Skip to content

ON RECORD

Privacy Policy

Last updated: October 15, 2026

1. Introduction

ezOIG LLC ("ezOIG," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our OIG compliance platform and services.

2. Information We Collect

2.1 Information You Provide

We collect information that you directly provide to us, including:

  • Account information (name, email address, organization details)
  • Staff member information for compliance screening
  • Payment and billing information
  • Communications with our support team
  • Documents uploaded to our platform

2.2 Automatically Collected Information

We automatically collect certain information when you use our services:

  • Device and browser information
  • IP address and location data
  • Usage data and analytics
  • Cookies and similar tracking technologies

3. How We Use Your Information

We use the collected information for the following purposes:

  • Providing and maintaining our OIG compliance services
  • Processing exclusion list screenings
  • Sending notifications and compliance alerts
  • Processing payments and maintaining billing records
  • Improving our services and developing new features
  • Advertising our services, including showing our ads to people who have visited our public website, and understanding how our public website is used
  • Complying with legal obligations
  • Detecting and preventing fraud or security issues

4. Information Sharing and Disclosure

We may share your information in the following circumstances:

  • Screening Registries: To run the screenings you request, we submit the identifying details of each person you screen, such as name and, where a registry requires it, date of birth or license number, to the registry that performs the check: the HHS Office of Inspector General exclusion database; for Massachusetts checks, the Sex Offender Registry Board's ESORI portal, the Department of Public Health's license and Nurse Aide Registry search and, once available, the iCORI criminal record system; for Arkansas sex offender checks, the Arkansas Crime Information Center's public registry search, which receives the name only; and for Colorado medication aide checks, the Department of Public Health and Environment's QMAP register, which receives the name only. Other lists we screen against, such as SAM.gov, the OFAC sanctions list, state Medicaid exclusion lists and Colorado's license register, are downloaded in full and searched on our own systems, so nothing about the people you screen is sent to their publishers. Each registry handles the information it receives under its own policies.
  • Service Providers: We work with third-party service providers who assist in delivering our services, including cloud hosting and storage, payment processing, email delivery, and spam protection for our contact form. They may use your information only to provide those services to us.
  • Profile Pictures: To show your profile picture in the Service, our servers look up a one-way hash of your account email address with Gravatar, a service operated by Automattic Inc. If you have a Gravatar, we display it; if not, we show your initial. Your browser does not contact Gravatar, and we do not send Gravatar your email address itself.
  • Advertising and Analytics Partners: When you visit our public website, advertising and analytics platforms, such as Google, Meta, Microsoft, Reddit, LinkedIn and TikTok, receive information about your visit through their tags, which we load with Google Tag Manager, as described in section 8. When you start a trial they are told that a trial started, with its plan and price. They never receive information from inside the Service, including the people you screen.
  • Storage You Connect: When you connect your own storage account (such as Google Drive, Dropbox, OneDrive, Box, Amazon S3 or SFTP) and export to it, we send the data you choose to export to that account.
  • Legal Requirements: When required by law, court order, or government request
  • Business Transfers: In connection with a merger, acquisition, or sale of assets
  • With Your Consent: When you explicitly authorize us to share your information

We do not sell your personal information for money. Some privacy laws treat the advertising and analytics cookies described in section 8 as selling or sharing personal information; you can opt out of them as that section explains.

5. Data Security

We implement industry-standard security measures to protect your information, including:

  • Encryption of data in transit and at rest
  • Ongoing vulnerability management and security review of our software and systems
  • Access controls and authentication measures
  • HIPAA-eligible infrastructure and security safeguards
  • Regular backups and disaster recovery procedures

However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

We retain your information for as long as necessary to provide our services and comply with legal obligations. When you delete your account, we will delete or anonymize your personal information, except where we are required to retain it by law.

7. Your Rights and Choices

You have the following rights regarding your information:

  • Access: Request a copy of the personal information we hold about you
  • Correction: Request correction of inaccurate or incomplete information
  • Deletion: Request deletion of your personal information
  • Data Portability: Request a copy of your data in a portable format
  • Opt-Out: Opt out of marketing communications, and of advertising and analytics cookies as described in section 8

To exercise these rights, please contact us at legal@ezoig.com.

8. Cookies and Tracking Technologies

Inside the Service we use the cookies needed to run it: to keep you signed in, to protect forms against forged requests, and to remember your display preferences. We also set one cookie that records only that your browser has used the Service, so that our public website can ask advertising platforms to stop showing you our ads, as described below. When you add a payment method, our payment processor, Stripe, sets its own cookies to process the payment and prevent fraud.

On our public website (our home, features, pricing and policy pages, and the confirmation you see after sending us a message, but not the contact form itself), we use Google Tag Manager to load advertising and analytics cookies and similar technologies from third-party platforms, such as Google, Meta, Microsoft, Reddit, LinkedIn and TikTok. The platforms we use may change, but they are always advertising or analytics providers used for the purposes described here. They let these platforms measure how our ads perform and how our website is used, and show our ads to people who have visited our website, on their own sites and apps and across their advertising networks (often called retargeting or remarketing). Through them, each platform receives information such as the pages you visit, when you visit, your IP address, your device and browser, and whether you arrived from one of its ads, and may link it to an account you hold with that platform under its own privacy policy.

When you start a trial, a confirmation page tells these platforms once that a trial started, with its plan and price. When you send us a message through our contact form, the confirmation tells them that a message was sent and its topic, such as a demo request, but not your name, email address or what you wrote. Once you have used the Service, our public pages tell them that your browser belongs to a customer, so that they stop showing you our ads. Otherwise the tags are not loaded on our sign-in and signup pages or inside the Service, so they never receive your account information or anything about the people you screen.

If your browser sends a Global Privacy Control signal, our website loads neither Google Tag Manager nor any of these tags. You can also block or delete cookies in your browser settings, though the Service cannot keep you signed in without its own. Our Cookie Policy lists each cookie, what it does and how to opt out.

9. Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last Updated" date. Your continued use of our services after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us at:

Email: legal@ezoig.com
Address: ezOIG LLC, 145 Greenfield Ln, Castalian Springs, TN 37031

12. HIPAA Compliance

For healthcare organizations subject to HIPAA, we maintain administrative, physical and technical safeguards designed to protect Protected Health Information (PHI) and support our customers' HIPAA compliance. We will enter into a Business Associate Agreement (BAA) with covered entities where required.