We are committed to maintaining the privacy and security of your personal information. This Privacy Policy describes how Milliman Solutions, LLC d/b/a OneRecord ("our," "we," or "OneRecord") collects, uses, discloses, and protects Personal Information of consumers who visit, access, or interact with our website www.onerecord.com (the “Website”) or use the OneRecord mobile application (the “App”) to access, consolidate, view, and download health information made available through third-party networks, health care providers, payers, or other external sources (collectively, “Third Party Networks”) at the user’s direction (the "Service"). The Service is designed to facilitate your access to and download of health information for your own purposes. Milliman does not store or retain copies of health information accessed through Third Party Networks. This Privacy Policy does not address personal information that you provide to us in other contexts (for example, through a business relationship unrelated to the Services).

Your use of the Service is subject to this Privacy Policy and our Terms of Service. If you do not agree to this Privacy Policy, please do not use the Service.

In connection with the Service, we collect your Personal Information through our Website or App when you choose to provide that information, such as when you:

• submit information through the "Contact" page of our Website;
• authorize the Service to connect to Third Party Networks so you can access, consolidate, view, and download your health information;
• respond to our communications (for example, when you respond to an email from us);
• submit your email address through our Website; or
• participate in another one of our Website features.

For purposes of this Privacy Policy, “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an identified or identifiable individual or household. This term includes “personal data,” “personal information,” and similar terms as defined under applicable privacy and data protection laws. Personal Information covered by this Privacy Policy includes information that Milliman collects or maintains in connection with the Website, App, or Service. Personal Information does not include information excluded from the scope of applicable laws, including de-identified or aggregated information, publicly available information, or information governed by sector-specific privacy laws where those laws apply.

The types of Personal Information we collect depend on how you interact with our Service. For example, we may collect contact and identification information that you provide, consumer request information, and Website, App, device, account, and security-related information.

• Contact and identification information, such as name, address, email address, and telephone number that you provide through online forms, App forms, or communications with us;
• Consumer request information, such as information you provide when submitting a privacy rights request, or communicating with us about our Service;
• Website, App, device, account, and security-related information, such as IP address, browser type, device identifiers, cookie or analytics information, App usage information, and other information collected automatically when you use our Website or App.
• Health information accessed through Third Party Networks at your direction.

To use our Service, we may ask you for the information described above, but you may still visit our Website without providing that information.

From time to time we may request other Personal Information to provide you with other benefits of the Service. In those instances, you will be given the opportunity to provide or not provide that information, and it will be used only for that purpose.

We use Personal Information for purposes that depend on the context in which it is collected, including to facilitate user-directed access to, consolidation, viewing, and download of health information from Third Party Networks; authenticate users and connections; respond to requests, inquiries, or other communications; operate, maintain, improve, and evaluate our Website and App; analyze website and App use and performance; protect the security and integrity of our Website, App, systems, accounts, and connections; provide information or updates about our Service; comply with legal, regulatory, contractual, and audit obligations; and protect our rights, property, systems, and users.

Where required by applicable law, we will obtain your consent before collecting or processing Personal Information for certain purposes. You may withdraw consent at any time by emailing us at consumersupport@milliman.com subject to any legal or contractual restrictions and any reasonable time needed to process the request. If you provide us with Personal Information about another individual, you are responsible for ensuring that you have the appropriate authority to do so and, where required by applicable law, that the individual has received any required notice or provided any required consent.

When you authorize the Service to connect to Third Party Networks, the Service may access, transmit, display, consolidate, or make health information available for download at your direction. Except as expressly stated in this Privacy Policy, Milliman does not store or retain copies of health information accessed through Third Party Networks after completing the user-directed access, consolidation, display, or download process. Throughout this Privacy Policy, when we describe how we collect, use, share, retain, delete, or otherwise handle Personal Information, those descriptions are subject to this limit on our handling of health information from Third Party Networks.

We may share Personal Information with other entities that are controlled by, under common control with, or otherwise affiliated with us for purposes consistent with this Privacy Policy. These purposes may include Website or App administration and security, information technology support, consumer request support, compliance, legal, audit, and other administrative or operational purposes related to the Website or App.

Where we share Personal Information with our affiliates, we require those affiliates to process the information in a manner consistent with this Privacy Policy and applicable law. Depending on where you are located and where our affiliates operate, Personal Information may be transferred to, stored in, or accessed from countries that may not provide the same level of data protection as your country of residence. In those cases, we rely on appropriate safeguards or other lawful mechanisms where required by applicable law.

