Privacy Policy

LAST UPDATED: January 19, 2026

1. Acceptance of Terms

This privacy statement (“Privacy Statement”) is published by HealthTrust Purchasing Group, L.P., (“HealthTrust,” “We,” “Us,” “Our”) to explain Our privacy practices with respect to Use and/or disclosure of Personal Information We obtain when you interact with Us or otherwise utilize Our GPO services  (collectively “Services”) including via:

• Websites, Mobile Applications, and Portals: This includes any interaction you have with Our main informational Website, our member and supplier portals, and any associated mobile applications (collectively, the “Website”). We collect data through forms, demo requests, account registration, and browsing activities.
• Events: When you attend events such as trade shows or Webinars where We participate or present, We may collect Personal Information from and about you.
• Our Services. We may collect Personal Information to facilitate the contract for which you or your employer has entered into or requested in order to participate in Our GPO services or as a result of a contract for GPO services.
• Phone, Text, Chat and Email Communications: Personal Information may be collected when you communicate with Us via phone, text, chat, or email, such as call logs, email addresses, and the content of the communications.
• Online Advertisements and Emails: If you view Our online ads or emails, We may collect information about your interaction with these communications, such as click-through rates and preferences.
• Authorized Service Providers: We may also collect information through third-party service providers who are authorized to act on Our behalf, including marketing firms and payment processors.

As Used in this Privacy Statement, “Personal Information” means any information that may be Used, either alone or in combination with other information, to personally identify an individual or as otherwise defined by applicable state laws as noted below.

By accessing and Using Our Services, you acknowledge and fully understand Our Privacy Statement and freely consent to the information collection and Use practices described in this Privacy Statement. IF YOU DO NOT CONSENT TO THE INFORMATION COLLECTION AND USE PRACTICES DESCRIBED BELOW, YOU MUST IMMEDIATELY CEASE ANY ACCESS OR USE OF OUR SERVICES.

2. Information Collected

We collect certain information, including Personal Information, from and about you in three ways:

• directly from you;
• automatically via technology; and
• from third parties, such as from your employer or data aggregators.

Personal Information We Collect Directly From You. While the Personal Information We collect varies depending upon your Use of the Services and Our interactions with you, in general, We may collect the following Personal Information directly from you:

• Contact Information. When you contact Us, We collect your name, email address, phone number, postal address.

• Employment Information. When you contact Us or fill out one of Our forms ,We collect your contact information and employment information regarding the company you are reaching out on behalf of.

• Purchases and Payments. We collect purchase and payment information to facilitate the Services.

• Account Information. When you register for an account with Us, We collect your name, postal address, email address, date of birth password, and any other information used in connection with accessing your account.

• Communications and Interactions. When you send email, text message, call, or otherwise communicate with Us and with members of Our team, We collect and maintain a record of your contact details, communications, and Our responses.
• Responses and Feedback. If you participate in Our surveys or questionnaires, We collect your responses and feedback, such as user satisfaction or other information related to your use of the Services, and any other information you so choose to provide.
• Marketing and Promotions. We collect your email, name, and marketing preferences. If you participate in promotions We offer, We collect your name and other information related to the activities available through the Website.
• Inferences.  We may generate inferences about you based on other Personal Information We collect such as your preferences, behaviors, contact information, and demographics information.
• Preferences. We also may collect information about your preferences, including communications preferences.

Personal Information We Collect Automatically. We and Our third-party providers automatically collect Personal Information related to your use of the Website, including Using cookies and other similar technologies. The Personal Information We may automatically collect includes the below categories of information (collectively, “Usage Data”):

• Device and Browsing Information. When you visit the Website, We may collect IP address, browser type, domain names, access times, date/time stamps, operating system, language, device type, unique ID, Internet service provider, referring and exiting URLs, clickstream data, and similar device and browsing information.
• Activities and Usage. We also collect activity information related to your use of the Website, such as information about the links clicked, searches, features used, items viewed, time spent within the Website, your interactions with Us within the Website, and other activity and usage information.
• Location Information. We may also collect or derive location information about you, such as through your IP address. If you choose to enable location-based sharing with Us through your device settings, We may collect precise location information to provide content that is more relevant to your location and to otherwise improve your interactions with the Website. You may turn off location data sharing through your device settings.

