Third Horizon Privacy Policy

Overview and Scope

We at Third Horizon Strategies (dba Third Horizon, “we,” “our,” or “us”) recognize the importance of protecting the integrity and privacy of personally identifiable information (“Personal Information” or “PII”). To that end, this Privacy Policy (“Policy”) discloses our practices regarding the collection, use, and disclosure of the PII we receive when you interact with thirdhorizon.com, Starset Rate Compass at ratecompass.thirdhorizon.com, and any other website, application, or subscription platform we operate (together, the “Sites”) or through our services related to the Sites (together with the Sites, the “Services”), or when you otherwise interact with us. By using our Services or otherwise submitting information to us, you accept the terms of this Policy.

If you subscribe to Starset Rate Compass, this Policy applies alongside the Rate Compass Terms of Use. Where a conflict exists between this Policy and a separate data processing agreement Third Horizon has signed with your organization, that agreement controls.

Information We Collect

We are the sole owner of information collected by us or on our behalf. We collect several types of information, including:

Personal Information: We may collect PII from you when you complete forms, navigate web pages, create or log in to an account, subscribe to or use Starset Rate Compass, and in connection with other activities, services, features, or resources we make available. For purposes of this Policy, PII means any information that is linked or reasonably linkable to an identified or identifiable natural person. PII does not include publicly available information from government records, deidentified or aggregate information, or information excluded from the scope of “Personal Information” or “PII” as defined by applicable laws.

The types of PII we may collect, use, store, and disclose include the following categories of information:

Rate Compass Platform Data: The rate, benchmark, and pricing figures shown in Starset Rate Compass are drawn from insurer price transparency files and reflect market- and payer-level reimbursement information. This data is not an individual’s health information and is not Protected Health Information (PHI) under HIPAA. It does not identify, and is not derived from, any patient.

Sensitive PII: We may, if necessary, collect more sensitive categories of PII revealing: account log-in credentials, precise geolocation, racial or ethnic origin, date of birth, data concerning health (see also Consumer Health Data below), or data concerning a natural person’s sex life or sexual orientation (“Sensitive PII”). Any Sensitive PII collected will only be used to the extent necessary to provide the Services to you, or as otherwise permitted by applicable data privacy laws and regulations. Where a state law requires opt-in consent before we process Sensitive PII, we will obtain that consent before doing so.

Deidentified Information: We may collect deidentified information from you that may not by itself reasonably identify you as the source when you use the Services, or otherwise interact with us (“Deidentified Information”). Deidentified Information may include: (i) device type, (ii) device operating system, (iii) internet browser type, (iv) internet service provider, (v) referring/exit pages, (vi) date/time stamp, (vii) product and feature usage within Starset Rate Compass, and (viii) clickstream information. We will take reasonable measures to ensure that Deidentified Information we collect is not personally identifiable and may not later be easily used to identify you as required by applicable law.

Children’s Information: We do not offer or promote the Services to, nor do we intentionally collect or retain PII from, children who are younger than 13 years of age. Starset Rate Compass is a professional tool intended for use by adults working at or with health care organizations and is not directed to children. If we discover that we have inadvertently collected information from a child under 13 years of age, we will promptly take all reasonable measures to delete such information from our systems. Where applicable state law defines a minor as anyone under 18 for purposes of opt-in consent to sale, sharing, or targeted advertising, we will honor that standard for known minor users.

Consumer Health Data

Starset Rate Compass rate and benchmark information does not describe an individual’s health condition, diagnosis, or treatment. We do not use Rate Compass to infer an individual’s health status or to geofence health care facilities for tracking or advertising. To the extent information we process is subject to consumer health data privacy laws, we process it in accordance with the applicable requirements, including consent and consumer rights where required.

How We Collect Information

The information we collect depends on how you use the Services or otherwise interact with us. We collect PII and Deidentified Information in various ways, including:

Directly from You: We collect PII when you voluntarily provide it to us, including in connection with your use of the Services, when you create a Starset Rate Compass account, select the states or service lines included in your subscription, or use the Opportunity Calculator or provider lookup tools, or when you register for newsletters or updates, view publications, sign up for events, participate in public user posting areas (such as bulletin boards, discussion forums, and surveys), or otherwise directly engage with other activities, services, features, or resources we make available. The PII we collect depends on how you use the Services and how you choose to communicate with us.

