Updated June 1, 2026
This Privacy Policy describes how Kaizen Health collects, uses, shares, and protects personal information in connection with the Platform. Kaizen operates primarily as a Business Associate and service provider to health plans, healthcare providers, and governmental healthcare programs; most personal information we process is handled on behalf of and under the direction of our clients. By using the Platform, you acknowledge the practices described in this Policy.
We may collect the following categories of personal information:
We collect information:
We use personal information to:
Kaizen may use artificial intelligence (“AI”) and automated processing tools to support operations, fraud detection, scheduling, quality monitoring, and analytics. AI-assisted processes are designed to augment human decision-making and do not replace required human oversight. Where required by applicable law, meaningful human review may be applied to automated decisions that have a material impact on individuals.
Kaizen implements policies and procedures designed to support compliance with applicable federal and state laws governing automated decision-making. Where required by applicable law, Kaizen may provide notices, explanations, human review, or other rights relating to automated processing. In many cases, Kaizen processes information on behalf of health plans, healthcare providers, and other clients, and requests relating to automated processing may need to be directed to the applicable client.
We may share personal information with:
We do not sell personal information.
Kaizen Health primarily operates as a Business Associate as defined by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), 45 CFR §160.103. Kaizen receives, maintains, transmits, and processes Protected Health Information (“PHI”) solely on behalf of and under the direction of Covered Entities and other authorized entities pursuant to applicable Business Associate Agreements.
Kaizen does not independently determine the purposes or means of treatment, payment, or healthcare operations activities involving PHI and processes such information only as permitted by law, contract, and client instructions.
Kaizen maintains SOC 2 and HITRUST certifications at the infrastructure level. If you have questions about how your PHI is handled, please contact us or your health plan directly.
Kaizen uses administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, or misuse. These include encryption in transit and at rest, access controls, audit logging, and regular security assessments. No method of transmission or storage is completely secure; we cannot guarantee absolute security.
Kaizen maintains policies and procedures for detecting, investigating, mitigating, documenting, and reporting security incidents and breaches involving PHI in accordance with HIPAA, HITECH, applicable Business Associate Agreements, and other applicable laws. Security incidents are reported to applicable Covered Entities and governmental authorities within timeframes required by law and contract.
We retain personal information for as long as necessary to fulfill the purposes described in this Policy, to comply with legal and regulatory obligations, to support audit and program integrity requirements, and to resolve disputes. Retention periods vary by data type and applicable legal requirements, including healthcare program record retention requirements.
Depending on your state of residence and applicable law, you may have rights to:
Individuals seeking access, amendment, accounting of disclosures, restrictions, or other rights relating to PHI should contact the applicable Covered Entity, health plan, healthcare provider, or program sponsor. Kaizen assists Covered Entities in fulfilling such requests as required by applicable agreements and law. For all other requests, contact us at privacy@kaizenhealth.org.
Residents of certain states have additional rights under applicable state privacy laws. Kaizen complies with all applicable state privacy requirements across the states in which it operates.
California Residents (CCPA/CPRA)
If you are a California resident whose personal information Kaizen holds directly (as distinct from information held by your employer or health plan), you may have rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including:
Personal information that constitutes Protected Health Information under HIPAA is generally exempt from certain state consumer privacy laws, including portions of the CCPA/CPRA, to the extent provided by applicable law. To submit a California privacy request, contact us at privacy@kaizenhealth.org.
Other State Residents
Residents of certain states may have rights to access, correct, delete, or obtain information regarding personal information that Kaizen holds directly. Kaizen will respond to applicable requests in accordance with applicable law.
Because Kaizen primarily operates as a Business Associate and service provider to health plans, healthcare providers, governmental healthcare programs, and other clients, most personal information processed by Kaizen is handled on behalf of and under the direction of those clients. Individuals seeking to exercise rights relating to information processed on behalf of a client should contact the applicable health plan, healthcare provider, or client directly. For information Kaizen holds independently, requests may be submitted to privacy@kaizenhealth.org.
Our website does not currently respond to browser Do Not Track signals. We may use standard web analytics tools to collect aggregate, non-personally-identifiable information about site traffic and usage patterns, such as page views, browser type, and referring URLs. We do not use this data to identify individual visitors. We will update this policy as our website and technical practices evolve.
The Platform is not directed to children under the age of 13. We do not knowingly collect personal information from children. If you believe a child’s information has been provided, please contact us and we will take appropriate action.
Kaizen may use de-identified and aggregated data that cannot reasonably be used to identify an individual for analytics, benchmarking, product improvement, and research. Kaizen maintains administrative, technical, and organizational safeguards designed to prevent re-identification and to support compliance with applicable law. Where Protected Health Information is de-identified, Kaizen utilizes de-identification methodologies consistent with the HIPAA de-identification standards set forth in 45 CFR §164.514.
We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or business operations. Material changes will be communicated via the Platform or by email. We encourage you to review this Policy regularly.