Effective date: September 13, 2023
We encourage you to read this document to understand the terms, policies, and more that apply to you when you use our websites, products, or services, including how we process your personal information and how you can update and manage that information.
Milu Health, Inc. (“Milu Health”, “Company”, “we”, “us”, or “our”) operates the website located at miluhealth.com and other websites, products, services, and mobile applications with links to this Terms of Service (“Terms”), including without limitation secure applications and internal tools (collectively, the “Sites” or “Websites”, unless otherwise specified). Users of the Sites or Services are referred below as “Users”, “Members”, “you”, “your”, or “yours”.
Please note that Users in different regions may be subject to different data protection laws, regulations, and standards. As such, this document has a section dedicated to California consumers, as well as a section dedicated to consumers subject to European Union jurisdiction.
What information do we collect from users and how is it used?
The following describes the types of personal and other information Milu Health may collect about you, and how we may use and maintain that information, including, but not limited to:
Eligibility, claims, medical history, and other Employer data. If you are eligible for our Services through your employer, Plan, or labor union (collectively, your “Employer”), your Employer may provide to us directly or via a third-party data required to verify your eligibility, to allow us to communicate with you, and to understand your health. This information may include your name, email address, phone number, Service eligibility data, carrier membership data, biometric data, medical history and claims data, and information used to verify your identity (such as birthday, partial social security number, and/or employee ID number).
Registration. Before you can utilize certain services that we offer on the Sites or otherwise, we may ask that you register with the Sites and provide us with your email address, a password, your first and last name and other contact information and personal details. We request this information for identification purposes, to communicate with you regarding your account, and to facilitate the functioning of certain services.
Forms. To fully utilize the services we offer, you may be required to fill out forms that will contain personal information such as your name, address, telephone number, social security number, account information, employment, health status and other personal information relevant to your health insurance coverage, diagnosis and treatment.
Surveys. At various points in your Member experience with us, you may be presented with optional surveys intended to measure your Service experience in some way.
Medical Records. To support the cost savings identification and medical bill negotiation processes that we run to try to save you money on your healthcare costs or notify you about benefits which may help to you, you may be required to provide us with past and current medical records, description of symptoms, a medical history and life-style descriptions.
Correspondence. If you correspond with us, including postal, email, in-app chat or messaging, phone, or video, we may retain those records.
Technical information and usage information. Like many other websites, we collect information about users’ devices (such as browser and device types, device identification numbers, or other online identifiers) and users’ utilization and navigation of our Sites. This information helps us to design our Sites to better suit our users’ needs. For example, our Sites will track the URL that you visited before you came to our Sites, the URL to which you next go and your Internet Protocol (IP) address. We use your IP address to help diagnose problems with our server and to administer our Sites. Your IP address also is used to help identify you and to gather broad demographic information.
To whom does Milu Health disclose information about you that we collect?
Milu Health will not share, rent, sell or otherwise disclose any of the personally identifiable information that we collect about you, except when we have your permission or in any of the following situations:
If you have requested a Service, we may use information about you to fulfill such requests (including providing that information to third parties). We may also at any time review your case, your medical records from prior to and after your interaction with the Sites, and any records created as a result of Services received. We may share information about you, your care, and your use of Services to your healthcare payor, or as necessary to implement plan designs described to you in your applicable Plan documentation, or on your request. If your Plan provides incentives for utilization of services, we will share information required to implement such incentives. If your Plan identifies and analyzes cost savings opportunities, we will share information required to support such initiatives. We may request courtesy notices from your treating physician(s) and/or request additional medical records from them, including records pertaining to care you received after receiving the services. We may review these records for, among other purposes, reviewing the quality of service you received, reviewing the quality of service provided by the physicians and medical professionals treating you (including the physicians and medical professionals to whom you may have received a referral), to better understand the course of treatment for your condition(s) including information regarding outcomes and costs, and to improve treatments and recommendations for people with similar or different conditions. We will take care to minimize personally identifying information in this process. We may also use anonymous information gathered, including information from your medical records, to generate conclusions about the healthcare process, particular conditions, and other matters. We and our affiliated physicians and researchers may publish this anonymous information in journals, websites and other locations. However, we will not publish your name or any identifying information about you without your permission; we will use only anonymous data for any public purpose.
