Privacy should be understandable before you share information with us.

CRIS respects the privacy of people who visit our website, contact us, request information or ask to see the platform.

This Privacy Policy explains what information we may collect through the public CRIS website, why we collect it, how it may be used, when it may be shared and the choices you may have regarding that information.

The public CRIS website is designed for business enquiries, product evaluation, educational content and communication with prospective customers, partners and other interested parties.

Please do not submit patient information, claim-level healthcare data or other sensitive healthcare information through the public website unless CRIS has specifically provided an approved secure process for doing so.

Contact CRIS Security & Trust

PRIVACY AT A GLANCE

Key points before you continue.

Use the full policy below for the complete details, scope and qualifications that apply to each point.

We collect only what we need

The public website may collect business contact information, enquiry details and limited technical information needed to operate and protect the site.

We do not need patient data for ordinary website enquiries

Contact, demo and procurement forms are not intended for patient names, medical record numbers, claim files, clinical information or other protected healthcare information.

We do not sell personal information

CRIS does not sell personal information submitted through the public website.

We use information for legitimate business purposes

This may include responding to enquiries, arranging demonstrations, providing requested information, improving the website, maintaining security and meeting legal obligations.

Scope & information

What this policy covers, what the website may collect and what should never be submitted through public forms.

WHAT THIS POLICY COVERS

This policy applies to the public CRIS website.

This Privacy Policy applies to personal information collected through CRIS public-facing websites, forms and related online interactions.

It may include information collected when you:

visit the CRIS website;
submit a Contact form;
request a demonstration;
ask a commercial or procurement question;
contact CRIS about security or technical matters;
download or request a resource;
subscribe to communications where that option is available; or
otherwise communicate with us through the public website.

This policy does not automatically govern information processed inside a customer deployment of CRIS.

Customer deployments may be subject to separate agreements, privacy terms, data-processing arrangements, security requirements and deployment-specific responsibilities.

INFORMATION YOU PROVIDE TO US

We collect the information needed to respond to you.

Depending on the form or interaction, you may provide information such as:

Full name
Work email address
Telephone number
Organisation name
Role or job title
Country or region
Organisation size
Nature of your enquiry
Areas of CRIS you are interested in
Preferred contact method
Information included in a message you send to us
Information you voluntarily provide during a commercial, technical, security or procurement discussion

We ask visitors to provide only information that is reasonably necessary for the purpose of the enquiry.

INFORMATION COLLECTED AUTOMATICALLY

Some technical information is created when you use a website.

Like most websites, the CRIS website may automatically receive limited technical information when you visit.

Depending on the website configuration, this may include:

IP address
Browser type
Device type
Operating system
Pages viewed
Date and time of access
Referring page or website
Approximate geographic region derived from technical information
Website performance information
Security and error logs
Session information
Cookie or similar technology identifiers where applicable

This information is generally used to operate, protect, measure and improve the website.

PLEASE DO NOT SEND PATIENT OR CLAIM DATA THROUGH THE PUBLIC WEBSITE

A website enquiry should not become an unintended healthcare-data transfer.

The ordinary CRIS website, Contact form and Request a Demo form are not intended to receive patient-level healthcare information.

Please do not submit information such as:

Patient names
Dates of birth
Medical record numbers
Member or beneficiary identifiers
Claim-level patient information
Clinical records
Diagnosis information
Treatment information
Patient screenshots
Remittance or claim files containing identifiable patient data
Documents containing protected health information or similarly sensitive healthcare information
Passwords or authentication credentials
Production database extracts
Other confidential information that your organisation is not authorised to disclose through a public web form

If your organisation needs to provide sensitive information as part of an authorised CRIS evaluation, implementation, support or production process, CRIS should first establish the appropriate approved channel and applicable contractual or security arrangements.

Use, communications & sharing

How website information may be used, marketing choices, cookies, analytics, service providers and external services.

HOW WE USE WEBSITE INFORMATION

Information is used to support the reason you contacted us.

CRIS may use information collected through the public website to:

Respond to enquiries
Arrange CRIS demonstrations
Provide requested product information
Respond to commercial questions
Support procurement and due-diligence discussions
Respond to security and technical enquiries
Communicate about an active business discussion
Provide resources you requested
Manage business relationships
Improve website content and usability
Understand which CRIS topics visitors find useful
Maintain website performance
Detect abuse, fraud or security threats
Investigate technical problems
Maintain appropriate business records
Meet legal, regulatory or contractual obligations
Protect CRIS, its users and its systems

Where permitted, CRIS may also use relevant business contact information to continue a legitimate business conversation related to an enquiry you initiated.

MARKETING COMMUNICATIONS

A business enquiry does not mean unlimited marketing permission.

