We are committed to protecting your privacy. This Notice explains how Everlywell, Everly Health Solutions, Natalist and their respective affiliates (“we”, “us” or “our”) collect information from and about you (“you” or “your”) when you visit our websites or any mobile applications, social media networks, interactive features, and other services that link to this Notice (collectively, our “Platforms”), and how we use, maintain, protect and disclose that information. Our Platforms, like most other platforms, use cookies and other technologies to make our Platforms work as you expect and to collect and share information. Please see our Your Privacy Choices page for more information.

The Platforms are intended solely for users within the United States. Individuals outside of the United States should not use the Platforms. If you are located outside the United States, you acknowledge and agree that if you use our Platforms your information may be transferred to, processed or maintained outside of your state, province or country, and subject to laws regarding processing of information that may be less stringent than the laws in your location. By providing your data to or using the Platforms, you acknowledge and consent to the transfer, processing and maintenance of your data as described in this Notice. Residents of the states of California Colorado, Connecticut, Montana, Oregon, Texas, Utah, and Virginia have certain rights described in Section 4 of this Notice. Residents of the states of Nevada and Washington have certain rights described in our Consumer Health Data Privacy Notice

If you are using our Platforms in connection services covered by Health Insurance Portability and Accountability Act of 1996 (or “HIPAA”) or state laws governing the privacy of health information, such as California’s Confidentiality of Medical Information Act or Virginia Code § 32.1-127.1:03, please refer to our HIPAA Notice of Privacy Practices, which describes how we use and disclose such health information, our legal duties with respect to such health information, and your rights with respect to your health information and how you may exercise them.

Any defined terms in Everlywell’s Terms of Use, Everly Health Solution’s Terms of Service or Natalist’s Terms of Service have the same meaning when used in this Notice. By using the Platforms that link to those terms, you consent to the collection and use of the personal information in accordance with this Notice and the terms linked by the Platforms.

We collect information about you when you use our Platforms, including personal and non-personal information. “Personal information” is any information that may identify, relate to, describe, or be capable of being associated with or reasonably linked, directly or indirectly, with a particular identified or identifiable person or household.

Personal Information we might collect includes data such as the following:

We do not consider personal information to include information that can no longer be used to identify a specific natural person, whether in combination with other information or otherwise such as, for example, de-identified or aggregated consumer information.

Children’s Privacy

Our Platforms do not knowingly collect personal information from users who are under 18 years of age. We are relying on your representations in Everlywell’s Terms of Use, Everly Health Solution’s Terms of Service and Natalist’s Terms of Service that you are 18 years of age or older. You should not use the Platforms if you are not 18 years of age or older.

Securing Your Information

We have implemented measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration and disclosure. All personal information you provide to us is stored on our secure servers behind firewalls. Any payment transactions will be encrypted using SSL or other encryption technology, or will use our third party payment processors, who will use appropriate security procedures. The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Platforms, you are responsible for keeping this password confidential. You should not share your password with anyone. We urge you to be careful about giving out information in public areas of the Platforms like message boards. The information you share in public areas may be viewed by any user of the Platforms. Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted to the Platforms. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Platforms.

How Long We Retain Your Information

We retain your personal information only for as long as is necessary for our legitimate business purposes. We will retain and use your personal information to the extent necessary to comply with our legal, accounting, or reporting obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes and enforce our legal agreements and policies. Additionally, we may continue to store your Personal Information contained in our back-ups that are not accessible during the normal course of business. This applies to all categories of Personal Information in use by us.

We will only use your personal information as described in this Notice or, if not described in this notice, with your consent prior to such processing taking place. The purposes for which we may use your personal information include:

