Privacy Policy

Last updated: October 2026

1. Scope and our services

10ly Health ("10ly," "we," "our") operates a digital health coordination platform at https://10ly.health. Depending on availability and eligibility, services may include patient intake, provider discovery and matching, scheduling, introductory virtual consultations conducted by independent clinicians, occupational and workers' compensation coordination, enterprise workflows, recovery and functional outcome monitoring, and AI-assisted operational analytics. Research activities, if introduced, will be subject to additional governance and notices. This policy explains our handling of information for activities for which we determine processing purposes. When we handle protected health information (PHI) for a HIPAA covered entity as its business associate, applicable law and our business associate agreement (BAA) control.

2. Different legal roles and HIPAA

HIPAA applies to covered entities and to business associates for specified obligations. 10ly's role may differ by service and relationship. Independent healthcare providers may be responsible for treatment, clinical records, and their own HIPAA Notices of Privacy Practices. This website privacy policy is not a substitute for any notice required of a covered entity under 45 CFR 164.520. If 10ly acts as a business associate, it processes PHI only as permitted or required by the applicable BAA or law and supports the covered entity's compliance responsibilities. Other personal and consumer health information may be regulated by federal and state privacy or consumer protection laws.

3. Information we collect

Depending on the service, we may collect: (a) identity and contact details, age and account credentials; (b) symptoms, reported conditions, injury details, functional limitations, care preferences, referral and scheduling information, and patient-reported outcomes; (c) employer, insurer, third-party administrator, case manager, claim identifiers, authorization and return-to-work coordination data; (d) provider credentials, specialties, availability and business contact information; (e) communications and support records; (f) device, IP address, browser, security logs, cookie and website usage information; and (g) information provided by authorized partners, healthcare professionals, or organizations. We limit collection and use according to the purpose, applicable law, and contracts.

4. How we use information

We use information to operate accounts and the platform; match patients with providers; coordinate appointments and permitted care communications; support authorized workers' compensation and occupational health workflows; administer enterprise services; respond to support inquiries; prevent fraud and security incidents; fulfill legal obligations; and perform permitted quality improvement and analytics. We do not treat patient intake as unrestricted permission for advertising, data brokerage, research, or AI training. Additional uses requiring authorization or consent will be undertaken only after the required permission is obtained.

5. AI-assisted processing and human oversight

Where enabled, AI systems may assist in intake organization, provider matching, workflow prioritization, care coordination insights, and outcome analysis. AI outputs may be incomplete or inaccurate and are not a substitute for licensed professional judgment. Any clinically consequential automated functionality must be separately assessed for appropriate oversight, safety, and applicable law. We do not authorize identifiable PHI to be used for general-purpose third-party model training merely because it is submitted to our platform. Any permitted training, evaluation, or model improvement use must have a documented legal and contractual basis and applicable safeguards.

6. When information is disclosed

Subject to applicable law, agreements, and permissions, we may disclose information to participating healthcare professionals; authorized payers, insurers, third-party administrators and nurse case managers; service providers supporting hosting, video, scheduling, messaging, security or analytics; and authorities when disclosure is legally required or permitted. Employers receive only information they are authorized to receive for a legitimate program or workers' compensation purpose; enrollment or payment by an employer does not create unrestricted access to clinical records. We may transfer information in a corporate transaction subject to applicable requirements. Research disclosures are addressed separately below.

7. Workers' compensation and enterprise access

Workers' compensation disclosures are governed by applicable workers' compensation and privacy laws, contractual terms, and valid authorizations where necessary. Information disclosed may include claim coordination status, appointments, treatment authorization, functional limitations, and return-to-work milestones when permitted. Role-based access should restrict employers, case managers, insurers, providers, and administrators to authorized data. Medical diagnoses, unrelated conditions, and full records are not automatically shared with employers.

8. Vendors, BAAs and subprocessors

We use service providers only under appropriate contractual restrictions. When a vendor creates, receives, maintains, or transmits PHI for a covered entity or business associate in a manner requiring a BAA, the appropriate BAA must be executed before that processing begins. Vendor access is limited to permitted services. Specific hosting, video, AI, analytics, messaging and security vendors and their processing locations must be verified against our current vendor inventory.

9. Cookies, tracking and advertising

Our public website may use essential cookies and permitted analytics. Sensitive intake, appointment, clinical and authenticated workflows require additional safeguards against inappropriate transmission of PHI or consumer health data to advertising or tracking vendors. We will honor applicable consent and opt-out requirements. A cookie banner or this policy alone does not authorize disclosures prohibited by HIPAA or other laws. Actual technologies and settings must be verified before publication.

