This Privacy Policy describes how Cotiviti, Inc. ("Cotiviti," "we," and "us") collects, uses, discloses, and protects Personal Information. It applies when you use the Cotiviti website or other Cotiviti-owned or operated services that post this Privacy Policy (collectively, the "Sites"), or otherwise provide your Personal Information to us.

We also receive some Personal Information from our clients in order to provide services to them. Our contract with our client applies to that Personal Information, not this Privacy Policy.

If you are a resident of California, you may have additional rights, which you can read about in our California Notice at Collection.

Personal Information We Collect

The Personal Information we collect and have collected over the last 12 months depends on your interactions with us, and may include:

• Identifiers, such as your name, phone number, email address, and other contact information.
• Commercial information, such as products or services purchased and other purchasing histories or tendencies.
• Internet and other electronic activity information, such as your IP address, browser type, browser language, and information about your interactions with and use of our website, including via cookies and other tracking technologies.
• Geolocation data, such as non-precise geolocation information derived from your IP address.
• Professional or employment-related information, such as your employer, job title, and job applicant resume information and employment history.
• Inferences, drawn from any of the information we collect to determine your preferences or evaluate your job application.

If you are a job applicant, we may also collect:

• Education information, such as your education history, professional qualifications, and certificates and licenses.
• Audio, visual or other sensory information, such as your image when recorded or captured in surveillance camera footage, pictures taken in the workplace, or recording of customer service calls.

How We Collect Personal Information

Our website and other online services collect Personal Information that you or an authorized third party intentionally submit to us by completing and sending a form, by submitting email to us, or by logging onto and providing information to us in one of the areas of our website that is restricted to registered users. Cotiviti also collects Personal Information from cookies and other tracking technologies when you use our website and online services. Similarly, off-line, Cotiviti will collect Personal Information about you that you voluntarily submit or that we receive from another party, such as a retail merchant.

Uses of Personal Information

We use personal information (including the identifiers, commercial information, internet and other electronic activity information, geolocation data, professional or employment-related information, education information, and inferences described above) for the following business and commercial purposes:

• Providing our Products and Services, including processing payments and providing updates and reports requested by clients.
• Transactional Purposes, including communicating with you, providing customer service, administering our contracts, and supporting business activities such as billing and collections, procurement, and taxes.
• Recruiting and Hiring, including making informed decisions on recruitment, assessing your suitability for the role, and communicating with you about your application.
• Business Operations, including for budgeting, maintaining and administering records, satisfying compliance, and satisfying our regulatory, audit, investigative, ethics, and disciplinary obligations.
• Analytical Purposes, including analyzing, Site usage, preferences, trends and statistics.
• Marketing and Promotional Purposes, including improving and personalizing our marketing and advertising, conducting market research, prospecting for new clients, and providing you with information about us, including personalized marketing communications.
• Maintaining of our Sites and Systems, including ensuring functionality on our Sites and systems, diagnosing technical and service problems, applying security controls for company systems, providing new Site or system implementations, applying change management processes, and providing IT Service Desk / Help Desk Support.
• Developing and Improving our Products and Services, including to help us develop new products and services and to improve and analyze our existing products and services.
• Security and Fraud Prevention, including to detect and protect us and our Sites, premises, assets, systems, products, services and intellectual property from fraud, theft, and misconduct.
• Legal Purposes, including to comply with our legal obligations and reporting requirements, defend ourselves in legal proceedings, and protect our company and our property, employees, and others through legal proceedings.
• Other Purposes that we may describe to you.

Disclosure of Personal Information

Cotiviti may disclose your Personal Information to the following categories of third parties:

• Service Providers: We may disclose information with companies or persons that provide services to Cotiviti, including, for example, data storage, payment processing, email delivery, marketing, operating systems and platforms, and customer support services.
• Cotiviti family of companies: We may disclose information with Cotiviti's parent companies, subsidiaries, joint ventures, or other affiliated companies under common control (collectively the "Cotiviti family of companies").
• Special Circumstances of Disclosure: To third parties, including government agencies or law enforcement, if Cotiviti believes in good faith belief that such action is reasonably necessary: (1) to comply with the law; (2) to comply with legal process; (3) to enforce the Terms of Use; (4) to respond to claims that such content violates the rights of third-parties; (5) to protect the interests of Cotiviti, or for a compelled public purpose such as national security or public safety.
• Corporate Transaction Recipients: We may share information with potential investors, purchasers, merger partners, and their advisors in the event we: (i) sell or transfer, or are considering selling or transferring, all or a portion of our business or assets; or (ii) are considering or engaging in any reorganization, conversion, merger, sale, joint venture, assignment, transfer or disposition of all or any portion of our ownership interest, business or operations; or (iii) are soliciting or accepting investments.
• Other Reasons. We may disclose personal information for other reasons we may describe to you, including if you consent to the disclosure or direct us to disclose your information.