Google Analytics.  We use Google Analytics on the Website to help us analyze traffic and improve services. For more information on Google Analytics’ processing of personal information, please see https://www.google.com/policies/privacy/partners/. You can opt-out of Google Analytics for Display Advertising and customize Google Display Network ads using the Ads Preferences Manager.  You can find out more about how Google uses cookies in advertising and opt-out via the following links: Google Display Network (DoubleClick) & Google Analytics Opt-out Browser Add-on.

Personal Information We Collect from Other Sources. In addition, We may collect and receive Personal Information from third parties, such as business partners, clients and customers, data analytics and data aggregator providers, public databases, and service providers. We may combine this information with Personal Information We collect directly from you, and use it to generate inferences about your preferences, behavior, or other characteristics, and market to you as permitted by applicable law.

3. Third Party Advertising

Advertisements appearing on and off Our Website may be delivered to users by advertising partners, who may set cookies. These cookies allow the ad server to recognize your computer each time they send you an online advertisement to compile information about you or others who Use your computer. This information allows ad networks to, among other things, deliver targeted advertisements that they believe will be of most interest to you. This Privacy Statement covers the use of cookies by Us and does not cover the use of cookies by any advertisers. We and Our service providers may use information about your interactions with Our Services to predict your interests and select the ads you see on and off Our Services. This is known as interest-based advertising. In providing interest-based ads, We follow the Self-Regulatory Principles for Online Behavioral Advertising developed by the Digital Advertising Alliance (“DAA”).  For more information about interest-based advertising and how you can opt out, visit:

• Digital Advertising Alliance: http://www.aboutads.info/choices/
• Network Advertising Initiative: http://www.networkadvertising.org/choices/

Social Media & Search Pixels.  We use Twitter/X Pixel, Google Ads and other similar tags to better measure, optimize, and retarget our marketing campaigns. This allows user specific behavior to be tracked after they have been redirected to the advertiser’s website by clicking on a social media or search ad. This enables us to measure the effectiveness of social media and search ads for statistical and market research purposes. This data is stored and processed by the social media and search providers. The social media and search providers may link this information to your social media or search account and also use it for its own promotional purposes, in accordance with their data usage policies.  For more information, please visit:

• https://about.ads.microsoft.com/en-us/resources/policies/microsoft-advertising-privacy-policy
• https://twitter.com/en/privacy

4. Protected Health Information

HealthTrust does not request, require, or intentionally collect protected health information (“PHI”) in order to provide access to the Services. If delivery of any Services necessitates HealthTrust’s access to PHI, such access will occur only under the applicable and legally required agreements and safeguards.

5. How May Your Information be Used and Disclosed

If you submit or We collect Personal Information through Our Services, then such Personal Information may be used in the following ways: (i) to provide, analyze, administer, and improve Our Services and related GPO services; (ii) to contact you in connection with Our Services or related GPO services and appointments, events or offerings that you may have registered for or requested; (iii) to identify and authenticate your access to the parts of Our portal or other password-protected services that you are authorized to access; (iv) to send you surveys and marketing materials; (v) for recruiting and human resources administration purposes; (vi) to better understand how users access and use the Services, and for other research and analytical purposes, to develop the Website and its features, and for internal quality control and training purposes; (vii) to protect Our rights or Our property and to ensure the technical functionality and security of Our Services; and (viii) as required to meet Our legal and regulatory obligations.

We do not sell, lease, rent or otherwise disclose the Personal Information collected from Our Services to third parties unless otherwise stated below or with your consent.

• Affiliates and Subsidiaries. We may disclose the personal information we collect to Our corporate affiliates and subsidiaries. We may also partner with other businesses to offer Our products, and we may disclose Personal Information to those business partners as necessary to facilitate your orders or requests.
• Vendors and Service Providers. We may disclose the Personal Information we collect to service providers who perform functions on Our behalf, such as IT and website hosting, marketing, and marketing research providers, customer support, data storage, analysis and processing providers, auditors, consultants, and legal counsel.
• Advertising Partners and Analytics & Marketing Partners (“Business Partners”). We may also disclose your Usage Data, name, and email to marketing and advertising networks, data analytics providers, and other companies who provide marketing or analytics services on Our behalf. For more information, please see Section 2 above.