• Providing any services or products that you request or purchase.
• Contacting you regarding the administration of any features or functions of the Platforms or services you have registered to use.
• Providing you with notices about your account, including expiration and renewal notices.
• Carrying out our obligations and enforcing our rights arising from any contracts entered into between you and us, including for billing and collection.
• Notifying you about changes to our Platforms, our policies, terms or any services or products we offer or provide through it.
• Sending you marketing and promotional emails.
• Responding to your questions or other requests.
• Allowing you to participate in the interactive features of the Platform or services.
• Tailoring your experience on the Platforms or otherwise customizing what you see when you visit and use the Platforms.
• Saving your user account, registration and profile data or other personal information (so you do not have to re-enter it each time you visit or use the Sites).
• Tracking your return visits to and use of the Platforms.
• For research purposes, for marketing/promotional purposes and to provide anonymous reporting for internal and external clients and business partners.
• Accumulating and reporting de-identified or aggregate, statistical information in connection with the Platform and user activity.
• Determining which features and services users like best to help us operate the Platforms, enhance and improve our Platforms, services or products and to display advertising and marketing information.
• Keeping you secure and safe while using our Sites, which requires us to process your personal information to combat spam, malware, malicious activities or security risks.
• Improving and enforcing our security measures.
• Maintaining legal and regulatory compliance.
• Enforcing compliance with our terms and conditions and policies.
• Protecting you, others and our business, including, without limitation, using information for fraud prevention.
• For any other purpose disclosed to you prior to you providing us your personal information or which are reasonably necessary to provide the Services or other related products and/or services requested.

We may also use your information to contact you about our own and third parties’ services and products that may be of interest to you. If you do not want us to contact you about third party services and products, please email us at [email protected] to opt out.

We may use the information we have collected from you to enable us to display advertisements to our advertisers’ target audiences. If you click on or otherwise interact with an advertisement, the advertiser may assume that you meet its target criteria.

We may share or disclose your personal information in the following circumstances, for the purpose discussed below:

Laboratory Testing, Clinician and Telehealth Services, and Pharmacies

If you utilize laboratory testing services or clinician oversight or telehealth services, your personal information will be transmitted to the applicable laboratory or healthcare provider, and if they order a medication, to the requested pharmacy. For information about how such health information is used or disclosed, please our HIPAA Notice of Privacy Practices and the notices, agreements, consents or acknowledgments you execute and receive in the course of utilizing those services.

Within Our Corporate Organization

We may share your personal information with our subsidiaries and affiliates in order to provide you with our services and take actions based on your requests.

Corporate Transactions

To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution or sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation or similar proceeding, in which personal information held by us about our Platforms and/or services is among the assets transferred, and you agree to and do hereby consent to our assignment or transfer of rights to your personal information.

As Required by Law

Under certain circumstances your personal information may be subject to processing pursuant to laws, regulations, judicial or other government subpoenas, warrants, or orders. We may be required to disclose personal information in coordination with regulatory authorities in response to lawful requests by public authorities, including to meet national security or law enforcement requirements, or for public health purposes. We will preserve and disclose any and all information to law enforcement agencies or others if required to do so by law or in the good faith belief that such preservation or disclosure is reasonably necessary to: (a) comply with legal or regulatory process (such as a judicial proceeding, court order, or government inquiry) or obligations that we may owe pursuant to ethical and other professional rules, laws, and regulations; (b) enforce our Terms of Service and other policies; (c) respond to claims that any content violates the rights of third parties; or (d) protect the rights, property, or personal safety of Everlywell, Everly Health Solutions and/or Natalist, its employees, its users, its clients, and the public.

Service Providers

We may share personal information with companies and individuals (“Service Providers”) who facilitate the operation of our Platforms and services, provide services on our behalf, perform service-related functions or assist us in analyzing how our Platforms and services are used. The personal information obtained by Service Providers from their relationship with us is only to be used for performing the services specified in our agreement with them, or as reasonably necessary to perform one or more of the following:

• Comply with applicable law, regulation, or legal process;
• Detect, prevent or mitigate fraud or security vulnerabilities;
• Debug to identify and repair errors impairing existing intended functionalities; and/or
• Conduct internal research for technological development and demonstration of our products or services, if such use is reasonably necessary and proportionate to achieve the purpose for which the data was shared.

Sharing of Website Tracking Data

Our websites, like almost all other websites, use cookies and other technologies to make the website work as you expect and to collect and share information. Please see our Your Privacy Choices page for more information.

Integration of Third-Party Platform, Services and Websites

The Platforms may be linked to, rely on and be integrated with websites, applications, interfaces, services and platforms operated by other companies, including third-party services. The Platforms may also feature advertisements from these companies. We are not responsible for the privacy practices of such websites, applications, interfaces, services and platforms operated by third parties that are linked to, rely on and/or integrated with the Platforms or for the privacy practices of third party advertising companies. Once you leave the Platforms via a link, access a third-party service or click on an advertisement, you should check applicable privacy policies to determine, among other things, how related companies process personal information they may collect about you. This Privacy Notice applies solely to information collected by Everlywell, Everly Health Solutions and/or Natalist.

