Cotiviti, Inc. (Cotiviti) respects your privacy and is committed to protecting Personal Information. This statement explains our policies and practices regarding the use and disclosure of your Personal Information by Cotiviti when you use the Cotiviti website or other Cotiviti-owned or operated services that post this Privacy Policy (collectively, the "Sites"), or otherwise provide your Personal Information to us.

If you are a resident of California, you may have additional rights, which you can read about below.

How We Collect Your Personal Information

We use the term "Personal Information" to refer to information that would permit someone to identify or contact you, such as your full name, address, telephone number, or email address. The Personal Information we collect and have collected over the last 12 months depends on your interactions with us, and may include:

• Identifiers, such as your name, phone number, email address, and other contact information.
• Commercial information, such as products or services purchased and other purchasing histories or tendencies.
• Internet and other electronic activity information, such as your IP address, browser type, browser language, and information about your interactions with and use of our website, including via cookies and other tracking technologies.
• Geolocation data, such as non-precise geolocation information derived from your IP address.
• Professional or employment-related information, such as your employer, job title, and job applicant resume information and employment history.
• Inferences, drawn from any of the information we collect to determine your preferences or evaluate your job application.

If you are a job applicant, we may also collect:

• Education information, such as your education history, professional qualifications, and certificates and licenses.

Personal Information does not include aggregated information that, by itself, does not permit the identification of individual persons.

Our website and other online services collect Personal Information that you or an authorized third party intentionally submit to us by completing and sending a form, by submitting email to us, or by logging onto and providing information to us in one of the areas of our website that is restricted to registered users. Cotiviti also collects Personal Information from cookies and other tracking technologies when you use our website and online services. Similarly, off-line Cotiviti will collect Personal Information about you that you voluntarily submit or that we receive from another party, such as a retail merchant.

Use and Disclosure of Personal Information

Cotiviti may use this Personal Information internally in connection with processing your inquiries and orders, verify information about you, or to help improve our products and services. Cotiviti also may use your Personal Information for the purposes of supporting your relationship with Cotiviti by designing content that is suitable to your needs and alerting you to new service offerings as they become available.

Cotiviti may disclose your Personal Information to the following categories of third parties:

• Service Providers: We may disclose information with companies or persons that provide services to Cotiviti. These service providers help us with managing IT and data storage, operate our business, and send marketing.
• Cotiviti family of companies: We may disclose information with Cotiviti's parent companies, subsidiaries, joint ventures, or other affiliated companies under common control (collectively the "Cotiviti family of companies").
• Our corporate clients: When we provide services to our corporate clients, we may also disclose your Personal Information with that client as necessary to provide the services to them.
• Special Circumstances of Disclosure: To third parties if Cotiviti believes in good faith belief that such action is reasonably necessary: (1) to comply with the law; (2) to comply with legal process; (3) to enforce the Terms of Use; (4) to respond to claims that such content violates the rights of third-parties; (5) to protect the interests of Cotiviti, or for a compelled public purpose such as national security or public safety.

Over the past 12 months, Cotiviti has disclosed to the third parties listed above each of the categories of Personal Information described in this Privacy Policy for a business purpose. Cotiviti does not sell Personal Information to third parties in the traditional sense, but we do use cookies and other tracking technologies, which may constitute a “share” of Personal Information under certain U.S. state consumer privacy laws. In the past 12 months, we have shared the following categories of Personal Information with our targeted advertising service providers and partners: Identifiers, Geolocation data, and Internet and other electronic activity information. We do not knowingly sell the Personal Information of minors under 18.

