1. Purpose

This document outlines the policy and procedures used by Exclugo.ai to identify and track client searches. The goal is to maintain transparency with clients regarding what information is associated with each search, how it is used, and how privacy is protected.

2. Definitions

• Search Event: Any query submitted by a client to the Exclugo.ai system.
• Identifier: A data point or token used to associate a search with a specific client or session.

3. Monitored Lists

Clients are responsible for sending in their monitored lists as often as frequently as desired

Comparison: The purpose of a comparison is to keep a client’s monitored lists up to date for each search type. This process will remove any names no longer on the submitted list and will add any new names found on the submitted list that are not currently in Exclugo.

Vendor Organization and Vendor Individual lists must be submitted separately. If a client does not separate these lists, they will be treated as Vendor Organization by default, and charges will apply accordingly.

Payroll integrations/SFTP file drops are available, Clients are responsible for reviewing integration alerts that are sent via email.

API integrations are available upon request.

4. Search Methodology

Exclusion
1. Required Fields: First name, Last Name, Date of Birth, SSN
2. Matching Logic: A match will require two of the following identifiers: Name, Date of Birth, SSN, License Number, Address or NPI Number
3. Results:
  1. Record Found: Any individual found on one of the exclusion lists. Sanctions will not be considered a hit.
  2. No Record found
  3. Not performed: Not performed will include notes with a reason or additional information that is needed to complete the search. A search that is not performed will pause the monitoring for the individual.
4. Source: OIG, SAM and 42 State exclusion lists. Please see our source list posted online for a detailed list.
Exclusion Alias
1. Required Fields: First name, Last Name, Date of Birth, SSN
2. Matching Logic: A match will require two of the following identifiers: Name, Alias Name, Date of Birth, SSN, License Number, Address, or NPI Number
3. Results:
  1. Record Found: Any individual found on one of the exclusion lists. Sanctions will not be considered a hit.
  2. No Record Found
  3. Not performed: Not performed will include notes with a reason or additional information that is needed to complete the search. A search that is not performed will pause the monitoring for the individual.
4. Source: OIG, SAM and 42 State exclusion lists. Please see our source list posted online for a detailed list.
Sex Offender
1. Required Fields: First name, Last Name, Date of Birth, SSN
2. Matching Logic: A match will require two of the following identifiers: Name, Alias Name, Date of Birth, SSN, or Address,
3. Results: Sex offender match on any sex offender registry
4. Source: Independent State Sex Offender database
OFAC
1. Required Fields: First name, Last Name, Date of Birth, SSN
2. Matching Logic: A match will require two of the following identifiers: Name, Alias Name, Date of Birth, SSN, or Address
3. Results: OFAC Match
4. Source: OFAC
Death Master File
1. Required Fields: Name and SSN
2. Matching Logic: Matches are based off the provide SSN
3. Results: If a record is found on the DMF matching the provided SSN
4. Source: Social Security Death Master File
Professional License Monitoring
1. Required Fields: First Name, Last Name, Date Birth, SSN, and License Number and State
2. Matching Logic: License number, License State and License type
3. Results
  1. Record Found – License found with no alerts.
  2. Record Found with alerts – Any actions within seven years will be shown. (actions over seven years will not)
  3. Record not found – License that cannot be found
4. Source: State’s online professional license verification tool or Nursys
NPI Monitoring
1. Required Fields: First Name, Last Name, Date of Birth, SSN, NPI number
2. Matching Logic: NPI Number
3. Results
  1. Record Found – NPI License found
  2. Record not found – NPI license not found
4. Source: NPPES NPI Registry
Vendor Exclusion – Individual
1. Required Fields: First name, Last Name, Address, Unique Vendor ID
2. Matching Logic: An alert will match Exact name and one of the following: Address, License Number, Date of Birth, SSN or NPI number
3. Results:
  1. Record Found: Any individual found on one of the exclusion lists. Sanctions will not be considered a hit.
  2. No Record Found
  3. Not performed: Not performed will include notes with a reason or additional information that is needed to complete the search. A search that is not performed will pause the monitoring for the individual.
4. Source: OIG, SAM, State Exclusion list of the vendor’s submitted address
Vendor Exclusion – Organization
1. Required Fields: Organization name, Address, Unique Vendor ID
2. Matching Logic: An alert will match Exact Organization name and one of the following: EIN or Address
3. Results:
  1. Record Found: Any organization found on one of the exclusion lists. Sanctions will not be considered a hit.
  2. No Record Found
  3. Not performed: Not performed will include notes with a reason or additional information that is needed to complete the search. A search that is not performed will pause the monitoring for the individual.
4. Source: OIG, SAM, State Exclusion list of the vendor’s submitted address

5. Privacy and Security

- All identifiers are stored in accordance with industry-standard security protocols.
- Personally identifiable information (PII), if collected, is handled per our [Privacy Policy] and in compliance with applicable data protection laws.

6. Client Responsibilities

- Ensure API Keys and login credentials are kept secure.
- Notify Exclugo.ai of any suspected unauthorized access.

- Review all alerts

- Upkeep monitored lists for each search type
- Review and comply with this policy and the broader Exclugo.ai Terms of Service.

7. Changes to this Policy

Exclugo.ai reserves the right to update this policy. Clients will be notified of major changes via email or dashboard notification. Continued use of the service after updates constitutes agreement to the revised terms.