Rally Coach Program Consumer Health Data Privacy Notice

Real Appeal®, Live Vape Free™, Quit for Life®, and Wellness™ Coaching are business divisions of RVO Health, LLC.  This Consumer Health Data Privacy Policy (“Policy”) supplements the information contained in our general Privacy Policy and describes the types of consumer health data RVO Health collects about you through its operation of Real Appeal®, Live Vape Free™, Quit for Life®, and Wellness™ Coaching, how we use that information, who we disclose it to, and certain rights and options you have regarding your consumer health data. Please read this Policy carefully before providing us with your consumer health data so you understand our practices regarding your consumer health data.

This Policy is provided pursuant to the Washington My Health My Data Act (RCW 19.373.005 to 19.373.900) and similar U.S. laws. The laws of your state or country of residence may not regulate our handling of your consumer health data. As such, you may or may not be entitled to exercise or receive the rights and information described herein.

‍

Patient Records and Protected Health Information

This Policy does not apply to or describe how we use and disclose patients’ protected health information (“PHI”) under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). Please review our Notice of Privacy Practices for complete information on the use and release of PHI. Speak with your provider about any concerns you may have regarding your medical records.

‍

How We Collect Consumer Health Data

“Consumer health data” is any personal information that is linked or reasonably linkable to a “consumer” (as that term is defined in applicable laws, but often meaning a resident of the state to which the law pertains) and that identifies the consumer’s past, present, or future physical or mental health status.

RVO Health may collect the following categories of consumer health data:

• Individual health conditions, treatments, diseases, or diagnoses, such as the interest in or viewing of certain articles that relate to or are used in connection with the treatment of a specific health condition.
• Social, psychological, behavioral, and medical interventions, such as the interest in or receipt of certain preventative medications or health products.
• Diagnoses or diagnostic testing, treatment, or medication, such as the interest in or purchase of certain medication or diagnostic tests, search queries regarding specific diagnoses or treatment.
• Receipt of health-related surgeries and procedures or post-surgery or -procedure care, such as participating in forums to discuss operations and post-operative activities.
• Gender-affirming care information, such as the interest in and review of articles that relate to or are used in connection with such care.
• Reproductive or sexual health information, such as the interest in or use of reproductive or sexual health medications or products, including contraceptives.
• Bodily functions, vital signs, symptoms, or measurements, such as pulse and heart rate data, blood glucose data, blood oxygen levels data, and body temperature data that is collected using a personal device.
• Data that identifies a consumer seeking health care services, such as search queries to find or locate a medical doctor or concerning medical conditions or other health-related topics.
• Other identifiable information that would constitute an information-type described above but is derived or extrapolated from non-health data.

RVO Health collects such information from website and mobile application users directly when: (1) the user searches for certain types of articles or information on RVO Health’s websites or mobile applications, (2) creates and adds information to an account or profile, (3) purchases a subscription or other services from RVO Health, (4) fills out forms or surveys, or prompts features in our websites or mobile applications to function and report back certain information or take a certain action, or (5) interacts with our websites or mobile applications (i.e., through the use of various automatic tracking technologies that are deployed on our digital properties).

RVO Health also collects consumer health data from other sources, including: (1) a consumer’s healthcare or medical provider, when that provider is working with or using RVO Health to make certain of their services available, (2) other business operations and brands within the RVO Health family of brands, and (3) marketing vendors or similar companies that provide us with information about prospective or existing customers.

‍

How We Use Consumer Health Data

The above information is collected and used by RVO Health for the purposes of making our websites, mobile applications, and related services available to consumers. In some cases, collection or usage is necessary to provide the product or service that the consumer has requested.

