Privacy Policy

Virsys12 Privacy Policy

Last updated March 5, 2026

This Privacy Policy for Virsys12 (“Privacy Policy”) explains how we collect and treat information when you visit Virsys12.com (the “Site”) or use one or more solutions offered through our App Suite or receive related services from Virsys12 (collectively, our “Services”). Virsys12 Services are provided by HealthStream, Inc. along with its subsidiaries and affiliates (collectively, “HealthStream,” “us” or “we”). This Privacy Policy is part of and governed by your agreement with us to use our Website or other Services. Any additional notices that we provide to you about our privacy practices will also be considered to form part of this Privacy Policy.

If you have questions about our privacy practices or would like to make a complaint, please contact privacy@HealthStream.com.

For information about Virsys12 or our Services, you can Contact Us online, by email at solutions@virsys12.com, or by mail to:

Virsys12

500 11^th Ave. N, Suite 850Nashville, TN, 37203

United States

We may periodically update this Privacy Policy. If we make any material changes, we will notify you through the Services or by updating this posting. Your continued use of the Services after the effective date will be subject to the new Privacy Policy. You are responsible for checking this Privacy Policy for changes.

Our Privacy Promise

We value you and your privacy, and we want you to understand how we treat and protect your information. Here is a summary of our promise to you, as detailed in this Privacy Policy:

• The Services collect and process publicly available Provider data to provide network management, credentialing, contract automation, and related services. Personal Information that we collect is limited to Users’ login and account information and any Personal Information contained within the publicly available Provider data.
• Virsys12 Services do not process protected health information protected by HIPAA or other sensitive information. Do not submit HIPAA or other sensitive information to the Services.
• The Site uses cookies to provide certain content and for advertising purposes. See the Cookie Notice in Section 5 for details.
• You can always control your data, either directly through your account or by contacting us for help. See Section 8 for details.
• A notice of privacy rights is provided in Section 9.
• We do not sell your Personal Information.
• Some disclosures of Personal Information to HealthStream Partners may qualify as sharing for cross-contextual advertising purposes. See Section 3(c) for details.
• This Privacy Policy DOES NOT apply to information collected while using a website or platform owned or operated by a third party, or to other services offered by HealthStream.

We encourage you to read this Privacy Policy in full to understand in detail how we collect and use information through the Services. By using or accessing our Services in any manner, you consent to the privacy practices described in this Privacy Policy. If you do not agree with this Privacy Policy, do not use the Services.

1. Personal Information Defined

When we say, “Personal Information,” we mean information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual consumer or household. For our purposes, Personal Information typically falls within one or more of these categories:

• Identifiers (e.g., name, email address, address, telephone number, username);
• Sensitive Personal Information (e.g., racial or ethnic origin; biometrics; union membership; state ID; precise geolocation; contents of messages when we are not the recipient; as well as health data, protected health information, and similar data protected by health privacy laws; and other health information generally);
• Protected classification information (e.g., race, citizenship, marital status, medical condition, sex, sexual orientation, veteran or military status);
• Biometric information (e.g., image, keystrokes, behavioral or biological characteristics);
• Internet or other similar activity (e.g., general location, content interactions, browsing history);
• Employment-related information (e.g., current or past employment);
• Non-public educational information, including information protected under the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99);
• Commercial information (e.g., products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies); and
• Inferences drawn from Personal Information to create a profile about preferences, characteristics, trends, predispositions, behavior, attitudes, intelligence, and aptitudes.

Note that some information about you may not be protected by privacy laws, for example, information that is: (a) publicly available; (b) aggregated, meaning data about a group or category of services or users from which individual identities and other Personal Information has been removed; or (c) deidentified so that it cannot be easily linked back to the individual.

2. Virsys12 Services

The Services provide network management, onboarding, credentialing, and automation services. To do this, we collect and process publicly available Customer credential and related data about healthcare providers (“Providers”) on behalf of payors and other customers that engage Virsys12 to use the Services (“Customers”). Virsys12 serves Providers and Customers in the healthcare industry, but the Services are not designed to and do not collect or process information that is protected under health privacy laws. In fact, we do not process any sensitive Personal Information as part of the Services. DO NOT submit protected health information or OTHER SENSITIVE INFORMATION to the Services.