Cotiviti does not sell Personal Information to third parties in exchange for money, but we do use cookies and other tracking technologies, which may constitute a "share" or "sale" of Personal Information under certain U.S. state consumer privacy laws. In the past 12 months, we have disclosed the following categories of Personal Information with our targeted advertising service providers and partners: identifiers, geolocation data, and internet and other electronic activity information. For more information, see the Cookies and other Tracking Technologies section of our privacy policy below.

In the event Cotiviti engages in an SMS text messaging campaign, no mobile information will be shared with third parties for marketing or promotional purposes.

Cookies and other Tracking Technologies

When using Cotiviti's Sites or other online services, we, our service providers, and our targeted advertising service providers and partners may collect, receive, and store certain information you or your browser or device makes available. When you access the Sites, we, our service providers, and our targeted advertising service providers and partners may place small data files on your computer or other device. These data files may be web beacons, cookies, clear gifs, pixel tags, e-tags, flash cookies, log files, or other local storage provided by your browser or associated applications. These technologies, which are often referred to collectively as cookies, collect information about your use of the Sites and other websites and applications, including your Internet Protocol address, browser type, browser language, pages viewed, links clicked, conversion information, information entered into forms, the date and time of your visit, mobile network information, and time spent on pages or in apps. These cookies may also uniquely identify your browser. We use this information to understand how people interact with our website, analyze and track data, determine the popularity of certain content, deliver advertising and content targeted to your interests, and better understand your online activity.

Most browsers are initially set up to accept cookies. You can reset your browser to refuse all cookies or to indicate when a cookie is being sent. If you want to learn more about how to opt-out of receiving targeted advertisements based on your interest, you can visit the NAI's Consumer Opt Out page, which will allow you to opt-out of seeing advertisements set by participating NAI members.

Google Analytics. We use Google Analytics on our website to track usage data and help improve your experience. You can find more information on how Google uses data at www.google.com/policies/privacy/partners.

HubSpot. We use HubSpot traffic analytics tool on our website (www.Cotiviti.com) to track usage data and help improve your experience. You can find more information on how HubSpot uses data at https://legal.hubspot.com/privacy-policy.

Responding to "Do Not Track" Signals

Some browsers incorporate a "Do Not Track" feature that signals to websites that a user does not want to have his or her online activity and behavior tracked. Not all browsers offer a DNT option and DNT signals are not yet uniform. Our Sites are thus not currently set up to respond to these signals. For more information on Do Not Track signals, please visit https://allaboutdnt.com/

Global Privacy Control (GPC) allows individuals to automatically signal their privacy preferences to websites and other online services through their browser or through an extension. If we receive a GPC signal to opt-out of website tracking, we will honor such requests made on our Site (www.Cotiviti.com). We will process a GPC signal in a 'frictionless' manner, meaning we will not require any additional confirmation from you, change your user experience, or display any pop-up notifications upon receiving the signal. Please note that we may not be readily able to associate an opt-out preference signal with other personal information such as your email address. If you configure this setting on your browser, certain features on our site may not work and you will receive less targeted advertising. You will also need to turn the setting on for each browser that you use.

Opting Out of Cross-Context Behavioral Advertising or Targeted Advertising

We allow third-parties to provide analytics and advertising services and serve advertisements on our behalf across the Internet and in mobile applications. Our advertising partners may collect information about your activities on our Sites on your current device and combine it with information about your activities on other websites, mobile apps, and devices. They may also collect IP address, browser or operating system type and version, and demographic or inferred-interest information, as well as personal information if you have submitted such information to us through the Sites. They collect such information using server logs, cookies, web beacons, tags, pixels, mobile advertising IDs (such as Facebook cookies or Google's Advertising ID), cross-device linking, and similar technologies. For example, our advertising partners may use the fact that you visited our website to target advertising to you on other websites and mobile apps on your current device or on other devices you use. They may match your browsers or devices if you log into the same online service on multiple devices or if your devices share similar attributes that support an inference that they are used by the same person or household. This means that information about your activity on websites or apps on your current browser or device may be combined and used with information collected from your other browsers or devices. These third parties partners use this information for our and their own advertising, analytics, attribution, and reporting purposes. To learn more about interest-based advertising, tracking technologies, and how to opt out, please visit http://www.aboutads.info/choices. You can disable the sharing of your personal information for cross-contextual behavioral advertising or targeted advertising through online cookies and tracking technology by adjusting your cookie preferences using our cookie banner. When you visit our Sites, the cookie banner provides options to manage or reject non-essential cookies and tracking technologies associated with advertising and analytics. You may also manage your preferences by accessing the 'Cookie Settings' link available on our cookie banner or our website footer. Please note that disabling these cookies may affect your personalized experience and limit certain functionalities.

Marketing Opt-Out

If you would like to opt out of receiving promotional or marketing e-mail from us, you may use the "unsubscribe" mechanism included in each marketing message. Note that your option not to receive promotional and marketing e-mail shall not preclude us from corresponding with you, by e-mail or otherwise, regarding your existing relationship with us. Your opt-out request will also not apply to correspondence that has already been initiated.

