Privacy Policy

1. Scope and Purpose

This Privacy Policy (“Policy”) explains how Candid Billing LLC and its affiliated companies, subsidiaries, and parent companies (referred to as “Candid Billing,” “we,” “us,” “our,” or “CandidBilling”) collect, use, disclose, and safeguard information obtained from you through our websites and applications, including www.candidbilling.com, that link to this Policy (collectively, the “Sites”). This Policy also governs information collected offline, such as when you visit our offices, attend events, speak with our representatives, or interact with us in any other circumstance where this Policy is made available to you.

This Policy does not apply to third-party websites, products, or services that we do not control, even if they are linked from our Sites. We encourage you to review the privacy policies of those third parties before providing any information to them.

By using our Sites or providing information to us, you acknowledge that you have read and understood this Policy.

2. Information We Collect

2.1 Information You Provide to Us

• Contact details — name, email address, phone number, practice name, and job title.
• Business information — NPI number, specialty, practice size, patients per day, and services you are interested in.
• Communications — messages, consultation requests, form submissions, and correspondence with our team.
• Engagement information — billing, credentialing, and account details you provide when you engage our services.

2.2 Information Collected Automatically

• Device and browser data — IP address, browser type, operating system, and device type.
• Usage data — pages viewed, links clicked, referring URL, and time spent on the Sites.
• Cookies and similar technologies — as described in Section 5 below.

2.3 Protected Health Information (PHI)

In the course of providing medical billing, revenue cycle management, credentialing, and related services, we may receive or process PHI on behalf of healthcare providers. We handle PHI in accordance with the Health Insurance Portability and Accountability Act (“HIPAA”) and the terms of the applicable Business Associate Agreement (“BAA”).

3. How We Use Your Information

• Respond to your inquiries and provide the services you request.
• Process, manage, and support client engagements.
• Improve our Sites, services, and overall customer experience.
• Send service updates, newsletters, and marketing communications, with an option to opt out at any time.
• Comply with legal, regulatory, tax, and contractual obligations.
• Detect, prevent, and address fraud, abuse, and security incidents.

4. How We Share Your Information

We do not sell your personal information. We may share information in the following limited circumstances:

• Service providers and business associates — vendors that perform functions on our behalf, such as hosting, email delivery, analytics, and IT support, under confidentiality and data-protection obligations.
• Clients and healthcare providers — as necessary to deliver the services you have engaged us to perform.
• Professional advisors — lawyers, accountants, auditors, and insurers who need the information to advise us.
• Legal and regulatory requirements — to comply with applicable law, legal process, court orders, or lawful requests from public authorities.
• Business transfers — in connection with a merger, acquisition, reorganization, or sale of assets, subject to this Policy.
• With your consent — when you ask us to share information or direct us to do so.

5. Cookies and Similar Technologies

We use cookies and similar technologies to operate the Sites, remember your preferences, measure traffic, and improve performance. You can control or disable cookies through your browser settings; however, disabling cookies may affect certain features of the Sites. We may use third-party analytics providers (such as Google Analytics) that collect information in accordance with their own privacy policies.

6. HIPAA Compliance and Business Associate Obligations

Where we act as a Business Associate, we use and disclose PHI only as permitted by the applicable BAA and HIPAA. We maintain administrative, physical, and technical safeguards designed to protect PHI. Our obligations with respect to PHI are governed by the BAA and HIPAA, which take precedence over this Policy to the extent of any conflict.

7. Data Security

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information and PHI, including access controls, encryption in transit where appropriate, and ongoing employee training. However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

8. Data Retention

We retain information for as long as necessary to fulfill the purposes described in this Policy, comply with legal and contractual obligations (including HIPAA retention requirements), resolve disputes, and enforce our agreements. Retention periods vary depending on the type of information and the services provided.

9. Your Privacy Rights

Depending on your location, you may have some or all of the following rights:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion, subject to legal and HIPAA retention obligations.
• Opt out of marketing communications at any time.
• Object to or request restriction of certain processing.
• Request a portable copy of your information.
• Lodge a complaint with a supervisory authority.

To exercise these rights, contact us at info@candidbilling.com. We will verify your request and respond within the time required by applicable law. We will not discriminate against you for exercising your privacy rights.

California residents: you may have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know, delete, correct, and opt out of the sale or sharing of personal information. We do not sell personal information.

10. Children’s Privacy

Our Sites and services are intended for healthcare professionals and business users, not children. We do not knowingly collect personal information from children under 13 (or the applicable age in your jurisdiction). If you believe a child has provided personal information to us, please contact us and we will take appropriate steps to delete it.

11. Third-Party Links

Our Sites may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites. We encourage you to review their privacy policies before providing any information.

12. International Visitors

Our Sites are operated in the United States. If you access them from outside the United States, your information may be transferred to, stored, and processed in the United States, where privacy laws may differ from those in your jurisdiction. Where required, we implement appropriate safeguards for such transfers.

13. Changes to This Policy

We may update this Policy from time to time. The “Last updated” date at the top of this page reflects the most recent revision. Material changes will be posted on this page. Your continued use of the Sites after changes become effective constitutes acceptance of the updated Policy.

14. Contact Us

If you have questions about this Policy or our privacy practices, please contact us:

Candid Billing LLC
530 Broad Street, Carlstadt, New Jersey 07072
Phone: (657) 355-6936
Email: info@candidbilling.com
Website: www.candidbilling.com