Last Updated: March 6, 2024

This XCaliber Privacy Notice (“Notice”) explains how XCaliber Inc. and its affiliates and subsidiaries operating under the XCaliber brand (“XCaliber“, “we“, “our” or “us“) collect, store, use, disclose and otherwise process information about you in the course of our business, including through our websites that link to this Notice (such as, www.XCaliber.com) (the “Sites“), our generally available software-as-a-service offering hosted by or on behalf of XCaliber (the “Service”) and through other means such as our and our partner’s events, sales and marketing activities. This Notice also sets out more information about your privacy rights.

‍About Our Service
‍We provide the Service to our customers under an agreement with them and solely for their benefit. Our customers designate which of their personnel (including third party contractors, agents, etc.) are authorized as users of the customer’s Service account (“Authorized Users“). Authorized Users may access and use the Service from all over the world, subject to the agreement between XCaliber and the customer as well as any applicable laws.

‍

This Notice does not apply to the content that our customers and their Authorized Users upload and store in the Service (“Customer Content”). XCaliber processes Customer Content solely on behalf of the customer and that customer is responsible for the collection and use of your data. Because of this, that customer’s privacy notice (and not this Notice) will apply to the customer’s collection and use of Customer Content. Therefore, for any queries related to your data in Customer Content, you should refer to their privacy notice and direct any queries to them. The customer’s agreement with XCaliber governs our use of and processing of Customer Content.

‍1. Information You Provide
‍The personal information we collect when you use the Sites, including when you sign up to the Service through our Sites’ self-service portal (“Self-Service”), and the reasons why you are asked to provide it, will be made clear to you at the point we ask you to provide your personal information. We will let you know prior to the collection of your personal information whether the provision of personal information we are collecting is compulsory or may be provided on a voluntary basis.

‍When using the Sites: We may collect your name, email, postal address, phone number and other information you provide via the Sites when, for example, you submit inquiries, request more information about our services, complete surveys,download XCaliber collateral, provide feedback about our services or register for sales events or marketing activities.

‍When using our Service: When you register to use our Service, we may collect your personal information (like name and contact details), and via Self-Service we collect credit card information for payment and billing purposes. You can also provide or link additional information when you choose to link your community cloud account with your service account, or if you choose to provide any additional information about yourself when submitting a support ticket.

‍When communicating with us: We may collect your name, title, and company name, and audio transcripts, audio visual recordings, and other information you provide and/or consent to when you communicate with us in person or on calls.

‍2. Information We Automatically Collect
When using the Sites: We automatically collect information when you visit or use the Sites, including your use of Self-Service. This information may reveal your identity and may include information about the specific computer or device you are using, such as your computer’s operating system and Internet Protocol (IP) address. Also, we automatically collect and store information about your activities on our Sites, such as information about how you came to and used our Sites, event information (like access times, browser type, and language) and data collected through cookies and other similar technologies that uniquely identify your browser, computer and/or other device. We may disclose information about your computer or other device with our third-party service providers for information and network security, including fraud detection.

‍When using the Service: We automatically collect data relating to the performance and configuration of our Service and our customers’ and their Authorized Users’ consumption, use of, and interaction with the Service (collectively, “Usage Data“). While most Usage Data does not include personal information, the following types of Usage Data may include personal information:

‍

• technical information, or data obtained from APIs, software or systems hosting the products and services and devices accessing these products and services, log files generated during such use;
• data and metadata about an Authorized User, such as user ID, email, IP address, other data about the Authorized User’s computer or other device, browser and connecting software (e.g., OS and software versions); and
• data and metadata about an Authorized User’ activities and behavior within our Service, such as click-patterns and feature utilization.

‍

Usage Data is used by XCaliber for (a) providing, supporting, and operating our products and services, (b) network and information security, and (c) analyzing, developing, and improving our products and services.

‍3. Information We Receive from Third Parties
‍From time to time, we may obtain information about you from third party sources, such as public databases and websites, resellers and distributors, joint marketing or business partners, security and fraud detection firms and social media platforms. Examples of the information we may receive from other sources include: account information; page-view information; contact information from business partners with whom we operate XCaliber or industry events, sales and marketing campaigns, or joint offerings; search results and links, including paid listings (such as sponsored links); and credit history information from credit bureaus.