We may disclose information that we collect about you to our third-party contractors who perform services for us in order to provide certain services or to complete or confirm a transaction that you conduct with us.
We may use information we know about you to contact you to inform you about relevant services, including by telephone, text message, email, or direct mail.
We may disclose the results of anonymized aggregated data about you for marketing or promotional purposes (for instance, that a certain percentage of our Sites’ users are living in a particular state of the United States). In these situations, we do not disclose to these entities any information that could be used to personally identify you. Certain information, such as your password, is not disclosed to marketing advertisers at all, even in aggregate form.
We may disclose information about you for purposes such as to provide services available on the Sites; to coordinate with insurance, reinsurance and excess or stop loss insurers; to enforce our Members’ rights; to protect against actual or potential fraud; to resolve Member inquiries or disputes; to receive payments; to carry out our business; to protect the confidentiality or security of our records; to administer preventive health and case management programs; to perform auditing and ratemaking functions; to enable our service providers to perform marketing services on our behalf and inform Users about our own products or services; to comply with federal or state laws and other applicable legal requirements.
We may disclose your information, to the extent permitted by law, in court or in the stages leading to possible legal action arising from improper use of this website, application or services, or due to a dispute you initiate in connection with the related services.
Moreover, we may be legally obligated to disclose information about you to the government or to third parties under certain circumstances, such as in connection with illegal activity on our Sites or to respond to a subpoena, court order or other legal process. We reserve the right to release information that we collect to law enforcement or other government officials, as we, in our sole and absolute discretion, deem necessary, appropriate or as required under law, such as your statement to hurt yourself or others.
If you use our Sites or Services outside of the United States, information that we collect about you will be transferred to servers inside the United States, which may involve the transfer of information out of countries located in the European Economic Area. By allowing us to collect information about you, you consent to such transfer and processing of your data.
Your Rights Under HIPAA Regarding Protected Health Information
You have certain rights regarding your protected health information under HIPAA that may be available to you. For official notice concerning these rights, you should refer to your Plan’s Notice of Privacy Practices.
To exercise these rights, you may contact your Plan at the contact information listed in your Plan’s Notice of Privacy Practices or follow the instructions below under “How to exercise your privacy rights”. Where applicable, we will respond to your request in accordance with the business associate agreement we have with your Plan. In the event of any inconsistency between the below summary, and your Plan’s Notice of Privacy Practices, we will follow your Plan’s Notice of Privacy Practices as applicable, unless we are otherwise instructed by your Plan, subject to a relevant business associate agreement.
What security measures do the Sites employ?
To help protect the privacy of data you transmit through the Sites, where personally identifiable information is requested, Milu Health also uses technology designed to encrypt the information that you input before it is sent to us using Secure Sockets Layer (SSL) technology or similar encryption technology. In addition, we take steps to protect the user data we collect against unauthorized access. However, you should keep in mind that the Sites and our services are run on software, hardware and networks, any component of which may, from time to time, require maintenance or experience problems or breaches of security beyond our control.
How can you correct or update information that we collect about you?
You may correct or update information collected about you by managing your account profile, contacting us via the contact information below, or submitting a privacy request as laid out below under “How to exercise your privacy rights”. We will respond in accordance with our agreements and legal requirements. If necessary, we may retain original and updated information for reasons such as technical constraints, dispute resolution, troubleshooting and agreement enforcement.
What are the policies of linked Sites and other third parties?
Milu Health’s Sites are owned and operated by Milu Health. Our Sites are continually under development and changes to the Sites or Services may be made at any time. We reserve the right to revise or remove any part of this Policy in our sole discretion at any time and without prior notice to you, unless where legally required. Thus, you should visit this page periodically for changes. Any changes to this Policy are effective upon posting to the Sites, unless otherwise specified. If you disagree with this Policy, your sole remedy is to discontinue your use of the Sites and Services. Your continued use after a change has been posted constitutes your acceptance of the changes.
What is our policy on children users of our Sites?
