Consumer Health Data Privacy Policy

1. Scope & what "consumer health data" means

"Consumer health data" is personal information that identifies your past, present, or future physical or mental health status — which, for a health service like Promise, can include information about the products and treatments you seek or purchase. This policy applies to residents of Washington and Nevada. As a matter of practice, we extend the choices described here to our users generally.

Remember that Promise is a technology platform. The medical intake, evaluation, and prescription records are created and held by Promise's prescriber network and our partner pharmacy under HIPAA and their own notices — this policy covers the more limited consumer health data that myPromise, LLC handles through this website.

2. Consumer health data we collect & why

Through this website, we may collect:

• Contact details and the contents of messages you send us when you ask about a health product or service.
• Information about the health-related products and pages you view or express interest in.
• The email address you enter if you join a waitlist for a treatment that is not yet available, together with which treatment page you submitted it from. We use it only to tell you if that treatment becomes available, and you can have it deleted at any time (see Section 6).
• What you type into the Promise Guide, our automated helper, and what it answers, together with the page you opened it from and, on a chat landing page, short names for the photos it showed you. A question about a treatment or a goal may itself describe your health. We keep these conversations for up to 30 days with no name, email address, IP address or account attached, use them only to generate the reply, to improve the guide and, on a chat landing page, to count which photos lead to conversations, and share the conversation and the page it was opened from, but never the photo names, only with the AI model provider that generates the reply on our behalf. You can delete your conversation at any time with the guide's “Start over” control; because nothing identifies you, we cannot locate one from an email request.
• Some of our landing pages show one of several photos, and we measure which ones lead to conversations. The page keeps short names for the photos it showed you in your browser tab's session storage. It sends those names to Google Analytics once when the page loads, and again with the Guide's count-only events if you use it; these events never include your conversation text or a treatment name. We also keep daily totals for each photo of how many chats started, how many continued past a first message and how many were shown a treatment option. The totals hold no conversation text and nothing that identifies you, and we keep them for up to two years, including after conversations are deleted.
• Technical and usage data (through cookies and analytics) that could indicate an interest in a health product or service.
• The address of the first page you view on each visit, which can name a treatment or article, with the page you came from, your screen and browser-window size, the time, your IP address, browser details and cookie identifiers. Our streaming-TV ad measurement tag sends these to an advertising platform (see Section 4). The tag does not load for visitors located in Washington, Nevada or Connecticut, as estimated from their IP address.
• An ad click identifier, if you arrived from an online ad, together with the milestone (a visit started or a first payment was made) and which treatment the visit concerned. The clinical platform sends this without your name, contact details or other health details. We keep this measurement record, including the treatment reference, for 120 days.
• If you agree to receive marketing email when you start a visit, your email address, first name, the time you agreed, and the order references, amounts and subscription, checkout and order events described in Section 4, which are sent to our email marketing provider so we can send you marketing email. If you then receive marketing email, whether you opened each email and which links in it you clicked, which our email marketing provider records with your email address so we can measure and improve those emails; a click on a link to a treatment page can show interest in that treatment.
• The payment details you enter at checkout and the order, shipping and renewal notices sent to you, which our payment processor and our email delivery provider handle to charge your plan and keep you informed about your order.

We collect this data to respond to you, to connect you with Promise's prescriber network and our partner pharmacy, and to operate, secure, and improve the Site.

We also use the streaming-TV ad measurement tag described in Section 4 to measure whether our streaming-TV ads lead people to visit the Site.

3. Sources of consumer health data

• Directly from you, when you contact us or interact with the Site.
• Automatically, through cookies and analytics tools (such as Google Analytics) when you use the Site.
• Automatically, through our streaming-TV ad measurement tag, which runs in your browser on the Site's pages and sends what it collects directly to the advertising platform (see Section 4).
• From our partners, such as Promise's prescriber network, our partner pharmacy, and service providers that help us operate.

