The Advisory Board Company ("Advisory Board", "we", "us", "our") provides online products and services (collectively, the “Website”) that may, among other things, provide healthcare leaders with valuable insights, strategies, and forecasting and benchmarking tools to make healthcare better.  We provide this privacy policy (“Privacy Policy”) to outline the information Advisory Board collects from users of the Website (“Users”, “you”) and how we may use and disclose this information.   It also describes the choices available to you regarding our use of your information and how you can manage and update this information.  All products and services that are governed by this Privacy Policy will include a link to and/or copy of this Privacy Policy on the home page of the applicable website.  Depending on the products and services, Advisory Board may be the data controller for the processing of your information or it may be a data processor.

Products and Services Covered by this Privacy Policy

We believe information about our products or services might help you better understand our data collection and use practices related to those products or services. 

Our products and services covered by this Privacy Policy (the “Services”) provide healthcare leaders access to research, expert consultations, events, facilitated presentations, research, implementation toolkits, along with forecasting and benchmarking tools through our Website.

Your Consent to this Privacy Policy by Using the Website

Please read this Privacy Policy carefully.  As described in this Privacy Policy, we may use and disclose your information to provide you with products and services and to improve your experience using those products and services.  By using the Website, or any other website, online service or mobile application where this Privacy Policy is posted, you agree to our collection, use, disclosure, and storage of information as described in this Privacy Policy.

We will not sell your information to third parties, including data brokers or marketers, without obtaining a separate consent from you to do so.  Unless you provide consent, we do not allow third parties to advertise to Users on the Website. 

How to Contact Us with Questions about this Privacy Policy

By following the instructions below, you may request clarification about our Privacy Policy, complain about our Personal Data processing practices, make a request to exercise rights in the Personal Data that concerns you, and/or request a copy of our contractual clauses designed to protect Personal Data if applicable.

We want you to have a clear understanding of the information addressed by this Privacy Policy. We will collect information about you in a variety of ways, including directly from you, through automatic means, or from third parties.  The information that is collected depends on how you use the Website.

Information You Provide Directly to Advisory Board

When you use the Website, you may provide certain information directly to us including where you use the Website to direct and authorize us to obtain information about you from other sources. 

For example, without limitation, when you use the Services, you may choose to provide us with information about yourself in connection with registration for the Website as well as there are certain services you will only be able to access by registering with us and providing the information described below.  In order to create or reconfigure an account, you will be expected to provide certain information, including your name, personal contact details (location and email address), When you create an account on the Website, your account information will include your email address, and your account will be protected by a password of your choosing.

If you give us information on behalf of someone else, you should only do so if the other person has appointed you to act on his or her behalf and has agreed that you can: give consent on his or her behalf to the processing of his or her personal data; receive on his or her behalf any data protection notices; give consent to the transfer of his or her personal data abroad; and give consent to the processing of his or her sensitive personal data, such as health information.  We may request verification of the third party’s consent in these cases.

Your Advisory Board User Name

When you register to use the Services, Advisory Board requires that your username is your email address.  

Your Profile

Each registered User of the Services has a profile page that displays your User name and additional details such as your place of work, phone number, department and role if you have chosen to provide us with this information.

Exchange of Direct Messages with Resources Such as Coaches and Posting Comments (Within the Website)

As part of the Services, Advisory Board may allow Users to: (i) send direct messages on the Website to resources; and (ii) receive direct messages on the Website from resources. To the extent that you include information, such as health information, in your private messages, you understand that such information will be viewable by the recipients of your messages.

Information We Collect from Third Parties

Advisory Board enters into business relationships with business partners including: healthcare providers and/or networks of healthcare providers ("Providers"), health plans or health insurers, including, without limitation, employer-sponsored health plans ("Health Insurers"), and companies that contract with Providers, Health Insurers, and/or Advisory Board ("Contractors") to make available Advisory Board’s products and services. Advisory Board’s business partners such as Providers, Health Insurers, and Contractors are collectively referred to in this Privacy Policy as "Advisory Board Partners." When you use the Website, we may collect information about you, directly or indirectly, from or through applicable Advisory Board Partners. With your consent, we may also collect information from other third parties.

