BRIGHT HEALTH LLC Privacy Policy
Effective Date: June 1, 2025 Last Updated: June 1, 2025
1. Introduction
Bright Health LLC (“Bright Health,” “we,” “our,” or “us”) is a digital healthcare company that provides telemedicine services, electronic medical records, healthcare provider networks, laboratory coordination, pharmacy services, health education, wellness programs, appointment scheduling, and related healthcare services through our website, mobile applications, and other platforms (collectively, the “Services”).
Your privacy is important to us. This Privacy Policy describes how we collect, use, disclose, protect, and process your personal information and health information when you access or use our Services.
By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy and agree to the practices described herein. If you do not agree with this Privacy Policy, please do not use our Services.
2. Definitions
- Services means the Bright Health website, mobile applications, telemedicine platform, and all related healthcare and administrative services.
- Personal Data means any information that identifies, relates to, describes, or could reasonably be linked to an identifiable individual.
- Health Information (or Protected Health Information) means medical records, consultation notes, diagnoses, treatment history, prescriptions, laboratory results, imaging reports, allergies, medications, and any other information related to an individual’s physical or mental health.
- Usage Data means information automatically collected when you interact with our Services (e.g., device information, IP address, browser type, pages viewed, and timestamps).
- Cookies means small text files placed on your device to enhance functionality, analyze usage, and improve user experience.
- Data Controller means Bright Health LLC, which determines the purposes and means of processing Personal Data.
- Data Processor means a third party that processes Personal Data on behalf of Bright Health LLC.
3. Information We Collect
We collect the following categories of information depending on how you use the Services:
Identity & Contact Information
- Full name, email address, mobile phone number, date of birth, gender, home address, emergency contact details, and government-issued identification (when required for identity verification or regulatory compliance).
Health Information
- Medical history, allergies, current medications, consultation notes and recordings (where applicable), laboratory and radiology reports, prescriptions, diagnoses, treatment plans, and insurance information.
Payment & Financial Information
- Payment card details, billing address, and transaction history (processed securely through third-party payment processors).
Technical & Usage Information
- Device information, IP address, browser type and version, operating system, app usage data, log data, and approximate location information (with your permission).
Communications
- Records of correspondence with customer support, feedback, and other communications you send to us.
We do not intentionally collect information from children under the age of 13 (or the applicable age of digital consent in your jurisdiction) without verifiable parental consent.
4. How We Collect Information
We collect information through the following means:
- Directly from you when you create an account, book a consultation, speak with a healthcare provider, upload medical records, request prescriptions, schedule laboratory or pharmacy services, purchase subscriptions, or contact customer support.
- Automatically when you visit our website or use our mobile applications (via cookies, pixels, and similar technologies).
- From healthcare providers, laboratories, pharmacies, and other partners involved in delivering care.
- From third-party sources (e.g., identity verification services or payment processors) where permitted by law.
5. How We Use Your Information
We use your information for the following purposes:
- To provide, operate, and improve our healthcare Services, including connecting you with licensed healthcare professionals, managing appointments, generating prescriptions, and coordinating laboratory and pharmacy services.
- To verify your identity and prevent fraud.
- To process payments and manage subscriptions.
- To respond to your inquiries and provide customer support.
- To send important service-related notifications (e.g., appointment reminders, prescription updates, and security alerts).
- To improve patient care, conduct internal quality assurance, and develop healthcare innovations.
- To maintain the security and integrity of our platform.
- To comply with applicable legal, regulatory, and professional obligations.
- To send marketing communications where permitted by law and where you have provided consent (you may opt out at any time).
- To analyze usage trends and improve the functionality and user experience of our Services.
We process Health Information only as necessary to provide care, operate the Services, or as otherwise permitted or required by applicable law.
6. Health Information & Confidentiality
Your Health Information is treated as confidential. Access is limited to authorized healthcare professionals and personnel who need the information to provide care or operate the Services.
We implement administrative, physical, and technical safeguards designed to protect Health Information from unauthorized access, use, disclosure, alteration, or destruction, consistent with applicable healthcare privacy standards.
