MHC Health Management Solutions, LLC
PRIVACY NOTICE
This document may be viewed, downloaded, or otherwise accessed by the User in the “Legal” section of the App, ensuring perpetual availability for the User's convenience and compliance purposes.
This Privacy Notice describes the information collection, use, retention and sharing practices of MHC Health Management Solutions, LLC and its subsidiaries, and affiliates (“Mercola”, “we”, “our”, or “us”) when you interact with us through Mercola’s mobile application, Mercola Health Coach (the “App”).
HIPAA AND HBNR
Although Mercola is not a covered entity or business associate, as defined under the Health Insurance Portability and Accountability Act of 1996, as amended, and implementing regulations (collectively, “HIPAA”), it may receive your protected health information from a health care provider that is a HIPAA covered entity, or its business associate, when you use the App to request laboratory testing services (“Lab Tests”). For information on how your health care provider creates, receives, maintains, and transmits your protected health information as a HIPAA covered entity, please refer to your health care provider's HIPAA Notice of Privacy Practices. This Privacy Notice does not apply to your protected health information.
Mercola is subject to the health breach notification rule adopted by the Federal Trade Commission (“FTC”) (the “HBNR”) as a vendor of personal health records (“PHR”) when it receives your PHR identifiable health information (“PHR Information”). The HBNR requires Mercola to provide citizens or residents of the United States with notice of any breach of security of PHR Information.
INFORMATION COLLECTION AND USE
Through your use of the App, we will collect personal information, which is information that identifies you or relates to you as an identifiable individual. We collect personal information directly from you and automatically as outlined below.
A. Information Collected Directly From You
Through your use of the App, we will collect your personal information. Except as otherwise indicated, the personal information we collect is limited to the minimum extent necessary to carry out the requested action. If you do not provide us with your personal information, we are not able to carry out the requested action. We collect personal information when you:
- Contact us: When you contact us, we will collect, from you, your personal identifiers (name and email address or telephone number) and any additional information you choose to include in your message. We use this information to respond to your questions or inquiries and to troubleshoot where necessary. If you contact us via telephone, subject to your consent, we will also collect, from you, your audio information (voice recording) for customer service and quality assurance purposes.
- Create an account: When you create an account to obtain Lab Tests (defined below) through the App, we will collect, from you, your personal identifiers (name, email address) and account login information (selected username, password, and security question answers). We use this personal information to create and manage your account, communicate with you regarding your account, and facilitate your access to services through the App, including laboratory testing services.
- Request Lab Tests: When you request Lab Tests through the App, we will collect, from you, your personal identifiers (date of birth, physical address, telephone number, email address). We use this information to facilitate (i) the delivery to you of items required to collect and send your specimen to the laboratory (the “Lab Kit”) and (ii) your access to the laboratory testing services offered by providers through the App. We also collect your Lab Test results by way of our home testing service provider so they can be transmitted from the laboratory service provider to your account.
- Verify your identity: When you verify your identity, subject to your consent, we will verify your identity using a facial recognition solution. Upon verifying your identity, subject to your consent, we will collect, from you, your sensitive identifiers (passport or government-issued identification), visual information (selfie image), and your biometric identifiers (face geometry). This information will be used solely for identity verification, fraud prevention, and security purposes. We will delete this information immediately after the verification is processed.
- Make a purchase: When you make a purchase, we will collect from you or from our third-party payment processor, Authorized.net, your sensitive financial information (credit/debit card number, expiration date, and CVV). We use this information to process your payment, fulfill and manage your purchase, and to conduct audits. Mercola only has access to card type and the last four digits of the card. Please see Authorized.net’s Privacy Notice (https://usa.visa.com/legal/global-privacy-notice.html) for information regarding Authorized.net’s collection, use, and sharing of personal information. For transparency, Authorized.net may share information with third parties for fraud related purposes.
- Register your Lab Kit: When you register your Lab Kit, we will collect, from you, your personal identifiers (name, date of birth, email address, telephone number, shipping address), commercial information (Lab Kit ID), protected classification information (gender), and your sensitive health information (blood sample). We will use this information to register your Lab Kit with our home testing service provider, as well as facilitate your access to the laboratory testing services offered by providers through the App.
