Snapshot 219904
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Skip to main content
Komodo Health Privacy Notice
Komodo Health Privacy Notice
Komodo Health, Inc., and its affiliates (collectively, “we,” “our,” “us,” or “Komodo Health”) are committed to protecting your privacy and Personal Data about you. This Privacy Notice is intended to describe our practices regarding collection, use, and sharing of Personal Data relating to visitors to the Komodo Health website (www.komodohealth.com, the “Site”), product users, customers, prospective and former customers, business partners, and healthcare professionals. Where we refer to “Personal Data” throughout this Privacy Notice, we mean “Personal Data” or “Personal Information” as such terms are defined in applicable an applicable law or regulation.
Personal Data Collected
When You Communicate With Us
When you communicate with us in and through the Site, email us, or otherwise communicate with us, we collect the following identifiers or professional information that may, alone or in combination with other information, constitute Personal Data:
Name, company name, job title, state/region;
Contact information such as email address and phone number; and
Content of communications sent to us.
When You Request Information From Us
When you use features such as “Contact” or “Request Demo” on the Site, we collect the following identifiers or professional information that may, alone or in combination with other information, constitute Personal Data:
Name, company name, job title, state/region;
Contact information such as email address and phone number; and
Which of our data products and services (collectively, our “Services”) may interest you.
When We Collect Healthcare Provider Personal Data
In connection with our Services, we collect the following professional information or identifiers about healthcare providers from third party sources and publicly available sources. Some of this information may, alone or in combination with other information, constitute Personal Data:
Name, company name, affiliated institution names, job title, professional credentials;
National Provider Identifier (NPI); and
Contact information such as email address, office address, fax number, and phone number.
Healthcare Provider Correction and Appeal Requests
If you use the Provider Correction and Appeal Request form available through https://www.komodohealth.com/provider-correction-and-appeal-request you must provide:
Name;
Organization;
NPI;
Contact information such as email address and phone number; and
Correction request details.
Professional or Employment-Related Information
If you approach us with respect to our career opportunities, we collect the following professional or employment-related information that may, alone or in combination with other information, constitute Personal Information:
Name;
Contact information such as email address and phone number;
Personal Information included in the resume/CV and cover letter; and
Personal Information included in your public LinkedIn profile.
Customer and User Data
If you are a representative of a current, former, or prospective customer or a user of our Services or the Site, we collect the following information that may, alone or in combination with other information, constitute Personal Data:
Name, contact information (e.g., business email address and phone number, etc.), job title and/or job function, and company name;
Account usage, login credentials, and device information collected during or from your usage of our Services (e.g., username, IP address, device type, browser version, locale, language settings, user activity logs, session IDs, connectivity, technical, and aggregated usage data, etc.); and
Our communications and correspondences with you, including sensory information such as audio and video recordings and transcriptions of meetings and transcriptions and analyses and inferences derived from such correspondences and sensory information;
Internet Activity Information
Software used on the Site collects Internet or other electronic network activity information that may, alone or in combination with other information, constitute Personal Data:
The domain from which you access the Site;
The type of browser and operating system used in the device you use to access the Site;
Internet Protocol (IP) address;
The date and time you visited the Site (time stamp);
The website used to link to the Site from;
Any search terms used to navigate the Site;
The language used in browsing the Site in social media applications;
A browsing session ID; and
Whether you are a first time visitor to the Site.
Sources of Personal Data
In the last 12 months, we have collected Personal Data from the following categories of sources:
You: information collected directly from you;
Software: information automatically collected via cookies, web logs, web beacons, and other software-based analytics tools;
Publicly available sources;
Commercial partners: information obtained from our data licensors and commercial partners, including commercial data aggregators; and:
Commercial resources: other commercially available resources, such as medical publications.
How the Personal Data is Used
We use Personal Data about you for the following purposes:
To operate and improve our Site, including through analytics to help us understand how you use the Site, so that we can present content in the best manner;
To provide the Services to you;
To operate, develop, support, and improve our Services;
To provide you with any information that you request from us. If you do not provide us with the information we need to respond to your request, we may not be able to provide you with the information that you request from us;
To carry out internal business operations. For example, financial reporting, internal reporting and business modeling purposes (e.g., forecasting, product strategy), analysis of conversion rates, sales, system usage, marketing effectiveness, training, customer and account management, as well as for other business analytics projects and internal reporting.
