Effective Date: January 1, 2020

(If you are a CA resident, this statement includes your California Privacy Rights)

This Website is designed for informational purposes to be used by clients and other interested parties (each, a “User” or “you”). This Website is owned and operated by American Specialty Health Incorporated, a Delaware corporation with a mailing address of 10221 Wateridge Circle, San Diego, CA 92121, on behalf of itself and its subsidiaries. (collectively “ASH” or “We”). ASHLink.com includes public facing materials that are intended to be resources (e.g. clinical practice guidelines; Clinical Quality Assurance; claims forms) to the insurance, health plan and employer-sponsored benefit program participants we serve. This includes prospective and contracted specialty network practitioners and fitness centers.

ASHLink.com also provides additional features for clients, provider and fitness club network participants and other health care practitioners to conduct transactions for benefit administration available through insurance, health plan and employer-sponsored benefit programs supported by ASH. Separate terms and conditions and privacy practices apply to the uses of the secured Website.

This privacy statement addresses the features of ASHLink.com that are publicly available.

We collect personal information in an effort to improve the user experience and to communicate information about our products and services. ASH values its users (“you”) and respects your privacy. We are committed to using your information responsibly. We will not release, sell, rent, or trade your personal information to any third party without your permission, except when we believe in good faith that the law requires it, or to protect our own rights and properties, or as expressly stated in this Privacy Statement. We consider personal information to include, but not be limited to name, e-mail address, mailing address and IP Address.

This Privacy Statement informs users about the information practices for this website, including: what personal information we collect on the Website; how the personal information is collected; how the personal information will be used; and the choices users have about the collection and use of personal information.

This Privacy Statement, together with the Terms & Conditions., governs your use of the publicly available features of this Website. By using this Website, you accept and agree to be bound by this Privacy Statement and the Terms & Conditions..

You should read and familiarize yourself with this Privacy Statement and with ashlink.com Terms & Conditions.. For any questions about this Privacy Statement, please contact us directly through any means noted at the end of this Privacy Statement. If information practices change, ashlink.com will post the revised policy on ashcompanies.com and/or will notify users through direct communication.

This chart is a reference guide on how the publicly available functions of ASHLink.com collect, use, and share your information. This is only a summary. You should review the full privacy statement below for more detail. If you are a California resident or an international user, the full privacy statement below contains important information related to your privacy rights.
	Categories of Personal Information	Source of Collection	How do we use?	How do we share?
Website Use – public features	Identifiers: IP address	Provided by you when accessing the website.	To perform auditing, detecting security incidents, debugging programs, internal research and tech development, and quality assurance and product improvement.	We do not share this information outside of ASH
Forms/Contact Us	Identifier: First and last name, User type, Email address Personal Information: Phone number, General inquiry type and inquiry details; Detail required on applicable form	Provided by you.	To verify your information and to perform services addressing your questions, suggestions and complaints. To process the activity related to the form completed. Inquiries and Forms are forwarded to the applicable ASH staff responsible for managing the issue. ASHLink does not store or directly process inquiries or forms.	Inquiries and Forms are forwarded to the applicable ASH staff responsible for managing the issue. ASHLink does not store or directly process inquiries or forms. ASH may share the information as necessary to resolve your inquiry or concern, or process the activity related to a form, when resolution requires third party action.
	For legal purposes, including: as reasonably necessary to comply with law or legal process (including a court or government order or subpoena); to detect, prevent, or otherwise address fraud, security or technical issues; to enforce this Privacy Statement or the Terms & Conditions for the ASHLink.com Website; and as reasonably necessary to protect the rights, property or safety of ASH, ASH users, and/or the public.
Additional Sharing	During a corporate reorganization: If ASH is involved in a merger, acquisition, financing, or sale of business or assets, information collected from and about users may be transferred to one or more third parties involved in such transaction and, upon such transfer, the relevant third-party privacy policy or policies may govern further use of the information. In the event of such a change, ASH will endeavor to notify our users of the change as well as any choices our users may have regarding the change. Aggregate information: In addition, ASH may provide reputable third-party vendors with aggregate statistics regarding ASHLink.com Website traffic patterns and related Usage Information. The information so provided will not include individually identifiable information, meaning we will not share your Personal Information with these third-party vendors.
Cookies, Website Analytics, and Interest Based Advertising	Internet or Electronic Activity Information: Web server logs Cookies Personal Information: Date and time of User access of Website	Aggregated information provided by Google Analytics.	To perform auditing, detecting security incidents, debugging programs, internal research and tech development, and quality assurance and product improvement. Cookies issued by the website are for web site session management and do not store information once the session is closed.	We do not share the information that Google Analytics provides to us with any third parties.

