Privacy Policy
OrthoLive, Inc., d/b/a HealthcareLive, Inc. and OrthoLive Medical Group, Prof Corp d/b/a HealthcareLive Medical Group, Prof Corp — how we collect, use, and protect your personal information.
HealthcareLive, Inc. (“HealthcareLive,” “we,” “us,” or “our”) and OrthoLive Medical Group, Prof Corp d/b/a HealthcareLive Medical Group, Prof Corp (our affiliated medical group) respect your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information through the HealthcareLive platform and any website or online service that links to this Policy (the “Services”), and the rights and choices available to you.
This Policy covers non-HIPAA information only. Information that constitutes Protected Health Information under HIPAA is governed by our HIPAA Notice of Privacy Practices, which controls in the event of any conflict. State privacy laws generally do not apply to HIPAA-regulated PHI, but do apply to website data, web-form data, cookies, and advertising technologies even where the subject matter is health-related.
This Policy incorporates our gap analysis against all twenty state comprehensive privacy laws in force as of mid-2026, the Washington My Health My Data Act, the Nevada consumer health data law, and the Connecticut SB 1295 amendments effective July 1, 2026. We draft to the Maryland MODPA standard — the strictest state baseline — so that a single policy satisfies all applicable state requirements.
Scope of This Policy & Relationship to HIPAA
This Policy applies to personal information we collect from and about visitors, prospective customers, employer and broker contacts, employees of our client organizations, and individuals who interact with the Services. It does not apply to information regulated as PHI under HIPAA and HITECH; those disclosures appear in our HIPAA Notice of Privacy Practices.
The two documents are complementary. If a healthcare interaction creates PHI, the HIPAA Notice governs it. If the same interaction also generates website analytics, advertising identifiers, or inferred data, this Policy governs those data streams. If there is ever a conflict regarding PHI, the HIPAA Notice controls.
Information We Collect
Information You Provide to Us
When you register, request a demo or RFP, complete a web form, communicate with us, or use the Services, you may provide:
- Name, title, employer, and business contact information
- Phone number, email address, and login credentials
- Date of birth, state, country, ZIP code, and health plan information
- Information about your interest in or need for care, injury, or occupational health services
If you are a registered member receiving care, some of this information may be PHI governed by the HIPAA Notice rather than this Policy.
Information from Healthcare Providers and Other Sources
In connection with treatment and subject to applicable law, we may receive records from your past, current, and future healthcare providers, and from employers or plan sponsors. Such records may include diagnoses, prior treatments, general health information, laboratory and pathology results, social and family history, and related communications. Records received in a HIPAA-covered capacity are governed by the HIPAA Notice.
Information Collected Automatically
- Internet Protocol (IP) address, device identifiers, and online identifiers
- Browser type, operating system, and internet service provider
- Pages viewed, links clicked, and dates and times of visits
- Standard server log information
- Approximate geographic location derived from IP address
We do not collect precise device GPS location from public website visitors unless you specifically grant permission for a feature that requires it.
Cookies & Tracking Technologies
We and our service providers use cookies, pixels, and web beacons to operate the Services, remember your preferences, measure performance, and — if we engage advertising partners in the future — may support advertising consistent with your choices. We do not use Adobe Flash Local Shared Objects or other deprecated tracking technologies.
You can manage cookies through your browser settings. You may also exercise opt-out rights for advertising and the sale or sharing of personal information as described in Section 5, including by using a recognized universal opt-out signal such as the Global Privacy Control (GPC) once we have implemented support for it.
Lead Scoring
We use automated lead scoring to evaluate and prioritize business contacts and prospective employer, broker, and partner customers for commercial outreach. Lead scoring assigns a numeric score based on how closely a contact matches our ideal customer profile and the level of engagement they have shown with our Services. That score influences whether and how our sales team contacts a prospect, the priority of outreach, and the type of content or offer presented. This automated evaluation of individuals constitutes profiling under applicable state privacy laws.
Attributes used in lead scoring fall into four categories:
Firmographic fit — attributes about the organization the contact works for, including: industry or vertical (e.g., construction, manufacturing, logistics, maritime, healthcare); company size by employee count or revenue; geographic location of the business; type of organization (employer, insurance carrier, TPA, broker, staffing agency); and whether the company has an active workers’ compensation or occupational health program.