To notify you about changes to the Site and our Services;
To enable us to issue a notice, administrative, or corrective action to you in relation to the Site or the Services, if required;
To send you direct marketing messages that you have consented to receive;
To protect against, identify, and prevent fraud and other unlawful activity, claims, and other liabilities;
To comply with applicable legal and regulatory requirements, industry standards, and our own policies; and
Where permitted by law, to provide you with information about other products and services we offer that are similar to those that you have already subscribed to or inquired about and we feel may interest you.
How Personal Data is Shared
In the past 12 months, we have disclosed the following categories of Personal Information with the following categories of third parties for a business or commercial purpose:
Komodo Affiliates and Subsidiaries
Identifiers
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))
Commercial or transactions related information
Professional or employment related data
Inferences drawn from other Personal Data
Internet or other similar network activity
Service Providers / Business Partners
Identifiers
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))
Commercial or transactions related information
Internet or other similar network activity
Professional or employment related data
Inferences drawn from other Personal Data
Customers and Users of our Services
Identifiers
Professional related data
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))
Commercial or transactions related information
Counterparties in Relation to a Sale, Merger, Acquisition, or Similar Corporate Event
Identifiers
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))
Commercial or transactions related information
Public Authorities and Legal Proceedings
Identifiers
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))
Commercial or transactions related information
Protected classification characteristics under California or federal law
Sensitive personal data
Professional or employment related data
U.S. State Privacy Rights
Depending on the state in which you reside and whether or not the law applies to our company, you may have certain privacy rights regarding your personal data. If you are a California resident, this section does not apply to you. California residents should refer to the "California Privacy Rights" section. For residents of other states, your privacy rights may include (if applicable):
The right to confirm whether or not we are processing your personal data and to access such personal data and the categories of personal data we are processing or have processed;
The right to obtain a copy of your personal data that we collected from and/or about you in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the information to another controller without hindrance, where the processing is carried out by automated means;
The right, at our option, to obtain a list of specific third parties, other than natural persons, to which we have disclosed your personal data or any personal data;
The right to obtain a list of categories of third parties to which we have disclosed your personal data;
The right to delete personal data that we collected from and/or about you, subject to certain exceptions;
The right to correct inaccurate personal data that we maintain about you, subject to certain exceptions;
The right, if applicable, to opt out of the processing of your personal data for purposes of (1) targeted advertising; (2) the “sale” of your personal data (as that term is defined by applicable law); and (3) profiling in furtherance of decisions that produce legal or similarly significant effects concerning you;
If we are required by applicable law to obtain your consent to process sensitive personal data, the right to withdraw your consent; and
The right not to receive discriminatory treatment by us for the exercise of your privacy rights.
Depending on how the applicable privacy law defines a “sale,” we may sell personal data to third parties. For instance, our use of cookies and tracking technologies on the Site may constitute a sale of personal data to third-party advertisers. We may also use cookies and other tracking technologies to display advertisements about our products to you on nonaffiliated websites, applications, and online services. This is “targeted advertising” under applicable privacy laws. We do not use personal data for profiling in furtherance of decisions that produce legal or similarly significant effects concerning individuals.
To exercise privacy rights you may have under applicable state law, please submit a request through our interactive privacy request webform (linked here) or by calling us at 1-888-919-1959. If legally required, we will comply with your request upon verification of your identity and, to the extent applicable, the identity of the individual on whose behalf you are making such request. To do so, we will ask you to verify data points based on information we have in our records. If you are submitting a request on behalf of another individual, please use the same contact methods described above. If we refuse to take action regarding your request, you may appeal our decision through our interactive webform available (linked here) or by calling us at 1-888-919-1959. If you would like to opt out of targeted advertising, you may alter your cookie settings by clicking "Cookie Settings" in the footer of the Site.
Additional Information:
We are not currently accepting privacy rights requests from individuals that reside in U.S. states that do not have an applicable data privacy law that grants individuals such privacy rights.
Certain U.S. states do not contemplate the concept of an "authorized agent" making a request on behalf of a consumer. In such cases, we reserve the right to reject requests made by individuals or entities claiming to be an "authorized agent" of the individual. In cases where the U.S. state does permit the use of authorized agents, the request must include all of the required information to evidence the appointment, and we may contact the individual directly to confirm the validity of the authorized agent and/or with the request response where permitted by applicable law.