Third-Party Advertisers

With your consent, we may share your personal information with third parties to market their products or services to you.

Targeted Advertising

With your consent, we may disclose the following categories of personal information to the categories of third parties listed below for the purpose of targeted or cross-context advertising (under California law, this is called “sharing”):

You can opt in and out of sharing or using your personal information for the purposes of targeted advertising, by interacting with the cookie banner that may appear at the bottom of our websites the first time you come to the website or the Sharing Settings or Your Privacy Choices link that may appear in the footer of our websites.

How We Respond to Do Not Track Signals

"Do Not Track" signals are used by some web browsers to attempt to limit tracking related to your visits to a website. Not all browsers offer a "Do Not Track" option and "Do Not Track" signals are not yet uniform. To the extent that your browser broadcasts a "Do Not Track" signal, our website is configured to recognize "Do Not Track" signals. We also recognize opt-out preference signals contained in HTTP header fields.

A. Rights Available to California Residents Under Rights provided by California Civil Code Section 1798.83 (California’s Shine the Light Statute)

A California resident who has provided personal information to a business with whom he/she has established a business relationship for personal, family, or household purposes (a “California Customer”) may request information about whether the business has disclosed personal information to any third parties for the third parties' direct marketing purposes. In general, if the business has made such a disclosure of personal information, upon receipt of a request by a California Customer, the business is required to provide a list of all third parties to whom personal information was disclosed in the preceding calendar year, as well as a list of the categories of personal information that were disclosed. California Customers may request further information about our compliance with this law by contacting us at any of the following:

• Mail: Attn: Privacy Officer, Everly Health, Inc., 823 Congress Avenue, 12th Floor, Austin, TX 78701
• Email: [email protected]
• Phone Number: 888-813-0230

Please note that we are only required to respond to one request per California Customer each year under Code Section 1798.83.

B.  Rights Under State Consumer Privacy Laws

Residents of the states of California, Colorado, Connecticut, Montana, Oregon, Texas, Utah, or Virginia have certain rights described in Section 4 of this Notice. If you are a resident of one of these states (“Applicable Residents”), you may exercise your privacy rights where these are applicable to you at any time, by contacting us at any of the following:

• Mail: Attn: Privacy Officer, Everly Health, Inc., 823 Congress Avenue, 12th Floor, Austin, TX 78701
• Email: [email protected]
• Phone Number: 888-813-0230

This section describes practices regarding the collection, use, disclosure, and sale of “personal information” and the rights of Applicable Residents regarding their personal information under the applicable state consumer privacy laws in the United States (“Applicable State Data Protection Law”). This section applies to Applicable Residents who are considered a “Consumer” or an equivalent term under the Applicable State Data Protection Law. The section does not apply to information that is exempt from an Applicable State Data Protection Law. For example, Applicable State Data Protection Laws do not apply to information that is already protected by certain other laws such as HIPAA, to information that is already publicly available from governmental sources, or to de-identified or aggregated consumer information.

C. You Have a Right to Know about Personal Information Collected, Disclosed, Shared or Sold

Applicable Residents have the right to request that we disclose what Personal Information we collect, use, and disclose. This is called the "Right to Know". Under the Right to Know, you can request a listing of the types of Personal Information we have collected about you, the sources of that information, how we use the information (e.g., our business or commercial purposes for collecting, or selling Personal Information), other individuals and businesses with whom we share Personal Information, and the specific pieces of Personal Information that we have collected about you. If you would like to make a request under your Right to Know, you may request this through [email protected] or by calling 888-813-0230. When you make a request under your Right to Know, you can expect the following:

• We will verify your identity. We will verify your identity using the following process: Our customer care team will ask questions based upon information that you previously have provided. Where possible, we will use information we already hold about you in order to confirm that you are who you say you are.
• We will confirm our receipt of your request within 10 days. If you have not received a response within a few days after that, please let us know by contacting us at [email protected] or by calling 888-813-0230.
• We will respond to your request within 45 days of receipt of the request, if possible. If necessary, we may need an additional period of time, up to another 45 days, but we will reply either way within the first 45-day period and, if we need an extension, we will explain why.

