I. Information We Collect

“Personal Information” refers to any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual.

The Personal Information we may collect includes the following:

· Contact details such as name, email address,phone number, and address;

· Account details such as username and password;

· Website tracking data such as IP address;

· Job applicant and employee information including contact information, resume, employment history, education history, government identification (e.g. Social Security number), and background check information;

· Protected classification characteristics to the extent voluntarily provided by job applicants; and

· Inferences drawn from any of the information listed above to create a profile about an individual reflecting their preferences, characteristics, behavior, or attitudes.

We may also collect Personal Information automatically using various tracking technologies, such as cookies, on our Site. The information collected by these tracking technologies may include IP address, referring URL, device ID, web browser characteristics, and date and time of activity. See further information in the section below.

If you provide us Personal Information relating to other individuals, you warrant that you have the authority to do so, and where required, have obtained the necessary consent, and acknowledge that it may be used in accordance with this Privacy Policy.

II. Online Tracking Technologies

We use cookies and similar technologies, such as tracking pixels, tags, scripts, software development kits, local storage objects, and web beacons (collectively, “cookies”), to collect information about your interactions with our Site, including your browsing activities, device and browser information, pages viewed, links clicked, referring URLs, marketing campaign interactions, preferences, and other usage information. Some cookies are necessary to operate the Site, while others help us improve the Site, measure the effectiveness of our marketing, personalize content, and deliver or measure advertising.

· Strictly Necessary Cookies. These cookies are required for the Site to function and cannot be switched off in our systems. They are usually set in response to actions you take, such as setting your privacy preferences, logging in, or filling out forms.

· Performance and Functionality Cookies. These cookies are used to enhance the performance and functionality of our Site but are not essential to its use. However, without these cookies, certain functionality, such as videos or interactive features, may become unavailable.

· Analytics and Customization Cookies. These cookies collect information that helps us understand how our Site is being used, evaluate traffic patterns, measure the effectiveness of our marketing campaigns, and provide a more personalized Site experience. These technologies may include, for example, Hotjar Tracking, which helps us understand user interactions with the Site; UTM Tracker and Marketo - Referring URL, which help us identify referring sources and marketing campaign performance; Marketo Munchkin Tracking, which helps measure interactions with our marketing content and Site; Marketo Measure (Bizible), which helps attribute marketing activities to business outcomes; Calibermind, which helps analyze account-based marketing and customer journey activity; and ZoomInfo WebSight, which helps identify business visitors and understand company-level Site engagement.

· Advertising Cookies. These cookies are used to make advertising messages more relevant to you. They may prevent the same ad from continuously reappearing, help ensure that ads are properly displayed for advertisers, measure the effectiveness of advertising campaigns, and, in some cases, select advertisements based on your interests or interactions with our Site. These technologies may include, for example,Facebook Pixel, LinkedIn Base Pixel, Base Twitter Pixel, Event Twitter Pixel, Demandbase Tag, Adwords w Form, Marketo Measure (Bizible), Calibermind, and ZoomInfo WebSight. These tools may allow us and our advertising or analytics partners to collect or receive information from our Site and elsewhere on the internet and use that information to provide measurement services, deliver targeted advertising, create or refine audiences, attribute conversions, or understand engagement with our ads and Site.

· Social Networking Cookies: These cookies enable you to share our Site’s content through third-party social networks and other websites. These cookies may also be used by social media platforms and other third parties for advertising, analytics, personalization, measurement, or similar purposes. These technologies may include, for example, Facebook Pixel, LinkedIn Base Pixel, Base Twitter Pixel, and Event Twitter Pixel.

Third parties that provide cookies or similar technologies may use the information they collect for their own purposes in accordance with their privacy policies. Depending on where you reside and how these technologies are used, our use of certain analytics, advertising, social networking, and similar tracking technologies may constitute a “sale,” “sharing,” or “targeted advertising” activity under applicable U.S. state privacy laws.

You can manage your cookie preferences at any time by using our Cookie Manager. You may also be able to manage cookies through your browser settings. If you disable or reject certain cookies, some features of the Site may not function properly. Where required by applicable law, we will obtain your consent before placing non-essential cookies on your device, and you may withdraw or change your consent at any time through the Cookie Manager.

Our Site’s cookie management tool is configured to honor opt-out preference signals sent by Global Privacy Control (“GPC”) within your browser. Please note that due to technical limitations, the GPC signal may only be recognized within your current browser. For more information on GPC please visit https://globalprivacycontrol.org.

