Solveglobal Privacy Policy

Introduction and Scope

Solveglobal LLC ("Solveglobal," "we," "our," or "us") provides musculoskeletal disorder risk-mitigation, workforce health and well-being support, check-in tools, provider coordination, employer reporting, and related services through our public website and authenticated online portal (collectively, the "Services"). Depending on the program, the portal may be available to employees, members, spouses, eligible family members, providers, client representatives, or other covered participants.

This Privacy Policy applies to personal information that Solveglobal collects or receives through the Services, including information connected with website visits, portal registration and use, check-ins, provider coordination, service communications, workforce reporting, customer support, security, account administration, contracting, and billing.

This Privacy Policy does not replace a separate notice that may apply to information handled by an employer, group health plan, insurance carrier, workers' compensation carrier, third-party administrator, healthcare provider, or other organization. If another organization sponsors your access to the Services, its privacy notices and legal obligations may also apply.

Our Role and Sensitive Information

2.1 Health-related information and HIPAA

Some information handled through the Services may be health-related. Whether the Health Insurance Portability and Accountability Act ("HIPAA") or another health privacy law applies depends on the source of the information, the purpose for which it is handled, and Solveglobal's role.

When Solveglobal handles protected health information ("PHI") for a HIPAA covered entity or business associate, Solveglobal acts under the applicable Business Associate Agreement and HIPAA requirements. This Privacy Policy is not a HIPAA Notice of Privacy Practices for a provider, health plan, insurer, employer group health plan, or other covered entity.

2.2 Employer and plan roles

An employer can act in different capacities. When an organization acts as an employer, Solveglobal does not disclose a participant's identifiable health-related information, individual check-in responses, or provider notes for employment-related actions or decisions, except at the participant's direction or as required by law.

When an employer or another organization performs a legally recognized group-health-plan or plan-sponsor function, any disclosure is limited to the plan-administration purpose and conditions permitted by applicable law, governing plan documents, and applicable agreements. Information received for plan administration is not disclosed for employment-related actions or decisions.

2.3 Employment records and other regulated information

Health-related information contained in employment records may be governed by employment, disability, workers' compensation, or state privacy laws rather than HIPAA. Consumer health data that is not PHI may be governed by state consumer health data laws. We apply the requirements appropriate to the information and the role in which we handle it.

Information We Collect

The information we collect depends on your relationship with Solveglobal, the program through which you use the Services, and the features you use.

3.1 Website and inquiry information

• Contact and business information, such as name, organization, job title, email address, phone number, mailing address, and the content of an inquiry.
• Technical and usage information, such as IP address, browser and device type, operating system, referring source, pages viewed, links selected, access dates and times, cookie identifiers, and diagnostic records.

3.2 Client and program administration information

• Client representative information, including organization, role, work contact information, account, contract, billing, and support records.
• Eligibility and access information supplied by a sponsoring organization or participant, which may include participant or employee ID, name, date of birth, company, department, shift, job title, eligibility status, email address, and mobile phone number.
• We seek to collect only the data elements reasonably necessary for eligibility, account administration, service delivery, security, and legal or contractual obligations.

3.3 Portal and check-in information

• Registration, login, authentication, account, and communication-preference information.
• Check-in responses and information about physical function, musculoskeletal concerns, discomfort, limitations, performance, job tasks, work conditions, ergonomic concerns, requested support, and follow-up availability.
• Portal messages, support requests, feature activity, submission history, session information, audit logs, error reports, and security events.

3.4 Provider and care-coordination information

• Referral, consultation, appointment, scheduling, and follow-up status.
• Provider identity and organization, participant-submitted information relevant to the consultation, provider notes, recommendations, observations, communications, and records needed to document or coordinate Services.

3.5 Communication records

• Email address, mobile number, message content, date and time, delivery and response status, consent and opt-out records, and related technical or support records.
• If you include health-related or other sensitive information in an email or text reply, that content may be processed by the communication provider used to transmit or host the message.

Please do not submit sensitive personal information that is unrelated to the Services or that we have not requested.

Sources of Information

We collect personal information from:

• you, when you visit the website, register, complete a check-in, communicate with us, or use the portal;
• employers and organizational clients that sponsor or administer a program;
• group health plans, insurers, workers' compensation carriers, third-party administrators, and similar organizations, where applicable;
• providers and clinical or care-coordination partners;
• service providers and technology systems used to operate, secure, and support the Services; and
• records generated through use of the Services, including logs, security records, analytics, inferences, and reporting outputs.