Information that is Automatically Collected

We may use automated means to collect information about you, your computer or other device that you used to access the Website, and your use of the Website.  These automated means include common technologies such as cookies or similar technologies.  These technologies help us to administer the Services, track Users’ interactions with the Services, gather demographic information about our user base as a whole, and otherwise provide you with relevant content.  We collect information from and about the devices you use to access the Services. This includes information such as Internet Protocol (“IP”) addresses, the type of browser and device you use, the region and language settings on your device, and identifiers associated with your devices. Where you have given consent, your devices, depending on their settings, may also transmit location information to us, to enable you to receive more relevant information from third party service providers and vendors acting on our behalf where you have agreed to receive such information.

We will also automatically collect, review and store information about your interactions with the Services, such as page response times, page interaction information (such as scrolling, clicks, and mouse-overs), technical data (including crash reports), and the web page you visited before coming to our website or go to after our website.  

Cookies and Tokens

Cookies are files that websites send to your computer or other Internet-connected device to uniquely identify your browser or to store information or settings on your device. Our Website may use session cookies to better understand how you interact with our services, to monitor aggregate usage by Users and to improve our services.  Your browser may tell you how to be notified when you receive certain types of cookies and how to restrict or disable certain cookies. You also may be able to delete your Flash cookies or adjust your Flash cookie settings by visiting the Adobe Flash Website Storage Settings Manager. Please note, however, that without cookies you may not be able to use all of the features of our Website.

Our cookies, tokens and similar technologies (collectively, "Tracking Technologies") also are used for administering the Website, including without limitation, for authentication, to remember Users’ settings, to customize the content and layout of the Website for Users, to contact you about the Website, and to improve our internal operations, the content of our Website and our services. Users may be able to control the use of, or reject or disable, some Tracking Technologies at the individual browser level.  If you reject or disable Tracking Technologies, you may still use our Website, but your ability to use some features or areas of the Website may be limited. We use Tracking Technologies to identify your device and keep track of your Internet session with our Website.  Using these Tracking Technologies, we may automatically end your session on our Website after a period of inactivity (as determined by us in our sole discretion).  We also use Tracking Technologies that allow us to recognize your device when you return to the Website within a certain period of time (as determined by us in our sole discretion) and automatically log you back into your account with us. UNLESS YOU AFFIRMATIVELY LOG OUT of your account PRIOR TO YOUR SESSION ENDING (whether by you or by us), YOU WILL BE AUTOMATICALLY LOGGED BACK IN THE NEXT TIME YOU OR ANY USER OF YOUR DEVICE VISITS OUR SITE within the period of time determined by us. If you do not wish to be automatically logged back in when you (or someone using your device) next initiate a session with our Website (using the same device that is being used for your current session), you should log out of your account (i) prior to ending your session, or (ii) if you will be inactive on our Website for more than a few minutes.

Web Logs

In conjunction with the gathering of data through cookies and in order to determine errors, Web servers may log records such as your device type, operating system type, device advertising identifier, browser type, domain, and other system settings, as well as the language your system uses and the country and time zone where your device is located. The Web server logs also may record the address of the Web page that referred you to our Website, the IP address (and associated city and state or province for the IP address) of the device you use to connect to the Internet, and data about your interaction with our Website, such as which pages you visit.

Online Analytics

We may use third-party web analytics services on our Website, such as those of Adobe Analytics and Google Analytics. These service providers use the sort of technology described in this “Information that is Automatically Collected” section to help us analyze how Users use the Website, including by noting the third-party Web site from which Users arrive. The information (including your IP address) collected by the technology will be disclosed to or collected directly by these service providers, who use the information to evaluate your use of the Website. To prevent Adobe Analytics and Google Analytics from using your information for analytics, you may visit their Opt-Out pages by clicking here.

