Centennial Rewards Program Privacy Policy

Effective Date: January 2, 2021

1. Introduction

   
   The Centennial Rewards program is provided by your Medicaid health plan and the New Mexico Human Services Department (HSD) and is administered by Finity Communications Incorporated ("Finity"). This Privacy Policy describes how the Centennial Rewards program collects and uses information received from participating members. This Privacy Policy is hereby incorporated into the Terms and Conditions of the Centennial Rewards program.

2. Does this Privacy Policy apply to me?

   Yes. By visiting this site or participating in the Centennial Rewards program, you are accepting the terms of this Privacy Policy. IF YOU DO NOT AGREE WITH THIS PRIVACY POLICY, YOU SHOULD LEAVE THE SITE NOW AND NOT PARTICIPATE IN THE PROGRAM.

   You may have reached this website directly or by clicking on a link on your health plan's website or an advertisement. Please be aware that you may also be subject to your health plan's privacy policy when you use this website. We recommend that you regularly check the policies for all websites that you visit to remain informed about how your information is collected and used.

3. How will I know if this Privacy Policy has been revised?

   The Centennial Rewards program may revise this Privacy Policy at any time, without prior notice. You are accepting all revisions by using this website or participating in the Centennial Rewards program after any revisions have been made. Any revisions will take effect when they are posted on this website. We recommend that you review it periodically to remain informed about the Centennial Rewards program privacy practices.

4. What if I access this site from outside the U.S.?

   This website is designed for use within the United States. If you access this site from outside the U.S., you are accepting that your information will be captured and stored by a U.S.-based server and will be subject to U.S. laws and regulations. You further accept responsibility for compliance with any applicable foreign laws and regulations.

5. What is an internet "cookie"?

   Internet cookies are small files stored by your computer's browser that contain non-personally identifiable information. Many websites use cookies to collect information about you. You have the option to delete or block these cookies using your browser privacy settings at any time.

6. Does this site use internet cookies?

   Yes. Private internet cookies are required in order to enable the full functionality of the Centennial Rewards program website. These cookies are not shared with third-party sites. We collect anonymous traffic data about visitors to this website using Google Analytics, including IP address, device type and capabilities, OS version, browser type and capabilities, number of visitors, length of visits, and time spent on pages.

   We may use this information to evaluate your use of the site, compile activity reports for website operators, provide other services relating to website activity and internet usage, and for any other lawful purpose. This data may also be shared with other third-party companies that provide products or services to you (e.g., your health plan, health care provider, health coaching provider, or another third-party health services entity) or to comply with a court order or other legal requirement.

   You may refuse the use of cookies by changing the settings on your browser. The website may lose full functionality if you do so. By using this website, you consent to the processing of your data by Google in the ways described above.

   If you affirmatively provide us with personally identifiable information, read the following section.

7. What if I voluntarily submit personal information to the Centennial Rewards program?

   We may collect personal information about you in association with your participation in the Centennial Rewards program. If you contact the Centennial Rewards program or otherwise voluntarily submit personally identifiable information (e.g., your name, email address, phone number, credit card number, account numbers, etc.), the Centennial Rewards program may use your information to

   • provide you with a more personalized user experience
   • process your application or registration
   • send you Reward Alerts and other notifications related to your participation in the Centennial Rewards program
   • process your rewards orders
   • reply to phone calls, emails, text messages, or other communications received from you
   • recommend learning modules or other wellness activities and programs
   • monitor, track, compile, and report your health status and participation in the rewards program
   • compile and report data to HSD and your health plan
   • compile and report aggregate or anonymous data to your health plan or other third parties
   • protect the legal rights of HSD, your health plan, Finity, and the Centennial Rewards program
   • comply with applicable subpoenas, laws, and regulations
   • fulfill any other lawful purpose
8. Does the Centennial Rewards program collect information protected by HIPAA?

   Yes, the Centennial Rewards program may collect information that is protected by the Health Insurance Portability and Accountability Act of 1996 and related laws and regulations (the "HIPAA rules").

   The HIPAA rules protect the privacy and security of protected health information (PHI). This includes information that personally identifies an individual or that may be used to identify an individual. Examples of PHI include

   • your name, address, date of birth, health plan member ID, and Social Security number
   • your past, present, or future physical or mental health or condition
   • the provision of health care to you
   • the past, present, or future payment for the provision of health care to you

   The HIPAA rules protect all PHI from improper use or disclosure by Covered Entities (such as health plans) and certain Business Associates. Finity is not a Covered Entity under HIPAA; however, we may be a Business Associate of a Covered Entity from whom we receive your information. For example, we may perform certain services for health insurance companies sponsoring your access to this site. In instances where Finity is a Business Associate or handling your PHI, we will comply with all HIPAA requirements and all terms of the pertinent Business Associate agreement.

   This site and all other aspects of the Centennial Rewards program are designed to comply with the applicable HIPAA rules. We collect PHI that you voluntarily submit when you register for the Centennial Rewards program or take part in any wellness activities and programs made available through the program. For example, as part of the registration process for a wellness challenge or health activity, you may be asked to submit your name, age, height, weight, health conditions, health risk factors, etc.

