Published Date:February 20, 2026
Effective Date: February 20, 2026
Last Updated: This version of the policy is no longer active, and is shared to archival purposes only. Click here for the current version and revision history.
Access the print version here.
These Smart Connect Terms of Use & Privacy and Security Notice (“Terms”) describe our conditions of use and minimum privacy and data practice commitments whenever individuals (“you”) use Smart Connect from b.well Connected Health, Inc. (alternately, “b.well”, “we”, “us” or “our”).
b.well is a connected health technology provider that powers consumer-centered health data access and exchange, working with our industry partners to create timely, relevant and personalized health experiences for patients and consumers, to help solve healthcare’s fragmentation problem.
Smart Connect helps you find and connect your health data from participating healthcare organizations, connected medical device & wellness applications, and national and regional networks (each a “Connected Network”). With Smart Connect, a modern digital identity credential simplifies your ability to manage all your data in one place, with an application you trust, without as many portal logins from different data sources.
b.well is not a “covered entity” under the Health Insurance Portability and Accountability Act (“HIPAA”), but many of our enterprise customers are, which makes HIPAA apply to us as a matter of law. We apply the same data practices for all our enterprise customers, regardless of whether they are regulated by HIPAA or not. As well, we are covered by state consumer privacy laws, as well as the Federal Trade Commission’s Health Data Breach Notification regulations and the Federal Trade Commission Act, which prohibits unfair and deceptive practices with respect to personal data. We also comply with the privacy and security requirements adopted by various Connected Networks from which we seek your health information – for example, the Trusted Exchange Framework and Common Agreement – when you choose to use Smart Connect. As well, we helped to draft, and have signed onto, the CARIN Alliance Code of Conduct for consumer-facing health applications.
When you agree to use Smart Connect and accept these Terms, you are authorizing b.well to act as your “individual access service provider”. This means b.well will retrieve your electronic health information from Connected Networks and make it available to you in the application you are using to access Smart Connect (as applicable, the “Connected App”).
Our relationship to you and your information is determined by the type of Connected App you are using:
If your Connected App links to the b.well Terms of Service and b.well Privacy Policy, the information we retrieve for you will be accessible in the b.well-branded Connected App. In this context, these Terms serve as an “Additional Privacy Notice” as outlined in the b.well Privacy Policy, and modify the b.well Terms of Service to conform with these Terms.
If you access Smart Connect through any other Connected App, b.well assumes different roles regarding your information:
As Your Designated Individual Access Service Provider: We are directly responsible to you only for electronically retrieving your health information from Connected Networks and transmitting it to the third-party Connected App. In this limited capacity, our relationship is governed by these Terms.
As a Service Provider (or Data Processor) for the Third-Party that controls the Connected App: In all other respects, we operate as a service provider for the legal entity that controls the Connected App. That legal entity is called a “data controller”. As their service provider, we are contractually bound to the data controller’s terms of service and privacy notice for the Connected App. To reflect this, the third party may share with you a disclosure like the following about b.well:
Secure Data Intermediary. [data controller]’s data intermediary partner is b.well Connected Health, Inc. When you authorize data connections through [data controller], you may be requested to authorize b.well to establish these connections for you. As a service provider to [data controller], b.well is required to comply with the [data controller] terms of service and privacy notice.
We also describe this relationship in our Privacy and Security Statement.
Bottom line: Regardless of how you access Smart Connect, b.well does not gain any rights to your data beyond those granted by the Connected App’s terms and privacy policy, except for the purpose of performing the services described in these Terms.
Once information retrieved through Smart Connect is available to you in the Connected App, the Connected App’s terms of service and privacy notice apply to that information.
Any conflict between these Terms and a Connected App’s terms and privacy policy will be resolved with priority to protecting your privacy rights and the security of your information.
We can modify these Terms at any time. Our up-to-date Terms (with their effective date and a revision history) will be posted with Legal Notices on our website at bwell.com and in Smart Connect.
For immaterial changes, we will continue to retrieve your information. For material changes, you will stop looking for your information until you accept the updated Terms via new opt-in consent. We will notify you by email if the changes to the Terms are material.
