Provider Privacy Addendum

Last Updated: February 18, 2025

Introduction

This Provider Privacy Addendum explains what Personal Information we collect, how we collect the information, the reasons we collect information, and how we share or use the information we collect through the use of our website, mobile apps, and through email, text, and other electronic or in person communications between Alma and you, as a Provider.

This Provider Privacy Addendum (“Provider Privacy Addendum”) is in addition to the information found in our Privacy Notice (our “Privacy Notice”) and only applies to you, (1) in your role as a health care professional that provides healthcare to patients (for purposes of this Provider Privacy Addendum, the “Services”) via the Alma provider platform (the “Provider Platform”) and through the Membership Agreement (as defined below) with the Alma Provider Network or (2) a health care professional considering providing Services via the Provider Platform or gathering information from Alma for example, through downloading whitepapers, worksheets workbooks, and other informational documents (collectively, (“you”)). Additionally, if you are located in California, the California privacy rights section will apply to you, in addition to this Provider Privacy Addendum. Unless defined differently in this Provider Privacy Addendum, any terms defined in our Privacy Notice have the same meaning when used in this Provider Privacy Addendum.

When this Provider Privacy Addendum applies to you, it is the language that is applicable in the event of a discrepancy with our Privacy Notice. Where this Provider Privacy Addendum is silent as to a topic addressed in the Privacy Notice, the Privacy Notice will apply.

If you are unable to view this Provider Privacy Addendum due to a disability, please contact us at support@hello alma.com to obtain this Provider Privacy Addendum in an alternative format.

1. When does our Provider Privacy Addendum apply?

Alma provides back office and technology support through an agreement with Alma Community Network, P.C. and the Alma Community Network, LLC (collectively, the “Alma Provider Network”), to assist Providers like you provide online telehealth clinical consultations, services and treatment on our Provider Platform. You, as a Provider, pay a monthly fee to Alma to be able to utilize Alma’s Provider Platform, which allows you to provide your Services through the Provider Platform. In addition to your relationship with Alma, you also have an agreement with the Alma Provider Network to provide Services to patients as a Provider that is a part of the network of Providers comprising the Alma Provider Network (the “Membership Agreement”).

This Provider Privacy Addendum only applies to you to the extent you have an existing agreement with Alma and the Alma Provider Network (for purposes of this Provider Privacy Addendum only, hereinafter collectively, “Alma,” “we,” or “our”). If you are not a Provider and do not have an agreement with Alma and the Alma Provider Network, this Provider Privacy Addendum does not apply to you.

When does our Provider Privacy Addendum not apply?

If you are not a Provider and do not have an agreement with Alma and the Alma Provider Network, this Provider Privacy Addendum does not apply to you. This Provider Privacy Addendum does not apply to information collected by any other website operated either by us or by a third party unless the website is listed above or links to this Provider Privacy Addendum. It also does not apply to any third-party website that is linked to or accessible from our Provider Platform.

This Provider Privacy Addendum also does not apply if you are patient of a Provider with the Alma Provider Network. It is possible that you could be a Provider and a patient that treats with a Provider that is part of Alma Provider Network. When you are not acting as a Provider and using the Alma Platform to provide the Services, our Privacy Notice applies to you and not this Provider Privacy Addendum.

Our Provider Privacy Addendum, Terms of Service, and Membership Agreement.

This Provider Privacy Addendum is incorporated and should be read as part of our Terms of Use and our Membership Agreement, which also apply when you use our Provider Platform.

2. Personal Information

What types of Personal Information do we collect?

