limit functionality of the Sites. Third parties also provide software that allows you to visit the Sites without providing certain types of this information. Our Sites may use the following types of cookies:

Qualifications & exceptions

• Browser rejection is offered as a control, subject to reduced functionality.
• The paragraph notes third-party software that suppresses some information collection without naming it.

Not stated here

• The policy does not state how cookie choices interact with the cookie banner described for advertising cookies.

Data Access & Collection · Company practice

Essential cookies cannot be switched off and support logins and forms

Essential or strictly necessary cookies are described as necessary for the Sites to function and as not switchable off in eCW systems. They are usually set in response to actions that amount to a request for services, such as setting privacy preferences, logging in or filling in forms, and blocking them in the browser can prevent parts of the Sites from working.

Supporting quotations

6.1.2.1. Essential/Strictly Necessary Cookies: These cookies are necessary for the Sites to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the Sites will not then work.

Qualifications & exceptions

• The category is presented as exempt from the switch-off mechanism, with browser blocking as the only lever.

Data Access & Collection · Company practice

Analytics cookies measure visits, traffic sources and page popularity

Analytics or performance cookies are described as allowing eCW to count visits and traffic sources so that it can measure and improve Site performance, showing which pages are most and least popular and how visitors move around the Sites.

Supporting quotations

6.1.2.2. Analytics/Performance Cookies: These cookies allow us to count visits and traffic sources, so we can measure and improve the performance of our Sites. They help us know which pages are the most and least popular and see how visitors move around the Sites.

Not stated here

• The paragraph does not say whether these cookies are first-party or third-party, or how long they persist.

Data Access & Collection · Company practice

Advertising partners may set targeting cookies where a cookie banner is shown

Targeting or advertising cookies may be set by eCW’s advertising partners at Sites where a cookie banner is displayed, and those partners may use them to build a profile of the reader’s interests and show relevant adverts on other websites. Readers may disallow them using the cookie banner, and California residents and residents of states with consumer privacy protection laws may also opt out of certain sharing of information through these cookies by using the “Your Privacy Choices” section, as described in Section 18.5.1. Disallowing them results in less targeted advertising.

Supporting quotations

6.1.2.3. Targeting/Advertising Cookies: These types of cookies may be set by our advertising partners at Sites at which a cookie banner is displayed. These cookies may be used by those advertising partners to build a profile of your interests and to show you relevant adverts on other websites. You may disallow these targeting/advertising cookies using the cookie banner. California residents and residents of states with consumer privacy protection laws may also opt-out of certain sharing of information through these cookies including by visiting the "Your Privacy Choices" section of our website and following the instructions there, as described further in Section 18.5.1. If you do not allow these cookies, you will experience less targeted advertising.

Qualifications & exceptions

• Third-party setting is conditioned on a cookie banner being displayed at the Site.
• Refusing these cookies reduces targeting rather than removing advertising.

Not stated here

• Which advertising partners set these cookies is not identified in this section.

Data Access & Collection · Company practice

Third-party analytics services such as Google Analytics analyze Site usage

eCW may use third-party Web analytics services, giving Google Analytics as an example, and other technologies on the Sites to collect and analyze usage information through cookies and similar tools, to conduct auditing, research or reporting, and to provide certain features. It points readers to the Google Analytics Opt-out Browser Add-on as a way to prevent that use of their information for analytics.

Supporting quotations

We may use third-party Web analytics services (such as those of Google Analytics) and other technologies on our Sites to: collect and analyze usage information through cookies and similar tools; engage in activities such as auditing, research, or reporting; and provide certain features to you.

Qualifications & exceptions

• The named provider is an example; other analytics services may be used under the same description.

Not stated here

• The policy does not describe what is done with analytics output beyond auditing, research and reporting.

Data Access & Collection · Company practice

eCW honours Global Privacy Control but does not recognize Do Not Track signals

The policy describes Do Not Track as a browser privacy preference, says eCW provides a variety of opt-out mechanisms and recognizes Global Privacy Control through its vendor OneTrust, and states that it does not currently use technology that specifically recognizes DNT signals from a Web browser.

Supporting quotations

Do Not Track ("DNT") is a privacy preference that users can set in certain web browsers. We are committed to providing you with meaningful choices about the information collected on our website for third-party purposes, and that is why we provide the variety of opt-out mechanisms listed above and recognize "Global Privacy Control" through our vendor, OneTrust. However, we do not currently use technology that specifically recognizes DNT signals from your Web browser.

Qualifications & exceptions

• The DNT statement is present-tense and limited to current technology.
• Global Privacy Control recognition runs through the named vendor OneTrust.

Not stated here

• Which opt-out mechanisms make up the “variety” referred to is not enumerated in this paragraph.

Sharing & Disclosure · Permission or license

eCW discloses Personal Information to third parties at the reader’s request

The first listed disclosure reason is disclosure at the reader’s request, direction or authorization. The example given is a reader directing eCW to disclose Personal Information to a third-party entity, whether an eCW business partner or another third party, so that the reader can use that third party’s service, in which case eCW says it will share the information.

Supporting quotations

7.1.1. At Your Request: eCW may disclose Personal Information to third parties at your request, direction, or authorization. For example, if you direct eCW to disclose your Personal Information to a third-party entity, whether an eCW business partner or other third party to use the third party's service, we will share your information with the third party.

Qualifications & exceptions

• Conditioned on the reader’s request, direction or authorization.

Not stated here

• Whether the third party’s own use is limited by contract is not addressed here.

Sharing & Disclosure · Company practice

Personal Information may be shared with affiliates, including Healow, without authorization

eCW may disclose Personal Information to its affiliates, described as parents, entities under common ownership and subsidiaries such as Healow, LLC, and to other related companies without authorization.

Supporting quotations

7.1.2. Internal Sharing: eCW may disclose Personal Information to its affiliates (including parents, entities under common ownership, and subsidiaries, such as Healow, LLC), and other related companies without authorization.

Qualifications & exceptions

• The section states that affiliate sharing occurs without authorization, in contrast to the preceding at-your-request reason.
• Affiliates are illustrated by Healow, LLC.

Not stated here

• The policy does not describe what the affiliates do with the information after disclosure.

Sharing & Disclosure · Company practice

Service providers receive Personal Information to operate and improve the business

eCW may disclose Personal Information to service providers for the purposes of operating its business, delivering, improving and customizing its products or services, sending marketing and communications related to its business, payment processing, and other legitimate purposes permitted by applicable law. Marketing communications appear here as a purpose for which data reaches service providers.

Supporting quotations

7.1.3. With Our Service Providers: eCW may disclose Personal Information to service providers for the purposes of operating our business, delivering, improving, and customizing our products or services, sending marketing and communications related to our business, payment processing, and for other legitimate purposes permitted by applicable law.

Qualifications & exceptions

• The final purpose is open-ended (“other legitimate purposes permitted by applicable law”).

Not stated here

• The policy does not name the service providers or the contractual limits placed on them.

Sharing & Disclosure · Company practice

Customers receive Personal Information, including Sensitive Personal Information, per Customer Documents

eCW may disclose Personal Information, including Sensitive Personal Information, to its customers consistent with the Customer Documents. The disclosure to Provider customers is therefore bounded by the Customer Documents rather than by this policy alone.

Supporting quotations

eCW may disclose Personal Information, including Sensitive Personal Information, to its customers consistent with the Customer Documents.

Qualifications & exceptions

• The disclosure is expressly conditioned on the Customer Documents.

Not stated here

• What the Customer Documents require for these disclosures is not reproduced.

Data Access & Collection · Context

Sensitive Personal Information covers government ID, financial, demographic and status data

The policy defines Sensitive Personal Information as Personal Information regarding more sensitive areas, giving government ID and certain other financial information, gender, marriage status, race or ethnicity, and veteran or disability status as examples.

Supporting quotations

refers to Personal Information regarding more sensitive areas, such as government ID and certain other financial information, gender, marriage status, race/ethnicity, or veteran or disability status.

Qualifications & exceptions

• The list is introduced by “such as”, so the categories are examples.

Not stated here

• The definition does not say whether it matches any particular statute’s sensitive-data category.

Legal Rights & Agreement Rules · Permission or license

Disclosure covers legal process, charge verification and enforcing eCW’s rights

To the extent permitted by law, eCW will disclose Personal Information to government authorities or third parties under a legal request, subpoena or other legal process. It may also use or disclose Personal Information as permitted by law to perform charge verifications, to apply or enforce the Services’ Terms of Use or Terms and Conditions, and to protect its own rights, interests or property and those of its affiliates, customers or Service users.

Supporting quotations

7.1.5. Compliance with Law: To the extent permitted by law, eCW will disclose Personal Information to government authorities or third parties pursuant to a legal request, subpoena, or other legal process. eCW may also use or disclose your Personal Information as permitted by law to perform charge verifications, apply, or enforce the Service's Terms of Use or Terms and Conditions, or protect eCW's rights, interests, or property as well as those of eCW affiliates, customers, or Service users

Qualifications & exceptions

• The clause is qualified by “to the extent permitted by law”.
• The protections extend to affiliates’, customers’ and Service users’ rights and property, not only eCW’s.

Not stated here

• Notice to the reader before a legal-process disclosure is not described in this clause.

Sharing & Disclosure · Permission or license

Personal Information may be transferred to a third party in a sale, merger or transfer

If eCW sells all or part of its business, makes a sale or transfer of assets, or is otherwise involved in a merger or business transfer, it may transfer Personal Information to a third party as part of that transaction.

