Spruce Health, Inc. – Privacy Policy

Last Modified: 15 September 2022

IF YOU ARE (OR SOMEONE ELSE IS) EXPERIENCING A MEDICAL EMERGENCY, CALL 911 IMMEDIATELY.

PLEASE READ THIS PRIVACY POLICY CAREFULLY BEFORE USING OUR SERVICES, OUR WEBSITE, OR OUR MOBILE APPLICATION.

I. Introduction

This privacy policy (the "Privacy Policy") describes the types of information Spruce Health, Inc. ("Spruce", "we", "our", or "us") may collect from you or that you may provide when you use the Spruce website or application (the "Platform"), whether accessed via mobile application or website. This Privacy Policy also describes our practices for collecting, using, maintaining, protecting, and disclosing that information. This Privacy Policy does not apply to any website or application operated by third parties. Use of the Platform is governed by this Privacy Policy and our Terms of Service (for users of the Spruce website: https://www.sprucehealth.com/terms-website, for organizations using the Spruce application: https://www.sprucehealth.com/terms-organizations, and for patients using the Spruce application: https://www.sprucehealth.com/terms-patients). This Privacy Policy is incorporated into our Terms of Service. All capitalized terms used in this Privacy Policy but not defined herein have the meanings assigned to them in the Terms of Service. By accessing or using the Platform, you acknowledge that you have read, understood, and agreed to be legally bound by and comply with this Privacy Policy and our Terms of Service. If any term in this Privacy Policy is unacceptable to you, please do not use the Platform or provide any Personal Information (defined below). This Privacy Policy may change from time to time (see Revisions to Our Privacy Policy below) and your use of the Platform after we make changes is deemed to be acceptance of those changes, so please check this Privacy Policy periodically for updates.

This Privacy Policy does not apply to information collected by us offline or through any other means, or by any third party, including through any application or content that may link to or be accessible from or on the Platform. Also, you may be subject to different privacy policies or terms of service for other websites or applications.

Spruce is committed to protecting your privacy. We provide this Privacy Policy to explain the type of information we collect and to inform you of the specific practices and guidelines that protect the security and confidentiality of Personal Information, including protected health information ("PHI") that individually identifies you or others and that is subject to the Health Information Portability and Accountability Act of 1996, as amended.

II. Information We Collect About You and How We Collect It

Information About You and Your Health Care Treatment and Payment

We collect several types of information from and about users of our Platform, including both health care providers and their patients, as applicable, such as:

We collect this information:

Information You Give to Us

The information we collect on or through our Platform may include:

Information We Collect About You

As with many other websites and applications, as you navigate through and interact with our Platform, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:

The information we collect automatically includes statistical data and may also include Personal Information. We may also maintain it or associate it with Personal Information you provide to us or that we collect in other ways or receive from third parties. It helps us to improve our Platform and to deliver a better and more personalized service, including by enabling us to:

As with many other websites and applications, our Platform may use "cookies" or other technologies to help us deliver content specific to your interests, to process your requests, and/or to analyze your visiting patterns. We may collect information about your visit, including: the domain from which you access the Internet; IP address; operating system and information about the device or browser used when visiting the Platform; date and time of your visit; content you visited; general location; and website (such as google.com or bing.com) and website referral source (email notice or social media site) that connected you to the Platform. Our Platform uses two types of cookies: single-session (temporary) and multi-session (persistent). Temporary cookies last only as long as your web browser is open and are used for technical purposes, such as enabling better navigation through our Platform. Once you close your browser, the cookie disappears. Persistent cookies are stored on your computer for longer periods and are used for purposes including tracking the number of unique visitors to our Platform and information such as the number of views a page gets, how much time a user spends on a page, and other pertinent web statistics. Cookies, by themselves, will not be used by Spruce to disclose your individual identity. This information identifies your browser, but not you, to our servers when you use the Platform. We may also collect data by using "pixel tags," "web beacons," "clear GIFs," or similar means (collectively, "pixel tags") that allow us to know when you visit our Platform. Through pixel tags, we collect non-Personal Information or aggregate information that can be used to enhance your online experience and help us to understand traffic patterns.

Information We Receive From Other Sources

This is information we receive about you if you use any of the other websites we operate or other services we provide. We sometimes work with third parties, and they sometimes provide information about you. We obtain information from such third parties with whom we work to provide you with certain services (including, for example, sub-contractors, analytics providers, and search information providers, or third parties who share your information to provide your health care services, such as a medical provider including your information when they message or communicate with other medical providers or Spruce).

In addition, we may use third-party providers to serve or track interactions on other websites. You may link to or access our Platform using other third-party websites. Use of such third-party websites is subject to the terms of service and privacy policies of those third parties. Spruce does not control the use of this technology or the resulting information and is not responsible for any actions or policies of such third parties.

We may combine information we receive from other sources with information you give to us and information we collect about you. Depending on the types of information received, we will use the information received from other sources or the combined information for the purposes described in the "How We Use Your Information" section.

III. How We Use Your Information

We, or health care providers with respect to their patients, may use information collected about you, including Personal Information, in the following ways:

IV. Disclosure of Your Information

We, or health care providers with respect to their patients, may disclose Personal Information that we collect or you provide as described in this Privacy Policy as follows:

V. Choices About How We Use and Disclose Your Information

We strive to provide you with choices regarding the Personal Information you provide to us. We have created mechanisms to provide you with control over your information:

Tracking Technologies and Advertising

You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, please note that some parts of our Platform may then be inaccessible or may not function properly.

Do Not Track

We do not currently respond to "do not track" signals as we do not track our users across third-party websites.

Promotional Offers from Spruce, its affiliates, or third-party partners

If you do not wish to have your contact information used by Spruce to promote our own products or Services, you can unsubscribe by following the instructions at the bottom of any email you have received from us. If you are not able to unsubscribe through this method, please contact us and we can handle your request. You can also always exercise your right to ask us not to process your Personal Information for marketing purposes by contacting us at the address below.

VI. Data Security

We have implemented measures designed to reasonably secure your Personal Information from accidental loss and from unauthorized access, use, alteration, and disclosure.

Where we have given you (or where you have chosen) a password which enables you to access certain parts of our Platform, you are responsible for keeping this password confidential. We ask you not to share a password with anyone. The information you share in public areas may be viewed by any user of the Platform.

Unfortunately, the transmission of information via the Internet is not completely secure. Although we will do our best to protect your Personal Information, we cannot guarantee the security of your data transmitted to or from our Platform; any transmission is at your own risk.

When you use our Platform, there is a risk that any PHI will be stored unencrypted on your mobile device. We have implemented a variety of technical safeguards to make sure that PHI does not leak onto your mobile device, but we cannot guarantee that these safeguards will work as intended.

VII. Data Retention and Deletion

We retain the data we collect for different periods of time depending on what it is, how we use it, and what your stated preferences are:

When data is deleted, we follow a deletion process to make sure that your data is safely and completely removed from our servers, or retained only in anonymized form. We try to ensure that our services protect information from accidental or malicious deletion. Because of this, there may be delays between when the deletion process is initiated and when copies are deleted from our active and backup systems.

VIII. Third-Party Platforms

Our Platform may contain links or references to other websites outside of our control. Please be aware that this Privacy Policy does not apply to these websites. Spruce encourages you to read the privacy statements and terms and conditions of linked or referenced websites you enter. These third-party websites may send their own cookies and other tracking devices to you, log your IP address, and otherwise collect data or solicit Personal Information. SPRUCE DOES NOT CONTROL AND IS NOT RESPONSIBLE FOR WHAT THIRD PARTIES DO IN CONNECTION WITH THEIR WEBSITES, OR HOW THEY HANDLE YOUR PERSONAL INFORMATION. PLEASE EXERCISE CAUTION AND CONSULT THE PRIVACY POLICIES POSTED ON EACH THIRD-PARTY WEBSITE FOR FURTHER INFORMATION.

IX. Children Under the Age of 13

We will not intentionally collect any Personal Information from children under the age of 13 through our Platform without receiving parental or other legal guardian consent. If you think that we have collected Personal Information from a child under the age of 13 through our Platform, please contact us.

X. Revisions to Our Privacy Policy

We reserve the right to change this Privacy Policy at any time. It is our policy to post any changes we make to our Privacy Policy on this page. The date this Privacy Policy was last modified is identified at the top of the page. If we consider the changes to be significant, we will provide a more prominent notice (including, in certain instances, email notification of Privacy Policy changes). If you are using the Platform as part of or on behalf of an organization, we may, in our sole discretion, choose to provide this notice only to the administrator of your organization. You are responsible for periodically monitoring and reviewing any updates to the Privacy Policy. Your continued use of our Platform after such amendments will be deemed your acknowledgement of these changes to this Privacy Policy.

XII. Contact Information

If you have any questions or comments about this Privacy Policy and our privacy practices, please contact us as specified in our Terms of Service.