Examples of a material change include if we begin to:
If you refuse to accept the modified Terms, you will have access to your already-retrieved information through the application you use to access Smart Connect.
b.well maintains a number of certifications for implementing recognized industry best practices for consumer privacy and information security practices for technology companies that manage health information, including the certifications listed below. Certifications are issued based on testing performed by independent assessors that are qualified by the certification organizations.
Without limiting the foregoing, we encrypt all of your information in transit and at rest, and our sub-processors are required to meet our minimum privacy and information security commitments. We maintain a list of our sub-processors on our website. While we implement reasonable privacy controls and information security measures to safeguard your personal information from unauthorized access, disclosure, use, modification and loss, there is always a risk of data breach outside of our reasonable control, and you accept that risk. We have protocols in place to notify you and help you through next steps if your data is compromised.
| Effective Date | Link to prior version (as applicable) | Description |
| February 20, 2026 | N/A | First published version |
We collect information about you from you directly, from our other platform services and from trusted third-parties.
Trusted third-parties include:
The categories of personal information we collect includes:
We use this information to:
De-Identified Data: We may deidentify and/or aggregate individually identifiable information, in accordance with the HIPAA de-identification standards at 45 CFR 164.514(b), in connection with our services or for our internal business purposes, such as creating and analyzing usage data. Usage data reflects general patterns and trends about how users interact with the Smart Connect Services (for example, feature utilization, navigation flows, and performance metrics) but does not identify any individual user. We use usage data to analyze, maintain, and improve the functionality, performance, and user experience in Smart Connect and related services, and to generate reports, which we may share with customers and the public.
In general, we only share your information with Connected Networks, the data controller for your Connected App and our third-party service providers. We may also share your information when required by law or court order, or in connection with business transfers (such as a merger or acquisition).
1.Connected Networks
We share the minimum information necessary to search for, locate and retrieve information. If authorized by the data controller for your Connected App, we can also share information with organizations that you designate, which may be Connected Networks or their participating organizations.
If you are not using a b.well-branded Connected App, we share your information with the data controller for your Connected App.
We share the minimum necessary information with our sub-processors to help us provide the Smart Connect service. These companies are acting on our behalf and are required, by contract with us, to keep your information confidential, and are only authorized to use it for specified purposes, consistent with our contractual commitments, applicable law and other requirements.
We closely scrutinize all law enforcement and regulatory requests. We do not disclose information to law enforcement or regulatory authorities unless we determine it is necessary to do so under law to comply with a valid court order, subpoena, civil investigation demand or search warrant, and our reasonable efforts to limit disclosures to anonymized, redacted or minimum necessary information are unsuccessful.
If we are not prohibited from doing so (e.g. under the Patriot Act), we will attempt to notify you within three (3) business days of receiving any such legal process, and within three (3) business days of responding with your information. We also seek assurances from the requesting law enforcement or government agency that it will protect information to the highest degree possible and will not disclose it in violation of applicable federal or state confidentiality laws. While we cannot offer assurance that these efforts will be successful, we will maintain a record of these disclosures.
If we are a party to a legal proceeding with you, we will not disclose information retrieved from Connected Networks for purposes of resolving a civil dispute. If we are not a party to a legal proceeding but receive a valid subpoena, discovery request or other lawful process, we will attempt to notify you, request a protective order, and use reasonable efforts to limit disclosures of your health information to the minimum necessary to accomplish their intended purpose.
If we enter into a merger, acquisition, or the sale of all or part of our assets, Smart Connect will likely be part of the assets transferred. A successor cannot make a material change to these Terms without your opt-in consent.