• In the Event of Merger, Sale, Divestitures or Change of Control. We may transfer or assign Personal Information to an entity that acquires or is merged with Us as part of a merger, acquisition, sale, or other change of control.
• Other Disclosures. We may disclose Personal Information about you if We have a good faith belief that disclosure of such information is helpful or reasonably necessary to: (i) comply with any applicable law, regulation, legal process or governmental request; (ii) enforce Our terms of use, purchasing agreements, or participation agreements, including investigations of potential violations thereof; (iii) detect, prevent, or otherwise address fraud or security issues; or (iv) protect against harm to Our or third parties’ rights, property or safety.

In addition to the uses and disclosures of information outlined above, your information may also be used and disclosed as follows:

• If another individual is managing your account on your behalf, as authorized by you or as a personal representative under applicable law.

Aggregate and Deidentified Information. Notwithstanding anything else in this Privacy Statement, We may use, disclose, and otherwise process aggregate and deidentified information related to our business and the Services with third parties for quality control, analytics, research, development, and other legal purposes.

6. Information Security

No Website can guarantee security, but We utilize commercially reasonable physical, electronic, and procedural safeguards to protect your Personal Information collected via Our Services in compliance with applicable law.

7. Proactive Privacy Protection

In order to protect your privacy, you should:

• Never share your username or password;
• Always sign out when you are finished using the Portal;
• Use only secure web browsers;
• Employ common anti-virus and anti-malware tools on your system to keep it safe;
• Use a strong password with a combination of letters and numbers;
• Change your password often; and
• Notify Us immediately if you believe your login and/or password have been compromised at privacy@healthtrustpg.com.

If you share your Portal username and password with another person, this will allow that person to see your confidential information. We have no responsibility concerning any breach of your confidential information due to your sharing or losing your user name or password.

8. Third Party Websites

If you use Our Services to link to another third party Website, you may decide to disclose Personal Information at that Website. In contacting that third party Website, or in providing information on that Website, that third party may obtain Personal Information about you. This Privacy Statement does not apply when you leave Our Services and go to a third party Website. We encourage you to be aware when you leave Our Services and to read the privacy statements of each third party Website that collects personally identifiable information.

9. Communications Opt-Out

We may send certain messages, including electronic newsletters and marketing communications on a periodic basis. If you wish to be removed from such marketing messages, you may request to discontinue future ones. All such material will have information as to how to opt-out of receiving it, although certain messages (such as an account status update), may be required by law and will not have opt-out capabilities.

10. Information Retention.

We keep your personal data only as long as necessary to provide you with Our Services and for legitimate and essential business purposes, such as maintaining the performance of Our Services and related GPO services, making data-driven business decisions about new features and offerings, complying with Our legal obligations, and resolving disputes. We keep some of your Personal Information for as long as you are a registered member of Our Services.

11. Your Privacy Rights

11.1. Under California’s “Shine the Light” law, California residents have the right to request in writing from businesses with whom they have an established business relationship, (a) a list of the categories of Personal Information, such as name, e-mail and mailing address and the type of services provided to the customer, that a business has disclosed to third parties (including affiliates that are separate legal entities) during the immediately preceding calendar year for the third parties’ direct marketing purposes; and (b) the names and addresses of all such third parties. To request the above information, please contact us at privacy@healthtrustpg.com with a reference to California Disclosure Information.  We will endeavor to respond to such requests to information access within 30 days following receipt at the e-mail address stated above. If We receive your request at a different e-mail address, We will respond within a reasonable period of time, but not to exceed 150 days from the date received. Please note that We are only required to respond to each customer once per calendar year.

11.2. California Consumer Privacy Act  (“CCPA”).

• This section only applies to California residents (“Consumers”). For the purposes of this section only, “Personal Information” means information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Consumer or household.