Where CRIS sends promotional or educational communications, we aim to do so only where there is an appropriate basis for the communication.

Depending on the circumstances, that may include information you specifically requested, communications related to an existing business discussion or marketing permitted by applicable law.

Where an unsubscribe or preference option is required, it should be provided.

You may also contact CRIS if you no longer wish to receive non-essential promotional communications.

Operational, contractual, security or service-related communications may still need to be sent where they are necessary for an existing relationship.

COOKIES AND SIMILAR TECHNOLOGIES

The website may use limited technologies needed to function, protect itself and understand usage.

CRIS may use cookies, browser storage or similar technologies for purposes such as:

Maintaining website functionality
Remembering basic preferences
Protecting forms and sessions
Preventing abuse
Measuring website performance
Understanding how visitors use the site
Supporting analytics where configured

Cookies and similar technologies may be either temporary or persistent depending on their purpose.

Where consent is required by applicable law for non-essential technologies, CRIS should provide the appropriate consent or preference mechanism before those technologies are used.

The technologies actually used on the live website should be reflected accurately in this policy and in any cookie notice.

ANALYTICS

Website analytics should help us improve the experience, not create unnecessary profiles.

CRIS may use analytics tools to understand broad website behaviour, such as:

Which pages are visited
How visitors move through the website
Which devices and browsers are used
Which content attracts attention
Where technical problems occur
How visitors arrive at the site

Analytics information should be limited to what is appropriate for operating and improving the website.

CRIS should not describe analytics technologies in this policy unless they are actually deployed.

HOW INFORMATION MAY BE SHARED

We do not sell personal information.

CRIS does not sell personal information submitted through the public website.

Information may, however, be disclosed where reasonably necessary to organisations that help CRIS operate its website or business.

These may include providers supporting:

Website hosting
Cloud infrastructure
Email delivery
Business communications
Cybersecurity
Analytics
Customer relationship management
Technical support
Website maintenance
Professional advisory services

Such providers should receive only the information reasonably necessary for the service they perform and should be subject to appropriate confidentiality, security or contractual obligations where required.

CRIS may also disclose information where necessary to comply with applicable law, respond to lawful requests, protect legal rights, investigate fraud or security incidents or support a legitimate corporate transaction.

BUSINESS PARTNERS AND THIRD-PARTY SERVICES

External services have their own privacy practices.

The CRIS website may link to third-party websites or services.

For example, a visitor may be directed to an external meeting service, communication platform, documentation service or another authorised business system.

Once you leave the CRIS website, the privacy practices of the external provider may apply.

CRIS does not control the privacy policies of independent third-party websites merely because the website links to them.

Visitors should review the relevant third-party privacy information where appropriate.

Security, retention & transfers

Safeguards, retention and international handling of website information.

SECURITY

We use safeguards to reduce risk, but no public website can promise zero risk.

CRIS uses administrative, technical and organisational measures intended to protect website information against inappropriate access, disclosure, alteration, loss or misuse.

Depending on the system and environment, controls may include measures relating to:

Access control
Authentication
Encryption
Secure hosting
Logging
Monitoring
Backup
Vulnerability management
Software maintenance
Incident response
Data minimisation
Controlled administrative access

However, no website, network or Internet transmission method can be guaranteed to be completely secure.

Visitors should therefore avoid sending sensitive information through ordinary website channels where a secure alternative is required.

For more information about CRIS security architecture and production-readiness controls, visit:

Security & Trust

HOW LONG WE KEEP INFORMATION

Information should not be kept simply because storage is available.

CRIS may retain information for only as long as reasonably necessary for the purpose for which it was collected or for another legitimate business, legal, security or contractual purpose.

Retention may depend on factors including:

The nature of the information
The purpose for which it was collected
Whether a business relationship is active
Legal or contractual requirements
Security and audit requirements
The need to resolve disputes
The need to maintain appropriate business records

When information is no longer reasonably required, CRIS may delete, anonymise, aggregate or otherwise dispose of it in accordance with applicable processes.

INTERNATIONAL DATA HANDLING

Website services may involve systems located in more than one country.

Some service providers or technical infrastructure used by CRIS may operate in jurisdictions different from the visitor's own country.

Where personal information is transferred across borders, CRIS should apply the safeguards required by applicable law and relevant contractual arrangements.

The precise requirements may differ depending on the visitor's location, the service provider involved and the nature of the information.

Rights & lawful processing

Privacy rights, legal bases where required, and the website’s professional-use context.

YOUR PRIVACY RIGHTS

Depending on applicable law, you may have rights concerning your personal information.

