Long Health Privacy Policy

Effective Date: September 3, 2026
Last Reviewed: September 3, 2026
Version: 2.0

Long Health, Inc. (“Long Health,” “we,” “us,” or “our”) respects your privacy and is committed to protecting Personal Information entrusted to us.

This Privacy Policy describes how Long Health collects, uses, discloses, and protects Personal Information in connection with our public websites, business relationships, communications, and healthcare technology services.

Long Health also provides healthcare interoperability services and is a California-designated Qualified Health Information Organization (“QHIO”). Privacy practices specifically applicable to Long Health’s QHIO and California Data Exchange Framework (“DxF”) services are described separately in our Long Health QHIO Privacy Policy.

1. Scope

This Privacy Policy applies to Personal Information Long Health collects or processes in connection with:

• our public websites;
• inquiries submitted to Long Health;
• customers and prospective customers;
• business partners;
• vendors and contractors;
• authorized users of Long Health technology platforms;
• sales and marketing activities;
• customer support; and
• general business operations.

This Privacy Policy does not replace the Notice of Privacy Practices of a healthcare provider, health plan, or other healthcare organization.

Protected Health Information (“PHI”) and other health information that Long Health processes on behalf of healthcare organizations may also be governed by HIPAA, Business Associate Agreements, interoperability agreements, the DxF, and other applicable requirements.

2. About Long Health

Long Health provides healthcare technology, interoperability, health information exchange, clinical workflow, data integration, and related services to healthcare providers, health plans, medical groups, hospitals, clinics, laboratories, and other authorized organizations.

Long Health does not provide medical diagnosis or treatment directly to patients.

Long Health does not currently operate a general direct-to-consumer patient portal through which individuals independently access, download, amend, delete, or manage their medical records.

When Long Health processes health information on behalf of a healthcare organization, the applicable healthcare organization remains responsible for the underlying medical record and its applicable patient privacy obligations.

For additional information concerning Long Health’s QHIO and health information exchange activities, please review our QHIO Privacy Policy.

3. Personal Information We Collect

The information we collect depends upon how an individual or organization interacts with Long Health.

Business and Contact Information

We may collect:

• name;
• company or organization;
• job title;
• business email address;
• telephone number;
• mailing address;
• information submitted through contact forms;
• correspondence; and
• other information provided to us in connection with a business relationship.

Account and Authorized User Information

For individuals authorized by their organizations to use Long Health services, we may collect:

• name;
• business contact information;
• organization;
• username or account identifier;
• authentication information;
• permissions and role information;
• application activity; and
• support information.

Website and Technical Information

When someone visits our website or uses our services, we may automatically collect certain technical information, such as:

• Internet Protocol address;
• browser type;
• device type;
• operating system;
• referring website;
• pages viewed;
• date and time of access;
• approximate geographic information derived from an IP address;
• application or website activity;
• cookies or similar technology identifiers; and
• security and system logs.

Customer and Transaction Information

We may collect information relating to:

• contracts;
• subscriptions;
• invoices;
• payments;
• services purchased;
• implementation activities;
• customer support; and
• other business transactions.

Payment information may be processed by third-party payment processors and may not be stored directly by Long Health.

4. Health Information

In providing healthcare technology and interoperability services, Long Health may create, receive, maintain, or transmit PHI or other health information on behalf of healthcare organizations.

Long Health processes such information only as permitted by applicable law, contractual agreements, Business Associate Agreements, interoperability requirements, and instructions applicable to the services being provided.

Long Health does not use PHI received from healthcare customers for consumer behavioral or targeted advertising.

Long Health does not sell PHI.

For information regarding health information processed through Long Health’s California QHIO services, please review our Long Health QHIO Privacy Policy.

5. How We Use Personal Information

Long Health may use Personal Information to:

• provide and operate our services;
• establish and manage customer relationships;
• authenticate authorized users;
• respond to inquiries and support requests;
• administer contracts and billing;
• communicate with customers and business partners;
• provide product, service, administrative, and security notices;
• improve our websites, platforms, and services;
• monitor performance and troubleshoot technical issues;
• detect and prevent fraud, misuse, and cybersecurity threats;
• maintain security and audit records;
• comply with contractual obligations;
• comply with applicable legal and regulatory requirements;
• enforce our agreements;
• protect Long Health, our customers, and others; and
• carry out legitimate corporate and business operations.

Where required by applicable law, we obtain consent before using Personal Information for a purpose requiring consent.

6. How We Disclose Personal Information

Long Health may disclose Personal Information in the following circumstances.

Service Providers

We may provide information to vendors and service providers that assist us with functions such as:

• cloud infrastructure;
• website hosting;
• cybersecurity;
• communications;
• customer support;
• analytics;
• payment processing;
• accounting; and
• other business operations.

We require service providers to protect information in accordance with applicable contractual and legal requirements.

Customers and Authorized Organizations

Information relating to authorized users may be provided to the organization through which the user receives access to Long Health services.

Professional Advisors

We may disclose information to attorneys, accountants, auditors, insurers, consultants, and other professional advisors when reasonably necessary.

Legal and Regulatory Requirements

We may disclose information when required or permitted by law, regulation, subpoena, court order, or other valid legal process.

Business Transactions

Information may be transferred as part of a merger, acquisition, financing, restructuring, sale of assets, or similar business transaction, subject to applicable privacy and confidentiality requirements.