11.2.1. Collection and Sharing of Personal Information.  

The chart below describes:

• The categories of Personal Information that We have collected, disclosed, or sold about Consumers in the preceding twelve (12) months and may collect about you through Our Services.

Sales and Sharing of Personal Information; Use for Targeted Advertising

Certain state laws, including the California Consumer Privacy Act, define “sale” as disclosing or making available personal information to a third-party in exchange for monetary or other valuable consideration, and “sharing” or “targeted advertising” as disclosing or making available Personal Information to a third-party for purposes of cross-contextual behavioral advertising.

While we do not disclose Personal Information to third parties in exchange for monetary compensation, we “share” or use for targeted advertising the following categories of Personal Information: identifiers, and Usage Data. We disclose these categories to our Business Partners (as described above) for purposes of marketing and advertising. We do not sell or share or use for targeted advertising Personal Information about individuals we know are under age 16.  For more information regarding your opt-out rights, see the below Your Privacy Rights and Choices.

Your Privacy Rights and Choices

Residents of states with generally applicable privacy laws may have the following rights regarding their personal information, subject to certain exceptions and qualifications under their respective state laws.

• Access and Data Portability. You have the right to request details about the Personal Information we have collected about you, such as whether we have collected Personal Information about you, the categories of sources, the purposes for which we have collected the Personal Information, the categories of recipients, and the specific pieces of Personal Information we have collected. You may also have the right to receive a copy of your Personal Information in a readily usable format.
• You may have the right to request we correct incorrect or inaccurate Personal Information, subject to restrictions regarding the determination of accuracy of the existing personal information.
• You may have the right to request deletion of your data unless an exception applies.
• Opt-Out of Sale, Sharing, or Targeted Advertising. You have the right to opt-out of “sales” and “sharing” of your Personal Information, and to opt-out of the use of your Personal Information for “targeted advertising” as those terms are defined under applicable state privacy laws. As described above, we disclose your Personal Information to advertising and analytics partners to help select and deliver ads that may be of interest to you, which may assist us with advertising-related analytics and result in our receipt of valuable consideration.

You have the right to opt-out of “sales” and “sharing” of your Personal Information or use for targeted advertising by using an opt-out preference signal. If the Website detects that your browser or device is transmitting an opt-out preference signal, such as the “global privacy control”—or GPC — signal, we will opt that browser or device out of the use of cookies or other tools on our site that result in a “sale” or “sharing” or use for targeted advertising of your personal information. If you come to the Website from a different device or from a different browser on the same device, or if you clear your cookies, you will need to opt-out again, or use an opt-out preference signal, for that browser and/or device as well.

To learn more about the Global Privacy Control, please visit: https://globalprivacycontrol.org/#download

• Limit Use and Disclosure. We do not collect nor engage in uses of sensitive Personal Information that would trigger a right to limit use and disclosure of sensitive Personal Information under applicable state privacy law.
• Opt-Out of Profiling with Legal or Significant Effects. You may have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. However, we do not engage in such activities as described under applicable state privacy law, so there is no need to exercise this right.

You may request to exercise your rights of access, deletion, or correction by contacting Us as described in the Consumer Requests section below.

CONSUMER REQUESTS AND VERIFICATION

Right to Non-Discrimination

We may not discriminate against you because you exercise any of your privacy rights contained in this Privacy Statement including, but not limited to:

• Denying goods or services to you;
• Charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties;
• Providing a different level or quality of goods or services to you; or
• Suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services.

Verifying Requests

You may request to exercise your rights of access, deletion, or correction by contacting Us as described in the Consumer Requests section below. To help protect your privacy and maintain security, We will take steps to verify your identity before processing your request.  If you request access to or deletion of your Personal Information, We may require you to provide any of the following information: name, email address, telephone number, or postal address, and account information. When you make such a request, you can expect the following:

• As required under applicable law, We will verify your identity. You will need to provide Us with your email address and full name. We may ask for additional information if needed.
• We will confirm that you want your information accessed, corrected, and/or deleted.
• We will confirm our receipt of your request within 10 days. If you have not received a response within a few days after that, please let Us know by contacting Us at the Website or phone number listed below.
• We will respond to your request within 45 days upon receipt of your request. If necessary, we may need an additional period of time, up to another 45 days, but We will reply either way within the first 45-day period and, if We need an extension, We will explain why.
• In certain cases, a request for access, correction, or deletion may be denied. For example, if We cannot verify your identity, the law requires that We maintain the information, or if We need the information for internal purposes such as providing services or completing an order. If We deny your request, we will explain why We denied it and delete any other information that is not protected and subject to denial.