We may also share Personal Information with third-party service providers, contractors, vendors, and other authorized third parties that perform services for us or on our behalf. These services may include website and mobile application hosting, analytics, information technology, security, communications, consumer request support, professional services, and other operational support.

When we share Personal Information with these third parties, we require them to use the information only to provide services to us or as otherwise permitted by our agreement with them, to maintain appropriate safeguards, and to process the information in accordance with applicable law.

Information may be transmitted between you, Third Party Networks, technology providers, and other service providers as technically necessary to authenticate your request, establish authorized connections, retrieve or display information, consolidate information for viewing, enable download, troubleshoot issues, protect security, and comply with applicable legal or operational requirements.

We may create, use, and disclose de-identified or aggregated information for lawful business, operational, analytics, research, and similar purposes based on information we collect or maintain. De-identified or aggregated information is not intended to identify you. Milliman does not use health information accessed through Third Party Networks to create retained de-identified or aggregated health datasets unless we provide additional notice and obtain any consent or authorization required by applicable law. Where required by applicable law, we will maintain and use de-identified information without attempting to reidentify it, except as permitted by law.

An Internet Protocol ("IP") address is a number that automatically identifies the computer/machine you have used to access the Internet. The IP address enables our server to send you the web pages that you want to visit, and it may identify the server owned by your Internet Service Provider. We may use IP addresses to conduct website analyses and performance reviews and to administer our website.

In some instances, we may collect data through cookies. A "cookie" is a text-only string of data that we send to the cookie file of the browser on a website visitor’s computer hard disk using our web server. Cookies are used to make websites work, or work more efficiently, as well as to provide data to the owners of the website.

Our website may use both required cookies and analytics and performance cookies.

Required cookies enable a website visitor to move from page to page within the website and to use its features. These cookies are deleted when the visitor closes his/her browser.

Analytics and performance cookies and similar technologies help us understand how visitors use the Website and App, evaluate performance, improve functionality, and protect security. These technologies may collect information such as pages visited, referring pages, browser or device information, IP address, approximate location derived from IP address, interactions with the Website or App, and related usage information. We use the following third-party providers for analytics and performance tracking, and you can learn more about their privacy practices and available controls at the links below:

Google Analytics: https://policies.google.com/privacy

Microsoft Clarity: https://www.microsoft.com/en-us/privacy/privacystatement

The majority of web browsers accept cookies and similar files, but a visitor can usually change the browser settings to prevent this. However, by doing so, some functionality of the website may be lost. Please visit https://www.aboutcookies.org/ to learn more about cookies and how to control them. We rely on your consent, to the extent required by law, to use non-required cookies that may contain your Personal Information.

Our Service operates in the United States. For individuals residing outside of the United States who seek to transfer Personal Information from the EEA, the Isle of Man, Switzerland or the United Kingdom to the United States, please refer to our Data Privacy Framework Notice here. We are committed to handling Personal Information in accordance with this Privacy Policy and applicable data protection and privacy laws worldwide including, but not limited to, the EU-US Data Privacy Framework (EU-US DPF), the UK Extension to the EU-US DPF, and the Swiss-US Data Privacy Framework (Swiss-US DPF), as administered by the U.S. Department of Commerce, the EU General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA).

We may also disclose Personal Information and other related information in response to subpoenas, court orders, or other lawful requests by public authorities, and to meet national security or law enforcement requirements. We may collect and share Personal Information in order to investigate or take action regarding illegal activities, suspected fraud, violations of our Terms of Use, or as otherwise required by law or regulation.

We maintain reasonable administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized access, use, disclosure, alteration, loss, or destruction. These safeguards are intended to take into account the nature of the Personal Information we process, the purposes for which it is processed, and the risks presented by the processing. We also require service providers, contractors, and other third parties that process Personal Information on our behalf to maintain appropriate safeguards and to process Personal Information in accordance with applicable law and their contractual obligations to us.

Except for health information obtained by Third Party Networks as described above, we retain Personal Information that we collect or maintain for as long as reasonably necessary to fulfill the purposes for which it was collected, including to provide the Service, maintain accounts and records, respond to requests, support security and fraud prevention, comply with legal, regulatory, contractual, audit, and reporting obligations, resolve disputes, and enforce agreements. Retention periods may vary depending on the nature of the information, the purpose for which it was collected, applicable legal requirements, and operational needs. When Personal Information is no longer needed, we will delete, de-identify, or otherwise handle it in accordance with applicable law and our retention practices.

