Privacy Policy

IDEAL PRIVILEGES, LLC dba EDDY
PRIVACY POLICY
Effective Date: August 26, 2026
Supersedes the Privacy Policy dated June 20, 2023

1. EDDY SITES AND SERVICES
   Ideal Privileges, LLC (“IP”) dba Eddy (“Eddy”) is committed to helping reduce healthcare administrative
   burdens, which includes protecting your privacy. The information we collect through our websites and
   services helps us provide you with information and services specific to your needs and interests. This privacy
   policy (the “Privacy Policy”) governs your access to and use of all current and any future Eddy websites and
   the services offered on those websites, including Eddy’s standard platform and Eddy’s AI-native platform for
   credentialing and enrollment (together, the “Services”).
   Eddy currently operates the following website (collectively, the “Sites”): the Eddy software platform at
   http://www.secure.eddynow.com and any successor or replacement platform URL that Eddy designates.
   For our various Services, additional terms may apply. Additional Service-specific terms may be accessed
   through the Terms of Use or Terms of Service. This Privacy Policy is to be read along with any separate
   service agreement(s) that you may have in place with Eddy, including the Master Services Agreement and
   Business Associate Agreement. If there is a conflict between that agreement and this Privacy Policy, the terms
   of the service agreement will control with respect to the subject matter of that agreement. If there is a conflict
   regarding the handling of protected health information (“PHI”), the Business Associate Agreement will
   control.
   By accessing any of our Sites or Services, you agree to be bound by this Privacy Policy. If you do not agree to
   the terms of this Privacy Policy, please do not use our Sites or Services. Each time you use our Sites or
   Services, the current version of the Privacy Policy will apply. Accordingly, whenever you use our Sites or
   Services, you should check the date of this Policy (which appears at the top) and review any changes since the
   last version.
   This Privacy Policy is applicable to all visitors, registered users, providers who submit profile information,
   and all other users of our Sites or Services.
   The provisions contained herein supersede all previous notices or statements regarding our privacy practices
   with respect to the Sites and Services, including the Privacy Policy effective June 20, 2023. We post an
   effective date on the Privacy Policy so please check back periodically to review the current policy.

2. HOW DOES EDDY GATHER AND USE INFORMATION?
   “Eddy Content” means, including without limitation, characters, data, images, photographs, animations,
   video, audio, music, text, and applets on the Sites, and any and all other material and information provided by
   Eddy or its third-party providers that you see on the Sites and/or through the Services. Any content that you
   provide to Eddy regarding feedback or ideas on the Services shall become Eddy Content.
   “Content” shall mean Eddy Content, Third Party Data, and User Submitted Data collectively.

“Personal Information” includes any information that identifies you, would enable someone to contact you,
or that describes your relationship with Eddy.
“Third Party Data” shall mean data that Eddy obtains from third-party sources, such as primary-source
verification bodies, payers, licensing boards, or other sources used to perform credentialing and enrollment
Services.
“User Submitted Data” shall mean any information that you submit to Eddy through the Sites or Services,
such as provider contact information, identifiers (including NPI and TIN where provided), payment
information, certifications, licenses, work history, supporting documents, support requests, and prompts,
queries, or instructions you type into conversational reporting or other AI-assisted features, and includes
Personal Information that you submit directly to Eddy.
“Client Data” means non-public data provided by a contracting client (or its users or providers) to enable the
Services, including provider information and any PHI, as further described in the applicable Master Services
Agreement.
The use of User Submitted Data is subject to this Privacy Policy and the Terms of Use (including any
Site-specific terms associated with a particular Service) in effect at the time we use such information. This
section provides details about how Eddy gathers and uses User Submitted Data.
(a) Cookies.
Cookies are pieces of data assigned by a web server that uniquely identify the browser on your computer.
Eddy may attempt to install cookies when a user arrives at any of our Sites or uses our Services. Cookies
enable our systems to gather information about your navigational patterns through the Sites and Services.
Viewers have the option to accept or disable cookies at any time through their browsers. Visit the “help”
portion of your toolbar for more information. If you block or refuse to accept cookies, or delete cookies
between visits to any of our Sites, you may not be able to access or use certain features or functions of our
Sites or Services.
(b) User Analytics.
We may collect general statistics to track user trends on our Sites and Services. These statistics may include
hits to our server, the types of browsers used to access our Sites, page views, and navigational patterns. The
information that is collected in this manner does not provide us with any Personal Information about our
users. It helps us track where our users are coming from. This allows us to pinpoint high-traffic areas and
determine the most effective ways to communicate with our users. We may use this statistical information for
research and commercial purposes and to develop improvements to our Sites and Services.
(c) Information Users Provide to Eddy.
We collect and store User Submitted Data when you register to use our Sites or Services, utilize the Services
on our Sites, ask a question, complete a form, upload documents, enter a prompt or report request in an
AI-assisted feature, conduct a transaction, or send us an email. To use our Services, you will be required to
submit certain User Submitted Data, including Personal Information. If you do not provide the requested
information, you may not be able to access or use some of the features and functions of our Sites and we may
not be able to provide you with our Services. For administrative and security purposes, such as to prevent the
introduction of viruses and unauthorized access into the Eddy Sites, we may collect and retain information
such as IP addresses.

