Privacy Policy

Guiding Principles

i3, an Ingenix company, is a global information and research business that provides products and services to help our customers improve health care treatment, delivery, and financing as well as develop and bring to market new therapies. In our operations, we often possess personal information that identifies individuals and other proprietary information about our customers' operations. Preservation of, and respect for, our customers' trust is critical to our continued success. Therefore, we will always treat such information:

• Confidentially, according to applicable laws.
• Appropriately, according to the promises we make to our customers.
• Respectfully, according to our common concern for the sensitive nature of such information.

Policies

Information Security: We maintain appropriate physical, electronic, and administrative security standards and procedures to safeguard our data and systems. Our employees are educated on the importance of our privacy and security policies and must comply with them. Employees are permitted to access and use only that personal and proprietary information they need to perform their job duties.

Information Processing: We try to use only the amount of personal and proprietary information necessary for research, analytical or derivative product development purposes that are consistent with:

1. Our core business mission to provide high-quality products and services to our customers;
2. Our contractual and legal obligations to customers, data controllers, and individuals from whom we receive such information; and
3. Applicable law.

We have procedures to maintain the accuracy of information while in our care. We do not maintain personal information longer than necessary.

• When we receive personal information from customers or other data controllers as a business associate, we rely on their obligations to provide individuals with any required notice and consent for the intended purpose or we obtain additional consent/authorization as necessary. We process personal information obtained from clinical research trials in accordance with the individual's informed consent, national laws, and international guidelines governing the protection of human subjects. Research using personal information is approved by an institutional review board, ethics committee or privacy board where and as required by law.
• When we collect personal information directly from individuals (such as those interested in participating in a clinical research trial or becoming clinical investigators) on behalf of a customer, we will provide such individuals with:
  1. Notice about the intended use and disclosure of their information;
  2. Choice before using or disclosing their information for any other purpose; and
  3. The ability to access and correct their information where required by law.

De-identified Data: We remove, encode or encrypt individual identifiers from personal information to the fullest extent possible consistent with its intended use. In some cases, we receive personal information from customers and data controllers for the purpose of de-identifying it on their behalf. We make anonymous such data using statistical techniques to create aggregated norms or benchmarks, such as hospital performance measures or prevailing insurance charges in an area.

Clinical Communications: We may partner with customers such as health plans and health care providers to help them inform patients about treatment options such as clinical trials. We also may partner with customers to help them provide information on health-related products and services of potential interest to their consumers. We will not use personal information for such purposes unless:

1. The activity is permitted by law;
2. The activity promotes health and well-being; and
3. Individuals are given the opportunity to "opt-out" of the program or to "opt-in" to the program where required by law or by the customer or data controller.

In addition:

• We will not distribute information or solicitations to consumers enrolled in government health care programs for purposes other than assisting a customer in carrying out treatment, payment or health care operations, unless approved in advance by the sponsoring government agency and requested by the individual without any solicitation on our part.
• We will not solicit or provide information to consumers based on their status with or at risk for mental health, substance abuse, or HIV/AIDS, unless we are acting on behalf of a customer who has obtained appropriate consent/authorization or is otherwise legally authorized to make such contact, or when approved by an institutional review board or privacy board for research purposes in accordance with applicable law.

Information Disclosure: We will not disclose personal or proprietary information, which we obtain in the course of providing products and services to our customers, to any third party except: (1) as required by law, or (2) consistent with applicable law and our obligations to the customer, data controller, and/or individual from whom we received the information, as follows:

• We may disclose personal information to a service provider to perform a specific service on our behalf, but only when consistent with this policy and subject to a contract that:
  1. Prohibits them from using the information for any other purpose;
  2. Requires them to conform to our privacy and security obligations; and
  3. Allows for an audit of their compliance.
• We will not share one customer's information with another customer, except at the customer's direction or as part of de-identified aggregated norms. At the direction of a customer, such as an employee benefit plan sponsor, we will disclose the customer's information to its other service providers, from its service providers back to the customer, or to other entities participating with the customer in an organized health care arrangement. The other entities may also be our customers.
• We disclose personal information about clinical investigators and encoded patient data from clinical research trials to the study sponsor in accordance with the individual's consent or contract.

Personal or proprietary information may be included in assets transferred as part of a merger or sale of the company's assets.

International Data Transfers: i3 is a multi-national company with offices and customers in many countries. We may transfer personal or proprietary information to one of our other international offices or to a customer located outside the country in which it was originally collected in accordance with international data protection laws.

Web Site Privacy: We do not identify visitors to our World Wide Web site unless they choose to identify themselves, such as to obtain information about products or clinical trials.

• Our Web site may deposit a small file called a "cookie" on a visitor's computer hard drive to personalize their experience or track aggregate site visitation statistics. Visitors may choose to use technologies to block such "cookies," but in some cases they may not have access to the full functionality of the Web site.
• We may record a Web site visitor's Internet Protocol (IP) address for security reasons and to evaluate how our Web site is being used. We do not use IP addresses to identify individuals.

Our Web site is not designed to attract children; we do not collect or maintain information from our Web site from individuals that we actually know are under the age of 13 years.