Demographic / contact fit — attributes about the individual contact, including: job title and seniority level; department or functional role (e.g., HR, risk management, operations, benefits, C-suite); decision-making authority; and estimated tenure with their current employer.
Behavioral engagement signals — actions taken on our website or in response to our communications, including: pages visited and time spent (including pricing, services, and industry-specific pages); content downloaded (guides, case studies, whitepapers); form submissions and data request activity; email open and click-through rates; webinar or event attendance; demo or consultation requests; and number and recency of visits.
Negative signals (which reduce a score) — including: prolonged inactivity or score decay over time; unsubscribes from marketing communications; use of a personal rather than business email address; and prior indication that the contact is a competitor or is not a decision-maker.
Lead scoring is applied only to business contacts and prospective customers — not to patients, plan members, or individuals seeking personal healthcare services. It does not affect any individual’s access to healthcare services, insurance, employment, or housing. You may opt out of lead scoring at any time using the methods in Section 9.
How We Use Your Information
- To operate, maintain, secure, and improve the Services, and to verify eligibility and complete registration
- To provide a tailored experience and respond to your requests for products, services, demos, RFPs, and information
- To communicate with you, including service messages and, where permitted and consistent with your choices, marketing about our Services
- To conduct research and analytics, generally using deidentified or aggregated information
- To detect, prevent, and address fraud, abuse, and security incidents
- To meet legal, contractual, and regulatory obligations
How We Share Your Information
We share personal information only in the circumstances below. We do not sell your personal information to third parties for their own commercial purposes. Every disclosure listed here serves a single governing purpose: the coordination, delivery, and management of your episode of care and ongoing case management. Disclosures outside that purpose — for example to your employer, legal counsel, insurers acting in a claims capacity, or other third parties not directly involved in your care — occur only as expressly permitted by the Universal Terms of Service (UTOS), your written consent, or a valid patient release or authorization. No disclosure is made for the independent commercial benefit of any third party.
Service Providers and Processors
We share information with vendors that host data, provide analytics, support communications and billing, and process requests. Where a formal service contract governs the relationship, it restricts the vendor’s use strictly to supporting the delivery and administration of your episode of care and prohibits any further disclosure, sale, or independent use of your information. These are service relationships, not data-sharing relationships.
Healthcare and Related Entities
We share information with providers, laboratories, and other entities directly involved in treating you or coordinating your episode of care — for example, a specialist receiving a referral within our provider network, an imaging center fulfilling a diagnostic order, or a pharmacy fulfilling a prescription. Some of these disclosures occur through formal contracts; others occur through clinical referral arrangements, treatment relationships, or at your direction — all of which are independently lawful bases for disclosure under HIPAA and applicable state law. This is the core clinical purpose for which HealthcareLive exists.
Corporate Affiliates
We share information with subsidiaries and affiliates within our corporate group, including OrthoLive Medical Group, Prof Corp d/b/a HealthcareLive Medical Group, Prof Corp, subject to this Policy.
Employer, Legal Counsel, and Other Third Parties
Disclosure of your personal information to your employer (in a workers’ compensation or occupational health context), to legal counsel, to insurers acting in a claims or subrogation capacity, or to any other third party not directly involved in your care requires one of the following independent bases:
- Universal Terms of Service (UTOS): Where the UTOS, executed by your employer or plan sponsor as the responsible party, authorizes a specific category of disclosure as part of the service relationship (for example, injury reporting to the employer of record in a workplace injury case).
- Your written consent or patient release: A signed, purpose-specific authorization from you permitting the disclosure. Consent obtained for one purpose does not authorize disclosure for a different purpose.
- Legal obligation: A valid subpoena, court order, regulatory demand, or other legal process requiring disclosure, in which case we will notify you to the extent permitted by law.
- Applicable law: A specific statutory or regulatory permission that applies to the data and the recipient (for example, mandatory workers’ compensation reporting requirements).