RVO Health also collects and uses the above categories of consumer health data for the purposes of:

• Improving its services, including tailoring its platform to present relevant information to its users. For example, you may receive ads when using our websites and mobile applications that are generated using data about your previous interactions with our websites or mobile applications.
• Understanding and analyzing how users interact with our websites and mobile applications, including analyzing traffic and usage metrics, and how users search for, choose, and interact with various pages or features. For example, RVO Health may analyze webpage clicks to determine the best placement of a particular article or ad.
• Marketing RVO Health’s services to current, former, and potential users. For example, RVO Health may send you marketing communications that are generated using data about articles you have read on our websites or mobile applications.  
• Preventing and detecting fraud, financial crime, hacking activities, security breaches, and other unlawful activities in connection with our websites and mobile applications and our services. For example, RVO Health may use event data on our websites or mobile applications to ensure that you are a person and not a bot.
• Protecting RVO Health and/or its parent companies, affiliates, subsidiaries, retail partners, the general public, including investigating possible fraud, theft, violations of our terms, misuses of our websites or mobile applications and/or attempts to harm RVO Health and/or its parent companies, affiliates, subsidiaries, organizational partners, or any individual. For example, RVO Health may provide the details of a user’s account in connection with investigating potential fraud.

‍

How We Share Your Consumer Health Data

RVO Health may disclose or transfer your consumer health data to those of its vendors or service providers that process the information on RVO Health’s behalf (e.g., our website hosting providers, email and communications vendors, data storage providers, etc.).

Additionally, RVO Health shares consumer health data with the following categories of “third parties” (as that term is defined by applicable laws, but often meaning a party who is not a processor acting on RVO Health’s behalf):  

• As permitted by applicable law, and with your consent (to the extent required), marketing and advertising vendors, such as those that supply the pixels, cookies, tags or other tracking technologies used on RVO Health’s websites or mobile applications to collect real-time event and other usage data from and about users of RVO Health’s websites or mobile applications for their own purposes (including to engage in targeted advertising on behalf of themselves or others).
• As permitted by applicable law, and with your consent (to the extent required), our affiliates, subsidiaries, or related entities for advertising and marketing purposes.
• Parties to a corporate transaction or proceeding, such as in the event of a merger, financing, acquisition, bankruptcy, dissolution, or a transfer, divestiture, or sale of all or a portion of our business or assets of which consumer health data is among the assets being disclosed or transferred.
• Law enforcement or other government agencies when we believe doing so is necessary to comply with applicable law or respond to a valid legal process.  

As a reminder, RVO Health owns and operates other business divisions that conduct their operations under other brands. You can learn more about each of our brands here: https://www.rvohealth.com/brands. RVO Health makes your consumer health data available to each of its business divisions and operating brands, including the consumer health data that is the subject of this Policy.

‍

How You Can Exercise Your Rights

Subject to certain exceptions, the laws of your state of residence may afford you the right to:  

1. Confirm whether RVO Health is collecting, sharing, or selling your consumer health data and to access such data, including a list of all third parties and affiliates with whom RVO Health has shared or sold the consumer health data.
2. Withdraw consent from the collection or sharing of your consumer health data.
3. Delete your consumer health data.

Where the collection or use of your consumer health data is necessary for us to provide a product or service you have requested from us, we may collect and use your consumer health data without your consent. If we collect or use your consumer health data for other purposes, however, we will obtain your consent for such processing, where the law requires us to do so. Where consent is the basis for processing your consumer health data and where law permits, you have the right to withdraw your consent to such processing.

To exercise the rights described above, you may submit your request by contacting RVO Health at legal@rvohealth.com.  

Note, RVO Health may deny your request if RVO Health is unable to authenticate you or your request using commercially reasonable efforts and may request that you provide additional information for authentication purposes. If RVO Health can authenticate your request, it will comply with the request within 45 days of receipt of the request; provided that, RVO Health may extend its response period by an additional 45 days when reasonably necessary, in which case you shall be notified of the extension.

If your request to exercise a right that you have under applicable laws is denied, you may appeal that decision by contacting us at legal@rvohealth.com. If your appeal is unsuccessful, you can raise a concern or lodge a complaint with your local attorney general (e.g., for Washington residents, the Washington State Attorney General at www.atg.wa.gov/file-complaint).

‍

Changes to this Policy

RVO Health will update this Policy periodically to reflect changes to our privacy practices. Any changes are effective as of the “Last Updated” date above.

‍

Contact Us

If you have questions about this Policy or our privacy practices, or wish to make a request regarding your consumer health data, please contact us at legal@rvohealth.com.

‍