BillingFreedom^® Privacy Policy

BillingFreedom LLC

1. Introduction

BillingFreedom LLC ("BillingFreedom," "we," "us," or "our") respects your privacy. This Privacy Policy explains what personal information we collect when you visit billingfreedom.com and its subpages (the "Site"), submit a form, request a billing audit, or otherwise contact us, and how we use, share, and protect that information.

BillingFreedom LLC is a Delaware limited liability company with its principal office at 6136 Frisco Square Blvd., Suite 418, Frisco, Texas 75034. We provide revenue cycle management services to healthcare providers in the United States, including medical billing, coding, credentialing, accounts receivable follow-up, denial management, monthly reporting, and virtual medical assistant (VMA) support.

This Policy applies to the Site, our marketing and sales communications, job applications, and the business contact and account information we handle when administering our client relationships. It does not apply to protected health information ("PHI") that we handle on behalf of client practices. That data is governed by HIPAA and the Business Associate Agreement ("BAA") we sign with each client (see Section 6).

This Policy describes our practices. Where the law requires your separate consent for a particular use (for example, receiving text messages), we will ask for it at that time, and you may withdraw it as described in Section 11.

2. Information We Collect

Information you give us

We collect the information you provide when you:

• Submit a contact, quote, or billing audit request form (name, email address, phone number, practice or organization name, specialty, state, practice management or EHR system, approximate claim volume, and anything you type in a message field).
• Chat with the assistant on our Site (name, email address, specialty, practice name, and the questions you ask). The chat assistant runs on a third-party AI service that processes your messages on our behalf to generate replies (see Section 5).
• Book a call through our scheduling link (name, email address, phone number, meeting time, and time zone).
• Call, email, or text us, or subscribe to our articles or newsletter.
• Apply for a job with us (résumé, work and education history, certifications, and anything else in your application).
• Become a client (business contact details, billing and payment information, and the information needed to perform the services under your service agreement and BAA).

Information collected automatically

When you visit the Site, we and our service providers collect your IP address, browser type and version, device type and operating system, pages viewed, referring URL, date and time of visit, approximate location (city or region derived from IP address), and the identifiers set by cookies and similar technologies (see Section 4).

Information from other sources

We may receive business contact information from publicly available sources (such as the NPPES NPI Registry, state licensing boards, practice websites, and professional directories), from referral partners, and from advertising and analytics providers such as Google about how you reached the Site.

We do not request sensitive personal information, including patient information, Social Security numbers, insurance member IDs, or payment card numbers, through the Site's public forms or chat. Please do not include this information in messages or attachments. If we receive it inadvertently, we will restrict access to it and delete it, or return it through a secure channel, as appropriate.

3. How We Use Personal Information

We use the information we collect to:

• Respond to your inquiries, quote requests, and audit requests, and schedule and hold calls with you.
• Provide, administer, and improve our services for clients, including onboarding, account management, invoicing, and support.
• Send you articles, billing and coding updates, newsletters, and offers about our services. You can opt out at any time (see Section 11).
• Operate, secure, and improve the Site, understand how visitors use it, and measure the performance of our Google advertising.
• Evaluate job applications and make hiring decisions.
• Verify your identity and prevent fraud, abuse, and unauthorized access.
• Comply with legal obligations, enforce our agreements, and protect our rights, our clients, and others.
• Carry out any other purpose we describe to you at the time we collect the information.

We do not use information collected through the Site to make automated decisions that have legal or similarly significant effects on you.

4. Cookies and Similar Technologies

The Site uses cookies, pixels, and similar technologies. Some are set by us; others are set by third-party providers we use.

Your choices. We do not use Site data to build remarketing audiences, and we do not run Facebook, LinkedIn, or other social media advertising pixels. You can block or delete cookies through your browser settings; the Site will still work, but some features may not. You can opt out of Google Analytics with the Google Analytics opt-out browser add-on and manage your Google ad settings at adssettings.google.com. Blocking remote images in your email client limits open tracking but does not prevent tracking when you click a tracked link; unsubscribing stops future marketing emails. Because we do not use your information for targeted advertising and do not sell or share it, an opt-out preference signal such as Global Privacy Control (GPC) does not change how we process it. If our practices change, we will update this Policy, honor such signals as required by law, and provide any required choices before introducing materially different advertising practices. You may also contact us (Section 15) to exercise any applicable privacy choice.

We do not respond to "Do Not Track" browser signals, because there is no common industry standard for them.

