Updated March 12, 2026

Privacy Policy

KLAS requires the collection of personal information for both its research initiatives and in the use of our website. On this page we lay out how we use and store these data, and what we do to keep your information private. This policy is subject to change without notice. If you are looking for information on how to share KLAS material, see our Data Use Policy.

If you have any questions about this policy, please read our FAQs or contact us at datause@klasresearch.com.

KLAS Enterprises, LLC, is referred to in this Privacy Policy as “KLAS” or by first person pronouns such as “we,” “us,” “our,” etc. This policy does not constitute a warranty, and while we take your privacy seriously, data breaches can happen. For more on our disclaimer of warranties, please see our Terms of Use.

This Privacy Policy describes how KLAS Enterprises, LLC dba KLAS Research (“KLAS,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal data. By using our websites, products, services, or participating in our surveys or interviews, you agree to the terms of this Privacy Policy.

Table of Contents
Contact Information

KLAS Research, LLC

Attn: Personal Data Enquiry
365 South Garden Grove Lane
Pleasant Grove, Utah 84602
+1-801-226-5120

datause@klasresearch.com

Why We Need Your Data

We collect and process personal data to provide our websites, products, services, and research activities; to communicate with you; to manage our business operations; to improve our offerings; to maintain the security and functionality of our systems; and to comply with legal obligations.

If you choose not to provide certain personal data, we may be unable to provide requested information, enable access to certain products or services, process transactions, or allow participation in surveys, interviews, or other research activities.

Types of Personal Information We Gather

The data KLAS collects is called “personal information” or “personal data” under data privacy laws. However, the data KLAS collects is related to individuals’ professional data relating to their employment. Our data collection occurs in specific situations, with variations in the types of data collected. We collect personal data in the following scenarios.

Personal data required for the provision of products and services

To provide you with information regarding our products and services and to enable you to use and procure them, we may collect personal data, including but not limited to your name, employer, telephone number, address, and email address.

To enable you to interact with our websites and online products and services, we may also collect passwords, password hints, and similar security information needed for authentication and account access.

To enable purchases of products and services, we collect data necessary to process payments. Such information may include a credit card number and the associated security code if that is your chosen method of payment.

We may also request and collect other data from you via forms on our websites. In each case, you will know what personal data you provide to us because you actively and voluntarily provide it.

If you wish to participate in our surveys, interviews, or other research initiatives, the same contact information may also be used to communicate with you in connection with those activities.

KLAS’s two primary research initiatives are described below; we also conduct other studies worldwide.

Healthcare IT Insights (HIT Insights)

KLAS conducts Healthcare IT Insights research through surveys, interviews, and related research activities. We collect personal data from participants to administer research activities, communicate with participants, verify that responses come from qualified individuals, maintain research integrity, and analyze and report research results.

The personal data we collect for these purposes may include your name, email address, phone number, job title, organization, and the content of your survey responses, interview responses, or other research submissions. We may also maintain records associated with your participation, including scheduling information, communications, and research administration details.

We may publish aggregated, anonymized, or otherwise deidentified findings derived from participant responses including generalized role or organizational characteristics where appropriate to explain research findings. We generally retain survey results and interview transcripts in identifiable form in our internal systems for research integrity and administration; however, we do not intentionally publish directly identifying information (such as a participant’s name) with that participant’s responses unless we have permission or are otherwise permitted by law.

If you participate in an interview, presentation, demonstration, or similar research activity, we or our service providers may record, transcribe, host, or otherwise process that interaction for research, quality, documentation, or administrative purposes. We may use service providers to assist with scheduling, communications, transcription, hosting, storage, and related support services, subject to appropriate confidentiality and data protection obligations.

We use Healthcare IT Insights data to conduct research, produce and distribute research content, improve our methodologies, maintain the quality and integrity of our research, and support our business operations. If you have questions about how we process personal data in connection with Healthcare IT Insights, you may contact us using the information provided in this Privacy Policy.

Arch Collaborative

Your survey responses will be aggregated with those of other survey participants and the aggregate results will be shared anonymously with your employer and other report recipients. If your employer has commissioned the survey, your individual (i.e., non-aggregated) survey responses will also be shared with your employer (if you choose to share such responses with your employer).

Your confidentiality is paramount to our research

If you have any questions about how we process and store data from our research, please reach out to us.

Cookies, Analytics, and Log Data

We use cookies, similar technologies, analytics tools, and log files to operate our websites and online services, maintain security, remember user preferences, understand how users interact with our websites and services, and improve functionality, content, and user experience.

These technologies may collect information such as your IP address, browser type, device information, operating system, internet service provider, referring and exit pages, pages viewed, date and time information, clickstream data, and other usage information about your interactions with our websites and services.

Some cookies and similar technologies may be set by KLAS, and some may be set by service providers that support website functionality, analytics, security, or performance. We may use analytics providers, including Google Analytics, to help us understand website traffic and usage patterns and to improve our websites, products, and services. These providers may use cookies or similar technologies to collect information about your use of our websites and online services.

