Skip to content 
Privacy Policy
Prime Well Med Solutions respects your privacy.
1. Introduction
1.1 Purpose
This Privacy Policy explains how Prime Well Med Solutions LLC (“Prime Well,” “we,” “our,” or “us”) collects, uses, shares, keeps, and protects personal information. It also explains the privacy choices you may have.
Prime Well is a CMS-approved MIPS Qualified Registry and a HIPAA-compliant service provider to healthcare practices. We provide MIPS reporting, MIPS Value Pathways (MVP) reporting, Revenue Cycle Management (RCM), and HIPAA Security Risk Assessments. We do not provide medical billing as a standalone service.
By using our website or communicating with us, you accept the practices described here.
1.2 Scope
This policy covers personal information collected through:
- primewellmedsolutions.com and any other site that links to this policy;
- web forms, demo requests, quote requests, webinars, events, and surveys;
- email, phone calls, text messages, and live chat with our sales, support, and account teams;
- marketing campaigns and advertising; and
- offline conversations with our representatives at conferences and meetings.
1.3 What this policy does not cover
This policy does not govern Protected Health Information (PHI) or other client data that we process on behalf of a healthcare practice, group, or organization under a services agreement.
If you are a patient of a practice that uses Prime Well, your healthcare provider controls your medical records. Send questions, access requests, or correction requests to your provider, and read your provider’s Notice of Privacy Practices.
Please do not send PHI through our website forms, general email, chat, or social media. We will give clients a secure channel after a BAA is in place.
1.4 Relationship to other agreements
This policy is part of the terms that govern your use of our website. Read it together with our Terms and Conditions, and with any service agreement, order form, or BAA that applies to you. If a service has its own privacy notice, that notice controls for that service.
1.5 Compliance with law
We work to comply with the privacy and data protection laws that apply to us, including HIPAA, the Health Information Technology for Economic and Clinical Health Act (HITECH), CMS Quality Payment Program requirements for third-party intermediaries, the CAN-SPAM Act, the Telephone Consumer Protection Act (TCPA), the Pennsylvania Breach of Personal Information Notification Act, and applicable state consumer privacy laws.
1.6 Changes to this policy
We may update this policy to reflect changes in our practices, technology, or the law. Changes take effect on the “Last updated” date above. If you keep using our website after that date, you accept the updated policy. For material changes, we will also notify active clients directly.
1.7 Job applicants and personnel
Information collected from job applicants, employees, and contractors is handled under separate recruiting and employment notices, not this policy.
2. Information we collect
What we collect depends on how you interact with us.
2.1 Identifiers and contact details
- First and last name
- Business email address
- Telephone and mobile number
- Postal address
- IP address and other online identifiers
2.2 Professional and business information
- Practice, group, or organization name
- Job title and role
- Medical specialty
- Number of clinicians or providers
- State and general location
- NPI and TIN, where needed to check MIPS eligibility or to onboard you
- EHR or practice management system in use
- Services you are interested in
2.3 Website and device information
- Browser type and settings
- Device type and operating system
- IP address
- Referring website and search terms
- Pages viewed, time on page, clicks, and scroll depth
- Cookie and tracking identifiers
2.4 General location
We may work out your general location, such as city, state, or country, from your IP address. We do not collect precise GPS location.
2.5 Messages you send us
Anything you choose to send us: form submissions, emails, chat messages, text messages, support tickets, and notes or recordings from calls.
2.6 Event and webinar information
Registration details, attendance records, questions asked, poll answers, and recordings where recording is announced in advance.
2.7 Marketing and preference information
Your communication preferences, subscription status, opt-ins and opt-outs, and how you interact with our emails and ads, such as opens and clicks.
2.8 What we do not want you to send
Our website is not built to receive sensitive personal information. Do not submit Social Security numbers, driver’s license numbers, bank or card numbers, insurance details, or PHI through website forms or general email unless we specifically ask you to and give you a secure method.
2.9 Artificial intelligence and machine learning
We do not use personal information collected through our website, and we do not use client PHI, to train public or third-party artificial intelligence models. Where we use AI tools inside our business, we do so under written contracts and vendor reviews, and only for the purposes described in this policy. Any AI tool that touches PHI must sign a BAA with us.
3. How we collect it
3.1 Information you give us directly
- Filling in a form or requesting a demo, quote, or audit
- Registering for a webinar or event
- Emailing, calling, texting, or chatting with us
- Subscribing to our newsletter or updates
- Signing a service agreement or onboarding your practice
3.2 Information collected automatically
When you visit our website, we and our providers may use cookies, pixels, tags, and server logs to collect the information listed in section 2.3. This depends on your browser settings and your cookie choices. See section 8.
