ContinuoCare Privacy Policy

Effective August 2026

This Privacy Policy explains how ContinuoCare collects, uses, and protects information in connection with its technology platform and SMS outreach services. By using ContinuoCare's services or receiving communications from ContinuoCare, you agree to the practices described in this Policy.

1. Who We Are

ContinuoCare is a technology platform that enables healthcare and insurance organizations to send automated communications to their members — including Medicaid recertification reminders, renewal instructions, and deadline notifications. ContinuoCare does not independently collect or use member health information for its own purposes. All communications are conducted on behalf of and under the authority of contracted client organizations.

ContinuoCare is not a healthcare provider, health plan, or insurance company. Questions about your Medicaid coverage or healthcare services should be directed to your healthcare organization.

2. Information We Collect

2.1 — Information provided by client organizations

ContinuoCare receives member information from its contracted client organizations (such as health plans, health systems, and community organizations). This information may include:

• Contact information — phone number, email address, mailing address
• Identification information — name, date of birth, Medicaid ID (CIN)
• Eligibility information — Medicaid eligibility status, recertification deadline, plan name
• Routing information — renewal pathway (HRA or NYSOH), assigned office location
• Language preference — preferred language for communications
• Clinical flags — disability status, Health Home enrollment (used only for routing and priority scoring — not stored beyond what is needed for the outreach workflow)

This information is provided to ContinuoCare solely to enable the delivery of Medicaid navigation communications. ContinuoCare does not purchase or independently source member data.

2.2 — Information generated through platform use

When a member interacts with ContinuoCare communications, the platform may automatically collect:

• Outreach engagement data — whether an SMS was delivered, opened, or responded to; whether an IVR call was answered or went to voicemail; whether a personalized webpage link was opened
• Response data — member replies to SMS messages (such as YES, STOP, or HELP)
• Device information — device type detected when a member opens a web link (used only to optimize page rendering)
• Timestamp data — dates and times of all outreach attempts and member interactions

2.3 — What we do not collect

ContinuoCare does not collect:

• Detailed medical records, diagnoses, or treatment information
• Social Security numbers or financial account information
• Information from minors under 13
• Biometric data of any kind

3. How We Use Information

ContinuoCare uses member information for the following purposes only:

• To deliver Medicaid navigation communications — SMS messages, IVR calls, and personalized webpages containing renewal instructions, document checklists, and deadline reminders
• To personalize communications — routing members to the correct renewal pathway (HRA or NYSOH), in their preferred language, with their specific document requirements
• To track outreach outcomes — recording whether messages were delivered, whether members responded, and whether renewals were completed — for operational improvement and client reporting
• To generate closed-loop reporting — providing client organizations with aggregate and member-level completion data for their attributed member panels
• To maintain platform integrity — fraud detection, security monitoring, and system maintenance

ContinuoCare does not use member information for advertising, marketing to unrelated third parties, or any purpose other than those listed above.

4. SMS Communications and Privacy

SMS-specific privacy commitments

Phone numbers collected for SMS outreach are used solely to deliver Medicaid navigation messages. ContinuoCare does not sell, rent, transfer, or share phone numbers with third parties for any marketing or commercial purpose.

Phone numbers obtained through SMS opt-in are not shared with any third party or affiliate for purposes unrelated to the services described in this Privacy Policy.

When a member replies STOP, their number is immediately added to ContinuoCare's suppression list. No further automated messages are sent to that number.

Opt-out preferences are permanent and honored across all future outreach cycles unless the member affirmatively re-consents through their client organization.

5. How We Share Information

5.1 — With client organizations

ContinuoCare shares outreach outcomes and member engagement data with the client organization that provided the member's information. This includes: whether outreach was attempted, whether the member responded, and whether recertification was confirmed.

