Privacy Policy

Last Updated: August 13, 2026

This Privacy Policy describes how Scan.com Corporation and its subsidiaries and affiliates (individually a “Scan.com Business,” and together referred to as “Scan.com,” “we,” “us,” or “our”) collect, use, disclose, and process your Personal Information (“you” and “your”), as well as rights that you may have regarding that information. This Privacy Policy applies to www.scan.com, us.scan.com, our patient and provider portals, our mobile applications, and any other website or online service that links to this Privacy Policy (collectively, the “Services”), and to information we collect offline in connection with the Services.

We reserve the right to change this Privacy Policy at any time. If we change this Privacy Policy, we will post an updated version on this website. Please check back periodically to see if this Privacy Policy has been updated. Updates to this Privacy Policy will be referenced by the “Last Updated” date shown above. Where a change is material, we will provide notice before the change takes effect and, where required by law, will obtain your consent.

Protected Health Information

This Privacy Policy does not apply to the processing of your Protected Health Information (“PHI”), as defined by the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”).

Diagnostic imaging and radiology professional services made available through the Services are furnished by independent professional entities, including each affiliated professional corporations (each, an “Affiliated PC”). Each Affiliated PC is a covered entity under HIPAA. The use and disclosure of your PHI by an Affiliated PC is governed by HIPAA and by that entity’s Notice of Privacy Practices, and not by this Privacy Policy.

Scan.com Corporation provides management, administrative, and technology services to the Affiliated PCs and to other health care providers, health plans, and health care clearinghouses. When Scan.com Corporation creates, receives, maintains, or transmits PHI on behalf of those customers, it does so as a Business Associate (as defined by HIPAA) and in compliance with HIPAA and the applicable business associate agreement. For information on how your PHI is handled, please refer to the applicable Notice of Privacy Practices.

Workers’ Compensation

Where we furnish or arrange diagnostic imaging in connection with a workers’ compensation claim, health information about you may be disclosed to your employer, its workers’ compensation insurer or third-party administrator, the state agency administering the claim, and their respective agents, as authorized by and to the extent necessary to comply with laws relating to workers’ compensation or other similar programs established by law that provide benefits for work-related injuries or illness without regard to fault, consistent with 45 C.F.R. § 164.512(l) and applicable state law.

Individuals Outside the United States

This Privacy Policy describes our practices with respect to individuals located in the United States.

1. Definitions.

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular person, household or device. “Personal Information” does not include: (a) publicly available information or lawfully obtained, truthful information that is a matter of public concern; (b) information that is deidentified or aggregate information; or (c) PHI or other information excluded from the scope of applicable state privacy laws, including information governed by HIPAA, the Gramm-Leach-Bliley Act, or the Fair Credit Reporting Act.

“Sensitive Personal Information” means Personal Information that reveals information such as: (a) social security, driver’s license, state identification card, or passport number; (b) account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; (c) precise geolocation; (d) racial, ethnic, or national origin, citizenship or immigration status, religious or philosophical beliefs, or union membership; (e) the contents of mail, email, and text messages unless we are the intended recipient of the communication; (f) genetic data; (g) information about a child; (h) biometric information for the purpose of uniquely identifying an individual; (i) mental health, physical health, and pregnancy; (j) sex life or sexual orientation, including status as a transgender or nonbinary individual; (k) status as a crime victim; and (l) neural data. Sensitive Personal Information that is publicly available is not considered Sensitive Personal Information or Personal Information.

“Consumer Health Data” means Personal Information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status, including bodily functions, vital signs, symptoms, diagnoses, treatments, medications, health-related surgeries or procedures, use or acquisition of health care services, precise location information that could reasonably indicate an attempt to acquire health care services, and any information that is derived or extrapolated from non-health information (such as proxy, derivative, inferred, or emergent data) and used to identify a health status. Consumer Health Data does not include PHI governed by HIPAA.

Please note that various jurisdictions may use different terms. For example, some jurisdictions use the terms “personal data,” “sensitive data,” or “sensitive personal data.” Moreover, some jurisdictions do not consider some of the Personal Information listed in the Sensitive Personal Information definition above to be Sensitive Personal Information.

