This Privacy Policy explains how IXB Inc. ("IXB," "we," "us," or "our") collects, uses, discloses, and protects information in connection with ixb.com, our business-to-business platform, and related services (collectively, the "Services").
IXB provides technology services to health plans, pharmacy benefit managers, and related healthcare organizations. Our Services are intended for business use and are not intended to provide medical advice, healthcare services, insurance coverage, pharmacy services, or benefits administration directly to individuals.
This Privacy Policy is intended to serve as IXB’s general U.S. privacy notice and, where applicable, notice at collection for website visitors and business contacts.
1. Scope and IXB’s role
This Privacy Policy applies to information we collect through our public website, business communications, and the Services.
When IXB processes information on behalf of a customer, we do so as a service provider, processor, contractor, business associate, or similar role under our agreement with that customer. In those cases, the customer controls the information and IXB processes it only as permitted by the applicable agreement, Business Associate Agreement, customer instructions, and applicable law.
This Privacy Policy does not apply to:
- third-party websites, products, or services that we do not control;
- employment, contractor, or job-applicant information unless we state otherwise;
- a customer’s own privacy practices; or
- protected health information handled under a Business Associate Agreement, except as summarized below.
2. Protected health information and customer data
The Services may process data submitted by or for IXB customers, including healthcare administrative data that may include protected health information ("PHI") under the Health Insurance Portability and Accountability Act and its implementing rules ("HIPAA").
When IXB creates, receives, maintains, or transmits PHI for a covered entity or another business associate, IXB does so as a Business Associate or subcontractor under a Business Associate Agreement ("BAA"). Our use and disclosure of PHI is governed by the applicable BAA, customer agreement, HIPAA, and other applicable law.
This Privacy Policy is not a HIPAA Notice of Privacy Practices. If you are a health plan member, patient, beneficiary, or other individual seeking to exercise rights regarding PHI processed for an IXB customer, please contact the relevant health plan, pharmacy benefit manager, provider, or other customer. IXB will support our customers in responding to such requests as required by our agreements and applicable law.
3. Personal information we collect
The information we collect depends on how you interact with IXB. We may collect the following categories of information:
| Category | Examples | Sources |
|---|---|---|
| Identifiers and business contact information | Name, business email address, business phone number, company, role, and similar contact details | You, your organization, our customers, or business partners |
| Internet, device, and usage information | IP address, browser type, device information, pages viewed, referring pages, dates and times of visits, cookie or similar identifiers, and approximate location derived from IP address | Automatically from your browser or device |
| Professional and commercial relationship information | Employer, job title, business role, customer or vendor relationship, and business communications | You, your organization, our customers, or business partners |
| Communications | Messages, requests, form submissions, support communications, and related records | You or your organization |
| Customer platform data | Data submitted to or processed through the Services by or for IXB customers, which may include healthcare administrative data, PHI, and related records | IXB customers, authorized users, vendors, and service providers acting for customers |
| Sensitive personal information | IXB does not seek sensitive personal information through the public website. Sensitive information may be included in customer platform data and, where applicable, is handled under customer agreements, BAAs, and applicable law | IXB customers or authorized users |
We do not collect every category of information from every person. We also may create or use aggregated, anonymized, or de-identified information where permitted by our agreements and applicable law.
4. How we use information
We use information for the following purposes:
- to provide, operate, maintain, secure, and support the Services;
- to create and manage business accounts and authorized-user access;
- to respond to inquiries, requests, and business communications;
- to manage customer, vendor, and business relationships;
- to monitor website performance, troubleshoot issues, and understand usage;
- to protect the security, integrity, and availability of the Services;
- to detect, prevent, investigate, or respond to fraud, misuse, security incidents, or unlawful activity;
- to comply with legal, regulatory, contractual, and audit obligations;
- to enforce agreements and protect our rights, customers, users, and others; and
- to create or use aggregated, anonymized, or de-identified information where permitted by applicable agreements and law.
IXB processes customer platform data only to provide the Services, as instructed by the relevant customer, and as permitted by applicable agreements and law.
5. How we disclose information
We may disclose information in the following limited circumstances:
| Recipient category | Purpose |
|---|---|
| Service providers and subprocessors | To host, operate, secure, support, analyze, and maintain the Services and our business systems |
| IXB customers and authorized users | To provide the Services and make customer platform data available to the customer or authorized users designated by the customer |
| Professional advisors | For legal, compliance, accounting, audit, insurance, and similar business purposes |
| Government, regulatory, legal, or safety recipients | When required by law, legal process, regulation, or governmental request, or when necessary to protect rights, safety, security, or the integrity of the Services |
| Transaction parties | In connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar corporate transaction, subject to appropriate protections |
We require service providers and subprocessors to handle information subject to contractual confidentiality, security, and data-protection obligations.
6. No sale, sharing, targeted advertising, or profiling
- IXB does not sell personal information.
- IXB does not share personal information for cross-context behavioral advertising.
- IXB does not use personal information for targeted advertising.
- IXB does not use website visitor personal information for profiling in furtherance of decisions that produce legal or similarly significant effects.
- IXB does not offer financial incentives or loyalty programs in exchange for personal information.
- IXB does not knowingly sell or share personal information of minors.
If IXB’s practices change, we will update this Privacy Policy and provide any required notices, choices, or opt-out methods.
7. Cookies and analytics
Our website uses cookies and similar technologies that are necessary to operate the site and may use limited analytics technologies to understand website performance and usage.
We do not use cookies or similar technologies to sell personal information, share personal information for cross-context behavioral advertising, or conduct targeted advertising.