‍4. Third Party Applications
‍We may link to third-party websites or applications in our Service, or on our Sites. In those circumstances, the data we collect, use and disclose via the Sites or the Service will be subject to this Notice, including our Cookie Statement. However, your use of the third-party websites, applications and any information you instruct us to send to the third-party (via clicking and accessing third-party websites or applications) will be subject solely to the third-party’s terms and conditions and their privacy notice, and will not be subject to this Notice.

When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email or home address. We (or service providers on our behalf) may then send communications and marketing to these email or home addresses. You may opt out of receiving this advertising by visiting https://app.retention.com/optout
‍
‍5. Targeted Online Advertisements
‍We use one or more third party service providers to serve ads about our products and services on other websites. These third parties may automatically collect and use certain information about your online activities, either on our Sites or other websites, such as your IP address, your ISP and the browser you are using. They may collect your information by using cookies, pixel tags, clear gifs and similar tracking technologies. We use the information collected, alone or in combination with information about you that we obtain from other sources (like our data partners and offline customer data), to among other things, deliver advertising targeted to your interests, including serving ads related to our products or services when you access and use other websites, and to better understand the usage of the Sites tracked by these third parties. This Notice does not apply to, and we are not responsible for, cookies, pixel tags or clear gifs in ads delivered by third parties on other websites, and we encourage you to check the privacy notices of ad services to learn about their use of cookies and other online tracking technology.
‍
‍6. Use of Information We Collect
‍We use personal information collected via the Sites, our Service and through other means (e.g., in person or on calls) for purposes described in this Notice, including using your information to:

‍

• operate, audit and improve our Sites, products and services;
• provide customer service and support;
• provide and to facilitate the delivery of products and services you request;
• send you related information, including confirmations, invoices, technical notices, updates, security alerts, training and support and administrative messages;
• maintain your account;
• enhance security, monitor and verify identity or service access, combat fraud, spam, malware or other network and/or information security risks;
• detect bugs, report errors and perform activities to maintain the quality or safety of our services;
• conduct research and development;
• understand you and your preferences to enhance and personalize your experience and enjoyment when using our Sites, products and services;
• develop and send you direct and online advertising, sales and promotional communications (where this is in accordance with your marketing and cookie preferences);
• communicate with you about one of our events or our partner events, including webinars and demos;
• respond to your comments or questions or provide information requested by you;
• link or combine it with other personal information we get from third parties, to help understand your needs, provide you with better service and to prevent fraud;
• process and deliver contest entries and rewards;
• display and measure engagement with advertisements across different devices and sites;
• maintain legal and regulatory compliance;
• short-term, transient use, such as customizing content that we or our service providers display on the services; and
• process your information for other legitimate business purposes, such as customer surveys, data analysis, audits, collecting and assessing feedback, identifying usage trends, determining the effectiveness of our marketing campaigns and to evaluate and improve our products, services, marketing and customer relationships.

‍

We may store and process personal information in the United States and other countries.
‍
‍7. Sharing of Personal Information
‍We do not disclose your personal information to third parties other than as follows:

