Privacy statement

Table of Contents

• Introduction
• Data Protection Officer
• How we collect and use (process) your personal information
• Use of the banquethealth.com website
• Cookies and tracking technologies
• Use of the Banquet Health services
• Text messaging (SMS) notifications
• Sharing information with third parties
• Transferring personal data to the U.S.
• Data Subject rights
• Security of your information
• Data storage and retention
• Children's data
• Questions, concerns, or complaints

Introduction

Banquet Health is a modern software solution for healthcare food management. Its software is designed to increase operational efficiency, improve patient experience scores, better manage patient safety, help lower expenses in a challenging fiscal environment and optimize synergies through enterprise solutions.

We understand that you are aware of and care about your own personal privacy interests, and we take that seriously. This Privacy Notice describes Banquet Health’s policies and practices regarding its collection and use of your personal data, and sets forth your privacy rights. We recognize that information privacy is an ongoing responsibility, and so we will from time to time update this Privacy Notice as we undertake new personal data practices or adopt new privacy policies.

Data Protection Officer

Banquet Health is headquartered in Brooklyn, New York, in the United States. Banquet Health has appointed an internal data protection officer for you to contact if you have any questions or concerns about Banquet Health’s personal data policies or practices. If you would like to exercise your privacy rights, please direct your query to Banquet Health’s data protection officer. Banquet Health’s data protection officer’s name and contact information are as follows:

Charlton Field

support@banquethealth.com

How we collect and use (process) your personal information

Banquet Health collects personal information about its website visitors, customers, and individuals who use the Banquet Health applications. For website visitors and customer representatives, this information is generally limited to:

• name
• job title
• employer name
• work address
• work email
• work phone number

We use this information to provide prospects and customers with services.

We do not sell personal information to anyone and only share it with third parties who are facilitating the delivery of our services.

From time to time, Banquet Health receives personal information about individuals from third parties. Typically, information collected from third parties will include further details on your employer or industry. We may also collect your personal data from a third party website (e.g. LinkedIn)

Use of the Banquet Health Website

As is true of most other websites, Banquet Health’s website collects certain information automatically and stores it in log files. The information may include internet protocol (IP) addresses, the region or general location where your computer or device is accessing the internet, browser type, operating system and other usage information about the use of Banquet Health’s website, including a history of the pages you view. We use this information to help us design our site to better suit our users’ needs. We may also use your IP address to help diagnose problems with our server and to administer our website, analyze trends, track visitor movements, and gather broad demographic information that assists us in identifying visitor preferences.

Banquet Health has a legitimate interest in understanding how customers and potential customers use its website. This assists Banquet Health with providing more relevant products and services and with providing appropriate staffing to meet customer needs.

Cookies and tracking technologies

Banquet Health uses only essential cookies to ensure secure access and performance of our website and application. We do not use any advertising, marketing, or behavioral tracking cookies.

We may use cookies for the following purposes:

• Authentication: To allow users to securely log in to the application.
• Performance Monitoring: To help us detect and troubleshoot technical issues.

These cookies are required for core functionality and do not collect personally identifiable information. Users cannot disable these cookies, but we do not use any optional, non-essential, or third-party tracking cookies.

Use of the Banquet Health services

Banquet Health provides software applications to its hospital and health system customers, including an order-ahead application that allows authorized individuals (such as employees of our customers and, where the feature is enabled, guests) to place advance food orders for pickup. When you use the order-ahead application, we collect: (a) your name and account information, which may be provisioned by your organization’s administrator; (b) your mobile phone number, if you provide one or enable order notifications; and (c) order information, such as the items you order, order status, and pickup details. We use this information to operate the application, process and fulfill your orders, and send you order-related notifications, including text (SMS) notifications as described below under “Text messaging (SMS) notifications.” We do not use this information for marketing, advertising, or promotional purposes, and we do not sell it.

Text messaging (SMS) notifications

If you opt in to receive text message notifications through the Banquet Health order-ahead application, Banquet Health will send you SMS messages about the status of your order, such as confirmations that your order has been received, is ready for pickup, or has been delivered. These messages are transactional only; we do not use text messaging for marketing, advertising, or promotional purposes.

(a) Opt-in. You opt in within your account profile by turning on “SMS order updates,” entering your
mobile number, and confirming it with a one-time verification code. Consent to receive text messages is not a condition of placing an order or of any other purchase. Please update your mobile number in the application if it changes.

(b) Message frequency. Message frequency varies based on your order activity.

(c) Fees. Message and data rates may apply. Wireless carriers are not liable for delayed or undelivered
messages.

(d) Opt-out. You may opt out at any time by replying STOP to any message or by turning off “SMS
order updates” in your account profile. After you opt out, you will receive a final message confirming that you have been unsubscribed.

(e) Help. Reply HELP to any message or contact us at support@banquethealth.com for assistance.
No mobile information will be shared with third parties or affiliates for marketing or promotional
purposes. Information sharing with subcontractors in support services, such as customer service and
message delivery, is permitted. All other categories described in this policy exclude text messaging
originator opt-in data and consent; this information will not be shared with any third parties.

Sharing information with third parties

The personal information Banquet Health collects from you is stored in one or more databases hosted by third parties located in the United States. These third parties do not use or have access to your personal information for any purpose other than performing services on our behalf, such
as cloud storage, retrieval, and message delivery. On occasion, Banquet Health engages service providers to send communications to you on our behalf. These service providers are not permitted to use your personal information for any other purpose.