Additional Technologies on Advisory.com and Other Websites

Our corporate and other websites such as Advisory.com may contain additional technologies such as those described here. Advisory.com includes social media features, such as the Facebook button, Twitter widget, and other third party mini programs or services that run on the website. These features may collect your Internet Protocol address, which page you are visiting on the Advisory.com website, and may set a cookie to enable the feature to function properly.   When you engage with our content on or through social media services or other third party platforms, plug-ins, integrations or applications, you may allow us to have access to certain information in your profile on those services, platforms, plug-ins, integrations or applications. For a description on how social media services and other third party platforms, plug-ins, integrations or applications handle your information, please refer to their respective privacy policies and terms of use, which may permit you to modify your privacy settings.

On Advisory.com and other websites, we may also allow third party service providers to use cookies and other technologies to collect information and to track browsing activity over time and across third party websites such as web browsers used to read our Website, which websites are referring traffic or linking to the websites, and to deliver targeted advertisements to you on third party websites. We do not control these third party technologies and their use is governed by the privacy policies of third parties using such technologies. For more information about third party advertising networks and similar entities that use these technologies, see http://www.aboutads.info/consumers, and to opt-out of such ad networks’ and services’ advertising practices, go to www.aboutads.info/choices and www.networkadvertising.org/choices. Once you click the link, you may choose to opt-out of such advertising from all participating advertising companies or only advertising provided by specific advertising companies. We do not control these opt-out choices.

Mobile Application Technologies

When using mobile applications, information may be stored and processed temporarily on your mobile device.  By accessing mobile applications operated by Advisory Board to provide the Services, you agree to the transfer and temporary storage of information.  Our mobile applications may collect information specific to use of your mobile device, such as unique device identifier and, with your consent, precise geolocation information, motion coprocessor data (e.g., recording information such as steps, distance, and elevation), accelerometer data (showing whether you're stationary or moving), and gyroscope data. 

We obtain location data from your device to provide location-related services, e.g., tracking workouts and reporting services, via the mobile application.  We do not store information about your location after the service is performed or share your location data with third-parties. You can withdraw consent to use precise, real-time or network location data at any time by turning off the location-based feature on your mobile device or by not using any location-based features. If you withdraw consent, functionality associated with precise, real-time or network location, e.g., navigation, will no longer work.

Use and Storage of Information to Provide You with the Website and Related Services

Advisory Board, and any third party vendors acting on Advisory Board’s behalf, may use and store your information to perform activities associated with providing you with the Website and Services such as: (i) registering you to use the Website and otherwise logging you into the Website, including the authentication of your identity, where applicable, and otherwise enabling your access to the Website; (ii) resolving disputes and/or troubleshooting problems; (iii) verifying your compliance with your obligations in our Terms of Service or other Advisory Board policies; (iv) improving the quality of the Website, (v) fulfilling any request you make; (vi) communicating with you; (vii) connecting you with and providing you with information about services, , resources or programs to which you may have access; (viii) providing you with Website content, including, without limitation, generating recommendations (such as recommended Website activities), and processing your preferences and requests; (ix) analyzing, customizing, and personalizing the Website, including through the delivery of tailored content and communications; ; and (x) otherwise as directed by you or provided for herein. Except where prohibited by law, and only to the extent permitted by Advisory Board’s agreements with applicable Advisory Board Partners, we may also use your information in connection with any other services we make available to you.

Advisory Board’s legal basis to process your information includes processing that is necessary for Advisory Board’s legitimate interests, including those described above, to carry out the functions necessary to provide you with the Website and the Services.  It is also based on your consent, which may subsequently be withdrawn at any time by contacting us at information_governance@optum.com if you are outside of the United States, without affecting the lawfulness of processing based on consent before its withdrawal.