Supporting quotations

7.1.6. Business Transaction: If eCW sells all or part of its business or makes a sale or transfer of assets or is otherwise involved in a merger or business transfer, eCW may transfer your Personal Information to a third party as part of that transaction.

Qualifications & exceptions

• Triggered by a sale or transfer of the business or assets, or a merger or business transfer.

Not stated here

• Whether the recipient must honour the same commitments after transfer is not stated here.

Sharing & Disclosure · Permission or license

eCW disclaims traditional sale but shares data with advertising and marketing partners

eCW says it does not generally sell Personal Information as “sell” is traditionally understood, meaning an exchange of a good or service in return for money, but that it may disclose certain Personal Information to advertising and marketing partners, generally though not exclusively in hashed or pseudonymized form, to support its marketing activities and to offer services it believes may interest the reader.

Supporting quotations

7.1.7. Sell or Sharing of Data: eCW does not generally sell your Personal Information as the term "sell" is traditionally understood (i.e., an exchange of a good or service in return for money). However, we may disclose certain Personal Information to advertising and marketing partners generally but not exclusively in hashed or pseudonymized form. We do so in order to support our marketing activities and to provide you with offers of services that we believe you may be interested in.

Qualifications & exceptions

• The no-sale statement is qualified by “generally” and tied to a money-for-data understanding of sale.
• Hashed or pseudonymized form applies generally but not exclusively.

Not stated here

• Which marketing partners receive the data is not identified in this paragraph.

Sharing & Disclosure · Restriction or exception

Text messaging originator opt-in data and consent are not shared with third parties

Notwithstanding the preceding disclosure reasons, eCW states that text messaging originator opt-in data and consent will not be shared with third parties.

Supporting quotations

7.1.8 Text Messaging Originator Opt-In Data and Consent. Notwithstanding the foregoing, text messaging originator opt-in data and consent will not be shared with third parties.

Qualifications & exceptions

• Stated as an override of the disclosure reasons that precede it.
• The limitation covers opt-in data and consent, not message content generally.

Not stated here

• Which messaging programmes the clause covers is not identified.

Sharing & Disclosure · Company practice

Third-party advertisers may collect Site data to measure and personalize ads

eCW may enter into relationships with third-party advertising companies to drive traffic to and serve ads on its Site. Those companies may also collect information through the Data Collection Technologies described in Section 6 to measure the effectiveness of their ads and to personalize advertising content. eCW points to the Network Advertising Initiative for information about ad networks and how to opt out of their collection, and says it does not use such providers on its Portals.

Supporting quotations

eCW may enter into relationships with third-party advertising companies to drive traffic to and serve ads on our Site. These third-party companies may also collect information through Data Collection Technologies described in Section 6 to measure the effectiveness of their ads and to personalize advertising content. The Network Advertising Initiative offers useful information about Internet advertising companies (also called "ad networks" or "network advertisers"), including information about how to opt-out of their information collection. We do not use such providers on our Portals.

Qualifications & exceptions

• Collection by the advertising companies is described as possible (“may also collect”).
• The Portals are excluded from these third-party advertising arrangements.

Not stated here

• How the advertising companies use the data beyond ad measurement and personalization is not described.

Use & Processing · User right or choice

Marketing opt-out is available, but non-marketing messages continue

Readers may opt out of receiving marketing communications by following the instructions in a communication or by contacting eCW through the Contact Information section. If they opt out, eCW may still send non-marketing communications, such as those about the account or the ongoing business relationship.

Supporting quotations

8.1. You may opt-out of receiving marketing communications from us by following the instructions included in such a communication or by contacting us as provided in the Contact Information Section 17. If you opt out, we may still send you non-marketing communications, such as those about your account or our ongoing business relationship.

Qualifications & exceptions

• The opt-out is limited to marketing communications; service messages continue.
• Opt-out can be exercised through the message itself or by contacting eCW.

Not stated here

• Whether opt-out covers marketing through channels other than e-mail is not stated here.

Use & Processing · User right or choice

Readers may review and request changes to their Personal Information on contact

eCW says a reader may review and request changes to the Personal Information it has collected about the reader by contacting it through the Contact Information section. The mechanism is a request to eCW rather than a self-service account tool.

Supporting quotations

8.2. You may review and request changes to the Personal Information we have collected about you by contacting us as provided in the Contact Information Section 17 below.

Qualifications & exceptions

• The route given is contact with eCW under Section 17.

Not stated here

• The policy does not state a response time or any limits on access in this section.

Data Access & Collection · Company practice

Biometric data such as fingerprints or facial scans may be collected to verify identity

In connection with the Services, eCW may collect or store biometric data such as fingerprints or facial geometry scans that may identify the reader, used for authentication and verification of identity, and it notes that this information may be biometric data under laws governing its collection, use, storage and disclosure. eCW says that by providing the information the reader acknowledges having been advised of and understanding that eCW and its agents and contractors may collect, use, store and disclose biometric data for the purposes described in the policy or otherwise described in the Services.

Supporting quotations

In connection with the Services, eCW may collect or store biometric data, such as fingerprints or facial geometry scans that may identify you, which are used for authentication and verification of your identity. This information may be biometric data under certain laws governing the collection, use, storage, and disclosure of biometric data. By providing such information, you acknowledge that you have been advised of, and understand that, eCW, and its agents and contractors, may collect, use, store, and disclose biometric data for the purposes described in this Privacy Policy, or as otherwise described in the Services.

Qualifications & exceptions

• Consent is expressed through providing the information and the accompanying acknowledgement rather than a separate signature in this text.
• Agents and contractors are included in the permitted handling.

Not stated here

• Which specific Services use biometric data is not identified.

Sharing & Disclosure · Company commitment

eCW will not sell, lease or trade biometric information

eCW states that it will not sell, lease or trade the reader’s biometric information. The commitment is stated absolutely, without the qualifications attached to the policy’s general no-sale statement.

Supporting quotations

We will not sell, lease, or trade your biometric information.

Qualifications & exceptions

• Three verbs are used: sell, lease and trade.

Security & Safeguards · Company commitment

Biometric data is deleted at the first of three triggers, with a PHI carve-out

eCW says it retains biometric data only until the first of the following occurs, at which point the data is scheduled for deletion: the purposes outlined in Section 9 have been satisfied, a date of deletion required by applicable law, or three years have passed since the reader’s last interaction with the Services. Two qualifications follow: eCW will not delete biometric data that is PHI unless the applicable Provider requests it, and apart from that case the collection, use, storage, disclosure and retention of biometric PHI is governed by Section 4 and any applicable Customer Documents rather than by Section 9.

Supporting quotations

We will retain such biometric data only until the occurrence of the first of the following, at which point the data will be scheduled for deletion: (a) the purposes outlined in this Section 9 have been satisfied, (b) any date of deletion required by applicable law, or (c) three (3) years have passed since your last interaction with our Services. Notwithstanding the foregoing, (1) eCW will not delete biometric data that is PHI unless requested by the applicable Provider, and (2) except as provided in subsection (1), the collection, use, storage, disclosure, and retention of biometric data that is PHI through the use of any of the Services shall be governed by Section 4 of this Privacy Policy and any applicable Customer Documents, not by this Section 9.

Qualifications & exceptions

• Deletion is triggered by the earliest of the three events.
• The retention commitment is displaced for PHI, which follows the Provider’s instruction and Section 4.

Not stated here

• What “scheduled for deletion” means operationally is not described.

Sharing & Disclosure · Context

Disclosure is framed as occurring for an enumerated list of reasons

The disclosure section is introduced by a single sentence saying eCW may disclose Personal Information for the following reasons, after which each reason is stated in its own subsection, from at-your-request disclosure through to text messaging opt-in data. The policy presents disclosure as purpose-bound by that list, though it does not say the list is exhaustive.

Supporting quotations

We may disclose your Personal Information for the following reasons:

Qualifications & exceptions

• The introduction does not state that the listed reasons are the only permitted disclosures.

Not stated here

• No general prohibition on disclosure outside the list appears in this section.

Security & Safeguards · Company commitment

eCW claims reasonable safeguards while conceding no system is perfect

eCW says it has reasonable and appropriate safeguards in place to help protect collected Personal Information from loss, misuse and unauthorized access, disclosure, alteration and destruction. It immediately qualifies this by saying that although it attempts to protect the information in its possession, no security system is perfect and it cannot promise that Personal Information will remain absolutely secure in all circumstances.

Supporting quotations

eCW has reasonable and appropriate safeguards in place to help protect the Personal Information eCW collects from loss, misuse, and unauthorized access, disclosure, alteration, and destruction. Although eCW attempts to protect the Personal Information in our possession, no security system is perfect, and eCW cannot promise that your Personal Information will remain absolutely secure in all circumstances.

Qualifications & exceptions

• The safeguard commitment is framed as “reasonable and appropriate” rather than as a guarantee.
• The paragraph expressly disclaims absolute security in all circumstances.

Not stated here

• No specific standard, certification or control set is named here.

Security & Safeguards · Company practice

Retention lasts as long as needed for purposes, business needs and legal obligations

eCW says it will retain Personal Information as needed to fulfil the purposes for which it was collected, and as necessary to comply with its business requirements and legal obligations, resolve disputes, protect its assets and enforce its agreements. It points California residents to a separate Privacy Notice for California Residents for further retention detail.

Supporting quotations

eCW will retain your Personal Information as needed to fulfill the purposes for which it was collected. eCW will retain and use your Personal Information as necessary to comply with eCW's business requirements, legal obligations, resolve disputes, protect our assets, and enforce our agreements. Additional information for California residents about our data retention practices is available in our Privacy Notice for California Residents.