3.3 Information from other sources
- Public sources such as the CMS NPPES NPI registry, state license boards, and professional directories
- Business contact data providers and lead generation partners
- Referrals from existing clients and partners
- Advertising and marketing platforms
- Your EHR or practice management system, once you authorize a connection (this route may carry PHI and is governed by your BAA)
We may combine information from these sources with information you give us, to improve accuracy and to make our outreach more relevant.
4. How we use it
- Deliver our services. Collect, validate, and submit MIPS and MVP data to CMS as our clients direct, run RCM workflows, and perform Security Risk Assessments.
- Meet CMS registry duties. Run annual data validation audits and give clinicians and groups performance feedback at the frequency CMS requires.
- Respond to you. Answer questions, book demos, send quotes, and handle support requests.
- Onboard and manage accounts. Verify eligibility, set up access, and send service notices and invoices.
- Market our services. Send newsletters, deadline reminders, program updates, event invitations, and offers to business contacts, subject to section 6 and section 7.
- Improve our website and services. Analyze traffic, test content, and fix problems.
- Measure marketing. Understand which campaigns, pages, and ads work.
- Protect our business. Detect fraud and unauthorized access, keep systems secure, and enforce our agreements.
- Meet legal duties. Comply with law, regulation, audits, subpoenas, and lawful government requests.
We never sell PHI. We never use PHI for our own marketing. HIPAA requires written patient authorization for marketing uses of PHI, and we do not seek or rely on such authorizations.
5. How we share it
5.1 CMS and its contractors
We submit MIPS and MVP data to CMS on behalf of client practices, as those practices direct and approve.
5.2 Our clients
We return reports, scores, dashboards, and submission records to the practice that engaged us.
5.3 Service providers and vendors
We use vendors for hosting, security, storage, email delivery, telephony and text messaging, analytics, advertising, CRM, e-signature, accounting, and payment processing. They may only use the information to perform services for us. Any vendor that may touch PHI must sign a subcontractor BAA with us before access is granted.
5.4 Advertising and analytics partners
Subject to your cookie choices, we share website activity data with analytics and advertising partners to measure performance and to show relevant ads. Under some state privacy laws, this may count as a “sale” or “sharing” of personal information, even though no money changes hands. See section 8 and section 13 for your choices.
5.5 When you ask us to
We share information with third parties when you direct or authorize it.
5.6 Legal reasons
We share information where required by law, court order, subpoena, regulator request, or to protect the rights, property, or safety of Prime Well, our clients, or the public.
5.7 Business transfers
If Prime Well is involved in a merger, acquisition, financing, or sale of assets, information may transfer as part of that transaction. PHI would remain protected under HIPAA and the applicable BAA.
5.8 De-identified and aggregated information
We may create and use information that has been de-identified or aggregated so it cannot reasonably identify you, your clinicians, or any patient. Where the information was PHI, de-identification is performed to the HIPAA standard. We may use this for benchmarking, research, product improvement, and reporting, as permitted by your agreement.
We do not sell personal information for money.
6. Text messaging (SMS)
We use a licensed business messaging provider, RingCentral, to send and receive text messages. This section is our SMS privacy commitment.
6.1 Consent is opt-in
We send text messages only to people who have given consent, for example by submitting a form, ticking an SMS consent box, texting us first, or agreeing during a call. Consent to receive text messages is never a condition of buying any product or service.
6.2 We do not sell or share your mobile information
Text messaging originator opt-in data and consent records are not shared with any third party, except with:
- our messaging platform provider and the mobile carriers, purely to transmit the message; and
- legal or regulatory authorities where the law requires it.
We do not share mobile numbers with data brokers, lead resellers, or advertising networks.
6.3 What we send
- Appointment, demo, and meeting confirmations and reminders
- MIPS and MVP deadline and submission alerts
- Account, onboarding, and support updates
- One-time passcodes and two-factor authentication codes
- Occasional service or program announcements, where you opted in to them
6.4 Frequency, cost, and help
- Message frequency varies by program and by your activity.
- Message and data rates may apply. Your mobile carrier sets those rates, not us. We do not charge a separate fee for text messages.
- Reply STOP to any message to opt out. You will get one confirmation message and then no more, apart from any message you specifically request afterwards.
- Reply HELP for help, or contact us using section 17.