Other HealthStream products or services may process health privacy information to provide certain services to the Customer. Any such processing is subject to the HealthStream Privacy Statement and pursuant to a business associate agreement with the Customer.

In all cases, the Customer is solely responsible for ensuring that use of the Services by the Customer and its end users (“Users”) complies with health privacy and other applicable laws. If you have questions, please contact the Customer through which you use the Services.

3. Our Privacy Practices
   1. About Personal Information Collection

How we collect and use your Personal Information depends on which of our Services you use and how you use them. In any case, we only collect, use, retain, and disclose Personal Information as reasonable and necessary and proportionate to provide you with the Services, or we might use it in other compatible ways that we would tell you about first. During the last 12 months, we have collected (i) identifiers; (ii) employment-related information; (iii) commercial information; and (iv) internet activity as follows:

1. Your communications with Virsys12. If you contact us through the Site, by email, or otherwise, to inquire about the Services or to receive Customer support or consulting services, you voluntarily provide us with your:
   • Identifiers like your name, email address, telephone number, mailing address, and any other Personal Information you choose to include in your message.
   • Employment information like your job title and organization type (e.g., hospital, home health facility, etc.).

We use this information to respond to your inquiries and to communicate with you about HealthStream according to your communication preferences. If you opt-in to marketing communications from us, we may also use this information to send you promotional information in alignment with your stated communication preferences.

2. Your use of the App Suite. The Services provide Customers with a complete solution for managing provider data and ongoing data maintenance across an organization from onboarding and credentialing to contract management and fee schedules to claims activation.
   • The App Suite leverages Salesforce technology, subject to Salesforce terms and conditions and privacy practices.
   • You can access the Services through your Salesforce login, subject to the Salesforce privacy practices and terms and conditions.
     1. You may have the option to access the Services through your hStreamID. To get an hStreamID, you must register and create an account. This includes submitting identifiers like your name, email address, mailing address, and phone number, as well as your login credentials to create your account. In some cases, we also collect your employment and educational information like your title, credentials, specialty, and your education and work status and history. If you include a photograph to your account profile, we will collect the biometrics contained in the photograph you upload.
     1. A Customer might create your User account or submit information about you to the Services, such as your identifiers like your name, email address, and login credentials and your job title.
     1. Customer data resides and is processed on Salesforce servers within the Customer’s Salesforce database. We do not have access to the Customer’s data on the Salesforce database.
     1. V12 PDE sometimes transfers Provider directory data from Salesforce to a Virsys12 server for processing. V12 PDE is the only solution in the App Suite that processes Customer data in this manner.
     1. The Services use Salesforce artificial intelligence for certain automation features. This processing occurs on Salesforce infrastructure and subject to Salesforce terms and conditions. You can read more about Salesforce artificial intelligence technology here.
3. Automatically from your use of the Site. When you visit the Site, we automatically collect technical data about your device and session on the Site, such as your IP address, device ID, browser type, operating system, and the content with which you interact. In some cases, we may also collect geolocation data. We use this data for diagnostic, usage and performance purposes and to better understand how visitors interact with the Site. We collect this data to achieve our legitimate interest of managing and improving our Services.

Additionally, certain third parties place cookies and related technologies on the Site which will collect data, including Personal Information, from your activities on the Site. Cookies are described in detail in the Cookie Notice provided in Section 5. If you opt to permit marketing cookies on our Site to interact with your device, the data collected through marketing cookies may be used to deliver targeted ads to you.

4. From our marketing resources. We may obtain Personal Information related to potential new Customers or other growth opportunities from third parties like our marketing partners, affiliate programs, or public databases. This information may include name, job title, email address and/or mailing address, phone number, or commercial history, as well as social media (e.g., LinkedIn) profiles. We process this Personal Information to achieve our legitimate interest of marketing the Services, and we only use it in a manner that aligns with the purpose for which the individual made the information available to us or our marketing resource.