Cookies and other Tracking Technologies

When using Cotiviti's web page or other online services, Cotiviti may collect information your browser or device makes available whenever you visit. This information includes your Internet Protocol address, browser type, browser language, and the date and time of your query. We use this information to understand how people interact with our website. Upon your first visit to Cotiviti, a "cookie", or small file containing a string of characters, may be sent to your computer that uniquely identifies your browser. Cotiviti generally uses the following types of cookies on its website:

• Security: We use cookies to enable and support our security features, for example: to authenticate users, prevent fraudulent use of login credentials, and protect user data from unauthorized parties.
• Preferences: We use cookies to store user preferences and to personalize your experience.
• Analytics: We use cookies to help us track user trends and search patterns.
• Advertising: We also use cookies to display advertising, including ads targeted to your interests. These cookies can also help build user profiles and gather statistics on the performance of our advertisements on other websites.

Most browsers are initially set up to accept cookies. You can reset your browser to refuse all cookies or to indicate when a cookie is being sent. If you want to opt-out of receiving targeted advertisements based on your interest, you can visit the NAI's Consumer Opt Out page, which will allow you to opt-out of seeing advertisements set by participating NAI members.

Google Analytics. We use Google Analytics on our website to track usage data and help improve your experience. You can find more information on how Google uses data at www.google.com/policies/privacy/partners.

HubSpot. We use HubSpot traffic analytics tool on our website (www.Cotiviti.com) to track usage data and help improve your experience. You can find more information on how HubSpot uses data at https://legal.hubspot.com/privacy-policy?hubs_content=knowledge.hubspot.com/reports/analyze-your-site-traffic-with-the-traffic-analytics-tool&hubs_content-cta=Privacy%20Policy&_ga=2.190226091.1014409333.1718130591-1496066595.1718130591.

Responding to "Do Not Track" Signals. Some browsers incorporate a "Do Not Track" feature that signals to websites that a user does not want to have his or her online activity and behavior tracked. Not all browsers offer a DNT option and DNT signals are not yet uniform. Cotiviti takes steps to recognize and respond to DNT signals.

Global Privacy Control (GPC) allows individuals to automatically signal their privacy preferences to websites and other online services through their browser or through an extension. If we receive a GPC signal to opt-out of website tracking, we will honor such requests made on our website (www.Cotiviti.com).

Marketing Opt-Out

If you would like to opt out of receiving promotional or marketing e-mail from us, you may use the “unsubscribe” mechanism included in each marketing message. Note that your option not to receive promotional and marketing e-mail shall not preclude us from corresponding with you, by e-mail or otherwise, regarding your existing relationship with us. Your opt-out request will also not apply to correspondence that has already been initiated.

Cotiviti's Commitment to Accuracy and Security

The accuracy and security of Personal Information is important to Cotiviti. If you ask us to correct your Personal Information, we will attempt to correct such inaccuracies in a timely manner.

Cotiviti is committed to taking reasonable steps to protect your information from unauthorized access and use. To that end, we have established the appropriate physical, electronic, and managerial policies and procedures to secure this information.

Retention of Personal Information

We may retain Personal Information as reasonably required to provide our products and services, operate our business, and comply with our legal obligations. In determining when your Personal Information is retained or disposed, we may consider the nature and sensitivity of your Personal Information, the potential risk of harm from unauthorized use or disclosure of your Personal Information, the purposes for which we process your Personal Information, and applicable legal requirements.

Information from Minors

We do not knowingly collect data from or market to children under 18 years of age. By using the Sites, you represent that you are at least 18 or that you are the parent or guardian of such a minor and consent to such minor dependent's use of the Sites. If we learn that Personal Information from users less than 18 years of age has been collected, we will take reasonable measures to promptly delete that data from our records. If you become aware of any data we may have collected from children under age 18, please contact us at PrivacyOffice@cotiviti.com.

External Links

Cotiviti's website may provide links to third-party websites. Even if the third-party is affiliated with Cotiviti through a business partnership or otherwise, Cotiviti is not responsible for the content, privacy policies, or practices of such external links. External links are provided for convenience only and access to these links is at your own risk.

International Privacy Disclaimer

Because privacy laws are not the same in all countries, our non-U.S. operations may adopt additional measures depending on local legal requirements. Information obtained from our website generally is processed and stored in the United States in accordance with this Policy, which may not be as comprehensive as required in the European Union or other nations.