Advertising and Analytics Partners
We do not currently use advertising partners or share your personal information for advertising purposes. In the future, we may share limited online identifiers and activity data with advertising and analytics partners through cookies and similar technologies. If and when we do, any such sharing will be: (a) consistent with your choices and the opt-out and consent rules in Sections 5 and 6; (b) limited to online identifiers only — it will never include your name, health records, injury information, or treatment data; and (c) subject to your right to opt out at any time. This would be the only category of disclosure not solely in furtherance of your episode of care. We will update this Policy and provide appropriate notice before engaging in any such sharing. Certain future disclosures of identifiers to advertising partners may constitute a “sale” or “sharing” under state law; see Section 5 for your opt-out rights.
Legal, Safety, and Transactional Recipients
We disclose information to comply with law and legal process, to protect rights and safety, and in connection with a merger, acquisition, financing, or similar transaction.
Recipients You Direct
We share information when you request or direct us to, including through social media integrations. Information posted in public areas of the Services may be viewed by others.
Deidentified Information
We may disclose deidentified or aggregated information that cannot reasonably be used to identify you, without restriction.
Sale, Sharing, Targeted Advertising & Your Opt-Out Choices
We do not currently sell personal information or share it with advertising partners for targeted advertising. We do engage in lead scoring — automated profiling of business contacts based on firmographic fit, contact attributes (title, seniority, role), behavioral engagement (website activity, content downloads, email interaction, demo requests), and negative signals (inactivity, unsubscribes) — for commercial outreach purposes. Lead scoring is separate from and does not affect any individual’s access to healthcare services. You may opt out of lead scoring using the methods in Section 9.
If we engage advertising partners in the future, certain disclosures of identifiers may be considered a “sale” or “sharing” under state privacy laws. We will provide notice and opt-out rights before doing so.
How to opt out (current and future): Email privacy@healthcarelive.com with the subject line “Privacy Choices”, use your browser’s cookie settings, or use industry opt-out tools at optout.networkadvertising.org (NAI) and optout.aboutads.info (DAA).
We honor universal opt-out signals in all twelve states that require it: California, Colorado, Connecticut, Montana, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Delaware, Oregon, and Texas. We apply this practice nationwide.
Sensitive Data & Consent
Where we process “sensitive data” as defined by applicable state law — which may include health information, disability or treatment information, precise geolocation, biometric or neural data, reproductive or sexual health information, government-issued identifiers, and certain financial account numbers — we do so only as permitted by law and, where required, with your express opt-in consent.
- Sensitive data collection: We obtain opt-in consent before collecting sensitive data in contexts that require it.
- Sensitive data sale: We obtain separate, specific opt-in consent before any sale of sensitive data. We do not currently sell sensitive data.
- No implied consent: We do not rely on your mere use of the Services as consent for processing sensitive data. Consent means a freely given, specific, informed, and unambiguous affirmative act.
- Withdrawal: You may withdraw consent at any time using the methods in Section 9. Withdrawal does not affect processing that lawfully occurred before withdrawal.
This section reflects the expanded sensitive data definitions under Connecticut SB 1295 (effective July 1, 2026) and the Maryland MODPA, which limits sensitive data collection to what is strictly necessary.
Consumer Health Data (Washington & Nevada)
What Is Consumer Health Data?
Under the Washington MHMDA and Nevada SB 370, “consumer health data” is personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status. This includes health conditions, treatment, diagnoses, medications, inferences about health, and location data that may reveal a health condition or visit to a health facility — even if not collected in a HIPAA-covered capacity.
Consumer Health Data We Collect and Why
We may collect health-related information you submit through web forms or the Services, and inferences reasonably linkable to your health that we may derive from your use of the Services. We use this information to provide, improve, and personalize the Services, to respond to your requests, and to connect you with appropriate care. We do not use consumer health data for marketing purposes without your separate opt-in consent.
How We Share Consumer Health Data
We share consumer health data only with:
- Service providers under contract that restrict their use to our specified purposes
- Corporate affiliates subject to this Policy
- Healthcare providers, laboratories, and related entities as necessary to provide care
- Advertising partners — only with your separate opt-in consent
Sale of Consumer Health Data
We do not sell consumer health data. Any future sale would require a separate, specific, signed written authorization from you — this Policy does not serve as that authorization.
Consent and Withdrawal
We obtain opt-in consent to collect, and separate opt-in consent to share, consumer health data where required by the Washington MHMDA or Nevada SB 370. You may withdraw any consent at any time using the methods in Section 9. Withdrawal will be honored promptly and does not affect prior lawful processing.
