Corewell Technology Privacy Policy
Section 1
Scope and who we are
Corewell Technology (“Corewell,” “we,” “us,” or “our”) is a managed IT services provider and cybersecurity firm located at 21031 Ventura Blvd, 2nd Floor, Woodland Hills, CA 91364, serving businesses across Los Angeles County and Orange County, California, with remote support nationwide.
This policy applies to the website located at corewelltechnology.com and its subdomains, to our client portal and support tools, to information you submit through our forms, and to information we obtain in the course of assessing, managing, securing, and supporting the technology of our clients. It applies to prospective clients, current clients and their employees, vendors, and visitors to this website.
Where a signed master services agreement, business associate agreement, data processing agreement, or nondisclosure agreement between you and Corewell imposes stricter confidentiality or data-handling obligations than this policy, those terms govern the information they cover.
Section 2
Information we collect
We collect only what we need to assess, propose, deliver, secure, support, and bill for our services.
Information you give us directly
- Contact and inquiry information submitted through our assessment, estimator, and contact forms and by telephone or email: name, company, job title, business address, telephone number, email address, employee count, industry, and the details of your request.
- Account and billing information: billing contact, purchase order and tax identifiers, and payment information, which is processed by a PCI DSS compliant payment processor. Corewell does not store full payment card numbers on its own systems.
- Support communications: tickets, chat transcripts, correspondence, and, where you are told in advance, recordings or transcripts of support calls.
Information generated by managing client systems
When we manage a client environment, our monitoring, security, backup, and remote-support tools necessarily process information about the devices, accounts, and networks in that environment: device identifiers and configurations, installed software, patch status, user account names and sign-in events, security alerts and the files or messages that triggered them, network device logs, backup contents, and remote-session recordings. We access this information only to deliver the services in our agreement with the client, and we do not use client data for any other purpose.
We do not read our clients’ email, files, or messages except as required to resolve a specific support request, investigate a security incident, or perform a migration or recovery at the client’s direction, and such access is logged.
Information collected automatically on this website
- IP address, approximate city- or region-level location derived from it, browser type and version, operating system, device type, screen dimensions, and language settings.
- Referring URL, pages viewed, time on page, interactions with the cost estimator, files downloaded, and exit pages.
- Cookie and similar identifiers as described in Section 5.
Information from third parties
- Business credit reporting agencies and public commercial records, used for credit review on new client accounts.
- Software, cloud, and hardware vendors, in connection with licensing, warranties, and support for our clients.
- Analytics providers, which may return aggregated audience measurement data about this website.
Sensitive information we do not seek
We do not knowingly collect Social Security numbers, precise geolocation, biometric identifiers, health information, or information about race, religion, sexual orientation, or political affiliation through this website. Please do not include such information in form submissions or support tickets. Protected health information and other regulated data held in a client’s systems is governed by our business associate or data processing agreement with that client.
Section 3
How we use information
- Delivering service: assessing environments, preparing proposals, onboarding, monitoring, patching, securing, backing up, supporting, and reporting on client technology.
- Security operations: detecting, investigating, containing, and remediating threats to client environments and to our own systems.
- Billing and account management: invoicing, collecting payment, and managing licenses and renewals.
- Improving our services: capacity planning, quality review, and training, using aggregated or de-identified data wherever practical.
- Marketing to businesses: sending assessments, proposals, service updates, and industry information to business contacts who have asked for them or with whom we have a relationship. You may opt out at any time.
- Legal compliance: meeting tax, accounting, contractual, regulatory, and lawful-process obligations.
Section 6
Your privacy rights
Depending on where you live, you may have the right to know what personal information we hold about you, to receive a copy of it, to correct it, to delete it, to restrict or object to certain processing, and to opt out of the sale or sharing of personal information or targeted advertising. We extend these rights to every individual in the United States regardless of state of residence.
To exercise a right, contact us as described in Section 11. We verify requests by matching the information you provide against our records. You may designate an authorized agent, in which case we will request written authorization. We respond within forty-five days and do not discriminate against anyone for exercising a privacy right.
California residents: under the California Consumer Privacy Act, the categories of personal information we have collected in the preceding twelve months are identifiers, commercial information, internet and network activity information, and professional information, for the purposes in Section 3 and from the sources in Section 2. We do not collect sensitive personal information through this website. Where we process personal information in a client’s systems, we do so as a service provider to that client, and requests concerning that information should be directed to the client.
Section 7
How we protect information
We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the information we hold, aligned to the CIS Controls. Access to client environments is granted per engineer, protected by multi-factor authentication, limited to the systems each engagement requires, and logged. Our own workstations and servers run the same endpoint detection, patching, encryption, and backup controls we deploy for clients. Web forms are served over TLS, and payment data never touches our servers. No method of transmission or storage is perfectly secure, and we review our controls regularly.
Section 8
How long we keep information
We keep personal information only as long as needed for the purposes in Section 3 or as the law or our client agreements require. As a general rule: website analytics data is kept for fourteen months; inquiries that do not become engagements are kept for two years; tickets, monitoring records, and security logs for client environments are kept for the term of the agreement plus one year unless the agreement specifies otherwise; backup data is retained according to the schedule in each client’s agreement and returned or destroyed at termination; and contracts and invoices are kept for seven years for tax and accounting purposes.
Section 9
Security incident notification
If we determine that personal information in our custody has been acquired by an unauthorized person, we will notify affected clients promptly and will notify affected individuals and regulators within the time required by applicable law, including California Civil Code section 1798.82 and, where we act as a business associate, the HIPAA Breach Notification Rule. Incident handling for client environments follows the incident response plan in each client’s agreement.
Section 10
Children and third-party links
This website and our services are directed to businesses. We do not knowingly collect personal information from children under thirteen. Links to third-party websites are provided for convenience; those sites have their own privacy practices.
Section 11
Changes and how to contact us
We review this policy at least annually and whenever our services, vendors, or the law change in a way that affects it. For material changes we post a notice on this website for at least thirty days and notify clients directly.
Privacy Officer
Corewell Technology
21031 Ventura Blvd, 2nd Floor, Woodland Hills, CA 91364
Telephone: 213-225-1511
Email: [email protected]
If you are not satisfied with our response, you may contact the California Office of the Attorney General or the California Privacy Protection Agency.
© 2026 Corewell Technology. This policy is effective October 20, 2026.