Consumer Health Data Privacy Policy

Why there are three privacy documents, and which one applies to you

Our Privacy Policy covers ordinary website information: cookies, analytics, and marketing data.

Our Notice of Privacy Practices covers protected health information (PHI) once you are a patient. That is a HIPAA document and HIPAA rules govern it.

This policy covers the gap between them. Before you are a patient, information you give us about your health is not PHI, but it is still health data, and we protect consumer health data as described in this policy and provide the rights required by applicable consumer health privacy laws. If you later become a patient, the same information may also become PHI. Where that happens, both this policy and the Notice of Privacy Practices apply to it.

What consumer health data we collect

We collect only what the evaluation and your care actually need:

• Your state of residence, asked before any other question, so we can tell you immediately if we cannot treat you.
• Your name, email address and mobile number, asked before the medical questions so the physician can reach you either way.
• Medical history and health information you provide during your evaluation, including medications, conditions, symptoms, treatment history and treatment-related screening information, and whether you asked to speak with the physician before any approval.
• If you go on to become a patient, the clinical intake and records on our patient record platform. That information is PHI and the Notice of Privacy Practices governs it.

We do not calculate a health score. The safety screen either stops an evaluation or lets it continue; nothing is scored, ranked or graded.

What we do NOT do with it

We do not sell consumer health data. We have never sold it and we do not have a process for doing so.

We do not use your evaluation answers, or any inference from them, to target advertising to you, and we do not put them into an advertising platform’s audience or custom-audience tools.

We never send your evaluation answers, your concern, your treatment, the medication you were prescribed, or the fact that you took a health assessment to any advertising company. That is true of every page, every event and every sharing arrangement described below, and it is true whether or not you give us any of the consents on this page.

We do not use geolocation to infer anything about your health, and we do not operate a geofence around any health care facility.

How we use it

To tell you whether we can treat you in your state, and to stop the process immediately if we cannot.

To give the reviewing physician the information needed to decide whether treatment is appropriate.

To contact you about the evaluation you started, if you gave us your contact details.

To understand how many people start and finish the evaluation. We count steps; we do not attach your answers to that count.

Advertising pixels and advertising platforms: none, on any page

We run no advertising pixels on this website. No page sends your visit to Meta, TikTok or any other advertising network, and no purchase or lead is reported to any advertising platform. That is true of every page: the home page, the start pages, the pages about a therapy or a lab test, every article, every city page, the evaluation and everything after it.

The page you land on after paying asks one optional question about how you heard of us; we record the answer in Google Analytics (advertising features off) and never send it to any advertising platform.

What is measured on the evaluation, and by whom

Our own first-party counter. Every step of the evaluation (opened, state passed, contact screen shown, submitted and so on) is counted by our own software with a stage word and nothing about you: no answers, no state, no treatment choice, no name, email or phone. Reload protection uses a random token kept only in your browser tab.

Google Analytics on the evaluation records that the page was viewed and nothing else. The treatment you chose is removed from the page address before the tag loads, so Google Analytics never receives it; no evaluation event, answer, state, eligibility result or contact detail is sent. Advertising storage is denied and IP addresses are anonymised.

Google Analytics elsewhere records page views on the public pages and, on the home page and the start pages, one event when a button that starts your evaluation is pressed (the page and the button, nothing else). It is not sent if your browser sends Global Privacy Control or Do Not Track. No Google Ads tag runs on this site and no page sends a conversion to Google Ads.

Google reCAPTCHA Enterprise runs on the evaluation to block automated submissions and is subject to Google’s privacy policy and terms.

Who we share it with

Service providers who process data on our behalf under contract, and only for the purposes above: our customer-record platform, our patient record platform, our payment processor, our cloud infrastructure provider, and our email and messaging providers.

Advertising platforms: none. No page of this site sends an advertising network anything.

A prescribing or dispensing pharmacy, only if you become a patient and a prescription is issued.

Law enforcement or a court, only where we are legally required to and only to the extent required.

How to opt out of each thing separately

There are two things you may want to switch off, and they have their own controls:

• Google Analytics. Block it with any standard tracker-blocking browser extension or your browser’s private mode. Google publishes a Google Analytics opt-out browser add-on that works across every site.
• The start-button event on the home page and the start pages. Turn on Global Privacy Control or Do Not Track in your browser, or use the Google Analytics opt-out add-on above; either one stops it being sent.

Our own first-party step counter cannot identify you, so there is nothing about you in it to delete. If you would rather we handled anything else for you, email [email protected] with the subject line "Consumer health data request" and we will delete the records associated with you and tell you what we deleted.

Your rights

Wherever you live, you may ask us to:

• Confirm whether we hold consumer health data about you, and tell you who we have shared it with.
• Withdraw a consent you previously gave, for future collection, use or sharing.
• Delete the consumer health data we hold about you. We will delete it from our own systems and instruct our service providers to do the same. Where the information has also become part of a clinical record, medical-record retention law may require us to keep that record. We will tell you if that applies to you and what we are keeping.
• Appeal, if we refuse a request. We will explain why, and how to contact your state attorney general.

To make a request, email [email protected] with the subject line "Consumer health data request". We will respond within 45 days and will tell you if we need a further 45. We will not charge you, and we will not treat you differently for asking.

How long we keep it

If you complete the evaluation but do not become a patient, we keep your contact record and evaluation answers for as long as they are useful for follow-up, and delete them on request.

If you become a patient, the clinical record is retained for the period medical-record retention law requires, and the Notice of Privacy Practices governs it.

Analytics counts are aggregate and are not linked back to you by name, email address or phone number.

Changes to this policy

If we change how we collect, use or share consumer health data in a way that is materially different from this policy, we will post the revised policy here with a new effective date before the change takes effect. We will not apply a material change retroactively to data already collected without your consent.

Contact

Privacy Officer, RegenHairSolutions LLC dba Kesbury Health — [email protected], 8051 N. Tamiami Trail, Suite E6, Sarasota, FL 34243.