We may collect and use the following Personal Information about you:

Categories of Personal Information	Specific Examples of Personal Information Collected
Personal Identifiers	First, middle and last name, former names or aliases (including maiden name, to the extent applicable), fax number, birth date, e-mail address, telephone number, former and current addresses, IP Address, Social Security number, passport or VISA number, professional licensure identifiers, NPI number, and driver’s license number.
Information that identifies, relates to, describes, or is capable of being associated with a particular individual	A name; signature; Social Security number; physical characteristics or description; address; telephone number; passport number; driver’s license or state identification card number; insurance policy number; education; employment; employment history; bank account number; credit card number, debit card number, or any other financial information. Some Personal Information included in this category may overlap with other categories.
Financial Information	Credit card number, debit card number, account number, or other financial information.
Health or Insurance Information for Credentialing Purposes	Work history, education history, licensure information.
Protected classes of Personal Information	Race, citizenship, color, age, national origin, sex (including gender, gender identity, gender expression, pregnancy or childbirth, and related medical conditions), sexual orientation, and physical or mental disability. The majority of this information is collected optionally by you in order to be added to your profile.
Biometric information	Photos, video, and voice. (Biometrics are collected only as part of the normal of the treatment sessions between you and your patient(s)).
Internet or other electronic network activity information	IP address, device mode, device ID, OS version, device language, operating system, browser type, browsing history, search history, and information regarding a consumer’s interaction with an Internet Web site, application, or advertisement.
Geolocation data	Physical location based on IP address, local time, and local time zone.
Professional or employment-related information.	Current or past job history or performance evaluations.

How do we collect your Personal Information?

We may collect Personal Information in the following ways:

Directly From You. We collect most Personal Information directly from you. For example, when we speak to you by phone, text message, and e-mail. Additionally, we will collect information from you when you visit or use our Provider Platform and fill out forms. When you agree to be in network with a health plan, we may collect information from you for purposes of credentialing. When you contact Alma directly, such as when you contact our Provider Support team, we will receive the contents of your message or any attachments you may send to us, as well as any additional information you choose to provide.
Automatically. We collect Personal Information automatically as you navigate through our Provider Platform. We use the following technologies to automatically collect data:
- Cookies. We and our service providers may use cookies, web beacons, and other technologies to receive and store certain types of information whenever you interact with our Provider Platform through your computer or mobile device. A “cookie” is a small file or piece of data sent from a website and stored on the hard drive of your computer or mobile device. Some of the cookies we use are “session” cookies, meaning that they are automatically deleted from your hard drive after you close your browser at the end of your session. Session cookies are used to optimize performance of the Website and to limit the amount of redundant data that is downloaded during a single session. We also may use “persistent” cookies, which remain on your computer or device unless deleted by you (or by your browser settings). We may use persistent cookies for various purposes, such as statistical analysis of performance to ensure the ongoing quality of our Provider Platform. We and third parties may use session and persistent cookies for analytics and advertising purposes, as described herein. On your computer, you may refuse to accept browser cookies by activating the appropriate setting on your browser, and you may have similar capabilities on your mobile device in the preferences for your operating system or browser. However, if you select this setting you may be unable to access or use certain parts of our Provider Platform. Unless you have adjusted your browser or operating system setting so that it will refuse cookies, our system will issue cookies when you direct your browser to our Provider Platform.
- Other third-party tools. We use other third-party tools to track the performance of our Provider Platform. These tools provide us with information about errors, app and website performance, and other technical details we may use to improve our Provider Platform. For more information related to these third-party analytics providers please review How do we collect your Personal Information?.
From Third Parties. We collect Personal Information from our business partners. For example. We may receive information on website usage from our website host. We may also receive Personal Information from a health plan or credentialing service for purposes of credentialing you with various health plans.

How do we use your Personal Information?

