Digital Privacy

Erlanger Privacy Notice for Digital Engagement and Navigation Services

Effective Date: July 17, 2025

This Privacy Notice describes how Erlanger (“institution,” “our,” or “we”) collects, uses, and shares personal information via our digital engagement and navigation services provided via web, mobile application (named ErlangerNow) , and/or on-premise kiosks (our “Services”). Our Services permit Erlanger patients and visitors (“Visitors”) and our employees or contractors (“Staff”) (collectively, “Users”) to: navigate effectively to and within our physical location(s); readily search and identify information about locations, physicians, and availability; link to applications that permit patients to schedule and manage healthcare services and appointments; and otherwise to interact with Erlanger.

For all Users who interact with Erlanger online, we collect information you choose to give us and other information that may be collected from your use of our Services, including from your device(s). We use that information to operate our business and for purposes set forth below. Below, we also describe choices we offer with respect to your information.

This Privacy Notice does not apply to third parties that may be linked from or otherwise accessible via the Services. This Privacy Notice does not apply to information that cannot be identified to any individual, household, or electronic device associated with an individual or household. In addition to this Privacy Notice, we may provide you other notices relating to other services or relating to protected health information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA). This Privacy Notice is not a HIPAA Notice of Privacy Practices.

Personal Information Collected

We collect the following information with respect to our Services:

Visitors

Personal Information Collected

1. Configuration information about your account / use of the Services. This includes profile information that may reveal some information about your health situation (e.g., “Childbirth,” “Cancer”).
2. Geo-location information.
3. IP address.
4. Logging and technical usage information when interacting with a Digital Service.
5. Support communications or other interactions with us or our providers.
6. Any information provided to us in free text fields, on forms, or in response to surveys (such as when you enter search words).

Key Information Uses

1. Facilitate your navigation to and through our facilities. This includes customizing your experience of the Services to provide personalized experiences that match your health situation.
2. Record details about your interactions and communications made through our Services.
3. Facilitate appointment scheduling by linking to other systems and applications outside of our Services.
4. Connect patients to internal and external providers.
5. Provide support.
6. Provide information about new or related services we may offer.

Staff

Personal Information Collected

1. Directory information including name, job title, professional credentials, specialties, and affiliations.
2. Contact data in the employment context including email, phone number, and home address.
3. Account login credentials. - Geo-location information.
4. IP address.
5. Logging and technical usage information when interacting with a Digital Service.
6. Support communications or other interactions with us.
7. Any information provided to us in free text fields, on forms, or in response to surveys.

Key Information Uses

1. Facilitate your navigation to and through our facilities.
2. Provide your location, directory information, and availability to Visitors and other Staff.
3. Facilitate the employment relationship.
4. Permit login to the Services including to access restricted maps and materials only available to Staff.
5. Record details about your interactions and communications made through our Services.
6. Manage account and provide support.
7. Provide information about new or related services we may offer.

In all cases, we may collect and use other information you choose to provide or with your consent.

Other Ways We Use Information We Collect

We may use the information we gather to operate our business and for a variety of purposes, including the following:

• To enhance, support, and manage our Services, including to maintain, analyze, customize, and improve your experience in connection with our Services.
• To communicate with you, including telling you about and administering our Services.
• To provide you information that you request from us.
• To provide customer and technical support.
• To monitor and enforce our contracts, legal terms, acceptable use or other policies or similar terms.
• To comply with law and satisfy our regulatory and compliance obligations. Additionally, to support compliance efforts on behalf of others and ourselves that support our provision of services. - To detect and prevent fraud and other prohibited, illicit or illegal activity, and to protect the rights and interests of you, others, and ourselves.
• To address existing or anticipated disputes.
• To otherwise operate our business, including support for transactions impacting our company as a whole (such as mergers, acquisitions, or asset purchases).
• To fulfill any other purpose for which you provide your information to us.
• For other purposes permitted by law, described to you when you provide your information or to which you consent.

As permitted by law, we may combine the information we gather about you in identifiable form, including information from third parties. We may use this information, for example, to improve and personalize our services, content and advertising.

How We Secure Information

We are committed to maintaining measures to protect the security of your information. Of course, despite these measures, no network or system is ever entirely secure and we cannot guarantee the security of networks and systems that we operate or that are operated on our behalf.

How We Share Information

We may share your information with third parties as reasonable to operate our business, to provide the Services to you and others, as permitted or required by law, or as directed or authorized by you. These third parties may collect personal information about your online activities over time and across third-party websites when you use our Services. We do not respond to “do not track” signals or other mechanisms that provide consumers the ability to exercise choice regarding the collection of personal information about an individual consumer’s online activities over time and across third-party websites or online services.

