Privacy Policy

• Protected health information (PHI). When you become a patient, your medical record is created and kept by your Treating Clinicians’ practices in their electronic health record system. When we handle it for them, we do so as a HIPAA business associate. HIPAA and the practices’ Notice of Privacy Practices govern that information. Where this policy and that notice conflict for PHI, the notice controls.
• Consumer health data. Health-related information outside HIPAA (for example, quiz answers you choose to send us) is also covered by our Consumer Health Data Privacy Policy for residents of Washington, Nevada, Connecticut and other states with similar laws.
• Everything else, such as waitlist sign-ups and support emails, is covered by this policy.

Waitlist and contact forms.

• Name and email address, so we can tell you when services open in your area.
• State of residence and confirmation that you are 18 or older, to check eligibility and plan where to offer care.
• How you found us: short codes from the link you clicked (for example a channel and a campaign code such as “c3”) and whether you arrived on an ad page, a guide or the home page. These codes say nothing about your health.
• Anything you write to us by email.

Our sign-up form asks no health questions. Calculators run in your browser, and what you enter is not sent to our servers.

If you become a patient, we collect, on behalf of your Treating Clinicians:

• identity and contact details: name, date of birth, address, phone, email, and identity verification;
• health information: medical history, medicines, allergies, lab results, imaging reports, genetic test results if you order them, visit notes and messages;
• payment information, processed by our payment processor. We do not store full card numbers;
• pharmacy and laboratory details needed to fill prescriptions and orders.

Automatically. Our hosting provider records standard server logs (IP address, browser type, pages requested, time) for security and to keep the site running. The website stores a small note in your browser for the current session only, to remember which link brought you here. It sets no advertising cookies.

Google Analytics.We use Google Analytics to count visits to our public pages: which page, the referring site or campaign code, and general device, browser and approximate location (city level) information. It uses first-party cookies. We also send a few activity events on our guides: which interactive tool or step-by-step checklist was used, how many steps were ticked, and how far down the page a visitor scrolled. We never send quiz answers, form entries, numbers you type or choices you pick in a calculator or chart, or health information, and we remove page addresses’ query details except campaign codes. Google signals and ad personalization are off, we do not link Analytics to any advertising account, and data is deleted after 14 months. You can block it with the Google Analytics opt-out add-onor your browser’s tracking protection.

The Preval Health iPhone app stores everything you enter, including labs, medicines, doses, meals, workouts, blood pressure, notes and your goals, only on your iPhone. The app has no account, and we do not receive, see or store any of it. The app contains no analytics, advertising or tracking code.

Backups are files you create and save where you choose, such as iCloud Drive or Files. You can add a password to a backup.

Apple Health access is optional and read-only. The app reads the workouts, steps, exercise minutes, weight, sleep and lab results you allow, and never writes to Apple Health.

A few optional features send data off your iPhone, only when you turn them on and use them. Photo, voice and lab-report reading send the photo, recording or report to the AI provider you choose, using your own API key, after you agree in the app. That provider’s privacy policy applies. Barcode lookup, off by default, sends only the scanned barcode to Open Food Facts to find the food.

Images you share from the app, such as progress cards, leave your iPhone only when you choose where to send them. They leave out your name and exact dates by default.

Preval Plus purchases.If you buy Preval Plus, Apple takes payment through your Apple Account; we never see your card or billing details. We use RevenueCat to check whether Preval Plus is active. RevenueCat receives your purchase history from Apple and a random ID it creates for this app. It does not receive your name, email address or any health data you enter, and we don’t use it for advertising or tracking. RevenueCat’s privacy policy applies to that data. You can manage or cancel a subscription in your iPhone’s Settings.

Deleting the app removes its data from your iPhone. You can also erase everything in Settings, Delete all data.

• to provide, coordinate and support your care, including scheduling, labs, prescriptions and payments;
• to tell you when services open in your state and send updates you asked for;
• to answer questions and provide customer support;
• to keep the Services secure, prevent fraud and fix problems;
• to learn which links and pages bring people to us, using the non-health codes described above;
• to meet legal, licensing and accreditation obligations.

We do not use health information for marketing without your written authorization, and we do not use it to target ads.

We share personal information only:

• With your Treating Clinicians and their practices, to provide your care.
• With pharmacies and laboratories you or your clinician choose, to fill prescriptions and run tests.
• With service providers that work for us under contracts limiting their use of the data, and, for PHI, business associate agreements: website hosting (Vercel), database hosting (Neon), email (Google Workspace), website analytics (Google Analytics), payment processing, and the telehealth and electronic health record platform used by the practices (MD Integrations).
• When the law requires it, for example in response to a valid subpoena, or to protect someone’s safety.
• In a business transfer, such as a merger or sale, subject to the same protections.
• With your permission, for anything else.

We do not sell personal information, and we do not “share” it for cross-context behavioral advertising as California law defines those terms. We have not done so in the past 12 months.

We may advertise on search engines and social media. When we do, we do not install those platforms’ pixels, tags or software development kits on our website, intake or app, and we do not upload patient or waitlist lists to ad platforms. Ad links carry only the short campaign codes described in Section 2. We honor Global Privacy Control (GPC) browser signals as an opt-out of any sale or sharing. If we ever change this practice, we will update this policy first and ask for your consent where the law requires it.

• Waitlist information: until you unsubscribe or ask us to delete it, or 3 years after your last contact with us.
• Medical records: for as long as state medical-record laws require, which is often 10 years or more after your last visit, and longer for minors.
• Billing records: as long as tax and accounting laws require, usually 7 years.
• Server logs: up to 90 days unless needed to investigate a security problem.

We use encryption in transit (TLS) and at rest, access controls limited to people who need the data, multi-factor authentication for staff accounts, and vendor agreements that require safeguards. No system is perfectly secure. If a breach affects your information, we will notify you as required by HIPAA, the FTC Health Breach Notification Rule and state law.

Depending on where you live, you may have the right to:

• know what personal information we have about you and get a copy;
• correct inaccurate information;
• delete your information, subject to medical-record retention laws;
• opt out of sale, sharing, targeted advertising and profiling (we do none of these);
• limit use of sensitive personal information (we use it only to provide the Services);
• withdraw consent, and appeal a decision we make on your request.

To make a request, email privacy@prevalhealth.comwith the subject “Privacy request.” We will verify your identity by matching information we already have, and respond within 45 days (or sooner where state law requires). An authorized agent may submit a request with your signed permission. If we deny your request, you can appeal by replying with “Appeal”; if you disagree with the result, you may contact your state attorney general. We will not discriminate against you for using these rights. Requests about medical records follow the Notice of Privacy Practices.

Every marketing email includes our postal address and an unsubscribe link. Unsubscribing does not stop messages about your care or account.

The Services are for adults 18 and older. We do not knowingly collect information from anyone under 18. If you believe we have, contact us and we will delete it.

We store data in the United States and offer the Services only to people in the United States.

We will post updates here with a new date. For material changes, we will notify registered users by email or in the app before the change takes effect.

Preval Health Privacy Team, CORDOC LLC d/b/a Preval Health, 4030 Wake Forest Rd Ste 349, Raleigh, NC 27609. Email privacy@prevalhealth.com.