Many state privacy laws do not apply to individuals where they are acting in a commercial or employment context. As a result, these laws may have limited applicability to our operations with respect to residents of the states where these laws are in effect.
State privacy laws generally do not govern and/or provide for privacy rights in relation to certain publicly available information or information that is de-identified or aggregated. Where that is the case, this Privacy Notice does not cover our collection, licensing, use, or disclosure of such information. Further, we publicly commit to not re-identifying any de-identified individuals contained within "de-identified data" (as such term is defined under applicable privacy laws), and we also contractually prohibit authorized recipients of de-identified data from re-identifying.
California Privacy Rights
This section describes how Komodo collects, uses, and discloses the Personal Data of California residents (“consumer” or “you”) when we are acting as a business (as such terms are defined by the CCPA and CPRA). If you are not a California Resident, this section does not apply to you.
Under the CCPA, personal data does not include certain publicly available information, deidentified or aggregated consumer information, and certain types of other information such as health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) or the California Confidentiality of Medical Information Act (CMIA), or clinical trial data subject to the Common Rule. The CCPA also do not apply to information that is de-identified in accordance with the requirements for deidentification set forth in Section 164.514 of Part 164 of Title 45 of the Code of Federal Regulations (the "expert determination" and "safe harbor" methods) and is derived from patient information that was originally collected, created, transmitted, or maintained by an entity regulated by the Health Insurance Portability and Accountability Act ("HIPAA"), the Confidentiality of Medical Information Act, or the Federal Policy for the Protection of Human Subjects. Therefore, this Privacy Notice and this section do not cover our collection, licensing, use, or disclosure of such de-identified information. Further, we publicly commit to not re-identifying any de-identified individuals contained within "de-identified data" (as such term is defined under the CCPA and other privacy laws), and we also contractually prohibit authorized recipients of de-identified data from re-identifying.
If you are a California resident and we maintain Personal Data about you that is subject to the CCPA, you have the right:
To request that we disclose to you the following information covering the 12-month period prior to your request (“Request to Know”):
The categories of Personal Data we collected about you and the categories of sources from which we collected the Personal Data;
The business or commercial purpose for collecting Personal Data about you;
The categories of third parties to whom we disclosed Personal Data about you, and the categories of Personal Data disclosed; and
The specific pieces of Personal Data we collected about you;
To request that we delete Personal Data we collected from you (“Request to Delete”);
To request that we correct inaccurate Personal Data that we maintain about you (“Request to Correct”);
To opt-out of the "sale" or "sharing" of your Personal Data ("Request to Opt-out of Sale or Sharing");
To be free from discrimination by a business for exercising your privacy rights under the CCPA.
The CCPA defines a “sale” as the disclosure of Personal Data for monetary or other valuable consideration. We have no actual knowledge that we sell or share Personal Data of California residents 16 years of age and younger. In the last 12 months, we have not sold or shared Sensitive Personal Data. With respect to our practices relating to Personal Data collected and used through our Site and/or as an element of our Services in the last 12 months, we have sold or shared the following categories of Personal Data:
Non-public e-mail address or other contact information for a healthcare professional.
Non-public professional or employment-related information of a healthcare professional such as field of specialty.
Identifiers such as unique personal identifier, online identifiers (e.g., cookies, mobile IDs, other online advertising identifiers), IP address, email address, or other similar identifiers of website visitors for the purposes of online advertising, measurement and analytics of advertising campaigns, and/or personalization.
If you would like to opt-out of the sale or sharing of your Personal Information, you must submit an opt-out request by through our California Privacy Opt-out Portal (linked here).
California residents must make a Request to Know, Delete, or Correct by:
Contacting us at 1-888-919-1959.
Submitting your request to Komodo’s Privacy Rights Portal (linked here).
When you make a Request to Know, Delete, or Correct, we will require verification that you are who you say you are before your Request can be processed. For example, we may use an e-mail verification solution and/or attempt to match information that you provide in making your Request with other sources of similar information to reasonably verify your identity.
California residents may authorize an agent to make a request on their behalf. A California resident’s authorized agent may make a request on behalf of the California resident by using the submission methods listed above in this section. Authorized agents must provide us with proof that you have given them permission to submit the request on your behalf. We may also require you to verify your identity directly with us or directly confirm with us that you provided the authorized agent permission to submit the request.
