Thesaurus Health Privacy Policy
Version 2.0
Effective Date: October 13, 2026
Introduction
Thesaurus Health Inc. (“Thesaurus,” “we,” “us,” or “our”) provides business-to-business healthcare data standardization, terminology, ETL, analytics, and related professional services. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information through our public website, business relationships, recruitment activities, and professional services.
This policy is issued by Thesaurus Health Inc., a Delaware corporation with a mailing address at 215 Avenue B, Apt 5A, New York City, NY 10009, USA. Thesaurus Health also maintains a legal presence in Germany.
Our public website is a corporate informational site. We do not provide services through the website, and we do not collect patient-level or customer clinical data through it.
Scope and Our Role
This policy applies to website visitors, business contacts, current and prospective clients, meeting participants, job applicants, contractors, and other individuals whose personal information we process for our own business purposes.
For personal information we collect for our own business purposes, such as website, business-contact, scheduling, recruitment, and administrative information, Thesaurus generally acts as a controller. When we process personal information on behalf of a client under a services agreement, Thesaurus generally acts as a processor or service provider and follows the client’s instructions. If a client agreement conflicts with this policy, the client agreement controls for that engagement.
Information We Collect
Depending on how you interact with us, we may collect:
• Business and contact information, such as your name, business email address, telephone number, employer, job title, and professional contact details.
• Communications, including the content of emails, meeting notes, inquiries, proposals, contracts, and other correspondence.
• Scheduling information, such as your name, email address, availability, meeting details, and information you choose to provide when booking a meeting.
• Recruitment information, such as a CV or résumé, employment history, education, qualifications, references, public professional profiles, and communications relating to an application or engagement.
• Website technical information, such as IP address, browser and device information, timestamps, pages viewed, and limited usage information collected automatically by our website provider.
• Client and project administration information, such as business contacts, source-system descriptions, schemas, data dictionaries, reference data, mappings, code, technical documentation, project records, and billing information.
We do not collect personal health information directly from individuals through our website.
How We Collect Information
We may collect information:
• Directly from you when you email us, communicate with us, schedule a meeting, submit application materials, enter into a contract, or otherwise interact with us.
• From clients and business partners in connection with an existing or prospective engagement.
• Automatically through our website and its hosting platform, Wix, using essential cookies, server logs, and similar technologies.
• From public or professional sources, such as company websites and professional networking profiles, where relevant to business development, recruitment, due diligence, or professional communications.
How We Use Information
We use personal information to:
• Respond to inquiries and communicate with clients, prospective clients, partners, applicants, and contractors.
• Schedule and conduct meetings.
• Establish, manage, and document business relationships.
• Provide contracted professional services and related support.
• Evaluate candidates and manage recruitment or contractor engagement processes.
• Operate, secure, maintain, and improve our website and business systems.
• Comply with legal, regulatory, contractual, accounting, and security obligations.
• Protect our rights, investigate suspected misuse or security incidents, and establish or defend legal claims.
We do not currently use our website for targeted advertising, and we do not currently operate newsletters, automated marketing campaigns, or event-invitation campaigns through the website.
Client Health Data and Professional Services
Thesaurus does not collect personal health information directly from patients. We do not host or maintain client clinical datasets in Thesaurus-controlled infrastructure.
When an engagement requires access to personal or health information, authorized Thesaurus personnel may access that information in the client-controlled environment solely to perform the contracted services, such as ETL development and execution, data standardization, terminology mapping, analytics, quality assurance, or technical documentation. Access is limited to what is necessary for the assigned role and engagement.
Where applicable, Thesaurus handles health information in accordance with applicable privacy and security requirements and contractual obligations, including Business Associate Agreements where required. We do not submit patient-level data or client clinical data to artificial intelligence services.
Non-clinical project materials, such as source schemas, data dictionaries, reference data, mappings, code, technical documentation, and project-management records, may be stored in Thesaurus business systems where permitted by the applicable agreement.
Legal Bases for Processing
Where the laws of the European Economic Area, the United Kingdom, Switzerland, or similar jurisdictions apply, we process personal information on one or more of the following legal bases:
• Performance of a contract or taking steps at your request before entering into a contract.
• Our legitimate interests in operating and securing our business, managing professional relationships, responding to inquiries, recruiting personnel, and providing services.
• Compliance with legal or regulatory obligations.
• Consent, where consent is required and has been obtained.
Where processing is based on consent, you may withdraw that consent at any time without affecting processing that occurred before withdrawal.
Website, Cookies and Wix
Our website is hosted on Wix. Wix may automatically collect limited technical and usage information, including IP address, browser and device information, timestamps, pages viewed, server-log information, and information generated by essential cookies or similar technologies used to operate, secure, and maintain the site.
We do not currently deploy advertising pixels or targeted-advertising technologies on the website. You may manage cookies through your browser settings. Where required by applicable law, additional cookie controls may be provided through the website.
Scheduling Through Calendly
Our website includes a link to Calendly for meeting scheduling. When you schedule a meeting, Calendly and the connected calendar provider process the information you submit, such as your name, email address, selected time, and any optional details. Meeting information may remain in Calendly and in our calendar history as part of ordinary business records. Thesaurus does not separately export or maintain a standalone scheduling database. Your use of Calendly is also subject to Calendly’s own privacy notice.
HubSpot and Business Relationship Management
We use HubSpot to organize business-contact and relationship information. This may include names, business contact details, organizations, roles, correspondence history, and relationship notes. We do not currently use HubSpot to send newsletters, automated marketing emails, or event invitations.
Sharing and Service Providers
We do not sell or rent personal information. We do not sell personal information for targeted advertising or cross-context behavioral advertising.
We may disclose personal information:
• To Thesaurus personnel and individual contractors who need the information for their assigned responsibilities and are subject to confidentiality and data-protection obligations.
• To service providers that support website hosting, scheduling, CRM, email, document collaboration, communications, videoconferencing, productivity, security, accounting, and other business operations. These may include Wix, Calendly, HubSpot, Google Workspace, Microsoft 365, Microsoft Teams, Zoom, and selected productivity or AI-assisted tools.
• To professional advisers, auditors, insurers, banks, and other advisers where reasonably necessary.
• When required by law, legal process, regulation, or a lawful request from a public authority.
• In connection with a merger, acquisition, financing, reorganization, sale of assets, or similar corporate transaction, subject to appropriate safeguards.
Third-party websites and services operate under their own privacy notices and terms.
AI-Assisted Tools
Thesaurus may use selected AI-assisted tools for internal drafting, analysis, and productivity involving ordinary business information. We do not provide patient-level data or client clinical data to these tools. We do not use AI to make solely automated decisions about individuals that produce legal or similarly significant effects.
International Processing
Thesaurus Health Inc. is a United States company and maintains a legal presence in Germany. We operate internationally, and our personnel and service providers may process personal information in the United States, the European Economic Area, and other countries.
Where required by applicable law, we use appropriate contractual or other safeguards for international transfers of personal information. Data-protection laws in the destination country may differ from those in your country of residence.
Data Retention
We retain personal information only for as long as reasonably necessary for the purposes described in this policy, to perform or administer a contract, to meet legal, regulatory, accounting, security, or dispute-resolution requirements, or as otherwise permitted by law.
Retention periods vary by the type of information and context. Meeting information may remain in scheduling and calendar history; business-contact information may remain in our CRM; and recruitment information may be retained for current or reasonably anticipated opportunities. When Thesaurus processes personal information on behalf of a client, retention and deletion follow the client’s instructions and the applicable agreement.
Data Security
We use reasonable technical and organizational measures designed to protect personal information. These measures may include role-based and need-to-know access controls, encryption where appropriate, multi-factor authentication where supported, confidentiality obligations, privacy and security training, and incident-response procedures.
No system or method of transmission is completely secure. We therefore cannot guarantee absolute security, but we maintain safeguards proportionate to the nature of the information and the services involved.
Your Privacy Rights
Depending on your jurisdiction and the circumstances, you may have rights to:
• Request access to personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of your information.
• Request restriction of, or object to, certain processing.
• Request portability of information you provided to us.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with an applicable data-protection authority.
To exercise a privacy right, contact us at [email protected]. We may need to verify your identity and may decline or limit a request where permitted or required by law.
If your request concerns information that Thesaurus processes solely on behalf of a client, you should ordinarily contact that client directly. We will support the client in responding where required by the applicable agreement or law.
Children’s Privacy
Our website and services are not directed to children, and we do not knowingly collect personal information from children through our website. If you believe a child has provided personal information to us, please contact us so that we can review and, where appropriate, delete it.
Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our practices, services, legal obligations, or other circumstances. The updated policy will be posted on our website with a revised effective date.
Contact Us
If you have questions, concerns, or requests relating to this Privacy Policy or our privacy practices, contact us at:
Email: [email protected]
Mailing address: Thesaurus Health Inc., 215 Avenue B, Apt 5A, New York City, NY 10009, USA
Website: https://www.thesaurus.health