We may use your User Submitted Data internally, among other things, to communicate with you, to provide
information or Services to you (including credentialing, enrollment, tracking, reporting, and workflow
automation), to contact you directly about Services that you have purchased, and for our research or business
purposes as described in this Privacy Policy and your service agreement.
We may also combine your User Submitted Data with Third Party Data to provide our Services.
Users who subscribe to certain of our Services will be required to provide certain User Submitted Data,
including Personal Information that will be shared with other authorized Users of the same client
organization, and, where required to perform the Services, with payers, licensing boards, primary sources, and
other Service Recipients.
In addition to this Privacy Policy, if you have an agreement with a third-party user of Eddy Services (“Service
Recipient”) and provide information to or through the Service Recipient, that agreement may also govern the
collection, use and disclosure of your User Submitted Data through this Site.
3. ARTIFICIAL INTELLIGENCE
Eddy offers AI-assisted features as part of the Services. These features may include conversational reporting,
intelligent workflow routing and status tracking, document and field extraction, and similar automation
designed to reduce administrative burden in credentialing and enrollment. AI features generate draft outputs
from data already stored in the Services and from prompts or instructions you enter. AI outputs are assistive
tools. They are not legal, clinical, or payer-approval determinations and should be reviewed by an authorized
human user before they are relied on for a credentialing, enrollment, or other administrative decision.
(a) Private LLM implementation.
Eddy provides AI features through a private large language model (“LLM”) implementation. Client Data,
User Submitted Data, PHI, and prompts submitted to AI features are processed inside that private
implementation. They are not shared with public or consumer AI services, and they are not made available to
unaffiliated third parties for those parties’ own use, training, or product improvement.
The private LLM is deployed on secured servers operated for Eddy in the United States. Data processed by AI
features remains in the United States.
(b) No training on client data.
Eddy does not use Client Data, User Submitted Data, PHI, prompts, uploaded documents, or AI outputs to
train, fine-tune, or otherwise improve foundation models or general-purpose AI models, whether Eddy’s or a
third party’s.
Eddy may use performance-related data and user feedback (for example, whether a report completed
successfully, latency, error rates, and comments you submit about the quality of a feature) to operate and
generally improve the Services. That improvement use does not include using the underlying client content to
train AI models.
(c) What AI features collect and generate.
When you use an AI-assisted feature, Eddy processes the prompt or instruction you enter, the Client Data
needed to respond (for example, provider records, enrollment status, or report filters you specify), and the
resulting output (for example, a generated report or suggested routing). Prompts and outputs are User
Submitted Data and Client Data. They are stored and retained as needed to provide the Services, maintain an