10. Research, de-identification and secondary uses

Future clinical or operational research may involve de-identified, limited, or identifiable data only as permitted by applicable law and agreements. Identifiable PHI research may require an individual authorization or an applicable waiver or other permission, including institutional review where required. HIPAA de-identification standards must be satisfied before data is described as de-identified under HIPAA; pseudonymization alone may not be sufficient. No independent commercialization or licensing of identifiable health data is authorized by this policy.

11. Security safeguards

We maintain administrative, technical, and physical safeguards appropriate to the information and applicable obligations. These may include access controls, encryption, logging, incident management, workforce training, vendor oversight and risk assessments, to the extent implemented and verified. No electronic system is completely risk-free. We will provide legally required notices following applicable breaches or incidents. Specific security measures should not be publicly claimed unless confirmed by 10ly's security owner.

12. Retention and deletion

We retain information only as long as reasonably necessary for the relevant services, legal and regulatory obligations, contractual requirements, security, dispute resolution and clinical or claim recordkeeping. Retention periods differ by data type and responsible organization. We delete, de-identify or otherwise securely dispose of data when applicable retention obligations end. Deletion requests are subject to lawful exceptions, including medical record and claims retention duties. The company's approved retention schedule controls operational implementation.

13. Individual rights and requests

Depending on the data and applicable law, individuals may have rights to access, correct, amend, obtain copies, delete eligible information, receive certain disclosure accountings, restrict or object to certain processing, withdraw consent where applicable, and exercise available opt-out or appeal rights. HIPAA access, amendment, accounting and other PHI requests are generally handled by the responsible covered entity, with assistance from 10ly where required by a BAA. We may need to verify identity and may direct requests to the appropriate provider or plan. We will not retaliate against individuals for exercising applicable privacy rights.

14. Marketing and communications

We may send operational communications such as appointment confirmations, service updates, account notices and security alerts. Marketing messages are sent only as permitted by applicable law, and users can unsubscribe from promotional emails. Where applicable, consent is obtained for marketing or automated texts. Appointment or clinical communications must be configured to avoid unnecessary disclosure of sensitive information.

15. Children and geographic scope

The general consumer platform is intended for adults aged 18 and older, consistent with the published Terms of Use. Any authorized services involving minors require separate procedures and legally appropriate permissions. The intended geographic scope is States within United States of America. Cross-border processing, if any, is subject to applicable safeguards and disclosures.

16. State consumer health privacy requirements

Where applicable, additional state consumer health data or comprehensive privacy laws may require specific notices, consents, access or deletion procedures, restrictions on sharing, and appeal or opt-out rights. Any HIPAA or other statutory exemptions must be evaluated for the particular entity, data and activity rather than presumed to apply to the entire platform. Supplemental state notices will be provided where required.

17. Third-party clinicians and links

Participating clinicians and external services may have independent privacy notices and obligations. 10ly is not responsible for unrelated processing by independent third parties outside its control. Review the privacy notices of your healthcare provider and any third-party services you choose to use.

18. Changes to this policy

We may update this policy as our practices, services and laws change. We will post a revised effective date and provide additional notice or obtain permission when required for material changes. Prior disclosures or permissions do not automatically authorize materially new uses.

19. Contact and complaints

10ly Health | Website: https://10ly.health | General contact: contact@10ly.health | Telephone: 1-877-212-7263 | Publicly listed address: 301 North Harrison Street, Unit 200, Princeton, NJ 08540. Privacy-specific email/contact: provider@10ly.health. Registered legal entity: 10ly Health. For concerns involving a covered entity's PHI, individuals may also contact that covered entity or submit a complaint to the U.S. Department of Health and Human Services Office for Civil Rights, as applicable. We will not retaliate for filing a privacy complaint.

20. Additional notices

Depending on the activity, separate documents may include the covered entity's HIPAA Notice of Privacy Practices, a state consumer health data notice, telehealth consent, AI notice, workers' compensation data access notice, research authorization or consent, and cookie preferences. These notices supplement this policy and do not override applicable legal requirements.

21. SMS Data Privacy

10ly Health will not share consumer opt-in data and consent with any third parties for marketing/promotional purposes; excluding aggregators and providers of the Text Messaging services.