How does the public-facing ASHLINK.COM use information collected about users?

The publicly available features of ASHLink.com includes materials that are intended to be resources to the insurance, health plan and employer-sponsored benefit program participants we serve. Use of the public-facing materials does not require an account. We collect and store the following information about Users:

• IP addresses;
• Date and time of User access of Website;

Except as expressly stated in this Privacy Statement, we use the information collected from or about Users for internal purposes only, including measuring the number of visitors to the different sections of this Website, helping make this Website more useful to Users.

In addition, ASH collects personal information in forms that are available on the website (such as the Member Grievance Form) and in the Contact Us section of ASHLink.

• The Contact Us form collects information such as a name, e-mail address, and telephone number. If you provide your e-mail address, postal address, and/or telephone number to us, we will collect and store such information and may use it to communicate with you at your request.
• The various forms will collect different information based on the form content. For example, the Member Grievance Form requires a name, date of birth, home phone number, work phone number, address, name of employer or group, enrollment ID, provider name if applicable, and a description of Grievance. Once the form is completed and submitted, ASHLink forwards it to the secured database used by the applicable ASH staff responsible for managing the form. The information entered on the form is not stored on ASHLink.

How does ASH use PHI and PII?

ASH collects personal information (including, but not limited to name, e-mail address, mailing address, and/or telephone number) when user commences communications with ASH. If you provide your e-mail address, postal address, and/or telephone number to us, we will collect and store such information and may use it to communicate with you. When any personal or general information is sent through ASHLink the information will be directed to appropriate staff from the ASH affiliate responsible for supporting the managing such issues. Such information is given only to the person appropriately suited to process the request, answer questions, or resolve concerns. Customers may also be contacted via phone, U.S. Mail or e-mail if ASH needs to clarify information submitted or if ASH feels the requested information is best conveyed via phone, U.S. Mail or email.

Under what circumstances does ASH share information with third parties?

ASH may share your information with third parties in the following circumstances:

• As reasonably necessary to enable third-party service providers to provide services and support for the operation and maintenance of the ASHLink.com Website;
• As reasonably necessary to comply with law or legal process (including a court or government order or subpoena);
• As reasonably necessary to detect, prevent, or otherwise address fraud, security or technical issues;
• As reasonably necessary to enforce this Privacy Statement or the Terms & Conditions for the ASHLink.com Website;
• As reasonably necessary to protect the rights, property or safety of ASH, ASH users, and/or the public.
• As reasonably necessary when ASH is involved with a merger, acquisition, financing, or sale of business or assets; and
• From time to time, to provide reputable third-party vendors with aggregate statistics regarding ASHLink Website traffic patterns and related site information. The information so provided will not include individually identifiable information, meaning there will be no personal information.

HOW CAN USERS OPT-OUT OF COLLECTION OF PERSONAL INFORMATION?

California Residents see below. If you decide to opt-out of a particular feature that asks you to provide your information, you should not continue with the feature. If you do continue the feature after you decide to opt-out, you may be asked again to provide your information within the feature.

CAN USERS DELETE THEIR INFORMATION COLLECTED ON THE ASHLINK.COM WEBSITE?

Except as expressly otherwise stated in this Privacy Statement, and except where applicable law provides otherwise, personal information collected on the ASHLink.com Website cannot be deleted or removed from ASH’s database and will be retained for a minimum of 10 years in accordance with ASH’s record retention policy. If a grievance or contact us submission is received by ASH, the appropriate internal team will use the information to service your request. This data is not stored on ASHLink.

In relation to information that is submitted to ASH via forms available on ASHLink, members maintain the right to amend personal information, including Protected Health Information (PHI), if the member believes that information is inaccurate or incorrect. A request for an amendment must be made in writing on American Specialty Health’s (ASH) Member Request to Amend Protected Health Information form, available online or upon request through the contact information at the end of this privacy statement. Failure to fully complete all sections of the form may result in the form being returned to you. Response to the request for amendment will be issued within 30 days of receipt of the completed form. However, ASH may obtain one 30-day extension by sending the member a written notice stating the reason for the delay and the expected date of the response.

ASH may deny the member’s amendment request under the following circumstances:

• The personal information is accurate and complete.
• The request for amendment was made verbally.
• The request does not state a reason for the amendment
• ASH did not create the personal information, unless the originator is not available to act on the request.