audit trail, support security and quality, and meet legal and contractual obligations, including HIPAA where
applicable.
(d) Human review.
Authorized users remain responsible for reviewing AI-generated reports, extracts, and recommendations
before using them to make or document a credentialing or enrollment decision, or before submitting
information to a payer or other third party.
4. WHAT SECURITY PROCEDURES DOES EDDY USE TO PROTECT PERSONAL
INFORMATION?
Eddy uses physical, electronic, and administrative safeguards to assist us in preventing unauthorized access,
maintaining data accuracy, and correctly using User Submitted Data and Client Data.
Information that is sent to us through our Sites and Services is secured by encryption in transit. Fields that
contain PHI are encrypted. Eddy maintains a customized access system so that access to User Submitted Data
and Client Data through our Sites and Services is limited to registered persons who are required to use unique
credentials to obtain access. We contractually prohibit these persons from using your User Submitted Data
other than for the purpose of using our Services (unless otherwise authorized by you).
Because ordinary email transmissions are not secure, we encourage you to use a secure method when sending
us any User Submitted Data, or to use another means of transmitting the information to us.
Eddy will retain User Submitted Data for as long as your account is active or as needed to provide you with
our Services. If you wish to cancel your account or request that we no longer use your information to provide
our Services, please contact us at info@eddynow.com. We will retain and use User Submitted Data as
necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. Return or
destruction of PHI at the end of a client engagement is handled as provided in the applicable Business
Associate Agreement.
5. WILL EDDY DISCLOSE THE USER SUBMITTED DATA WE COLLECT TO THIRD
PARTIES?
Eddy may share User Submitted Data, including Personal Information contained within User Submitted Data,
as described below. Except as described in this Privacy Policy or your service agreement, Eddy does not sell
Personal Information.
(a) Affiliated Businesses We Control.
We may share User Submitted Data with the affiliated businesses we control to make sure that your
experience with us is as seamless as possible and that you have the full benefit of our Services. The use of
User Submitted Data by such controlled affiliates remains subject to this Privacy Policy.
(b) Agents and Infrastructure.
We employ other companies and individuals to perform functions on our behalf. Some examples of such
functions include operating and hosting our service offerings and the private LLM implementation on secured
servers in the United States, supporting our information technology infrastructure, sending postal mail and
e-mail, removing repetitive information from customer lists, analyzing performance data, providing marketing
assistance, processing payments, and providing customer service. We share User Submitted Data with these

agents only as we deem necessary for such third parties to perform their functions on Eddy’s behalf, and not
for those parties’ independent use or for training of third-party AI models. We may also provide aggregate
statistics about our customers, traffic patterns and related site information to reputable third-party vendors, but
these statistics do not include Personal Information.
(c) Unaffiliated Third Parties.
Eddy may from time to time disclose User Submitted Data to third parties as set forth in Section 5(h) below,
and in connection with initiatives or activities consistent with our mission to simplify healthcare
administration, and only as permitted by your service agreement and, where PHI is involved, the Business
Associate Agreement.
(d) Protection of Eddy and Others.
We may disclose User Submitted Data collected from you to (i) comply with the law, applicable regulations,
governmental and quasi-governmental requests, orders or subpoenas directed to us or our affiliates; (ii)
protect and defend our rights or property or the rights or property of other users of our Sites and Services
including the enforcement of our Terms of Use or other agreements; (iii) respond to an emergency or protect
the personal safety of users of our Sites or Services, or the public; or (iv) prevent a crime or protect national
security (including exchanging information with other companies and organizations for fraud protection).
(e) Change of Control.
In the event that a third party acquires all or a substantial portion of Eddy’s business, whether such acquisition
is by way of merger, liquidation, dissolution, consolidation or sale of all or a substantial portion of our
business, trade or assets, informational Content (including User Submitted Data) will be transferred to the
acquiring third party, subject to this Privacy Policy and applicable agreements (including the Business
Associate Agreement). By using our Sites or Services, you consent to the sale and transfer of your User
Submitted Data as described in this paragraph.
(f) Public Areas of our Sites or Services.
If you provide any User Submitted Data to Eddy for posting in areas of our Sites or through our Services that
may be publicly viewed (for example, blogs or messaging features to the extent available), your information
will be available to third parties who use our Sites or Services. Please be cautious when using public areas of
our Sites or Services. AI prompts and credentialing or enrollment records are not public areas of the Services.
(g) Authorized by User.
We may disclose User Submitted Data we collect from you if you request or authorize it.
(h) As Part of the Services.
Eddy may disclose User Submitted Data that you provide as part of your use of the Services to Service
Recipients and other Eddy customers in accordance with any Terms of Service or Master Services Agreement
relating to each applicable Service (for example, submission of enrollment applications to commercial health
plans and State or Federal agencies). Access to such User Submitted Data through our Services is limited to
registered users who are bound by agreements governing their use of Content (subject to any agreement you
may have directly with Service Recipients relating to their use of your Personal Information).
Eddy does not disclose Client Data or prompts to unaffiliated third-party AI providers for those providers’
training or independent use. See Section 3.
(i) Privacy Policy.