We may combine information from these sources when reasonably necessary for the purposes described in this Policy and permitted by law and applicable agreements.

How We Use Information

Solveglobal uses personal information to:

• operate, maintain, troubleshoot, secure, and improve the Services;
• verify eligibility, create and administer accounts, authenticate users, and manage permissions;
• deliver check-ins, reminders, portal notices, and other service communications;
• support musculoskeletal risk mitigation, participant engagement, follow-up, and appropriate provider involvement;
• coordinate consultations, scheduling, referrals, and related documentation;
• produce workforce-level reporting and analysis in accordance with Section 7;
• manage client, plan, carrier, administrator, provider, and vendor relationships;
• respond to inquiries, support requests, privacy requests, complaints, and security concerns;
• detect, investigate, and prevent fraud, misuse, security incidents, and unauthorized access;
• comply with law, legal process, professional obligations, contracts, Business Associate Agreements, plan documents, claims requirements, and recordkeeping duties; and
• create and use aggregated or de-identified information as described in Section 11.

We do not use participant health-related information, individual check-in responses, provider notes, or authenticated portal health activity for third-party advertising or cross-context behavioral advertising.

How We Disclose Information

We disclose personal information only for the purposes described below, at an individual's direction, or as otherwise permitted or required by law.

6.1 Service providers and technology vendors

We may disclose information to vendors that provide hosting, storage, security, authentication, communications, analytics, support, reporting, payment, legal, audit, and other operational services. Vendors receive only the information reasonably necessary for their assigned services and are subject to applicable contractual confidentiality, security, data-use, and deletion requirements.

6.2 Sponsoring organizations, plans, carriers, and administrators

We may disclose limited administrative information needed to verify eligibility, administer access, reconcile services, or manage a program. Identifiable health-related information is disclosed only when permitted for the recipient's legally recognized role, authorized or directed by the individual, or required by law. Section 7 explains the separate limits that apply to employers and plan functions.

6.3 Providers and care-coordination participants

We may disclose information reasonably necessary to arrange, provide, document, or coordinate a requested consultation or related support. A provider's own privacy notice and professional obligations may also apply.

6.4 Legal, safety, security, and business purposes

We may disclose information when reasonably necessary to comply with law or valid legal process; protect a person, Solveglobal, or the Services; investigate fraud or security incidents; enforce agreements; exercise or defend legal claims; or complete a merger, acquisition, financing, reorganization, or sale of assets subject to appropriate confidentiality protections.

6.5 Professional advisors

We may disclose information to attorneys, accountants, auditors, insurers, consultants, and other professional advisors subject to appropriate confidentiality duties.

6.6 No sale or cross-context behavioral advertising

Solveglobal does not sell personal information and does not share personal information for cross-context behavioral advertising. We do not permit third parties to use participant health-related information, individual check-in responses, provider notes, or authenticated portal health activity for their own advertising or marketing.

Employer Reporting, Plan Administration, and Individual Privacy

7.1 Employers acting as employers

Employer reporting is designed to support workforce-level prevention, safety, musculoskeletal risk mitigation, health, and well-being. Employers acting in their employment capacity receive aggregated or de-identified reporting. They do not receive individual check-in responses, provider notes, or identifiable participant health-related information for hiring, discipline, promotion, termination, compensation, or other employment actions.

7.2 Administrative information

A sponsoring organization may receive limited administrative information needed to operate the program, such as eligibility, enrollment, access, or service-administration status. Administrative reporting is not intended to disclose the substance of a check-in, diagnosis, provider note, or other health-related information.

7.3 Plan-sponsor and claims functions

Where an employer or another organization performs a plan-administration, insurance, claims, or workers' compensation function, Solveglobal may disclose information only to the extent permitted by the applicable legal framework, governing documents, and agreements. Information disclosed for a plan function may not be used for employment-related actions or decisions where prohibited by law or agreement.

7.4 Exceptions

Individual information may be disclosed when the participant directs or authorizes the disclosure, when necessary to address an applicable workers' compensation or claims matter, or when required by law or valid legal process. Any disclosure is limited to the purpose and information permitted by the authorization, law, process, or applicable agreement.