If you are a parent or guardian and discover that your child under the age of 13, or equivalent minimum age depending on jurisdiction, has obtained an Milu Health account, then you may alert us using the contact information below under “Contact Us” and request that we delete that child’s personal information from our systems. If we learn that we have collected the personal information of a child under 13, or equivalent minimum age depending on jurisdiction, outside the above circumstances we will take steps to delete the information as soon as possible, except where prohibited by applicable law.
We do collect from employers information regarding Members of all ages, so that we may know who is eligible to receive Services. A parent/guardian may request that we stop processing that information if eligible under CCPA or GDPR, as further described below, however you should contact your Employer if you would like that information no longer provided to health carriers.
What law governs my use of the Sites and Milu Health’s services?
Additional Information About This Privacy Statement
Information about Particular Services
Please note that the descriptions below concerning particular services may not apply to all services, sites, or mobile applications provided by Milu Health.
The services contained in this section enable us to monitor and analyze web traffic and can be used to keep track of User behavior.
Google Analytics (Google Inc.)
Google Analytics is a web analysis service provided by Google Inc. (“Google”). Google utilizes the Data collected to track and examine the use of this Application, to prepare reports on its activities and share them with other Google services.
Google may use the Data collected to contextualize and personalize the ads of its own advertising network.
Personal Data collected: Cookies and Usage data.
Display Advertising extension for Google Analytics (Google Inc.)
Google Analytics on this Application might use Google’s Interest-based advertising, 3rd-party audience data and information from the DoubleClick Cookie to extend analytics with demographics, interests and ads interaction data.
Personal Data collected: Cookies and Usage data.
Analytics collected directly (This Website)
This Website uses an internal analytics system that does not involve third parties.
Personal Data collected: Cookies and Usage Data.
Google Tag Manager (Google Inc.)
Google Tag Manager is an analytics service provided by Google Inc.
Personal Data collected: Cookies and Usage data.
LinkedIn conversion tracking (LinkedIn Corporation)
LinkedIn conversion tracking is an analytics service provided by LinkedIn Corporation that connects data from the LinkedIn advertising network with actions performed on this Website.
Personal Data collected: Cookies and Usage Data, Tracking Pixel.
Content commenting services allow Users to make and publish their comments on the contents of this Website.
Depending on the settings chosen by Milu Health, Users may also leave anonymous comments. If there is an email address among the Personal Data provided by the User, it may be used to send notifications of comments on the same content. Users are responsible for the content of their own comments.
If a content commenting service provided by third parties is installed, it may still collect web traffic data for the pages where the comment service is installed, even when Users do not use the content commenting service.
Displaying content from external platforms
This type of service allows you to view content hosted on external platforms directly from the pages of this Website and interact with them.
This type of service might still collect web traffic data for the pages where the service is installed, even when Users do not use it.
This type of service allows this Website to monitor the use and behavior of its components so its performance, operation, maintenance and troubleshooting can be improved.
Which Personal Data are processed depends on the characteristics and mode of implementation of these services, whose function is to filter the activities of this Website.
Managing contacts and sending messages
This type of service makes it possible to manage a database of email contacts, phone contacts or any other contact information to communicate with the User.
These services may also collect data concerning the date and time when the message was viewed by the User, as well as when the User interacted with it, such as by clicking on links included in the message.
Marketo Email Marketing (Marketo, Inc.)
Marketo Email Marketing is an email address management and message sending service provided by Marketo, Inc.
Personal Data collected: email address and Usage data.
Interaction with external social networks and platforms
This type of service allows interaction with social networks or other external platforms directly from the pages of this Application.
The interaction and information obtained through this Application are always subject to the User’s privacy settings for each social network.
This type of service might still collect traffic data for the pages where the service is installed, even when Users do not use it.
Remarketing and Behavioral Targeting
This type of service allows this Application and its partners to inform, optimize and serve advertising based on past use of this Application by the User.
This activity is performed by tracking Usage Data and by using Cookies, information that is transferred to the partners that manage the remarketing and behavioral targeting activity.
Remarketing through Google Analytics for Display Advertising (Google Inc.)
Google Analytics for Display Advertising is a Remarketing and Behavioral
Targeting service provided by Google Inc. that connects the tracking activity performed by Google Analytics and its Cookies with the Adwords advertising network and the Doubleclick Cookie.