Security of your Personal Information

We follow generally accepted industry standards to protect the personal information submitted to us and have implemented reasonable technical, organization, administrative and physical measures to protect personal information. No method of transmission over the Internet, or method of electronic storage, is 100% secure, however. Therefore, we cannot guarantee its absolute security and encourage you to use websites and share information with caution.

Retention of Personal Information

We may retain Personal Information as reasonably required to provide our products and services, operate our business, and comply with our legal obligations. In determining when your Personal Information is retained or disposed, we may consider the nature and sensitivity of your Personal Information, the potential risk of harm from unauthorized use or disclosure of your Personal Information, the purposes for which we process your Personal Information, and applicable legal requirements.

Information from Minors

We do not knowingly collect, sell or share the Personal Information from or market to children under 18 years of age. By using the Sites, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent's use of the Sites. If we learn that Personal Information from users less than 18 years of age has been collected, we will take reasonable measures to promptly delete that data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at PrivacyOffice@cotiviti.com.

External Links

Cotiviti's website may provide links to third-party websites. Even if the third-party is affiliated with Cotiviti through a business partnership or otherwise, Cotiviti is not responsible for the content, privacy policies, or practices of such external links. External links are provided for convenience only and access to these links is at your own risk.

International Privacy Disclaimer

Because privacy laws are not the same in all countries, our non-U.S. operations may adopt additional measures depending on local legal requirements. Information obtained from our website generally is processed and stored in the United States in accordance with this Policy, which may not be as comprehensive as required in the European Union or other nations.

Confidentiality and Non-Disclosure Agreements

Nothing in this Privacy Policy shall detract from the rights and obligations of the parties to any non-disclosure or similar agreement that Cotiviti or any of the Cotiviti family of companies have entered into with any customer or other third-party.

Updates to our Privacy Policy

The Cotiviti Privacy Policy is subject to change at any time, and we encourage you to review this policy regularly for any changes. A current policy is available for review on our website at www.cotiviti.com or can be reviewed at our offices at 10701 South River Front Parkway, Suite 200, South Jordan, Utah 84095.

How to Contact Us

If you have questions or comments regarding our Privacy Policy, or any issue relating to how we collect, use or disclose personal information, or if you would like us to update information we have about you or your preferences, please contact us as indicated below.

Email us at: PrivacyOffice@cotiviti.com

Write to us at:
Cotiviti, Inc.
Attention: Privacy Officer
10701 South River Front Parkway, Suite 200
South Jordan, Utah 84095
(770) 379 2800

For Issues regarding Information Security

Email us at: InfoSec@cotiviti.com

Write to us at:
Cotiviti, Inc.
Attention: Chief Information Security Officer
10701 South River Front Parkway, Suite 200
South Jordan, Utah 84095
(770) 379 2800

California Notice at Collection

Additional Information for California Residents
This section supplements the information contained in the rest of this Privacy Policy and applies solely to consumers residing in the state of California, who visit or use the Sites.

California residents may have certain rights, subject to legal limitations, concerning the collection, use, and disclosure of Personal Information.

• Right to Know. You may have the right to request information about the categories of Personal Information we have collected about you, the categories of sources from which we collected the Personal Information, the business or commercial purposes for collecting the Personal Information, and to whom we have disclosed Personal Information and why. You may also request the specific pieces of Personal Information we have collected about you.
• Right to Delete. You may have the right to request that we delete Personal Information that we have collected from you.
• Right to Correct. You may have the right to correct or request that we correct inaccurate Personal Information that we maintain about you.
• Right to Opt-Out. You may have the right to opt-out of the sale of your personal information or the sharing of your personal information for cross-context behavioral advertising or targeted advertising.

California consumers may submit requests via our webform located at www.dsrcotiviti.ethicspoint.com or by calling us at 844-916-1330. We will not discriminate against you for exercising your privacy rights.

Verification: To process requests (other than requests to opt-out of sale or sharing of personal information, we will need to obtain information to locate you in our records or verify your identity depending on the nature of the request ("verifiable request"). In most cases, we will collect some or all of the following data elements: first and last name, email address, and telephone number. In some cases, we may request different or additional information, including a signed declaration that you are who you say you are, and will inform you if we need such information. If we cannot verify your identity, we may reject your request in whole or in part.

Authorized Agents: Authorized agents may exercise rights on behalf of California residents by submitting a request via our webform and indicating that they are submitting the request as an agent. We will require the agent to demonstrate authority to act on behalf of the resident, such as by providing signed permission from the resident. We may also require the resident to verify their own identity directly with us or to directly confirm with us that they provided the authorized agent permission to submit the request. We may deny a request from an authorized agent who does not submit sufficient proof to act on your behalf. We do not require consumers to re-verify their identity when an authorized agent submits a "Request to Opt-Out of Sale/Sharing" or "Request to Limit the Use of Sensitive Personal Information" on the consumers behalf.

Timing: We will confirm receipt of your verifiable request within ten (10) business days. We will respond to all requests within 45 days, unless we need more time, in which case we will notify you and may take up to 90 days total to respond to your request.

Updated: November 21, 2025