PRIVACY POLICY

1. Scope and Overview

This Privacy Policy explains how Transformation Revenue Cycle Management, operating the KPMS Training Simulator, collects, uses, shares, retains, and protects personal information.

In this Policy, "KPMS," "Platform," "Company," "we," "us," and "our" refer to Transformation Revenue Cycle Management and the KPMS Training Simulator.

This Policy applies to:

• Individual learners.
• Professional Membership subscribers.
• Instructors and organization administrators.
• Learners using KPMS through an employer, school, college, or workforce training program.
• Customers who purchase individual, subscription, organizational, institutional, enterprise, or custom training services.
• Visitors who contact KPMS or use the KPMS website.

KPMS is a United States service. This Policy is designed for United States customers.

This Policy applies to information collected through:

• The KPMS website.
• The KPMS Training Simulator.
• Account registration and login.
• Purchases and subscriptions.
• Training activities and assessments.
• Certificate verification.
• Customer support and refund requests.
• Organizational and institutional administration.

This Policy should be read together with the KPMS Terms of Service and the KPMS Refund & Cancellation Policy.

The Terms of Service and Refund & Cancellation Policy are incorporated into the customer relationship by reference where applicable. The current versions are available at:

Terms of Service: [Terms of Service URL]

Refund & Cancellation Policy: [Refund & Cancellation Policy URL]

Privacy Policy: [Privacy Policy URL]

2. Information We Collect

2.1 Information You Give Us

We may collect information that you provide directly, including:

• Full name.
• Email address.
• Telephone number.
• Organization, employer, school, or training program.
• Job title, role, or learner status.
• Account registration information.
• Billing address and related transaction information.
• Information submitted in support requests.
• Information provided in refund requests.
• Information provided in billing inquiries or payment disputes.
• Information provided in accessibility or accommodation requests.

We collect only the information reasonably needed for the applicable business purpose.

2.2 Account and Authentication Data

We may collect and record:

• Account credentials and authentication information.
• Sign-in and sign-out events.
• Account creation and activation dates.
• Password reset events.
• Device or session authentication information.
• Failed login attempts.
• Role and permission changes.
• Records of suspected unauthorized access.

KPMS does not store complete payment-card numbers or card security codes.

2.3 Training and Assessment Data

We may collect and record:

• Training progress.
• Lesson completion.
• Simulation activity.
• Assessment results.
• Capstone activity.
• Knowledge-check activity.
• Completion percentages.
• Certificate eligibility and issuance.
• Certificate status and revocation records.
• Training summaries and reports.
• Records needed to evaluate refund eligibility.

These records support training delivery, assessment integrity, certificate issuance, certificate verification, customer support, billing decisions, and dispute resolution.

2.4 Organizational and Institutional Data

When KPMS is used through an organization or institution, we may collect and process:

• Organization name.
• License and seat quantities.
• Seat assignments.
• Seat reassignment records.
• Learner enrollment status.
• License activation and expiration dates.
• Payment entitlement changes.
• Administrator actions.
• Organization-level training reports.
• Records of authorized administrator access.

2.5 Payment and Transaction Data

Payments may be processed by Stripe or another payment processor identified during checkout.

KPMS may retain:

• Transaction references.
• Purchase date.
• Product or plan purchased.
• Amount charged.
• Currency.
• Payment status.
• Renewal dates.
• Refund status.
• Payment processor information.
• Records of duplicate charges or billing errors.

KPMS does not store complete payment-card numbers or card security codes. Payment information is handled according to the payment processor's policies and applicable legal requirements.

2.6 Support and Communications Data

We may collect communications between you and KPMS, including:

• Refund requests.
• Billing inquiries.
• Cancellation requests.
• Technical support requests.
• Dispute correspondence.
• Account-access communications.
• Accessibility requests.
• Communications concerning suspected misuse or security incidents.

Refund requests may include your name, account email, purchase date, plan or organization name, receipt or transaction reference, and reason for the request.

Do not send complete credit-card numbers, card security codes, passwords, or unnecessary sensitive information by email.

2.7 Technical and Usage Data

We may collect technical and usage information, including:

• Internet Protocol address.
• Device type.
• Browser type and version.
• Operating system.
• Session information.
• Login activity.
• Referring and exit pages.
• Platform features used.
• Error and diagnostic information.
• Security and fraud-prevention signals.
• Cookies and similar technologies.

We use this information to operate the Platform, maintain security, troubleshoot problems, analyze performance, and prevent misuse.

2.8 Information KPMS Does Not Want

KPMS does not seek, need, or want real patient information or protected health information.

