24HrDOC Policy Notice for 24HrDoc Website and Patient Platform

Introduction

24HrDoc, Inc. (“24HrDOC”, “we”, “our”, or “us”) respects your privacy and is committed to protecting it through our compliance with this Privacy Notice (“Notice”). This Notice applies to you (“you” or “your”) and anyone who accesses or uses our Services (defined below), whether as a guest or registered user (“User”). A core element of our mission is our commitment to protect the information that identifies you as a specific individual and can be used to contact or identify you (“Personal Information”) and to be transparent about the data we collect about you, how it is used, and with whom it is shared.

This Notice describes our practices for collecting, using, maintaining, protecting, and disclosing personal information of Users, including providers who offer services through www.24hrdoc.com and www.24hrdoc.ai (our “Website(s)”), software, Platforms, and mobile application (collectively, the “Services”). For clarity, our “Platform” means our patient-facing websites, mobile applications, and online portal features (together, the “Patient Platform”). Through the Patient Platform you may create an account, schedule or conduct telehealth visits, exchange secure messages, view orders, and manage prescriptions (as available). This Notice applies to your use of the Patient Platform and to other non-clinical online interactions with us. When you receive clinical services from a Healthcare Provider, your “Protected Health Information” (“PHI”) is governed by that Provider's Notice of Privacy Practices, not this Notice.

Please read this Notice carefully to understand our policies and practices regarding your information and how we will treat it. If you do not agree with our terms, your choice is not to use our Services. By accessing or using this Website, you agree to this Privacy Notice. This Notice may change from time to time (see Changes to Our Privacy Notice). Your continued access of our Website or use of our Services after we make changes is deemed to be acceptance of those changes, so please check the Last Modified Date at the top of this Notice, to ensure that you are viewing the most current version of this Notice.

Children's Privacy

The Service is a general audience service intended for users 18 and older. We do not solicit or knowingly collect Personal Information from anyone younger than age 18, and if we become aware of any such information being collected, we will take immediate action to delete it. Should you become aware that we have collected Personal Information from a user younger than 18, please contact us at services@24hrdoc.com.

HIPAA AND PHI

Certain demographic, health and/or health-related information that 24HrDOC collects about Users on behalf of the licensed medical professionals that we partner with (“Healthcare Provider(s)”) as part of providing the Services may be PHI governed by the Health Insurance Portability and Accountability Act (“HIPAA”). Specifically, this may be true when:

• 24HrDOC is providing administrative, operational, or other services to a Healthcare Provider that is a “Covered Entity” (as defined by HIPAA); and
• in order to provide those services, 24HrDOC receives identifiable information about a User on behalf of the Healthcare Provider, where 24HrDOC is acting as a “Business Associate” (as defined by HIPAA); and
• this identifiable information is regulated as PHI.

This Privacy Notice does not apply to PHI, which is instead regulated by HIPAA. HIPAA provides specific protections for the privacy and security of PHI and restricts how PHI is used and disclosed. Please read the Notice of Privacy Practices of your Healthcare Provider to understand how your PHI can be used and disclosed.

This Privacy Notice describes our practices for managing Personal Information that a User provides to 24HrDOC when 24HrDOC is not acting as a Business Associate and that is not PHI. To provide just a few examples, we collect such Personal Information when you:

• create an account,
• search for Healthcare Providers or available appointments,
• post reviews,
• provide device/IP Information or Web Analytics information by browsing our websites (see below),
• direct your Covered Entity healthcare provider to disclose PHI to 24HrDOC outside of its Business Associate capacity (e.g. pursuant to a HIPAA Authorization or access request), and
• as further described throughout this Privacy Notice.

What Information Is Collected and How That Information Is Collected and Used

We collect several types of information, including Personal Information from you and about users of our Services, such as basic contact information when you sign up for an account. Other types of information we collect are related to how you use our platform, which helps us improve our Services. We use information that we collect about you or that you provide to us, including any Personal Information, to generally provide you with our Services.

When you provide us with information in connection with a particular activity or otherwise sign up for or order our products and Services or provide your contact information to us, including your email address or telephone number in connection with that activity, product or service, you agree that such action constitutes a purchase or inquiry establishing a business relationship with us. You expressly consent to receiving communications from 24HrDOC through the information you provided to us. Please review our Terms of Use for more information about our user guidelines. For more information on how to access and control your communication preferences, please see YOUR RIGHTS and the YOUR CHOICES REGARDING YOUR INFORMATION sections below.

Tracking Technologies

We, as well as third parties that provide content, advertising, or other functionality on the Services, may use cookies, pixel tags, local storage, and other technologies (“Tracking Technologies”) to automatically collect information through our Services. Tracking Technologies are essentially small data files placed on your computer, tablet, mobile phone, or other devices that allow us to record certain pieces of information whenever you visit or interact with our Site and Services. Depending on the specific Tracking Technology, we, our online data partners, or vendors may use Tracking Technologies to associate these activities with other Personal Information they or others have about you, including by association with your email or online profiles. We (or service providers on our behalf) may then send communications and marketing to these emails or profiles.

• Pixel Tags / Web Beacons: A pixel tag (also known as a web beacon) is a piece of code embedded on the Website that collects information about users&apois; engagement on that web page. The use of a pixel allows us to record, for example, that a user has visited a particular web page or clicked on a particular advertisement.
• Cookies: A cookie is a small text file that can be stored on and accessed from your device when you visit and use our Website. We use cookies to analyze trends, administer the Website, and track users&apois; movements around the site.

  Please review your web browser settings to modify your cookie settings, to disable the use of cookies, or to delete cookies. Please note that third parties such as advertisers or analytics providers may also use cookies and similar technologies while you are browsing or using the Website. We unfortunately have no control over such third parties&apois; use of these technologies.

  Cookies can be categorized as first-party or third-party cookies. As the name implies, first-party cookies are put on your device by 24HrDOC. Third-party cookies are placed on your device not by 24HrDOC, but by a third-party. Third-party cookies may include the Tracking Technologies described below.

• Analytics: We may use Tracking Technologies and other third-party tools to process analytics information about our Services. These tools are used to analyze how the Website is used and how it is performing. For clarity, we do not use, and do not allow our third-party service providers to use, Tracking Technologies within the Patient Platform.

Tracking Technologies we use include:

• Google Analytics: Collects information such as how often users visit this Website, what pages they visit when they do so, and what other sites they used prior to coming here. We use this information only to improve our Services and do not combine it with personally identifiable information. Google's ability to use and share information collected by Google Analytics about your visits to this Website is governed by Google's Privacy Policy. You can prevent Google Analytics from recognizing you on return visits to this Website by disabling cookies on your browser.
• Meta Pixel: We use Meta Pixel to customize our advertising and serve you ads on your social media based on your browsing behavior. The Pixel allows us to measure the effectiveness of Meta ads and may link information to your Meta account. Meta may also use this information for its own purposes per its Privacy Policy. You can opt out via your Meta Ad Settings or through the Digital Advertising Alliance opt-out tools.

You can generally opt out of receiving personalized ads from third-party advertisers and ad networks who are members of the Network Advertising Initiative (NAI) or who follow the Digital Advertising Alliance's Self-Regulatory Principles by visiting http://optout.networkadvertising.org and http://www.aboutads.info/choices/.

Do Not Track Signals: Our Services do not respond to “Do Not Track” signals. Third parties may collect information on public, unauthenticated pages for advertising/analytics, subject to your choices and applicable state law.

HIPAA & Online Tracking Technologies: We do not deploy online tracking technologies (including analytics, pixels, SDKs, session replay, or similar tools) on login and registration, appointment scheduling, symptom or intake tools, or any authenticated Patient Platform pages. Tracking is limited to unauthenticated, public-facing pages and is configured to avoid collecting PHI or linking public activity to a Patient Platform account.

HOW WE DISCLOSE AND SHARE YOUR INFORMATION

We may share information we receive about you as follows or as otherwise described in this Privacy Notice. When we disclose Personal Information, the recipient is required to keep that Personal Information confidential, secure and process the Personal Information only for the specific purpose for which they are engaged:

• To operate and support the Patient Platform: including account registration and authentication, session management, appointment scheduling, secure messaging, order/prescription management, and features you request as a registered User. Additionally, including care-coordination logistics requested through the Patient Platform, such as prescription processing and laboratory/diagnostic orders (as applicable).
• With Healthcare Providers: We will share your Personal Information, including your Health Information, with Healthcare Providers for the purposes of providing you with the Services you have requested.
• Service Providers: We employ third party companies and individuals to provide Services on our behalf, to perform Services-related operations such as website maintenance, database management, background checks, web analytics, payment processing, fraud detection or email marketing.
• Our Advertising Partners: As described above (see “Tracking Technologies”) we partner with third party advertisers to display advertising on the Website. Our ad network partners use cookies and web beacons to collect user information about your activities on the Website and other websites to provide you targeted advertising based upon your interests.
• Corporate Transactions: We may sell, transfer, or otherwise share some or all of our assets, including your Personal Information, in connection with a merger, acquisition, reorganization or sale of assets (including, in each case, as part of the due-diligence process with any potential acquiring entity) or in the event of bankruptcy.
• Affiliates and Subsidiaries: We may share Personal Information with our affiliated entities and corporate group companies to promote products and services to you, ensure a consistent level of service across our products and services, and enhance our products, services, and your customer experience.
• If Required by Law: We will share Personal Information with government agencies as required by law in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. We may disclose any information about you to government or law enforcement officials or private parties as we, in our sole discretion, believe necessary or appropriate: (i) to enforce our Terms and Conditions; (ii) to respond to claims, legal process (including subpoenas); (iii) to protect our property, rights, and safety and the property, rights, and safety of a third-party, our users, or the public in general; (iv) to stop any activity that we consider illegal, unethical or legally actionable activity; and (v) as required in accordance with applicable local, state, or federal laws. You may submit personal information to us through a form on the Website and consent to receive communication from us or our business affiliates and non-affiliates based on the information in the form.
• NOTE: We may use or share de-identified information (not reasonably capable of being associated with you). We do not attempt to re-identify de-identified data and we require our Service Providers to do the same.

YOUR CHOICES REGARDING YOUR INFORMATION

You have several ways to exercise control over your information:

• Patient Platform: Registered Users may access and update their Personal Information by accessing the applicable feature in their Account settings. Registered 24HrDOC users may also update their choices regarding the types of communications they receive from us through the online Account settings.
• E-Mail: You may opt-out of receiving marketing emails from us by following the opt-out instructions provided in those emails. Please note that we reserve the right to send you certain communications relating to your Account or use of the Services (for example, administrative and service announcements) via email and other means and these transactional account messages may be unaffected if you opt-out from receiving marketing communications.
• Text Messaging: By opting to use the Services provided by 24HrDOC, you consent to receive SMS (text) messages from 24HrDOC, its affiliates, and its partners pertaining to your account, services you have requested, and your interaction with 24HrDOC's Website. These messages may include, but are not limited to, appointment reminders, updates on services, promotional offers, and information relevant to your account and services. You acknowledge and agree that:
  1. SMS messages may be sent using automated technology.
  2. You do not have to consent to receive SMS messages as a condition of purchasing any goods or services.
  3. Standard message and data rates may apply to any SMS messages sent or received.
  4. The frequency of messages varies – you may receive messages periodically based on your interaction with 24HrDOC's Services.

  To opt out of SMS messages at any time, reply "STOP" to any message you receive. Upon receiving your request, we will send you a confirmation message and cease sending you SMS messages. For assistance or more information, reply "HELP." By providing your consent to receive SMS messages, you confirm that you are the owner of the mobile phone associated with the number you have provided or that you are authorized to consent to receive messages at that number. You also agree to inform 24HrDOC if you cease being the owner or authorized user of the number.

• Providing Consent: You may choose whether to receive from us offers and promotions for our products and services, the products or services of third parties, or products and services that we think may be of interest to you, by providing your consent (for example, by clicking an unticked checkbox).
• Contact Us: You may contact us to access, update or delete your personal information by contacting us at: services@24hrdoc.com.

YOUR RIGHTS REGARDING YOUR INFORMATION

Residents of certain jurisdictions may access, correct, update or delete your personal information; object to our processing of this information, ask us to restrict our processing of your personal information, or request portability of your personal information. Please see the YOUR CHOICES REGARDING YOUR INFORMATION to learn more about exercising your rights.

Upon request 24HrDOC will provide you with information about whether we hold any of your personal information. You are responsible for maintaining the accuracy of the information you submit to us, such as your contact information. You may access, correct, or request deletion of your personal information by making updates to that information in your Account settings or by contacting 24HrDOC. If you request to access all personal information you've submitted, we will respond to your request to access within the time period required by applicable law.

We will use commercially reasonable efforts to honor your requests for deletion; however, certain residual information may actively persist on the Services even if you close your account. In addition, the rights described above may be limited, for example, if fulfilling your request would reveal personal information about another person, or if you ask us to delete information, we are required by law to keep or have compelling legitimate interests in keeping (such as for fraud prevention purposes). Your Personal Information may remain in our archives and information you update or delete, or information within a closed account, may persist internally for our administrative purposes, to the extent permitted by law.

Please note that our Services require a minimum amount of Personal Information in order to function. Individuals who do not provide Personal Information (e.g., by not filling out a profile) may not be able to access the full functionality of features found on the Services.

California Residents — Your California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (“CCPA”) and California Consumer Privacy Rights Act, amending the CCPA (“CPRA”) (collectively the CCPA and CPRA are the “California Privacy Laws”) provide you with additional privacy rights with respect to our collection, use and disclosure of your Personal Information, including:

• The right to know what Personal Information we have collected and how we have used and disclosed that Personal Information in the 12-month period preceding your request.
• We collected the following categories of Personal Information in the last 12 months: identifiers/contact information, characteristics of protected classifications under California or federal law, payment card information associated with you, commercial information, customer records information, Internet or other electronic network activity information, geolocation data, audio, electronic, visual or similar information, and inferences drawn from the above.
• The sources of Personal Information from whom we collected are directly from users, analytics tools, social networks, and third-party services that update or supplement information we hold about you.
• Please see the above section within this Notice titled INFORMATION WE COLLECT ABOUT YOU AND HOW WE COLLECT IT, to see the full list of categories of Personal Information we have collected about you.
• Please see the above sections YOUR RIGHTS and YOUR CHOICES REGARDING YOUR INFORMATION, to see applicable business or commercial uses and disclosures of your Personal Information.
• The right to request deletion of your Personal Information.
• The right to be free from discrimination related to the exercise of any of your privacy rights.
• The right to opt out of the sale of your Personal Information, and to request information about whether we have sold your Personal Information in the past 12 months.
  • Pursuant to the definitions of “sale” under California Privacy Laws, we do not “sell” and have not “sold” Personal Information in the previous 12 months. To the extent our use of advertising technology constitutes “sharing” under California law, you may opt out of such sharing at any time, and we honor Global Privacy Control (GPC) signals as an opt-out preference for applicable browsers such as NAI and DAA.
• The right to correct inaccurate Personal Information.
• The right to limit the use and disclosure of Sensitive Personal Information.
• The right to access information related to and opt-out of the use of automated decision-making technology.

For more information on how to exercise any applicable rights you may have under California Privacy Laws, please contact us at services@24hrdoc.com. Please note that we may require you to verify your credentials, by matching your e-mail address, or other account information to the information in our systems, before you can submit a request to exercise any of these rights.

If you authorize another person to act as your agent to submit requests on your behalf, then unless you provide the agent with power of attorney under the California Probate Code, we will ask the agent to provide us the written and signed authorization that you provided to the agent, we will confirm with you that you did provide the authorization, and we will verify your identity.

Washington My Health My Data Act

To the extent that the Washington My Health My Data Act (“MHMD”) applies to the Services, 24HrDOC provides a My Health My Data Act Notice (“MHMD Notice”), hereby incorporated into this Privacy Notice by reference, for residents of the State of Washington in accordance with the My Health My Data Act of 2023 and sets out how 24HrDOC collects, uses and discloses Consumer Health Data (as defined in the MHMD) that we collect from you when you use our Services. The MHMD Notice is available at: Link.

U.S. State Privacy Rights

Residents of certain states (including Colorado, Connecticut, Virginia, Oregon, Texas, and Delaware) may have additional rights to access, delete, correct, or opt out of targeted advertising, sale, or profiling in furtherance of decisions that produce legal or similarly significant effects. You may submit a request by emailing services@24hrdoc.com. If we deny your request, you may appeal by emailing services@24hrdoc.com with “Appeal” in the subject line. We will describe any actions taken in response to your appeal.

International Jurisdictions

Our Services are hosted and offered in the United States of America (US), and are subject to US federal, state, and local law. If you are accessing the Services from another country, please be advised that you may be transferring your personal information to us in the US, and you consent to that transfer, processing, and storage of your personal information in accordance with this Privacy Notice. You also agree to abide by the applicable laws of US federal, state, and local laws concerning your use of the Services and your agreements with us. Any persons accessing our Services from any jurisdiction with laws or regulations governing the use of the Internet, including the collection, use, or disclosure of personal information, different from those of the jurisdictions mentioned above may only use the Services in a manner lawful in their jurisdiction. If your use of the Services would be unlawful in your jurisdiction, you may not use our Services.

Security

We use physical, technical, and organizational measures designed to protect your information against unauthorized access, theft, and loss as appropriate to the sensitivity of the data, including encryption in transit (TLS) and at rest, access controls with least-privilege, logging/monitoring, and vendor due diligence. We also support multi-factor authentication for protected areas of the Patient Platform. We restrict access to your personal information to those employees who need to know that information to service your account or perform their job functions.

Although we take precautions intended to help protect information that we process, no system or electronic data transmission is completely secure. Any transmission of your personal data is at your own risk, and we expect that you will use appropriate security measures to protect your personal information.

You are responsible for maintaining the security of your account and the information in your account. We may suspend your use of all or part of the Services without notice if we suspect or detect any breach of security. You understand and agree that we may deliver electronic notifications about breaches of security to the email address on record on your account.

Data Retention

Unless you request that we delete certain information (see YOUR RIGHTS and YOUR CHOICES), we will retain your Personal Information for the period necessary to fulfill the purposes outlined in this Privacy Notice unless a longer retention period is required or permitted by law. Criteria used to determine retention periods include:

• The length of time we have an ongoing relationship with you and provide services to you (for example, for as long as you have an account with us or keep using the Website);
• Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of transactions for a certain period of time before deletion);
• Whether retention is advisable considering our legal position (such as statutes of limitations, litigation or regulatory investigations).

Deleting your 24HrDOC account or asking us to delete Personal Information under this Notice does not delete medical records maintained by your Healthcare Provider(s). Those records are governed by the Provider's Notice of Privacy Practices and applicable law. To access, amend, obtain a copy of, or request deletion/limited use of your medical record, contact your Provider directly.

Links to Other Sites

Our Website may include links to third-party websites and services that are not operated by us. When you click these links, you will be directed away from our Services. A link to a third-party website or service does not mean that we endorse it or the quality or accuracy of information presented on it. If you decide to visit a third-party website or service, you are subject to its privacy practices and policies, not ours. This Privacy Notice does not apply to any personal information that you provide to these other websites and services.

Telehealth Platforms

Telehealth visits may be delivered through a third-party platform (e.g., video visit vendor). The collection and use of information by that platform (for example, device diagnostics, telemetry, or platform cookies) is governed by the platform's own privacy policy and terms of use, which 24HrDOC does not control. PHI created or used by your Healthcare Provider during care is governed by the Provider's Notice of Privacy Practices, not this Notice.

Changes to This Notice

24HrDOC may update this Privacy Notice at any time and any changes will be effective upon posting. In the event that there are material changes to the way we treat your Personal Information, we will update the Last Modified date at the top of this Notice upon becoming effective. We may also notify you by email, in our discretion. We will not make changes that retroactively reduce your privacy rights unless required by law.

How to Contact 24HrDOC

If you have any questions about this Privacy Notice, please contact us at: services@24hrdoc.com.