We may also use deidentified, aggregated, or similar non-directly identifying information in connection with analytics and user experience improvement efforts. We do not use cookies or analytics technologies for purposes inconsistent with this Privacy Policy.

You can control cookies through your browser settings and, where available, through cookie preferences or similar tools made available on our websites. Please note that disabling certain cookies may affect the functionality or performance of some parts of our websites or services.

How We Use/Share Personal Data

Your personal data will be accessible by our employees who require access in order to further our business interests as described above.

We may share your personal data with contracted service providers to enable them to provide our products and services to you, for customer support, marketing, technical operations, and account management purposes; and to perform other activities described in this Privacy Policy. We do not share, sell, rent, or trade any personal data with third parties for any promotional purposes unrelated to our business or to our own products and services. We do not “sell” or “share” personal data as defined under applicable U.S. state privacy laws (e.g., California CPRA, Colorado CPA), but if we were to do so in the future, we would expect to provide opt-out mechanisms, including honoring Global Privacy Control (GPC) signals.

Contractors and service providers are authorized to use and disclose personal data only as necessary to perform and provide the particular services for which they were engaged and only in accordance with this Privacy Policy and applicable data processing agreements required under laws such as the GDPR and U.S. state privacy laws. Examples of services which may give contractors or service providers access to personal data include:

  • hosting our websites;
  • hosting our email server;
  • processing your payments;
  • maintaining, enhancing, or adding to the functionality of our websites;
  • processing and fulfilling orders;
  • collecting web analytics data; and
  • enabling us to send you email or perform other administrative services.

We may share personal data with other parties, including the following:

  • governmental authorities pursuant to applicable laws or court processes or as we reasonably deem necessary to prevent harm, financial loss, fraud, or illegal activity;
  • the successor in interest to all or a portion of our business or assets, provided that, should such a transfer occur, we will require such successor to agree in writing to use, protect, and maintain the security, integrity, and confidentiality of the transferred personal data in accordance with this Privacy Policy; and
  • others pursuant to consent obtained from you.

Criteria and Time Period for Retaining Personal Data

We retain your personal data for a useful period of time (approximately 10 years) to fulfill the processing, research, historical, trend tracking, quality control and other purposes mentioned above. We delete personal data when it is no longer necessary for such purposes, or as required by applicable laws (e.g., applicable privacy laws may require us to honor deletion requests within 45 days, subject to exemptions).

Rights Available to Persons in the European Economic Area

If you are located in the European Economic Area, you may have the following rights, which may be subject to limitation:

  • Right to access, rectify or erase your personal data;
  • Right to restrict the processing of your personal data;
  • Right to obtain copies of your personal data held by us for the purpose of transferring it to yourself or another party specified by you;
  • Right to object to the processing of your personal data; and
  • Right to not be subject to automated decision-making.

To exercise any of these rights, you may contact us as described above. Our obligations with respect to the foregoing objections and requests are governed by applicable laws and regulations.

You also have the right to lodge a complaint regarding our processing of your personal data with any applicable supervisory authority.

U.S. Privacy Policy (Including California)

To comply with U.S. state privacy laws in effect as of August 2025 (e.g., California CPRA, Colorado CPA, Connecticut CTDPA, Delaware DPDPA, Florida FDPSA, Iowa ICDPA, Minnesota MCDPA, Montana MCDPA, Nebraska NDPA, New Hampshire NHPA, New Jersey NJDPA, Oregon OCPA, Tennessee TIPA, Texas TDPSA, Utah UCPA, Virginia VCDPA, and others in states like Rhode Island RIDPA effective January 1, 2026), we reaffirm the following points covered throughout our privacy policy, especially under the header “Types of Personal Information We Gather”:

  • California residents (and residents of other applicable states) may visit parts of the website anonymously, but all content restricted by our authorized access cannot be visited anonymously (see Authorized Access above).
  • We collect the following categories of personal information from the sources described above (e.g., directly from you, cookies, logs):
    • Identifiers (such as your name, title, job area, employer, and contact information);
    • Internet and networked device information (such as website usage, cookies, and session data);
    • Information we infer about your website usage;
    • We currently do not, but if in the future we collect sensitive personal information (e.g., health-related insights in surveys, we will obtain opt-in consent at least in the states requiring it, such as Colorado, Virginia, and Connecticut); and
    • Other information that might reasonably be associated with you (such as interview transcripts or responses, survey responses, see “Participation in Research Studies” above).

We use and disclose these categories for the business purposes described in this policy (e.g., providing services, research, analytics, security). We do not sell or share personal information for cross-context behavioral advertising as defined under these laws, but you may opt out of any future sales/sharing or targeted advertising by emailing datause@klasresearch.com or using GPC signals, which we may honor if/when applicable and capable. We have not sold or shared personal information in the past 12 months and have no current expectation of doing so in the future.