- Carriers are not liable for delayed or undelivered messages.
- Supported carriers may change without notice.
6.5 Accuracy of your number
You are responsible for giving us a correct mobile number and for telling us if it changes. We are not responsible for messages sent to an outdated or incorrect number.
6.6 No PHI by standard text message
We do not send PHI by standard SMS. If a client needs to exchange PHI with us, we will provide a secure channel.
7. Email and phone calls
7.1 Email
Our marketing emails identify Prime Well, show a valid physical mailing address, and include a working unsubscribe link, as the CAN-SPAM Act requires. We process opt-outs promptly and within 10 business days. Opting out of marketing does not stop service emails about an active engagement, such as invoices, deadlines, or submission confirmations.
7.2 Phone calls
We follow the TCPA, federal and state Do-Not-Call rules, and state calling-time limits. We use autodialed or prerecorded marketing calls only where the required prior express written consent exists. You can ask to be added to our internal do-not-call list at any time.
7.3 Call recording
Pennsylvania is a two-party consent state. We may record or monitor calls for quality, training, and record-keeping. Where we do, we announce it at the start of the call, and you may ask us not to record or may end the call.
8. Cookies and tracking
Cookies are small files stored on your device. We and our providers also use pixels, tags, and server logs.
8.1 Categories we use
| Category | What it does | Can you turn it off? |
|---|---|---|
| Strictly necessary | Runs the site, keeps it secure, remembers your cookie choice | No |
| Functional | Remembers preferences and powers features such as chat | Yes |
| Analytics and performance | Shows how visitors use the site so we can improve it | Yes |
| Advertising and targeting | Measures campaigns and shows relevant ads | Yes |
8.2 Tools on this site
- Google Analytics – website traffic and behavior measurement
- Google Tag Manager – manages the tags above
- Meta Pixel – measures Facebook and Instagram ad performance and builds audiences
These providers process data under their own privacy policies. You can read how Google handles data on partner sites at google.com/policies/privacy/partners and Meta’s terms at facebook.com/privacy.
8.3 Your choices
- Use the cookie banner or Cookie Preferences link to change your settings at any time.
- Block or delete cookies in your browser settings.
- We honor the Global Privacy Control (GPC) signal. Where we detect a valid GPC signal, we treat it as an opt-out of the sale or sharing of personal information and of targeted advertising, for the laws that recognize it.
8.4 No tracking on pages that handle PHI
We do not place analytics or advertising trackers on client portals, secure upload pages, or any page where PHI may be entered. This follows guidance from the HHS Office for Civil Rights on online tracking technologies.
9. Other websites and social media
Our site links to third-party websites and social platforms. We do not control them and are not responsible for their content, security, or privacy practices. Read their policies before sharing information with them.
10. How long we keep information
| Type | Retention |
|---|---|
| PHI and client data | For the length of the engagement and as the BAA and CMS program rules require. Then returned or securely destroyed, unless law requires us to keep it. |
| HIPAA compliance records (policies, risk analyses, training logs, BAAs) | At least six years from creation or last effective date. BAAs: at least six years after termination. |
| Contracts, invoices, and tax records | As accounting and tax law requires, generally seven years. |
| Marketing and business contact data | Until you opt out or the record goes stale. |
| Opt-out and suppression lists | Kept indefinitely, so we can keep honoring your opt-out. |
| SMS consent records | At least four years after the last message, to show consent if challenged. |
| Website analytics | Up to 26 months. |
| Webinar and event recordings | Kept for training, education, and marketing unless you ask us to remove you. |
When information is no longer needed, we delete, de-identify, or securely destroy it. Where technical or legal reasons delay deletion, we limit further use and keep protecting the information until deletion is possible.
11. Security
We maintain administrative, physical, and technical safeguards built around the HIPAA Security Rule and the NIST Cybersecurity Framework. These include:
- Encryption of data in transit (TLS 1.2 or higher) and at rest
- Role-based access control and least-privilege permissions
- Multi-factor authentication on systems that hold client data
- Audit logging of access, changes, and submissions
- Network monitoring, endpoint protection, and patch management
- Encrypted backups and a tested disaster recovery plan
- An annual HIPAA Security Risk Analysis and a written risk management plan
- Annual HIPAA and security awareness training, with signed confidentiality agreements
- Written incident response and breach notification procedures
- Vendor risk reviews and signed subcontractor BAAs
11.1 Where data is stored
Prime Well Med Solutions LLC is a United States limited liability company with its principal place of business in Pennsylvania. Client data is stored on servers located in the United States. This meets the CMS requirement that a qualified registry keep its principal place of business and its data storage location within the United States.
