Changes to this Privacy Policy

This Policy is effective as of the “Last Updated” date listed above. We reserve the right to change this Privacy Policy from time to time to ensure that it accurately reflects our services, practices, applicable law, and SettLiT policies. We will revise the “Last Updated” date above and provide additional notice or obtain consent if required by applicable law. Material changes to the Individual Access Services Privacy and Security Notice are subject to the IAS-specific consent requirements described below.

Definitions Used in this Privacy Policy

Personal Information

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an individual or household, or that is otherwise treated as personal information, personal data, or a similar term under applicable law.

‍

Health Information

“Health Information” means Personal Information that relates to an individual’s past, present, or future physical or mental health or condition, health care, payment for health care, or medical records. Depending on the context and applicable law, Health Information may be protected health information under HIPAA, consumer health data or sensitive personal information under state law, or Individually Identifiable Information under TEFCA. We use those more specific terms only where they apply.

‍

Health Information Sources

“Health Information Sources” are health care providers, health plans and insurers, pharmacy networks, laboratory networks, insurance claims networks and clearinghouses, electronic medical record systems, state health information exchanges, national health data exchanges accessed through Marble’s Individual Access Services where applicable, medical record custodians, and other persons or organizations from which SettLiT obtains medical records or other Health Information at your direction, at the direction of a SettLiT customer acting with appropriate authorization, or as otherwise permitted by applicable law.

‍

Deidentified Information

“Deidentified Information” means information that no longer constitutes Personal Information under applicable law because it has been deidentified in accordance with the applicable legal standard. Different laws and contracts may impose different deidentification requirements. The additional TEFCA requirements that may apply to deidentification of Individually Identifiable Information are described in the IAS Notice below.

‍

Personal Representatives and Other Authorized Representatives

You may authorize another person, including a family member, advisor, lawyer, caregiver, or health care provider, as a Personal Representative to act on your behalf. SettLiT may require reasonable verification of that person’s identity and authority. Whether a parent, guardian, Personal Representative, executor, or other person may act for an individual, and the scope of that authority, is determined by applicable law and any valid authorization or other documentation.

Personal Information We Collect

Depending on how you interact with SettLiT, or how a SettLiT customer uses the services on your behalf, we may have collected the following categories of Personal Information. These categories may overlap.

‍

Information You Provide Directly

When you register for or use a SettLiT service, we collect Personal Information that you, your Personal Representative, or a SettLiT customer acting with appropriate authorization provide directly, including your name, mailing address, email address, telephone number, date of birth, account identifiers, and other information described below.

‍

• Health and medical information that you, your Personal Representative, or a SettLiT customer acting with appropriate authorization provide, including information about your health care providers, insurers, medical conditions, and medical records.

• Authorization and consent information, including instructions about records you or a SettLiT customer ask us to retrieve or disclose and information about a Personal Representative or other person you authorize.

• Communications and support information, including information you provide when you contact SettLiT or respond to customer research or satisfaction surveys.

‍

Information We Collect at Your Direction

At your direction or the direction of a SettLiT customer, and with your consent or authorization where required, SettLiT collects medical records and other Health Information from Health Information Sources. If you designate a Personal Representative, you may also authorize that person to provide information to SettLiT and to access or direct the disclosure of information on your behalf, subject to the scope of that person’s authority.

‍

Identity and Verification Information

When SettLiT services include identity verification, SettLiT or its service providers may collect information from you and from third-party identity and verification providers. Depending on the service and verification method, this may include information from a government-issued identification document, an image or selfie, identity-verification results, and similar information necessary to verify identity or authority.

‍

Information from SettLiT Customers, Integrations, and Applications

SettLiT may receive information from customers, case management systems, integrations, APIs, or other applications, including client and case information that customers upload, import, or sync, as necessary to create or manage client profiles, present authorization requests, retrieve and organize records and related data, and provide the services requested or authorized by the customer or individual.

‍

Website, Device, and Usage Information

When you visit our website or use our online services, SettLiT collects information about how and when you use our website and services, including information about pages or content viewed, browser and device type and settings, operating system, IP address, unique identifiers, system activity, crash reports, and the date, time, and referring URL associated with a request.