Geofencing Prohibition
We do not establish a geofence around any facility that provides in-person health care services for the purpose of identifying or tracking consumers, collecting consumer health data, or sending health-related notifications or advertisements. This commitment applies nationwide.
Washington and Nevada residents may exercise all rights in Section 8, including the right to confirm, access, and delete consumer health data and to withdraw consent, using the methods in Section 9.
Your Privacy Rights
Subject to verification and to exceptions under applicable law, residents of states with privacy laws may exercise the following rights. The specific rights available depend on your state of residence; see Section 15 for state-specific details.
How to Exercise Your Rights
To submit a request — including to opt out of lead scoring, access the data used in profiling, or exercise any other right — email privacy@healthcarelive.com with the subject line “Privacy Rights Request” and include your name, email address, state of residence, and a description of the right you wish to exercise. To opt out of lead scoring specifically, use the subject line “Opt Out — Lead Scoring.”
Response Timelines
We will acknowledge receipt promptly and respond within 45 days. If we need additional time, we may extend by an additional 45 days and will notify you of the reason. For consumer health data requests under the Washington MHMDA and Nevada SB 370, the same 45-day baseline applies.
Identity Verification
To protect your information, we may need to verify your identity before processing a request. We may ask for your name, contact details, and information about your prior interactions with us. For visitors who have not created an account, we may use an IP address or device identifier for verification. We will not require you to create an account to submit a request.
Authorized Agents
You may designate an authorized agent to submit a request on your behalf. We may require verification of the agent’s written authorization and your identity before processing the request.
Appeals
If we decline your request in whole or in part, you may appeal by replying to our response email or by contacting privacy@healthcarelive.com with the subject line “Privacy Rights Appeal.” We will respond to an appeal within the time required by your state’s law and, where applicable, provide information on contacting your state attorney general.
Data Retention
We retain personal information for as long as necessary to fulfill the purposes described in this Policy, to provide the Services, and to meet our legal, accounting, and reporting obligations, after which we delete or deidentify it. Retention periods vary by data type:
- Account and registration data: Retained while your account is active and for a reasonable period thereafter to support re-registration, legal claims, or compliance obligations.
- Transaction and billing records: Retained for the period required by applicable tax and accounting law, generally seven years.
- Website analytics and advertising data: Retained for up to 13 months or as required by contract with our service providers.
- Consumer health data: Retained only as long as necessary for the purpose collected; promptly deleted upon a valid deletion request absent legal hold.
- Legal hold data: Retained for the duration of any litigation, regulatory inquiry, or investigation in which it is relevant.
Children & Minors
The public Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn we have inadvertently collected such information, we will promptly delete it.
For known minors who are at least 13 and under 18, we apply heightened protections as required by law:
- We obtain consent before engaging in targeted advertising directed at a known minor.
- We do not sell the personal information of known minors except as expressly permitted by law.
- We do not use the personal information of known minors for targeted advertising except as permitted by law.
- We comply with Maryland MODPA’s broad restrictions on selling and targeting minors, which we apply as our nationwide standard for minors’ data.
Security
We maintain administrative, technical, and physical safeguards designed to protect personal information against loss, misuse, and unauthorized access, disclosure, alteration, and destruction. Our program is aligned with NIST privacy and cybersecurity frameworks. Providing a NIST-aligned privacy program also supports the affirmative defense available to us under Tennessee’s TIPA.
No method of transmission or storage over the internet is completely secure. We cannot guarantee absolute security. Please note that information collected by third parties may not have the same security protections as information you submit directly to us.
Third-Party Websites & Links
The Services may contain links to third-party websites and platforms we do not control. We are not responsible for their content or privacy practices. Information you provide to third parties is governed by their own privacy policies. We encourage you to review those policies before sharing information.
International Users
The Services are operated from the United States and are intended for U.S. residents. If you access the Services from outside the United States, your information may be processed and stored in the United States, which may provide a different level of data protection than your jurisdiction. By using the Services, you acknowledge this transfer.