In some cases, third parties may use your information subject to their own privacy policies and to comply with their own legal and regulatory obligations . We work with different types of third parties, presently including:

• Information hosting, storage and cloud service providers;
• Payment processing companies;
• Security service providers;
• Technical and customer support providers; and
• Survey and analytics providers

Erlanger ensures through contractual agreements that all third parties with which we share personal data provide the same or equal levels of protection to such data that Erlanger is required to provide.

Key examples of third-party sharing:

Mobile device operating system navigation. We may share geo-location data and other information with your mobile device operating system to help you navigate to or within our facilities. We do not control how mobile device operating systems utilize this information.

Your mobile device may notify our application when you get near certain navigation destinations. In some cases, this may require you to enable background location settings within your device. This feature enables our application to provide an arrival notification, provide on-site wayfinding and other interaction relating to your arrival.

Gozio Inc. (our “Digital Provider”). Our Digital Provider provides comprehensive support for our Services. They may automatically collect certain information associated with your use of the Services, including IP address, information you input directly into the Services, websites that you link to or from, information from your mobile device or your computer about how you interact with the Services, including the date of the visit, the time of arrival and length of visit to the Services, the type of device used and the operating system on that device, browser type, a list of files downloaded or pages viewed, and any errors encountered. Digital Provider may use such information to provide services to us, and for analytics, to monitor and enhance security, to facilitate reporting, or to provide support.

Microsoft: Our Services include information from Microsoft Azure Maps to facilitate web-based navigation.

Epic MyChart: Our Services may link to MyChart, or MyChart functionality may be embedded within our Services. When you use MyChart functionality (to, e.g., schedule or update an appointment), your information is shared with MyChart.

Cloud service and storage providers: Erlanger, Digital Provider or others with whom we share information may store your information with cloud service and storage providers to facilitate the transfer, formatting, structuring, and storage of data and to facilitate access to data. Such cloud storage supports provision of the Services and our related services.

Professional advisors, law enforcement and regulators. Erlanger and its Digital Provider may share your information with professional advisors who provide legal, compliance, auditing, accounting, banking, insurance, consulting, or similar services, and with regulators, law enforcement, or government agencies to:

• Comply with our legal and regulatory obligations, including those compliance obligations of federal, state or local regulators;
• Conduct audits and manage financial, insurance, or other matters;
• Protect our interests, property or legal rights, or those of our customers or third parties;
• Respond to a subpoena, court order, or similar law enforcement request, or when we believe in good faith that the disclosure of personal information is necessary to prevent physical harm or financial loss, to report suspected illegal activity, or to investigate violations of this Privacy Notice or other applicable terms; and
• For other legal purposes, such as to enforce our terms and conditions, or to exercise or defend legal claims.

Corporate transaction. In the event of a corporate transaction, we may share your personal information with companies or other entities in connection with, or during the negotiation of, any merger, sale of company stock or assets, financing, acquisition, restructuring, divestiture or dissolution of all or a portion of our business, or other similar event.

Other disclosures. In addition to the above disclosures, we may disclose personal information in the event that we believe such disclosure is (i) necessary to provide our services or operate our business; (ii) in accordance with purposes we describe when you share it with us; (iii) permitted by law; or (iv) with your consent or at your direction.

What Choices Do I Have?

Update personal information. Our Services generally do not permit individual user accounts, with exception for Staff. If you are a Staff member who has an account with us, you may update certain personal information by logging in to your account. As permitted by law, we may deny a request to change information if we believe the change would violate any law or legal requirement, cause the information to be incorrect, or prevent the provision of our Services.

Marketing communications. You may receive marketing communications from Erlanger. You may opt out of receiving marketing emails by following the unsubscribe link in each email or otherwise made available to you. Please note that you may continue to receive non-marketing emails from us after you opt-out.

Cookies. Our Services may link to or embed content from third parties that include cookies and other analytics technologies. You have a number of choices regarding certain cookies. Most web browsers automatically accept cookies, but you may modify your browser’s setting to notify you of cookie placement or decline cookies. If you choose to decline cookies when accessing the Services, certain features of our Services may not function properly or at all as a result.

Updates to Our Privacy Notice

We may update this Privacy Notice from time to time in order to provide clarification or notice of changes to our practices. If we make changes, we will revise the Effective Date at the top of this Privacy Notice. Changes to this Privacy Notice will be effective once they are posted unless otherwise indicated. We may choose to notify you by email to the email address in our records.

Contact Information

If you have any questions or concern about this privacy notice or the privacy practices at Erlanger, please email: [email protected]