| Opt-In Consent | We will not launch Smart Connect without your affirmative opt-in consent |
| Withdrawal of Consent | You can withdraw your consent at any time through Smart Connect or your Connected App; we will immediately honor your request upon our receipt. Be advised, A withdrawn consent does not undo our prior authorized requests or disclosures. It also does not stop any uses or disclosures that are either required by law or that are otherwise permitted by applicable law. ‘’ To relaunch Smart Connect, you will need to provide a new opt-in consent. |
| No Use Against You: | b.well will never use information retrieved from Connected Networks to make claims against you, except (if applicable) to collect fees or costs for services you requested. |
| Data Minimization | We only collect and use the minimum necessary amount of personal information as necessary to fulfill the permitted uses and disclosures described in these Terms. |
| No sale of your information | We do not sell your information, except in the event of a business transfer. In that case, these Terms cannot change materially without your opt-in consent, in accordance with these Terms. |
| No use for marketing or targeted advertising | We do not use your information to market our services or target you for advertising. |
| No fees; other costs | We do not charge fees for access to Smart Connect or for access to information we retrieve from Connected Networks. We get paid by customers to support your access through their Connected Apps. The fees and other business terms you accept to use these Connected Apps to access your information are between you and these customers. To access and use Smart Connect, you will need access at your own expense to the internet, a computer, cell phone number, smartphone or similar handheld device, an acceptable digital identity credential from a recognized organization and a Connected App. We are not responsible for the fees that you incur from these third parties. |
| Data retention | Under these Terms, we only maintain your information until it is available for you in the Connected App or until you withdraw consent for Smart Connect. The period of time varies with the timing of receipt, volume and complexity of the information we retrieve from Connected Networks. After the retrieved information is available to you in the Connected App, the terms and privacy notice for that Connected App applies. We will continue to retain other information as necessary to maintain your Smart Connect services, unless you request that we delete it by contacting our Privacy Team. We will delete it within a reasonable time, except for the minimum necessary in our audit logs and our backup systems as required by our information security program, and to comply with applicable law. |
| Incident reporting | We will notify you by email if we believe that the security of your personal information may have been compromised, as required by law, regulation and other requirements. |
| Data Access Requests | We make your information accessible through your Connected App in a machine readable format. However, a machine-readable format in PDF can be requested by verified users by contacting our Privacy Office. |
| Data Deletion Requests | You can permanently delete your PHR at any time and for any reason without closing your b.well account. |
| Data Corrections | Data corrections are typically discovered in the Connected App. If you discover an error, contact the data controller for the Connected App. If we received the error through Connected Network, you may be required to request the correction from the original data source. |
| Contact us | If you have a question or concern about b.well, Smart Connect or our data practices, we will work to promptly resolve these questions or concerns. Please direct them to our privacy team, as follows: By mail: Privacy Team |
We are required as a participant in different Connected Networks to make the following disclosures:
Commonwell Health Alliance (https://www.commonwellalliance.org/):
Any information retrieved through Commonwell is provided to you on an as-is, as available basis, with no warranty of any kind, and for information purposes only. You disclaim any claim that Commonwell’s services or any information retrieved through Commonwell is medical advice.
The Trusted Exchange Network and Common Agreement (https://rce.sequoiaproject.org/tefca/)
REQUEST-ONLY IAS PROVIDER: B.WELL DOES NOT PROVIDE BIDIRECTIONAL SERVICES THROUGH TEFCA. YOU WILL HAVE THE ABILITY TO REQUEST ACCESS TO YOUR HEALTH INFORMATION VIA TEFCA EXCHANGE. YOU WILL NOT BE ABLE TO USE B.WELL TO SHARE YOUR HEALTH INFORMATION WITH OTHER PARTICIPANTS IN TEFCA.
U.S. Centers for Medicare & Medicaid Services (CMS)
Be advised, CMS does not certify or endorse the Smart Connect functionality. CMS disclaims any warranty relating to its’ services for facilitating the retrieval of information from CMS, or to the information itself.
U.S. Department of Veterans Affairs
Be advised, CMS does not certify or endorse the Smart Connect functionality. CMS disclaims any warranty relating to its’ services for facilitating the retrieval of information from CMS, or to the information itself.
Jurisdiction-Specific Provisions
Jurisdiction-Specific Legal Disclosures are published on bwell.com under Legal notices, and may be updated over time.
This Section III only applies if you are not using a b.well-branded mobile or online application that links to the b.well Terms of Service and b.well Privacy Notice.
Because b.well operates principally on the internet, you consent to transact business with us online and electronically. Among other things, this means that we collect legally binding consents and other agreements from you using electronic signatures that are binding under the federal Electronic Signatures in Global and National Commerce Act (E-sign Act), 15 U.S.C. §§7001-7006, and any similar state law based on the Uniform Electronic Transaction Act. These electronic signatures, represented by the unique identifiers associated with your account, bear the same legal authority as your written signature.
When you send emails or other electronic messages to us through Smart Connect, you are communicating with us electronically and consent to our review and analysis of these messages, and to receiving return communications, if any, from us electronically. You agree that all documents, notices, disclosures, and other communications that we provide to you through the email address you provide through the service satisfy any legal requirement that such communications be in writing.