Users must not enter or upload:

• Real patient names.
• Medical record numbers.
• Insurance identifiers.
• Clinical records.
• Patient account information.
• Protected health information.
• Other information that identifies a real patient.

KPMS training scenarios use fictional information only.

3. How We Use Information

We may use information for the following purposes.

3.1 Training Delivery and Progress Tracking

We use account, authentication, training, assessment, organizational, and technical information to:

• Provide access to the Platform.
• Track lessons and simulations.
• Save progress.
• Display training results.
• Support instructors and administrators.
• Maintain learner accounts.
• Provide training reports.

3.2 Assessment Integrity

We use account, authentication, training, assessment, and security information to:

• Confirm the identity of the learner using an account.
• Detect account sharing.
• Investigate suspicious activity.
• Protect assessment materials.
• Maintain accurate completion records.
• Investigate academic-integrity concerns.

3.3 Certificate Issuance and Verification

We use account, training, completion, and certificate information to:

• Determine whether completion requirements were satisfied.
• Issue Certificates of Completion.
• Maintain certificate records.
• Verify earned certificates.
• Respond to authorized verification requests.
• Process certificate corrections or revocations when documented grounds exist.

Certificate verification is intended to remain available while the applicable verification service and underlying records are maintained, subject to operational availability, this Policy, and applicable law; there is no automatic 24-month verification expiration.

3.4 Billing and Entitlement Management

We use account, organization, transaction, payment-entitlement, and administrative information to:

• Process purchases.
• Manage subscriptions.
• Apply seat assignments.
• Track license periods.
• Process renewals.
• Identify failed payments.
• Correct billing errors.
• Confirm cancellations.
• Manage access after payment or expiration.

3.5 Refund and Dispute Handling

We use account, training, transaction, support, and communications information to:

• Review refund requests.
• Determine whether applicable usage thresholds were reached.
• Confirm purchase and renewal information.
• Investigate duplicate or unauthorized charges.
• Respond to chargebacks and payment disputes.
• Preserve records needed to explain a decision.
• Support later complaints, audits, or legal proceedings.

KPMS aims to acknowledge refund requests within three business days.

3.6 Account Security and Abuse Prevention

We use authentication, technical, usage, administrative, and security information to:

• Protect accounts.
• Detect unauthorized access.
• Prevent fraud.
• Investigate misuse.
• Maintain Platform security.
• Restrict activity that threatens users or the Platform.
• Preserve evidence of security incidents.

3.7 Legal Compliance and Business Records

We may use relevant information to:

• Comply with legal obligations.
• Respond to lawful requests.
• Enforce the Terms of Service.
• Enforce the Refund & Cancellation Policy.
• Protect the rights, safety, and property of KPMS and others.
• Maintain tax, accounting, billing, and business records.
• Resolve complaints and disputes.

3.8 Service Improvement

We may use technical, usage, support, and deidentified training information to:

• Improve Platform performance.
• Identify errors.
• Improve instructions and workflows.
• Evaluate feature use.
• Improve customer support.
• Maintain reliable and secure services.

We do not use real patient information for service improvement.

4. Fictional Training Data

KPMS uses fictional patient accounts, claims, remittances, payment records, insurance scenarios, and revenue cycle workflows.

These scenarios are created for educational purposes. They are not records about real individuals and must not be treated as real patient information.

Users must not enter real patient information into KPMS.

If a user inadvertently submits real patient information, the user should promptly contact:

info@kpmstraining.com

The user should not include additional patient information in the notification.

After receiving a report, KPMS may:

• Restrict access to the affected material.
• Investigate the submission.
• Delete the information when reasonably practicable.
• Request limited information needed to locate the submission.
• Preserve a minimal incident record when needed for security, legal, or compliance purposes.
• Take other reasonable steps to prevent further access or disclosure.

KPMS does not guarantee that deletion can remove every copy from backups, security logs, or systems operated by service providers. Any retained information will be limited to what is reasonably necessary and will be handled according to this Policy and applicable law.

5. Legal Basis and Consent

Because KPMS serves United States customers, this Policy uses plain-language descriptions of business purposes rather than European legal terminology.

KPMS may collect and use information when it is reasonably necessary to:

• Provide the requested Platform services.
• Manage an account or subscription.
• Process a purchase or refund.
• Administer an organizational license.
• Maintain training and certificate records.
• Protect security and prevent misuse.
• Comply with law.
• Protect rights and safety.
• Respond to a customer request.

Where applicable law requires consent, KPMS will request consent before collecting or using the information for that purpose.

You may withdraw consent where the law provides that right. Withdrawal may not affect processing that occurred before withdrawal or processing that KPMS must continue for legal, security, billing, certificate, or dispute purposes.

