Behavioral Healthcare Options, Inc. (BHO) is very sensitive to privacy issues. We respect your right to privacy and feel it is important for you to know how we handle the information we receive from you via the Internet. In general, you can visit www.bhoptions.com without revealing any personal information about yourself. If you choose to provide BHO with personal information, it may be necessary in some cases for us to provide your information to our contractors or agents in order to respond to your inquiry.

Customer Information Practices Statement

GUIDING PRINCIPLES

BHO is a health and well-being company that provides products and services to help our customers improve health care treatment, delivery, and financing. In our operations, we often possess personal information that identifies individuals and other proprietary information about our customers' operations. Preservation of, and respect for, our customers' trust is critical to our continued success. Therefore, we will always treat such information:

• Confidentially, according to applicable laws.
• Appropriately, according to the promises we make to our customers.
• Respectfully, according to our concern for the sensitive nature of such information.

Policies

INFORMATION SECURITY:

We maintain appropriate physical, electronic, and administrative security standards and procedures to safeguard our data and systems. Our employees are educated on the importance of our privacy and security policies and must comply with them. Employees are permitted to access and use only that personal and proprietary information they need to perform their job duties.

Information Processing:

We try to use only the amount of personal and proprietary information necessary for research, analytical, or derivative product development purposes that are consistent with:

1. Our core business mission to provide high-quality products and services to our customers
2. Our contractual and legal obligations to customers, data controllers, and individuals from whom we receive such information
3. Applicable law

We have procedures to maintain the integrity and confidentiality of information while in our care.

• When we receive personal information from customers or other data controllers, we rely on their obligations to provide individuals with any required notice and consent for the intended purpose or we obtain additional consent/authorization as necessary. We process personal information in accordance with an individual's informed consent, national laws, and international guidelines governing human subjects protection. Research using personal information is approved by an institutional review board, ethics committee, or privacy board where and as required by law.
• When we collect personal information directly from individuals on behalf of a customer, we will provide such individuals with:
  1. Notice about the intended use and disclosure of their information
  2. Choice before using or disclosing their information for any other purpose
  3. The ability to access and correct their information where required by law

De-Identified Data:

We remove, encode, or encrypt individual identifiers from personal information to the fullest extent possible consistent with its intended use. In some cases, we receive personal information from customers and data controllers for the purpose of de-identifying it on their behalf. We anonymize such data using statistical techniques to create aggregated norms or benchmarks, such as hospital performance measures or benchmark insurance charges in a regional area.

Clinical Communications: We may partner with customers such as health plans and health care providers to help them inform patients about treatment options such as clinical trials. We also may partner with customers to help them provide information on health-related products and services of potential interest to their consumers. We will not use personal information for such purposes unless:

• The activity is permitted by law
• The activity promotes health and well-being
• Individuals are given the opportunity to "opt-out" of the program or to "opt-in" to the program where required by law or by the customer or data controller.

In addition:

We will not distribute information or solicitations to consumers enrolled in government health care programs for purposes other than assisting a customer in carrying out treatment, payment, or health care operations, unless approved in advance by the sponsoring government agency and requested by the individual without any solicitation on our part.

We will not solicit or provide information to consumers based on their status with or at risk for mental health, substance abuse, or HIV/AIDS, unless we are acting on behalf of a customer who has obtained appropriate consent/authorization or is otherwise legally authorized to make such contact, or when approved by an institutional review board or privacy board for research purposes in accordance with applicable law.

Information Disclosure:

We will not disclose personal or proprietary information, which we obtain in the course of providing products and services to our customers, to any third party except: (1) as required by law, or (2) consistent with applicable law and our obligations to the customer, data controller and/or individual from whom we received the information, as follows:

• We may disclose personal information to a service provider to perform a specific service on our behalf, but only when consistent with this policy and subject to a contract that:
  
  1. Prohibits them from using the information for any other purpose;
  2. requires them to conform to our privacy and security obligations; and
  3. allows for an audit of their compliance.
• We will not share one customer's information with another customer, except at the customer's direction or as part of de-identified aggregated norms. At the direction of a customer, such as an employee benefit plan sponsor, we will disclose the customer's information to its other service providers, from its service providers back to the customer, or to other entities participating with the customer in an organized health care arrangement. The other entities may also be our customers.
• We disclose personal information about clinical investigators and encoded patient data from clinical research trials to the study sponsor in accordance with the individual's consent or contract. Personal or proprietary information may be included in assets transferred as part of a merger or sale of the company's assets.

Web Site Privacy:

We do not identify visitors to our World Wide Web site unless they choose to identify themselves, such as to obtain information about products or clinical trials.

• Our Web site may deposit a small file called a "cookie" on a visitor's computer hard drive to personalize their experience or track aggregate site visitation statistics. Visitors may choose to use technologies to block such "cookies," but in some cases they may not have access to the full functionality of the Web site.
• We may record a Web site visitor's Internet Protocol (IP) address for security reasons and to evaluate how our Web site is being used. We do not use IP addresses to identify individuals.

Our Web site is not designed to attract children; we do not collect or maintain information from our Web site from individuals that we actually know are under the age of 13 years.

Certain portions of this Web site are configured to permit users to post messages, comments, or other content. Any such content is only the opinion of the poster, is no substitute for your own research, and should not be relied upon for any purpose. You should not post any content:

• which is profane, libelous, defamatory, obscene, pornographic, indecent, lewd, harassing, threatening, harmful, invasive of privacy or publicity rights, abusive, inflammatory, or otherwise objectionable; or
• the transmission of which could violate, or facilitate the violation of, any applicable law, regulation, or intellectual property rights.

You are solely responsible for the content of any postings you submit and BHO assumes no responsibility or liability for any content submitted by you. We may, but are not obligated to, restrict or remove any and all content from a message that we determine in our sole discretion violates these guidelines or is otherwise harmful to us, BHO customers, or any third party. BHO reserves the right to purge the content you provide after 90 days of creation, but you understand that BHO may access, preserve, and disclose the content if required to do so by law or in a good faith belief that such access, preservation, or disclosure is required by law.

Any content you submit is for non-commercial use only. Any content you submit will be routed through the Internet and you understand and acknowledge that you have no expectation of privacy with regard to any content you submit. Never assume that you are anonymous and cannot be identified by your posts.
If you do post content or submit material, and unless we indicate otherwise, you grant BHO and its affiliates a nonexclusive, royalty-free, perpetual, irrevocable, and fully sublicensable right to use, reproduce, modify, adapt, publish, translate, create derivative works from, distribute, and display such content throughout the world in any media. You grant BHO and its affiliates and sublicensees the right to use the name that you submit in connection with such content, if they choose. You represent and warrant that you own or otherwise control all of the rights to the content that you post; that the content is accurate; that use of the content you supply does not violate these Terms and Conditions and will not cause injury to any person or entity; and that you will indemnify BHO or its affiliates for all claims resulting from content you supply.