We will verify and respond to your request consistent with applicable law, taking into account the type and sensitivity of the Personal Data subject to the request. Please be aware that the CCPA includes certain exemptions or exceptions and there are other laws and regulations outside of the CCPA may apply to the Personal Data that we collect, use, and disclose. Therefore, certain Personal Data may be exempt from, or outside the scope of, a Request to Know, Delete, or Correct.
The table below reflects our California privacy request metrics for January 1, 2025 to December 31, 2025. The information provided reflects requests from California consumers only.
Request Type Number of Requests Received Number of Requests Complied With in Whole or in Part Number of Requests Denied Median Number of Days to Substantively Respond to Requests Mean Number of Days to Substantively Respond to Requests
Request to Know What Personal Information is Collected 2
2
0 27.5 27.5
Request to Know What Personal Information is Sold or Shared
1
1
0 40 40
Request to Delete 564
338
226
13.23 24.48
Requests to Limit Use of Sensitive Personal Information 0 -
-
-
-
Request to Opt Out of Sale/Sharing 70
54
16
4.62
6.35
EU and UK GDPR Rights
The GDPR is a European Union regulation that protects the rights of data subjects in the European Economic Area (EEA), with respect to the processing of their “personal data,” as such term is defined in the GDPR. The UK GDPR is the GDPR, as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, which protects the rights of data subjects in the United Kingdom (UK), with respect to the processing of their “personal data,” as such term is defined in the GDPR.
Komodo Health will process Personal Data that is subject to the GDPR only if and to the extent that at least one of the following lawful bases applies:
The processing is necessary for the purposes of the legitimate interests pursued by Komodo Health or the legitimate interests of a third party.
The processing is necessary for the performance of a contract to which you are a party.
You have given consent to the processing of your Personal Data for a specific purpose.
The processing is necessary for Komodo’s compliance with a legal obligation.
If you are located in the European Union or UK, you have certain data protection rights under the GDPR or UK GDPR, respectively. In certain circumstances, you have the following rights:
Access: the right to know what personal data we store about you and to request that we send you a copy of that personal data.
Data portability: the right to request that we transfer the personal data we have collected about you to another organization.
Correction: the right to request that we correct or update any inaccurate or incomplete personal data we hold about you.
Deletion: the right to request that we delete your personal data. This right is sometimes also referred to as the “right to erasure” or the “right to be forgotten.”
Restriction: the right to request that we restrict or suspend processing of your personal data, and the right to object to further processing of your personal data that is inconsistent with the purpose for which it was collected.
Objection: the right to object to our use of your personal data to send you newsletters or other email marketing notifications, including through automated decision making.
Individuals
If you would like to exercise one of these privacy rights, please submit a request using our Privacy Rights Portal (linked here).
Security
We take reasonable and appropriate measures to protect Personal Data from loss, misuse and unauthorized access, disclosure, alteration, and destruction, taking into account the risks involved in the processing and the nature of the Personal Data. Despite our efforts to store Personal Data in a secure operating environment that is not available to the public, we cannot guarantee the security of Personal Data during its transmission or its storage on our systems. Further, while we attempt to ensure the integrity and security of Personal Data, we cannot guarantee that our security measures will prevent malicious third parties from illegally obtaining access to Personal Data. We do not warrant or represent that Personal Data about you will be protected against, loss, misuse, or alteration by third parties.
Retention of Personal Data
Personal Data is kept for as long as needed for the purposes described in this Privacy Notice and for our legitimate business purposes (e.g., complying with our legal obligations, maintaining business and financial records, resolving disputes, maintaining security, detecting fraud and abuse, and enforcing our agreements), after which it is destroyed in accordance with Komodo’s retention policies.
International Data Transfers
We may transfer, store, or otherwise process Personal Data in the United States or in another country that has a lower or different level of data protection law than your own country. However, we have taken appropriate safeguards with respect to the protection of your privacy, fundamental rights and freedoms, and the exercise of your rights. For example, if we transfer personal data from the EEA that is subject to the General Data Protection Regulation ("GDPR") to a country outside of the EEA, such as the United States, we will implement an appropriate data transfer solution such as entering into Standard Contractual Clauses, or taking other measures to provide an adequate level of data protection under the GDPR.