KPMS may record the version of a policy accepted by a user and the date of acceptance. Acceptance records may be retained for compliance, billing, account administration, and dispute resolution.

Where permitted by law, continued use of the Platform after notice of an updated Policy constitutes acceptance of the updated Policy.

6. Sharing and Disclosure

KPMS may share information with the following categories of recipients.

6.1 Payment Processors

We share transaction and payment-related information with Stripe or another payment processor identified during checkout.

The processor handles payment information according to its own privacy policy and applicable requirements.

6.2 Hosting and Infrastructure Providers

We may share information with providers that host, maintain, secure, or support the Platform and its databases.

6.3 Email and Communication Providers

We may use providers to send account messages, renewal notices, support communications, refund responses, security alerts, and other service communications.

6.4 Analytics Providers

We may use analytics providers if analytics tools are enabled.

Analytics may help us understand Platform performance, feature use, errors, and general usage trends.

[OWNER CONFIRMATION REQUIRED: Identify whether KPMS uses analytics providers and list them before publication.]

6.5 Professional Advisers

We may disclose information to attorneys, accountants, auditors, insurers, consultants, and other professional advisers when reasonably necessary to provide advice, protect rights, comply with law, or resolve a dispute.

6.6 Organizations and Institutions

If a learner accesses KPMS through an employer, school, college, workforce program, or other institution, authorized administrators may receive information about that learner's:

• Training progress.
• Assessment results.
• Seat activity.
• Completion records.
• Certificate status.
• License participation.

The organization or institution may establish additional rules for account access and reporting.

6.7 Legal and Safety Disclosures

We may disclose information when reasonably necessary to:

• Comply with law, regulation, subpoena, court order, or legal process.
• Respond to a government request.
• Protect the rights, safety, or property of KPMS, users, or others.
• Investigate fraud, security incidents, or unlawful activity.
• Enforce the Terms of Service or other agreements.
• Support a merger, acquisition, financing, restructuring, sale, or transfer of business assets.

6.8 Business Transfers

If KPMS or substantially all of its assets are transferred, personal information may be transferred as part of that transaction. The recipient will be expected to handle the information according to applicable law and any applicable privacy commitments.

6.9 No Sale of Personal Information

KPMS does not sell personal information.

For this Policy, "sell" means exchanging personal information for money or other valuable consideration in a transaction that is treated as a sale under applicable privacy law.

KPMS does not provide personal information to data brokers for sale.

[CURRENT SUBPROCESSOR LIST: Insert the current list of hosting, infrastructure, payment, email, analytics, security, and other service providers that process personal information for KPMS.]

7. Cookies and Similar Technologies

KPMS may use cookies, software development kits, pixels, local storage, and similar technologies.

7.1 Strictly Necessary Technologies

These technologies may be used to:

• Maintain authentication.
• Keep a user signed in.
• Manage sessions.
• Protect accounts.
• Remember security settings.
• Support shopping-cart or checkout functions.
• Maintain Platform operation.

Disabling strictly necessary cookies may prevent sign-in or cause portions of the Platform to stop working.

7.2 Preference Technologies

Preference technologies may remember settings such as:

• Display preferences.
• Account preferences.
• Language or accessibility settings.
• Other choices made during Platform use.

7.3 Analytics Technologies

Analytics technologies may be used to understand:

• Platform performance.
• Feature use.
• Error rates.
• General traffic patterns.
• Training-flow problems.

Analytics technologies will be used only if enabled by KPMS.

[OWNER CONFIRMATION REQUIRED: Confirm whether analytics cookies or software development kits are used.]

7.4 Managing Cookies

You may control cookies through your browser or device settings.

Some browsers allow you to block, delete, or receive notice about cookies. Blocking cookies may affect Platform functionality.

KPMS does not promise that every browser or device control will stop every similar technology.

8. Organizational and Institutional Privacy

When a learner accesses KPMS through an employer, school, college, workforce program, or other institution, the organization may administer the account and license.

Authorized administrators may see:

• Learner name and account email.
• Seat assignment and seat activity.
• Training progress.
• Assessment results.
• Completion records.
• Certificate status.
• Account or license status.

The organization or institution may provide notice to learners about its own monitoring and reporting practices.

The organization is responsible for obtaining any consent or providing any notice required for its use of learner information.

Where a school, college, or workforce program licenses KPMS, the institution remains responsible for its obligations under the Family Educational Rights and Privacy Act, commonly called FERPA, and applicable state student-data laws.

KPMS processes student training records as directed by the institution under the applicable Organizational or Institutional License Agreement.

A learner's privacy request may be routed through the organization when the organization controls the account or is legally responsible for the applicable records.