Qualifications & exceptions

• Retention is framed by purpose and by the listed business and legal needs, without fixed periods here.

Not stated here

• The retention periods themselves are not stated in this section.

Sharing & Disclosure · Company practice

Aggregated information said not to identify individuals is shared with business partners

eCW may provide aggregated information related to the reader’s Personal Information to some of its business partners, saying the information is used in a collective manner and does not identify the reader individually in any way.

Supporting quotations

eCW may provide aggregated information related to your Personal Information to some of eCW's business partners. This information is used in a collective manner and does not identify you individually in any way.

Qualifications & exceptions

• The reassurance rests on the aggregation claim rather than on a described de-identification method.

Not stated here

• The policy does not define what aggregation technique is used or whether re-identification is prohibited.

Legal Rights & Agreement Rules · Restriction or exception

Aggregated or de-identified PHI is created or disclosed only as the Provider authorizes

Where the reader is a patient of a Provider, eCW says it may only create, use or disclose aggregated or certain de-identified PHI as authorized by the Provider in the Customer Documents. Patient data is therefore carved out of the general aggregated-information sharing described in the same section.

Supporting quotations

If you are a patient of a Provider, we may only create, use or disclose aggregated or certain de-identified PHI as authorized by your Provider in the Customer Documents.

Qualifications & exceptions

• Applies only to PHI of Provider patients.
• Authorization comes from the Provider through the Customer Documents, not from the patient directly.

Not stated here

• The Customer Documents themselves are not reproduced.

Legal Rights & Agreement Rules · Restriction or exception

Third-party links are provided for convenience, with eCW disclaiming responsibility

eCW says its Sites may contain links to third-party websites, that it is not responsible or liable for the privacy practices or content found on those websites, and that readers should check each website’s privacy notice and policies. Links are described as provided solely for convenience, and any use of or submission of data to such websites is said to be at the reader’s sole risk.

Supporting quotations

Our Sites may contain certain links to third party websites. eCW is not responsible or liable for the privacy practices or content found on these websites. You should check the privacy notice and policies of each website you visit. Links to third party websites are provided solely for your convenience and any use or submission of data to such websites shall be at your sole risk.

Qualifications & exceptions

• Disclaims responsibility and liability for third-party practices and content.
• Places the risk of using linked sites on the reader.

Not stated here

• Whether any linked site is operated by an eCW affiliate is not addressed here.

Data Access & Collection · Restriction or exception

Sites are not directed at under-18s and eCW does not knowingly collect their data

eCW says the Sites are not directed toward individuals under the age of 18, that it does not promote the Sites to them, and that it does not knowingly collect Personal Information through the Sites from individuals under 18. Access to the Portals is said to be governed separately by the Portals’ posted Terms of Use.

Supporting quotations

Our Sites are not directed toward individuals under the age of 18. We do not promote our Sites to individuals under 18, and we do not knowingly collect any Personal Information through our Sites from individuals under 18. Access to our Portals is separately governed by the Portals' posted Terms of Use.

Qualifications & exceptions

• The threshold is 18 rather than the 13 used in some children’s privacy regimes.
• The limitation is stated for Personal Information collected through the Sites.

Not stated here

• What eCW does if it learns it has collected data from a person under 18 is not stated here.

Use & Processing · Permission or license

Services are for the United States, and use is treated as authorizing US processing

The Services are said to be intended for use only in the United States of America. A reader using the Services or contacting eCW from outside the United States is advised that information provided or automatically collected will be transferred to the United States, and that by using the Services or submitting information the reader explicitly authorizes that transfer and subsequent processing in the United States in accordance with the policy.

Supporting quotations

The Services are intended for use only in the United States of America. If you use the Services or contact us from outside of the United States of America, please be advised that (i) any information you provide to us or that we automatically collect will be transferred to the United States of America; and (ii) by using the Services or submitting information, you explicitly authorize its transfer to and subsequent processing in the United States of America in accordance with this Privacy Policy.

Qualifications & exceptions

• Authorisation for transfer is inferred from using the Services or submitting information.
• The paragraph addresses only transfer into the United States, not transfers out of it.

Not stated here

• Whether other safeguards apply to the transfer is not stated here.

Legal Rights & Agreement Rules · Company practice

The policy may change at any time, effective on the last updated date

eCW may change the policy at any time, and unless it says otherwise changes take effect on the last updated date shown at the top of the policy. Readers are told to check the policy regularly, and eCW says it may try to notify material changes by posting a notice on the Services, by e-mail if an address has been provided, or by other reasonable methods. Notification of material changes is framed as something eCW may attempt rather than something it guarantees.

Supporting quotations

eCW may change this Privacy Policy at any time. Unless we say otherwise, changes will be effective upon the last updated date at the top of this Privacy Policy. Please check this Privacy Policy regularly to ensure that you are aware of any changes. We may try to notify you of material changes to this Privacy Policy, which if we do so may be by means such as by posting a notice directly on the Services, by sending an e-mail notification (if you have provided your e-mail address to us), or by other reasonable methods.

Qualifications & exceptions

• Change notice is discretionary (“we may try to notify you”).
• The effective date defaults to the last updated date unless eCW says otherwise.

Not stated here

• What counts as a material change is not defined.

Legal Rights & Agreement Rules · Restriction or exception

Using the Services after a change is treated as acceptance of the change

The policy says that if a reader uses the Services after changes to the policy, the reader has accepted the changes, and that a reader who does not agree with the changes should stop using the Services. Acceptance is therefore tied to continued use rather than to an affirmative action.

Supporting quotations

In any event, if you use the Services after changes to this Privacy Policy, you have accepted the changes. If you do not agree with the changes, please stop using the Services.

Qualifications & exceptions

• Acceptance arises from continued use.
• The stated remedy for disagreement is to stop using the Services.

Not stated here

• Whether a reader can reject a change while continuing to use some Services is not addressed.

Legal Rights & Agreement Rules · Context

Privacy questions and incident reports go to the Chief Privacy Officer in Westborough

Readers with questions or concerns about the policy, or who need to report a privacy incident, are directed to the eCW Chief Privacy Officer at eClinicalWorks, LLC, 2 Technology Drive, Westborough, MA 01581, marked for the attention of the Chief Privacy Officer, using the privacy-office contact given in that block.

Supporting quotations

If you have any questions or concerns related to this Privacy Policy or if you need to report a Privacy incident, please contact the eCW Chief Privacy Officer at:

eClinicalWorks, LLC 2 Technology Drive Westborough, MA 01581 Attn: Chief Privacy Officer privacy-office

Not stated here

• The contact block in the source ends with the local part of the address, so the full e-mail address is not reproduced in the evidence.

Security & Safeguards · Context

Security questions and incident reports go to the Chief Information Security Officer

Separately, readers with security questions or concerns, or who need to report a security incident, are directed to the eCW Chief Information Security Officer at the same Westborough address, marked for that officer, using the ciso.office contact given in the block.

Supporting quotations

If you have any questions or concerns related to Security or if you need to report a Security incident, please contact the eCW Chief Information Security Officer at:

eClinicalWorks, LLC 2 Technology Drive Westborough, MA 01581 Attn: Chief Information Security Officer ciso.office

Not stated here

• The contact block in the source ends with the local part of the address, so the full e-mail address is not reproduced in the evidence.

Legal Rights & Agreement Rules · Restriction or exception

Contact addresses monitor only privacy and security matters, and Portal help goes to the Provider

The published addresses are monitored only for privacy- and security-related inquiries, and a patient with a question about accessing the Patient Portal is told to contact their healthcare provider. The limitation channels patient access questions away from the privacy and security contacts.

Supporting quotations

These e-mail addresses are monitored only for privacy- and security-related inquiries. If you are a patient and have a question related to accessing the Patient Portal, please contact your healthcare provider.

Qualifications & exceptions

• The monitoring limitation applies to the privacy and security addresses.

Not stated here

• Where non-privacy inquiries should be directed is not stated in this block.

Security & Safeguards · Company commitment

Breach notices go to account contact details unless law requires another method

Where applicable law requires notice of known or suspected security breaches affecting the reader’s Personal Information, eCW says it will send breach notices to the contact information in the reader’s account unless the law requires a different method. For other events involving information about the reader, it may contact the reader by e-mail, telephone or mail.

Supporting quotations

Pursuant to applicable law, eCW may be required to send you notice of known or suspected security breaches that impact your Personal Information. In the event that eCW must provide a notice of a security breach to you, eCW will send security breach notices to the contact information contained in your account information unless eCW is required by law to notify you using another method. Otherwise, if eCW needs, or is required, to contact you concerning any event that involves information about you we may do so by e-mail, telephone, or mail.

Qualifications & exceptions

• The notice obligation is framed by what applicable law requires.
• The default channel is the account contact information.

Not stated here

• Timing of breach notices is not specified in this paragraph.

Legal Rights & Agreement Rules · Context

The California notice carries its own effective and last-updated dates

The Privacy Notice for California Residents states an effective date of January 1, 2023 and a last updated date of June 6, 2025, separately from any dates stated for the main privacy policy.

Supporting quotations

Effective Date: January 1, 2023 Last Updated: June 6, 2025

Not stated here

• The notice does not explain how its dates relate to the dates on the main policy.

Legal Rights & Agreement Rules · Context

The notice supplements the policy for California residents to comply with CCPA/CPRA

The notice is described as supplementing the privacy policy and applying to all visitors to the Site and others who reside in California. eCW says it adopts the notice to comply with the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020, and that terms defined in the CCPA/CPRA carry the same meaning in the notice.