5. How We Share Information

We do not sell your personal information, and we do not share it with third parties for their own marketing. We share information only in these cases:

• Service providers. Companies that host the Site and our systems, send email on our behalf, provide chat and scheduling tools, process payments, run analytics and advertising, and provide IT and security services. We require service providers to protect the information and use it only for the contracted services and other purposes permitted by applicable law and our agreements.
• Affiliates and related companies. Our affiliates and related entities under common ownership, including our operations team in Pakistan (see Section 8), for the purposes described in this Policy and under the same safeguards. Client PHI is accessed only through secured, company-controlled systems and only as permitted by the client's BAA.
• Professional advisors. Lawyers, accountants, auditors, and insurers, where needed.
• Legal and safety. Courts, regulators, law enforcement, or other parties when required by law, subpoena, or legal process, or when we believe disclosure is necessary to protect the rights, property, or safety of BillingFreedom, our clients, or others.
• Business transfers. A buyer, successor, or investor in connection with a merger, acquisition, financing, or sale of all or part of our business. We will require that the recipient honor this Policy.
• With your direction. When you ask us to share information, for example with a payer, clearinghouse, or software vendor as part of the services.

We may use or share aggregated or de-identified information that cannot reasonably be used to identify you. Where required by applicable law, we keep that information in de-identified form, do not attempt to re-identify it except as legally permitted, and require recipients to do the same.

6. Protected Health Information and HIPAA

When our services involve creating, receiving, maintaining, or transmitting protected health information (PHI) on behalf of a HIPAA-covered entity or another business associate, we act as a business associate or business associate subcontractor under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations. This may include billing, coding, accounts receivable, reporting, virtual medical assistant services, and other services that involve PHI. Our role depends on the information and functions involved, not the service name alone.

Our handling of PHI is governed by HIPAA, the HITECH Act, and the Business Associate Agreement we sign with each client, not by this Privacy Policy. Under those obligations we:

• Use and disclose PHI only as permitted or required by the applicable BAA and law, and apply the minimum necessary standard where required.
• Protect PHI with administrative, physical, and technical safeguards designed to meet applicable HIPAA requirements, including access controls, secure storage and transmission, and secured, company-managed workstations for staff accessing client systems.
• Report security incidents and breaches of unsecured PHI to the affected client as required by the BAA and the HIPAA Breach Notification Rule.
• Require the same protections from any subcontractor that handles PHI on our behalf.

If you are a patient of one of our clients, please direct questions about your health information, and any request to access or amend it, to your healthcare provider. We assist the provider with those requests as required by our BAA and applicable law, and respond directly only when authorized or required to do so.

Do not submit PHI through the Site. The contact, quote, audit, and chat features on the Site are not intended to collect patient information. If an audit or onboarding requires PHI, we will first execute the appropriate BAA and arrange a secure transfer channel with safeguards appropriate for PHI. Public marketing forms, advertising tags, and public AI chat tools are not approved channels for patient records.

7. Data Security

We protect personal information with administrative, technical, and physical safeguards appropriate to its sensitivity, including encryption in transit (TLS) on the Site, encrypted and access-controlled storage, multi-factor authentication for company systems, role-based access limited to staff who need it, secured and monitored company workstations, staff HIPAA and security training, and periodic security assessments.

No method of transmission over the internet or electronic storage is completely secure, so we cannot guarantee absolute security. If we learn of a security incident that affects your personal information, we will notify you and any regulators as required by applicable law. Please help us keep your information secure by not sharing login credentials and by contacting us right away if you suspect unauthorized access.

8. International Access and Processing

BillingFreedom LLC is based in Frisco, Texas, and our client-service systems are hosted in the United States. Our operations staff, including billers, coders, credentialing specialists, accounts receivable staff, and virtual medical assistants, work from Pakistan as employees of BillingFreedom or an affiliate under common ownership. We do not use independent freelancers or unrelated billing companies to perform these services; we do use the technology and other service providers described in Section 5.

Our Pakistan-based staff access personal information and client PHI only through secured, company-controlled systems, from company-managed workstations, and under the confidentiality obligations, training, and access controls described in Sections 6 and 7. Client agreements, BAAs, and any applicable restrictions govern access to client PHI.

This may involve information about website visitors, prospective clients, clients and their staff, and job applicants. The processing locations of our website, marketing, recruitment, and other technology providers depend on the services used, so the U.S. hosting statement above does not extend automatically to every third-party system; contact us (Section 15) for information about a specific provider. Privacy laws in Pakistan and other processing locations may differ from those where you live. We apply the safeguards described in this Policy and appropriate contractual protections to information accessed there.

