Consumer Health Data Privacy Policy

• On the website: the sign-up form asks for name, email and state only, and calculator inputs stay in your browser. Google Analytics records which public pages are visited and whether a visitor used a tool or checklist on the page, never the numbers or choices entered, such as a page about statin side effects, which some laws treat as consumer health data. We use it only to understand which pages are useful, with advertising features off, and do not combine it with your name or email.
• If you email us about your health, we receive what you choose to write, and use it only to answer you.
• In the iPhone app: none. Everything you enter stays on your iPhone and we do not receive it.
• Before you become a patient, intake answers you submit (such as cholesterol history, medicines and side effects) are used to route you to a Treating Clinician and determine eligibility. Once you are a patient, this information becomes part of your medical record under HIPAA.

Directly from you, and, if you become a patient, from your clinicians, laboratories and pharmacies.

• the Treating Clinicians and their practices who provide your care;
• laboratories and pharmacies you or your clinician select;
• service providers (processors) that host, store or deliver our services under contracts limiting their use of the data: Vercel (hosting), Neon (database), Google Workspace (email), Google Analytics (page-visit counts), our payment processor and the clinicians’ telehealth platform.

We do not sell consumer health data, and we do not share it with advertising platforms, data brokers or affiliates for their own use. We do not use geofencing around health care facilities.

We collect consumer health data only with your consent or as needed to provide a service you ask for, and we will ask for separate consent before sharing it for any other purpose. You can withdraw consent at any time by emailing privacy@prevalhealth.com.

You have the right to:

• confirm whether we collect, share or sell your consumer health data, and access it, including a list of all third parties and affiliates we shared it with;
• withdraw your consent to collection and sharing;
• have your consumer health data deleted, including from our processors;
• appeal our decision on your request.

To use these rights, email privacy@prevalhealth.comwith the subject “Consumer health data request.” We will verify your identity and respond within 45 days, extendable once by 45 days when reasonably necessary, with notice to you. To appeal, reply with “Appeal” and we will respond within 45 days. If we deny your appeal, you can contact the Washington Attorney General at atg.wa.gov/file-complaint, or the attorney general in your state. Medical records we must keep by law may be excluded from deletion, and we will tell you if that applies.

Preval Health Privacy Team, CORDOC LLC d/b/a Preval Health, 4030 Wake Forest Rd Ste 349, Raleigh, NC 27609. Email privacy@prevalhealth.com.