Supporting quotations

This Privacy Notice for California Residents (this "Notice") supplements the information contained in this Privacy Policy and applies to all visitors to our Site, users and others who reside in the State of California ("you" or as the context requires "your"). We adopt this notice to comply with the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 ("CCPA/CPRA"), and any terms defined in the CCPA/CPRA have the same meaning when used in this Notice.

Qualifications & exceptions

• Scope is limited to California residents.
• Statutory terms are incorporated by reference rather than redefined.

Not stated here

• The notice does not state how a conflict with the main policy would be resolved beyond describing itself as a supplement.

Data Access & Collection · Context

CCPA/CPRA Personal Information covers data linked to a consumer or household

CCPA/CPRA Personal Information is defined as information eCW collects through a user’s interactions with the Services that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

Supporting quotations

Through a user's interactions with our Services, eCW collects information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household ("CCPA/CPRA Personal Information"). CCPA/CPRA Personal Information does not include:

Qualifications & exceptions

• The definition extends to household-level linkage, not only individuals.
• Collection is described as occurring through interactions with the Services.

Legal Rights & Agreement Rules · Restriction or exception

Public, de-identified and HIPAA-covered data are excluded from the California definition

The notice excludes from CCPA/CPRA Personal Information publicly available information and lawfully obtained truthful information that is a matter of public concern, de-identified or aggregated consumer information, and information excluded from the statute’s scope, giving the example of PHI and health or medical information covered by HIPAA and the California Confidentiality of Medical Information Act, and clinical trial data.

Supporting quotations

Publicly available information or lawfully obtained, truthful information that is a matter of public concern;

De-identified or aggregated consumer information; or

Certain information excluded from the CCPA/CPRA's scope, such as PHI, health or medical information covered by HIPAA and the California Confidentiality of Medical Information Act ("CMIA") or clinical trial data.

Qualifications & exceptions

• The exclusion for scope-covered information is illustrated by HIPAA, CMIA and clinical trial data.

Not stated here

• Whether the exclusions match the statutory text exactly is not verifiable from the notice alone.

Data Access & Collection · Company practice

Identifiers collected include names, government IDs, contact details and provider identifiers

The categories table lists identifiers with examples including a real name, alias, postal address, unique personal identifiers, Internet Protocol address, e-mail address, account name, Social Security number, driver’s license or state identification number, passport number, telephone and fax numbers, username, National Provider Identifier and APU ID, or other similar identifiers.

Supporting quotations

Identifiers A real name, alias, postal address, unique personal identifiers, Internet Protocol address, e-mail address, account name, Social Security number, driver's license or state identification number, passport number, telephone number, fax number, username, National Provider Identifier (NPI), APU ID, or other similar identifiers

Qualifications & exceptions

• The listed items are examples of the category.

Data Access & Collection · Company practice

The California customer-records category covers financial, medical and insurance data

The table lists the personal information categories in the California Customer Records statute, with examples including name, signature, Social Security number, physical characteristics or description, address, telephone and passport numbers, driver’s license or state identification card number, insurance policy number, education, employment and employment history, bank, credit card and debit card numbers, other financial information, medical information and health insurance information. The notice adds that items in this category may overlap with other categories.

Supporting quotations

Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)) A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.

Note that some CCPA/CPRA Personal Information included in this category may overlap with other categories.

Qualifications & exceptions

• Includes medical information and health insurance information as examples within this category.
• Overlap with other table categories is acknowledged.

Data Access & Collection · Company practice

Biometric collection is tied to biometric authentication integration in the Services

For biometric information the table says that if the reader has a biometric authentication integration as part of eCW’s Services, eCW may collect information concerning fingerprints, faceprints, voiceprints and iris or retina scans. The collection is conditioned on that integration being part of the Services.

Supporting quotations

Biometric information If you have biometric authentication integration as part of eCW's Services, then we may collect information concerning your fingerprints, faceprints, voiceprints, and iris or retina scans.

Qualifications & exceptions

• Conditioned on the reader having a biometric authentication integration as part of the Services.
• Biological identifiers listed are fingerprints, faceprints, voiceprints and iris or retina scans.

Data Access & Collection · Company practice

Internet activity covers browsing, search, page views and conversions

The Internet or other similar network activity category lists browsing history, search history, information on a consumer’s interaction with a website, application or advertisement, page views, first and recent conversion, domain name and hosting space.

Supporting quotations

Internet or other similar network activity Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement, page views, first and recent conversion, domain name, and hosting space

Not stated here

• The entry does not say which of these fields are collected on the Sites as opposed to customer applications.

Data Access & Collection · Company practice

Geolocation data comes from conference events, applications and IP-based location

Geolocation data is described as gathered from attendees at eCW conference events and from users of its applications, including the conference event application, and as derived from IP address where associated with a geographic location.

Supporting quotations

Geolocation data Geolocation data from attendees at our conference events, users of our applications, including conference event application, and based on IP address, where associated with a geographic location

Qualifications & exceptions

• IP-derived location is included where it is associated with a geographic location.

Data Access & Collection · Company practice

Audio, visual and similar data include call recordings, photos and videos

The audio, electronic, visual, thermal, olfactory or similar information category is illustrated with call recordings, photographs such as those from practices or depicting providers or staff, videos from practices, and photos and videos relating to marketing.

Supporting quotations

Audio, electronic, visual, thermal, olfactory, or similar information Call recordings, photographs such as from practices or depicting providers or staff, videos from practices, photos and videos relating to marketing

Qualifications & exceptions

• Illustrated by examples rather than a closed list.

Data Access & Collection · Company practice

Professional and employment data include role, job history and practice details

Professional or employment-related information is described as current or past job-related information including role, job history and performance evaluation data, information related to a particular company or practice, and NPI.

Supporting quotations

Professional or employment-related information Current or past job-related information, including role, job history, and performance evaluation data; information related to a particular company or practice; NPI

Qualifications & exceptions

• Performance evaluation data appears in this category.

Data Access & Collection · Company practice

Education information covers credentials, institution and graduation year

Education information is described as education credentials, the school or university attended, and year of graduation.

Supporting quotations

Education information Education credentials; school or university attended; year of graduation

Data Access & Collection · Company practice

Inferences include profiles of preferences, behaviour and abilities

The table lists inferences drawn from the other categories to create a profile about a consumer reflecting preferences, characteristics, psychological trends, predispositions, behaviour, attitudes, intelligence, abilities and aptitudes, with the examples repeating that profile description.

Supporting quotations

Inferences drawn from any of the information identified in this table to create a profile about a consumer reflecting the consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

Qualifications & exceptions

• The category is expressly built on the other listed categories.

Data Access & Collection · Context

Sensitive personal information in the table is limited to licence numbers and passwords

The sensitive personal information row lists a driver’s license or state identification number and account passwords. The examples given are narrower than the main policy’s description of Sensitive Personal Information, which also refers to gender, marriage status, race or ethnicity and veteran or disability status.

Supporting quotations

Sensitive personal information Driver's license or state identification number; account passwords

Qualifications & exceptions

• The row gives two examples rather than a full statutory enumeration.

Not stated here

• Why the table’s examples differ from the policy definition is not explained.

Data Access & Collection · Company practice

Other collected information includes event, customer, testimonial and policy-described data

The table closes with an other category covering information the reader provides about attending an eCW event, customer information regarding products and services, testimonials, and other information as described in the privacy policy.

Supporting quotations

Other Information you provide us regarding your attending an eCW event; customer information regarding products and services; testimonials; other information as described in this Privacy Policy.

Qualifications & exceptions

• The final element is a catch-all referring back to the privacy policy.

Data Access & Collection · Company practice

California sources include information given directly and collected automatically

The notice lists the categories of sources from which CCPA/CPRA Personal Information is collected, beginning with information provided directly by the reader and information collected indirectly, which it describes as including information collected in the course of delivering services and information collected automatically through use of its website or other services.

Supporting quotations

Directly from you

Indirectly from you, which includes information collected in course of delivering services and information collected automatically through use of our website or other services

Qualifications & exceptions

• Indirect collection expressly includes data gathered while delivering services, not only website tracking.

Data Access & Collection · Company practice

Sources also include integrations, providers, payors, authorities and purchased data

Further listed sources are third-party applications integrated with eCW’s CRM software, other third parties that interact with eCW in connection with the services it performs, medical providers, third-party payors and government authorities, data brokers or resellers from which eCW purchases data to supplement the information it collects, employees and prospective employees, and other vendors or suppliers.

Supporting quotations

Third-party applications integrated with our CRM software

Other third parties that interact with us in connection with the services we perform

Medical providers, third-party payors, and government authorities

Data brokers or resellers from which we purchase data to supplement the information we collect

Employees and prospective employees

Other vendors/suppliers

Qualifications & exceptions

• Includes data purchased from brokers or resellers to supplement collected information.
• Employees and prospective employees appear as a source category.

Not stated here

• The notice does not identify which brokers or providers supply data.

Use & Processing · Company practice

The California notice restates the improvement, service and targeting purposes

Before its list of statutory business purposes, the notice says eCW uses CCPA/CPRA Personal Information to improve the reader’s experience with the Services, to provide the Services and to communicate about requested information, and that it may use the information to help target specific offers and to develop and improve the Services. It then introduces a list of business or commercial purposes for which the information may be used.