4. How we share it & with whom

We may share consumer health data with the following categories of recipients:

• Advertising measurement. Google Ads receives only the click identifier, the milestone type and, for a payment, the amount — never the treatment, your name, contact details or health history. To process the measurement, the upload also includes its time, currency and a pseudonymous reference used to prevent duplicate counting.
• Streaming-TV ad measurement. An advertising platform we use to measure whether our streaming-TV ads lead people to visit the Site receives, through a measurement tag on our pages, the address of the first page you view on each visit (which can name a treatment), the page you came from, your screen and browser-window size, the time, your IP address, browser details, the identifier in a cookie the tag sets on the Site and the identifier in our Google Analytics cookie; the platform can also read or set cookies on its own domain. We use it only to measure our ads; we don't use it to build advertising audiences or to target ads to you. The platform also uses what it receives under its own privacy policy, which can include its own advertising uses, such as matching it with other information to recognize people and households and building advertising audiences. We don't send it your name, email address or phone number. The tag does not load for visitors located in Washington, Nevada or Connecticut or outside the United States, on our search page, on the confirmation shown after you join a waitlist, or when your browser sends a Global Privacy Control signal or you have turned it off on our Privacy Policy page, and it does not run on the intake, checkout or patient portal.
• Promise's prescriber network and our partner pharmacy, to serve your request.
• Our telehealth platform provider, which runs the intake, checkout, patient portal and order routing for a visit, so your request can reach Promise's prescriber network and our partner pharmacy.
• Our payment processor, which processes the payment details you enter at checkout, through our telehealth platform provider, to charge your plan.
• Our email delivery provider, which receives your email address and the content of your order, shipping and renewal notices in order to deliver them.
• Our email marketing provider, only if you opt in. If you agree to receive marketing email, our telehealth platform provider sends our email marketing provider your email address, first name and the time you agreed, along with order references and amounts and events showing when you subscribe, start a checkout you don't finish, or place an order, so we can send you marketing email. Your phone number is sent only if you also agree to receive text messages. These transfers never include the names of your treatments or medications, doses, intake answers, date of birth, last name or address. When we send you marketing email, our email marketing provider records whether you open each email and which links in it you click, linked to your email address (tracked links pass through a tracking address before taking you to the page), so we can measure and improve our marketing email. This applies only to marketing email you have agreed to receive, and because a link may lead to a treatment page, a click can show interest in that treatment. You can withdraw this consent at any time by emailing privacy@mypromise.com; the unsubscribe link in any marketing email stops the emails themselves. Unsubscribing stops future marketing email, so no new emails are tracked, although opening or clicking a marketing email you received earlier may still be recorded.
• Service providers / processors that host our website, provide analytics (such as Google), and help us communicate with you — under contracts that limit their use of the data.
• Legal and safety recipients, when required by law or to protect rights and safety.

We do not sell consumer health data (as "sell" is defined by these laws), and we do not share it for cross-context targeted advertising without your consent.

5. Consent

We collect and use consumer health data to provide the products, services, and information you ask for. Where the law requires your consent to collect or share consumer health data beyond what is necessary to provide what you requested, we obtain that consent first, and you may withdraw your consent at any time by contacting us. Withdrawing consent does not affect processing that already took place.

We do not use the Google Ads measurement or the streaming-TV ad measurement described in Section 4 to target you with advertising. The streaming-TV measurement tag does not load while your browser sends a Global Privacy Control signal or after you turn it off on our Privacy Policy page.

6. Your rights

If you are a Washington or Nevada resident, you have the right to:

• Confirm and access the consumer health data we hold about you, and learn with whom we have shared it.
• Delete your consumer health data.
• Withdraw consent to our collection or sharing of your consumer health data.

To make a request, email privacy@mypromise.com. We will respond within the timeframe required by law. We may need to verify your identity, and you will not be discriminated against for exercising these rights. If we deny your request, you may appeal by replying to our decision; if your appeal is denied, you may contact your state Attorney General (below).

For the streaming-TV ad measurement tag, an email request can't do the job: we don't link what the tag sends to your name or email address, so we can't find your browser from an email. To stop it, use "Turn off ad measurement on this browser" on our Privacy Policy page or turn on Global Privacy Control in your browser or a browser extension; if you email us, we will explain both.

7. No geofencing

We do not use geofencing to identify, track, or send notifications to consumers based on their proximity to any healthcare facility.

8. Complaints

Washington residents may contact the Washington State Attorney General at atg.wa.gov/file-complaint. Nevada residents may contact the Nevada Office of the Attorney General at ag.nv.gov.

9. Contact us

myPromise, LLC
7135 E Camelback Rd, Suite 230
Scottsdale, AZ 85251
(602) 737-2202 · privacy@mypromise.com