A list of our third party sub processors can be found here:

• Amazon Web Services (including AWS End User Messaging, which delivers our SMS
  notifications)
• Datadog
• Google Workspace
• Cloudflare

We do not otherwise reveal your personal data to non-Banquet Health persons or businesses for their independent use unless: (1) you request or authorize it; (2) it’s in connection with Banquet Health-hosted and Banquet Health co-sponsored conferences as described above; (3) the information is provided to comply with the law (for example, compelled by law enforcement to comply with a search warrant, subpoena, or court order), enforce an agreement we have with you, or to protect our rights, property or safety, or the rights, property or safety of our employees or others; (4) the information is provided to our agents, vendors or service providers who perform functions on our behalf; (5) to address emergencies or acts of God; or (6) to address disputes, claims, or to persons demonstrating legal authority to act on your behalf. We may also gather aggregated data about our services and website visitors and disclose the results of such aggregated (but not personally identifiable) information to our partners and service providers for legitimate business purposes, such as service improvement and benchmarking. Mobile phone numbers and text messaging opt-in data and consent are never shared with or sold to third parties or affiliates for marketing or promotional purposes.

The Banquet Health website connects with third party services such as Facebook, LinkedIn, Twitter and others. If you choose to share information from the Banquet Health website through these services, you should review the privacy policy of that service. If you are a member of a third party service, the aforementioned connections may allow that service to connect your visit to our site to your personal data.

Transferring personal data to the U.S.

Banquet Health has its headquarters in the United States. Information we collect about you will be processed in the United States. By using Banquet Health’s services, you acknowledge that your personal information will be processed in the United States. The United States has not sought nor received a finding of “adequacy” from the European Union under Article 45 of the GDPR. Pursuant to Article 46 of the GDPR, Banquet Health is providing for appropriate safeguards by entering binding, standard data protection clauses, enforceable by data subjects in the EEA and the UK. These clauses have been enhanced based on the guidance of the European Data Protection Board and will be updated when the new draft model clauses are approved.

Depending on the circumstance, Banquet Health also collects and transfers to the U.S. personal data with consent; to perform a contract with you; or to fulfill a compelling legitimate interest of Banquet Health in a manner that does not outweigh your rights and freedoms. Banquet Health endeavors to apply suitable safeguards to protect the privacy and security of your personal data and to use it only consistent with your relationship with Banquet Health and the practices described in this Privacy Statement. Banquet Health also enters into data processing agreements and model clauses with its vendors whenever feasible and appropriate. Since it was founded, Banquet Health has received zero government requests for information.

For more information or if you have any questions, please contact us at support@banquethealth.com.

Data Subject rights

The European Union’s General Data Protection Regulation (GDPR) and other countries’ privacy laws provide certain rights for data subjects. Data Subject rights under GDPR include the following:

• Right to be informed
• Right of access
• Right to rectification
• Right to erasure
• Right to restrict processing
• Right of data portability
• Right to object
• Rights related to automated decision making including profiling

This Privacy Notice is intended to provide you with information about what personal data Banquet Health collects about you and how it is used.

If you wish to confirm that Banquet Health is processing your personal data, or to have access to the personal data Banquet Health may have about you, please contact us.

You may also request information about: the purpose of the processing; the categories of personal data concerned; who else outside Banquet Health might have received the data from Banquet Health; what the source of the information was (if you didn’t provide it directly to Banquet Health); and how long it will be stored. You have a right to correct (rectify) the record of your personal data maintained by Banquet Health if it is inaccurate. You may request that Banquet Health erase that data or cease processing it, subject to certain exceptions. You may also request that Banquet Health cease using your data for direct marketing purposes. In many countries, you have a right to lodge a complaint with the appropriate data protection authority if you have concerns about how Banquet Health processes your personal data. When technically feasible, Banquet Health will—at your request—provide your personal data to you.

Reasonable access to your personal data will be provided at no cost. If access cannot be provided within a reasonable time frame, Banquet Health will provide you with a date when the information will be provided. If for some reason access is denied, Banquet Health will provide an explanation as to why access has been denied.

For questions or complaints concerning the processing of your personal data, you can email us at support@banquethealth.com. Alternatively, if you are located in the European Union, you can also have recourse to the European Data Protection Supervisor or with your nation’s data protection authority.

Security of your information

Banquet Health maintains commercially reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, and disclosure. Banquet Health maintains a SOC 2 Type II attestation and aligns its security program with applicable healthcare privacy and security requirements. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

Data storage and retention

Your personal data is stored by Banquet Health on its servers, and on the servers of the cloud-based database management services Banquet Health engages, located in the United States. Banquet Health retains service data for the duration of the customer’s business relationship with Banquet Health and for a period of time thereafter, to analyze the data for Banquet Health’s own operations, and for historical and archiving purposes associated with Banquet Health’s services. Banquet Health retains prospect data until such time as it no longer has business value and is purged from Banquet Health systems. All personal data that Banquet Health controls may be deleted upon verified request from Data Subjects or their authorized agents. For more information on where and how long your personal data is stored, and for more information on your rights of erasure and portability, please contact us at:

support@banquethealth.com

Children’s data

We do not knowingly attempt to solicit or receive information from children.

Questions, concerns or complaints

If you have questions, concerns, complaints, or would like to exercise your rights, please contact us at:

Banquet Health

support@banquethealth.com