Supporting quotations

eCW uses the CCPA/CPRA Personal Information collected in an effort to improve your experience with the Services, to provide the Services to you and to communicate with you about information that you request. eCW may also use CCPA/CPRA Personal Information to help target specific offers to you and to help eCW develop and improve its Services. Additionally, eCW may use Your CCPA/CPRA Personal Information for one or more of the following business or commercial purposes:

Qualifications & exceptions

• Targeting offers is framed as a possible use (“may also use”).

Not stated here

• The notice does not say whether the list that follows is exhaustive of its purposes.

Account & Service Control · Company practice

California business purposes include answering requests and administering accounts

The business-purpose list includes responding to user service requests, administering user accounts and responding to the reader’s questions and concerns. These administrative purposes appear as three separate entries in the list.

Supporting quotations

Respond to user service requests

Administer user accounts

Respond to your questions and concerns

Not stated here

• The entries are stated as purpose labels without further description.

Use & Processing · Company practice

Providing service to Provider customers is a listed California business purpose

Providing service to eCW’s customers, which include Providers, is one of the listed business or commercial purposes. The entry is stated without limiting language about patient data.

Supporting quotations

Provide service to our customers, which include Providers

Use & Processing · Company practice

Marketing products, services and events is a listed California business purpose

Marketing and communicating about eCW’s products, services, events and other offerings appears as a business or commercial purpose in the list.

Supporting quotations

Market and communicate about our products, services, events, and other offerings

Use & Processing · Company practice

Vendor and partner diligence and relationship administration are listed purposes

Conducting diligence regarding eCW’s vendors and partners and administering vendor and partner relationships is listed as a business or commercial purpose. The entry extends the stated uses to due-diligence activity about business counterparties.

Supporting quotations

Conduct diligence regarding our vendors and partners and administer vendor/partner relationships

Not stated here

• The notice does not say what information about vendors or partners is used.

Charges & Financial Obligations · Company practice

Payment processing, fees and billing are listed California business purposes

Processing payments, administering fees, providing invoices and resolving billing issues appear together as one business or commercial purpose in the list.

Supporting quotations

Process payments, administer fees, provide users with invoices, or resolve billing issues

Use & Processing · Company practice

Research and analysis is a listed California business purpose without stated conditions

Conducting research and analysis is a listed business or commercial purpose. Unlike the general use section, which conditions identifiable research use on consent or uses of de-identified or aggregate data, this entry carries no stated condition.

Supporting quotations

Conduct research and analysis

Qualifications & exceptions

• The entry is stated without the consent or de-identification conditions used in the general use section.

Not stated here

• Whether the general section’s conditions still apply to this entry is not stated.

Legal Rights & Agreement Rules · Company practice

Legal obligations and enforcing contract rights are listed California purposes

Carrying out eCW’s legal obligations and enforcing company rights arising from contracts to which it is a party is a listed business or commercial purpose.

Supporting quotations

Carry out our legal obligations and enforce Company rights arising from any contracts to which we are a party

Legal Rights & Agreement Rules · Company practice

Protecting rights, property or safety and answering law enforcement are listed purposes

The list includes uses necessary and appropriate to protect the rights, property or safety of eCW, its customers or others, and responding to law enforcement requests as required by applicable law, court order or governmental regulations.

Supporting quotations

As necessary and appropriate to protect the rights, property or safety of eCW, our customers or others

Respond to law enforcement requests as required by applicable law, court order, or governmental regulations

Qualifications & exceptions

• The safety purpose extends to customers and third parties, not only eCW.
• The law-enforcement purpose is conditioned on what the law, a court order or regulations require.

Use & Processing · Company practice

Personalizing and developing offerings and maintaining service quality are listed purposes

Two further entries cover providing, supporting, personalizing and developing eCW’s products, services, events and other offerings, and undertaking activities to verify or maintain the quality or safety of a service and to improve, upgrade or enhance it.

Supporting quotations

Provide, support, personalize, and develop our products, services, events, and other offerings

Undertake activities to verify or maintain the quality or safety of a service of the business and to improve, upgrade, or enhance such services

Security & Safeguards · Company practice

Security, integrity and detecting or prosecuting misconduct are listed purposes

The list includes helping maintain the safety, security and integrity of eCW’s website, products, services, databases and other technology assets and its business, and detecting security incidents, protecting against malicious, deceptive, fraudulent or illegal activity and assisting in the prosecution of those responsible.

Supporting quotations

Help maintain the safety, security, and integrity of our website, products and services, databases and other technology assets, and business

Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, and assist in the prosecution of those responsible for that activity

Qualifications & exceptions

• The incident purpose expressly extends to assisting prosecution.

Not stated here

• The notice does not describe the security measures or how incidents are detected.

Use & Processing · Permission or license

Purposes also include those disclosed at collection or otherwise set out in the statute

The list ends with a residual entry covering uses as described to the reader when the CCPA/CPRA Personal Information was collected, or as otherwise set forth in the CCPA/CPRA. The residual entry leaves room for purposes stated at the point of collection.

Supporting quotations

As described to you when collecting your CCPA/CPRA Personal Information or as otherwise set forth in the CCPA/CPRA

Qualifications & exceptions

• The entry is open-ended by reference to point-of-collection descriptions and the statute.

Not stated here

• Which point-of-collection notices eCW uses is not shown in this section.

Legal Rights & Agreement Rules · Company practice

Verifying consumer privacy rights requests is a listed California purpose

Verifying certain consumer privacy rights requests appears as a business or commercial purpose, tying use of the information to the request-verification step of the rights process.

Supporting quotations

Verify certain consumer privacy rights requests

Sharing & Disclosure · Permission or license

eCW denies traditional sale but shares data with advertising and marketing partners

The California notice repeats that eCW does not generally sell CCPA/CPRA Personal Information as “sell” is traditionally understood, but that it may disclose certain CCPA/CPRA Personal Information to advertising and marketing partners, generally though not exclusively in hashed or pseudonymized form, to support marketing activities and offer services the reader may be interested in. It adds that it may use advertising technologies such as those described in the targeting-cookies and third-party advertising sections and will comply with applicable law including the CCPA/CPRA, and that a reader or authorised representative may opt out of sale or sharing by using the “Your Privacy Choices” section of the website.

Supporting quotations

eCW does not generally sell CCPA/CPRA Personal Information as the term "sell" is traditionally understood (i.e., an exchange of a good or service in return for money). However, we may disclose certain CCPA/CPRA Personal Information to advertising and marketing partners generally but not exclusively in hashed or pseudonymized form. We do so in order to support our marketing activities and to provide you with offers of services that we believe you may be interested in.

To exercise the right to opt-out of the sale or sharing of your CCPA/CPRA Personal Information, you (or your authorized representative) may submit a request to us by visiting the "Your Privacy Choices" section of our website.

Qualifications & exceptions

• The no-sale statement is qualified by “generally” and by a money-for-data understanding of sale.
• Hashed or pseudonymized form applies generally but not exclusively.
• Opt-out covers both sale and sharing and is exercised through the website rather than by a single named link here.

Not stated here

• The notice does not name the advertising and marketing partners.

Sharing & Disclosure · Company commitment

eCW states no actual knowledge of selling or sharing data of consumers under 16

The notice states that eCW has no actual knowledge that it sells CCPA/CPRA Personal Information of consumers under 16 years of age to non-service provider third parties, and no actual knowledge that it shares such information with those parties. The statement is framed as absence of knowledge rather than as a prohibition or an opt-in regime.

Supporting quotations

eCW has no actual knowledge that it sells CCPA/CPRA Personal Information of consumers under 16 years of age to non-service provider third parties.

Qualifications & exceptions

• Limited to non-service provider third parties.
• Framed as absence of actual knowledge, not as a guarantee.

Not stated here

• The notice does not describe any age-verification or opt-in process for minors in this paragraph.

Sharing & Disclosure · Company practice

Identifiers and internet activity are shared with advertising and marketing partners

The sharing table lists two categories shared with advertising and marketing partners: identifiers, and internet and other similar network activity.

Supporting quotations

Identifiers Advertising and marketing partners

Internet and other similar network activity Advertising and marketing partners

Qualifications & exceptions

• The third-party recipient column names advertising and marketing partners for both rows.

Sharing & Disclosure · Company practice

The stated purpose for that sharing is marketing and communicating about offerings

The purpose given for the sharing of those categories is to market and communicate about eCW’s products, services, events and other offerings.

Supporting quotations

To market and communicate about our products, services, events, and other offerings

Sharing & Disclosure · Company practice

Disclosure recipients include affiliates, providers, payors, patients and authorities

To facilitate the provision of Services and to comply with applicable law, eCW says it may disclose CCPA/CPRA Personal Information to third parties such as its affiliates, its service providers, other medical providers, third-party payors or clearinghouses, patients, government authorities, third parties providing the services the reader contracted for, third parties the reader or the reader’s agents authorize or to which disclosure is needed to provide services, and third parties needed to comply with applicable law such as law enforcement.

Supporting quotations

To facilitate the provision of Services to you and to comply with applicable law, we may disclose Your CCPA/CPRA Personal Information to third parties such as our affiliates; our service providers; other medical providers, third party payors, or clearinghouses; patients; government authorities; third parties for providing the services for which you have contracted; third parties to whom you or your agents authorize us to disclose your CCPA/CPRA Personal Information or to which we must provide your CCPA/CPRA Personal Information to provide services to you; and third parties to comply with applicable law, such as law enforcement.

Qualifications & exceptions

• The recipient list is introduced by “such as”.
• Patients appear as a recipient category.
• Disclosure is framed around facilitating Services and legal compliance.

Not stated here

• Which recipient receives which data elements is shown only in the following table.