Personal Data collected: Cookies and Usage data.
LinkedIn Website Retargeting (LinkedIn Corporation)
LinkedIn Website Retargeting is a remarketing and behavioral targeting service provided by LinkedIn Corporation that connects the activity of this Website with the LinkedIn advertising network.
Personal Data collected: Cookies and Usage Data.
User database management
This type of services allows Milu Health to build user profiles by starting from an email address, a personal name, or other information that the User provides to this Application, as well as to track User activities through analytics features. This Personal Data may also be matched with publicly available information about the User (such as social networks’ profiles) and used to build private profiles that Milu Health can display and use for improving this Application.
Some of these services may also enable the sending of timed messages to the User, such as emails based on specific actions performed on this Application.
Marketo Lead Generation (Marketo, Inc.)
Marketo Lead Generation is a User database management service provided by Marketo, Inc.
Heat mapping and session recording
Heat Mapping services are used to display the areas of a page where Users most frequently move the mouse or click. This shows where the points of interest are. These services make it possible to monitor and analyze web traffic and keep track of User behavior.
Some of these services may record sessions and make them available for later visual playback.
Contacting the User
Contact form (this Website)
By filling in any contact form with their Data, the User authorizes this Website to use these details to reply to requests for information, quotes or any other kind of request as indicated by the form’s header.
Personal Data collected: various types of Data.
System logs and maintenance
For operation and maintenance purposes, this Website and any third-party services may collect files that record interaction with this Website (System logs) use other Personal Data (such as the IP Address) for this purpose. Logging data may be collected in order to assist with troubleshooting crashes and other issues.
A web beacon (also referred to as clear gif, pixel tag or single-pixel gif) is a transparent graphic image used in tandem with cookies that enables us to record a user’s actions.
Milu Health may use web beacons to count users who have visited certain pages, verify system and server integrity and for similar statistical measures. Milu Health may also use pixel tags in HTML-based emails sent to its users to track which emails are opened by recipients.
Milu Health retains personal information, subject to this Policy, only for as long as necessary for the purposes for which the data was collected and processed.
Data collected for the provision of Services is retained for the longer of as needed to provide Services; as specified in a relevant agreement (e.g., with your Plan); or as otherwise required, including by applicable law or regulation.
Additional Information for EU / EEC Users
Data Is required to provide services
Unless otherwise specified, all Personal Data (as defined under the GDPR) requested is mandatory and your choice to not provide such Personal Data may make it impossible to provide services to you. In cases where we have made clear that some Personal Data is not mandatory, you are free not to communicate this Personal Data without any consequences on the availability or the functioning of the service. If you are uncertain about which Personal Data is mandatory then you are welcome to contact Milu Health at the contact details below under “Contact Us”.
Additional information about your Personal Data
Your GDPR rights
Solely to the extent applicable to us, if you are subject to the GDPR, you may have certain rights and protections about the collection, sharing, and use of your Personal Data including as follows:
Right to Access Your Personal Data: You can ask us for a copy of the Personal Data we have about you.
Right to Rectification/Correction: You can also ask us to change, correct, or update your Personal Data in certain cases, especially if it is inaccurate.
Right to Erasure/Right to be Forgotten: You can ask us to stop using or erase all or some of your Personal Data (if we have no legal right to keep using it).
Right to Data Portability: You can ask us for a copy of the Personal Data you provided to us in a commonly used and machine-readable format.
Right to Object or Restrict Processing: You can object to or ask us to restrict processing under certain circumstances.
Requests should be sent to the Data Controller via the contact details below under “Contact Us”
Additional information regarding methods of processing
We take security measures to prevent unauthorized access, disclosure, modification, or unauthorized destruction of the Personal Data. The Personal Data processing is carried out using computers and/or IT enabled tools, following organizational procedures and modes strictly related to the purposes indicated. In addition to us, in some cases, the Personal Data may be accessible to certain types of persons in charge, involved with the operation of this Website (administration, sales, marketing, legal, system administration) or external parties (such as third-party technical service providers, mail carriers, hosting providers, IT companies, communications agencies) appointed, if necessary, as Data Processors by us. If applicable, this list may be requested and by a GDPR-covered Person from us at any time.