‍

Cookies and Similar Technologies

The Site uses cookies and similar technologies to help personalize and support your online experience. Cookies are small amounts of data that often include unique identifiers that enable the Site to recognize you and keep track of your preferences. We use cookies and similar technologies for authentication, security, functionality, preferences, analytics and measurement, load balancing, and navigation. Cookies may include “session” cookies, which are not permanently stored and expire when your session ends, and “persistent” cookies, which remain on your device for a defined period or until deleted.

‍

You have the ability to disable or manage cookies through your browser settings and any cookie or privacy controls SettLiT makes available. If cookies are disabled, some features or services of the Site may not be available or function as intended.

How We Use Personal Information

SettLiT uses Personal Information, including Health Information, for the following purposes:

‍

• To provide services that you or a SettLiT customer request or authorize, including locating, retrieving, organizing, maintaining, presenting, analyzing, and summarizing Health Information and related data, generating customer-requested insights, and supporting customer-directed integrations and workflows.

• To create and administer accounts, authenticate users, verify identity or authority, and record authorizations and consent.

• To communicate with you, provide customer support, and respond to questions or requests.

• To maintain and secure our services, prevent fraud and abuse, troubleshoot problems, and protect the rights, property, and safety of SettLiT, our users, and others.

• To comply with applicable law and legal process, maintain records, enforce agreements and policies, and resolve disputes.

• To analyze performance and usage, and to develop, maintain, and improve our services and website.

• For other purposes that you authorize or that are otherwise permitted by applicable law.

Deidentified Information

Separate from the IAS-specific requirements described below, SettLiT may deidentify and/or aggregate Personal Information in accordance with applicable law and applicable contractual restrictions. Where required by applicable law, SettLiT will maintain and use deidentified information in deidentified form, will not attempt to reidentify it except as permitted by law to test or validate deidentification, and will require recipients to maintain the information in deidentified form and not attempt to reidentify it.

How We Disclose Personal Information

SettLiT may disclose Personal Information, including the categories described above, to the following categories of recipients for the purposes described in this Privacy Policy:

‍

• Health Information Sources and persons or organizations that you, your Personal Representative, or a SettLiT customer acting with appropriate authorization direct SettLiT to contact or provide information to.

• SettLiT customers and their authorized users, and case management systems, integrations, APIs, or other applications through which SettLiT services are requested or managed, to the extent necessary to provide the requested or authorized service.

• Service providers and contractors that help us provide, host, secure, support, analyze, or improve our services. These service providers are obligated by contract to protect your Personal Information. They are not permitted to use this information for any purpose except providing the service and are only given the information necessary to perform their designated functions.

• Our affiliates and financial, insurance, legal, accounting, security, and other advisers that provide services to SettLiT.

• Government authorities, regulators, courts, law enforcement, or other persons when disclosure is required or permitted by applicable law or is reasonably necessary to protect rights, safety, or property.

• A buyer, successor, lender, investor, or other appropriate party in connection with an actual or proposed merger, acquisition, financing, reorganization, sale of assets, or similar corporate transaction, subject to applicable law.

‍

SettLiT does not authorize its service providers to use Personal Information received from SettLiT for their own marketing or other independent purposes unless separately permitted by applicable law and the governing agreement.

Sale, Sharing, and Targeted Advertising, Where Applicable

SettLiT does not sell or disclose medical records or other identifiable Health Information in exchange for direct or indirect remuneration except as permitted by applicable law and, where required, after obtaining the specific consent or authorization required by applicable law. Some state privacy laws use the terms “sale,” “sharing,” or “targeted advertising” to cover certain online disclosures that may not involve a traditional sale for money. SettLiT will provide any notices and honor any rights required by applicable law if SettLiT engages in a practice to which those requirements apply.