Sharing & Disclosure · Company practice

The disclosure table maps identifiers and customer-record data to the same recipient set

The disclosure table gives, for identifiers and for the categories described in California Civil Code section 1798.80(e), the recipients service providers, affiliates, third parties for providing contracted services, third parties the reader or its agents authorize, other medical providers, third-party payors or clearinghouses, and, for identifiers only, patients.

Supporting quotations

Identifiers Service Providers; Affiliates; Third parties for providing the services for which you have contracted; Third parties to whom you or your agents authorize us to disclose; Other medical providers, third party payors or clearinghouses; Patients

Categories described in Civ. Code § 1798.80(e) Service Providers; Affiliates; Third parties for providing the services for which you have contracted; Third parties to whom you or your agents authorize us to disclose; Other medical providers, third party payors or clearinghouses

Qualifications & exceptions

• Patients appear as recipients for identifiers but not for the customer-records category row quoted here.

Not stated here

• Rows for other categories are not included in this packet.

Sharing & Disclosure · Company practice

Most remaining table categories go to service providers, affiliates and authorized thirds

The disclosure table assigns protected-classification characteristics, internet or other electronic network activity, geolocation data, professional or employment-related information, education information and sensitive personal information to service providers, affiliates and third parties the reader or its agents authorize eCW to disclose to.

Supporting quotations

Characteristics of protected classifications under California or federal law Service Providers; Affiliates; Third parties to whom you or your agents authorize us to disclose

Internet or other electronic network activity information Service Providers; Affiliates; Third parties to whom you or your agents authorize us to disclose

Geolocation data Service Providers; Affiliates; Third parties to whom you or your agents authorize us to disclose

Professional or employment-related information Service Providers; Affiliates; Third parties to whom you or your agents authorize us to disclose

Education information Service Providers; Affiliates; Third parties to whom you or your agents authorize us to disclose

Sensitive personal information Service Providers; Affiliates; Third parties to whom you or your agents authorize us to disclose

Qualifications & exceptions

• The recipient set is identical across these six rows.
• Sensitive personal information appears in the same recipient set as ordinary categories.

Not stated here

• The table does not say what each recipient does with the disclosed data.

Sharing & Disclosure · Company practice

Biometric and audio-visual data go to a narrower set of recipients

Biometric information is disclosed only to service providers. Audio, electronic, visual, thermal, olfactory or similar information is disclosed to service providers and affiliates, without the further third-party and agent-authorized recipients listed for other categories.

Supporting quotations

Biometric information Service Providers

Audio, electronic, visual, thermal, olfactory, or similar information Service Providers; Affiliates

Qualifications & exceptions

• Biometric data has the narrowest recipient set in the rows quoted.
• Audio and visual information adds affiliates but no agent-authorized third parties.

Sharing & Disclosure · Company practice

Disclosure purposes repeat provision, marketing, billing and diligence purposes

The purposes given for disclosing CCPA/CPRA Personal Information are to provide, support, personalize and develop eCW’s products, services, events and other offerings, to provide service to its customers including Providers, to market and communicate about its offerings, to process payments and resolve billing issues, and to conduct diligence and administer vendor and partner relationships.

Supporting quotations

To provide, support, personalize, and develop our products, services, events, and other offerings

To provide service to our customers, which include Providers

To market and communicate about our products, services, events, and other offerings

To process payments, administer fees, provide users with invoices, or resolve billing issues

To conduct diligence regarding our vendors and partners and administer vendor/partner relationships

Qualifications & exceptions

• The list mirrors the earlier business-purpose list rather than adding new purposes.

Data Access & Collection · Company practice

The notice at collection covers online interactions including email, chat and portals

The notice says the CCPA/CPRA requires disclosures at or before collection of CCPA/CPRA Personal Information from California residents, and that the following notice at collection for online sources explains how eCW collects and uses, sells or shares and retains that information in the online context. The online context is described as interacting with the Services online, including communicating by e-mail or online chat window, completing or submitting forms on the Sites or Provider Portals, visiting the Sites, or interacting on social media.

Supporting quotations

The CCPA/CPRA requires us to provide certain disclosures at or before our collection of CCPA/CPRA Personal Information from California residents. The below CCPA/CPRA Notice at Collection for Online Sources provides you with information about how we collect and use, sell or share and retain your CCPA/CPRA Personal Information in the online context. When you use or interact with our Services online, including when you communicate with eCW by e-mail or online chat window, complete or submit forms to us on our Sites or Provider Portals, or when you visit our Sites or interact with us on social media, we may collect and use the following categories of information.

Qualifications & exceptions

• The notice-at-collection scope is limited to the online context.
• Channels named include e-mail, chat windows, Site and Provider Portal forms, and social media.

Not stated here

• The notice does not state how offline collection is disclosed.

Sharing & Disclosure · Company practice

Four categories are marked sold or shared for marketing with purposes-based retention

In the notice-at-collection table the identifiers row, the customer-records row, the internet or other similar network activity row and the professional or employment-related information row each answer the sold-or-shared column with “Yes, to Market and communicate about our products, services, events, and other offerings.” Each of those rows gives the same retention criteria: as necessary to fulfil the specified purposes for collection and use, or a reasonable time thereafter, or other compatible purposes including satisfying legal requirements.

Supporting quotations

Identifiers Market and communicate about our products, services, events, and other offerings Yes, to Market and communicate about our products, services, events, and other offerings. As necessary to fulfill the specified purposes for collection and use (or a reasonable time thereafter) or other compatible purposes including satisfying legal requirements.

Categories described in Civ. Code § 1798.80(e) Market and communicate about our products, services, events, and other offerings Yes, to Market and communicate about our products, services, events, and other offerings. As necessary to fulfill the specified purposes for collection and use (or a reasonable time thereafter) or other compatible purposes including satisfying legal requirements.

Internet or other similar network activity Market and communicate about our products, services, events, and other offerings Yes, to Market and communicate about our products, services, events, and other offerings. As necessary to fulfill the specified purposes for collection and use (or a reasonable time thereafter) or other compatible purposes including satisfying legal requirements.

Professional or employment-related information Administer user accounts Yes, to Market and communicate about our products, services, events, and other offerings. As necessary to fulfill the specified purposes for collection and use (or a reasonable time thereafter) or other compatible purposes including satisfying legal requirements.

Qualifications & exceptions

• Sale or sharing is asserted for marketing and communications purposes, matching the earlier sharing section.
• Retention is expressed as a criteria-based standard rather than a fixed period.

Not stated here

• The table gives no numeric retention period for any category.
• Whether the retention column differs for rows not quoted here is not yet known.

Data Access & Collection · Company practice

Identifiers are collected for marketing, accounts, diligence, research and service

The identifiers row of the notice-at-collection table lists as purposes for collection and use marketing and communicating about eCW’s products, services, events and other offerings, administering user accounts, conducting diligence regarding vendors and partners and administering those relationships, conducting research and analysis, providing, supporting, personalizing and developing offerings, and providing service to eCW’s customers including Providers.

Supporting quotations

Administer user accounts

Conduct diligence regarding our vendors and partners and administer vendor/partner relationships

Conduct research and analysis

Provide, support, personalize, and develop our products, services, events, and other offerings

Provide service to our customers, which include Providers

Qualifications & exceptions

• Vendor and partner diligence appears as a purpose for ordinary identifiers.

Data Access & Collection · Company practice

Customer-record data is collected for marketing, accounts, diligence, service and billing

The California customer-records row lists marketing and communications, administering user accounts, vendor and partner diligence, providing, supporting, personalizing and developing offerings, providing service to customers including Providers, and processing payments, administering fees, invoicing and resolving billing issues.

Supporting quotations

Administer user accounts

Conduct diligence regarding our vendors and partners and administer vendor/partner relationships

Provide, support, personalize, and develop our products, services, events, and other offerings

Provide service to our customers, which include Providers

Process payments, administer fees, provide users with invoices, or resolve billing issues

Qualifications & exceptions

• Adds payment and billing purposes that the identifiers row does not list.

Data Access & Collection · Company practice

Internet activity is collected for marketing and for research and analysis

The internet or other similar network activity row lists two purposes, marketing and communicating about eCW’s products, services, events and other offerings and conducting research and analysis.

Supporting quotations

Conduct research and analysis

Internet or other similar network activity Market and communicate about our products, services, events, and other offerings Yes, to Market and communicate about our products, services, events, and other offerings. As necessary to fulfill the specified purposes for collection and use (or a reasonable time thereafter) or other compatible purposes including satisfying legal requirements.

Qualifications & exceptions

• This row lists fewer purposes than the identifiers and customer-records rows.

Data Access & Collection · Company practice

Professional and employment data is collected for accounts, diligence, service and billing

The professional or employment-related information row lists administering user accounts, vendor and partner diligence, providing, supporting, personalizing and developing offerings, providing service to customers including Providers, processing payments and billing, and marketing and communications.

Supporting quotations

Conduct diligence regarding our vendors and partners and administer vendor/partner relationships

Provide, support, personalize, and develop our products, services, events, and other offerings

Provide service to our customers, which include Providers

Process payments, administer fees, provide users with invoices, or resolve billing issues

Market and communicate about our products, services, events, and other offering

Professional or employment-related information Administer user accounts Yes, to Market and communicate about our products, services, events, and other offerings. As necessary to fulfill the specified purposes for collection and use (or a reasonable time thereafter) or other compatible purposes including satisfying legal requirements.

Qualifications & exceptions

• The row’s purpose list includes account administration and billing alongside marketing.