In addition to the specific uses above,we might also use your Personal Information to (i) provide the Services and personalize your experience; (ii) send you support and administrative messages; (iii) monitor your compliance with any of your agreements with us; (iv) protect your privacy and enforce this Privacy Policy; (v) identify, contact, or bring legal action against persons or entities who may be causing injury to you, to HealthStream, or to others if we believe it is necessary; (vi) comply with a law, regulation, legal process or court order; or (vii) fulfill any other purpose to which you consent. HealthStream will update this Privacy Policy or otherwise notify you and obtain your consent where required under applicable law before we collect additional categories of Personal Information or use your Personal Information for purposes that are incompatible with the purpose stated at the time of collection.

2. About Retention Periods

HealthStream retains Personal Information for the minimum period necessary to fulfil the purpose of collection. Sometimes our retention periods are determined by the regulations or policies that apply to the Customers or Users of a given Service. This means HealthStream may be required to retain Personal Information for a specified period or indefinitely, unless or until a User requests that we delete some or all of their Personal Information. HealthStream’s data retention practices are designed to ensure that our Services to serve as a secure repository of information in healthcare settings, comply with regulatory requirements, and support a policy of good data hygiene. We will delete, de-identify or anonymize your Personal Information when we have no ongoing legitimate business need to process it. We reserve the right to retain Personal Information for longer periods if necessary to comply with a legal or contractual obligation.

3. About Our Partners

From time to time, HealthStream partners with other companies that want to offer discounts, promotions, or other offers exclusively to our Users (“Partners”). These offers are posted on the Services as advertisements and users receive the promotion when they click through and purchase the product or service from the Partner. Any Personal Information you submit to the Partner when you make a purchase or sign up for services is subject to the Partner’s privacy practices, not ours. You consent to this processing by clicking the ad and interacting with the Partner. If you don’t want a Partner to have this Personal Information about you, do not click on the ad or engage the Partner for products or services. We may earn a commission from your purchase with a Partner.

Please note that HealthStream and the Partner may exchange user data to facilitate your use of our Services along with the products or services offered by the Partner. The Partner is strictly required to keep all disclosed data confidential and to only use the data to fulfill the contract with us. For example, we may provide user data (e.g., username, employer, hire date) to the Partner or the Partner may report to us whether a user participated in a promotion. We may use the data received from the Partner for any purpose as permitted by this Privacy Policy and applicable law.

You can prevent the disclosure of your information in this manner to the extent that this exchange of data qualifies as “sharing” Personal Information under privacy laws by adjusting your account settings to opt-out of sharing. Please note that opting out may make it impossible for the Partner to provide you with the promotion. For clarity, neither HealthStream nor the Partner will never sell your Personal Information to one another or to any third party.

4. About Disclosures to Third Parties

We only disclose your Personal Information in limited circumstances and for specific purposes. If any Service allows for social connectivity or sharing, we will notify you of the privacy implications of using the feature before you proceed. In the last 12 months, HealthStream has disclosed all categories of Personal Information that we collected for a business purpose to these recipients:

1. The Customer. If you are a User with access to the Services through a Customer, Virsys12 processes your Personal Information as a service provider to that Customer. We may disclose any Personal Information associated with your account or your use of the Services to the Customer as necessary under our contract with the Customer.
2. Our Service Providers. We use a variety of service providers such as data hosting companies, analytics services, email hosting services, Google Maps, and payment processors. We prohibit our service providers from selling or disclosing the Personal Information we provide, and we require all service providers to maintain confidentiality standards that are commercially reasonable to ensure the security of your Personal Information. The type of information that we provide to a Service Customer will depend on the service that they provide to us.
3. Our Affiliates. As a part of the HealthStream family of services, we may disclose the Personal Information we collect about you to our affiliates or subsidiaries. If we do disclose your Personal Information to our affiliates or subsidiaries, their use and disclosure of your Personal Information will be subject to this Privacy Policy. Additionally, we may disclose Personal Information to our Partners, which the Partner must keep confidential and only use for its contractual obligations to us.Cookie Providers and Advertisers. Providers of third-party cookies, advertisers or our Partners may place ads on the Services. If you click on an ad, you will be redirected to the advertiser’s website or platform. Any information you provide to the advertiser will be processed according to the advertiser’s privacy practices, not ours. We may collect data about the ads you click from the Services to measure the popularity and effectiveness of ads on the Services. We also place cookies and pixels on the application to track and report on content interactions and to serve you with tailored advertisements when you visit social media and other platforms. This processing allows us and our advertisers to better understand how individuals interact with the Services and its features and to inform advertisers of the offers that most interest current and potential new Customers. You can opt out of these disclosures by not interacting with ads on the Services. Please note that if you directly interact with an advertiser, the advertiser will process your Personal Information according to its privacy practices.Law enforcement or other government agencies as permitted or required by law.Other Third Parties, as permitted by applicable law. For example: if we go through a business transition (e.g., merger, acquisition, or sale of a portion of our assets); to comply with a legal requirement or a court order; when we believe it is appropriate in order to take action regarding illegal activities or prevent fraud or harm to any person; to exercise or defend our legal claims; or for any other reason with your consent.
4. Aggregated and De-Identified Data. HealthStream may use fully anonymized, de-identified or aggregated data (where the Personal Information has been removed) to assist with our development, marketing, or other purposes. This information is not your Personal Information, so we may do this for our purposes and without restriction.