In certain cases, a Right to Know request may be denied. For example, if we cannot verify your identity or if providing you the information could create an unreasonable risk to someone's security (for example, we do not want very sensitive information disclosed inappropriately). If we deny your request, we will explain why we denied it. If we deny a request, we will still try to provide you as much of the information as we can, but we will withhold the information subject to denial.

D. The Right to Access and Receive your Specific Personal Information

Applicable Residents have the right to request that we provide a portable copy of the personal information we collect, use, disclose, and sell. You can request a listing of the types of personal information we have collected about you, the sources of that information, how we use the information (e.g., our business or commercial purposes for collecting or selling personal information), other individuals and business with whom we share personal information, and the specific pieces of personal information that we have collected about you. If you would like to make a request under your Right to Access, you may request this through [email protected] or by calling 888-813-0230. When you make a request for a portable copy of your information, you can expect the following:

• We will verify your identity based upon information that you previously have provided. Where possible, we will use information we already hold about you in order to confirm that you are who you say you are.
• We will confirm our receipt of your request within 10 days. If you have not received a response within a few days after that, please let us know by contacting us at the webpage or phone number listed above.
• We will respond to your request within 45 days of receipt of the request, if possible. If necessary, we may need an additional period of time, up to another 45 days, but we will reply either way within the first 45-day period and, if we need an extension, we will explain why.

In certain cases, a request for access may be denied, for example, if we cannot verify your identity. If we deny your request, we will explain why we denied it.

E. You have a Right to Request Deletion of Personal Information about You

Applicable Residents have a right to request the deletion of their Personal Information collected or maintained by us, subject to certain limitations. If you would like information about you to be deleted, you may request deletion through [email protected] or by calling 888-813-0230. When you make a request for deletion, you can expect the following:

• After you submit a request deletion, you will need to confirm that you want your information deleted. We will verify your identity based upon information that you previously have provided. Where possible, we will use information we already hold about you in order to confirm that you are who you say you are.
• We will confirm our receipt of your request within 10 days. If you have not received a response within a few days after that, please let us know by contacting us at the webpage or phone number listed below.
• We will respond to your request within 45 days of receipt of the request, if possible. If necessary, we may need an additional period of time, up to another 45 days, but we will reply either way within the first 45-day period and, if we need an extension, we will explain why.

In certain cases, a request for deletion may be denied, for example, if we cannot verify your identity, the law requires that we maintain the information (e.g., in case of certain tests) or if we need the information for internal purposes such as ongoing research. If we deny your request, we will explain why we denied it, treat your request as an "opt-out" of the sale of information (as described in our Notice of Right to Opt-Out), and delete any other information that is not protected from deletion.

F. You may have a Right to Request the Correction of Inaccurate Personal Information about You

Applicable Residents other than in Utah also have the right to request the correction of inaccurate Personal information collected or maintained by us. If you would like information about you to be corrected, you may request correction through the contact information at [email protected] or by calling 888-813-0230. When you make a request for correction, you can expect the following:

• After you submit a request for correction, you will need to confirm what information is incorrect and requires correction. We will verify your identity based upon information that you previously have provided. Where possible, we will use information we already hold about you in order to confirm that you are who you say you are.
• We will confirm our receipt of your request within 10 days. If you have not received a response within a few days after that, please let us know by contacting us at the webpage or phone number listed below.
• We will respond to your request within 45 days of receipt of the request, if possible. If necessary, we may need an additional period of time, up to another 45 days, but we will reply either way within the first 45-day period and, if we need an extension, we will explain why.

In certain cases, a request for correction may be denied, for example, if we cannot verify your identity. If we deny your request, we will explain why we denied it.

G. You Have the Right to Opt-Out of the Sale of Personal Information or Sharing of Personal Information for Targeted Marketing

This Section also serves as a Notice to residents of the States of California, Colorado, Connecticut, Montana, Oregon, Texas, and Utah and the Commonwealth of Virginia of their right to opt-out of the sale of personal information and of the use and/or disclosure of personal information for certain types of targeted advertising and consumer or household profiling. Residents of California have a right to direct businesses not to sell their personal information or share their personal information for cross-context behavioral advertising. Colorado, Connecticut, Montana, Oregon, Texas, Utah, and Virginia residents have the right to direct businesses not to process their personal data for purposes of (i) targeted advertising, (ii) selling or otherwise transferring personal data in exchange for monetary or other valuable consideration, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. Under Applicable State Data Protection Law, this is known as the “right to opt out.” In general, we will only use your personal information to perform services or provide the goods reasonably expected by you, internal reporting and analytics purposes, for other purposes in the ordinary course of business, and to facilitate first-party marketing and analytics. We do not sell your personal information for monetary consideration.