2. Information We Collect or May Collect, the Categories of Sources of Collection and the Purpose for Collection.

Set forth below are the categories of Personal Information we may collect and that we have collected in the preceding 12 months, the categories of sources from which the Personal Information was collected, and the business or commercial purpose for such collection. Please note that every Scan.com Business may not collect all of the information referenced below regarding you, and every Scan.com Business may not use your Personal Information for all purposes set forth in this Privacy Policy.

* See the section entitled Cookies and Tracking Technologies below.

We only use Sensitive Personal Information for the purposes disclosed in this Privacy Policy. We do not use or disclose Sensitive Personal Information for purposes other than those specified in this Privacy Policy. We do not sell Sensitive Personal Information, and we do not use or disclose Sensitive Personal Information for cross-context behavioral advertising or targeted advertising.

We collect and process only the Personal Information that is adequate, relevant, and reasonably necessary in relation to the purposes described in this Privacy Policy. We do not process Sensitive Personal Information except where the processing is strictly necessary to provide or maintain a product or service specifically requested by you, or where you have provided the consent required by applicable law.

We also collect aggregated, de-identified, or anonymous data that does not identify individual consumers. We collect this information for various purposes such as statistical or demographic data for legitimate business purposes not prohibited herein or by law. We commit to maintain and use such data in de-identified form, will not attempt to re-identify the data, and will contractually obligate any recipient of the data to comply with the same restrictions.

3. Cookies and Tracking Technologies.

We use several types of cookies and other tracking technologies on our website.

A cookie is a small file of letters and numbers that is stored on your browser or the hard drive of your computer. Cookies contain information that is transferred to your computer’s hard drive. We and our service providers and partners use cookies or similar technologies, such as web beacons, tracking pixels, and software development kits, to analyze trends, administer our website, personalize content and ads, track users’ movements around our website, gather demographic information about our user base as a whole, and provide marketing. You can control the use of cookies at the individual browser level and through the cookie preference center available on our website, but if you choose to disable cookies, it may limit your use of certain features or functions on our website or of the Services, as some of our features or services may not function properly without cookies.

Our website has the following cookies:

• Strictly necessary cookies. These are cookies that are required for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website and cookies that support appointment scheduling and payment functions.
• Functionality/preference cookies. These are used to recognize you when you return to our website. This enables us to personalize our content for you, greet you by name, and remember your preferences (for example, your choice of language or region).
• Statistical, analytical or performance cookies. These allow us to recognize and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily. The sharing of Personal Information with these cookie providers may be considered a sale or sharing under data privacy laws. You may opt out by visiting Do Not Sell or Share My Personal Information or by enabling an opt-out preference signal in your browser.
• Marketing/targeting cookies. These cookies record your visit to our website, the pages you have visited, and the links you have followed. We will use this information to make our website and the advertising displayed on it and on third-party websites more relevant to your interests. The sharing of Personal Information with these cookie providers may be considered a sale or sharing under data privacy laws. You may opt out by visiting Do Not Sell or Share My Personal Information or by enabling an opt-out preference signal in your browser.
• Third party cookies. These cookies are placed on your device by a website from a domain other than our website. Please note that various third parties may also use these types of cookies, over which we have no control. These named third parties may include, for example, advertising networks and providers of external services like web traffic analysis services. These third party cookies are likely to be analytical cookies, performance cookies, or targeting cookies.

We use third party advertising companies to place ads. We do this by allowing our advertising and social media partners to place their cookies on the browser of an individual who visits our site. The data received by our third party advertising and social media partners allows them to measure the effectiveness of such advertising and to provide advertisements on other websites about our services which are tailored to your interests.

• Google Analytics. We use Google Analytics to ensure website functionality and improve our website and services. This software may record information such as your IP address, location, age and gender, browser type and language, operating system, access time, duration of visit, pages you view within our website, search terms you enter and other actions you take while visiting us, the pages you view immediately before and after you access the Services, how often you use the Services, aggregated usage and performance data, and app errors and debugging information. Google Analytics is owned and controlled by Google LLC. Data collected by Google is subject to its privacy policy. You may opt out of having your activity on our website made available to Google Analytics by installing the Google Analytics browser add-on.
• Meta Pixel. We use the Meta Pixel to customize our advertising and to serve you ads on social media based on your browsing behavior. Meta stores cookies on your device to enable us to measure the effectiveness of Meta ads for statistical and market research purposes. The information collected via Meta, on our websites as well as other websites on which Meta cookies are installed, is also stored and processed by Meta. This may be deemed a sale or sharing under state data privacy laws. To opt out of this sale or sharing and the processing of Personal Information for purposes of targeted advertising, visit your Facebook Advertisement Preferences and Off-Facebook Activity settings.
• Google Ads. We use Google Ads to deliver advertisements to you and to track whether you have interacted with an advertisement we have placed elsewhere on the internet. Google Ads stores a conversion tracking cookie on your device when you click on our advertisement. For more information, please review Google’s privacy policy.
• Microsoft Advertising. We use Microsoft Advertising to deliver and measure advertising. Microsoft Advertising may store cookies on your device and may use the resulting information for its own purposes in accordance with Microsoft’s privacy statement.

We do not deploy third-party advertising, analytics, or social media tracking technologies on any page or screen through which you schedule an appointment, complete a health questionnaire, access results, or otherwise provide information about your health condition, treatment, or the health care services you are seeking.

In addition, we use web beacons and pixels, which are images that can be placed in web pages and some forms of email. These technologies can be used to deliver cookies and to collect information about your use of the site. A tracking pixel is a transparent graphic image (usually 1 pixel x 1 pixel or a JavaScript tag) that is placed on a web page and, in combination with a cookie, allows us to collect information regarding the use of the page of the site that contains the tracking pixel. Emails that we and our service providers send may include similar technologies that provide us with information related to whether you have opened an email or clicked on a link contained in an email. More information on how to unsubscribe from our marketing emails is found below.

If you want to remove existing cookies from your device you can do this using your browser options. If you want to block future cookies being placed on your device you can change your browser settings to do this. Please bear in mind that deleting and blocking cookies may have an impact on your user experience as parts of the site may no longer work.

Except for strictly necessary cookies, we set non-essential cookies and similar technologies only after you have made your choice through our cookie preference center, and we honor opt-out preference signals, including Global Privacy Control (GPC), as described in the section entitled Opt-Out Preference Signals and Do Not Track below.

4. Personal Information We Disclose, Share for Targeted Advertising or Sell and the Purpose for It.

Disclosure of Personal Information to Service Providers

We disclose, and have disclosed in the preceding 12 months, Personal Information to our service providers and contractors for the following business purposes.

• Auditing of Ad Impression: We disclose Personal Information for auditing purposes related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
• Security and Fraud Detection: We disclose Personal Information for our security and fraud detection services including detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.
• Functionality & Debugging: We disclose Personal Information to engage in debugging to identify and repair errors that impair existing intended functionality.
• Short-Term / Transient Use: We disclose Personal Information for short-term, transient use, including, but not limited to, non-personalized advertising shown as part of a consumer’s current interaction with the business, provided that the consumer’s Personal Information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumer’s experience outside the current interaction with the business.
• Services on Our Behalf: We disclose Personal Information in order to receive services performed on our behalf, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing analytic services, providing storage, or providing similar services on our behalf.
• Advertising and Marketing Services: We disclose Personal Information to provide advertising or marketing services on our own behalf.
• Research & Development: We disclose Personal Information for internal research related to technological development and demonstration.
• Quality Control & Improvement of Products and Services: We disclose Personal Information to verify, maintain, and improve our products and services.

The following chart sets forth the categories of Personal Information we have disclosed to our service providers for a business purpose over the past 12 months.

Disclosure of Personal Information to Other Recipients

In addition to our service providers and contractors, we disclose Personal Information to the following categories of recipients in order to deliver the Services you request: the Affiliated PCs and the radiologists who interpret your images; imaging centers and radiology groups in our network; your referring physician and other treating providers; health plans, payers, third-party administrators, and workers’ compensation carriers; employers, in connection with workers’ compensation claims and to the extent permitted by law; attorneys and other legal representatives you have authorized; our professional advisors (auditors, insurers, and counsel); and government agencies where required by law. Where the information disclosed is PHI, the disclosure is made in accordance with HIPAA and, where applicable, your written authorization.

• As Necessary: We may also use and/or disclose Personal Information, as necessary: (a) to comply with any legal process and/or exercise or defend legal claims; (b) to respond to requests from public and government authorities; (c) to enforce our terms and conditions; (d) to protect our operations and protect our rights, privacy, safety or property, and/or that of you or others; and (e) to allow us to pursue available remedies or limit the damages that we may sustain. We may also use and disclose your Personal Information in connection with or during negotiation of any reorganization, acquisition, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings). You acknowledge that such transfers may occur and that any acquirer of or successor to us may continue to use your Personal Information as set forth in this Privacy Policy.

Selling and Sharing (for Targeted Advertisement) of Personal Information

We do not sell Personal Information in exchange for monetary consideration. However, our use of third-party analytics and advertising cookies and pixels as described above may constitute a “sale” or “share” of Personal Information for cross-context behavioral advertising (targeted advertising) under certain state privacy laws, because those partners may use the information for their own purposes.

We do not sell or share Sensitive Personal Information, Consumer Health Data, or any information relating to your health condition, treatment, or the health care services you seek. We do not use such information for targeted advertising or profiling.

Notwithstanding anything to the contrary, we will not sell the Sensitive Personal Information of a Maryland resident. In addition, if you are a Maryland resident whom we know or should know is under 18 years of age, we will not process or sell your Personal Information for the purposes of targeted advertising.

The chart below shows the categories of Personal Information we sell (as defined herein) or share for cross-context behavioral advertising (targeted advertising), or that we have sold or shared in the past 12 months, the categories of third parties to whom we have sold or shared Personal Information, and the purpose for the sale or sharing of the Personal Information.

As noted in Section 3 above, we use third party cookies. Under California law, the disclosure of data to our third party advertising and social media partners may be considered a sale of Personal Information.

We do not sell or share the Personal Information of consumers under 16 years of age without affirmative authorization, and we do not have actual knowledge that we sell or share the Personal Information of consumers under 16 years of age.

We do not process Personal Information for purposes of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

5. Our Retention Policy – How Long We Keep Your Personal Information.

We will retain each category of your Personal Information identified above for an amount of time that is reasonably necessary for us to use the information for the purposes disclosed herein and for any other permitted purposes, including retention of Personal Information pursuant to any applicable contract, law or regulation. To determine the appropriate retention period for Personal Information, we consider the amount, nature, and sensitivity of the Personal Information, the potential risk of harm from unauthorized use or disclosure of your Personal Information, the purposes for which we process your Personal Information and whether we can achieve those purposes through other means, and the applicable legal requirements.

Medical records and imaging studies maintained by or on behalf of an Affiliated PC or another health care provider are retained in accordance with applicable state medical record retention laws and the provider’s own record retention policy, which may require retention for a period of years after the last date of service and, in the case of minors, for a period measured from the patient reaching the age of majority.

6. Data Security.

We implement technical, organizational, administrative and physical measures to help ensure a level of security appropriate to the risk to the Personal Information we collect, use, process and disclose. These measures are aimed at ensuring the on-going integrity and confidentiality of Personal Information. We evaluate these measures on a regular basis to help ensure the security of the processing. Please be aware that, despite our ongoing efforts, no security measures are perfect or impenetrable.

In the event of a breach of the security of unencrypted Personal Information, we will notify affected individuals and, where required, regulators and consumer reporting agencies, in accordance with applicable federal and state breach notification laws and, where the information involved is PHI, the HIPAA Breach Notification Rule.

7. Email and Text Message Communications.

You may unsubscribe from our marketing communications by clicking the “unsubscribe” link found in the commercial emails we send, or by sending us a request to [email protected]. If you opt out of receiving marketing email communications, we may still send you email messages related to specific transactions with us, including appointment confirmations, reminders, results notifications, and billing communications. Unsubscribing from our marketing communications will not affect the Services we provide to you.

If you have consented to receive text messages from us, you may opt out at any time by replying STOP to any message, or by replying HELP for assistance. Message and data rates may apply. Message frequency varies.

Text messaging originator opt-in data and consent are excluded from all of the categories of Personal Information described in this Privacy Policy; this information will not be sold, shared, or otherwise disclosed to any third party, excluding aggregators and providers of the text message services, and will not be used for any purpose other than delivering the messages you have requested.

8. Children and Minors.

The Services are intended for use by adults. We do not direct our websites or applications to children under thirteen (13) years of age, and we do not knowingly collect Personal Information online from a child under 13 years of age without verifiable parental consent. If we learn that we have collected Personal Information from a child under 13 in a manner inconsistent with the Children’s Online Privacy Protection Act, we will take appropriate steps to delete that information. If you are a parent or guardian and believe your child has provided Personal Information to us, please contact us using the information in Section 15.

Where a minor is a patient, we collect information about that minor from the parent, guardian, or personal representative who arranges the imaging, or from the referring provider or payer. Information relating to a minor patient’s care is generally PHI and is governed by HIPAA and the applicable Notice of Privacy Practices, and not by this Privacy Policy.

We do not sell or share the Personal Information of consumers under 16 years of age without affirmative authorization. If we have actual knowledge that you are at least 13 years of age and under 18 years of age (or under 17 years of age, where applicable state law so provides), we will not, without your consent (or the consent of your parent or guardian where required), process your Personal Information for the purposes of targeted advertising, sell your Personal Information, or profile you in furtherance of decisions that produce legal effects or effects of similar significance. If you are a Maryland resident under 18 years of age whom we know or should know to be under 18, we will not process or sell your Personal Information for the purposes of targeted advertising at all.

9. Consumer Health Data.

If you are a resident of Washington, Nevada, or Connecticut, you have additional rights with respect to Consumer Health Data under the Washington My Health My Data Act, Nevada Senate Bill 370, and the Connecticut Data Privacy Act, respectively.

• We collect Consumer Health Data only to provide the products and services you request, and only with the consent required by applicable law.
• We do not sell Consumer Health Data. We will not sell your Consumer Health Data without first obtaining your valid written authorization, separate and distinct from any consent to collect or share it.
• We do not use Consumer Health Data for targeted advertising or profiling.
• You have the right to confirm whether we are collecting, sharing, or selling your Consumer Health Data; to access that data, including a list of all third parties and affiliates with whom we have shared or sold it; to withdraw your consent to our collection and sharing of it; and to have it deleted.
• We do not use a geofence around any facility that provides in-person health care services to identify or track consumers, collect Consumer Health Data, or send notifications, messages, or advertisements related to Consumer Health Data or health care services.

10. Consumer Rights.

Depending on your state of residency, you may have certain rights related to your Personal Information. Please note that not all of these rights may be applicable to you, these rights are subject to certain exceptions, and certain of these rights are subject to verification mechanisms. Personal Information that is exempt from a state privacy law — including PHI and other information governed by HIPAA — is not subject to these rights.

You may submit a request by emailing us at [email protected], or writing to us at:

Your Rights if You Are a Resident of California

California residents may exercise certain privacy rights pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and related regulations (“CCPA”). Your rights to submit certain requests as a California resident are described below.

• Right to Know Personal Information Collected About You. You have the right to know: (1) the categories of Personal Information we have collected about you; (2) the categories of sources from which the Personal Information is collected; (3) the business or commercial purpose for collecting, selling, or sharing Personal Information; (4) the categories of parties to whom we disclose Personal Information; and (5) the specific pieces of Personal Information we have collected about you. You also have the right to know the list of all third parties to whom we have disclosed Personal Information, as defined under California Civil Code Section 1798.83(e) (also known as the “Shine the Light” law), during the preceding year for third-party direct marketing purposes.
• Right to Know Personal Information Disclosed, Sold or Shared and to Whom. You have the right to request that we disclose to you: (1) the categories of Personal Information that we collected about you; (2) the categories of Personal Information that we sold or shared about you and the categories of third parties to whom the Personal Information was sold or shared; and (3) the categories of Personal Information that we disclosed about you for a business purpose and the categories of persons to whom it was disclosed for a business purpose.
• Right to Request Deletion of Your Personal Information. You have the right to request that we delete your Personal Information. However, there are a number of situations where you do not have the right to delete your Personal Information. For example, you cannot request that we delete your Personal Information if it is reasonably necessary for us to complete the transaction for which the Personal Information is collected, to provide the services that you have requested or reasonably anticipated within the context of our ongoing business relationship, or to otherwise perform a contract between us. We also will not delete your Personal Information from our backup systems to the extent permitted by the CCPA, and we may not delete information we are required to retain under HIPAA or state medical record retention laws. Following receipt of a request, we will let you know what, if any, Personal Information we can delete. If we cannot delete all of your Personal Information, we will let you know the reason.
• Right to Correct Inaccurate Information. If you believe that any of the Personal Information we maintain about you is inaccurate, you have the right to submit a request for us to correct that information. Upon receipt of a request, we will use commercially reasonable efforts to correct the information as you direct.
• Right to Opt Out of the Sale and Sharing of Your Personal Information. You may opt out of the sale or sharing of your Personal Information, to the extent applicable, by clicking Do Not Sell or Share My Personal Information. You can also exercise this right by using a browser or extension that supports an opt-out preference signal (also known as Global Privacy Control (GPC)). If you choose to use this signal, you will need to turn it on for each browser you use.
• Right to Limit the Use of Your Sensitive Personal Information. You have the right to direct us to limit the use and disclosure of your Sensitive Personal Information to those uses permitted by Section 1798.121(a) of the CCPA. You may exercise this right by clicking Limit the Use of My Sensitive Personal Information or by contacting us using the methods described above.
• Right to Non-Discrimination for Exercising Your Rights. If you choose to exercise any of your rights, you have the right to not receive discriminatory treatment by us.

Your Rights If You Are a Resident of a State Other than California

If you are a resident of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, or another state with a comprehensive consumer privacy law, you may have the following rights. Nevada residents should also refer to the “Nevada Privacy Notice” below.

• The Right to Know: You have the right to know whether we are processing your Personal Information and, if you are a resident of Oregon, the categories of your Personal Information we have processed and the specific third parties to which we have disclosed it.
• The Right of Access: You have the right to access your Personal Information, and to obtain a copy of it in a readily usable format, if feasible.
• The Right to Correct Inaccuracies: You may request that inaccuracies in your Personal Information be corrected.
• The Right to Delete: You have the right to request that your Personal Information be deleted, except in cases where retention is required by law or contractual obligation.
• The Right to Data Portability: You have the right to obtain a copy of your Personal Information in a portable and, if feasible, readily usable format.
• The Right to Opt Out: You may elect to prevent your Personal Information, to the extent applicable, from being: (a) used in targeted advertising; (b) sold; or (c) used for automated decision making or profiling purposes that may produce legal or similarly significant effects. You may exercise these rights using the methods described above or by enabling an opt-out preference signal in your browser.
• Rights Regarding Profiling: To the extent we engage in profiling in furtherance of decisions that produce legal or similarly significant effects, you have the right to (1) question the result of the profiling, (2) be informed of the reason the profiling resulted in the decision, and (3) if feasible, be informed of actions you could have taken to result in a different decision. You also have the right to review the Personal Information used in the profiling and, if such data was inaccurate, to correct the data and have the profiling decision reevaluated.
• Rights Regarding Sensitive Personal Information: Depending on your state of residency, we will either: (a) not process your Sensitive Personal Information without first presenting you with clear notice and an opportunity to opt out of the processing; or (b) not process your Sensitive Personal Information without obtaining your consent. You have the right to withdraw your previous consent and opt out of further processing of your Sensitive Personal Information. Where you withdraw consent, we will cease processing as soon as practicable and no later than fifteen (15) days after receiving your request.
• Rights Regarding Information We Share with Third Parties: If you are an Oregon or Minnesota resident, you have the right to obtain, at our option, either a list of the specific third parties to whom we have disclosed your Personal Information or a list of the specific third parties to whom we have disclosed any Personal Information. If you are a Delaware resident, you have the right to obtain a list of the categories of third parties to whom we have disclosed your Personal Information.
• Additional Minnesota Rights: If you are a Minnesota resident, you also have the right to obtain a list of the specific third parties to which we have disclosed your Personal Information, and the right to contest a profiling decision as described above.
• The Right to Non-Discrimination for Exercising Your Rights: If you choose to exercise any of your rights, you have the right to not receive discriminatory treatment by us.

Verification of Consumer Requests

When you make a request to know, delete and/or correct, to help protect your privacy and maintain security, we will take steps to verify your identity. Our verification procedure may differ depending on whether you have an account with us and the request you are making. The following generally describes the verification processes we use:

• Password Protected Accounts. If you have a password-protected account with us, we may use existing authentication practices to verify your identity but will require re-authentication before disclosing, correcting or deleting data. If we suspect fraudulent or malicious activity relating to your account, we will require further verification before complying with a request to know, correct or delete.
• Verification for Non-Accountholders. If you do not have, or cannot access, a password-protected account with us, we will generally verify your identity by matching at least two data points provided by you with reliable data points maintained by us for requests to know categories of Personal Information, and at least three data points for requests to know specific pieces of Personal Information, requests for access, and requests for data portability. For requests to correct or delete, we will verify your identity to a reasonable degree or a reasonably high degree of certainty depending on the sensitivity of the Personal Information and the risk of harm posed by unauthorized deletion.

If there is no reasonable method by which we can verify your identity, we will state so in response, including an explanation of why we have no reasonable method to verify your identity. We may also require a declaration, signed under penalty of perjury, that the person requesting the information is the person whose information is the subject of the request or that person’s authorized representative.

If you use an authorized agent to submit a request, we may require the authorized agent to provide proof that you gave the agent signed permission to submit the request. We may also require you to do either of the following: (a) verify your own identity directly with us; or (b) directly confirm with us that you provided the authorized agent permission to submit the request.

There may be situations where we cannot grant your request. For example, if you ask us to delete Personal Information that we are obligated to keep to comply with applicable law, we may not be able to fulfill some or all of your request. Your request may also be denied if it compromises the privacy of others, is overly repetitive, or is extremely burdensome to fulfill.

We will respond to valid requests no later than 45 calendar days after receipt. If necessary, we may take up to an additional 45 days to respond, but in such an event will provide you notice and an explanation of the reason within the initial 45-day period. Valid requests for access and data portability will be transmitted securely. Please note that you may only make a request to know or a request for data portability twice within a 12-month period.

Appeals

If we decline to take action on your request, we will notify you of that decision and the reasons why within 45 days. You may appeal our decision by replying to our response or by emailing [email protected] with the subject line “Privacy Request Appeal.” We will respond to your appeal in writing within 45 days (or within 60 days where applicable state law so provides), setting forth a written explanation of the reasons for our decision. If your appeal is denied, we will provide you with an online mechanism or other method through which you may contact your state attorney general to submit a complaint.

11. Nevada Privacy Notice.

Nevada law provides that Nevada residents may submit a verified request directing us not to make any “sale” of “covered information” to third parties, including but not limited to name, address, email address, telephone number, social security number, and an identifier that allows a specific person to be contacted. To submit a request, email [email protected] with the subject line “Nevada Opt-Out Request.” Nevada residents also have rights with respect to Consumer Health Data as described in Section 9 above.

12. Opt-Out Preference Signals and Do Not Track.

We recognize and honor opt-out preference signals, including Global Privacy Control (GPC), as a valid request to opt out of the sale and sharing of Personal Information for the browser or device transmitting the signal. If you are logged into your account when the signal is received, we will apply the opt-out to your account as well.

We do not respond to legacy “Do Not Track” (DNT) browser headers, which are not recognized as an opt-out preference signal under applicable state privacy regulations. DNT is a preference you can set on your web browser to inform websites that you do not want to be tracked. You can enable or disable DNT by visiting the preferences or settings page of your web browser.

13. Additional Information About Data Collection and Processing.

• Legal action. Your Personal Information may be used for legal purposes by us in court or in the stages leading to possible legal action arising from improper use of the Services. You acknowledge that we may be required to disclose Personal Information upon request of public authorities.
• System logs and maintenance. For operation and maintenance purposes, the Services and any third-party services may collect files that record interaction with the Services (system logs) and may use other Personal Information (such as the IP address) for this purpose.
• Third-party websites. The Services may contain links to websites operated by third parties. This Privacy Policy does not apply to those websites, and we are not responsible for their privacy practices. We encourage you to review the privacy policy of any third-party website you visit.
• Information not contained in this policy. More details concerning the collection or processing of Personal Information may be requested from us at any time using the contact information in Section 15.

14. Changes to This Privacy Policy.

We reserve the right to make changes to this Privacy Policy at any time by notifying you on this page. It is strongly recommended to check this page often, referring to the “Last Updated” date shown at the top of this Privacy Policy. Should the changes affect processing activities performed on the basis of your consent, we will obtain new consent from you where required. We will not apply materially different practices to Personal Information collected before the effective date of a change without first obtaining your consent.

15. How to Contact Us.

If you have any questions or concerns about our privacy policies and practices, or if you wish to exercise a privacy right, please contact us by emailing us at [email protected], or writing to us at: