Consumer Health Data Privacy Policy

Why there are three privacy documents, and which one applies to you

Our Privacy Policy covers ordinary website information: cookies, analytics, and marketing data.

Our Notice of Privacy Practices covers protected health information (PHI) once you are a patient. That is a HIPAA document and HIPAA rules govern it.

This policy covers the gap between them. Before you are a patient, information you give us about your health is not PHI — but it is still health data, and state consumer-health-privacy laws (notably Washington’s My Health My Data Act and Nevada SB 370) govern it. If you later become a patient, the same information may also become PHI. Where that happens, both this policy and the Notice of Privacy Practices apply to it.

What consumer health data we collect

We collect only what the funnel actually needs, and we list it specifically rather than by category:

• Your state of residence, asked before any other question, so we can tell you immediately if we cannot treat you.
• Your answers to the pre-consultation quiz: the concern you selected, how long you have experienced it, what you have tried, your age range and your priority.
• A score we calculate from those answers. This is an inference about your health and we treat it as consumer health data, not as a marketing metric.
• Your name, email address and phone number, when you choose to submit them to see your result.
• If you go on to become a patient, the clinical intake you complete on our patient record platform. That information is PHI and the Notice of Privacy Practices governs it.

What we do NOT do with it

We do not sell consumer health data. We have never sold it and we do not have a process for doing so.

We do not use your quiz answers, your score, or any inference from them to target advertising to you, and we do not put them into an advertising platform’s audience or custom-audience tools.

We do not load advertising or social-media tracking pixels on the quiz or your results page. Those surfaces carry web analytics only, with IP anonymisation on.

We do not use geolocation to infer anything about your health, and we do not operate a geofence around any health care facility.

How we use it

To tell you whether we can treat you in your state, and to stop the process immediately if we cannot.

To generate the result we show you, and to give the reviewing physician context if you go on to complete a clinical intake.

To contact you about the evaluation you started, if you gave us your contact details.

To understand how many people start and finish the quiz. We count completions; we do not attach your answers to that count.

Who we share it with

Service providers who process data on our behalf under contract, and only for the purposes above: our customer-record platform, our patient record platform, our payment processor, our cloud infrastructure provider, and our email and messaging providers.

Our advertising measurement: when you complete the quiz and submit your contact details, we send a lead event to Meta so we can measure whether our advertising works. That event contains a one-way cryptographic hash of your email address and phone number, advertising cookie identifiers if your browser has them, and the address of the page you completed. It does not contain your quiz answers, your concern, your score, or any other health information. We do not receive anything about you back from Meta as a result.

A prescribing or dispensing pharmacy, only if you become a patient and a prescription is issued.

Law enforcement or a court, only where we are legally required to and only to the extent required.

Analytics and the tools that run on this site

One analytics tool runs on this website. It is not an advertising tool, it does not receive your quiz answers or your score, and it is configured differently on the pages where health information is collected.

• Google Analytics 4 — page views and a small number of named events (for example, that a quiz was started or completed). On the quiz, results, thank-you and payment pages it runs with IP anonymisation on and the completion event is sent with no parameters at all: we count that a quiz finished, not what was in it.

A second, product-analytics tool used to run alongside it. It was removed from the health-data pages on 26 August 2026 and removed from this website entirely on 2 September 2026; nothing on this site sends anything to it.

The remaining tool is not used to build advertising audiences, and we do not send it anything about your health.

To opt out: you can block it with any standard tracker-blocking browser extension, or by using your browser's private/incognito mode. Google publishes a Google Analytics opt-out browser add-on that works across every site. If you would rather we handled it, email us at the address below with the subject line "Consumer health data request" and we will delete the analytics records associated with you and tell you what we deleted.

Separately from analytics: advertising measurement is opt-in. On the quiz submit screen there is an unticked box asking whether we may share a one-way hash of your email address and phone number with Meta so we can measure whether our advertising works. If you leave it unticked, nothing is sent to Meta at all. Ticking it is not a condition of anything, and the "Who we share it with" section above describes exactly what that event contains.

Your rights

Wherever you live, you may ask us to:

• Confirm whether we hold consumer health data about you, and tell you who we have shared it with.
• Withdraw a consent you previously gave, for future collection, use or sharing.
• Delete the consumer health data we hold about you. We will delete it from our own systems and instruct our service providers to do the same. Where the information has also become part of a clinical record, medical-record retention law may require us to keep that record — we will tell you if that applies to you and what we are keeping.
• Appeal, if we refuse a request. We will explain why, and how to contact your state attorney general.

To make a request, email [email protected] with the subject line "Consumer health data request". We will respond within 45 days and will tell you if we need a further 45. We will not charge you, and we will not treat you differently for asking.

How long we keep it

If you complete the quiz but do not become a patient, we keep your contact record and quiz answers for as long as they are useful for follow-up, and delete them on request.

If you become a patient, the clinical record is retained for the period medical-record retention law requires, and the Notice of Privacy Practices governs it.

Analytics counts are aggregate and are not linked back to you.

Changes to this policy

If we change how we collect, use or share consumer health data in a way that is materially different from this policy, we will post the revised policy here with a new effective date before the change takes effect. We will not apply a material change retroactively to data already collected without your consent.

Contact

Privacy Officer, RegenHairSolutions LLC dba Kesbury Health dba Kesbury Health — [email protected], 8051 N. Tamiami Trail, Suite E6, Sarasota, FL 34243.