Through Your Use of the Services: We, together with our service providers and partner organizations, may automatically collect information that your browser or application transmits when you use the Services. For Starset Rate Compass, product usage includes page views, content dimensions such as state, service line, level of care, and billing code, and tool-use and download events. We use this information to operate the Services, provide usage reports, and improve the product. Product usage analytics does not store raw search queries, entered rates or volumes, or letter contents. We may also use cookies and similar technologies to support sign-in and understand website visits.

Payment Information: When you purchase a Starset Rate Compass subscription, payment card information is collected and processed by our third-party payment processor, Stripe. Third Horizon does not store full payment card numbers on its own systems.

How We Use Information

We may use your PII for lawful business purposes, including to help enhance your user experience. These purposes include:

Providing our Services: We may use your PII to fulfill the purpose for which you provide it. For example, if you provide us with your email address to register for newsletters or updates, we will use that email address to contact you as requested. If you subscribe to Starset Rate Compass, we use your PII to create and administer your account, provision access to the states and tools included in your subscription, process payment and renewals, and provide customer support.

Direct Marketing: We may use your PII to send you promotional materials about our services and/or other items we believe would be of interest to you. You have the right to opt-out of receiving direct marketing at any time.

Customer Service and User Communications: We may use your PII to help us respond to your inquiries, questions, requests, and support needs more efficiently.

User Experience Personalization: We may use your PII to personalize your experience with the Services. For example, we may use your PII to tailor the content and information that we send or display to you, offer personalized recommendations, help, and instructions, or otherwise personalize your experience while using the Services. We may also use users’ PII and/or Deidentified Information in the aggregate to analyze browsing and usage activities and patterns in order to understand our users’ interests and preferences with respect to the Services. This will help us optimize your experience with the Services.

Business Optimization: We may use your PII and/or Deidentified Information to improve the content on our web pages, to customize the content and layout of our web pages, conduct internal research and development, administer surveys or market research, and in managing our everyday business needs. We may also use your feedback to improve the Services, including by monitoring, auditing, and analyzing trends, usage, and activities through the Services. All of this is done with the intention of making the Services more useful for you.

Safety and Security: We may use your PII and/or Deidentified Information to promote the safety and security of the Services, our users, and other parties. For example, we may use this information to authenticate users, facilitate secure payments, protect against fraud and abuse, respond to a legal request or claim, conduct audits, and enforce our terms and policies.

With Your Consent: We may use your PII in any other way we may describe to you at the time you provide the PII to us, or for any other purpose with your consent.

Artificial Intelligence and Automated Features: Third Horizon does not use customer account or usage data to train artificial intelligence or large language models. Starset Rate Compass does not currently include AI-assisted features.

We will not collect additional categories of PII or use PII we collected for materially different, unrelated, or incompatible purposes without providing you notice.

Automated Decision Making and Profiling

Third Horizon does not use Rate Compass subscriber PII to make automated decisions about the subscriber that produce legal or similarly significant effects, such as decisions about credit, employment, health care services, or insurance. We provide applicable privacy rights and processes relating to automated decision making and profiling where required by law.

Third-Party Use of Cookies and Other Tracking Technologies

Some content, including advertising content, displayed through our Services may be served by third-parties, including advertisers, ad networks and servers, content providers, and application providers. These third parties may use cookies alone or in conjunction with web beacons or other tracking technologies to collect information about you when you use our Services. The information they collect may be associated with your PII or they may collect information, including PII, about your online activities over time and across different websites and other online services. They may use this information to provide you with interest-based (behavioral) advertising or other targeted content.

We do not control these third parties’ tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly. For information about how you can opt out of receiving targeted advertising from many providers, see Your Privacy Choices below. Starset Rate Compass, as a paid subscription tool, does not serve third-party advertising to logged-in subscribers.

How We Disclose Information

We may disclose your PII to certain third parties for a business purpose as described below. Otherwise, we do not sell, share, or rent PII and will not disclose your PII to third parties without your permission.

To Our Affiliates and Partner Companies: We may disclose your PII to our affiliates, partner organizations, and other parties we consider to be supportive of our broader mission, including companies within the Third Horizon group. We may also disclose your PII to third party organizations and for-profit companies with whom we partner on specific initiatives, including to provide you with special member-exclusive offers, in which case those third parties may use your PII in ways comparable to those disclosed above. However, these third party organizations are never given direct access to our membership lists.