Some internet browsers have “Do Not Track” or “DNT” features which, when turned on, send a signal to a website that the individual visiting the website does not wish to be tracked. Such browser features and industry standards are not uniform, so our Site does not respond to DNT signals, but you can control your cookie preferences in the settings of your Internet browser. Please note that if you block or reject cookies on our Site, some functionality of the Site may be limited.

III. Information Use

We process Personal Information for a variety of purposes,including to:

· Respond to your questions and communicate with customers and prospective customers;

· Solicit feedback from customers and prospective customers;

· Operate, manage, and run our business and maintain records;

· Provide, develop, improve, and maintain our products and Services;

· Analyze and better understand consumers’ needs, preferences, and interests and conduct analysis and research;

· Advertise and promote our products and Services, including by contacting you to market products, services, and topics that maybe of interest to you or otherwise provide you with news, announcements, or updates;

· Collect and analyze information about characteristics and behavior of visitors to our Site;

· Detect and prevent fraud and perform identity verification;

· Perform accounting, audit, and other internal functions, such as internal investigations;

· Evaluate job applicants for employment;

· Comply with laws, regulations, legal processes,and internal policies;

· Exercise and defend legal claims; and

· For any other purpose you may agree to at or before the time your Personal Information is collected.

We may also aggregate and/or anonymize Personal Information and analyze that data for statistical, research, or any other purposes permitted by law.

IV. Information Disclosure

We disclose Personal Information in the following ways:

· To affiliates and subsidiaries within our corporate family.

· To contractors Health Catalyst uses to support our business in which case we will require such third parties to agree to treat it consistently with this Privacy Policy and use it only for the same purposes.

· To third-party marketing, advertising, analytics, and social media companies, who may process Personal Information for their own purposes.[NP4] 

· In connection with the sale, assignment, or other transfer of the business of the Site to which the information relates, in which case we will require any such buyer to agree to treat it in accordance with this Privacy Policy and use it only for the same purposes;

· To respond to law enforcement requests or where required by applicable laws, court orders, or government regulations;

· To third parties as deemed necessary to comply with legal requirements or to establish or exercise our legal rights to defend against legal claims; or

· When we believe it is necessary to share information to assist in an investigation regarding, or to prevent, illegal activities, suspected fraud, or potential threats to the safety of any person.

Health Catalyst does not sell Personal Information for monetary consideration, though certain of our digital analytics and advertising activities may constitute a “sale” or “sharing” of Personal Information as those terms are defined under applicable privacy laws (see further discussion in Your Privacy Rights and Privacy Notice for California Residents sections below).

V. Your Communication Choices

You may opt out of receiving email marketing communications from us by clicking the unsubscribe link included in our emails or by contacting us. Please note that we may still send you transactional and administrative emails even if you opt out of marketing communications.

You may opt-out of receiving automated text message marketing communications from us by replying “STOP” to the message or contacting us. Please note that we may still send you transactional and administrative text messages even if you opt out of marketing communications.

Based on where you live, you may have additional rights regarding your Personal Information (see further information in the Your Privacy Rights section below).

VI. Your Privacy Rights

Depending on your state of residency, you may have certain privacy rights, subject to certain exceptions, including:

· Right to Access. You may have the right to request that we disclose what Personal Information we collect, use, disclose, and sell about you.

· Right to Correction. You may have the right to request correction of Personal Information that we maintain about you if you find that the Personal Information is inaccurate.

· Right to Deletion. You may have the right to request that we delete Personal Information that we have collected from you.

· Data Portability. You may have the right to request a copy of your Personal Information in a portable and, to the extent technically feasible, readily usable format.

· Right to Withdraw Consent. You may have the right to withdraw your consent to the processing of your Personal Information.

· Right to Opt-Out. You may have the right to opt-out of certain uses of your Personal Information such as for(i) a “sale” or (ii) “sharing” for cross-context behavioral advertising.

· Right to Appeal. In some circumstances, we may deny your request to exercise one of your privacy rights described in this Privacy Policy (e.g., if we cannot verify your identity). You may appeal our decision by responding to our denial email or submitting a request to compliance@healthcatalyst.com

We do not engage in profiling activities that further automated decisions producing legal or similarly significant effects.

Requests to exercise your rights may be made using the contact information listed at the end of this Privacy Policy, or as otherwise described in this Privacy Policy. We will not discriminate against you for exercising your privacy rights.

VII. Information About Children

The Site is not intended for children under the age of 18. We do not knowingly collect personally identifiable information via the Site from visitors in this age group. If you believe that we have unintentionally collected Personal Information about your child, you can contact us by mail or email as described below.