Legal basis for processing
We may process Personal Data relating to Users if one of the following applies:
Users or their agents (including group sponsors and employers) have given their consent for one or more specific purposes. Note: Under some legislations we may be allowed to process Personal Data until the User objects to such processing (“opt-out”), without having to rely on consent or any other of the following legal bases;
provision of Personal Data is necessary for the performance of an agreement with the User or an authorized agent of the User (such as a group sponsor or employer) and/or for any pre contractual obligations thereof;
processing is necessary for compliance with a legal obligation to which we are subject;
processing is related to a task that is carried out in the public interest or in the exercise of official authority vested in us;
processing is necessary for the purposes of the legitimate interests pursued by us or by a third party.
In any case, we will gladly help to clarify the specific legal basis that applies to the processing, and in particular whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract.
Place of processing
Personal Data is processed at our operating offices, in data centers located in the United States and in any other places where the parties involved in the processing are located. The United States has different (and sometimes lesser) privacy protections than other jurisdictions. By providing Personal Data, using this website, using mobile applications provided by us, or requesting services, you consent to the transfer of your Personal Data to the United States and the processing of such Personal Data in the United States.
Personal Data shall be processed and stored as noted above under Data Retention.
Where Personal Data is processed subject to the General Data Protection Regulation, such Personal Data collected for the purposes of our legitimate interests shall be retained as long as needed to fulfill such purposes, including but not limited to retention of records of completed services as required by law, regulation and healthcare practice and for the other reasons described in this policy.
Users may find specific information regarding the legitimate interests pursued by us within the relevant sections of this document or by contacting us at the contact details below under “Contact Us”.
Furthermore, we may be obliged to retain Personal Data for a longer period whenever required to do so for the performance of a legal obligation (including but not limited to retention of records of healthcare services performed or recommended) or upon order of an authority.
Purposes of processing
Personal Data about you is collected to allow us to provide services to you, as well as for the following purposes: Analytics, Remarketing and behavioral targeting, Interaction with external social networks and platforms, Managing contacts and sending messages, User database management, Heat mapping session recording, Content commenting, Displaying content from external platforms, Content performance and features testing (A/B testing), Generation models of medical and clinical conditions, Generation models of physician and clinical performance, Infrastructure monitoring and Contacting the User.
Information not contained in this policy
More details concerning the collection or processing of Personal Data may be requested from the Data Controller at any time. Please see the contact information below under “Contact Us”.
Data Protection Officer
The Data Protection Officer shall be the HIPAA Privacy Officer.
This privacy statement has been prepared based on provisions of multiple legislations, including Art. 13/14 of Regulation (EU) 2016/679 (General Data Protection Regulation or “GDPR”).
Additional Information for California Consumers
This section of the Policy uses the term “personal information“ as it is defined in CCPA.
Categories of personal information collected, disclosed or sold
Please refer to the list above under “What information do we collect from users and how is it used?”
How we use the information we collect: sharing and disclosing of your personal information with third parties for a business purpose
We may disclose the personal information we collect about you to a third party for business purposes. In this case, we enter a written agreement with such third party that requires the recipient to both keep the personal information confidential and not use it for any purpose(s) other than those necessary for the performance of the agreement.
We may also disclose your personal information to third parties when you explicitly ask or authorize us to do so, in order to provide you with our Service.
To find out more about the purposes of processing, please refer to the relevant section of this document.
Your right to opt out of the sale of personal information
We do not sell Member information, including lists of Members or any personal information of Members otherwise.
To the extent our website uses third party cookies and these cookies collect personal information, such collection may in some cases be considered a “sale” of personal information for purposes of the CCPA.
You have the right to opt out of the sale of your personal information. This means that whenever you request us to stop selling your data, we will abide by your request.
You can opt out of such sales. Such requests can be made freely, at any time, without submitting any verifiable request by following the below instructions.
Instructions to opt out of the sale of personal information
On our Sites are cookie banners with a button labeled “Settings.” This button was added in order to comply with the CCPA, and it offers information about our use of these third-party cookies, and provides consumers an opportunity to opt-out of certain of these cookies.