9. Certificate Verification and Third-Party Disclosure

KPMS may allow an employer or other authorized third party to verify an earned Certificate of Completion.

KPMS intends to make earned certificates verifiable for as long as the verification service and relevant records are maintained, subject to applicable law and operational availability. There is no automatic 24-month verification expiration and no guarantee of perpetual availability.

A verification result is limited to the minimum information reasonably needed to confirm the certificate. It may display:

• Learner name.
• Completed program or course.
• Certificate issuance date.
• Certificate status.

A verification result does not display:

• Assessment answers.
• Assessment scores.
• Detailed training activity.
• Other learner records.
• Payment information.
• Organization information unless needed for the verification result.

KPMS may require a certificate number, verification link, or other information before displaying a result.

Certificate verification may cease when the verification service or relevant records are lawfully discontinued. Limited certificate records may be retained for legitimate verification, legal, administrative, dispute, and recordkeeping purposes, subject to applicable law and documented retention practices.

If a certificate is revoked, the verification result may display that the certificate is revoked or otherwise invalid. Revocation will be handled according to the Terms of Service and applicable policies.

10. Retention

KPMS retains information only for as long as reasonably necessary for the purposes described in this Policy, unless a longer period is required or permitted by law.

10.1 Account and Contact Information

Account and contact information is generally retained while the account is active and for up to two years after account closure.

Information may be retained longer when needed for billing, legal, security, certificate verification, dispute, or other documented business purposes.

10.2 Training and Assessment Records

Training progress, assessment records, simulation performance, completion records, and related administrative records are retained while needed to administer training, support organizational reporting, resolve disputes, and meet applicable legal obligations. Exact retention periods and deletion procedures must be verified against the production system and applicable institutional contracts before publication.

10.3 Certificate and Verification Records

KPMS intends to retain limited certificate and verification records for as long as reasonably necessary to support its verification service, legal obligations, fraud prevention, and dispute resolution. There is no automatic 24-month deletion or verification cutoff. KPMS does not promise indefinite retention. Institutional retention and export obligations may be set by a signed data agreement.

10.4 Policy Acceptance Records

Records showing the policy version accepted and the date of acceptance are generally retained for at least seven years after the later of:

• The last transaction.
• Account closure.
• The end of the applicable business relationship.

A longer period may apply when needed for legal or dispute purposes.

10.5 Transaction and Refund Records

Transaction, payment, refund, cancellation, renewal, and billing records are generally retained for at least seven years after the transaction or resolution of the applicable matter.

Refund request records are retained to support the refund decision, respond to later questions, and address payment disputes, complaints, audits, or legal obligations.

10.6 Support and Communications Records

Support, refund, billing, and dispute communications are generally retained for at least seven years after the matter is resolved when they relate to a transaction, account decision, security issue, or legal dispute.

10.7 Security Logs

Security and authentication logs are retained under the Company's documented security retention schedule, which must be confirmed before publication, and may be retained longer where necessary for investigations, security, legal compliance, or disputes.

10.8 Deletion and Deidentified Information

When a retention period ends, KPMS may delete, anonymize, or deidentify information.

Deidentified or aggregated information that no longer identifies a person may be retained and used for legitimate business purposes.

Records retained beyond account closure will be limited to information needed for certificate verification, legal, tax, billing, security, compliance, or dispute purposes.

11. Your Choices and Rights

Depending on applicable law, you may have the right to request:

• Access to personal information held by KPMS.
• Correction of inaccurate personal information.
• Deletion of personal information.
• A copy or portability of certain personal information.
• Information about how personal information is used or shared.
• Other rights provided by applicable state law.

You may submit a privacy request by emailing:

info@kpmstraining.com

11.1 Request Verification

Before completing a request, KPMS may verify your identity and account relationship.

Verification may require:

• Confirming the account email address.
• Providing information that matches account records.
• Confirming a recent transaction or organization relationship.
• Completing another reasonable authentication step.

KPMS will not request complete payment-card numbers or card security codes for identity verification.

11.2 Response Process

KPMS will review and respond to a verified request within the deadline required by applicable law, unless a different period is required by applicable law.

If additional time is legally permitted and reasonably necessary, KPMS may provide an explanation and an expected response date.

A learner's request may be routed through the learner's organization when the organization administers the account or controls the applicable student records.

11.3 Limits on Requests

A request may be denied or limited when:

• KPMS cannot reasonably verify the requester's identity.
• The request would disclose another person's information.
• The information must be retained for certificate verification.
• The information is needed for an open refund, billing, chargeback, or legal dispute.
• Retention is required by law, tax rules, accounting requirements, or a lawful request.
• Deletion would impair security or fraud prevention.
• The organization or institution controls the applicable records.
• The request is repetitive, excessive, or otherwise subject to a lawful exception.