However, when you visit our websites, we may share information about your use of our websites, including the specific health conditions, health care services and products you view, search for, or purchase, with certain advertising and/or analytics partners who retain the right to utilize that data for their own business purposes, which may include targeted advertising and/or profiling that produce legal or similarly significant effects concerning consumers. You can opt into, or out of, such sharing at any time by interacting with the cookie banner that may appear at the bottom of our websites the first time you come to the website or the Sharing Settings or Your Privacy Choices links that may appear in the footer of our websites.

Nevada law also gives Nevada consumers the right to request that a company not sell their personal information for monetary consideration to certain other parties.  This right applies even if their personal information is not currently being sold in that manner.  If you are a Nevada consumer and wish to exercise this right, please send an email with the subject line “Nevada Resident Do Not Sell Request” to [email protected].

H. Rights Regarding Use and Disclosure of Sensitive Personal Information

Sensitive personal information includes the “sensitive personal information” described in Section 1 of this Notice, such as your driver’s license number, national or state identification number, citizenship status, immigration status, race, national origin, religious or philosophical beliefs, sexual orientation, sex life, precise geolocation, information concerning your health, and genetic information.

In general, we will only use your sensitive personal information to perform services or provide the goods reasonably expected by you, for internal reporting and analytics purposes, for other internal purposes in the ordinary course of business, and to facilitate first-party targeted marketing and analytics.

However, when you visit our websites, we may share information about your use of our websites, including the specific health conditions, health care services and products you view, search for or purchase, with certain advertising and/or analytics partners who retain the right to utilize that data for their own business purposes. Depending on where you live, Applicable Residents can either opt into, or out of, such sharing at any time by interacting with the cookie banner that may appear at the bottom of our websites the first time you come to the website or the Sharing Settings or Your Privacy Choices links that may appear in the footer of our websites.

I. You have a Right to Non-Discrimination/No Retaliation for the Exercise of a Consumer's Privacy Rights

You have a right not to receive discriminatory treatment by us for exercising any of your state’s consumer privacy laws. We will not discriminate against any consumer because such person exercised any of the consumer's rights under these privacy laws, including, but not limited to: Denying goods or services. Charging different prices or rates for goods and services, including through the use of discounts or other benefits or imposing penalties. Providing a different level or quality of goods or services. Suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services.

J. Your Right to Appeal

If we refuse to take action on any of the above rights, consumers who are residents of the states of Colorado, Connecticut, Montana, Oregon, Texas, and Virginia can appeal this decision by emailing us at [email protected]. We shall inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions, within 45 days of receipt of your appeal, if you are a resident of Oregon, and within 60 days of receipt of your appeal, if you are a resident of Colorado, Connecticut, Montana, Texas, or Virginia.

K. Authorized Agents

If you are a California resident and would like, you may designate an authorized agent to make a request under the CCPA on your behalf. If you are a Colorado, Connecticut, Montana, Oregon, or Texas resident, you may have a right to designate an authorized agent to make a request to opt out on your behalf. We will deny requests from agents that do not submit proof of authorization from you. To verify that an authorized agent has authority to act for you, we may require a copy of a power of attorney or require that you provide the authorized agent with written permission and verify your own identity with us.

L. Contact Information

To request additional information, or make any of the requests described above, you may contact us at [email protected] or by calling 888-813-0230.

Our Platforms are intended for individuals who reside in the United States of America. We make no representations that our Platforms are appropriate or available for use outside of the United States. If you are a resident of another country, or are accessing the website from outside of the United States, please note that you are transferring data to the United States of America, which does not have the same data protection laws as the European Union and other regions.

From time to time, we may update this Notice. If we make changes, we will revise the “Last Updated” date at the bottom of this Notice. We encourage you to review this Notice periodically to be sure you are aware of those changes. Changes will become effective as of the “Last Updated” date.

To exercise your rights or ask questions regarding this Notice, you may contact us at any of the following:

Mail: Attn: Privacy Officer, Everly Health, Inc., 823 Congress Avenue, 12th Floor, Austin, TX 78701

Email: [email protected]

Phone Number: 888-813-0230

Last Updated: May 2, 2024