Sharing & Disclosure · Company practice

The audio and visual row answers No to sale or sharing and repeats the retention criteria

The audio, electronic, visual, thermal, olfactory or similar information row of the notice-at-collection table answers the sold-or-shared column with “No”, and gives the same retention criteria as the rows answered “Yes”: as necessary to fulfil the specified purposes for collection and use or a reasonable time thereafter, or other compatible purposes including satisfying legal requirements.

Supporting quotations

Audio, electronic, visual, thermal, olfactory, or similar information Market and communicate about our products, services, events, and other offering No As necessary to fulfill the specified purposes for collection and use (or a reasonable time thereafter) or other compatible purposes including satisfying legal requirements.

Qualifications & exceptions

• This is the first quoted row whose sold-or-shared answer is No.
• Retention wording is identical to the rows answered Yes.

Not stated here

• The table does not explain why this category is excluded from sale or sharing.

Data Access & Collection · Company practice

Sensitive information collected online is limited to passwords and identification numbers

The notice says eCW may collect sensitive personal information from certain online sources, including password information gathered in the course of users accessing its registration system and driver’s licence and state identification numbers in some instances. The sentence is framed as “may collect” and names only these two examples.

Supporting quotations

eCW may collect sensitive personal information from certain online sources, including password information in the course of users accessing our registration system, and driver's license and state identification numbers in some instances.

Qualifications & exceptions

• Collection is framed as possible rather than certain.
• Identification numbers are qualified by “in some instances”.

Not stated here

• The notice does not enumerate all sensitive personal information collected online.

Legal Rights & Agreement Rules · Context

Consumer rights are introduced as rights California residents may have

The rights section opens by saying California residents may have certain consumer rights and that these rights may include the list that follows. The framing is conditional rather than an unqualified grant.

Supporting quotations

California residents may have certain consumer rights. These rights may include:

Qualifications & exceptions

• Both the existence and the content of the rights are hedged with “may”.

Not stated here

• The notice does not state what determines whether a given right applies.

Legal Rights & Agreement Rules · Permission or license

The right to know covers category information and a copy of collected data

The right to know is described as the right to request information about the categories of CCPA/CPRA Personal Information collected, together with information such as the categories of sources and the third parties with whom it is shared, and separately as the right to request a copy of the specific pieces of CCPA/CPRA Personal Information collected, sometimes called the right to access personal information.

Supporting quotations

The right to know what CCPA/CPRA Personal Information we collect, including (1) the right to request information regarding the categories of CCPA/CPRA Personal Information we collect along with other information such as the categories of sources from which the information is collected and third parties with whom it is shared and (2) the right to request a copy of the specific pieces of CCPA/CPRA Personal Information we collect (sometimes referred to as the right to access personal information);

Qualifications & exceptions

• Two components are described: category-level information and specific pieces.
• Access is described as the right to a copy of what was collected.

Legal Rights & Agreement Rules · Permission or license

The right to delete is subject to stated exceptions

The right to delete CCPA/CPRA Personal Information collected from the reader is qualified by “subject to certain exceptions” in the list entry. The exceptions themselves are not enumerated in this list entry.

Supporting quotations

The right to delete CCPA/CPRA Personal Information that we collect from you, subject to certain exceptions;

Qualifications & exceptions

• The right is expressly subject to exceptions.

Not stated here

• The list entry does not identify the exceptions; later paragraphs describe limits on deletion.

Legal Rights & Agreement Rules · Permission or license

The right to correct covers inaccurate information eCW maintains

The right to correct inaccurate CCPA/CPRA Personal Information that eCW maintains about the reader appears as a list entry without further conditions.

Supporting quotations

The right to correct inaccurate CCPA/CPRA Personal Information that we maintain about you;

Sharing & Disclosure · Permission or license

Opt-out rights cover sale or sharing and certain sensitive-information uses

The list includes the right to opt out of the sale or sharing of CCPA/CPRA Personal Information and the right to opt out of certain uses of CCPA/CPRA Sensitive Personal Information. The sensitive-information opt-out is limited to certain uses rather than all processing.

Supporting quotations

The right to opt-out of the sale or sharing of CCPA/CPRA Personal Information;

The right to opt-out of certain uses of CCPA/CPRA Sensitive Personal Information; and

Qualifications & exceptions

• The sensitive-information opt-out is limited to certain uses.

Legal Rights & Agreement Rules · Permission or license

The list includes a right not to be retaliated against for exercising rights

The final list entry is the right not to be retaliated or discriminated against for exercising any CCPA/CPRA rights in good faith.

Supporting quotations

The right not to be retaliated or discriminated against for exercising any CCPA/CPRA rights in good faith.

Qualifications & exceptions

• Exercising rights in good faith is stated as the condition.

Legal Rights & Agreement Rules · Company commitment

eCW promises no discrimination but may vary price with the value of the data

eCW says it will not discriminate against a reader for exercising the listed rights, giving charging a different price or denying goods or services as examples, but that it may charge a different price or rate or provide a different level or quality of goods or services where the difference is reasonably related to the value provided to eCW by the data.

Supporting quotations

eCW will not discriminate against you for exercising any of the abovementioned rights, for example, by charging a different price or denying goods or services. However, eCW may charge a different price or rate or provide a different level or quality of goods or services when that difference is reasonably related to the value provided to us by the data

Qualifications & exceptions

• The non-discrimination statement is followed by an express carve-out for value-related differences.
• Price, rate, level and quality are all named as things that may differ.

Not stated here

• The notice does not quantify the value of the data or describe how a permitted difference would be calculated.

Retention & Deletion · Company commitment

Some data may survive deletion and access may be limited by burden or third-party rights

The notice says some information, excluding claims data provided by CMS as part of the “Blue Button” program, may remain in eCW’s records after a deletion request to the extent required by applicable law. It adds that there may be limits to how much information eCW can practically provide, for example limiting access where the burden or expense of providing it would be disproportionate to the risks to an individual’s privacy or where doing so would violate others’ rights.

Supporting quotations

Please note that some information, excluding claims data information provided by CMS as part of the "Blue Button" program, may remain in eCW's records even after you request deletion of your CCPA/CPRA Personal Information, to the extent required by applicable laws. Additionally, there may be limits to the amount of information eCW can practically provide. For example, we may limit access to CCPA/CPRA Personal Information where the burden or expense of providing access would be disproportionate to the risks to an individual's privacy or where doing so would violate others' rights.

Qualifications & exceptions

• Blue Button claims data from CMS is expressly excluded from the surviving-records statement.
• Retention after deletion is tied to what applicable law requires.
• Access may be limited by burden, expense, privacy risk or third-party rights.

Not stated here

• The notice does not state which records, beyond the CMS claims data, fall outside that limitation.

Sharing & Disclosure · Company practice

Opt-out works through Your Privacy Choices and Global Privacy Control signals

To opt out of sale or sharing, the reader can use the “Your Privacy Choices” section of the website. eCW also says it processes opt-out preference signals in a frictionless manner communicated through Global Privacy Control settings the reader may turn on in certain browsers, through its vendor OneTrust.

Supporting quotations

As noted above, you have the right to opt out of the sale or sharing of your CCPA/CPRA Personal Information to third parties. To exercise this right, you can visit the "Your Privacy Choices" section of our website. Additionally, eCW processes opt-out preference signals in a frictionless manner communicated through Global Privacy Control settings you may turn on in certain browsers through its vendor, OneTrust.

Qualifications & exceptions

• Global Privacy Control is named as the signal mechanism.
• Signal processing runs through the vendor OneTrust.

Not stated here

• The notice does not describe how a reader without GPC support can send an equivalent signal.

Legal Rights & Agreement Rules · Permission or license

The sensitive-information limit applies to inference uses and permits statutory uses

The right to limit the use or disclosure of CCPA/CPRA Sensitive Personal Information is stated for situations where the information is used to infer characteristics about the reader, and is exercised through the “Your Privacy Choices” section. eCW adds that it may continue using Sensitive Personal Information for certain purposes expressly permitted by the CCPA/CPRA.

Supporting quotations

You also have the right to limit the use or disclosure of your CCPA/CPRA Sensitive Personal Information if used to infer characteristics about you. To exercise this right, please visit the "Your Privacy Choices" section of our website. eCW may continue using Sensitive Personal Information for certain purposes expressly permitted by the CCPA/CPRA.

Qualifications & exceptions

• The limit is tied to inference uses.
• Expressly permitted uses continue after a limit request.

Not stated here

• The permitted purposes are not enumerated in this paragraph.

Legal Rights & Agreement Rules · Company practice

Requests go through a state privacy request form or a toll-free number

A reader wishing to exercise the listed rights is directed to complete the State Consumer Privacy Rights Request Form, linked to a request.eclinicalworks.com address, or to call the toll-free number given, +1 (866) 888-6929.

Supporting quotations

If you wish to exercise any of these rights, please complete the State Consumer Privacy Rights Request Form. You may also call us toll-free at +1 (866) 888-6929.

Qualifications & exceptions

• Two channels are offered: an online form and a toll-free telephone number.

Not stated here

• The linked State Consumer Privacy Rights Request Form is a separate document whose text this source does not supply, so this card cannot describe its fields or requirements.

Legal Rights & Agreement Rules · Company practice

Requests require identity matching with extra proof for sensitive data and agents

The notice requires a valid means of identification as a security precaution, and says eCW will verify identity with a reasonably high degree of certainty where feasible by matching the identifying information supplied against the CCPA/CPRA Personal Information it maintains or by using a third-party identity verification service. Extra information collected for verification is to be used only for that purpose and deleted as soon as practicable after complying with the request, additional proof may be required for particularly sensitive information, and a request made through an authorised agent requires written proof that the agent is authorised.

