Privacy Policy

1. Introduction

Sevana Health (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website sevanahealth.com, apply for a job with us, and when organizations use our healthcare compliance automation platform.

This policy distinguishes between three groups:

• Website visitors: anyone who browses our public marketing website, fills out a form, or contacts us. The information we collect from website visitors is ordinary business and analytics data, which generally is not Protected Health Information and does not create a HIPAA relationship (see Section 11).
• Job applicants: people who apply for a position through our careers pages (see the Job Applicants section below).
• Platform customers: health plans and their authorized users who license our software. Data processed inside the platform on a customer’s behalf, including any Protected Health Information (PHI), is handled under our customer agreements and Business Associate Agreements (see Section 11).

Our public marketing website and the customer platform are separate systems. The website is hosted by Netlify. The customer platform is hosted separately on Microsoft Azure. Website forms are sales, recruiting, and general-inquiry channels only; they are not approved channels for PHI.

2. Information We Collect

From Website Visitors

When you interact with our website, we may collect:

• Identifiers and contact details you submit through forms (name, email, phone, company, job title)
• Professional information such as your organization and role
• Communications you send to us, including your marketing email preference
• Internet and device activity collected automatically, such as IP address, browser and operating system, pages visited, time on page, and referring website
• Approximate location derived from your IP address

Please do not submit protected health information, member or patient information, or other sensitive health data through any website form.

From Platform Customers

When a customer uses the platform, we process the data their authorized users upload or generate (for example, CMS universe files and compliance records), along with account credentials and billing information. We process this data under the direction of the customer and in accordance with our agreements with them.

3. Job Applicants

If you apply for a position through our website, this section describes how we handle your application information.

What we collect

• Identifiers and contact details: name, email, phone number, and optional LinkedIn or portfolio links
• Professional and employment information: position of interest, years of experience, current employer and role, résumé, cover letter, desired compensation, and anything else you choose to include
• Location and availability: your city and state and your earliest start date
• Work authorization status: whether you are authorized to work in the United States. Some state laws treat citizenship or immigration status as sensitive personal information. We ask for it only to determine eligibility for employment and do not use it to infer anything else about you.
• Referral source: how you heard about the role

The application does not ask for, and we ask you not to include, health or medical information, Social Security numbers, dates of birth, or copies of identity documents. If we need any of these later in the hiring process, we will ask for them through a separate, appropriate channel.

How we use it

We use applicant information to review your qualifications, communicate with you about this and related roles, schedule interviews, make hiring decisions, and meet our legal obligations, including equal employment opportunity requirements. We do not sell applicant information and do not use it for marketing.

Who we share it with

Applications are received and stored through our website host’s form-processing service, which processes them on our behalf. We may also share applicant information with other service providers that support recruiting, with professional advisers, and with authorities when required by law.

Retention and security

If you are not hired, we keep your application for up to 24 months after the position is filled or your application is closed, so that we can consider you for other roles and respond to any legal questions, then delete it. If you are hired, your application becomes part of your personnel record. Applicant information is protected by the safeguards described in Section 10, with access limited to the people involved in hiring.

Your rights

Depending on where you live, you may have the rights described in Section 8, such as the right to access, correct, or delete your application information. Use the methods in Section 8 to make a request.

4. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our website and services
• Respond to inquiries, demo requests, and support requests
• Send technical notices, updates, security alerts, and administrative messages
• Send product news and updates, only if you opted in (you can unsubscribe at any time)
• Measure and analyze website usage (only with your consent for analytics cookies)
• Monitor website performance and reliability
• Detect, investigate, and prevent fraudulent or unauthorized activity
• Comply with legal obligations

We respond to inquiries whether or not you opt in to marketing communications.

5. Cookies, Analytics, and Browser Signals

Analytics. On a first visit we set no analytics cookies. We use Google Analytics only after you choose “Accept all” in our cookie banner. If you choose “Reject all,” dismiss the banner, or never respond, Google Analytics does not load and no analytics cookies are set. Google Analytics is configured without advertising features or Google signals. You can change your choice at any time using the Cookie Preferences link in the footer of every page. If you withdraw consent, analytics stop immediately and we delete the Google Analytics cookies from your browser.

Performance monitoring. Our website host, Netlify, may provide performance telemetry (real user monitoring) that measures page load speed and errors. It is separate from Google Analytics, is used only to keep the site fast and working, does not set cookies, and is not used for marketing or advertising.

Strictly necessary storage. We store your cookie choice in your browser’s local storage so we can remember it. Strictly necessary cookies and storage required for the site to function are always permitted.

Global Privacy Control and Do Not Track. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a choice to keep analytics off, and we do not show the cookie banner automatically. You can still opt in from the footer link if you wish. Because there is no common industry standard for “Do Not Track” browser signals, our website does not respond to them separately; analytics remain off unless you accept them.