Automated Decision Making

We use automated decision-making technologies to support our data processing activities. Our automated decision-making capabilities include logic that gives information to our Users based on User inputted responses.  By using this logic, it helps us create a more personalized experience. This means for our Users that you receive information that is more relevant to you.  Logic/decisions that are made by the system to give information to the user based on user-inputted responses.  This logic creates a more personalized experience based on inputs from the user and more relevant information is presented to the user as a result. It is based on data entered by the user, manually or by automatic tracking, the system triggers different messages, questions and hints from time to time.  What messages are triggered at what time is described as platform content and content logic such as events, conditions, importance or cool-downs.

Additional Information Regarding Use of Information for Communications with You

Advisory Board, Advisory Board Partners, and any third party vendors acting on Advisory Board's behalf, may also use your information to communicate with you (including, without limitation via email) about the Website and/or our products and Services (and related features and functionality) or those of any Advisory Board Partner that is providing services to you.  Our communications to you will include, without limitation, contacting you at the email address(es) that you use to register for our Website to communicate with you regarding the Website and actions that you take in connection with the Website and/or the Services, including, without limitation, sending motivational emails and reminders.

Your Choices Regarding Our Communications with You

In accordance with applicable law, we will offer you the opportunity to opt-in or opt-out of certain communications, such as, for example, communications that deal with any of our products or services you are not using but that we think might be of interest to you. Where applicable, you can opt-out by following the unsubscribe instructions included in Advisory Board emails, or accessing the email settings in your settings page on the Website. However, even if you opt out of such communications, you may continue to receive other transactional, relationship, and/or administrative communications from or through Advisory Board that are important or related to your Advisory Board account or the products and services you are using (such as, for example, a notice that there has been a change in one of your services or a change to this Privacy Policy). Please also note that you, not Advisory Board, have control over certain settings for how communications such as emails and push notifications are displayed on your devices, and the settings you select will affect how Advisory Board’s communications are displayed.

Creation and Use of Combined Data, De-Identified Data, and Aggregated Data

As permitted by law and by Advisory Board’s agreements with applicable Advisory Board Partners, Advisory Board, and any third party vendors acting on Advisory Board’s behalf, may aggregate and/or de-identify your information (meaning you are no longer identifiable from it), and/or with your consent combine your information with other information maintained or available to Advisory Board, and use or disclose such information as follows:

• We may disclose de-identified data, in anonymized form, for academic and statistical purposes.
• We may use aggregated or combined data to communicate with you about the Website and/or our products and services and disclose such aggregated or combined data to Advisory Board Partners in connection with providing the Website.
• We may also use and disclose de-identified data, de-identified aggregated data, and/or de-identified combined data for any business purpose, which may include, without limitation, improving our products and services, conducting analytics such as evaluating our Website and developing additional benefits, programs, and services, and disclosing to Advisory Board Partners for analytics purposes.

Retention of Data

Your information will be retained only for so long as reasonably necessary for the purposes set out above, in accordance with applicable laws.  This is subject to our retention of information where necessary (a) in connection with any legal proceedings (including prospective legal proceedings), obtaining legal advice or otherwise establishing exercising or defending legal rights; and (b) for medical purposes undertaken by a health professional or any person who in the circumstances is subject to an equivalent duty of confidentiality.

We may share your information in the following circumstances:

Disclosures to Service Providers and Advisory Board Partners

Advisory Board, and third party vendors acting on our behalf, may disclose your information to Advisory Board Partners, third party service providers, or vendors acting on our behalf for the purpose of providing the Website and related services to you or other Users, including, without limitation, registering you to use the Website (e.g., authenticating your identity), logging you into the Website, providing you with information you have requested through the Website or related services, , providing customer service, and connecting you with resources and other services.  Third party service providers or vendors acting on our behalf are authorized to use your information only in connection with providing these services to us or as required by law.

Additional Disclosures with Your Consent

With your consent, we may share your information with third parties or allow them to collect information from the Website in some ways not specifically described in this Privacy Policy. 