4. Children’s Privacy

Our Services are designed for individuals aged 18 and older. We do not knowingly collect Personal Information from anyone under the age of 18 without verification of parent or guardian consent. Please do not visit the Site or use our Services if you are under age 18. If you believe we might have any information collected online from someone under the age of 18, or if you become aware of any unauthorized submission of information to us, please contact us at privacy@healthstream.com and we will delete that information from our systems.

HealthStream cannot control the privacy practices of Customers. If a Customer chooses to input children’s Personal Information on the Services, it is done under their own privacy practices, not ours. We are not responsible for any Customer’s or other party’s compliance or noncompliance with laws or regulations. Please contact the Customer directly if you have questions about their privacy practices.

5. Cookie Notice

Cookies are small data files that are placed on your computer or mobile device when you visit a website. Cookies are widely used by website owners to make the website function or to provide certain features on the website.

The Site uses first-party cookies (set by us) and third-party cookies (set by other companies). These cookies serve a variety of purposes. Some cookies are essential for the Site to load and function. Other cookies provide specific features, serve or track advertising content, or analyze visitor interactions with the Site to help us operate and improve the Services.

The Site uses the following cookies:

1. Opt-In Monster (functionality)
2. Bing Ads (marketing)
3. Google Ads (marketing)

You can control how cookies interact with your device through your browser settings. Most web browsers automatically accept cookies. You can adjust your browser settings to block or disable cookies or to notify you when a cookie is sent to your device. You can also install third-party plugins to control cookie behavior. If you do not reject non-essential cookies or otherwise opt-out of analytics or marketing cookies, certain third parties will have access to data collected from these cookies and may independently process that data to analyze your use of our Services or for marketing purposes. By permitting these cookies, you consent to this processing of your data by third parties.

6. Offered in the United States Only

HealthStream is owned and operated in the United States and Virsys12 Services are provided to Customers located in the United States only. We do not market the Virsys12 Services to Customers located in any jurisdiction outside of the United States. However, if a Customer incidentally permits a non-US resident to register as a User under the Customer’s account, the Customer does so under its own (not HealthStream’s) privacy practices and the Customer is solely responsible for compliance with the privacy laws applicable to such use.

If you visit the Site from outside of the United States, you acknowledge that Personal Information we collect about you will be transferred to our servers in the United States and maintained there in accordance with our retention policy. This may require the transfer of your Personal Information out of your country of origin with laws governing data collection and use that may differ from or be more restrictive than U.S. law, or may result in governments, courts, law enforcement, or regulatory agencies having access to or obtaining disclosure of your Personal Information pursuant to the laws of the applicable foreign jurisdiction. By allowing us to collect Personal Information about you, you consent to this Privacy Policy and the transfer and processing of your Personal Information as described in this paragraph, and you waive any and all remedies that you may have based on the laws of your jurisdiction.

7. Your Choices & Controls

You can directly control your Personal Information on the Services using the methods described below:

1. Your Account Profile and Device Settings

Users can sign into their accounts at any time to review, change, or delete certain Personal Information. Users can terminate and permanently delete their Virsys12 account at any time. Note, however, that in some cases HealthStream serves as an information repository for Customers, in which case HealthStream may not be permitted to delete the User’s Personal Information. Please contact your Customer if you wish to make changes to your account but are not able to do so yourself through the Services. You can also control the data we collect by adjusting your device settings.