Authorized Agents

You may designate an authorized agent to request any of the above rights on your behalf. You may make such a designation by providing the agent with written permission, signed by you, to act on your behalf. Your agent may contact Us as described in the Consumer Request section below to make a request on your behalf.

11.3 Your Nevada Privacy Rights

We comply with the requirements of the Nevada Privacy law, which provides residents with choices regarding how We share information. Nevada Covered Personal Information (“Nevada Personal Information”) includes personally identifiable information about a Nevada consumer collected online, such as an identifier that allows the specific individual to be contacted. Nevada Personal Information also includes any other information about a Nevada consumer collected online that can be combined with an identifier to identify the specific individual.  We may collect the following categories of covered information about you through Our Services:

• First and Last Name;
• Physical Address;
• Email Address;
• Telephone Number; and
• User Name.

Information on how We may disclose your Nevada Personal Information is described in detail in the above section “How May Your Information be Used and Disclosed.”

Third parties may collect covered information about your online activities over time and across different Internet Websites or online services when you Use the Services.

We do not sell your Nevada Personal Information for monetary payments. HoWever, the definitions of ‘Personal Information,’ ‘share,’ and ‘sale’ under the law are broad. BecaUse of the breadth of these definitions under the law, We have provided opt-out links. You have the right to direct Us not to sell or share your Nevada Personal Information..

If you Use or visit Our Services, you may review and request changes to any of your covered information that is collected.

If you would like to exercise your rights, please refer to the below section “Consumer Requests.”

12. Consumer Requests. You may exercise your consumer rights by clicking on the following link https://hcahealthcare.com/about/legal/consumer-request-form.dot and completing the request form, emailing Us Personal Information Request or by calling Us at 844-422-3282.

13. International Visitors

Our Services directed through Our Services are intended solely for businesses located in the United States.  Visitors from outside the United States should refer to Our HealthTrust Europe domain at www.healthtrusteurope.com.  If you are using Our Services from outside the United States, your information may be transferred to, stored or processed in the United States, where Our servers are located and Our central database is operated. Although the data protection and other laws of the United States and other countries might not be as comprehensive as those in your country, We take steps to protect your privacy, including, for transfer of Personal Information from the European Economic Area, the Use of consent or contractual clauses that have been approved by the European Commission. By Using Our Services, you understand and agree that your information may be transferred to Our facilities and those third parties with whom We share it as described in this Privacy Statement.

14. Children May Not Use the Services or Portal

We will never ask for or knowingly collect information from children through the Services. If you are a child, you are not permitted to use Our Services or related GPO services and should immediately exit Our Services. If you think that We have collected Personal Information from a child through Our Services, please contact Us at privacy@healthtrustpg.com and We will dispose of the information as required by applicable law.

15. Policy Changes

We reserve the right to revise or update this Privacy Statement at any time, and you should periodically read the Privacy Statement to learn of any revisions or updates. We will notify you of any changes to the Privacy Statement by posting the revised or updated Privacy Statement and its “Effective Date” on the Website.  If we make material changes, We will provide prominent notice such as through a notice or banner or, where feasible, via email). Using the Services thereafter constitutes your agreement to and acceptance of the Privacy Statement and its revisions or updates.

16. What if I have Questions or Concerns Regarding this Privacy Statement?

If you have any questions or concerns about this Privacy Statement or the information practices of Our Services, please contact Us at privacy@healthtrustpg.com.

You may also contact Us at:

HCA Healthcare
Data Protection Officer
One Park Plaza
Nashville, TN 37203