VIII. Security

Health Catalyst takes reasonable steps to protect personally identifiable information as you transmit it to our Site and to protect such information from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. You should know and consider that no Internet or mobile device transmission, including text messages, is ever completely secure or error-free. As a result, while we strive to protect your Personal Information, we cannot guarantee that it will be 100% secure. Your transmission of your information to our Site thus is done entirely at your own risk.

IX. Retention of Personal Information

We retain the Personal Information we collect for the time period required to fulfill the legitimate business purposes for which it was collected and to engage in the use and disclosure practices outlined in this Privacy Policy, unless a different retention period is required by applicable law, or otherwise to fulfill a legal obligation or protect our legal rights. We may also maintain for an indefinite period of time certain Personal Information that has been de-identified. This information is no longer considered Personal Information and we commit not to attempt to reidentify such information.

X. Links to Other Websites

The Site may contain links or references to other websites to which this Privacy Policy does not apply, including social media platforms.We encourage you to read the Privacy Policy of every website you visit.

XI. Changes to This Privacy Policy and Supplemental Notice

Health Catalyst reserves the right to modify, add or remove portions of this Privacy Policy at its discretion and without prior notification.  Any changes to this Privacy Policy will be posted on this site.  Please check back periodically, and especially before you provide any Personal Information to us.  

XII. How to Contact Us

If you have any questions, comments, or concerns about this Privacy Policy or our information protection practices, please contact us as follows:

Compliance@healthcatalyst.com

or

Health Catalyst

10897 South River Front Parkway, #300

South Jordan, Utah, 84095

SUPPLEMENTAL NOTICE

PRIVACY NOTICE FOR CALIFORNIA RESIDENTS

Effective Date: July 21, 2026

This Privacy Notice for California Residents supplements the information contained in the Health Catalyst Privacy Policy above (“PrivacyPolicy”), and applies only to California residents (“you,” “your” or“consumer”). This section provides additional disclosures for residents of California, as required by the California Consumer Privacy Act, as amended(the “CCPA”). Please remember that the information we collect varies based on our relationship with you and note that certain Personal Information or activities may not be reflected in this section because they are exempt from the CCPA.

I. CCPA Categories of Personal Information We Collect, How and Why We Collect Them

We collect the following categories of Personal Information about California consumers. This information may be, or may have been, collected directly from you, automatically when you use our Services, from third parties, or from publicly available sources.

• Identifiers, including real name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, Social Security number, or other similar identifiers.
• Personal Information described in Cal. Civ. Code § 1798.80(e), including name, signature, address, telephone number, education, employment, employment history, bank account information, or other financial information, or health insurance information.
• Characteristics of protected classifications under California or federal law, including age and date of birth, gender, medical condition, or disability. Additional protected classification characteristics may also be collected from job applicants such as veteran status, race or ethnicity.
• Internet or other electronic network activity information, including Internet or other similar activity, browsing history, search history, information about a consumer’s interaction with our Site.
• Geolocation data, including location data inferred from your device IP address.
• Professional or employment-related information, including business contact information as well as information collected from job applicants during the hiring process including resumes, cover letters, education history, employment history, and background check information.
• Non-public education information, including transcripts or other information which may be collected during the hiring process.
• Inferences used to create a profile reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

We use the Personal Informationwe collect for the purposes described in the Information Use section of our Privacy Policy.

II. CCPA Categories of Personal Information Disclosed

We disclose all of the abovecategories of Personal Information to service providers or to other third parties as described in the Information Disclosure section above.

III. CCPA Categories of Personal Information Sold or Shared

Under the CCPA, a “sale” ofPersonal Information includes disclosures of Personal Information to third parties who may use the information for their ownpurposes, such as analytics and advertising partners. Similarly, “sharing” Personal Information refers to disclosing Personal Information to third parties for cross-context behavioral advertising. Per these definitions, we may sell and/or share the following categories of Personal Information to third party analytics and advertising partners:

• Internet or other electronic network activity information

Californiaresidents should refer to the Your Privacy Rights section of our Privacy Policy for information regarding their privacy rights under the CCPA and how toexercise them.

You have the right to direct us to not share, disclose, orsell your Personal Information. To exercise this right, you or your authorizedrepresentative may submit a request by clicking on the Do Not Sell or Share My PersonalInformation link on the homepage of our Site

California’s “Shine the Light” law (Civil Code Section §1798.83) permits users of our Site that are California residents to requestcertain information regarding our disclosure of Personal Information to thirdparties for their direct marketing purposes.

IV. Contact Us

If you have any questions, comments, or concerns about this Privacy Notice for California or our information protection practices, please contact us as follows:

Compliance@healthcatalyst.com