2. HealthStream Emails

If you provide us with your email address, we may send you informational or support emails or, if you opt-in, marketing emails about the Services. You can opt out of marketing emails but not our support or transactions emails. To opt-out, change your preferences via the links provided in the emails, email privacy@healthstream.com or submit a Consumer Privacy Request.

3. Texting Consent

If you opt in to text messaging or provide us with your wireless number for the purpose of text messaging, you consent to HealthStream sending you text messages for informational or authentication purposes. The number of texts that we send to you will be based on your circumstances and requests. You can unsubscribe from text messages by replying STOP or UNSUBSCRIBE to any of these text messages. Messaging and data charges may apply to any text message you receive or send. Please contact your wireless carrier if you have questions about messaging or data charges.

4. Do Not Track Requests

Do Not Track signals are signals sent through a browser informing us that you do not want to be tracked. Currently, our systems do not recognize browser “do-not-track” requests. If this changes in the future, we will update this Privacy Policy.

5. Consumer Privacy Requests

If you are a User and you wish to exercise your rights beyond the methods provided, express concerns, lodge a complaint, or obtain additional information about the use of your Personal Information, please contact your Customer. Users MUST direct privacy inquiries to the Customer. Otherwise, you may send us a Consumer Privacy Request or email us at privacy@HealthStream.com. We will relay your request to your Customer or fulfill it directly if we can. HealthStream does not charge a fee to process or respond to a verifiable request unless we have legal grounds to do so. In that case, we will tell you the cost estimate and why we are charging the fee before completing your request. We may be unable to fulfill some or all of your request, for example, if your request falls within a statutory exception or if fulfilling your request would prevent us from complying with a statutory or contractual obligation.

8. Notice of Privacy Rights

Depending on where you live or are located, you may have certain rights over your Personal Information. This section outlines legally required and courtesy notices of privacy rights that may be available to you depending on where you live and how you interact with HealthStream.

In the United States, consumer privacy is governed by state laws providing general consumer privacy rights, as well as federal laws addressing specific industries or data uses. This section provides notices of consumer privacy rights available to residents of U.S. states that require companies to inform consumers about their privacy rights and provide a method to exercise those rights (“Consumers”). If you reside in a state offering privacy protections, you may be entitled to some or all of these rights:

• Right to Correct. You have the right to request that we correct inaccurate Personal Information about you on our systems. If you become aware that the Personal Information that we hold about you is incorrect, or if your situation changes (e.g., you change address), please inform us and we will update our records. You can correct your Personal Information through your account or by contacting your Customer.
• Right to Delete. You have the right to request that we delete your Personal Information that we collected from you and retained, with certain exceptions. In response to your request, we may permanently delete, deidentify, or aggregate the Personal Information in response to a request for deletion. If you submit a right to deletion request, we will confirm the Personal Information to be deleted prior to its deletion, and we will notify you when your request is complete. Note that, as an information repository for Customers, HealthStream is not permitted to delete some types of Personal Information.
• Right to Access. You may have the right to receive confirmation that we have collected Personal Information about you and copies of the requested pieces of Personal Information in a portable and readily usable format. HealthStream may be legally prohibited from disclosing certain pieces of Personal Information, and we may be limited in the number or frequency of requests we must fulfill.
• Limited Use and Disclosure of Sensitive Personal Information. HealthStream does not seek to collect your sensitive Personal Information, though your Customer may use the Services to collect this information about you or you may choose to input some sensitive Personal Information to the Services. In no case will we use or disclose your sensitive Personal Information for the purpose of inferring characteristics about you. If this ever changes in the future, we will update this Privacy Policy and provide you with methods to limit use and disclosure of sensitive Personal Information.
• No Selling or Sharing Personal Information. HealthStream does not, and will not, sell the Personal Information collected about you or share your Personal Information with third parties for cross-contextual behavioral advertising purposes. As explained in Section 3(c), to the extent our exchange of data with our Partners qualifies as “sharing” Personal Information under privacy laws, you can prevent this data exchange by adjusting your account settings to opt-out of sharing. Additionally, HealthStream may use data collected from cookies on the Site or applications for marketing or retargeting, which may qualify as “sharing” Personal Information under some privacy laws. To opt-out of this sharing, adjust your settings on our Cookie Declaration or cookie banner to opt-out of Marketing Cookies.