Supporting quotations

If you make a request related to CCPA/CPRA Personal Information about you, you will be required to supply a valid means of identification as a security precaution. We will verify your identity with a reasonably high degree of certainty using the following procedure where feasible: we will match identifying information you provide when making the request to the CCPA/CPRA Personal Information maintained by eCW or use a third-party identity verification service. If it is necessary to collect additional information, eCW will use the information only for verification purposes and will delete it as soon as practicable after complying the request. For requests related to particularly sensitive information, we may require additional proof of identification. If you make a Consumer Rights request through an authorized agent, we will require written proof from you that the agent is authorized to act on your behalf.

Qualifications & exceptions

• Verification uses matching or a third-party service.
• Additional proof is discretionary for particularly sensitive information.
• Agent requests require written proof of authority.

Not stated here

• The notice does not state what “reasonably high degree of certainty” means in practice.

Legal Rights & Agreement Rules · Restriction or exception

eCW reserves its legal rights and calls the described rights non-absolute

The notice says eCW will review requests and respond accordingly, that the rights described are not absolute and that eCW reserves all rights available to it at law in this regard. It also says it will process a request within the time provided by applicable law.

Supporting quotations

We will review your requests and respond accordingly. The rights described herein are not absolute and we reserve all our rights available to us at law in this regard.

Qualifications & exceptions

• The reservation of legal rights is stated alongside the commitment to respond.

Not stated here

• The notice does not say which rights might be withheld or on what basis beyond the statutory exceptions.

Security & Safeguards · Company commitment

De-identified data will not be re-identified to answer a rights request

Where eCW retains CCPA/CPRA Personal Information only in de-identified form, it says it will not attempt to re-identify the data in response to a consumer rights request.

Supporting quotations

Additionally, if we retain your CCPA/CPRA Personal Information only in de-identified form, we will not attempt to re-identify your data in response to a Consumer Rights request.

Qualifications & exceptions

• The commitment is limited to information retained only in de-identified form.

Sharing & Disclosure · User right or choice

Shine the Light opt-out covers sharing for third parties’ own direct marketing

The notice says California’s Shine the Light law lets California residents request details about how their information is shared with third parties, and in some cases affiliates, for those parties’ own direct marketing purposes, and that a business must either provide that information or let California customers opt in to or out of that sharing. eCW then says it may from time to time elect to share information collected through the Services with third parties or affiliates for their own direct marketing purposes, and that a California resident may opt out of future sharing of their personal information as defined by that law by contacting the Privacy Officer with “Do Not Share” in the subject line.

Supporting quotations

In addition to the rights already described, California's Shine the Light law permits California residents to request certain details about how their information is shared with third parties and, in some cases, affiliates, for those third parties' and affiliates' own direct marketing purposes. Under the law, a business must either provide this information or permit California customers to opt in to, or opt out of, this type of sharing. We may from time to time elect to share certain information about you collected by us through the Services with third parties or affiliates for those third parties' or affiliates' own direct marketing purposes. If you are a California resident, you may opt out of such future sharing of your personal information (as defined by the California Shine the Light law) by contacting our Privacy Officer at privacy-office with the phrase "Do Not Share" in the subject line.

Qualifications & exceptions

• Sharing is described as something eCW “may from time to time elect” to do.
• The opt-out is limited to sharing for the recipients’ own direct marketing.
• The Shine the Light definition of personal information governs the opt-out.

Not stated here

• The contact address is rendered incompletely in this source as “privacy-office”, so the full e-mail address cannot be stated.

Legal Rights & Agreement Rules · Company practice

Where eCW acts as a service provider, requests are referred to its customer

For a California resident whose personal information eCW processed as a service provider on behalf of a customer, the notice directs the resident to inquire with that customer. If the resident requests directly from eCW, the resident must name the customer on whose behalf the information was processed, and eCW says it will refer the request to that customer and support it to the extent required by California privacy law.

Supporting quotations

If you are a California resident and we, as a service provider, have processed personal information about you on behalf of our customers and you wish to exercise your CCPA/CPRA rights, please inquire with our customer directly. If you wish to make your request directly to us, please provide the name of our customer on whose behalf we processed your personal information. We will refer your request to that customer and will support them to the extent required by California privacy law in responding to your request.

Qualifications & exceptions

• The referral route applies only where eCW acted as a service provider.
• Support for the customer is limited to what California privacy law requires.

Not stated here

• The notice does not say how a resident identifies which customer is responsible.

Legal Rights & Agreement Rules · Company practice

Alternative-format copies of both notices are available on request

Both the California notice and the other-state privacy rights section offer an alternative format to readers with a disability, by contacting eCW with a stated phrase in the subject line: “Alternative Format California Privacy Notice” for the California notice and “Alternative Format State Privacy Notice” for the other-state notice.

Supporting quotations

If you have a disability and would like to access this Notice in a different format, you may contact us at privacy-office with the phrase "Alternative Format California Privacy Notice" in the subject line.

If you have a disability and would like to access this information in a different format, you may contact us at privacy-office with the phrase "Alternative Format State Privacy Notice" in the subject line.

Qualifications & exceptions

• Two different subject-line phrases are given, one per notice.

Not stated here

• The contact address is rendered incompletely as “privacy-office” in this source, so the full address cannot be stated.

Legal Rights & Agreement Rules · Company commitment

The California notice is governed exclusively by California law

The California notice is stated to be subject exclusively to the laws of the State of California, and eCW makes no representation that the notice and its practices comply with the laws of any other country.

Supporting quotations

This Notice will be subject exclusively to the laws of the State of California within the United States of America. We make no representation that this Notice and such practices comply with the laws of any other country.

Qualifications & exceptions

• Governing law is California exclusively.
• No claim of compliance outside the United States.

Data Access & Collection · Permission or license

Visitors outside the United States must comply locally and consent to transfer

The notice says visitors who use the Site and reside outside the United States do so on their own initiative and are responsible for compliance with local law where it applies, and that by using the Site a non-US resident consents to the transfer and use of their information outside their country.

Supporting quotations

Visitors who use this Site and reside outside the United States do so on their own initiative and are responsible for compliance with local laws, if and to the extent local laws are applicable. If you reside outside of the United States, by using our Site, you consent to the transfer and use of your information outside your country.

Qualifications & exceptions

• The consent is framed as arising from use of the Site.
• Local-law compliance is placed on the visitor.

Not stated here

• The notice does not describe transfer safeguards or destinations.

Legal Rights & Agreement Rules · Permission or license

Residents of other states may have eight listed privacy rights

The other-state section says residents of states with consumer privacy protection laws may have certain rights, listing access, correction, deletion, opting out of the sale or sharing of personal information, opting out of processing for targeted marketing or automated decision-making and profiling, receiving a copy of personal information, obtaining a list of the categories of third parties to which personal information has been disclosed, and confirming whether eCW processes the personal information.

Supporting quotations

If you are a resident in a state with consumer privacy protection laws you may have certain rights regarding your information. Those rights may include (i) access rights to your personal information, (ii) correction requests to your personal information, (iii) deletion requests, (iv) opting out of the sale or sharing of your personal information, (v) opting out of processing personal information for targeted marketing or automated decision-making/profiling, (vi) receiving a copy of your personal information, (vii) obtaining a list of the categories of third parties to which we have disclosed your personal information, or (viii) confirming whether we process your personal information.

Qualifications & exceptions

• The rights are introduced with “may have” and described as rights that “may include” the list.
• The list itself is not tied to any named state.

Not stated here

• The section does not state which states are covered or which right applies in each.

Legal Rights & Agreement Rules · Company practice

Other-state requests use the Your Privacy Choices form and may require verification

Residents of those states are directed to the “Your Privacy Choices” link, which points to a request.eclinicalworks.com form, to submit their request. eCW may require additional information to verify identity, will consider all requests and respond within the period required by applicable law, and says that where a request is denied the reader may have a right to appeal by using the same link or contacting the privacy office.

Supporting quotations

Residents of these states may exercise the above rights by navigating to Your Privacy Choices and submitting your request on the form found at that address. We may require you to provide additional information to allow us to verify your identity in order to complete your request. We will consider all requests and provide our response within the time period required by applicable law. Please note, in many cases we are acting as a "Business Associate" and may be exempt from certain laws, or certain information we retain may be exempt from such requests.?In the event your request is denied, you may have the right to appeal the decision. You may seek to appeal by contacting us through the link set forth above or reaching out to privacy-office.

Qualifications & exceptions

• Verification information may be requested.
• The response deadline is the period required by applicable law.

Not stated here

• The notice does not describe the appeal process or its timing beyond the contact route.
• The linked request form at request.eclinicalworks.com is a separate document whose text this source does not supply, so this card cannot describe its fields or requirements.

Legal Rights & Agreement Rules · Restriction or exception

eCW says it may be exempt where it acts as a business associate

The other-state section adds that in many cases eCW is acting as a “Business Associate” and may be exempt from certain laws, and that certain information it retains may be exempt from such requests. The exemption statement sits immediately after the response-time commitment and before the appeal sentence.

Supporting quotations

Please note, in many cases we are acting as a "Business Associate" and may be exempt from certain laws, or certain information we retain may be exempt from such requests.

Qualifications & exceptions

• The exemption is stated as a possibility (“may”) rather than a rule.
• Both eCW and the retained information are described as possibly exempt.

Not stated here

• The notice does not specify which laws or information the exemption covers, and the sentence is followed by a stray character where a space or sentence break appears in the source.