5.2 — With service providers

ContinuoCare works with third-party service providers to deliver its platform, including:

• SMS and voice delivery — Twilio (messaging infrastructure). Twilio processes phone numbers and message content solely to deliver communications.
• Cloud infrastructure — Microsoft Azure (hosting and data storage). Azure processes data in accordance with ContinuoCare's data processing agreements.
• Analytics — anonymized, aggregated usage data may be processed by analytics providers. No individual member data is shared for analytics purposes.

All service providers are bound by data processing agreements that prohibit them from using member data for any purpose other than delivering services to ContinuoCare.

5.3 — Legal requirements

ContinuoCare may disclose information when required by law, court order, or governmental authority, or when necessary to protect the rights, property, or safety of ContinuoCare, its clients, or the public.

5.4 — What we never do

• Sell member data to any third party
• Share phone numbers for marketing purposes unrelated to ContinuoCare's services
• Use member health information for targeted advertising
• Allow service providers to use member data for their own purposes

6. HIPAA and Health Information

ContinuoCare operates as a Business Associate under HIPAA with respect to client organizations that are Covered Entities. ContinuoCare processes Protected Health Information (PHI) only to the extent necessary to deliver the navigation services described in this Privacy Policy, and in accordance with Business Associate Agreements executed with each client organization.

Members who have questions about how their PHI is used should contact the client organization (their health plan or healthcare provider) directly. The client organization's Notice of Privacy Practices governs the use of PHI for healthcare purposes.

7. Data Retention

ContinuoCare retains member data only for as long as necessary to fulfill the purposes described in this Privacy Policy:

• Outreach records — retained for 6 years to comply with HIPAA audit requirements
• SMS opt-out records — retained indefinitely to ensure suppression preferences are permanently honored
• Active member records — retained while the client relationship is active and the member is within a recertification window
• Engagement data — retained for 2 years for operational reporting and platform improvement

Upon termination of a client agreement, member data is returned to the client organization or securely deleted within 90 days, in accordance with the applicable Business Associate Agreement.

8. Data Security

ContinuoCare implements administrative, technical, and physical safeguards to protect member information against unauthorized access, disclosure, alteration, or destruction. These include:

• Encryption — all data in transit is encrypted using TLS 1.2 or higher. Data at rest is encrypted using AES-256.
• Access controls — member data is accessible only to ContinuoCare personnel with a legitimate operational need. Role-based access controls are enforced.
• Audit logging — all access to member data is logged and monitored.
• Vendor security — all third-party service providers are required to maintain security standards equivalent to or greater than ContinuoCare's own standards.

No method of electronic transmission or storage is 100% secure. In the event of a data breach, ContinuoCare will notify affected client organizations within 24 hours and comply with all applicable breach notification requirements.

9. Your Rights

Depending on your location and applicable law, you may have the right to:

• Access — request a copy of the information ContinuoCare holds about you
• Correction — request that inaccurate information be corrected
• Deletion — request that your information be deleted, subject to legal retention requirements
• Opt-out of SMS — reply STOP to any message at any time to unsubscribe from automated communications

To exercise any of these rights, contact ContinuoCare at admin@continuocare.com or contact your client organization directly.

10. Children's Privacy

ContinuoCare's services are not directed at children under the age of 13. ContinuoCare does not knowingly collect or process information from children under 13. If you believe a child's information has been provided to ContinuoCare in error, contact us at admin@continuocare.com and we will delete it promptly.

11. Changes to This Privacy Policy

ContinuoCare may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated to affected client organizations and, where feasible, to members via SMS prior to taking effect. The effective date at the top of this document reflects the most recent revision.

12. Contact Us

If you have questions about this Privacy Policy or ContinuoCare's data practices:

• Email: admin@continuocare.com
• Website: www.continuocare.com/privacy

If you have questions about your Medicaid coverage or how your healthcare organization uses your information, contact your health plan or provider directly. For New York Medicaid questions, call 1-800-541-2831.

ContinuoCare · Privacy Policy · Effective August 2026 · www.continuocare.com/privacy