Personal information, including PHI, contained in forms submitted through ASHLink is stored on other secured databases used by ASH. Generally, such information cannot be removed from the system and will be retained for a minimum of 10 years, as prescribed by state or federal law and in accordance with ASH’s record retention policy.

HOW CAN USERS OPT-OUT OF RECEIVING COMMUNICATIONS FROM ASH?

Communication received from ASH would not generate based on your use of the public ASHLink site. In connection with other services you receive from ASH, if you provide your e-mail address, postal address, and/or telephone number to us, we may send you information about ASH’s products and services that may be of interest to you. You may opt out of receiving further such communications from us at any time by contacting us as described at the end of this Privacy Statement. To stop receiving further such communications via email, you can also use the “unsubscribe” link contained in an email you have previously received from us. For users who have requested to be removed from our email, postal mail, and/or telephone contact lists, we will add them to our internal do-not-contact lists to ensure the request is honored.

HOW DOES ASH PROTECT THE PRIVACY OF MINORS?

ASH is concerned about the safety of children when they use the Internet. This web site is not intended for use by persons under the age of majority (e.g., under the age of 18 in California).

WHAT ARE COOKIES? HOW DOES ASH USE COOKIES ON ASHLINK.COM?

A cookie is a small data file that Websites often store on a computer's hard drive when their sites are visited. A cookie may contain information (such as a unique user ID), that is used for web session management.

Most web browsers are initially set to accept cookies, but you can change your browser settings to notify you when you are sent a cookie, giving you the ability to accept or reject it, or you can choose to routinely and manually delete cookies stored on your computer or mobile device. Each time you revisit the ASHLink.com Website, your ability to restrict our use of cookies on that service is subject to your browser settings and limitations at the time. Please note that if you choose to disable or reject cookies from the ASHLink.com Website, some portions and features of the ASHLink.com Website may become inaccessible or may not function properly.

For more information on how to manage cookies, visit http://www.aboutcookies.org/. To manage Adobe Local Shared Objects (also known as LSOs or Flash cookies), visit http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager07.html.

WHAT ARE DO NOT TRACK SIGNALS AND HOW DOES ASH RESPOND TO THEM?

A Do-Not-Track signal is a mechanism contained in some users’ web browsers that provides website visitors the ability to request a website to not record and collect information about the consumer’s online activity while visiting a website. To ensure the best user experience, ASHLink will ignore “Do Not Track” signals if ASHLink receives such a signal from a user’s web browser.

HOW DOES ASH ENSURE INFORMATION IS SECURE?

ASH has an organizational commitment to protecting privacy and security. All employees who have access to Users’ personal information are aware of security policies and practices through employee orientation and annual refresher training. Personal information is secured in an isolated database with tightly restricted access. Employees authorized to view this information are authenticated prior to gaining such access. ASH has an organizational commitment to protecting privacy and security. All employees who work on the ASHLink.com Website are made aware of security policies and practices through employee orientation and annual refresher training. ASH reviews web security on an ongoing basis. In addition to daily security administration and response activities, the ASHLink.com Website undergoes an overall security review on an annual basis.

WHAT IS ASH’S ADVERTISING POLICY?

ASH does not allow third-party advertising on ASHLink.com.

WHAT IS ASH’S POLICY REGARDING LINKS TO OTHER WEB SITES AND SERVICES?

For your convenience, the ASHLink.com Website may provide links to third-party websites and online services not owned or controlled by or affiliated with ASH (each, a “Linked Third-Party Website/Service”). Linking does not mean, and should not be deemed or construed to mean, that ASH endorses or approves or is affiliated with a Linked Third-Party Website/Service. ASHLink interacts with other ASH systems where data is mutually linked to administer benefit programs. ASHLink also links to Adobe.com to allow users the capability to view and print PDF documents located on the site. No personal information, including PHI, is shared with these sites. The appropriateness of links to external sites is reviewed semi-annually. ASH is not responsible for the information privacy and security policies or practices of a Linked Third-Party Website/Service. When you leave the ASHLink.com Website to visit a Linked Third-Party Website/Service, this Privacy Statement no longer applies, and any information collected from or about you by a Linked Third-Party Website/Service will be governed by that site/service’s privacy policies and practices, which may be substantially different from those of ASH. A Linked Third-Party Website/Service may set or use its own cookies, web beacons, etc. to your computer or mobile device, and may collect information from and about you and use the information in ways that ASH would not. You access a Linked Third-Party Website/Service entirely at your own risk. You should always read the privacy policy associated with a Linked Third-Party Website/Service before disclosing any personal information. For more on Links, please see the Terms and Conditions of this Website.