Your U.S. Privacy Rights

If you are a resident of a state with comprehensive privacy laws (e.g., California, Colorado, Connecticut, Delaware, Florida, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, Virginia), you may have the following rights, subject to verification, exemptions, and limitations:

  • Right to know/access what personal data we collect, use, disclose, sell, or share about you;
  • Right to correct inaccurate personal data;
  • Right to delete your personal data;
  • Right to data portability (receive a copy in a portable format);
  • Right to opt out of the sale or sharing of personal data, targeted advertising, or profiling in furtherance of decisions producing legal or similarly significant effects;
  • Right to limit use of sensitive personal data (e.g., health data in surveys); and
  • Right to non-discrimination for exercising these rights.

To exercise these rights, submit a verifiable request (or have an authorized agent do so) by emailing datause@klasresearch.com or calling our toll-free number, if one is posted on our website (klasresearch.com) under our contact information. We will respond within 45 days (extendable by 45 days if needed) and provide an appeal process if denied. We verify requests using information you provide (e.g., name, email).

EU GDPR Privacy Notice

To comply with the EU General Data Protection Regulation (GDPR), this notice applies if you are in the European Economic Area (EEA) or if your personal data is processed in a way that falls under GDPR. KLAS Enterprises, LLC dba KLAS Research (located in Utah, USA) is the data controller. Contact us at datause@klasresearch.com with questions or requests.

We collect and process personal data as described in this policy (e.g., “Types of Personal Information We Gather”). Key details:

  • Categories: Identifiers (e.g., name, email, phone number), professional info (e.g., job title, employer), responses, device data (e.g., cookies, IP).
  • Purposes and Legal Bases: Providing services/research (legitimate interests or contract); surveys (consent); analytics/security (legitimate interests). We minimize data and ensure fairness.
  • Recipients: Employees, processors (e.g., hosting providers under agreements), authorities if required.
  • Transfers: To the U.S.; protected by Standard Contractual Clauses or equivalent safeguards.
  • Retention: As needed for purposes (e.g., research up to 10 years); criteria in “Criteria and Time Period.”
  • Automated Processing: No significant automated decisions; object if applicable.
  • Source if Indirect: Data may come from vendors (e.g., Arch Collaborative) or public sources; informed within one month unless an exception applies (e.g., if data is used to communicate with data subject by emailing a survey invitation).

Provision of data is voluntary but may be required for participation; refusal limits services.

Your GDPR Rights

If you are in the EEA, you have the following rights under GDPR, subject to limitations:

  • Access, rectify, or erase your personal data;
  • Restrict processing or object (e.g., to legitimate interests, direct marketing, or profiling);
  • Obtain a portable copy of your data;
  • Withdraw consent anytime (does not affect past processing);
  • Avoid automated decisions with legal effects.

Exercise via datause@klasresearch.com; we verify and respond within one month. Lodge complaints with your supervisory authority. See edpb.europa.eu for details.

Security Measures and How We Store Personal Data

Personal data is stored on servers and systems that are owned and managed by us or by contractors engaged by us.

We maintain appropriate technical, administrative, and physical safeguards to protect personal data we receive or collect. We review, monitor, and evaluate our privacy practices and protection systems on a regular basis, including conducting data protection assessments as required under applicable U.S. state laws (e.g., Colorado, Virginia). Transmission of personal data is protected by SSL encryption when it is exchanged between your web browser and our websites.

Notwithstanding the foregoing measures, transmissions over the internet or a mobile network are not 100% secure, and we do not guarantee the security of transmissions. We are not responsible for any errors by individuals in submitting personal data to KLAS.

Where Your Data Is Stored

Personal data collected is stored on servers located in the United States of America.

Anonymized Data

We may use, transfer, sell, and share aggregated, anonymized data, which does not include any personal data and meets de-identification standards under applicable laws (e.g., CCPA/CPRA, GDPR).

Survey and Interview Data

Our goal is to have longstanding relationships with healthcare professionals. KLAS reports survey and interview responses obtained from providers anonymously to ensure that they can speak freely, safely, and with candor. All reports undergo thorough screening to maintain provider anonymity. The only information publicly associated with your responses is job level and organization size.

Children

We do not knowingly market our products or services to, and do not solicit or collect information from, children under the age of 16. We may ask users for their age to ensure that we are not collecting information from children under age 16 or to identify when additional steps may be necessary in connection with information collected from persons who have not reached the age of maturity in the jurisdiction in which they reside. If we learn that we have collected personal data from a child under age 16 without parental consent, we will delete that information. If you believe that we might have personal data from or about a child under 16, please contact us as described above. We do not currently collect any, but if we do in the future we will comply with enhanced protections for children’s data under applicable U.S. state laws (e.g., Delaware, Maryland).

Changes to This Privacy Policy

This Privacy Policy may be updated from time to time to remain consistent with the requirements of any applicable laws. We will post the revised version on our website and update the “last updated” date above to reflect the date of the changes.

Submit a Bug

We want to make this website experience as smooth as possible, so we will work on resolving any issues as soon as possible. 

Name

Sponsorship Inquiry Form

NOTE: Organizations currently measured by KLAS are not eligible for sponsorship.

Name
Are you currently measured?

Join the Arch Collaborative

Join the KLAS Arch Collaborative today to start your EHR measurement and improvement journey! 

Start the process by filling out the form below—we’ll get back to you shortly. 

Name