Privacy Policy

Introduction

Avande Inc. ("Avande," "we," "us," or "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy describes how we collect, use, disclose, and safeguard information when you visit our website, access our platform, or use our healthcare cost management services.

By using our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please discontinue use of our services.

Information We Collect

Personal Information

We may collect the following personal information when you interact with our services:

• Name, email address, phone number, and job title
• Company name, role, and business contact details
• Account credentials and communication preferences

Usage Data

We automatically collect certain technical information when you use our website and platform:

• IP address, browser type, and operating system
• Pages visited, time spent, and referring URLs
• Cookie identifiers and device information

Health Plan Data

In the course of providing services to our clients, we may process health plan data, including protected health information (PHI), on behalf of and as directed by our clients. This data is handled exclusively under the terms of a Business Associate Agreement (BAA).

How We Use Your Information

We use the information we collect for the following purposes:

• Service delivery: To provide, maintain, and improve our healthcare cost management platform and services
• Communications: To respond to your inquiries, send service updates, and deliver relevant information about our offerings (you may opt out at any time)
• Analytics: To understand how our services are used and identify areas for improvement
• Legal compliance: To meet regulatory obligations, enforce our terms, and protect our legal rights

HIPAA Compliance

Avande takes its obligations under the Health Insurance Portability and Accountability Act (HIPAA) seriously. All protected health information is handled in strict accordance with HIPAA Privacy and Security Rules.

• We only process PHI in our capacity as a Business Associate under a fully executed BAA
• We apply the minimum necessary standard to all PHI access and disclosures
• We maintain comprehensive administrative, physical, and technical safeguards
• We never sell, share, or use PHI for marketing purposes

Data Sharing and Disclosure

We do not sell your personal data. We may share information only in the following circumstances:

• Service providers: With trusted vendors who assist in delivering our services, bound by contractual confidentiality obligations
• Legal requirements: When required by law, regulation, legal process, or governmental request
• Client authorization: As directed by our clients in accordance with their agreements
• Business transfers: In connection with a merger, acquisition, or sale of assets, with appropriate notice to affected parties

Data Security

We implement industry-leading security measures to protect your information from unauthorized access, alteration, disclosure, or destruction:

• Encryption at rest: AES-256 encryption for all stored data
• Encryption in transit: TLS 1.2+ for all data transmissions
• Certifications: SOC 2 Type II and HITRUST certified infrastructure
• Access controls: Role-based access with multi-factor authentication
• Testing: Regular penetration testing and vulnerability assessments
• Incident response: Documented procedures for detection, containment, and notification

Data Retention

We retain personal information only for as long as necessary to fulfill the purposes described in this policy and to comply with legal and regulatory requirements. Client data processed under a BAA is retained and disposed of in accordance with the terms of that agreement.

You may request deletion of your personal data at any time by contacting us at the address below. We will process your request in accordance with applicable law.

Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your personal data
• Object to or restrict certain processing activities

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know, delete, and opt out of the sale of personal information. Residents of other states may have similar rights under applicable privacy laws.

To submit a privacy request, please contact us at privacy@avande.com.

Cookies and Tracking Technologies

Our website uses the following categories of cookies:

• Essential cookies: Required for core site functionality such as security, session management, and accessibility. These cannot be disabled.
• Analytics cookies: Help us understand site usage patterns and improve our services. You may opt out of these at any time through your browser settings.

We do not use third-party advertising cookies or share cookie data with advertisers.

Third-Party Links

Our website may contain links to third-party websites or services that are not operated by Avande. We are not responsible for the privacy practices of these external sites and encourage you to review their privacy policies before providing any personal information.

Children's Privacy

Our services are not directed to individuals under the age of 13, and we do not knowingly collect personal information from children. If we become aware that we have inadvertently collected data from a child under 13, we will take steps to delete it promptly.

Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by posting the updated policy on our website with a revised "Last updated" date. Your continued use of our services after any changes constitutes your acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:

Email: privacy@avande.com
Mail: Avande Inc., 123 Healthcare Way, Boston, MA 02101