Retention

SettLiT will retain Personal Information for so long as reasonably necessary to provide our services and satisfy applicable legal, contractual, security, and business requirements. The retention period for a particular category of information depends on factors such as the duration of the account or service relationship, the nature and sensitivity of the information, the purpose for which it was collected, applicable authorization or consent requirements, and legal or contractual obligations. When Personal Information is no longer needed, SettLiT deletes, deidentifies, or otherwise disposes of it as appropriate, subject to applicable law and technical requirements such as backup or audit-log retention.

Processing and Storage Outside the United States

Your Personal Information may be processed and/or stored outside of the United States as necessary or appropriate to provide our services. SettLiT takes reasonable measures to protect your Personal Information regardless of where it is processed or stored. Information processed in another jurisdiction may be subject to the laws of that jurisdiction and may be disclosed as permitted or required by applicable law. Where applicable law requires additional safeguards for a transfer, SettLiT will implement the required safeguards.

Data Security

SettLiT has deployed appropriate physical, administrative, and technical measures designed to safeguard your Personal Information against theft, loss, unauthorized access, copying, modification, use, disclosure, and disposal. These measures include appropriate security policies, employee training, confidentiality obligations, audits and compliance monitoring, access controls, monitoring, and encryption or other security technologies appropriate to the nature of the information and applicable requirements. No security measure can eliminate all risk.

‍

Access to online accounts, medical records, and other client data is protected by account credentials and other security measures. Where available, we encourage you to use multi-factor authentication and to protect your account credentials from unauthorized use.

Children

SettLiT does not knowingly collect Personal Information about minors without the consent or authorization of a parent, guardian, Personal Representative, or the minor, where required by applicable law.

Your U.S. Privacy Rights

Depending on where you live, the Personal Information involved, and applicable law, you may have some or all of the following rights:

‍

• To confirm whether SettLiT processes Personal Information about you and to access or obtain a copy of that information.

• To request correction of inaccurate Personal Information.

• To request deletion of Personal Information, subject to applicable exceptions.

• Where applicable, to exercise any right under applicable law to opt out of certain sales, sharing, targeted advertising, or profiling.

• To limit certain uses or disclosures of sensitive Personal Information, where applicable.

• To withdraw consent where SettLiT relies on consent and applicable law permits withdrawal.

• To exercise privacy rights without unlawful discrimination or retaliation.

‍

How to Exercise Your Rights

To submit a privacy request, email privacy@medchart.com or call 1-833-603-0407. Please provide enough information for SettLiT to identify the request and respond. We may need to ask for additional information to verify your identity. Where a request is made by a Personal Representative or authorized agent, SettLiT may also need to verify that person’s authority. Where applicable law gives you a right to appeal SettLiT’s decision on a privacy request, you may request an appeal by replying to the decision or contacting privacy@medchart.com and identifying the request as a privacy appeal. Where SettLiT processes Personal Information on behalf of a customer, such as a law firm, that customer may be responsible for responding to your request under applicable law. In those circumstances, SettLiT may direct your request to the customer or assist the customer in responding.

Complaints and Questions

For more information about SettLiT’s privacy practices, or to raise a question or concern, please contact:

‍

Juliana Doxey
Chief Privacy Officer, Medchart US Inc.
215 S. Denton Tap Rd., Suite 290
Coppell, TX 75019
Email: privacy@medchart.com
Toll-free: 1-833-603-0407
Fax: 1-888-929-2687

INDIVIDUAL ACCESS SERVICES PRIVACY AND SECURITY NOTICE

IAS Notice Effective Date: September 15, 2026

‍

SettLiT makes Individual Access Services (“IAS”) available through Medchart US Inc., the legal entity doing business as both SettLiT and Marble. Medchart US Inc. provides IAS in conformance with the Trusted Exchange Framework and Common Agreement (“TEFCA”) issued by the U.S. Department of Health and Human Services. This IAS Notice is part of and supplemental to the SettLiT Privacy Policy above. For purposes of this IAS Notice, the “IAS Provider” is Medchart US Inc. doing business as both SettLiT and Marble. Marble is listed as the Individual Access Services Provider identified in the TEFCA Directory, although Medchart US Inc.’s commitments apply equally to Marble and SettLiT The scope of SettLiT services, datasets, or processing activities subject to IAS or HIPAA requirements is determined by the applicable TEFCA Framework Agreements, its standard operating procedures, and applicable law.