11.2 No absolute guarantee
No internet transmission or storage system is perfectly secure. We cannot guarantee absolute security, but we work to prevent incidents and to respond quickly when something happens.
12. Breach notification
12.1 PHI
If we discover a breach of unsecured PHI, we notify the affected client without unreasonable delay and within the period set in the BAA. HIPAA allows up to 60 calendar days from discovery, and our standard is to notify sooner. We provide the information the covered entity needs to meet its own notification duties.
12.2 Pennsylvania and other state laws
For personal information covered by state breach laws, we notify affected individuals without unreasonable delay, as the Pennsylvania Breach of Personal Information Notification Act requires. Where a breach affects more than 500 Pennsylvania residents, we also notify the Pennsylvania Office of Attorney General. We follow the notification deadlines of any other state whose residents are affected.
12.3 Documentation
We document all security incidents and keep those records in line with our incident response program and applicable law.
If you believe your information has been accessed without authorization, contact our Security Office using section 17.
13. Your privacy rights
Pennsylvania does not currently have a comprehensive consumer privacy law. If you live in a state that does, such as California, Colorado, Connecticut, Virginia, Texas, Oregon, or others, you may have the rights below. We extend the same request process to anyone who asks.
13.1 Rights that may apply to you
- Confirm whether we process your personal information, and learn what categories we collect, where we got them, why we use them, and who we share them with
- Access the personal information we hold about you
- Correct inaccurate information
- Delete information we collected from or about you
- Receive a portable copy of your information
- Opt out of the sale or sharing of personal information
- Opt out of targeted advertising
- Limit the use of sensitive personal information
- Opt out of profiling that produces legal or similarly significant effects
- Withdraw consent where we relied on consent
- Not be treated differently for using these rights
These rights have exceptions. Information governed by HIPAA is generally exempt from state consumer privacy laws. Patients should contact their provider.
13.2 How to make a request
Email info@primewellmedsolutions.com with “Privacy Request” in the subject line, or use the contact details in section 17. We will take reasonable steps to verify your identity before acting. We may need extra information to do that.
13.3 Authorized agents
You may use an authorized agent where the law allows. The agent must give us written proof of authority. We may still verify your identity with you directly. A valid power of attorney is accepted on receipt.
13.4 Our response time
We respond to verified requests within 45 days. If we need more time, we may extend by another 45 days and will tell you why within the first period. Where a state requires a faster response, we meet that deadline.
13.5 Appeals
If we deny your request in whole or in part, and your state gives you an appeal right, we will explain how to appeal. You may also contact your state attorney general.
13.6 No discrimination
We will not deny you services, charge you a different price, or give you a lower quality of service because you exercised a privacy right.
13.7 Sale and sharing
We do not sell personal information for money. Some advertising and analytics cookies may count as a “sale” or “sharing” under laws such as the CCPA and CPRA. Opt out through our cookie banner or by enabling GPC in your browser. We do not knowingly sell or share the personal information of anyone under 16.
13.8 Sensitive personal information
We do not intentionally collect sensitive personal information through our website. If you send it to us anyway, you may ask us to limit how we use it.
13.9 California “Shine the Light”
California residents may ask, once per calendar year, for a list of the categories of personal information we disclosed to third parties for their own direct marketing in the prior calendar year, and the names and addresses of those third parties. Email us with “Shine the Light Request” in the subject line. We respond within 30 days.
13.10 Automated decision-making
We do not make decisions about you by automated means that produce legal or similarly significant effects. If that changes, we will update this policy.
14. Children
Our website and services are for healthcare professionals, practice administrators, and other adults in business roles. They are not directed to children. We do not knowingly collect personal information from anyone under 13 through our website, and we do not knowingly sell or share the personal information of anyone under 16. If you are a parent or guardian and believe a child has given us information, contact us and we will delete it as the law requires.
15. Visitors outside the United States
Our website and services are intended for individuals and organizations in the United States. We do not direct our services to the European Economic Area, the United Kingdom, or other regions that require specific cross-border transfer mechanisms. If you visit from outside the United States, your information will be processed in the United States, where data protection laws may differ from those in your country.
16. Accessibility
If you need this policy in another format because of a disability, contact us and we will provide one.
17. Contact us
Email: info@primewellmedsolutions.com
Phone: 267-319-7722
Address: 3070 Bristol Pike,1–124 B Bensalem PA 19020