   The PHI we collect may be shared with your health plan or the state to administer your health program or incentive, with third-party health service entities, or to comply with a court order or other legal requirement. We may also share your PHI within the Finity family of businesses, but only in accordance with this Privacy Policy and applicable laws. To find out how your health plan may use your PHI, we recommend that you review their privacy policies and terms of use.

   Although this site and the products and services offered through Finity are not intended for use by children, we are committed to compliance with the Children's Online Privacy Protection Act, 15 U.S.C. §6501-6506. Parents, managing conservators, and legal guardians may have the opportunity to voluntarily submit personally identifiable information or PHI on behalf of their children. Any such information is only obtained upon parent/guardian consent. Any personally identifiable information or PHI submitted on behalf of children will be used in the same manner and for the same purposes as information collected for adults accessing this site.

9. Does this site collect genetic information?

   No. The Centennial Rewards program does not collect genetic information for any purposes that are prohibited by the Genetic Information Nondiscrimination Act of 2008 (GINA). GINA generally prohibits health plans from collecting genetic information, including family medical history, prior to or in connection with enrollment, for underwriting purposes, or as part of a health risk assessment.

   Your health plan provider may collect genetic information for lawful purposes. To find out how any such third parties may use your genetic information, we recommend that you review their privacy policies and terms of use or contact them directly.

10. Does this site collect Social Security numbers?

    Yes. The Centennial Rewards program uses your Social Security number when you register for the program. We may also use it to help confirm your identity when you contact Centennial Rewards Customer Service. We use advanced encryption, security technology, and strict procedures to protect your Social Security number from unauthorized use or disclosure.

11. How do you use my personal information?

    The Centennial Rewards program does not sell any of the personally identifiable information we collect. In the course of providing service to you, we may share your personal information with your health plan for the purpose of administering the Reward Program, including forwarding your current and previous contact information. We may also share some of your personal information with other third-party health service entities, or to comply with a court order or other legal requirement.

    We may also remove all personal identifiers from your PHI through a process known as de-identification, in accordance with HIPAA regulations. Once de-identified, the information can no longer be tied to you or used to identify you in any way. The de-identified information we collect and create is compiled in large volumes for the purpose of performing statistical analysis.

    In the event we transfer the ownership of our business services to another organization, in whole or in part, because of a reorganization, merger, or succession plan, your personal information may be transferred. If such a transfer of interest occurs, the successor organization's use of your personal information will still be subject to this Privacy Policy, until you are notified otherwise.

12. How does this site protect personal information?

    The Centennial Rewards program uses advanced encryption, security technology, and other safeguards to prevent unauthorized access to this website and to maintain the privacy and security of collected data and information. We are not responsible for any harm that may occur if you voluntarily or accidentally disclose your PHI or personal information, including your username or password, to any third parties.

13. Can I opt out of receiving communications?

    Yes. You can change your communication preference for the rewards program or opt out of certain reward communication media in the My Account section of centennialrewards.com. You may also call us at 1-877-806-8964 (TTY: 1-844-488-9722) to opt out.

    Please be advised that you may not be able to opt out of certain required system messages used to verify your identity or service your account. Finity also has no control over the opt-out policies of other companies, including your health plan.

14. Will you publicize my name if I earn a reward?

    The Centennial Rewards program will not use your name, image, or likeness for publicity purposes unless you give us written permission.

15. Is information I provide by email secure?

    Email can be an insecure mode of communication. Emails may be misdirected, redirected, forwarded, or shared with or without your permission. We recommend that you carefully consider the information you transmit by email, especially personally identifiable information and PHI.

16. How do I correct errors in my personal information?

    Call us at 1-877-806-8964 (TTY: 1-844-488-9722) if you believe there is an error in your personal information on the Centennial Rewards website.

17. Governing jurisdiction and conflict of laws

    This Privacy Policy is governed by the internal substantive laws of the state of New Mexico, without respect to its conflict of laws principles. By taking part in the Centennial Rewards program, you agree that any dispute, lawsuit, or controversy related to your use of the program will be resolved in the federal courts of New Mexico or the state courts of Santa Fe County, New Mexico.

    You further expressly consent to the exercise of personal jurisdiction in the federal court of New Mexico or the state courts of Santa Fe County, New Mexico in connection with any dispute involving the Centennial Rewards program, its affiliates, subsidiaries, employees, contractors, officers, directors, administrators, and telecommunication providers.

18. Severability

    In the event that any part of this Privacy Policy is found to be invalid by a court of competent jurisdiction, that part shall be deemed invalid or modified as required by such court, and the remainder of the Privacy Policy shall remain in full force and effect.

19. Contact us for more information

    Call us at 1-877-806-8964 (TTY: 1-844-488-9722) if you have questions or would like more information about the Centennial Rewards program.

20. Who can I contact about this Privacy Policy?

    If you have questions or concerns about this Privacy Policy, you may contact Finity at legal@finity.com.