To access and use Smart Connect, you will need access at your own expense to a Connected App, the internet, a computer, cell phone number, smartphone or similar handheld device, and an acceptable digital identity credential from a recognized organization. We are not responsible for the fees that you incur from unrelated third parties.
By agreeing to these Terms, you agree not to:
We reserve the right to monitor your use of Smart Connect and your access to and use of data associated with your account, to ensure compliance with these Terms, and applicable law or other legal requirements. We may remove or disable your account or access to any personal information, at any time, without notice, and at our sole discretion, if we reasonably believe your access and use of Smart Connect violates these Terms. We may investigate violations of the Terms or conduct that negatively affects Smart Connect or any of our other products or services. We may consult and cooperate with law enforcement authorities, if warranted, and reserve the right to prosecute users who violate the law.
b.well represents and warrants to you as follows:
By accepting these Terms and using Smart Connect, you agree to hold b.well and its officers, employees, directors, licensors and agents (collectively, “Indemnitees”) harmless from any and all losses, damages, liability and expenses (including reasonable attorneys’ fees), rights, claims, costs, actions of any kind and injury arising out of or in connection with: (1) your violation or breach of any term of these Terms or any applicable law or regulation; (2) your violation of any rights of any third party; or (3) your negligence or willful misconduct.
By accepting these Terms and using Smart Connect, you agree to hold b.well and its officers, employees, directors, licensors and agents (collectively, “Indemnitees”) harmless from any and all losses, damages, liability and expenses (including reasonable attorneys’ fees), rights, claims, costs, actions of any kind and injury arising out of or in connection with: (1) your violation or breach of any term of these Terms or any applicable law or regulation; (2) your violation of any rights of any third party; or (3) your negligence or willful misconduct.
These Terms remain effective until terminated by either party for any reason. If you no longer agree to be bound by these terms, you must stop using Smart Connect by withdrawing your consent. Following any termination, (1) these Terms will continue to apply and be binding upon you in respect of your prior use of Smart Connect (and any unauthorized further use thereof); and (2) any rights or licenses granted to us under these Terms will survive such termination.
This section is referred to in these terms as the “Arbitration Agreement.” In consideration of the terms and conditions of these Terms, you agree that any and all disputes or claims that have arisen or may arise between you and b.well, whether arising out of or relating to the terms (including any alleged breach thereof), the services, any advertising, any aspect of the relationship or transactions between us, shall be resolved exclusively through final and binding arbitration, rather than a court, in accordance with the terms of this Arbitration Agreement, except that you may assert individual claims in small claims court, if your claims qualify.
Further, this Arbitration Agreement does not preclude you from bringing issues to the attention of federal, state, or local agencies, and such agencies can, if the law allows, seek relief against us on your behalf. You agree that, by entering into these Terms, you and b.well are each waiving the right to a trial by jury or to participate in a class action. Your rights will be determined by a neutral arbitrator, not a judge or jury. The Federal Arbitration Act governs the interpretation and enforcement of this Arbitration Agreement.
Also, you waive any right to join or consolidate disputes by or against others as a representative or member of a class, to obtain relief in any arbitration in the interests of the general public, or to act as a private attorney general. If any provision related to this section is found to be illegal or unenforceable, then such provision shall be severed from the Arbitration Agreement but the rest of the arbitration clause shall remain enforceable and in full effect. The substance of any disputes where public injunctive relief is available shall be decided by the arbitrator. Only if the claimant succeeds on its claim permitting the remedy of a public injunction may such claimant request that a court of competent jurisdiction enter an injunction in conformity with the arbitral award.
These Terms are governed by and construed in accordance with the laws of Maryland. Subject to the Arbitration Agreement contained in these Terms, exclusive venue for making any legal claim or originating any dispute arising out of accessing or using Smart Connect shall be Baltimore City. Any such dispute or legal proceeding shall be exclusively governed by the laws of Maryland, without regard to any conflicts of law.
If any provision of these Terms is determined to be invalid under any applicable statute or rule of law, such provision shall be deemed omitted, and the balance of these Terms shall remain enforceable.
© 2026 b.well Connected Health. All rights reserved.