‍

• where it has been de-identified, including through aggregation or anonymization;
• when you instruct us to do so;
• with your consent, for example, when you agree to our disclosing your information to other third parties for their own marketing purposes subject to their separate privacy policies;
• with XCaliber affiliates, in such case the information will be processed as otherwise described in this Notice;
• with third party vendors, consultants and other service providers who work for us and need access to your information to do that work. Examples include vendors and service providers who provide assistance with marketing, billing, processing credit card payments, data analysis, fraud prevention, network and information security, technical support and customer service;
• with third party business partners, such as distributors, and/or referral partners, who are involved in providing services to our prospects and/or customers, to fulfill product and information requests and to provide customers and prospective customers with information about XCaliber and its products and services. From time to time, we may engage in joint sales or product promotions with select business partners. If you purchase or specifically express an interest in a jointly-offered product, promotion or service, we may share relevant personal information with those partner(s). Where you have given your consent to do so, these business partners may send you marketing communications about their own products and services. Please be aware that we do not control our business partners’ use of such information. Our partners are responsible for managing their own use of the personal information collected in these circumstances. We recommend you review the privacy notices of the relevant partner to find out more about their handling of your personal information.
• with providers who offer products on the XCaliber Marketplace, to fulfill product and information requests, to facilitate Marketplace transactions, and to provide customers and prospective marketplace consumers with information about products on the XCaliber marketplace. If you purchase or specifically express an interest in a provider product, we may share relevant personal information with that provider. Where you have given your consent to do so, these providers may send you marketing communications about their other listings on the XCaliber Marketplace;
• to comply with laws or to respond to lawful requests and legal process, to protect our rights and property and that of our agents, customers, members and others including to enforce our agreements, policies and terms of use or in an emergency to protect the personal safety of any person;
• in order to protect any individual’s vital interests, but only where we believe it necessary in order to protect the vital interests of any person; or
• in connection with or during negotiation of any business transfer, merger, financing, acquisition, or dissolution transaction or proceeding involving sale, transfer, divestiture or disclosure of all or a portion of our business or assets to another company.

‍

‍8. Legal Basis for Processing Personal Information (Visitors and Users From EEA, UK, and Switzerland Only)

‍
‍If you are based in the European Economic Area (“EEA“), Switzerland, or the United Kingdom, XCaliber Inc. is the data controller of your personal information unless the information is collected in circumstances where one of our affiliates is running a local event, training session or survey, for example, and they collect and control that information. In such circumstances, we will endeavor to make this clear to you in a context-specific notification at the point we collect your personal information. Our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it. However, we will normally collect personal information only where we have your consent to do so, where we need the personal information to perform a contract with you, or where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms. In some cases, we may also have a legal obligation to collect personal information from you. If we ask you to provide personal information to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time.

‍9. Security of Your Personal Information
‍We take all reasonable and appropriate steps to protect your personal information in an effort to prevent loss, misuse, and unauthorized access, disclosure, alteration and destruction. We use appropriate technical and organizational measures to protect your personal information which may include: physical access controls, encryption, internet firewalls, intrusion detection and network monitoring depending on the nature of the information and the scope of processing. Our staff, who may have access to your personal information, are required to keep your personal information confidential.
‍
‍10. International Data Transfers
‍Your personal information may be transferred to, and processed in, countries other than the country in which you reside. These countries may have data protection laws that are different to the laws of your country, and in some cases, may not be as protective. Specifically, our website servers are primarily located in the U.S. and we may process your personal information in jurisdictions where our affiliates, partners and third-party service providers are located. Our affiliate locations can be found here:

‍

However, we have taken appropriate safeguards to require that your personal information will remain protected in accordance with this Notice. These safeguards include implementing applicable data transfer mechanisms, such as the E.U. standard contractual clauses, or other lawful mechanisms for transfers of personal information in accordance with applicable data protection law. xclaiber has also self-certified compliance with the EU-U.S. Data Privacy Framework, the UK extension to the EU-U.S. Data Privacy Framework, and the Swiss-US Data Privacy Framework as set forth by the U.S. Department of Commerce with respect to personal information relating to individuals from the EEA, UK, and Switzerland.
‍
‍11. Your Information Choices and Changes
‍You may opt out of receiving promotional emails from us by following the instructions in those emails or by accessing the XCaliber Preference Center. If you opt out, we may still send you non-promotional emails, such as emails about your accounts or our ongoing business relationship. You may have additional privacy rights.
‍
‍12. California Users and Notice at Collection
‍The California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (“CCPA”), requires businesses that collect personal information of California residents to make certain disclosures regarding how they collect, use, retain and disclose such information. This section addresses those requirements. For a description of all of our data collection, use and disclosure practices, please read this Notice in its entirety.Personal Information Collection and Disclosure: Other than XCaliber’s sharing of personal information (as defined by CCPA and its implementing regulations) as set forth in the second table below, XCaliber does not sell personal information as we understand the term sale to be defined by the CCPA and its implementing regulations. The categories of personal information we collect about you and the third parties to whom we disclose that personal information for a business purpose are as follows:

‍

Categories of Personal Information Shared in the Preceding 12 Months:

‍
XCaliber does not use or disclose sensitive personal information for purposes other than those permitted purposes under the CCPA.