CALIFORNIA RESIDENTS: YOUR CALIFORNIA PRIVACY RIGHTS

Under California Civil Code Section 1798.83 (known as the "shine the light" law), California residents have a right to request an information-sharing disclosure from a business to which they have provided personal information, and which has disclosed the information to any third party for third-party direct marketing uses in the prior calendar year.

ASH does not knowingly share your personal information with third parties for their direct marketing use without your permission. California residents may send requests for information-sharing disclosure under this law by contacting us by mail at the address located in the contact section below. Please note that, under this law, we are not required to respond to your request more than once in a calendar year, nor are we required to respond to any requests that are not sent to the above-designated email address.

The California Consumer Privacy Act (CCPA) (California Civil Code 1798.100-199) provides California residents with specific rights related to the collection, use and disclosure of their personal information by us. While our privacy practices have adopted many of the CCPA requirements across our program, this section discusses specific rights and elements applicable to persons who are California residents at the time we collected, used or disclosed your personal information.

The CCPA and the details noted here do not apply to situations where your personal information is collected, used or disclosed by us:

• Where in our capacity as a business associate of a covered entity, we collect or maintain your personal information in the same manner as protected health information in compliance with privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, Parts 160 and 164 of Title 45 of the Code of Federal Regulations, established pursuant to the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191) and the Health Information Technology for Economic and Clinical Health Act (Public Law 111-5). This may apply when your access to our program is made available to you as part of a health benefit plan operated by a plan sponsor who is a covered entity under the laws noted immediately above.
• Where your access to our program is made available to you through a sponsoring organization as part of the organizations’ policies or products subject to the federal Gramm-Leach-Bliley Act (Public Law 106-102), and implementing regulations, or the California Financial Information Privacy Act (Division 1.4 (commencing with Section 4050) of the Financial Code).

Additionally, should we receive CCPA-related requests that are manifestly unfounded or excessive, in particular because of their repetitive character, we reserve the ability to either charge a reasonable fee for taking the action requested or refuse to act on the request. If we refuse your request on this basis we will notify you of the reason why.

If neither of the above situations apply to you and you are a California resident, you may exercise your rights under the CCPA as described below:

Right to Know: You have the right to request that ASH disclose what personal information we have collected, used, disclosed, and sold in the previous twelve (12) months.

To request this information you may fill out this form. You may submit this form by emailing us at the following email: HIPAA@ashn.com with the subject line "California Privacy Rights" or by mailing said form to our address below. You may also utilize your Right to Know by phone at (800) 678-9133.

ASH will verify your request by matching information provided by you in the Right to Know Form to information housed in our internal systems.

If we are unable to verify the request, we will deny the request and provide notice of such denial. ASH may also deny requests if you submit the Right to Know Form more than twice in a calendar year or if your request is not sent to the designated email, phone number, or address.

ASH will grant, deny, or respond to a request within 45 days of receipt of the Right to Know Form. If an extension of time (up to a maximum of 90 days) is required, we will notify you and provide additional information about the process.

Right to Delete: You have the right to request the deletion of your personal information collected or maintained by the ASH.

To request this information you may fill out this form. You may submit this form by emailing us at the following email: HIPAA@ashn.com with the subject line “California Privacy Rights” or by mailing said form to our address below. You may also utilize your Right to Delete by phone at (800) 678-9133.

ASH will verify your request in a two-step verification process. First, ASH will match information provided by you in the Right to Delete Form to information housed in our internal systems. Second, ASH may contact you to verify your identity and confirm your request, such contact may be made by phone or email.

If we are unable to verify the request, we will deny the request and provide notice of such denial. ASH may also deny requests if you submit the Right to Delete Form more than twice in a calendar year or if your request is not sent to the designated email, phone number, or address.

ASH will grant, deny, or respond to a request within 45 days of receipt of the Right to Delete Form. If an extension of time (up to a maximum of 90 days) is required, we will notify you and provide additional information about the process.

In response to your request, ASH may deny or grant your request. If ASH grants your request, we will notify you as to which of the following methods We have used to fulfill your request. We may do one of the following: (1) permanently delete your information from our systems; (2) deidentify your information; or (3) aggregate your information in accordance with CCPA requirements.

A denial of a deletion request may occur if ASH requires the use of your personal information to complete a transaction or provide services on your behalf, to detect security incidents and prosecute those responsible, to debug and repair errors that impair existing functionality, to exercise free speech or allow you to exercise free speech or any other right, to comply with the California Electronic Communications Privacy Act, to engage in public or peer-reviewed research with informed consent if deletion would seriously impair the achievement of such research, to enable solely internal uses that are reasonably aligned with the business relationship between you and ASH, or to comply with a legal obligation.

