Consumer Health Data Privacy Policy

1. Scope & what "consumer health data" means

"Consumer health data" is personal information that identifies your past, present, or future physical or mental health status — which, for a health service like Promise, can include information about the products and treatments you seek or purchase. This policy applies to residents of Washington and Nevada. As a matter of practice, we extend the choices described here to our users generally.

Remember that Promise is a technology platform. The medical intake, evaluation, and prescription records are created and held by Promise's prescriber network and our partner pharmacy under HIPAA and their own notices — this policy covers the more limited consumer health data that myPromise, LLC handles through this website.

2. Consumer health data we collect & why

Through this website, we may collect:

• Contact details and the contents of messages you send us when you ask about a health product or service.
• Information about the health-related products and pages you view or express interest in.
• The email address you enter if you join a waitlist for a treatment that is not yet available, together with which treatment page you submitted it from. We use it only to tell you if that treatment becomes available, and you can have it deleted at any time (see Section 6).
• What you type into the Promise Guide, our automated helper, and what it answers, together with the page you opened it from. A question about a treatment or a goal may itself describe your health. We keep these conversations for up to 30 days with no name, email address, IP address or account attached, use them only to generate the reply and to improve the guide, and share them only with the AI model provider that generates the reply on our behalf. You can delete your conversation at any time with the guide's “Start over” control; because nothing identifies you, we cannot locate one from an email request.
• Technical and usage data (through cookies and analytics) that could indicate an interest in a health product or service.
• An ad click identifier, if you arrived from an online ad, together with the milestone (a visit started or a first payment was made) and which treatment the visit concerned. The clinical platform sends this without your name, contact details or other health details. We keep this measurement record, including the treatment reference, for 120 days.
• If you agree to receive marketing email when you start a visit, your email address, first name, the time you agreed, and the order references, amounts and subscription, checkout and order events described in Section 4, which are sent to our email marketing provider so we can send you marketing email. If you then receive marketing email, whether you opened each email and which links in it you clicked, which our email marketing provider records with your email address so we can measure and improve those emails; a click on a link to a treatment page can show interest in that treatment.
• The payment details you enter at checkout and the order, shipping and renewal notices sent to you, which our payment processor and our email delivery provider handle to charge your plan and keep you informed about your order.

We collect this data to respond to you, to connect you with Promise's prescriber network and our partner pharmacy, and to operate, secure, and improve the Site.

3. Sources of consumer health data

• Directly from you, when you contact us or interact with the Site.
• Automatically, through cookies and analytics tools (such as Google Analytics) when you use the Site.
• From our partners, such as Promise's prescriber network, our partner pharmacy, and service providers that help us operate.

4. How we share it & with whom

We may share consumer health data with the following categories of recipients:

• Advertising measurement. Google Ads receives only the click identifier, the milestone type and, for a payment, the amount — never the treatment, your name, contact details or health history. To process the measurement, the upload also includes its time, currency and a pseudonymous reference used to prevent duplicate counting.
• Promise's prescriber network and our partner pharmacy, to serve your request.
• Our telehealth platform provider, which runs the intake, checkout, patient portal and order routing for a visit, so your request can reach Promise's prescriber network and our partner pharmacy.
• Our payment processor, which processes the payment details you enter at checkout, through our telehealth platform provider, to charge your plan.
• Our email delivery provider, which receives your email address and the content of your order, shipping and renewal notices in order to deliver them.
• Our email marketing provider, only if you opt in. If you agree to receive marketing email, our telehealth platform provider sends our email marketing provider your email address, first name and the time you agreed, along with order references and amounts and events showing when you subscribe, start a checkout you don't finish, or place an order, so we can send you marketing email. Your phone number is sent only if you also agree to receive text messages. These transfers never include the names of your treatments or medications, doses, intake answers, date of birth, last name or address. When we send you marketing email, our email marketing provider records whether you open each email and which links in it you click, linked to your email address (tracked links pass through a tracking address before taking you to the page), so we can measure and improve our marketing email. This applies only to marketing email you have agreed to receive, and because a link may lead to a treatment page, a click can show interest in that treatment. You can withdraw this consent at any time by emailing privacy@mypromise.com; the unsubscribe link in any marketing email stops the emails themselves. Unsubscribing stops future marketing email, so no new emails are tracked, although opening or clicking a marketing email you received earlier may still be recorded.
• Service providers / processors that host our website, provide analytics (such as Google), and help us communicate with you — under contracts that limit their use of the data.
• Legal and safety recipients, when required by law or to protect rights and safety.

We do not sell consumer health data (as "sell" is defined by these laws), and we do not share it for cross-context targeted advertising without your consent.

5. Consent

We collect and use consumer health data to provide the products, services, and information you ask for. Where the law requires your consent to collect or share consumer health data beyond what is necessary to provide what you requested, we obtain that consent first, and you may withdraw your consent at any time by contacting us. Withdrawing consent does not affect processing that already took place.

This measurement is not used to target you with advertising.

6. Your rights

If you are a Washington or Nevada resident, you have the right to:

• Confirm and access the consumer health data we hold about you, and learn with whom we have shared it.
• Delete your consumer health data.
• Withdraw consent to our collection or sharing of your consumer health data.

To make a request, email privacy@mypromise.com. We will respond within the timeframe required by law. We may need to verify your identity, and you will not be discriminated against for exercising these rights. If we deny your request, you may appeal by replying to our decision; if your appeal is denied, you may contact your state Attorney General (below).

7. No geofencing

We do not use geofencing to identify, track, or send notifications to consumers based on their proximity to any healthcare facility.

8. Complaints

Washington residents may contact the Washington State Attorney General at atg.wa.gov/file-complaint. Nevada residents may contact the Nevada Office of the Attorney General at ag.nv.gov.

9. Contact us

myPromise, LLC
7135 E Camelback Rd, Suite 230
Scottsdale, AZ 85251
(602) 737-2202 · privacy@mypromise.com