7.5 Small-group protection

Even reporting without names can create identification risk in a small group or highly specific category. When reporting could reasonably identify an individual, Solveglobal suppresses, combines, generalizes, or withholds the result. Recipients are prohibited from attempting to re-identify an individual from aggregated or de-identified reporting.

Providers, Care Coordination, and Health Information

When a program includes provider consultation or care coordination, Solveglobal may use and disclose information needed to arrange, support, document, and follow up on the requested service. Provider notes and recommendations may be maintained in the portal and may be subject to the provider's notice, professional obligations, record-management rules, and applicable agreements.

A request to access, correct, amend, or delete provider-related information may need to be handled by or coordinated with the provider, health plan, carrier, or other organization responsible for the record. We will explain or facilitate that process when reasonably possible.

When PHI is involved, uses and disclosures are governed by HIPAA, the applicable Business Associate Agreement, and the covered entity's instructions. When PHI is not involved, other health, employment, consumer-health-data, or general privacy laws may apply.

Email and Text Message Communications

We may use email, text messages, phone calls, and portal notices for account verification, security, check-ins, reminders, scheduling, support, program administration, and other service-related communications.

Providing a phone number does not by itself authorize promotional text messages. Where consent is required for automated calls or texts, we obtain and maintain the applicable consent before sending them. Consent to marketing is not a condition of receiving the Services. Message and data rates may apply.

We may send optional direct Solveglobal marketing communications to client representatives or individuals who request or lawfully receive them. Direct communications from Solveglobal are distinct from allowing third parties to use personal information for advertising. You may opt out of optional marketing at any time.

You may opt out of text messages by replying STOP or following the instructions in the message. You may request help by replying HELP or contacting us. We may send a final confirmation or messages required for account security, legal compliance, or an active transaction where permitted by law. Email preference links apply to optional messages and do not prevent necessary service or security communications.

Ordinary email and SMS may not be encrypted end to end. Avoid including detailed health information or other sensitive information in an email or text unless we specifically request it through an approved process. If you voluntarily include sensitive content in a message, our communication providers may process that content to transmit, store, secure, or support the communication under their applicable contracts with us.

Cookies, Analytics, and Tracking Technologies

10.1 Public website

The public website uses cookies, server logs, and similar technologies needed to operate the site, maintain security, remember preferences, measure performance, and understand general usage. We may use limited analytics providers for these purposes.

10.2 Authenticated portal

The portal uses technical data needed for authentication, security, audit, troubleshooting, and service improvement. We do not use advertising or marketing pixels in the authenticated portal and do not use portal health-related activity for third-party advertising or cross-context behavioral advertising.

10.3 Choices

You can control many cookies through browser settings and any preference tool we make available. Disabling essential cookies may prevent the website or portal from functioning. Because we do not sell personal information or share it for cross-context behavioral advertising, we do not use opt-out signals to reverse such a practice; where applicable law requires recognition of a valid opt-out preference signal, we process it as required.

10.4 Third-party content

A third-party website or service linked from the Services may use its own cookies and tracking technologies under its own notices. Solveglobal does not control tracking that occurs after you leave our Services.

Aggregated, De-Identified, and Pseudonymized Information

Aggregated information combines information about multiple people. De-identified information is processed so that it cannot reasonably be linked to an individual using methods appropriate to the applicable legal standard and context. We maintain and use de-identified information without attempting to re-identify it, except as permitted to test whether de-identification controls remain effective.

Pseudonymized, coded, or tokenized information replaces direct identifiers with another value but may still be linkable to a person. We treat pseudonymized information as personal information when it can reasonably be linked back to an individual.

We may use and disclose aggregated or de-identified information for reporting, service evaluation, analytics, risk mitigation, security, research, planning, and service improvement where permitted by law and applicable agreements. We do not describe merely access-restricted or pseudonymized information as de-identified.

Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including providing the Services, maintaining records, meeting legal and contractual obligations, supporting care or claims where applicable, resolving disputes, enforcing agreements, maintaining security, and preserving auditability.

Retention periods vary by data category and relationship. We consider the sensitivity and volume of the information, the purpose for which it was collected, the duration of the account or program, legal limitation periods, Business Associate Agreements, provider and plan obligations, security needs, backup cycles, and whether the information can be aggregated or de-identified.