We may use your Personal Information for the following purposes:

Operate, maintain, supervise, administer, and enhance our Provider Platform, including monitoring and analyzing the effectiveness of content on the Provider Platform, aggregate site usage data, and other usage of the Provider Platform such as assisting you in completing the registration process.
Provide our Provider Platform to you, in a custom, secure, and user-friendly way.
Provide you with information about the Provider Platform that you request from us or that may be of interest to you.
Promote and market our Provider Platform to you. For example, we may use your Personal Information, such as your email address, to send you news and newsletters, special offers, and promotions, or to otherwise contact you about additional services or products we think may interest you.
To promote you on our Website to potential patients that may be interested in your Services.
To provide you notices or about your account or updates that you may find relevant to your practice of your profession.
Contact you in response to a request.
To help ensure the security and integrity of our products, services, and IT infrastructure to the extent the use of the Personal Information is reasonably necessary and proportionate for these purposes.
To notify you about changes to our Provider Platform and the Services offered or provided through them.
Fulfill any other purpose for which you provide it.
To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection.
Anonymize and aggregate information for analytics and reporting.
To respond to law enforcement requests, court orders, and subpoenas and to carry out our legal and contractual obligations.
Authenticate use, detect fraudulent use, and otherwise maintain the security of our Provider Platform and the safety of others.
To administer surveys and questionnaires.
Any other purpose with your consent.

How do we share your Personal Information?

We may share Personal Information with third parties in certain circumstances or for certain purposes, including:

Our business purposes. We may share your Personal Information with our affiliates, vendors, service providers, and business partners, including our data hosting and data storage partners, analytics and advertising providers, technology services and support, and data security advisors. We may also share your Personal Information with professional advisors, such as auditors, law firms, and accounting firms.
Your business purposes. We may share your Personal Information with health plans and third parties related to assisting you in your treatment of patients on the Provider Platform. For example, we may share your Personal Information for purposes of submitting a bill to a health plan for the Services rendered by you.
With your consent. We may share your Personal Information if you request or direct us to do so.
Compliance with law. We may share your Personal Information to comply with applicable law or any obligations thereunder, including cooperation with law enforcement, judicial orders, and regulatory inquiries.
Business Transfer. We may share your Personal Information to a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of a bankruptcy, liquidation, or similar proceeding, in which Personal Information held by us about our users are among the assets transferred.
To enforce our rights. We may share your Personal Information to enforce any applicable terms and conditions and Terms of Service, and to ensure the safety and security of our Provider Platform and our users.
De-identified information. We may also disclose de-identified information, so that it cannot be reasonably used to identify any individual, with third parties for marketing, advertising, research, or similar purposes.
To improve our Provider Platform. We may use your Personal Information for internal testing, research, analysis, and product development, including to develop and improve our website/application, and to develop, improve, or demonstrate our products and services.
Third Party Analytics. We use Google Analytics to understand and evaluate how visitors interact with our Provider Platform. These tools help us improve our Provider Platform, performance, and your experience.

How do I access and correct my Personal Information?

You can review and change your Personal Information by logging into the Provider Platform. You may also Contact Us to inform us of any changes or errors in any Personal Information we have about you to ensure that it is complete, accurate, and as current as possible or to delete your account. We cannot delete your Personal Information except by also deleting your account with us. We may also not be able to accommodate your request if we believe it would violate any law or legal requirement or cause the information to be incorrect.

3. Who may use the Provider Platform?

Alma is subject to state and federal laws and regulations, and the Provider Platform may not be available in your state. You represent that you are not barred from enrolling or using the Provider Platform under the laws of the United States or any other jurisdiction(s) in which you may be located. Access to and use of the Provider Platform and the Services is limited exclusively to users located in states within the United States where the Provider Platform and the Services are available. The Provider Platform and the Services are not available to users located outside the United States. Accessing the Provider Platform or obtaining the Services from jurisdictions where content is illegal, or where we do not offer the Provider Platform or Services, is prohibited.

4. Data Security and HIPAA

We have implemented reasonable administrative, technical, and physical safeguards designed to protect against the risk of unauthorized access, alteration, destruction, disclosure, or use of your Personal Information. The Internet is not 100% secure and we cannot guarantee the security of information transmitted through the Internet. Any transmission of Personal Information is at your own risk. We are not responsible for the circumvention of any privacy settings or security measures contained on our Provider Platform, in your operating system, or mobile device.