User Submitted Data may also be disclosed as otherwise described in this Privacy Policy.
6. EXTERNAL LINKS
Other companies or organizations may have links to their websites or services through our Sites or Services.
We are not responsible for how these other companies or organizations collect, use, disclose, or secure the
information that you provide them. If you choose to access a third-party website or service linked to one of
our Sites or Services, you do so at your own risk and subject to any terms of service or privacy policy (if any)
associated with such third-party websites.
7. COLLECTION OF INFORMATION FROM CHILDREN
Eddy does not direct any of our content specifically to children. We do not knowingly collect or use Personal
Information from individuals under eighteen (18) without obtaining verifiable consent from their parents or a
guardian. If we learn that a user is under 18 years of age, we will promptly delete any Personal Information
we have collected about that user. If you are under the age of 18, please do not send us any information about
yourself.
8. DO NOT TRACK
Eddy does not respond to web browser “do not track” signals. As such, your navigation of our Sites and use
of the Services may be tracked as part of the gathering of the general User Analytics collected by Eddy. If you
arrive at our Sites by way of a link from a third-party site that does respond to “do not track” requests, the
recognition of any “do not track” request you have initiated will end as soon as you reach our Sites.
9. ACCESSING YOUR INFORMATION
On some of our Sites or to use our Services, you may be required to register in order to access your
information. You may be required, under certain agreements you may have with health plans, hospitals or
other third parties, to ensure that your information with Eddy is up-to-date and accurate. You may view and
edit your User Submitted Data by accessing the Site and supplying your username and password or other
required authentication. Your username and password or other authentication allows access to your
information, so you are responsible for the disclosure of your information to anyone using your username and
password. Please protect these security devices and notify us immediately if they have been lost, stolen or
misappropriated.
10. UPDATING OUR POLICY
Eddy may at our sole discretion revise this Privacy Policy at any time. If any material changes are made, we
will notify you by displaying a prominent announcement on our Sites prior to the new Privacy Policy taking
effect. Depending on the Service, we may display notice of a change for a reasonable period. If you continue
to use our Sites and Services following the posting of changes to this Privacy Policy, you will be deemed to
have accepted the changes. Any revised privacy policies posted by Eddy will supersede all previous notices or
statements regarding the Sites or Services.

1. OPT-OUT / INFORMATION CORRECTION OR REMOVAL
   If any of the information that we have about you is incorrect, or you wish to have information (including
   Personal Information) removed from our records, please contact us at info@eddynow.com. Requests that
   relate to Client Data held for a contracting client may need to be directed through that client, and requests that
   relate to PHI will be handled in accordance with the applicable Business Associate Agreement and HIPAA.
   Additionally, if you prefer not to receive marketing messages from us, please let us know by clicking on the
   unsubscribe link within any marketing messages that you receive or by sending a message to us at
   info@eddynow.com. This election will not affect your receipt of messages from us associated with the
   Services.

2. INTERNATIONAL USERS
   Eddy is headquartered in the United States of America. Personal Information that you provide may be
   accessed by Eddy or transferred to Eddy in the United States. AI features are deployed on secured servers in
   the United States. By visiting our Sites or using our Services, you consent to this transfer. You explicitly
   acknowledge and consent to the fact that Personal Information will be stored and processed in the United
   States and will be subject to the laws of the United States, including the ability of governments, courts or law
   enforcement or regulatory agencies of the United States to obtain disclosure of your Personal Information.

3. CERTAIN CALIFORNIA RIGHTS
   If you are a California resident, California Civil Code Section 1798.83 requires select businesses to disclose
   policies relating to the sharing of certain categories of your Personal Information with third parties. If you
   reside in California and have provided your Personal Information to Eddy, you may request information about
   our disclosures of certain categories of Personal Information to third parties for direct marketing purposes.
   Such requests must be submitted to us by email at info@eddynow.com. Within thirty (30) days of receiving
   such a request, we will provide a list of the categories of Personal Information disclosed to third parties for
   third-party direct marketing purposes during the immediately preceding calendar year, along with the names
   and addresses of those third parties. This request may be made no more than once per calendar year. Eddy
   reserves the right not to respond to requests submitted other than to the address specified in this Section.

4. HIPAA
   Where Eddy creates, receives, maintains, or transmits PHI on behalf of a client that is a covered entity or
   business associate, Eddy acts as a business associate. Use and disclosure of that PHI is governed by the
   Business Associate Agreement between Eddy and the client, and by applicable HIPAA and HITECH
   requirements, in addition to this Privacy Policy.

5. CONTACTING US
   The Sites and Services are owned and operated by Ideal Privileges, LLC dba Eddy, PO Box 12, Trinidad,
   Texas 75163. If you have questions or suggestions regarding this Privacy Policy or our privacy practices,
   please send an email message to support@eddynow.com.