Privacy Policy.

1. Scope

This policy applies to masrecovery.com and to the business relationships MAS maintains with healthcare providers, partners, and vendors. It does not cover patient data we receive under a Business Associate Agreement (BAA) on behalf of a covered entity — that data is governed by our HIPAA practices and the BAA itself. See our HIPAA Notice for those obligations.

2. Information we collect

We collect only what we need to respond to inquiries, deliver services, and operate the site:

• Contact information you submit through our forms (name, organization, work email, phone, and the message you write).
• Engagement data if you become a client — contract terms, billing details, and the operational data needed to perform the services you've engaged us for.
• Site usage data — standard server logs (IP address, browser, pages viewed) and limited analytics used to understand how visitors find and use the site.

We do not sell personal information. We do not run third-party advertising on this site.

3. How we use information

• To reply to your inquiry and follow up about a potential engagement.
• To deliver, support, and improve the revenue cycle services we provide to clients.
• To comply with legal, regulatory, and contractual obligations (HIPAA, FDCPA, TCPA, FCRA, state consumer protection law).
• To detect, prevent, and respond to fraud, security incidents, or abuse of the site.

4. How we share information

MAS shares information only with:

• Service providers we engage to operate the site, email, telephony, and internal tooling — bound by confidentiality and data protection terms.
• Healthcare clients whose accounts you may be contacting us about — in which case sharing is governed by our BAA and HIPAA.
• Law enforcement, regulators, or courts when required by valid legal process, or to protect rights, property, and safety.
• A successor entity in connection with a merger, acquisition, financing, or sale of assets — subject to commitments at least as protective as this policy.

5. Security

MAS maintains administrative, technical, and physical safeguards aligned with the NIST Cybersecurity Framework and the HIPAA Security Rule. These include access controls, encryption in transit, audit logging, vulnerability management, and workforce training. No system is perfect — if you believe you've discovered a security issue, please email info@masrecovery.com.

6. Retention

We retain personal information only as long as needed for the purposes for which it was collected, to satisfy our legal and contractual obligations, and to resolve disputes. Operational records associated with healthcare receivables are retained in accordance with HIPAA, our BAAs, and applicable state and federal recordkeeping requirements.

7. Your choices

• Access & correction. You may ask us to confirm what personal information we hold about you and to correct inaccuracies.
• Deletion. You may ask us to delete your information, subject to our legal, contractual, and recordkeeping obligations.
• Marketing email. You may opt out of marketing email at any time via the unsubscribe link or by emailing us.
• Cookies. You can control cookies via your browser settings. Blocking cookies may affect site functionality.

To exercise any of these rights, contact us using the details below. We will verify your identity before acting on a request.

8. State-specific rights

Residents of California, Colorado, Connecticut, Virginia, Utah, and other states with comprehensive privacy laws may have additional rights, including the right to know, the right to delete, the right to correct, the right to opt out of certain processing, and the right to non-discrimination for exercising those rights. To submit a verifiable request, email info@masrecovery.com.

9. Children

This site is not directed to children under 13, and we do not knowingly collect personal information from children.

10. International visitors

MAS operates from the United States. If you access this site from outside the U.S., you understand that your information will be transferred to, processed in, and stored in the United States, which may have different data protection laws than your jurisdiction.

11. Updates to this policy

We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date at the top of this page.

12. How to contact us