If KPMS denies or limits a request, it will provide an explanation where required by law.

11.4 State Privacy Rights

Additional rights may apply under state privacy laws.

[OWNER CONFIRMATION REQUIRED: Confirm whether KPMS meets or expects to meet applicable thresholds under state privacy laws, including California, Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, Virginia, and other applicable states.]

If a state law applies, this Policy will be supplemented with the notices, rights, appeal process, opt-out methods, and other disclosures required by that law.

12. Security

KPMS uses reasonable administrative, technical, and organizational safeguards designed to protect personal information.

Safeguards may include:

• Role-based access controls.
• Account authentication controls.
• Credential protections.
• Encryption in transit.
• Restricted administrative access.
• Monitoring for suspicious activity.
• Backup and recovery controls.
• Security procedures for service providers.
• Incident investigation procedures.
• Personnel access limitations.

No system is perfectly secure.

Users are responsible for protecting account credentials and promptly reporting suspected unauthorized access.

If KPMS determines that a security incident requires notice under applicable law, KPMS will provide notice as required by that law.

Notice may be provided by email, account message, website notice, postal mail, or another legally permitted method.

Implementation condition: Establish and document the incident-response and notification procedure before publication; applicable legal deadlines govern.

13. Children

KPMS is not intended for children under 13.

KPMS does not knowingly collect personal information from children under 13.

Minors may use KPMS only where permitted by law and under an appropriate institutional arrangement.

If KPMS learns that it has collected personal information from a child under 13 without an appropriate legal basis or required consent, KPMS will take reasonable steps to:

• Delete the information.
• Disable the account where appropriate.
• Contact the parent, guardian, or institution when appropriate.
• Preserve only the minimum information needed to document the deletion or comply with law.

A parent or guardian who believes a child under 13 provided personal information to KPMS should contact:

info@kpmstraining.com

14. Health Information and HIPAA Status

KPMS is intended for fictional training data only and is not offered as a service for processing protected health information on behalf of covered entities. The standard simulator service does not include a business associate agreement. HIPAA status depends on actual services and data handling and requires legal review where applicable.

The Platform is designed for fictional training data only.

Users must not enter real patient information or protected health information into KPMS.

If real patient information is submitted inadvertently, the user should notify KPMS promptly at:

info@kpmstraining.com

The user should not include additional patient details in the notification.

KPMS may restrict access, investigate the submission, delete the information when reasonably practicable, and retain a minimal incident record when needed for security, legal, or compliance purposes.

Use of KPMS does not authorize a user, employer, school, healthcare organization, or other customer to submit protected health information to the Platform.

15. Changes to This Policy

KPMS may update this Privacy Policy to reflect:

• Changes to the Platform.
• Changes to products or services.
• Changes to information practices.
• Changes to legal requirements.
• Changes to service providers.
• Security or operational improvements.

Each version will identify its version number and effective date.

KPMS will provide notice of material changes as required by law. Notice may be provided through the Platform, by email, through an account message, or by posting the updated Policy on the website.

Where permitted by law, continued use of the Platform after the effective date of an updated Policy constitutes acceptance of the updated Policy.

A material change will not retroactively reduce rights associated with information already collected unless permitted by law or agreed to by the affected person.

KPMS may retain records showing the version and date of a user's acceptance.

16. Contact Us

Questions, privacy requests, or concerns may be directed to:

KPMS Training Simulator

Operated by Transformation Revenue Cycle Management

Georgia, United States

Website: https://kpmstraining.com

Email: info@kpmstraining.com

Phone: (470) 797-0090

Business Hours: Monday through Friday, 9:00 AM to 5:00 PM Eastern Time

17. Document Status

DOCUMENT STATUS: DRAFT, PENDING OWNER APPROVAL AND LEGAL REVIEW

This Privacy Policy is not effective until approved and published by Transformation Revenue Cycle Management.

Before publication, the Company should confirm:

• The registered legal name of Transformation Revenue Cycle Management.
• The Company's formation state.
• The current list of subprocessors.
• Whether analytics or advertising cookies are used.
• Applicable state privacy law thresholds.
• The retention period for security logs.
• The applicable privacy-request response deadline.
• The security incident notification process.
• The final Privacy Policy URL.
• Whether a separate privacy contact is required.

This Privacy Policy should be reviewed by a Georgia-qualified attorney and aligned with the KPMS Terms of Service, the KPMS Refund & Cancellation Policy, and any Organizational or Institutional License Agreement before publication.