Right to Non-Discrimination: You have the right to exercise your privacy rights to know and to delete without facing discrimination of service or product offerings. Your use of ASHLink.com will remain the same whether you exercise your Right to Know or Right to Delete under the CCPA.

Right to Authorize an Agent: You have the right to authorize an agent to communicate on your behalf. To authorize an agent you may fill out this form. You may submit this form by emailing us at the following email: HIPAA@ashn.com with the subject line “California Privacy Rights” or by mailing said form to our address below. You may also utilize your Right to Authorize an Agent by phone at (800) 678-9133.

ASH will verify your request by matching information provided by you in the Right to Authorize Agent Form to information housed in our internal systems. If we are unable to verify the request, we will deny the request and provide notice of such denial.

Right to Opt-Out: ASH does not sell or knowingly share your personal information with third parties for non-permitted uses including direct marketing. California residents may send requests for information-sharing disclosure under this law by contacting us at the following email: HIPAA@ashn.com with the subject line “California Privacy Rights” or by phone (800) 678-9133 or by mail address located in the contact section below. Please note that, under this law, we are not required to respond to your request more than twice in a calendar year, nor are we required to respond to any requests that are not sent to the designated email, phone number, or address.

Additionally, should we receive CCPA-related requests that are manifestly unfounded or excessive, in particular because of their repetitive character, we reserve the ability to either charge a reasonable fee for taking the action requested or refuse to act on the request. If we refuse your request on this basis we will notify you of the reason why.

CHANGES TO OUR PRIVACY POLICY

ASH reserves the right to make changes to this Privacy Statement at any time by posting the modified policy on this Website. Modifications shall be effective when they are posted on this Website. Such posting shall constitute notice to you. Your continued use of the Website following the posting of any such modifications on this Website will mean you accept and agree to be bound by such modifications.

We encourage you to check this Website regularly to see if we have made any modifications to this Privacy Statement.

HOW CAN USERS CONTACT ASH WITH QUESTIONS OR FOR MORE INFORMATION?

Questions may be submitted online using ASH’s contact us page. ASH is a privately held corporation. All Web site operations are conducted and maintained by staff affiliated with ASH. American Specialty Health Incorporated is a Delaware corporation with a major corporate office located at 10221 Wateridge Circle, San Diego, CA 92121.

FOR MEMBER INQUIRIES

• (800) 678-9133
  TTY/TDD 711
• Between 10/1 and 3/31
  Sunday - Saturday (7 days a week): 8am – 8pm local time
  For every time zone we service
  The department is closed for Thanksgiving Day and Christmas Day
• Between 4/1 and 9/30
  Monday – Friday: 5am – 8pm PST
  The department is closed for all ASH observed holidays
• American Specialty Health
  10221 Wateridge Circle
  San Diego, CA 92121

FOR PROSPECTIVE PROVIDER INQUIRIES

• (888) 511-2743
• M-F 8:00 a.m. – 5:00 p.m. PST
• American Specialty Health
  P.O. Box 509001
  San Diego, CA 92150-9001

FOR PROVIDER INQUIRIES

• (800) 972-4226
• M-F 5:00 a.m. – 6:00 p.m. PST
• American Specialty Health
  P.O. Box 509001
  San Diego, CA 92150-9001

FOR PROSPECTIVE FITNESS CENTER INQUIRIES

• (877) 329-2746, option 5
• M-F 8:00 a.m. – 5:00 p.m. PST
• American Specialty Health Fitness, Inc.
  PO Box 509117
  San Diego, CA 92150-9117

FOR FITNESS CENTER INQUIRIES

• (877) 329-2746
• M-F 5:00 a.m. – 6:00 p.m. PST
• fitness@ashn.com (Claims)
• American Specialty Health Fitness, Inc.
  PO Box 509117
  San Diego, CA 92150-9117

If you need assistance with or require this Privacy Statement in an alternative format, please contact us at (800) 678-9133.

Privacy and Security Contact Information

ASH has a designated Privacy Officer and an Information Security Officer to oversee our privacy and security programs. You may direct questions about these programs to these individuals by either calling (877) 427-4766 or emailing HIPAA@ashn.com Use of this site is governed by the ASH Terms & Conditions..

---

Clicking on these links will take you away from ASHLink.com. ASHLink.com is not responsible for any content of external websites.