Should you wish to opt-out of these cookies, please click on the “Settings” button on the banner that pops up and adjust your cookies settings.
If you’d like to know more, you can contact us at the contact details below under “Contact Us”.
What are the purposes for which we use your personal information?
We may use your personal information to allow us to render services to you and your Employer (if applicable), the operational functioning of the Sites and features thereof (all together, “business purposes”).
We may also use your personal information for other reasons such as for commercial purposes as well as for complying with the law and defending our rights before the competent authorities where our rights and interests are threatened or we suffer an actual damage.
Your California privacy rights
The right to know and to portability
You have the right to request that we disclose to you:
the categories and sources of the personal information that we collect about you, the purposes for which we use your information and with whom such information is shared;
in case of sale of personal information or disclosure for a business purpose, two separate lists where we disclose:
for sales, the personal information categories purchased by each category of recipient; and
for disclosures for a business purpose, the personal information categories obtained by each category of recipient.
The disclosure described above will be limited to the personal information collected or used over the past 12 months.
If we deliver our response electronically, the information enclosed will be “portable”, i.e. delivered in an easily usable format to enable you to transmit the information to another entity without hindrance – provided that this is technically feasible.
The right to request the deletion of your personal information
You have the right to request that we delete any of your personal information, subject to exceptions set forth by the law (such as, including but not limited to, where the information is used to identify and repair errors on this Website, to detect security incidents and protect against fraudulent or illegal activities, to exercise certain rights etc.)
If no legal exception applies, as a result of exercising your right, we will delete your personal information and direct any of our service providers to do so.
How to exercise your privacy rights
How to make a request
providing sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative; and
describing your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.
With that in mind, at this time:
Requests from Members are considered verified if submitted using our Services. If you are an existing Member, please submit your request either by calling us and confirming your identity. If, however, there is indication or suspicion of fraud or other malicious activity on the Member’s account, we may suspend reliance on these verification methods and defer to other methods to confirm authenticity.
You may alternatively contact us via the information provided below under “Contact Us”. However, please note that emailed requests are not considered verified, and we may request additional information from you (that we would already have in our records) in order to confirm your identity.
We may also recognize verified requests submitted on an individual’s behalf by “Authorized Agents”. To be valid, we must receive from the Agent a signed authorization from the individual on whose behalf the Agent is acting. We will also need to verify the authorization with the consumer.
For “household” requests subject to the CCPA, we will need to verify each household Member’s individual identity and current status as household members.
And we will not process any requests of children under 13 years of age without verifiable consents from their parents or legal guardians.
We will not respond to or process any unverified request. This is all done to protect your confidentiality and ensure, to the best of our ability, that we only process such requests for the right persons.
You can submit a maximum number of 2 requests over a period of 12 months.
If you choose to exercise your privacy rights, you will not receive discriminatory treatment or a lesser degree of service from us.
How and when we are expected to handle your request
Unless otherwise specified in this Policy, the following applies for timing and expectations around how and when we will respond to your requests. If our response to a privacy request is restricted by an agreement between us and your Employer, we will process your requests in accordance with that agreement and related authorization. Otherwise, the following applies.
To the best of our ability, we will confirm receipt of your verifiable request within 45 days and provide information about how we will process your request.
For CCPA-related requests, we will respond to your request within 45 days of its receipt. Should we need more time, we will explain to you the reasons why, and how much more time we need. In this regard, please note that we may take up to 90 days to fulfill your request.
Our CCPA disclosures will cover the preceding 12 month period.
Should we deny your request, we will explain to you the reasons behind our denial.
We do not charge a fee to process or respond to your verifiable request unless such request is manifestly unfounded or excessive. In such cases, we may charge a reasonable fee, or refuse to act on the request. In either case, we will communicate our choices and explain the reasons behind it.
If you have questions want to submit a request, have concerns about this Policy or Milu Health’s Privacy Practices, or would like to report a violation, see the below contact options:
You may contact us by mail at:
Milu Health, Inc.
909 Davis St, Suite 500
Evanston, IL 60201
You may email us at firstname.lastname@example.org.
Or you may call our general support toll free line at (224) 204-0256.