Cookies
A cookie is a small file containing a string of characters that is sent to your computer when you visit a website. When you visit the website again, the cookie allows that website to recognize your browser. Cookies may store user preferences and other information. Cookies also provide a convenience feature to save you time or tell a web server that you have returned to a specific page. Cookies set by the website owner (in this case, Komodo) are called "first party cookies". Cookies set by parties other than the website owner are called "third party cookies." Third party cookies enable third party features or functionality to be provided on or through the website (e.g., like advertising, interactive content, and analytics). The parties that set these third-party cookies can recognize your computer both when it visits the website in question and when it visits certain other websites. We use first party and third-party cookies for several reasons. Some cookies are essential for our Sites to operate, and we refer to these as "essential" or "strictly necessary" cookies. Other cookies also enable us to track and target the interests of our users to enhance or improve the experience or functionality on our Sites. In some cases, we use third party cookies for advertising, analytics, and other purposes. The types of cookies we use are described in more detail below.
Essential Cookies are necessary for the Sites to work and enable you to move around it and use its services and features.
Functional Cookies allow websites to remember the user’s site preferences and choices they make on the site including username, region, and language. This allows the website to provide personalized features.
Analytics/Performance Cookies help us understand, improve, and research products, features, and services, and understand how well our Sites and services perform.
Advertising and Marketing Cookies help us deliver marketing campaigns and track their performance (e.g., understanding what features of are interest to you on our Sites so that we can send you relevant advertising). Similarly, our partners may use cookies to provide us with information about your interactions with their services, but use of those third-party cookies would be subject to the service provider’s policies.
Cookies are not the only way to recognize or track visitors to a website. We employ a software technology called clear gifs (a.k.a. Web Beacons/Web Bugs), that help us better manage the Sites and related services by informing us what content is effective. Clear gifs are tiny graphics with a unique identifier, similar in function to cookies, and are used to track the online movements of Web users. In contrast to cookies, which are stored on a user's computer hard drive, clear gifs are embedded invisibly on Web pages or in emails and are about the size of the period at the end of this sentence. We may use clear gifs or pixels in our HTML-based emails to let us know which emails have been opened by recipients. This allows us to gauge the effectiveness of certain communications and marketing campaigns.
You have the right to decide whether to accept or reject non-essential cookies. You can exercise your cookie preferences by clicking on the "Cookie Settings" link in the footer of the Site. You can also set or amend your web browser controls to accept or refuse cookies. If you choose to reject cookies, you may still use our Sites, although your access to some functionality and areas of our Sites may be restricted. How you can refuse cookies through your web browser controls vary from browser-to-browser, you should visit your browser's help menu for more information. In addition, most advertising networks offer you a way to opt out of targeted advertising. If you would like to find out more information, please visit https://www.youronlinechoices.com/. Google Analytics is also an element of the Site. By using cookies, Google Analytics collects and stores data such as time of visit, pages visited, time spent on each page of the Site, the Internet Protocol address, and the type of operating system used in the devices used to access the Site. You can opt-out of Google Analytics by using a browser plugin provided by Google and available at http://www.google.com/ads/preferences/plugin/.
Children
The Site and the Services are not intended for children under the age of 16. Accordingly, we do not intend to collect personal data from anyone we know to be under 16 years of age. We do not intentionally collect, sell, or process the personal information of individuals under 16 years of age.
Links to Other Sites
The Site may contain links to other websites of interest. However, once you have used these links to leave the Site, we do not have any control over third party websites. We cannot be responsible for the protection and privacy of any information that you provide when visiting such sites and external sites are not governed by this Privacy Notice. You should exercise caution and review the privacy notice applicable to any website in question.
Changes to this Privacy Notice
We may revise this Privacy Notice from time to time. We encourage you to check this page periodically for any changes. Any changes to this Privacy Notice take effect immediately after being posted or otherwise provided by us.
Contact Information
If you have any questions or comments about this Privacy Notice or how we handle Personal Data, please contact our Privacy team using one of the methods below.
Komodo's Privacy Rights Request Portal: Click here to access
Postal mail: Komodo Health, Inc., Attn: Chief Privacy Officer, 257 Park Avenue South, 2nd Floor, New York, NY 10010, United States