7. Telemedicine Services
By using Bright Health’s telemedicine services, you acknowledge and agree that:
- Healthcare providers may deliver care remotely via audio, video, or other electronic means.
- Certain medical conditions or situations may require in-person evaluation, and the provider may recommend that you seek care at a physical facility or emergency department.
- Technical issues (e.g., connectivity problems) may interrupt or limit a consultation.
- Providers may recommend emergency treatment when clinically appropriate.
- Telemedicine consultations are not a substitute for emergency medical care. In a medical emergency, dial your local emergency number immediately.
8. Artificial Intelligence
Bright Health may use artificial intelligence (AI) and machine learning tools to support healthcare delivery and improve the Services. These tools may assist with:
- Clinical decision support and triage recommendations
- Documentation and summarization of consultations
- Administrative efficiency and workflow optimization
- Personalization of educational content and wellness recommendations
AI tools are used to assist, not replace, licensed healthcare professionals. Final clinical decisions remain the responsibility of the treating provider. We take reasonable steps to ensure that AI systems are designed and monitored to support accurate, fair, and secure processing of information.
9. Cookies and Tracking Technologies
We and our service providers use cookies, pixels, and similar technologies to:
- Enable essential platform functionality
- Remember your preferences
- Analyze how the Services are used
- Improve performance and user experience
You can manage cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the Services. For more details, please see our Cookie Policy (if published) or contact us.
10. How We Share Your Information
We may share your information in the following circumstances:
- With healthcare providers involved in your care.
- With laboratories, pharmacies, and other clinical partners as necessary to fulfill your requests for services.
- With service providers who perform services on our behalf (e.g., cloud hosting, payment processing, identity verification, analytics, and customer support), under contractual obligations to protect your data.
- With your consent or at your direction.
- For legal and safety reasons, including to comply with law, respond to lawful requests, protect rights and safety, or investigate fraud or security incidents.
- In connection with a business transaction (e.g., merger, acquisition, or sale of assets), subject to appropriate confidentiality protections.
We do not sell your Personal Data or Health Information.
11. Data Retention
We retain Personal Data and Health Information only for as long as necessary to fulfill the purposes described in this Privacy Policy, provide the Services, comply with legal and regulatory obligations (including medical record retention requirements), resolve disputes, and enforce our agreements. Retention periods may vary depending on the type of information and applicable law.
12. Data Security
We implement reasonable administrative, technical, and physical safeguards designed to protect your information against unauthorized access, disclosure, alteration, and destruction. These measures include encryption in transit and at rest (where appropriate), access controls, secure authentication, and regular security assessments.
No method of transmission or storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security.
13. Your Rights and Choices
Depending on your jurisdiction, you may have the right to:
- Access the Personal Data we hold about you
- Request correction of inaccurate information
- Request deletion of your information (subject to legal and clinical record-keeping requirements)
- Object to or restrict certain processing
- Withdraw consent where processing is based on consent
- Request data portability
- Opt out of marketing communications
To exercise these rights, please contact us using the details in Section 16. We will respond in accordance with applicable law. Note that certain Health Information may be subject to specific healthcare privacy rules that limit deletion or modification.
You may also manage notification and marketing preferences in your account settings or by following the unsubscribe instructions in our emails.
14. International Data Transfers
If you access the Services from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate. We take steps to ensure that such transfers are conducted in accordance with applicable data protection laws.
15. Children’s Privacy
Our Services are not directed to children under 13 (or the higher age required in your jurisdiction). We do not knowingly collect Personal Data from children under this age without appropriate parental consent. If we become aware that we have collected such information, we will take steps to delete it promptly.
16. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. The “Last Updated” date at the top will reflect the most recent revision. Material changes will be communicated by posting the updated policy on our website or through other reasonable means. Your continued use of the Services after the effective date of any changes constitutes acceptance of the revised Privacy Policy.
17. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:
Bright Health LLC
Email: privacy@brighthealth.com
For healthcare-related privacy inquiries or to exercise rights regarding Health Information, please include sufficient information so we can locate your records and verify your identity.