Safety, Security and Compliance with Law

Your information and the contents of your communications through the Website may be disclosed to third parties as required by applicable law where Advisory Board or third party vendors operating on our behalf are located, such as to comply with a subpoena or similar legal process, or when we reasonably believe disclosure is necessary to: protect our rights; enforce the Terms of Use (including investigations of a potential violation thereof); protect your safety or the safety of others; detect, prevent or investigate fraud; report improper or unlawful activity; respond to User support requests; or respond to a government request.

Subsidiaries and Affiliated Companies

Except where prohibited by law or precluded by contract, we may share your information with any subsidiaries or other affiliated companies under common control with Advisory Board for the purposes set out in this Privacy Policy.

Sale, Merger or Similar Transaction

We may share your information in connection with any merger, reorganization, a sale of some or all our assets, a financing or acquisition of all or a portion of our business by another company, or to a receiver, trustee or successor in interest in bankruptcy, in which case such company may continue to process your information as set forth in this Privacy Policy (except where prohibited by law).

Uses and Disclosures as Required or Permitted by Law, Including Research, Health Care Operations, and Public Health

To the extent not prohibited by law or precluded by Advisory Board’s agreements with the applicable Advisory Board Partner, Advisory Board, and any third party vendors acting on Advisory Board’s behalf, may use and disclose your information: (a) as required or permitted by law; (b) for Research purposes; (c) for purposes of health care operations of the applicable Advisory Board Partner; and (d) for Public Health, as each is defined and in accordance with applicable law

We Do Not Control the Privacy Policies of Third Parties

Our Website may contain links that enable you to visit or use other third party websites, resources or programs that are not operated by Advisory Board.  We do not have control over the other websites, resources, or programs that you choose to visit, and this Privacy Policy does not apply to information collected or that you provide while visiting such other websites, resources, or programs.  Connecting to or otherwise accessing such other websites, resources, or programs is at your own risk.  You should refer to the privacy policies, if any, applicable to the other websites, resources, or programs.

The security of your information is important to us. We follow security standards to protect the information submitted to us, both during transmission and once we receive it. These safeguards vary based on the sensitivity of the information that we collect, process and store and the current state of technology.  For example, we restrict access to information to those Advisory Board employees or third party vendors who needs access to such information in order to provide the Services.  We maintain appropriate physical, electronic and procedural safeguards to protect your information, including firewalls, individual passwords and encryption and authentication technology, and take all other necessary and adequate administrative, organizational, technical, personnel and physical measures to safeguard the same against unauthorized or unlawful processing and use, accidental loss or destruction or damage, theft, disclosure or modification and to ensure its integrity.  Please note that Advisory Board uses encryption software that may be subject to export control regulations.

No method of transmission over the Internet, or method of electronic storage, is 100% secure, however. Therefore, we cannot guarantee its absolute security.  When disclosing any information via an open network, such as the Internet or email, you should consider that it is potentially accessible to others.  If you have any questions about security on our Website, you can contact us as specified in the “How to Contact Us” section of this Privacy Policy.

Be Sure to Log Off When Using Public or Third Party Computers

As described above, we use Tracking Technologies that automatically log you back into your account with us unless you affirmatively log out of your account prior to your session ending (whether you end your session or we end your session, for example if our Website has "timed out" – i.e. we have ended your session automatically after a period of inactivity as determined by us in our sole discretion).  If you log into the Website using a public computer or device, or a computer or device of that belongs to or is shared with another person, you should affirmatively log out of your account.  Otherwise, the next user of that computer or device may be able to access your account and your information in your account if your session has not ended.

Your Use of Persistent Login

If you choose to use a persistent log-in in your account, for example, by having your browser remember your user email address and/or password, others may be able to access information through your device. If you are concerned about the unauthorized use or disclosure of information via persistent login, you should elect to not use the persistent log-in feature. 