Alma and the Alma Provider Network must comply and follow the Health Insurance Portability and Accountability Act (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act (Public Law 111-005) (the “HITECH Act”) and its implementing regulations and guidance issued by the Secretary of the U.S. Department of Health and Human Services (collectively, the “HIPAA Regulations”). While the Personal Information collected about you is not subject to HIPAA and the HITECH Act, information that you provide related to your patients and the Services you provide on the Provider Platform may be protected by the HIPAA Regulations. Alma provides a HIPAA Notice of Privacy Practices that details the uses and disclosures of protected health information (as defined by HIPAA). You should read and familiarize yourself with the HIPAA Notice of Privacy Practices as it details how the Alma Provider Network will share protected health information on your behalf.

5. California Privacy Rights

California’s Shine the Light Law

California Civil Code Section 1798.83 (California’s “Shine the Light” law) permits users of our Platform or the Services that are California residents and who provide Personal Information in obtaining products and services for personal, family, or household use to request certain information regarding our disclosure of Personal Information to third parties for their own direct marketing purposes. If applicable, this information would include the categories of Personal Information and the names and addresses of those businesses with which we shared your Personal Information with for the immediately prior calendar year (e.g., requests made in 2023 will receive information regarding such activities in 2022). You may request this information once per calendar year. To make such a request, please contact us using the information below and note that your request is regarding “Shine the Light”.

Your rights under the CCPA

Right to Access Information. You have the right to request access to personal information collected about you, information regarding the source of that personal information, the purposes for which we collect it, and the third parties and service providers with whom we share it. To protect your personal information, we will verify your identity before we act on your request.
Right to Request Deletion of Information. You have the right to request, in certain circumstances, that we delete any personal information that we collected directly from you. To protect your personal information, we will verify your identity before we act on your request. We may have a reason under the law why we do not have to comply with your request or why we may comply with it in a more limited way than you anticipated. If we do, we will explain that to you in our response.
Right to Opt-Out of the Sale/Share of Personal Information to Third Parties. You have the right to opt out of any sale or share of your Personal Information to third parties.
Right of Non-Discrimination. You have the right not to be discriminated against – such as denying a good or service, providing a different level or quality of service, or charging different prices – for exercising any of your rights under the law.

In order to verify your identity when you make a request, you will be required to log in to your password-protected account or respond to an email verification request.

To exercise these rights, please contact us at the information provided below.

In addition to exercising these rights yourself, you may also designate an authorized agent to make these requests on your behalf. If the authorized agent does not provide a valid power of attorney, we will ask you to verify the request directly via email or through your password-protected account.

6. Changes to our Provider Privacy Addendum

We may update our Provider Privacy Addendum at any time and at our sole discretion to reflect changes in our privacy practices or procedures, laws, and best practices. We will post any changes we make to our Provider Privacy Addendum on this page with a new “Last updated” date. If we make material changes to our practices with regards to the Personal Information we collect from you, we will notify you by email to the email address specified in your account and/or through a notice on the Provider Platform. You are responsible for ensuring we have an up-to-date, active, and deliverable email address for you, and for periodically accessing the Provider Platform and reviewing this Provider Privacy Addendum to check for any changes.

YOUR CONTINUED USE OF OUR PROVIDER PLATFORM FOLLOWING THE POSTING OF CHANGES CONSTITUTES YOUR ACCEPTANCE OF SUCH CHANGES.

7. Contact Us

If you have any questions, concerns, complaints, or suggestions regarding our Provider Privacy Addendum or the ways in which we collect and use your Personal Information described in this Provider Privacy Addendum, have any requests related to your Personal Information pursuant to applicable laws, or otherwise need to contact us, you may contact us at the contact information below or through the “Contact Us” page on the Provider Platform.

Arlozorov9, Inc. d/b/a Alma

E-mail: support@helloalma.com