Customers may choose to use certain integrated third-party services that require disclosure of user Personal Information to function. These disclosures only occur with permission from the Customer through which you use our Services. As such, these disclosures are not a sale or sharing of user Personal Information under applicable privacy laws. Please direct any questions to the Customer.

• No Profiling. HealthStream does not use any form of automated processing of Personal Information to evaluate, analyze, or predict your performance, preferences, choices, or behavior. If this changes in the future, we will update this posting to describe our use of profiling and your options to opt-out. 
• Health Data Rights. The Services are designed to support Customers and healthcare professionals. Users should never submit health data to the Services unless instructed to by the applicable Customer. Some state laws entitle consumers to certain details about health data collected about them, including (a) confirmation of whether the entity collects, shares, or sells the consumer’s health data and access that data, including a list of all third parties and affiliates with whom the entity has shared or sold the health data and a method to contact those third parties, (b) a method to withdraw consent related to use of health data, and (c) the right to have their health data be deleted. The Customer, and not HealthStream, is responsible for fulfilling consumer requests to exercise their rights related to health data.
• Right to Disclosure. You may have the right to receive details about the collection and use of your Personal Information via the Services, such as: (i) the categories of Personal Information we have collected about you; (ii) the categories of sources for the Personal Information we have collected about you; (iii) our business purpose for collecting, using, processing, sharing or selling that Personal Information, as applicable; (iv) the categories of third parties with whom we share that Personal Information; and (v) if we sold or shared your Personal Information under the California Consumer Privacy Act, two separate lists stating: (a) sales or sharing, identifying the Personal Information categories that each category of recipient purchased; and (b) disclosures for a business purpose, identifying the Personal Information categories that each category of recipient obtained. To learn more, please contact your Customer. Certain laws may limit the number or frequency of requests we must fulfill.
• Right to Nondiscrimination. HealthStream will not discriminate against you for exercising your privacy rights. For example, unless permitted by law we will not: (i) deny you goods or services; (ii) charge you different prices or rates for goods or services; (iii) provide you a different level or quality of goods or services; (iv) retaliate against you as an employee, applicant for employment, or independent contractor for exercising your privacy rights; or (v) suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services, because you exercised a right under applicable privacy laws.
• Right to Disclosure of Marketing Information. California’s Shine the Light Act (Civil Code sections 1798.83-1798.84) entitles California residents to request certain disclosures regarding Personal Information sharing with affiliates and/or third parties for marketing purposes.

If you are a User, please contact the Customer through which you access the Services to exercise these rights or inquire further. Otherwise, you may send us a Consumer Privacy Request or email at privacy@HealthStream.com.

9. About Our Data Security

We implement reasonable and appropriate technical, organizational, and physical security measures to help protect your Personal Information from unauthorized or illegal access, destruction, use, modification, or disclosure. We employ a series of security measures, including secure login, multifactor authentication, and encryption. We ensure that our personnel who are responsible for handling Personal Information and privacy matters are informed of applicable privacy law requirements. Our security measures are appropriate to the volume, scope, and nature of the Personal Information processed and designed to meet our duty of care with respect to your Personal Information. Please note, however, that no transmission of data over the internet is 100% secure. We cannot guarantee that unauthorized third parties will not defeat our security measures or use your Personal Information for improper purposes. It is your responsibility to keep your account secure from unauthorized access. We are not responsible for any lost, stolen, or compromised passwords, or any unauthorized activity on your account. We also have no control over any Customer’s security measures or practices, and we make no representations or guarantees that your Personal Information is secure once transmitted or stored on their systems.

10. About Third Party Websites

This Privacy Policy only applies to Virsys12 Services. No website operated by a third party is covered by this Privacy Policy, even if you can access it via a link on our Services. If you click an advertisement or link on the Services, you will be redirected to a website operated by a third party whose privacy practices may differ from ours. If you submit Personal Information to any third-party websites, your information is governed by the privacy policies of those third parties and HealthStream has no control over their privacy practices. You are encouraged to familiarize yourself with the privacy practices of these third parties before submitting your Personal Information.