Transfer of Information

The Website, and your information, is hosted in the United States.  By using the Website, you consent to your information being transferred to our facilities and to the facilities of those third parties with whom we share it as described in our Privacy Policy. If you are using the Website from within the European Economic Area, please be aware that your information may be transferred to the United States in order to process customer service inquiries. We implement measures such as standard data protection contractual clauses to ensure that any transferred information remains protected and secure. A copy of these clauses can be obtained by contacting us as specified in the “How to Contact Us” section of this Privacy Policy.

Users are entitled, in accordance with applicable law, to object to or request restriction of processing of their personal data, and to request access to, rectification, erasure and portability of their own information.  Requests should be submitted by contacting us as specified in the “How to Contact Us” section of this Privacy Policy.   We will respond to your request within a reasonable timeframe under the circumstances of your request, and in any case in accordance with legal requirements. 

As well as using the contact details above, you may update and/or delete certain information by logging into the Website and updating your account.  Please remember, however, if we have already disclosed some of this information to third parties, we cannot access that information any longer and cannot force the deletion or modification of any such information by the parties to whom we have made those disclosures.  Additionally, if you modify certain information on our Website that we received from a third party, we reserve the right, but are not obligated, to share the updated information back to that third party. As a result, you will need to provide updated information to those third parties if you want to be sure they have your updates. Certain information is necessary in order for us to provide the Website and the Services; therefore, if you delete such necessary information you will not be able to use the Website or receive the Services.

If you wish to have your account deactivated, you may contact us as specified in the “How to Contact Us” section of this Privacy Policy, or follow the instructions on the Website.  After we receive your request, within a reasonable timeframe under the circumstances of your request, we will deactivate your account.  For up to 30 days it will be possible to recover your account if it was deactivated by mistake.  After 30 days, we begin the process of deleting your account permanently from our systems and your account may become non-recoverable.  You acknowledge that any content downloaded by you on the Website cannot be recovered after the deletion of your account.  Please note, however, that: 1) Advisory Board (and our third party vendors acting on our behalf), our Advisory Board Partners, and any other applicable third parties may continue to use and share for any purpose de-identified data and aggregated or combined data developed using your information that has been de-identified and 2) Advisory Board may continue to use information in your deactivated account for compliance with applicable regulations.  Also, please note that even though you may deactivate your account or request the deletion of your information, we may be required (by law or otherwise, such as to prevent fraud, resolve disputes, or troubleshoot problems) to retain this information, in which case we will comply with your deletion request only after we have fulfilled such requirements.  We may also keep a copy of your information to protect our legal rights, such as in connection with your use of the Website or your agreement to our Terms of Use, as permitted or required by applicable law.

We hope that we can answer any questions you have about this Privacy Policy and our collection and processing of your personal information. However, if you consider that Advisory Board’s processing of your information infringes applicable law, you have the right to lodge a complaint with your national supervisory authority responsible for ensuring the protection of personal data.

Children

The Website is not directed to children under the age of 16, and children under the age of 16 years of age are not eligible to use our Website. Protecting the privacy of children is very important to us. We do not collect information from people we actually know are under 16 years of age, and no part of our Website is designed to attract people under 16 years of age. If we later learn that an individual has provided us with their information and they are under 16 years of age, we will take steps to remove that User's information from our databases and to prevent the User from utilizing the Website.

From time to time, we may update this Privacy Policy to reflect changes to our information practices. If we make changes to this Privacy Policy, they will be reflected in an updated Privacy Policy that will be posted on the Website, and all changes will be effective upon such posting or upon any later date specified by us in writing.  We encourage you to periodically review this page for the latest information on our privacy practices. You can determine when this Privacy Policy was last revised by referring to the "Effective Date" legend at the top of this Privacy Policy. By continuing to use the Website or any services following the effective date of any updated Privacy Policy, you are agreeing to be bound by the terms and conditions of such updated Privacy Policy.

Effective Date: December 14, 2023.