For routine lifecycle management, we may delete information or convert it to aggregated or de-identified form. When we approve a legally valid deletion request, we delete the information from active systems and direct applicable processors to do the same, subject only to lawful retention exceptions and reasonable backup cycles. Restricting or archiving information is not treated as deletion unless applicable law permits continued retention.

Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, loss, or disclosure. These safeguards include access management, authentication, logging and monitoring, secure transmission and storage controls, vulnerability and incident management, workforce safeguards, vendor oversight, and continuity measures appropriate to the nature of the information and our role.

No security measure or method of transmission is completely secure. You are responsible for protecting your credentials, using a secure device and connection, and notifying us promptly if you believe your account or information has been compromised.

Your Privacy Choices and Rights

Depending on where you live, the type of information, and Solveglobal's role, you may have the right to:

• confirm whether we process your personal information and access or obtain a copy of it;
• correct inaccurate personal information;
• delete personal information, subject to lawful exceptions;
• withdraw consent or restrict or stop certain collection, use, or disclosure;
• obtain a list of certain third parties to whom information was disclosed, where required;
• opt out of sale, targeted advertising, or certain profiling, if such processing occurs;
• appeal a decision on a privacy request; and
• exercise rights without unlawful discrimination or retaliation.

To submit a request, email Privacy@Solveglobal.com or write to the address in Section 20. Please describe your request and your relationship to Solveglobal. We may request information reasonably necessary to verify your identity or authority. If another organization controls the relevant record, we may refer or coordinate the request with that organization.

We respond within the period required by applicable law. Rights may be limited by identity-verification requirements; legal, security, recordkeeping, claims, and dispute obligations; Business Associate Agreements; plan or provider responsibilities; privileges; and other lawful exceptions. If we deny a request, we will explain the basis and provide an appeal method when required.

California Privacy Notice

This section applies to California residents to the extent the California Consumer Privacy Act, as amended ("CCPA"), applies to Solveglobal and the information is not exempt. Terms such as "personal information," "sensitive personal information," "sell," and "share" have the meanings given by the CCPA.

15.1 Categories collected and disclosed in the preceding 12 months

Depending on a person's interaction with the Services, Solveglobal collected the categories below during the preceding 12 months and disclosed them for the business purposes described in this Policy. A category may not apply to every person.

15.2 Sources and purposes

The sources are those listed in Section 4. The business purposes are those listed in Sections 5 and 6, including service delivery, eligibility and account administration, communications, provider coordination, workforce-level reporting, security, compliance, support, analytics, and business operations.

15.3 Sale, sharing, and sensitive personal information

Solveglobal did not sell personal information or share personal information for cross-context behavioral advertising during the preceding 12 months. We do not have actual knowledge that we sell or share personal information of consumers under 16. We use and disclose sensitive personal information only for permitted service, security, compliance, and related purposes described in this Policy, not to infer characteristics for unrelated purposes.

15.4 California rights

Subject to verification and lawful exceptions, California residents may request to know or access personal information, correct inaccurate personal information, delete personal information, and obtain information about collection and disclosure practices. Because we do not sell personal information or share it for cross-context behavioral advertising, there is no current sale or sharing practice to opt out of. We will honor applicable opt-out preference signals as required by law.

You may exercise these rights using Section 20. An authorized agent may submit a request, but we may require proof of authority and direct identity verification where permitted. We will not unlawfully discriminate against you for exercising a CCPA right.

Consumer Health Data Notice

This section applies to consumer health data governed by an applicable state consumer health data law and not exempt under that law. For example, PHI and certain other regulated information may be exempt from a state consumer health data law and remain governed by the law that applies to that information. This section supplements the rest of this Policy.

16.1 Consumer health data collected

Depending on the Services used, we may collect consumer health data concerning physical function, musculoskeletal symptoms or risk, discomfort, limitations, workplace or ergonomic factors related to health, check-in responses, provider interactions, referrals, scheduling, recommendations, follow-up, and inferences derived from this information.

16.2 Sources and purposes

We collect consumer health data from you; sponsoring organizations, plans, carriers, administrators, or providers when legally permitted; service providers operating on our behalf; and records or inferences generated through the Services. We use it to provide requested Services, conduct check-ins, identify and address musculoskeletal risk, coordinate providers, communicate with you, administer programs, maintain security, comply with law and agreements, and create aggregated or de-identified information.

16.3 Sharing

We may share the categories described above with service providers that operate the Services; providers involved in a requested consultation or care-coordination activity; plans, carriers, administrators, or workers' compensation parties where legally permitted; professional advisors; and other parties at your direction or as required by law. Employers acting in their employment capacity receive only aggregated or de-identified workforce reporting and limited administrative information as described in Section 7.

We do not sell consumer health data. We do not permit a third party to collect consumer health data through the Services over time and across unrelated websites or online services for advertising or profiling. A linked third-party site may collect information under its own notice after you leave the Services.

16.4 Consent and processing

We collect and share consumer health data when necessary to provide a product or service you requested, with your affirmative consent where required, or as otherwise permitted by applicable law. A consent to collect is separate from a consent to share when the law requires separate consent. A sale, if ever proposed, would require a separate written authorization satisfying applicable law and an update to this Policy before the practice begins.

Consumer health data is processed electronically within the Services and systems operated by authorized service providers. Access is limited according to role and purpose. We may organize, analyze, infer from, transmit, secure, retain, delete, aggregate, or de-identify the data for the purposes described in this Policy and as permitted by applicable law.

16.5 Rights and requests

Where applicable, you may request confirmation of whether we collect, share, or sell your consumer health data; access the data; receive a list of third parties with whom it was shared; withdraw consent; stop future collection or sharing; correct the data; or delete it. A valid deletion request is propagated to applicable processors and other recipients as required by law, subject to lawful exceptions and backup cycles.

Submit a request or appeal using Section 20. If we decline to act, we will provide the reason and appeal instructions when required. If an appeal is denied, we will identify any external complaint mechanism required by applicable law.

16.6 Material changes

Before materially changing how we collect, use, or share consumer health data in a manner that requires additional consent, we will provide the required notice and obtain consent before applying the change.

Children and Minors

The public website is not directed to children under 13, and the Services are not offered directly to a child under 13 unless a specific program lawfully permits participation and Solveglobal has implemented the required parental or legal-authority verification and consent process. We do not knowingly collect personal information online from a child under 13 without legally sufficient authorization.

A participant between 13 and 17 may use the Services only when the applicable program permits it and any required consent, authorization, confidentiality, and guardian-access rules have been addressed. The availability of a dependent benefit does not by itself authorize a minor to create an account or disclose information.

If you believe a child provided information without appropriate authorization, contact us. We will investigate and delete or otherwise handle the information as required by law.

International Users and Data Transfers

The Services are primarily intended for U.S.-based programs. If you use the Services from outside the United States, your information may be processed and stored in the United States and in other locations where our service providers operate. Those jurisdictions may have different privacy laws from your location.

We do not represent that the Services are directed to the European Union, European Economic Area, United Kingdom, or another non-U.S. jurisdiction unless we expressly make them available there. If an international privacy law applies, we will provide any additional notice, legal basis, rights, or transfer mechanism required for the applicable processing.

Third-Party Websites and Services

The Services may link to or connect with providers, plans, carriers, administrators, vendors, or other third parties. A third party that collects information directly from you under its own terms is responsible for its own privacy and security practices. Review the third party's privacy notice before providing information.

A link does not mean Solveglobal controls or endorses the third party's privacy or security practices. This limitation does not reduce responsibilities Solveglobal has for a processor acting on our behalf under applicable law or agreement.

Changes and Contact Information

20.1 Changes to this Policy

We may update this Policy to reflect changes in the Services, technology, law, agreements, or privacy practices. We will revise the Last Updated date and provide additional notice or obtain consent when required. Continued use does not replace a consent or authorization required by law.

20.2 Contact us and submit requests

Questions, privacy requests, appeals, and security concerns may be sent to:

Solveglobal LLC
Attn: Privacy Administrator
PO Box 168
Spring Lake, MI 49456
Email: Privacy@Solveglobal.com

When submitting a request, provide enough information for us to understand and locate the relevant records, such as your name, contact information, relationship to Solveglobal, sponsoring organization or program, and a description of the request. Do not send account passwords, Social Security numbers, or detailed medical information by ordinary email.