You can usually control cookies through your browser settings. Disabling certain cookies may affect website functionality.
Where required by applicable law, we will recognize valid browser-based opt-out preference signals, such as Global Privacy Control, for activities subject to such signals. Because IXB does not sell personal information, share personal information for cross-context behavioral advertising, or use targeted advertising, such signals generally will not change our current practices.
8. Data retention
We retain information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Services, maintain business records, comply with legal and contractual obligations, resolve disputes, enforce agreements, and protect the Services.
Retention periods vary based on the type of information, the context in which it was collected, legal and contractual requirements, security needs, and the nature of our relationship with the relevant customer or user.
Customer platform data, including PHI, is retained and deleted according to the applicable customer agreement, BAA, customer instructions, and applicable law.
9. Security
IXB uses reasonable administrative, technical, and physical safeguards designed to protect information based on its nature and sensitivity. These safeguards may include access controls, encryption, logging, monitoring, security review, and workforce confidentiality measures.
No method of transmission, processing, or storage is completely secure. We cannot guarantee absolute security, but we work to protect information against unauthorized access, use, disclosure, alteration, and destruction.
10. Your privacy rights
Depending on your location, relationship with IXB, and applicable law, you may have rights regarding your personal information. These rights may include the right to:
- confirm whether we process your personal information;
- access personal information we maintain about you;
- obtain a copy of personal information in a portable format;
- correct inaccurate personal information;
- delete personal information;
- opt out of the sale of personal information;
- opt out of sharing for cross-context behavioral advertising or targeted advertising;
- opt out of certain profiling;
- limit or withdraw consent for certain uses of sensitive personal information, where applicable;
- appeal a decision we make regarding a privacy request; and
- be free from unlawful discrimination for exercising privacy rights.
These rights are subject to limits and exceptions under applicable law. We may need to verify your identity and authority before responding. If you use an authorized agent, we may request information confirming the agent’s authority and may also require you to verify your identity directly with us where permitted by law.
To submit a privacy request, email [email protected] with the subject line "Privacy Request."
To appeal a denied request, email [email protected] with the subject line "Privacy Appeal." If your appeal is denied, you may have the right to contact your state attorney general or privacy regulator, depending on applicable law.
If your request relates to customer platform data that IXB processes on behalf of a customer, we may direct you to that customer or forward the request to that customer. The customer is responsible for determining how to respond to requests regarding data it controls, and IXB will support the customer as required by our agreements and applicable law.
11. California and similar state privacy disclosures
This section provides additional information for residents of California and other states with similar privacy notice requirements.
In the preceding 12 months, IXB may have collected and disclosed the following categories of personal information for business purposes:
| Category | Sources | Purposes | Categories of recipients | Sold or shared? | Retention criteria |
|---|---|---|---|---|---|
| Identifiers | You, your organization, customers, business partners, devices | Communications, account administration, service delivery, security, compliance | Service providers, customers where applicable, professional advisors, legal recipients | No | As reasonably necessary for the relationship, Services, legal obligations, and security |
| Internet, device, and usage information | Browser, device, cookies, logs | Website operation, analytics, security, troubleshooting, fraud prevention | Service providers, security providers, analytics providers | No | As reasonably necessary for website operations, analytics, security, and legal obligations |
| Professional or employment-related business information | You, your organization, customers, business partners | Business relationship management, service delivery, support, compliance | Service providers, customers where applicable, professional advisors | No | As reasonably necessary for the business relationship, Services, legal obligations, and security |
| Commercial relationship information | You, your organization, customers, business partners | Customer, vendor, and business administration | Service providers, customers where applicable, professional advisors | No | As reasonably necessary for the business relationship, Services, legal obligations, and security |
| Communications | You or your organization | Responding to requests, support, relationship management, legal and compliance purposes | Service providers, professional advisors, legal recipients | No | As reasonably necessary to respond, maintain records, comply with law, and protect rights |
| Sensitive personal information, PHI, or health-related customer platform data | Customers, authorized users, or customer-directed sources | Providing the Services, security, compliance, and other purposes permitted by customer agreements, BAAs, and law | Customers, authorized users, service providers, subprocessors, legal recipients where required | No | According to customer agreements, BAAs, customer instructions, and applicable law |
IXB does not use or disclose sensitive personal information for purposes that require a right to limit under California law.
IXB has not sold personal information or shared personal information for cross-context behavioral advertising in the preceding 12 months.
IXB has no actual knowledge that it has sold or shared personal information of consumers under 16 years of age.
12. Consumer health data
IXB does not operate consumer-facing health services through the public website and does not intentionally collect consumer health data directly from individuals through public website forms.
IXB does not sell consumer health data.
IXB does not use geofencing around healthcare facilities to identify, track, collect information from, or send messages to individuals.
Customer platform data that includes health-related information, including PHI, is processed under customer agreements, BAAs where applicable, customer instructions, and applicable law.
If you believe you submitted consumer health data directly to IXB through the public website, contact us at [email protected] with the subject line "Consumer Health Data Request."
13. International visitors
IXB is based in the United States. If you access the Services from outside the United States, information may be processed in the United States or other locations where IXB or its service providers operate. Where required, we use appropriate safeguards for cross-border transfers.
14. Children’s privacy
The Services are intended for business use and are not directed to children. IXB does not knowingly collect personal information from children through the public website. If you believe a child has provided personal information to IXB, contact us so we can take appropriate action.
15. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date above. If changes are material, we will provide notice as required by applicable law.
16. Contact us
If you have questions about this Privacy Policy or IXB’s privacy practices, contact us at: