Pinebank Health Privacy Policy

Introduction

This Privacy Policy describes how Heyday Health, Inc. (“Heyday Health,” “we,” “our,” or “us”) collects and processes personal information about you in connection with Pinebank Health, our care navigation service, and through our website at www.pinebankhealth.com, our related applications and services, our electronic communications with you, and our marketing activities (collectively, the “Services”). Please read it carefully. If you do not agree with our practices, your choice is not to use the Services. By using the Services, you agree to this Privacy Policy.

Important: how this Policy relates to HIPAA

Clinical care through the Services is provided by Heyday Health Medical Group, Inc. (the “Medical Group”), an affiliated professional medical corporation and a HIPAA covered entity. Protected health information (“PHI”) that the Medical Group creates or receives in the course of providing care, and that Heyday Health processes on the Medical Group's behalf, is governed by the Medical Group's HIPAA Notice of Privacy Practices, not by this Privacy Policy. Heyday Health acts as a business associate of the Medical Group with respect to PHI. To the extent information is PHI regulated by HIPAA, this Privacy Policy does not apply and the HIPAA Notice of Privacy Practices controls. This Privacy Policy governs the personal information we handle outside of HIPAA, such as website, account, marketing, and general communications data.

Information We Collect

The information we collect depends on how you interact with the Services and may include:

• Contact data, such as your name, email address, mailing address, and phone number.
• Demographic data, such as your city, state, postal code, and age.
• Account data, such as username, password, and authentication data.
• Communications data, such as your messages, inquiries, and correspondence with us.
• Marketing data, such as your preferences for receiving communications and your engagement with them.
• Payment data, such as information needed to process any out-of-pocket payments, collected and processed by third-party payment processors.
• Website and device data, such as IP address, device and browser characteristics, operating system, general location, and online activity collected automatically through cookies and similar technologies.

Health information you provide in connection with clinical services, including medical records, clinical notes, and care details, is PHI handled by the Medical Group under the HIPAA Notice of Privacy Practices, as described above, and is not governed by this Privacy Policy.

How We Collect Information

We collect information directly from you when you provide it, such as when you register, fill in forms, or contact us; automatically as you navigate the Services, through cookies and similar technologies; and from third parties, such as authentication providers, analytics providers, and marketing partners. We may combine information from these sources.

How We Use Your Information

We use the information we collect to operate, personalize, and improve the Services; to register and service your account; to communicate with you about the Services and, where you have opted in, to send marketing communications; to process any out-of-pocket payments; to derive de-identified or aggregated data for our own purposes; to protect the rights, safety, and security of Heyday Health, you, and others; to prevent fraud and misuse; to comply with law and legal process; and for any other purpose with your consent. We handle PHI only as permitted by the HIPAA Notice of Privacy Practices and our business associate obligations.

How We Disclose Your Information

We may disclose personal information: to the Medical Group and its providers to support your care; to our service providers and contractors that support the Services, such as cloud hosting and infrastructure providers (for example, Amazon Web Services), authentication providers, AI platforms that power certain features (for example, Anthropic), analytics providers, and communication tools; to payment processors; to our professional advisors; to authorities and others as required by law or to protect rights and safety; in connection with an actual or prospective corporate transaction such as a merger, acquisition, or financing; to parties you designate or with your consent; and to affiliates. We do not sell your personal information to third parties for their own marketing purposes. Disclosures of PHI are governed by the HIPAA Notice of Privacy Practices.

Key Service Providers

The following providers play key roles in operating the Services and may process personal information on our behalf under data processing agreements or, where they handle PHI, business associate agreements: Amazon Web Services (cloud hosting and infrastructure), and Anthropic (AI platform powering certain features). We may update these providers from time to time.

Your Choices

You can set your browser to refuse cookies, though some features may not function properly. You can opt out of promotional communications at any time by following the unsubscribe instructions in our emails, by replying STOP to text messages, or by contacting us. To exercise rights regarding PHI, follow the process in the HIPAA Notice of Privacy Practices.

State Privacy Rights

Some of the data we describe below is exempt from state consumer privacy laws, including PHI regulated by HIPAA. To the extent state law applies, the following describes your rights.

California

If you are a California resident, the CCPA as amended may provide rights to know, delete, correct, and opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under the CCPA. California's “Shine the Light” law permits certain requests about disclosures for third-party direct marketing. To exercise these rights, contact us at the information below. PHI regulated by HIPAA is exempt from the CCPA.

Washington My Health My Data Act

If you are a Washington resident, the My Health My Data Act may provide rights regarding consumer health data that is not otherwise regulated by HIPAA, including the right to know, to withdraw consent to collection and sharing, and to have such data deleted. Heyday Health does not sell consumer health data. Health information handled by the Medical Group as PHI is regulated by HIPAA and is outside the scope of this Act. To exercise your rights, contact us at the information below.

Other States

Residents of other states with comprehensive privacy laws, such as Virginia, Colorado, Connecticut, and others, may have additional rights regarding their personal information. We will honor valid requests submitted under applicable law. Contact us at the information below.

Health Breach Notification

To the extent Heyday Health handles identifiable health information that is not regulated by HIPAA and is subject to the Federal Trade Commission's Health Breach Notification Rule, we will provide the notifications required by that Rule in the event of a qualifying breach. Breaches of PHI are handled under HIPAA's breach notification requirements by the Medical Group and its business associates.

Data Retention and Security

We retain information for as long as your account is active or as needed to provide the Services, and as necessary to comply with legal obligations, resolve disputes, and enforce our agreements. We use technical, administrative, and physical measures designed to protect personal information, including encryption in transit and at rest, access controls, and monitoring. No method of transmission or storage is completely secure, and you are responsible for keeping your password confidential.

Children Under 18

The Services are not intended for children under 18, and we do not knowingly collect personal information from them. If we learn that we have collected information from a child under 18, we will delete it. If you believe we may have such information, please contact us.

SMS and MMS Messaging

If you opt in, we use your telephone number to send SMS messages related to the Services, such as appointment confirmations and reminders and care navigation notifications, delivered through AWS Notify. Message and data rates may apply. Text HELP for help, and reply STOP to opt out at any time. The following apply to our SMS program:

• No mobile numbers will be shared with third parties or affiliates for marketing or promotional purposes.
• Text messaging originator opt-in data and consent will not be shared with any third parties.
• Messages are delivered through AWS Notify. AWS does not share end user phone numbers with third parties for marketing or promotional purposes.

For the full messaging terms and conditions, see our Terms of Use at www.pinebankhealth.com/terms.

Storage of Personal Information

Information you provide is stored and processed in the United States. The laws in the United States may not offer the same degree of privacy protection as the laws in your jurisdiction.

Changes to This Privacy Policy

We may change this Privacy Policy from time to time. We will post changes on this page and update the date above. If we make material changes to how we treat personal information, we will notify you by email or through the Services. Your continued use after changes take effect is deemed acceptance of them.

Contact Information

Pinebank Health is a service of Heyday Health, Inc.

Email: privacy@pinebankhealth.com

1 Mifflin Place, Suite 400, Cambridge, MA 02138