- Complete our wellness intake questionnaire: In order to use the App to request the Lab Tests, you will need to complete our wellness intake questionnaire. When you complete our wellness intake questionnaire, we will collect, from you, your personal identifiers (date of birth), wellness information (wellness goals, selected responses to the questionnaire (e.g., energy levels, sleep habits, level of physical activity, dietary habits, alcohol consumption, smoker status, conditions, height, weight)), and your protected classification information (gender). We will use this information to help you navigate your wellness journey by delivering a more personalized wellness coaching experience upon interacting with Pax, our AI-enabled virtual health coach, or with a human wellness coach. For example, if you indicate you have low energy, Pax may offer nutritional guidance by suggesting that you increase your intake of certain foods believed to boost energy levels. Please note that the information we collect in connection with the wellness intake questionnaire is limited to the minimum extent necessary for us to provide the wellness services you have requested from us.
- Interact with our AI-enabled virtual health coach (Pax): When you interact with our AI-enabled virtual health coach, Pax, through the App, we will collect, from you, your internet or other electronic network activity information (location, IP address, device identifiers) and any additional information you choose to provide in the chat. If you choose to verbally interact with Pax, we will collect and record (subject to your consent) your audio information (voice recording) and any additional information you choose to communicate to Pax. We use this information to provide general wellness information in response to your questions or inquiries, improve our responses to future questions, and for quality and customer service purposes. If you ask Pax to provide general wellness information in connection with your Lab Test results, Pax will retrieve your Lab Test results from received from our home-testing service provider and stored in your profile on the App in order to provide general wellness information to help you navigate your wellness journey. If you are signed-in to your account upon interacting with Pax, whether transmitted orally or electronically, the information you provide to Pax will be stored together with your account profile. We do not use any personal information submitted to Pax, whether submitted orally or electronically, for purposes of training the AI. Pax’s responses are AI-generated and may contain errors. All content produced by Pax is for informational purposes only and should be reviewed for accuracy. Pax is not intended to be a substitute for professional medical advice, diagnosis, or treatment. Always consult a qualified health care provider before taking any action. MHC Health Management Solutions, LLC is not liable for any errors, inaccuracies, or omissions in content produced by Pax. See our Terms and Conditions for more information.
- Interact with wellness coaches: When you interact with wellness coaches through the App, we will collect, from you, your behavioral activity (physical activity, eating habits), mental health indicators (e.g. stress, burnout, social determinants), wellness information (wellness goals, diet preferences, sleep tracking data, heart rate, blood biometrics, blood pressure, and glucose level), and related information. We share this information with wellness coaches to facilitate the wellness-related services you have requested through the App.
- Subscribe to marketing emails: If you subscribe to our marketing emails, we will collect, from you, your email address to fulfill your request to receive information we feel may be of interest to you. You can unsubscribe at any time by clicked on the “unsubscribe” link in each email. However, we will continue to send you notifications necessary to the services, or requested products or services. We will share this information with our third party email marketing provider to facilitate the sending of the emails. Our communications contain tracking technologies (i.e. pixels), to analyze whether a predefined action took place by a recipient, such as opening our communications and other engagement metrics such as timestamps, delivery status, whether an email was forwarded, clicks within an email, as well as sender and recipient addresses to better adapt and distribute our communications. When you opt-in to our marketing communications, you will be automatically opted-in to the use of these technologies. You can avoid downloading the pixel by rejecting the download of images in the email.
We aggregate the data we collect for benchmarking purposes and for internal analytics and to improve the App. We maintain and use this data in deidentified form. We will not attempt to reidentify the data, unless it is necessary to determine whether our deidentification processes satisfy applicable data protection laws.
Mercola may also use the personal information collected for the above purposes to comply with the law and for other limited circumstances as described in HOW WE SHARE YOUR PERSONAL INFORMATION.
B. Information Collected Automatically
In addition to the personal information you provide directly to us, we also collect information from you automatically as you use the App via online tracking technologies (e.g. cookies). This includes the following internet or other electronic network activity information. We use essential, performance, and analytics cookies to collect your usage, device, and approximate location information when you interact with the App. We use this information to: (i) enhance user experience; (iii) conduct analytics to improve the App; (iv) prevent fraudulent use of the App; and (v) diagnose and repair App errors, and, in cases of abuse, track and mitigate the abuse.
DATA RETENTION
Unless otherwise stated in this Privacy Notice, we retain your personal information (i) for as long as you maintain an account with us, (ii) until we receive a valid request to delete the information, (iii) until we no longer need the information to fulfill the purposes for which we collected it, or (iv) until the information is no longer needed for a service provider or contractor’s operational purpose(s).
We use the following criteria to determine whether it remains reasonably necessary to retain your personal information for such purposes or a service provider’s or contractor’s operational purpose(s): (i) whether there is a retention period required by statute or regulations; (ii) the existence of actual or threatened litigation for which we are required to preserve the information; and (iii) the statutes of limitations for potential legal claims. When we determine that it is no longer reasonably necessary to retain your personal information for one or more disclosed operational purposes based on the above criteria, we will delete or anonymize your personal information.
HOW WE SHARE YOUR PERSONAL INFORMATION
A. General Sharing
Mercola shares personal information in the following instances:
- Within Mercola: We share your personal information within Mercola for the legitimate business purposes of efficiently and effectively providing our services, such as accounting and customer service support. Access to your personal information is limited to those on a need-to-know basis.
- With home/laboratory testing providers: We share personal information with home testing and laboratory testing providers to facilitate your access to services available to you through the App.
- In the event of a corporate reorganization: In the event that we enter into, or intend to enter into, a transaction that alters the structure of our organization, such as a reorganization, merger, acquisition, sale, joint venture, assignment, consolidation, transfer, change of control, or other disposition of all or any portion of our assets, we would share your personal information with third parties, including the buyer or target (and their agents and advisors) for the purpose of facilitating and completing the transaction. We would also share your personal information with third parties if we undergo bankruptcy or liquidation, in the course of such proceedings.
- For legal purposes: We share personal information where we are legally required to do so, such as in response to court orders, subpoenas, governmental/regulatory bodies, law enforcement or legal process, including for national security purposes. We may share your information with our legal advisors or auditors to establish, protect, or exercise our legal rights or as required to enforce our terms of service or other contracts or to defend against legal claims or demands. We also share this information with third parties as necessary to: detect, investigate, prevent, or take action against illegal activities, fraud, or situations involving potential threats to the rights, property, or personal safety of any person; to comply with the requirements of any applicable law; or to comply with our legal obligations.
- With your consent: Apart from the reasons identified above, we may request your permission to share your personal information for a specific purpose. We will notify you and request consent before you provide the personal information or before the personal information you have already provided is shared for such purpose. You may revoke your consent at any time by contacting us at [email protected].
B. Sharing in the Last Twelve (12) Months
In the preceding twelve (12) months, Mercola has disclosed the following categories of personal information for a business purpose to the following categories of third parties:
- We have disclosed your personal information to service providers that assist us in providing the App. These service providers assist us with the following: information technology (“IT”) support; website hosting; cloud storage; data analysis; customer service; email delivery; marketing; shipping; auditing; payment processing; identity verification and similar services.
- We have disclosed your internet or other electronic network activity information collected by cookies to our IT support to detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, and to identify and repair the App and platform errors.
- We have disclosed your internet or other electronic network activity information collected by cookies to our IT support to update, improve, and maintain the App.
Mercola may also share personal information that has been anonymized and aggregated (“De-Identified Information”) in public reports or for general research purposes and in research collaborations with third parties. Mercola may also use De-Identified Information for commercial collaborations with private companies for purposes such as product design or enhancement of programs we provide.
C. Sale of Personal Information
In the preceding twelve (12) months, Mercola has shared personal identifiers (email address) with its affiliates for marketing purposes. To opt out, you may submit your request to [email protected] or by calling toll-free 877-985-2695.
RIGHTS OF CALIFORNIA RESIDENTS
The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (collectively, “CPRA”) entitles California residents to certain rights. If our processing of your personal information is subject to the CPRA, you are entitled to the following rights:
- Right to Access/Know: You have the right to request what personal information we have collected, used, disclosed, and sold about you, unless doing so proves impossible or would involve disproportionate effort. You may only make a request for access twice within any 12-month period.
- Right to Deletion: You have the right to request the deletion of your personal information that we collect or maintain, subject to certain exceptions. For example, if we are required by law to retain the information that you are asking to be deleted, we would not be able to delete the information until we are legally permitted to delete it.
- Right to Correct: You have the right to correct inaccurate personal information that we collect or maintain.
- Right to Opt-Out of Sale/Sharing: You have the right to opt out of the sale or sharing of your personal information to third parties. However, Mercola neither sells nor shares personal information to third parties.
- Right to Non-Discrimination: You have the right to not receive discriminatory treatment in the processing of your information if you choose to exercise your privacy rights.
- Right to Limit Use of Sensitive Data: You have the right to limit the use of your sensitive personal information when such use goes beyond that which is necessary for providing the services. Sensitive information includes Social Security number, driver’s license number, biometric information, precise geolocation, and racial and ethnic origin. However, Mercola does not process personal information in a manner that gives rise to this right.
If you are a California resident and wish to exercise your rights under the CPRA, you may submit a request by contacting us toll-free at 877-985-2695 or by emailing us at [email protected].
You must provide us with sufficient information that allows us to reasonably verify you are the person about whom we collected the personal information and describe your request with sufficient detail to allow us to properly evaluate and respond to it. In doing so, we will take steps to verify your request by matching information provided by you with the information we have in our records.
Only you, or a person that you authorize to act on your behalf may make a request related to your personal information. If you are an authorized agent making a request on behalf of another individual, you must provide us with signed documentation that you are authorized to act on behalf of that individual.
Note that we will acknowledge receipt of your request within 10 days of receipt and will strive to process your request(s) within 45 days unless we need more time, in which case we will let you know if we need additional time.
RIGHTS OF NEVADA RESIDENTS
If you are a consumer in the State of Nevada, you may request to opt-out of the current or future sale of your personal information. We do not currently sell any of your personal information under Nevada law, nor do we plan to do so in the future. However, you can submit a request to opt-out of future sales by contacting us at [email protected]. Please include “Opt-Out Request Under Nevada Law” in the subject line of your message.
YOUR INFORMATION CHOICES
- Correct or view your personal information: You may access your Mercola account “Legal” tab to correct or view certain personal information of yours in our possession and which is associated with your profile.
- Location settings: You can prevent your mobile device from sharing your location data by adjusting the permissions on your mobile device or within the App.
- Marketing emails: You may opt-out of receiving marketing emails from us by clicking the “unsubscribe” link provided with each email. Please note that we will continue to send you emails necessary to the services or any assistance you request.
- Opt Out of Other Cookies: All session cookies are temporary and expire after you close your web browser. Persistent cookies can be removed by following your web browser’s directions. To find out how to see what cookies have been set on your computer or device, and how to reject and delete the cookies, please visit: https://www.aboutcookies.org/. Please note that each web browser is different. To find information relating to your browser, visit the browser developer’s website and mobile application. If you reset your web browser to refuse all cookies or to indicate when a cookie is being sent, some features of our website may not function properly. If you choose to opt out, we will place an "opt-out cookie" on your device. The "opt-out cookie" is browser specific and device specific and only lasts until cookies are cleared from your browser or device. The opt-out cookie will not work for essential cookies. If the cookie is removed or deleted, if you upgrade your browser or if you visit us from a different computer, you will need to return and update your preferences. By clicking on the “Opt-Out” links below, you will be directed to the respective third-party website where your computer will be scanned to determine who maintains cookies on you. At that time, you can either choose to opt out of all targeted advertising or you can choose to opt out of targeted advertising by selecting individual companies who maintain a cookie on your machine.
DO NOT TRACK
We do not support Do Not Track (DNT). Do Not Track is a preference you can set to inform websites and applications that you do not want to be tracked.
INFORMATION SECURITY
We implement and maintain reasonable security measures, such as access controls and encryption, to protect the personal information we collect and maintain. However, no security measure or modality of data transmission over the Internet is 100% secure and we are unable to guarantee the absolute security of the information we have collected from you.
AGE RESTRICTION
The App and the services offered thereon are not intended for individuals under the age of eighteen (18). If we learn that we have collected or received personal information from a child under the age of eighteen (18), we will delete that information. If you believe we might have information from or about a child under the age of eighteen (18), please contact us at [email protected].
CHANGES TO THIS PRIVACY NOTICE
We may change this Privacy Notice from time to time. We will post the changes to this page and will indicate the date the changes go into effect. We encourage you to review our Privacy Notice to stay informed. If we make changes that materially affect your privacy rights, we will notify you with a prominent post on our Services and obtain your consent, if required.
CONTACT
If you have any specific questions about this Privacy Notice, you can contact us via email or phone or by writing to us at the address below:
E-mail: [email protected]
Telephone: 877-985-2695