To Service Providers and Contractors: We may disclose your PII to service providers and contractors that assist us in providing user support, processing payments, marketing, advertising, communicating with clients, and promoting the Services, or that otherwise perform business functions on our behalf relating to the Services. For Starset Rate Compass, this includes Google/Firebase for hosting, authentication, and data storage; Stripe for payments; Resend for email delivery; Atlassian/Jira for support requests; and Slack for internal request notifications. We also use Google Analytics on the public Rate Compass homepage to understand visits, using browser identifiers and sanitized page, referrer, and campaign information. We do not send subscriber account or organization identifiers to Google Analytics. These providers process information under their applicable agreements and privacy policies. Certain providers may also process information for their own fraud prevention, security, legal compliance, or service improvement purposes as described in those terms.

Law Enforcement, Safety, and Legal Processes: We may disclose your PII to law enforcement or other government officials if it relates to a criminal investigation or alleged criminal activity. We may also disclose your PII: (i) if required or permitted to do so by law; (ii) for fraud protection and credit risk reduction purposes; (iii) in the good-faith belief that such action is necessary to protect our rights, interests, or property; (iv) in the good-faith belief that such action is necessary to protect your safety or the safety of others; or (v) to comply with a judicial proceeding, court order, subpoena, or other similar legal or administrative process.

Sale or Acquisition of Assets: If we become involved in a transaction involving the sale of our assets, such as a merger or acquisition, or if we are transferred to another company, we may disclose and/or transfer your PII as part of the transaction. If the surviving entity in that transaction is not us, the surviving company may use your PII pursuant to its own privacy policies, and those policies may be different from this Policy.

As Disclosed or Consented To: We may disclose your PII for any other purpose disclosed by us at the time you provide that PII, or otherwise with your consent. For example, we may provide you with the opportunity to selectively share your PII with a specific partner organization directly through the Services. By providing your PII on a partner organization page through the Services, you consent to our disclosure of your PII to that partner organization.

Security

The security and confidentiality of your PII is very important to us. We use commercially reasonable security measures to protect your PII. For Starset Rate Compass, these measures include encryption of data in transit, Google-managed encryption at rest for data stored in Firestore and Firebase Authentication, access controls for authorized Third Horizon staff who view subscriber account and billing data, and quarterly review of our hosting environment. However, no data transmitted over or accessible through the internet can be guaranteed to be 100% secure. As a result, while we attempt to protect your PII, we cannot guarantee or warrant that your PII will be completely secure (i) from misappropriation by hackers or from other nefarious or criminal activities, or (ii) in the event of a failure of computer hardware, software, or a telecommunications network.

California’s Privacy Rights

California Civil Code Section 1798.83, also known as the “Shine The Light” law, permits California residents who are users of the Services to annually request, free of charge, information about the PII (if any) disclosed to third parties for direct marketing purposes in the preceding calendar year. If applicable, this information would include a list of the categories of PII that were shared and the names and addresses of all third parties with which we shared information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to:

Third Horizon

Legal Department

320 South Canal Street, Suite 3030

Chicago, IL 60606

Other State Privacy Rights

Depending on where you live, the nature of your relationship with us, and the applicable privacy law, you may have the right to:

• Confirm whether we process your PII and access a copy of it;
• Correct inaccurate PII;
• Delete your PII;
• Obtain a portable copy of your PII;
• Opt out of the sale of your PII, targeted advertising, or certain profiling; and
• Appeal a decision we make in response to your request.

To exercise any of these rights, contact us as described in Your Privacy Choices below. We will not discriminate against you for exercising a privacy right. Where you designate an authorized agent to act on your behalf, we may require proof of that authorization.

Your Privacy Choices

We strive to provide you with choices regarding the PII you provide to us. We have created various mechanisms to provide you control over your PII, including:

Tracking Technologies and Advertising: You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, some parts or functions of the Services may be inaccessible or may not function properly. For Google Analytics, you can also use Google’s opt-out browser add-on, available at https://support.google.com/analytics/answer/181881. You may contact us at info@thirdhorizon.com to exercise applicable privacy choices.

