Business Privacy Policy

Scope and who we are

This Business Privacy Policy applies to https://partners.lennox.health, partner applications, partner inquiries, approved partner administration, and related business communications operated by Sutter International Inc. doing business as Lennox Health ("Lennox," "we," "us," or "our"). It explains our handling of personal information in this business-partner context.

This policy does not govern the separate patient-facing Lennox Health website, secure clinical workflows, independent healthcare professionals, clinical entities, pharmacies, laboratories, or other third parties. Patient-facing privacy information is available through the applicable Lennox patient experience and at lennox.health/privacy-policy. When another party provides its own notice, that notice governs its handling of information.

Definitions

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an individual or household. “Process” means collecting, using, storing, analyzing, disclosing, or deleting Personal Information. “Service Provider” means an organization that processes Personal Information for a business purpose under contract or applicable law.

Personal Information does not include lawfully de-identified or aggregated information that cannot reasonably be linked to an individual, or public information excluded by applicable law.

Information we collect

The information we collect depends on how you use the partner website and may include:

• Identity and contact information: name, work email, telephone number, organization name, and contact preferences;
• Professional and organization information: role or specialty, business type, state of practice or operation, approximate customer or patient volume range, business website or public profile, and compliance-related information;
• Application and relationship information: application answers, messages, requested program, source industry, agreement acknowledgements, review status, approved channels, assigned links or codes, communications, and relationship records;
• Attribution information: campaign, source, and medium values included in a link, referral route, page, or form submission;
• Device and use information: IP address, browser and device type, operating system, language, approximate region derived from IP address, referring page, pages viewed, timestamps, request headers, performance events, and security or error logs; and
• Inferences: basic conclusions reasonably drawn from the information above, such as likely program fit, support needs, duplicate or fraudulent activity, or compliance risk.

Payment-card information, tax forms, banking information, identity documents, or similar records may be collected later through a separate approved provider or process if an approved relationship requires them. The applicable notice presented in that process will provide additional detail.

Information we do not seek on this site

The partner website is not designed to collect patient medical information, protected health information, consumer health data, Social Security numbers, financial account credentials, precise geolocation, biometric identifiers, or information about children. Do not put that information in an open text field, email, direct message, or attachment sent through a partner channel.

If we receive information that appears to have been submitted improperly, we may restrict access, delete or isolate it where appropriate, notify the sender, direct the individual to a secure channel, or take other steps reasonably necessary to protect the information and comply with law.

Sources of information

We collect Personal Information:

• directly from you when you browse, apply, contact us, sign an agreement, use a partner tool, or communicate with the partnership team;
• from the organization you represent and colleagues or authorized representatives who communicate with us;
• automatically from your browser, device, hosting request, and security systems;
• from campaign links, referral routes, approved partner tools, and operational providers;
• from public business, professional, licensing, registration, website, and social-media sources used for reasonable due diligence; and
• from advisers, vendors, or other parties involved in evaluating or administering an approved relationship.

How we use information

We may use Personal Information to:

• receive, validate, review, and respond to applications and inquiries;
• verify identity, authority, organization, professional role, public representations, program fit, and compliance readiness;
• communicate about review status, onboarding, agreements, approved materials, training, support, reporting, and relationship administration;
• create, secure, maintain, attribute, and troubleshoot partner links, codes, tools, and records;
• measure program activity, validate qualifying events, prevent duplicate or manipulated attribution, and administer agreed commercial terms;
• operate, maintain, debug, protect, and improve the partner website and related systems;
• detect fraud, spam, abuse, security incidents, policy violations, and unlawful activity;
• create aggregated or de-identified business information;
• send business marketing where permitted and consistent with your choices; and
• comply with legal, tax, accounting, audit, insurance, regulatory, dispute, recordkeeping, and enforcement obligations.

We will not use patient health information submitted through a patient-facing clinical workflow to calculate or disclose partner compensation, except to the limited extent a lawful de-identified, aggregated, or non-clinical status signal is expressly authorized and needed to administer an approved agreement.

Legal bases where applicable

Where a law requires a legal basis for processing, we process Personal Information as necessary to take steps at your request, perform or administer a contract, comply with legal obligations, pursue legitimate interests such as program administration, fraud prevention, security, and legal compliance, protect rights and safety, or act on consent. Where consent is the basis, it may be withdrawn prospectively, subject to legal and operational limits.

How we disclose information

We may disclose Personal Information to the following categories of recipients for the purposes described in this policy:

• Service providers: hosting, security, database, form-delivery, communications, document, verification, analytics, support, and relationship-management vendors;
• Professional advisers: lawyers, accountants, auditors, insurers, consultants, and compliance reviewers;
• Corporate parties: companies under common control and parties to a financing, reorganization, merger, acquisition, asset sale, diligence process, or similar transaction, subject to appropriate safeguards;
• Authorities and protective recipients: regulators, courts, law enforcement, counterparties, and others when required by law or reasonably necessary to protect rights, safety, security, patients, the public, or the integrity of the program; and
• Recipients you direct: your organization, authorized representatives, and others when you request or consent to the disclosure.

Providers receive information reasonably necessary for their function and are subject to contractual or legal duties appropriate to their role. We do not disclose patient medical details to partners through this website.

Partner attribution and reporting

An approved partner relationship may use a dedicated link, QR code, source parameter, campaign value, or similar identifier to determine that a visitor arrived through a partner route. Lennox may use that identifier and limited non-clinical status information to validate attribution, detect manipulation, administer the agreement, and prepare reporting.

Partner reports should be limited to the information stated in the signed agreement and should not include diagnosis, treatment, medication, medical record, or provider-decision detail. A partner is not authorized to infer, request, or independently combine reporting with other information to identify a patient’s health status.

Sale, sharing, and targeted advertising

We do not sell Personal Information for money. As of the effective date, the partner website is not configured to disclose partner application information or site activity for cross-context behavioral advertising. We do not knowingly sell or share the Personal Information of children under 16.

Some state laws define “sale” or “sharing” broadly. If our practices change in a way that creates an opt-out right, we will update this policy and provide the required method. Where applicable law requires us to honor a recognized browser-based opt-out signal, including Global Privacy Control, we will treat the signal as a request for the browser or device that sends it.

Cookies and similar technologies

We and our providers may use cookies, local or session storage, pixels, request logs, and similar technologies for security, load balancing, form operation, preference continuity, diagnostics, analytics, referral attribution, and performance. The partner application currently reads source, medium, campaign, and industry values from the page URL and includes them with the application when present.

You can limit or clear browser storage through browser settings, but some features may not work correctly. Standard hosting, security, font-delivery, and verification services may receive request information such as IP address and browser headers when your browser connects to them. Their own notices govern independent processing.

Data retention

We retain Personal Information only as long as reasonably necessary for the purposes described here. Retention varies by record type, relationship stage, legal requirement, and risk. Application and inquiry records may be retained to respond, document review, prevent repeated abuse, evaluate later contact, and preserve a record of consent or representations. Approved-partner records may be retained for the relationship and for a reasonable period afterward for payment, tax, audit, dispute, enforcement, and legal purposes.

When information is no longer reasonably required, we may delete, de-identify, aggregate, or securely isolate it, subject to backups, legal holds, fraud-prevention records, and technical limitations.

Security

We use administrative, technical, and organizational safeguards designed to protect Personal Information, including access controls, encrypted transport, input limits, provider safeguards, logging, and security monitoring appropriate to the information and risk. No method of transmission or storage is completely secure, and we cannot guarantee that unauthorized access, loss, misuse, or alteration will never occur.

Use a secure device, protect credentials and partner tools, and notify partners@lennox.health promptly if you suspect unauthorized access or improper disclosure. Do not send passwords, financial credentials, or patient information in an ordinary email.

U.S. state privacy rights

Depending on where you live and subject to applicability thresholds, verification, exceptions, and law, you may have the right to:

• confirm whether we process Personal Information and access categories or specific pieces;
• request correction, deletion, or a portable copy;
• learn categories of sources, purposes, and recipients;
• opt out of sale, sharing, targeted advertising, or certain profiling if we engage in those activities;
• limit certain uses or disclosures of sensitive Personal Information;
• withdraw consent for future processing where consent is the basis;
• appeal a decision where applicable; and
• exercise privacy rights without unlawful discrimination.

To submit a request, email partners@lennox.health with the subject “Business Privacy Request” and state your jurisdiction and request. We may verify identity by matching information already on file and may require proof of authority from an agent. We will use verification information only for verification and will respond within the time required by applicable law.

California notice at collection

For California residents, the categories described in this policy may correspond to identifiers, professional or employment-related information, commercial or relationship information, internet or other electronic network activity, approximate geolocation, and inferences. We collect those categories from the sources in Section 5 and use and disclose them for the business and commercial purposes in Sections 6 through 9.

We do not intentionally collect sensitive categories such as Social Security numbers, government identification numbers, financial account credentials, precise geolocation, racial or ethnic origin, religious beliefs, union membership, genetic data, biometric templates, private communications content, or health information through partner application and inquiry forms.

Subject to the California Consumer Privacy Act applying to Lennox and to statutory exceptions, California residents may request to know, correct, or delete Personal Information; opt out of sale or sharing; limit certain uses of sensitive Personal Information; and receive equal service when exercising a right. We will honor applicable Global Privacy Control signals as described above. We do not offer financial incentives for Personal Information through this partner website.

Marketing communications

Where permitted, we may send program news, invitations, or other business marketing. You may unsubscribe from promotional email through the link in the message or by contacting us. For eligible promotional texts, reply STOP. Transactional, legal, security, application, and relationship-administration communications may continue.

Your organization may continue to receive communications addressed to a different representative or sent under a separate lawful business relationship. Tell us if a contact has left the organization or should be replaced.

Children and visitors outside the United States

The partner website is intended for business users who are at least 18 and is not directed to children under 13. We do not knowingly collect Personal Information online from a child under 13 through this website. If you believe a child submitted information, contact us so we can review and take appropriate action.

The Partner Services are directed to business users in the United States. If you access them from another country, Personal Information may be processed and stored in the United States, where privacy laws may differ. We use lawful transfer mechanisms where required and applicable.

Third-party links and services

The partner website may link to Lennox patient services, social platforms, verification providers, or independent resources. Their privacy practices are governed by their own notices. Review the applicable notice before submitting Personal Information. Lennox is not responsible for an independent third party’s privacy or security practices.

Updates to this policy

We may update this policy to reflect changes in the Partner Services, data practices, providers, or legal requirements. We will post the revised version with a new effective date. Material changes may receive additional notice where required. Earlier versions may be retained for business and legal records.

Contact us

For privacy questions, requests, or appeals concerning this partner website, email partners@lennox.health. Include enough detail to identify the relevant application, inquiry, or partner relationship, but do not send a password, full financial credential, government identifier, patient information, or unnecessary sensitive information.