Legal

Privacy Policy

Version 2.0 · Effective September 28, 2026 · FinVerified, Inc.

1. Scope and Our Role

This Privacy Policy explains how FinVerified, Inc. (“FinVerified,” “we,” “us”) collects, uses, discloses, and protects personal information when you visit finverified.ai and its subdomains, use our free tools, communicate with us, or use the FinVerified platform as an authorized user of a customer (together, the “Services”).

When we act for our customers. Healthcare practices, dental service organizations, management services organizations, and lenders (“Customers”) use the Services to manage their own compliance workflows. When we process information on a Customer’s behalf, including information about patients, we act as the Customer’s service provider, processor, or business associate. That information is governed by our agreement with the Customer (including any Business Associate Agreement) and by the Customer’s own privacy practices. Patients should contact their healthcare provider with questions or requests about that information; see also our Patient Privacy Notice. We will assist our Customers in responding.

Protected health information. Where information is protected health information (“PHI”) under the Health Insurance Portability and Accountability Act (“HIPAA”), we use and disclose it only as permitted by the applicable Business Associate Agreement and HIPAA. See our HIPAA and PHI Statement. This Privacy Policy does not limit any right or obligation under HIPAA.

2. Information We Collect

Information you provide

• Contact and inquiry information: name, company, title, business email, phone number, number of locations, and the content of your message when you contact us or request a demo.
• Account information: name, work email, role, organization, location details, credentials, and preferences when you or your administrator create an account.
• Business and enrollment information: practice or lender details, licensing and ownership information, locations, and lender relationships needed to configure the Services.
• Billing information: billing contact details and transaction records. Payment card data is collected and processed directly by our payment processor, Stripe; we do not store full card numbers.
• Communications: support requests, feedback, survey responses, and records of our correspondence with you.
• Training and certification records: course progress, assessment results, and certificates for authorized users.

Free tools

Our free assessment tools calculate results in your browser from the answers and figures you enter. We do not ask for, and you should not enter, patient information into a free tool. If you choose to submit your contact details alongside results, we receive that information as an inquiry.

Information collected automatically

• Device and log data: IP address, browser and device type, operating system, referring URL, pages viewed, timestamps, and error and diagnostic data.
• Platform activity: actions taken in the Services, including audit-log events that record who did what and when. These records are part of the compliance evidence our Customers rely on.
• Cookies and similar technologies: see our Cookie Policy. Our marketing site does not use advertising or cross-site tracking cookies.

Information from others

We may receive information from Customers (for example, when an administrator invites you), from lender partners in connection with configured integrations, from our service providers, and from public sources such as professional licensing registries used for verification.

3. How We Use Information

• To provide, operate, maintain, and support the Services, including configuring disclosures, capturing consent, generating evidence records, and delivering training.
• To create and manage accounts, authenticate users, and administer subscriptions and billing.
• To communicate with you about the Services, security, billing, and policy changes, and to respond to inquiries.
• To send marketing communications where permitted, which you can opt out of at any time.
• To secure the Services, detect and prevent fraud, abuse, and security incidents, and enforce our terms.
• To analyze and improve the Services, including through aggregated or de-identified data that does not identify you, any patient, or any individual.
• To comply with law, respond to lawful requests, and establish, exercise, or defend legal claims.

AI features. Some features use artificial intelligence hosted by our infrastructure providers to generate summaries, coaching, and risk indicators. Our providers are contractually restricted from using Customer data to train their models, and we apply redaction controls designed to remove patient identifiers before content is sent for AI processing.

4. How We Disclose Information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We disclose information only as follows:

• Service providers and subprocessors that host, secure, communicate, process payments, monitor, or otherwise support the Services under contracts that limit their use of the information. Our current list is on our Subprocessors page.
• Customers. If you use the Services as an authorized user of a Customer, your account and activity information is available to that Customer.
• Lender partners and integrations that a Customer or patient directs us to connect with, only as needed for the configured workflow.
• Legal and safety. When we believe in good faith disclosure is required by law, subpoena, or legal process, or is necessary to protect the rights, property, or safety of FinVerified, our Customers, patients, or others.
• Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to this Policy and applicable confidentiality obligations.
• With your direction or consent.

5. Retention

We keep personal information for as long as needed for the purposes described in this Policy, including to provide the Services, maintain compliance evidence our Customers are required to preserve, meet legal, tax, and accounting obligations, resolve disputes, and enforce agreements. Retention of Customer data is governed by the applicable Customer Agreement. When information is no longer needed, we delete or de-identify it in accordance with our retention schedule, except where law requires longer retention.

6. Security

We maintain administrative, technical, and physical safeguards designed to protect information, including encryption in transit and at rest, field-level encryption of sensitive fields, role-based access controls, multi-factor authentication for administrative access, append-only audit logging, continuous monitoring, and vendor due diligence. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you and regulators as required by law.

7. Your Privacy Rights

Depending on where you live, you may have the right to:

• know and access the personal information we hold about you, and receive it in a portable format;
• correct inaccurate personal information;
• delete personal information, subject to legal exceptions;
• opt out of the sale or sharing of personal information, targeted advertising, or certain profiling (we do not engage in these);
• limit the use of sensitive personal information (we use it only as permitted to provide the Services);
• appeal a decision we make about your request; and
• not be discriminated against for exercising these rights.

We extend these rights to all U.S. users regardless of state of residence, to the extent they apply to the information we control. To make a request, email legal@finverified.ai with the subject line “Privacy Request.” We will verify your request using information associated with your account or inquiry, and we respond within the time required by law (generally 45 days). You may use an authorized agent, who must provide proof of authorization. If we deny your request, you may appeal by replying to our decision; if your appeal is denied, you may contact your state attorney general.

Requests about patient information held for a Customer should be directed to that healthcare provider or lender. We will forward requests we receive to the relevant Customer and support them in responding.

Global Privacy Control. We honor browser-based opt-out signals such as Global Privacy Control where required by law.

8. Marketing Choices

You can unsubscribe from marketing emails using the link in any message, or reply STOP to marketing text messages as described in our SMS Terms. We will still send transactional and service messages related to your account.

9. Children

The Services are directed to businesses and are not intended for children under 18. We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us and we will delete it. Information about a minor patient that a Customer processes through the Services is handled on the Customer’s behalf as described in Section 1.

10. Where We Process Information

We are based in the United States and process and store information in the United States. If you access the Services from outside the United States, your information will be transferred to and processed in the United States.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new effective date and, for material changes, provide notice by email or in the Services before the change takes effect.

12. Contact Us