‍

This IAS Notice explains the additional privacy and security practices applicable to Individually Identifiable Information (“III”) maintained by Medchart US Inc. where TEFCA requirements apply, including rights that apply specifically to III maintained by Medchart US Inc. in connection with IAS (“IAS Data”). For purposes of TEFCA, where the Framework Agreements or applicable standard operating procedures refer to “III” generally, the requirement applies to all III maintained by Medchart US Inc. as the IAS Provider legal entity, regardless of source. Where they refer specifically to “III maintained by the IAS Provider in connection with IAS,” that term applies to information accessed by an individual using the TEFCA Exchange.

‍

Relationship with Other Agreements

Once information retrieved through Individual Access Services is available to you in the Individual Access Services App, the Individual Access Services App’s terms of service and privacy notice apply to that information. Those terms do not displace any TEFCA obligations that continue to apply while the III remains within Medchart US Inc.'s stewardship.

‍

If there is a conflict between this IAS Notice and the Individual Access Services App's terms or privacy notice, this IAS Notice controls to the extent necessary to satisfy Medchart US Inc.'s obligations as the IAS Provider under TEFCA.

‍

How IAS Data is Accessed, Exchanged, Used, and/or Disclosed

In general, we only share your information with you or your Personal Representative(s), any person or organization authorized by you or your Personal Representative(s), and our third-party service providers. We may also share your information when required by law or court order, or in connection with business transfers (such as a merger or acquisition).

‍

We share the minimum information necessary to search for, locate and retrieve information. If authorized by you or your Personal Representative(s), we can also share information with organizations that you designate or their participating organizations.

‍

We share the minimum necessary information with our sub-processors to help us provide the Individual Access Services. These companies are acting on our behalf and are required, by contract with us, to keep your information confidential, and are only authorized to use it for specified purposes, consistent with our contractual commitments, applicable law and other requirements.

‍

All disclosures through TEFCA are made in accordance with the permitted and required Uses and Disclosures specified in the Common Agreement and applicable U.S. Department of Health and Human Services guidance.

‍

We closely scrutinize law enforcement and regulatory requests. We disclose information to law enforcement or regulatory authorities only when we determine disclosure is required or permitted by applicable law, including in response to a valid court order, subpoena, civil investigative demand, search warrant, or other valid legal process. Where appropriate, we use reasonable efforts to limit the information disclosed.

‍

If we are not prohibited from doing so, we will provide written or electronic notice to you within three (3) business days of receiving any such legal process, and within three (3) business days of making your III available to law enforcement. You may object to the production of your III or seek a protective order or other appropriate remedy consistent with applicable law.

‍

If we are a party to a legal proceeding with you, we will not disclose information retrieved from Individual Access Services for purposes of resolving a civil dispute. If we are not a party to a legal proceeding but receive a valid subpoena, discovery request or other lawful process, we will provide notice as described above and use reasonable efforts to limit disclosures of your IAS Data to the minimum necessary to accomplish their intended purpose.

‍

If we enter into a merger, acquisition, or the sale of all or part of our assets, Individual Access Services will likely be part of the assets transferred. If a successor makes a Material Change to this IAS Notice that would result in use or disclosure of III in a materially different manner, your express, documented, and informed consent will be obtained before that use or disclosure.

‍

We will never use information retrieved from Individual Access Services to make claims against you, except (if applicable) to collect fees or costs for services you requested.

‍

We use your IAS Data to:

• Locate and retrieve information from Health Information Sources

• Process this information so we can make it available to you

• Fix errors, analyze performance and improve the usability and effectiveness of our services

• Communicate with you as needed to provide essential information and respond to your questions or concerns

• Obey laws and help prevent theft, fraud and abuse

• Enforce our agreements and policies

• Maintain system security and the privacy of your information

• Resolve disputes

‍

We retain III until you decide to delete it, subject to applicable legal, contractual, audit-log, technical, and deletion requirements.

‍

For III subject to an applicable TEFCA requirement that incorporates the HIPAA de-identification standards, we may deidentify and/or aggregate that III in accordance with 45 C.F.R. § 164.514. Once such III has been deidentified in accordance with those standards and is no longer III under the applicable TEFCA requirement, the resulting deidentified information may be used or disclosed for analytics, research, product development, market research, and other lawful purposes, including disclosure to third parties, subject to applicable law and contractual restrictions, including any applicable no-reidentification requirements. We will complete the required deidentification before any use or disclosure that relies on treatment of the information as deidentified. Recipients may use or disclose the deidentified information only as permitted by applicable law and the terms governing the transfer. Usage data reflects general patterns and trends about how users interact with the Individual Access Services (for example, feature utilization, navigation flows, and performance metrics) but does not identify any individual user. We use usage data to analyze, maintain, and improve the functionality, performance, and user experience in Individual Access Services and related services, and to generate reports, which we may share with customers and the public.

‍

We collect and use only the amount of Personal Information reasonably necessary for the permitted purposes described in this Privacy Policy and Individual Access Services Privacy and Security Notice, subject to applicable TEFCA requirements and applicable law.

‍

Medchart US Inc. is not a “covered entity” or a “business associate” under HIPAA. To the extent required by the applicable TEFCA Framework Agreements, Medchart US Inc. doing business as SettLiT complies with the HIPAA Privacy Rule provisions incorporated by those agreements with respect to III subject to those requirements. When Medchart US Inc. is a Non-HIPAA Entity under the applicable TEFCA Framework Agreements, it also complies with the HIPAA Security Rule provisions required by those agreements with respect to III as if the III were protected health information and Medchart US Inc. were a covered entity or business associate. Nothing in this IAS Notice is intended to extend HIPAA or TEFCA requirements beyond the scope imposed by applicable law, the applicable TEFCA Framework Agreements, or standard operating procedures.

‍

Required Conformance with the Privacy and Security Notice and TEFCA

SettLiT is required to act in conformance with this IAS Notice and uses commercially reasonable efforts, including administrative, physical, and technical safeguards, to protect III, including IAS Data, from unauthorized or illegal access, modification, use, or destruction in accordance with the applicable TEFCA Framework Agreements.

‍

SettLiT encrypts all III it holds, both in transit and at rest, regardless of whether the data is TEFCA Information. Our sub-processors are required to meet applicable privacy and information security requirements consistent with our contractual commitments and applicable law.

‍

SettLiT’s obligations under the Individual Access Services Privacy and Security Notice and TEFCA will continue for as long as it maintains III subject to those obligations.

‍

While we implement reasonable privacy controls and information security measures to safeguard Personal Information from unauthorized access, disclosure, use, modification, and loss, no security measure can eliminate all risk. We maintain protocols to provide required notifications and take appropriate response measures if information is compromised.

‍

Opt-In Consent

We will not launch Individual Access Services without your affirmative opt-in consent.

‍

We will obtain your express, documented, and informed consent to this IAS Notice before accessing, exchanging, using, or disclosing III in connection with IAS, other than disclosures required by applicable law. If we make a Material Change to this IAS Notice, including by adding new uses or disclosures of III, we will obtain your express, documented, and informed consent before using the information in the materially different manner described in the updated IAS Notice.

‍

How to Revoke Consent for Individual Access Services

You can withdraw your consent at any time through the Individual Access Services App, and we will honor the withdrawal upon receipt. Step-by-step instructions for revoking consent are available in the app and on our website.

‍

Be advised, withdrawing consent does not affect actions we took in reliance on your consent before we received the withdrawal. After withdrawal, we may continue processing only to the extent required by applicable law or supported by a separate valid authorization or other applicable TEFCA basis.

‍

After revocation, you will no longer be able to access Individual Access Services unless you provide a new opt-in consent.