9. Data Retention

We keep personal information only as long as needed for the purposes described in this Policy, unless a longer period is required by law, contract, or a legal hold. As a general guide:

These periods are subject to applicable law, legal holds, and retention needed to resolve disputes, keep required records, or establish or defend legal claims. A deletion request does not require us to remove information we are legally required or permitted to retain, and we keep limited suppression records to honor communication opt-outs. Client PHI follows the applicable BAA and law rather than our general schedule.

When information is no longer needed, we delete it or de-identify it. Backup copies may remain until overwritten under our backup retention schedule; they remain protected and their use is restricted.

10. Enhanced conversions

To measure our advertising more accurately, we may share the information you enter in a form (such as your email address or phone number) with Google in hashed, non-readable form so that Google can match it to an ad click on our behalf. Google acts as our service provider for this ad-measurement purpose only, and we obtain your consent for this sharing where the law requires it. We do not share patient information or any other content of your inquiry this way.

11. Your Privacy Rights

Depending on where you live and the laws that apply to the information and our activities, you may have the rights below. You may submit a privacy request regardless of your location: we honor rights required by applicable law and consider comparable requests voluntarily where a particular law does not apply, subject to the limits described below.

• Access — confirm whether we process your personal information and receive a copy of it.
• Correction — ask us to fix inaccurate or incomplete information.
• Deletion — ask us to delete personal information, subject to applicable exceptions.
• Portability — receive a copy in a portable, readily usable format where applicable.
• Opt out — opt out of sales or sharing of personal information, targeted advertising, and certain profiling where applicable. We do none of these today, so there is currently nothing to opt out of; if that changes, we will update this Policy and provide an opt-out.
• Sensitive information — limit certain uses or disclosures of sensitive personal information where applicable.
• Appeal — ask us to reconsider if we decline a request.
• Non-discrimination — exercise your rights without unlawful discrimination.

Texas residents

The Texas Data Privacy and Security Act (TDPSA) exempts covered entities and business associates governed by the HIPAA rules, and that exemption may apply to BillingFreedom. Texas residents may nevertheless submit requests using the process below. We offer an appeal process and provide a decision within 60 calendar days after receiving an appeal, or sooner if required by law. If we deny an appeal, our response will include how to submit a complaint to the Texas Attorney General.

California residents

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA), applies where its coverage thresholds are met and relevant exemptions do not apply. PHI handled under HIPAA is exempt; that exemption does not automatically cover ordinary website, marketing, recruitment, or business-contact information. Where the CCPA applies, California residents may exercise its rights, including the rights to know, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive non-discriminatory treatment.

We do not sell personal information or share it for cross-context behavioral advertising, as those terms are defined by the CCPA, and have not done so during the preceding 12 months. The categories of personal information collected during that period are described in Section 2, the purposes in Section 3, and the recipient categories in Section 5. We do not request sensitive personal information through public forms or chat. Under California's "Shine the Light" law (Civil Code § 1798.83), you may ask whether we have disclosed personal information to third parties for their own direct marketing purposes; we have not and do not.

Residents of other states

You may exercise the rights available under your state's privacy law through the same contact methods. Whether a particular statutory right applies depends on that law's coverage, exclusions, and exemptions.

How to submit a request

Email info@billingfreedom.com with "Privacy Request" in the subject line, call (855) 415-3472, or write to the address in Section 15. Tell us which right you are exercising and give us enough information to locate your records. Do not include patient records, government identification numbers, or other unnecessary sensitive information in your request.

Verification and authorized agents

We verify identity where necessary and legally permitted, such as for requests to access, correct, or delete records, and we request only the information reasonably needed for that purpose. We do not require identity verification for sale or sharing opt-outs where the law prohibits it, although we may need information to identify the records or browser affected. You may authorize an agent to make a request on your behalf; we may ask for proof of that authorization and for verification permitted by applicable law.

Response times

We respond to access, correction, deletion, and portability requests within 45 calendar days of receipt, or any shorter period required by applicable law, and acknowledge them within 10 business days where the CCPA requires it. Where an extension is legally permitted and necessary, we will explain the reason and the revised deadline within the initial period; the extension will not exceed 45 more calendar days unless the applicable law allows a different period.

Appeals

If we decline a request, we explain why and how to appeal. Reply to our decision or email info@billingfreedom.com with "Privacy Appeal" in the subject line. We provide a written appeal decision within 60 calendar days of receipt, or any shorter period required by applicable law, and include the relevant regulator complaint route where required.

Advertising and communication opt-outs

Where an applicable sale, sharing, or targeted-advertising opt-out right exists, we implement the request as soon as feasible and within the applicable deadline — no later than 15 business days after receipt for CCPA sale or sharing opt-outs and sensitive-information limitation requests. We process marketing email unsubscribes within 10 business days and text message STOP requests promptly within applicable legal and provider deadlines (see Section 11).