These rights may include the ability to request:

Access to personal information held about you
Correction of inaccurate information
Deletion of certain information
Restriction of certain processing
Objection to certain processing
Withdrawal of consent where processing is based on consent
A copy of certain information in a portable format where applicable
Information about how your personal information is used

The rights available to you depend on the law that applies to the particular processing activity and may be subject to lawful exceptions.

CRIS may need to verify your identity before completing certain requests.

To make a privacy request, contact:

privacy@crisrcm.com

or use:

Contact CRIS

LEGAL BASIS FOR PROCESSING WHERE REQUIRED

Different activities may rely on different lawful grounds.

Where applicable privacy law requires CRIS to identify a lawful basis for processing personal information, processing may be based on one or more of the following:

Your consent
Steps taken at your request before entering into a contract
Performance of a contract
Compliance with a legal obligation
Legitimate business interests, where those interests are not overridden by applicable individual rights
Other grounds available under applicable law

The appropriate basis depends on the particular activity.

CHILDREN

The CRIS website is intended for professional and business use.

The public CRIS website is not directed at children and is not intended to collect personal information from children for consumer use.

If CRIS becomes aware that information has been submitted by a child in circumstances where collection is not appropriate, CRIS may take reasonable steps to remove it.

Customer data & healthcare context

The boundary between public website privacy and governed customer deployments.

CUSTOMER DATA IS GOVERNED SEPARATELY

Public website privacy and production data governance are not the same thing.

A customer organisation using CRIS may provide or process information under separate contractual and technical arrangements.

Those arrangements may address matters such as:

Roles and responsibilities for data processing
Permitted processing
Security requirements
Access controls
Data location
Retention
Deletion
Audit
Support access
Subprocessors
Incident handling
Healthcare regulatory requirements where applicable
Data return or transition arrangements

The specific obligations governing a customer deployment should be determined by the applicable customer agreement and associated documentation.

This public Privacy Policy does not replace those documents.

CRIS AND HEALTHCARE PRIVACY

CRIS should not imply that every website interaction is governed by healthcare privacy law.

CRIS is designed for use in healthcare revenue-cycle environments, but the legal treatment of information depends on the circumstances in which CRIS is deployed and the roles of the parties involved.

For example, whether a particular arrangement is subject to HIPAA, a Business Associate Agreement, another healthcare privacy law or another data-protection framework depends on the customer, deployment, information involved and applicable law.

CRIS should therefore not make unsupported statements that the public website itself is “HIPAA certified” or that every CRIS deployment automatically satisfies a particular legal framework.

Production commitments should be based on the actual implemented environment, contractual arrangements and documented controls.

AUTOMATED DECISION-MAKING

Public website enquiries are not intended to produce automated healthcare decisions.

CRIS may use ordinary website technologies to route, categorise, protect or manage enquiries.

The public website is not intended to make clinical decisions, determine patient eligibility, adjudicate healthcare claims or make other consequential healthcare decisions about individuals.

Where automated functionality is introduced in the future, this policy should be updated where required.

Updates & contact

Policy changes, effective dates and how to contact CRIS about privacy.

CHANGES TO THIS PRIVACY POLICY

The policy may change as the website and CRIS services develop.

CRIS may update this Privacy Policy from time to time to reflect changes in:

Website functionality
Service providers
Business processes
Legal requirements
Security practices
Privacy practices
CRIS products and services

When the policy is updated, the revised version should display an updated effective date.

Material changes may be communicated through additional means where appropriate or legally required.

EFFECTIVE DATE

Effective date: 20 September 2026

Last updated: 20 September 2026

Visitors should refer to the current version published on the CRIS website.

CONTACT US ABOUT PRIVACY

Questions about website privacy can be directed to CRIS.

For questions about this Privacy Policy, the handling of website information or a privacy request, contact:

CRIS Revenue Intelligence System

Privacy enquiries: privacy@crisrcm.com

General enquiries: info@crisrcm.com

Website: crisrcm.com

Contact CRIS

CUSTOMER OR PROCUREMENT REVIEW?

Need more than the public Privacy Policy?

Security, privacy, legal and procurement teams may require information beyond what belongs in a public website policy.

CRIS can separately provide or discuss applicable documentation relating to:

Security architecture
Privacy architecture
Deployment controls
Data-processing arrangements
Access controls
Retention and deletion
Subprocessor governance
Incident management
Production-readiness evidence
Customer-specific contractual requirements

PRIVACY PRINCIPLE

PRIVACY SHOULD NOT REQUIRE BLIND TRUST.

You should be able to understand what information you are being asked to provide, why it is needed and what happens after you provide it.

That principle applies to the CRIS public website and should continue into every governed CRIS deployment.

Review Security & Trust Contact CRIS