State-Specific Disclosures
The following summarizes notable state-specific points. All residents of states with a comprehensive privacy law in force have the rights in Section 8 to the extent their state provides them.
| State / Law | Key Points for HealthcareLive |
|---|---|
| California (CCPA/CPRA) | Sale and “share” opt-out; must honor GPC; right to limit sensitive personal information; “Your Privacy Choices” link; 12-month lookback for access requests; retention disclosure required. Medical information under CMIA, HIPAA, and HITECH is exempt; website and advertising data is not. |
| Virginia (VCDPA) | Access, delete, correct, portability, opt-out of sale / targeted ads / profiling; opt-in for sensitive data; appeal right. SB 754 (July 2025) adds heightened protection for reproductive and sexual health information. |
| Colorado (CPA) | Universal opt-out (GPC) required; opt-in for sensitive data; appeal right; data protection assessments. Part of the CA-CO-CT coordinated enforcement sweep. |
| Connecticut (CTDPA + SB 1295 eff. July 1, 2026) | Lower thresholds apply to any processing of sensitive data regardless of volume; expanded sensitive data definition (disability, neural, nonbinary status, financial account numbers); proportionality standard; separate consent to sell sensitive data; right to list of specific third parties; universal opt-out required. Counsel action item: SB 1295 narrows the GLBA entity-level exemption to a data-level exemption — confirm which HCL data streams, if any, were relying on a GLBA entity-level exemption and whether the narrowed carve-out still applies. Data protection assessments required for processing activities created on or after August 1, 2026. |
| Texas (TDPSA) | No volume threshold; opt-in for sensitive data; universal opt-out required. |
| Oregon (OCPA) | Universal opt-out required; opt-in for sensitive data; right to list of specific third parties. |
| Montana (MCDPA) | Universal opt-out required; opt-in for sensitive data; appeal right. |
| Nebraska (NDPA) | No volume threshold; universal opt-out required; opt-in for sensitive data. |
| Delaware (DPDPA) | Universal opt-out (from Jan 2026); opt-in for sensitive data; appeal right; right to list of categories of third parties. |
| New Hampshire (NHDPA) | Universal opt-out (from Jan 2026); opt-in for sensitive data; appeal right. |
| New Jersey (NJDPA) | Universal opt-out required; opt-in for sensitive data; appeal right; financial information treated as sensitive. |
| Minnesota (MCDPA) | Universal opt-out (from Jul 2026); right to list of specific third parties; right to question profiling results; appeal right. |
| Maryland (MODPA) | Strictest standard; used as drafting baseline. Sensitive data collection limited to what is strictly necessary; broad prohibition on selling sensitive data; targeted advertising and sale of minors’ data restricted; universal opt-out from Jul 2026. |
| Indiana (INCDPA) | In force Jan 1, 2026. Opt-out of sale / targeted ads / profiling; opt-in for sensitive data; appeal right. |
| Kentucky (KCDPA) | In force Jan 1, 2026. Virginia-style rights; opt-in for sensitive data; appeal right. |
| Rhode Island (RIDTPPA) | In force Jan 1, 2026. Opt-out of sale / targeted ads / profiling; identifies categories of third parties to which personal data may be sold or disclosed. |
| Washington (MHMDA) | Standalone consumer health data notice required — see Section 7 and standalone notice at [LINK]. Private right of action; highest litigation exposure. |
| Nevada (SB 370) | Mirrors Washington MHMDA; AG-enforced only (no private action). See Section 7. |
| Utah (UCPA) | Opt-out of sale and targeted ads; notice-and-opt-out for sensitive data (not opt-in); accurate notice required. |
| Iowa (ICDPA) | Opt-out of sale; notice-and-opt-out for sensitive data; accurate notice required. |
| Tennessee (TIPA) | Opt-out of sale / targeted ads / profiling; opt-in for sensitive data; NIST-aligned program supports affirmative defense. |
| Florida (FDBR) | Applies primarily to large for-profit entities meeting revenue thresholds. [Confirm applicability.] |
Changes to This Policy
We may update this Policy from time to time to reflect changes in our practices, the Services, or applicable law. When we make material changes, we will revise the Effective Date at the top of this page and notify you as required by law. We recommend reviewing this Policy periodically.
Contact Us
Questions about this Policy or our privacy practices may be directed to:
| privacy@healthcarelive.com | |
| Legal / Data Requests | legal@healthcarelive.com |
| Address | 1311 Vine Street, Cincinnati, OH 45202 |
| Phone | 833-573-6683 |
| Website | www.HealthcareLive.com/terms-of-service |