Fees and exceptions

We do not charge for requests except where applicable law permits a reasonable fee for a manifestly unfounded, excessive, or repetitive request. We may decline all or part of a request where the law allows, including where required records must be retained, identity cannot be verified when necessary, or the information is needed for permitted security purposes or legal claims. We do not treat a contractual obligation as a blanket exception to statutory deletion rights. Any refusal will explain the reason and how to appeal.

Visitors outside the United States

Our Site and services are intended for healthcare providers in the United States, and we do not direct them to individuals in the European Economic Area, the United Kingdom, or Switzerland. If you contact us from elsewhere, your information is processed and accessed as described in Section 8. If the EU or UK General Data Protection Regulation nonetheless applies to you, we rely on our legitimate interest in responding to business inquiries and administering our business, contractual necessity, legal obligations, or your consent where required. You may exercise the rights above, object to processing based on legitimate interests or to direct marketing, withdraw consent without affecting earlier processing, or complain to your supervisory authority, and we will respond within the time that law requires.

12. Communications and Opt-Out

Email

If you ask about our services or sign up for our articles or newsletter, we may email you about billing and coding updates, our content library, and our services. Every marketing email includes an unsubscribe link, or you can email info@billingfreedom.com to opt out. We may still send you transactional messages about an active request or engagement.

Phone

If you give us your phone number, we may call you about your inquiry. You can ask us to stop calling at any time.

Text messages (SMS)

We send text messages only within the scope of the consent you give us and applicable law. Giving us your mobile number does not by itself enroll you in recurring text messages. We obtain consent through a clear, SMS-specific opt-in, such as an optional consent checkbox on our forms or another documented method appropriate to the message type. If we use a confirmation text, we first obtain your agreement to receive it, and your affirmative reply confirms the enrollment it describes.

If you text us first, we may reply about that inquiry. An incoming message does not enroll you in recurring updates or promotional campaigns; recurring messages require a separate opt-in, and promotional messages require any additional consent, including written consent, that applicable law and our messaging provider require.

With your consent, we may text you to confirm or schedule a call, follow up on your request, or send relevant service updates. We keep a record of the number, the date, time, and method of consent, and the message categories it covers. Message frequency varies. Message and data rates may apply. Consent to receive text messages is not a condition of purchasing any service.

Reply STOP to opt out at any time and HELP for help; you may also contact us (Section 15) or use another opt-out method recognized by applicable law or our messaging provider. We process opt-outs promptly within applicable deadlines and then stop further messages within the opt-out's scope, except for a permitted, non-promotional confirmation. A later enrollment requires a new opt-in.

Your mobile phone number and SMS opt-in information will not be shared with third parties or affiliates for their marketing or promotional purposes. We provide this information to messaging service providers only as needed to operate the messaging service and meet applicable requirements.

Patient messages sent on behalf of a client practice, such as appointment reminders, are handled under that practice's instructions, its patient notices, and the BAA, and must also meet applicable patient-consent, telecommunications, privacy, and messaging-provider requirements. A BAA or practice instruction does not replace any patient consent that is independently required.

13. Children's Privacy

The Site is intended for healthcare professionals and businesses. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us at info@billingfreedom.com and we will delete it.

14. Third-Party Websites and Services

External websites

The Site links to independently operated websites, including payer and government resources, our social media pages, and review platforms. Their collection and use of information are governed by their own policies; review those policies before providing information to them.

Embedded and contracted services

We also use chat, scheduling, payment, analytics, and other providers to support our Site and services. Information they process on our behalf is covered by this Policy and our agreements with them. If you separately create an account with a provider or use its own services, its privacy notice may also apply. Linking to a provider's policy does not remove BillingFreedom's responsibilities under applicable law.

15. Changes to This Policy

We may update this Policy from time to time. When we do, we will post the revised Policy on the Site and update the effective date at the top. If a change materially reduces your rights, we will give you notice by email or a prominent notice on the Site before it takes effect. The revised Policy applies from its effective date. Where a change requires your consent under applicable law, we will ask for it before the change applies to you.

16. Contact Us

Questions, requests, or complaints about this Policy or our privacy practices:

BillingFreedom LLC
6136 Frisco Square Blvd., Suite 418
Frisco, Texas 75034, United States
Phone: (855) 415-3472
Email: info@billingfreedom.com
Website: billingfreedom.com

BillingFreedom LLC is a Delaware limited liability company and a BBB Accredited Business. BILLINGFREEDOM^® is a registered service mark of BillingFreedom LLC (U.S. Reg. No. 8,420,571).