‍

XCaliber does not have actual knowledge that it sells or shares the personal information of consumers under 16 years of age.

‍
Sources of Personal Information: The sources from which we collect personal information are described in Sections 1 (INFORMATION YOU PROVIDE), 2 (INFORMATION WE AUTOMATICALLY COLLECT) and 3 (INFORMATION WE RECEIVE FROM THIRD PARTIES) above.

‍

Purposes for Collecting Personal Information: We collect and disclose personal information identified in the lists above to communicate with you, for marketing and promotional purposes, to provide and improve our services and other purposes.

‍

California Consumer Rights: California law gives California residents the right to make certain requests with regard to their personal information .
‍
‍13. Events
‍We may collect, share and use personal information about you in connection with any events (such as a trade show, webinar, seminar, virtual event, or conference) that we participate in or sponsor and any related websites, social networking features or mobile apps (collectively, the “Events”). For more information about the personal information we collect, share and use at Events please see our XCaliber Event Privacy Notice.

‍14. Your Privacy Rights
‍You may have privacy rights regarding your personal information.

‍

• You may request a copy of your personal information or request to correct, update, or delete your personal information.
• You may request that we disclose what personal information we collect, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, and the categories of third parties to whom we disclose personal information.
• Where required by law, you can object to processing of your personal information, ask us to restrict processing of your personal information, or request portability of your personal information.
• If we collected and processed your personal information with your consent, where required by law, you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.
• Where applicable, if you wish to submit a complaint to a data protection authority about our collection and use of your personal information, you can find contact details for data protection authorities in the EEA.
• Californians also have the right to opt out of the sale of personal information or the sharing of personal information for cross-context behavioral advertising, as well as the right to limit the use or disclosure of sensitive personal information for purposes other than those permitted by the CCPA if sensitive personal information is collected. As described above, we do not sell your personal information, or use or disclose sensitive personal information for purposes other than those permitted by the CCPA.
  
  To opt out of the sharing of personal information for cross-context behavioral advertising:

‍

• You can disable certain cookie-based sharing. Alternatively, if you have a legally-recognized browser-based opt-out preference signal turned on via your device browser, such as the Global Privacy Control, we recognize such preference in accordance with applicable law.
• Submit a request to opt out of email based sharing.
  
  For other requests regarding your personal information that is processed by XCaliber, you can submit a request online by emailing privacy@xcaliberhealth.ai
  
  XCaliber will verify that the information you submit (which may include your first name, last name, email address, company, and country/state) matches our records before we fulfill the request. You may use an authorized agent to submit a consumer rights request on your behalf using the methods above, however, XCaliber will require the authorized agent to provide signed permission to submit the request on your behalf and may still contact you to confirm your identity and that this request was submitted with your permission.
  
  XCaliber does not discriminate against you for exercising your rights or offer you financial incentives related to the use of your personal information.
  
  ‍15. Your Privacy Rights in Respect of Customer Content
  ‍If personal information pertaining to you as an individual has been submitted to the Service by or on behalf of a XCaliber customer and you wish to exercise any data protection rights you may have in respect of that information under applicable law, including (as applicable) the right to access, port, correct, amend or delete such information, please inquire with the relevant XCaliber customer directly. We have a limited ability to access Customer Content.
  ‍
  ‍16. Data Retention and Deletion
  ‍We retain personal information we collect from you where we have an ongoing legitimate business need to do so (for example, to comply with applicable legal, tax or accounting requirements, to enforce our agreements or comply with our legal obligations). When we have no ongoing legitimate business need to process your personal information, we will either permanently delete or anonymize it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible. When processing Customer Content on behalf of our customers, we will retain Customer Content as described in our agreement with that customer.
  ‍
  ‍17. Changes to this Notice
  ‍We may change this Notice from time to time. If we make any changes to this Notice, we will change the “Last Updated” date above. If such changes are material in nature, we will provide you with additional notice (such as adding a statement to the main website page or sending you an email notification).
  
  ‍18. How to Contact Us
  ‍If you have any questions about this Notice or privacy-related issues, please contact us at privacy@xcaliberhealth.ai

‍