Promotional Communications: You will only receive email newsletters from us if you have a) expressly signed up to receive emails from us through the Services or in person at events hosted by us; b) taken action on our behalf either online or in person; or (c) become a Third Horizon client, including as a Starset Rate Compass subscriber. You may subscribe or unsubscribe to any newsletter or email communication from us at any time. You may also elect to sign up to receive text message updates from us by providing us with the mobile phone number to which you wish to receive text messages. We do not charge recipients to receive text messages, however your own messaging and data rates may apply. If you decide that you no longer wish to receive communications from us, including promotional emails, text messages, and/or other direct marketing communications, you may opt-out of future communications at any time by: (i) using the unsubscribe link at the bottom of our communications; (ii) following any instructions included in the relevant communication; or (iii) contacting us via email at info@thirdhorizon.com or via U.S. mail at Third Horizon, 320 S Canal Street, Suite 3030 Chicago, IL 60606.

With your consent, we may also send promotional and non-promotional push notifications or alerts to your browser. You can deactivate these messages at any time by changing the notification settings on your browser. Please be aware that although you may opt-out of promotional emails, text messages and/or other direct marketing communications, we reserve the right to email you administrative notices regarding the Services and other non-promotional messages, as permitted under the CAN-SPAM Act. This includes administrative notices about your Starset Rate Compass subscription, such as billing, renewal, and data-availability notices, which are not promotional communications.

Sharing of Your Information for Third-Party Advertising: If you do not want us to share your PII with unaffiliated or non-agent third parties for promotional purposes, you can opt-out by sending us an email with your request to info@thirdhorizon.com.

Account Information: You may request access to, correction of, deletion of, or other control over your PII by emailing info@thirdhorizon.com. Please provide enough information for us to identify your records. We may request additional information to verify your identity before processing a request. Information provided for verification will be used only for that purpose and deleted when no longer needed for verification, subject to applicable legal requirements.

Other State Privacy Rights: Residents of certain states may have additional personal information rights and choices, including rights related to advertising and analytics activities that may be considered “sales” or “sharing” of your PII or “targeted advertising” under the laws and/or regulations that apply to you. Depending on where you reside, you may have the right to opt out of targeted advertising, sharing, and sales of your PII, in addition to other applicable privacy rights. See Other State Privacy Rights above. To exercise any of these rights, please send us an email with your request, including the specific rights you wish to exercise, to info@thirdhorizon.com. Please be aware that your rights are limited to the extent permitted by applicable law.

We will make commercially reasonable efforts to respond to privacy requests as quickly as possible and within the time required by applicable law. Where an extension is permitted and necessary, we will provide the notice required by that law.

Data Retention

We retain PII for as long as reasonably necessary to provide the Services and meet legal, accounting, security, and business needs. Cancellation of a Starset Rate Compass subscription does not automatically delete account or billing records. We delete or deidentify PII when it is no longer needed for those purposes, subject to applicable legal requirements.

Do Not Track Disclosure

Starset Rate Compass honors browser Do Not Track and Global Privacy Control signals for its first-party journey measurement by preventing new attribution and requesting withdrawal of an earlier account link. These signals do not automatically opt you out of Google Analytics. You can exercise other privacy choices described in this Policy through your browser settings or by contacting us at info@thirdhorizon.com.

SPAM

We do not participate in bulk email solicitations that you have not consented to receiving (i.e., “spam”). We do not sell or disclose customer lists or email address lists to unrelated third parties. Except as otherwise provided herein, we do not share PII with any third-party advertisers.

Third Party Links

The Services may contain links to other websites or applications (“Linked Sites”) that are not owned by us. We do not control the collection or use of any information, including PII, which occurs while you visit Linked Sites. Therefore, we make no representations or warranties for—and will not in any way be liable for—any content, products, services, software, or other materials available on Linked Sites, even if one or more pages of the Linked Sites are framed within the Services.

Furthermore, we make no representations or warranties about the privacy policies or practices of the Linked Sites, and we are not responsible for the privacy practices of those Linked Sites. We encourage you to be aware of when you leave the Services and read the privacy policies of Linked Sites.

Modifications

We reserve the right to update this Policy from time-to-time in our sole discretion. If our privacy practices change materially in the future, we will post an updated version of the Policy to this webpage. It is your responsibility to review this Policy for any changes each time you use the Services. We will not lessen your rights under this Policy without your explicit consent. If you do not agree with the changes made, we will honor any opt-out requests made after the Effective Date of a new privacy policy. For Starset Rate Compass subscribers whose data handling is affected by a material change, we will also provide notice by email where practicable.

Contact Us

If you have questions about this Policy, the information we have collected from you, or our privacy practices, please email info@thirdhorizon.com.

Effective Date

This Policy was last modified as of the effective date printed above. This version of the privacy policy replaces and supersedes any prior privacy policies applicable to the Services.