7. Cookies and Website Technologies

Long Health may use cookies and similar technologies to:

• operate our website;
• maintain website security;
• remember preferences;
• understand website usage;
• measure website performance; and
• improve website functionality.

We may use service providers to assist with website analytics and related functions.

Visitors can generally manage cookies through their browser settings. Certain website features may not function properly if cookies are disabled.

Long Health does not use PHI obtained through its healthcare interoperability services for website advertising or consumer behavioral advertising.

8. Marketing Communications

Long Health may use business contact information to communicate regarding our products, services, events, or other business matters.

Recipients may opt out of promotional emails using the unsubscribe mechanism contained in those communications or by contacting Long Health.

Opting out of marketing communications does not prevent Long Health from sending necessary transactional, customer-service, contractual, privacy, or security communications.

9. Data Security

Long Health maintains administrative, technical, and physical safeguards designed to protect Personal Information against unauthorized access, disclosure, alteration, destruction, or loss.

Depending upon the information and service involved, safeguards may include:

• encryption;
• access controls;
• authentication;
• network and endpoint security;
• audit logging;
• security monitoring;
• vulnerability management;
• workforce security controls;
• incident response;
• business continuity; and
• vendor risk management.

No electronic system can be guaranteed to eliminate every security risk.

Long Health continually evaluates and updates its security measures based upon applicable requirements and identified risks.

10. Data Retention

Long Health retains Personal Information for periods reasonably necessary to:

• provide services;
• maintain customer relationships;
• satisfy contractual requirements;
• meet legal and regulatory obligations;
• maintain required audit records;
• protect our systems;
• resolve disputes; and
• enforce agreements.

Retention periods vary depending upon the type of information and applicable legal, contractual, and operational requirements.

Health information processed on behalf of a healthcare organization may be subject to separate retention requirements.

11. Medical Records and Patient Requests

Long Health does not currently provide a general direct-to-consumer medical-record access service.

Individuals seeking:

• access to medical records;
• copies of medical records;
• correction or amendment of medical records;
• an accounting of disclosures; or
• restrictions concerning an underlying medical record

should ordinarily contact the healthcare provider, health plan, or other healthcare organization responsible for that record.

Where Long Health processes information as a Business Associate or technology provider, Long Health assists the responsible healthcare organization with applicable individual rights as required by law and applicable contractual agreements.

HIPAA generally places responsibility on the Covered Entity for fulfilling an individual’s rights of access, amendment, and accounting, including where relevant information is maintained by its Business Associate.

For requests specifically concerning information exchange through Long Health’s QHIO services, please review our QHIO Privacy Policy.

12. California Privacy Rights

California residents may have certain rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”), to the extent those laws apply to Long Health and the particular information involved.

Depending upon the circumstances, applicable rights may include the right to:

• know categories and specific pieces of Personal Information collected;
• know how Personal Information is used or disclosed;
• request correction of inaccurate Personal Information;
• request deletion of certain Personal Information;
• opt out of certain sales or sharing where applicable;
• limit certain uses of Sensitive Personal Information where applicable; and
• exercise applicable privacy rights without unlawful discrimination.

Certain information is exempt from some or all CCPA/CPRA requirements, including certain PHI and medical information subject to HIPAA and other healthcare privacy laws.

Long Health does not sell PHI.

Requests concerning Personal Information collected by Long Health for its own business purposes may be submitted to:

support@longhealth.io

Long Health may verify the identity and authority of a person submitting a privacy request before acting upon it.

Requests concerning medical records maintained by a healthcare provider, health plan, or other healthcare organization should ordinarily be directed to that organization.

13. Children’s Privacy

Long Health’s public website and business services are not directed to children for the purpose of creating consumer accounts.

Long Health may process information concerning minors when such information is provided by or processed on behalf of healthcare organizations as part of authorized healthcare services.

Such information is handled in accordance with applicable privacy laws and contractual requirements.

14. Third-Party Websites

Our website may contain links to websites or services operated by third parties.

Long Health does not control and is not responsible for the privacy practices of independent third-party websites.

We encourage visitors to review the privacy policies of third-party services before providing Personal Information to them.

15. QHIO Privacy

Long Health, Inc. is a California-designated Qualified Health Information Organization.

Long Health maintains a separate Long Health QHIO Privacy Policy that describes privacy practices applicable to Long Health’s QHIO services, California Data Exchange Framework activities, health information exchange, individual access considerations, exchange restrictions, and other QHIO privacy requirements.

QHIO Privacy Policy

The QHIO Privacy Policy is maintained and published separately for purposes of Long Health’s applicable California QHIO privacy-policy requirements.

16. Changes to This Privacy Policy

Long Health may update this Privacy Policy periodically to reflect changes in:

• our services;
• technology;
• business practices;
• applicable laws or regulations; or
• privacy and security practices.

When we make changes, we will update the Effective Date and Last Reviewed information at the beginning of this Privacy Policy.

17. Contact Us

Questions regarding this Privacy Policy or Long Health’s general privacy practices may be submitted to:

Long Health, Inc.
Privacy / Compliance

Email: contact@longhealth.io

Phone: 408-673-8215

Website: https://www.longhealth.io

Please do not send Social Security numbers, complete medical records, or other unnecessary sensitive health information through ordinary email.

Version History

Version 2.0 — September 3, 2026
Comprehensive revision to reflect Long Health’s current business-to-business healthcare technology and interoperability service model and separation of the general Privacy Policy from the Long Health QHIO Privacy Policy.