‍

Individual’s Rights with respect to IAS Data

With respect to IAS Data, and subject to applicable law and technical feasibility, you have the right to require deletion of III maintained by SettLiT in connection with IAS with respect to future uses and disclosures, except for III contained in audit logs or where deletion is prohibited by applicable law; access that III; obtain an export of that III in a machine-readable format, including the means to interpret that format; and be notified if the III is reasonably believed to have been affected by an IAS Incident. You may exercise these rights through the Individual Access Services App or by contacting our Privacy Office. If SettLiT is reasonably aware of applicable law that prohibits it from honoring a deletion request, we will inform you.

‍

To access or export your IAS Data, follow the instructions to log-into the consumer portal sent to your email from Medchart US Inc. during your Individual Access Services identity verification and authorization process. Then use the download function within the portal for each element of IAS Data you wish to export. Available export format(s): ZIP files containing IAS Data elements selected. Each IAS Data element may be stored as a unique data format and is only available in the format in which it is natively stored within SettLiT. These may include JSON, FHIR, HTML, XML, CSV, PDF, TIFF, TXT, or other formats.

‍

Incident Reporting

We will notify you if III is reasonably believed to have been affected by an IAS Incident, as required by TEFCA and applicable law.

‍

Fees and Consent to Sale

We do not charge individuals fees or costs for IAS or for exercising the rights described in this IAS Notice. We get paid by customers for services we provide. We will not sell III or receive remuneration in exchange for III unless the transaction is permitted by applicable law and we have obtained your prior, express, and documented Consent to Sale, together with any other consent or authorization required by applicable law. Any Consent to Sale will be conspicuously labeled and separate from your consent to this Notice. As described above, we may use, disclose, license, or sell information after we have deidentified it in accordance with the standards described above.

‍

To access and use Individual Access Services, you will need access at your own expense to the internet, a computer, cell phone number, smartphone or similar handheld device, and an acceptable digital identity credential from a recognized organization. We are not responsible for the fees that you incur from these third parties.

‍

We may use III to provide you with better access to services through targeted marketing or advertising only if the use or disclosure is permitted by applicable law and we have obtained your prior, express, and documented Consent to Sale, together with any separate permission or authorization required by applicable law for the marketing or advertising.

‍

Required Disclosures

CommonWell Health Alliance (https://www.commonwellalliance.org/):

‍

Any information retrieved through CommonWell is provided to you on an as-is, as available basis, with no warranty of any kind, and for information purposes only. You disclaim any claim that CommonWell’s services or any information retrieved through CommonWell is medical advice.

‍

The Trusted Exchange Framework and Common Agreement (https://rce.sequoiaproject.org/tefca/)

‍

U.S. Centers for Medicare & Medicaid Services (CMS)

Be advised, CMS does not certify or endorse the Individual Access Services functionality. CMS disclaims any warranty relating to its services for facilitating the retrieval of information from CMS, or to the information itself.

‍

U.S. Department of Veterans Affairs

SettLiT is an independent application and is not created or endorsed by the U.S. Department of Veterans Affairs. If you authorize the IAS Provider through SettLiT to retrieve information from VA, our collection, use, disclosure, and protection of that information is governed by this Privacy Policy, this IAS Notice, applicable law, and any applicable VA terms.

‍

Request-Only IAS Provider

MEDCHART US INC., OPERATING AS MARBLE AND SETTLIT DOES NOT PROVIDE BIDIRECTIONAL SERVICES. YOU WILL HAVE THE ABILITY TO REQUEST ACCESS TO YOUR HEALTH INFORMATION VIA TEFCA EXCHANGE. YOU WILL NOT BE ABLE TO USE MARBLE OR SETTLIT TO SHARE YOUR HEALTH INFORMATION WITH OTHER PARTICIPANTS IN TEFCA.

‍

Complaints and Questions

For more information about our privacy protection practices, or to raise a concern you may have about our practices, please contact:

‍

Juliana Doxey
Chief Privacy Officer, Medchart US Inc.
215 S. Denton Tap Rd., Suite 290
Coppell, TX, 75019
Email: privacy@medchart.com
Toll-free: 1-833-603-0407
Fax: 1-888-929-2687