We understand the importance of protecting children's privacy in the interactive online world. Our Website and App are not designed for, or intentionally targeted at, children under 13 years of age. No one under the age of 13 should use our Service or submit any personal information to us through our Website or App. Parents, legal guardians or other duly appointed personal representatives may use our Service on behalf of a minor provided they agree and comply with our Terms of Service.

Our Website and App may provide links to other third-party websites, mobile applications, or online services that are outside of our control and not covered by this Privacy Policy. We are not responsible for the availability, content or accuracy, or privacy practices of other websites, products, services, or goods that may be linked to our Website or App. We encourage all users to review the privacy policies posted on these and all other sites and services.

The following disclosures apply to consumers whose Personal Information is subject to applicable U.S. state privacy laws and is collected through our Website or App. These disclosures supplement the other sections of this Privacy Policy and describe the categories of Personal Information we collect, the sources from which we collect it, the purposes for which we use or disclose it, the categories of third parties to whom we disclose it, our treatment of Sensitive Personal Information, and the privacy rights that may be available to you.

We collect information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (“Personal Information”). In particular, we have collected the following categories of Personal Information from consumers through our Website or App within the last twelve (12) months. The below reflects categories of information Milliman collects or maintains and should be read together with the Important Limitation Regarding Third Party Networks described above.

A. Identifiers

Identifiers and Contact Information. This category includes names, alias, postal address, gender, telephone numbers, mobile numbers, unique personal identifiers, online identifier, Internet Protocol address, email address, signature, account name, dates of birth, bank account information, citizenship status, marital status, demographic data (including age, nationality, place of birth), and other similar contact information and identifiers.

Collected: Yes

B. Personal information categories listed in the California Customer Records Act (Cal. Civ. Code § 1798.80(e))

A name, signature, address, telephone number, or other similar information provided by a consumer through our Website or App. Some personal information included in this category may overlap with other categories.

Collected: Yes

C. Protected classification characteristics under California or federal law

This category includes characteristics of protected classifications under California or federal law, such as race, color, religion or creed, national origin or ancestry, citizenship, medical condition, physical or mental disability, age (40 years or older), sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, and veteran or military status.

Collected: No

D. Commercial information

This category includes products or services provided, obtained, or considered.

Collected: Yes

E. Biometric information

This category can include identifiers or identifying information, such as fingerprints.

Collected: No

F. Internet or other similar network activity

Browsing history, search history, IP addresses, email communications, information on a consumer's interaction with a website, application, or advertisement.

Collected: Yes

G. Geolocation data

Physical location or movements.

Collected: Yes

H. Sensory data

Audio, electronic, visual, thermal, olfactory, or similar information including information collected from cameras, microphones, and similar devices.

Collected: Yes

I. Professional or employment-related information

Current or past job history or performance evaluations.

Collected: No

J. Sensitive Personal Information

Social Security number, driver’s license number, state ID number, or passport number, precise geolocation, contents of mail, email, or text messages, and medical or health data, where collected or maintained by Milliman through our Website or App.

Collected: Yes

K. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99))

Education records includes education history, degrees, and related information that is not publicly available personally identifiable information.

Collected: No

L. Inferences drawn from other personal information

Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

Collected: No

We collect Personal Information from the following sources, depending on how you interact with our Website or App:

• Directly from you, such as when you submit a form through our Website, App, contact us, request information, request assistance, submit a privacy rights request, or otherwise communicate with us;
• Automatically through our Website, App, and online interactions, such as through cookies and similar technologies, as described in the Cookies section;
• From third-party sources, such as analytics providers, identity verification providers, fraud prevention providers, public databases, and other third parties, where permitted by law.
• From Third Party Networks, at your direction, when you authorize the Service to connect with those networks to access, transmit, display, consolidate, or make information available for download through the Service as described above.

Our collection, use, disclosure, retention, and other processing of Personal Information varies depending on the circumstances and nature of your interactions with our Website or App. The table above identifies categories of Personal Information we may collect and disclose for business or commercial purposes in connection with Website or App interactions covered by this Privacy Policy. We collect these categories of Personal Information from the sources described in the Sources of Personal Information section and use or disclose them for the purposes described in the Collection and Use of Personal Information section, subject to any applicable separate notice, authorization, or sector-specific privacy law.

We will not collect additional categories of Personal Information or use Personal Information we have collected for materially different, unrelated, or incompatible purposes without providing notice as required by applicable law.

We may disclose Personal Information to affiliates, service providers, contractors, vendors, and other third parties for the purposes described in this Privacy Policy, including the purposes described in the How We Disclose Personal Information, Other Legal Disclosures, and Purposes for Collecting and Using Personal Information sections.