Confidentiality and Non-Disclosure Agreements

Nothing in this Privacy Policy shall detract from the rights and obligations of the parties to any non-disclosure or similar agreement that Cotiviti or any of the Cotiviti family of companies have entered into with any customer or other third-party.

Updates to our Privacy Policy

The Cotiviti Privacy Policy is subject to change at any time, and we encourage you to review this policy regularly for any changes. A current policy is available for review on our website at www.cotiviti.com or can be reviewed at our offices at 10701 South River Front Parkway, Suite 200, South Jordan, Utah 84095.

How to Contact Us

If you have questions or comments regarding our Privacy Policy, or any issue relating to how we collect, use or disclose personal information, or if you would like us to update information we have about you or your preferences, please contact us as indicated below.

Email us at: PrivacyOffice@cotiviti.com

Write to us at:

Cotiviti, Inc.

Attention: Privacy Officer

10701 South River Front Parkway, Suite 200

South Jordan, Utah 84095

(770) 379 2800

For Issues regarding Information Security

Email us at: InfoSec@cotiviti.com

Write to us at:

Cotiviti, Inc.

Attention: Chief Information Security Officer

10701 South River Front Parkway, Suite 200

South Jordan, Utah 84095

(770) 379 2800

Additional Information for California Residents

This section supplements the information contained in the rest of this Privacy Policy and applies solely to consumers residing in the state of California, who visit or use the Sites.

California residents may have certain rights, subject to legal limitations, concerning the collection, use, and disclosure of Personal Information.

• Right to Know. You may have the right to request information about the categories of Personal Information we have collected about you, the categories of sources from which we collected the Personal Information, the business or commercial purposes for collecting the Personal Information, and to whom we have disclosed Personal Information and why. You may also request the specific pieces of Personal Information we have collected about you.
• Right to Delete. You may have the right to request that we delete Personal Information that we have collected from you.
• Right to Correct. You may have the right to correct or request that we correct inaccurate Personal Information that we maintain about you.

California job applicants and business contacts may submit requests via our webform located at www.dsrcotiviti.ethicspoint.com or by calling us at 844-916-1330. We will not discriminate against you for exercising your privacy rights.

Verification: To process requests, we will need to obtain information to locate you in our records or verify your identity depending on the nature of the request ("verifiable request"). In most cases, we will collect some or all of the following data elements: first and last name, email address, and telephone number. In some cases, we may request different or additional information, including a signed declaration that you are who you say you are, and will inform you if we need such information. If we cannot verify your identity, we may reject your request in whole or in part.

Authorized Agents: Authorized agents may exercise rights on behalf of California residents by submitting a request via our webform and indicating that they are submitting the request as an agent. We will require the agent to demonstrate authority to act on behalf of the resident, such as by providing signed permission from the resident. We may also require the resident to verify their own identity directly with us or to directly confirm with us that they provided the authorized agent permission to submit the request. We may deny a request from an authorized agent who does not submit sufficient proof to act on your behalf.

Timing: We will confirm receipt of your verifiable request within ten (10) business days. We will respond to all requests within 45 days, unless we need more time, in which case we will notify you and may take up to 90 days total to respond to your request.

Opting out of Sales/Sharing: You also have the right to opt of the sale of your Personal Information or the sharing of your Personal Information for cross-context advertising. To exercise your right to opt out of the sale of your personal information, you can enable the Global Privacy Control (GPC) signal on your web browser; we will process this signal in a 'frictionless' manner, meaning we will not require any additional confirmation from you, change your user experience, or display any pop-up notifications upon receiving the signal. We accept Right to Opt Out of Sales requests sent through commonly used and recognized opt-out preference signals that you have enabled, such as HTTP headers. Cotiviti does not otherwise "sell" your Personal Information, including Personal Information of children under 16.

www.dsrcotiviti.ethicspoint.com

Updated: September 18, 2024