6. How We Share Information

We do not sell your personal information. We may share it with:

• Service providers that perform services on our behalf under contracts that limit their use of the data, including our website host (Netlify), which hosts the site, processes form submissions, and provides performance monitoring; and Google, which provides website analytics only if you accept analytics cookies
• Legal authorities when required by law or to protect our rights
• A successor in connection with a merger, acquisition, or sale of assets
• Others with your consent or at your direction

7. Advertising and Opting Out of Analytics

We do not sell personal information, and we do not use or share it for targeted or cross-context behavioral advertising. We do not use advertising cookies or pixels. Analytics cookies are off by default; to keep them off, do not accept them, or withdraw a prior acceptance using the Cookie Preferences link in the site footer. You may also contact us using the methods in Section 8.

8. Your US State Privacy Rights

Depending on your state of residence and whether a law applies to us, you may have rights under laws such as the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and the comprehensive privacy laws of Virginia, Colorado, Connecticut, and Texas, among others. Where a law does not require it, we will still consider requests described below in good faith.

Categories of personal information

In the past 12 months we have collected the following categories from website visitors: identifiers and contact details; professional or employment-related information; internet and electronic network activity (such as pages viewed); and approximate geolocation derived from IP address. We collect these directly from you and automatically from your browser. We disclose these categories to our hosting and analytics service providers for the business purposes described in Section 4. We do not collect sensitive personal information from website visitors who are not applying for a job. From job applicants, we also collect the information described in Section 3, including work authorization status, which we use only to determine eligibility for employment.

Your rights

Subject to applicable law and verification, you may have the right to:

• Know and access the personal information we hold about you
• Correct inaccurate personal information
• Delete personal information we collected from you
• Opt out of targeted advertising, sale, or sharing of personal information (we do not engage in these; see Section 7)
• Data portability: receive a copy of your information in a portable format
• Non-discrimination: we will not deny services, charge a different price, or provide a different level of service because you exercised your rights

How to exercise your rights

You can submit a request using any of these methods:

• By phone: (954) 543-5306
• By email: support@sevanahealth.com
• By web form: our online contact form at sevanahealth.com/contact

You may use an authorized agent to submit a request on your behalf. We will verify your identity before acting on a request, and we will respond within the timeframe required by applicable law.

Right to appeal

If we decline your request, you may appeal our decision by replying to our written response or by contacting us again using any method above and noting that you are submitting an appeal. We will respond to your appeal within the period required by applicable law. If your appeal is denied, you may contact your state attorney general.

9. Data Retention

We keep personal information only for as long as needed for the purposes described in this policy, then delete or de-identify it. In general:

• Form submissions and inquiries (demo and contact requests) are retained for up to 24 months after our last interaction with you, unless a longer period is needed to meet a legal or contractual obligation.
• Job applications are retained as described in Section 3.
• Website analytics data is retained according to our Google Analytics configuration and then automatically expired.
• Customer platform data is retained for the term of the customer agreement and deleted or returned afterward as set out in that agreement.

Where we cannot state an exact period, we determine retention based on the sensitivity of the data, the purpose for which it was collected, and applicable legal, tax, and recordkeeping requirements.

10. Data Security

We implement technical and organizational safeguards, including encryption, access controls, secure storage, and regular assessments. However, no method of transmission or storage is 100% secure.

11. HIPAA and Protected Health Information

HIPAA applies to the data our customers process through the platform, not to ordinary website visitors. When we handle Protected Health Information (PHI) on behalf of a covered entity, we act as a Business Associate and enter into a Business Associate Agreement (BAA) that governs how that PHI may be used and disclosed.

Public website forms are not intended or approved for PHI; please do not submit PHI through them. Information submitted through ordinary website interactions, such as browsing, requesting a demo, or contacting us, generally is not PHI and does not create a HIPAA relationship. If we receive PHI through a public form, we will restrict access to it and delete it in accordance with our security policies and applicable law.

12. Confidentiality

We treat non-public information you provide to us as confidential and use it only to deliver and support our services. We protect such information with reasonable safeguards consistent with industry standards. Confidential information does not include information that is publicly available, lawfully obtained from another source without restriction, or independently developed by us.

13. Data Storage and Processing Location

Sevana Health is a US company. Our public website is hosted by Netlify, a US-based provider that may deliver pages through a global content delivery network; form submissions made through the website are processed and stored by Netlify on our behalf. Our customer platform is hosted separately on Microsoft Azure in the United States, where customer platform data is processed and stored. We do not direct our website or services to individuals in the European Union, the United Kingdom, or other regions whose laws require additional cross-border transfer mechanisms. If our practices change, we will update this section to describe the safeguards we use.

14. Children’s Privacy

Our services are not directed to individuals under 18, and we do not knowingly collect their information.

15. Changes to This Privacy Policy

We may update this Policy from time to time. Changes will be posted with an updated “Last Updated” date.

16. Contact Us

17. Security and Incident Reporting

Sevana Health takes the security and confidentiality of information seriously. If you believe you have identified a security vulnerability, incident, or privacy concern affecting Sevana Health systems, data, or services, please notify our security team at:

This inbox is monitored by our security team, and all reports are investigated in accordance with our Security Incident Response Plan.