In the preceding twelve (12) months, we have disclosed categories A, B, D, F, G, H, and J in the table above for business or commercial purposes related to Website or App interactions. The categories of third parties to whom we may disclose Personal Information include affiliates, service providers, contractors, business operations vendors, analytics providers, professional advisors, third parties approved by you, and government or regulatory authorities where required or permitted by law.

Where we collect Sensitive Personal Information from consumers through our Website or App, we use or disclose it only as reasonably necessary and proportionate for the purposes described in this Privacy Policy, for the limited purposes permitted or required by applicable law, or with your consent where required.

You may request deletion of Personal Information that we maintain about you. When we receive a verified deletion request, we will delete Personal Information we maintain about you, subject to applicable legal, regulatory, contractual, audit, security, and operational retention requirements. Deletion requests apply to Personal Information maintained by Milliman and do not affect information that was previously disclosed or transmitted at your direction, downloaded or saved by you, or retained by Third Party Networks according to their own policies and legal obligations. You may submit requests to change or delete your Personal Information as described in the Submitting Requests section of this policy.

Depending on your state of residence and subject to certain exceptions, you may have certain data privacy rights with respect to Personal Information collected through our Website or App. This Privacy Policy does not apply to Personal Information processed in connection with client, prospective client, vendor, business partner, employment, recruiting, contractor, or workforce-related activities. Those activities may be governed by separate notices, agreements, policies, authorizations, or applicable laws. Some Personal Information may be subject to other sector-specific laws rather than the state privacy rights described in this section.

If you would like to make a data privacy request, you may submit your request by emailing us at consumersupport@milliman.com or by calling us at (800) 440-6598.

Depending on the type of request and the information involved, we may need to verify your identity, confirm your authority to act on behalf of another individual, and confirm that the Personal Information at issue relates to you or to the individual on whose behalf you are acting.

Your request should provide sufficient information for us to reasonably verify your identity or authority to make the request; identify the privacy right you wish to exercise; describe your request with sufficient detail for us to understand, evaluate, and respond to it; and provide any additional information reasonably required by applicable law or necessary for us to process the request. We will use the Personal Information you provide in connection with a privacy rights request only to verify your identity or authority, process and respond to the request, maintain records of the request as required or permitted by law, and prevent fraud or misuse of the request process.

You do not need to create an account with us to submit a privacy rights request. However, if we cannot verify your identity or authority, or if an exception or limitation under applicable law applies, we may be unable to fulfill the request in whole or in part. Where permitted by applicable law, we may limit the number or frequency of certain requests, including requests for access or data portability.

We do not sell Personal Information, share Personal Information for cross-context behavioral advertising, or process Personal Information for targeted advertising. Accordingly, we do not currently offer an opt-out right for these activities. We may disclose Personal Information to affiliates, service providers, contractors, vendors, and other third parties for the business and operational purposes described in this Privacy Policy, but such disclosures are not intended to constitute a sale, sharing for cross-context behavioral advertising, or targeted advertising under applicable state privacy laws.

We may be unable to honor a privacy rights request, in whole or in part, if doing so would conflict with, restrict, or otherwise interfere with our obligations under applicable law.

If you submit a request to access, correct, or delete health information obtained from a Third Party Network, we will be unable to fulfill that request as Milliman does not maintain the information as described in the Information Collected from Third Party Networks section of this privacy policy. In that case, you will need to contact the applicable Third Party Network. Health information you download or otherwise save is under your control and responsibility.

We endeavor to respond to your privacy rights request within the time period required by applicable law. In many cases, we will respond within 45 days after receiving the request. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. Our response will describe the action we have taken in response to your request or explain why we are unable to comply with the request, in whole or in part. If we deny a request, we will provide the reason for the denial where required by applicable law and provide information about any appeal process that may be available to you. Where required by applicable law, disclosures we provide in response to an access request will cover the applicable look-back period required by law (typically 12 months). If you request a copy of Personal Information that Milliman maintains, we will provide the information in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the information to another entity without hindrance. Responses involving health information accessed through Third Party Networks are subject to the Important Limitation Regarding Third Party Networks described above.

We do not charge a fee to process or respond to a privacy rights request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

We may update this Privacy Policy from time to time. When we do, we will update the date at the top of this Privacy Policy. If we make material changes, we will provide additional notice or obtain consent where required by applicable law. We encourage you to review this Privacy Policy periodically.

If you have questions about this Privacy Policy or our privacy practices, please contact us by email at consumersupport@milliman.com