Privacy Policy

Smart Health Network PBC ("Smart Health Network," "we," "us," or "our") operates smarthealthnetwork.org and related websites (the "Site"). This Privacy Policy explains what information we collect through the Site, how we use and share it, and the choices and rights you have.

What this policy covers — and what it doesn't

This policy covers information you provide through this Site and information collected automatically when you use it — for example, when you join the waiting list, request sandbox access, or contact us.

This policy does not cover the health information that flows through the Smart Health Network itself. By design, the network routes requests and responses between the organizations that hold patient data; it does not build or keep a central copy of anyone's medical records. Information that moves through the network is governed by the agreements with participating organizations, the Smart Health Trust Patient-Facing Terms, and applicable health-privacy laws (including HIPAA where it applies) — not by this policy.

Information we collect

Information you provide. When you submit a form or otherwise contact us, we collect the information you choose to provide — typically your name, work email address, organization, role, state, and the contents of your message or request.

Information collected automatically. When you use the Site, we and our service providers may automatically collect basic technical information your browser or device sends, such as IP address, device and browser type, pages viewed, referring pages, and date/time of access. We collect this through cookies and similar technologies (see "Cookies and analytics").

We do not ask for, and you should not submit, sensitive personal information or any patient health information through this Site.

How we use information

We use the information we collect to:

• respond to your inquiry and communicate with you;
• evaluate, provision, and administer sandbox or early-access requests;
• send you information about Smart Health Network that you have asked to receive (you can opt out at any time);
• operate, secure, maintain, and improve the Site; and
• comply with law and protect our legal rights, our users, and the public.

Cookies and analytics

We use strictly necessary cookies to operate and secure the Site, and limited first-party analytics to understand how the Site is used so we can improve it. We do not use third-party advertising cookies, and we do not use the Site to build advertising profiles.

You can control cookies through your browser settings, and where optional analytics are used you may decline them. We honor recognized opt-out preference signals, including the Global Privacy Control (GPC), where required by applicable law.

What we do not do

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under applicable law. We do not use your information for third-party advertising.

Who we share information with

We share information only:

• with service providers that help us operate the Site and our communications (such as website hosting, email, and analytics providers), who are bound by contract to protect it and to use it only to provide services to us;
• when required or permitted by law, or to protect the rights, safety, and security of Smart Health Network, our users, or the public; and
• in connection with a business transfer (such as a merger, financing, or sale of assets), subject to this policy.

We do not share your information with third parties for their own marketing.

How long we keep information

We keep personal information only as long as needed for the purposes described in this policy — for example, to respond to and follow up on your inquiry, to administer sandbox access, and to keep records we are required to keep — and then delete or de-identify it. The specific period depends on the type of information and our legal and operational needs.

How we protect information

We maintain reasonable administrative, technical, and physical safeguards designed to protect the information we collect. No website or method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

Your privacy rights (U.S. state laws)

Depending on where you live, U.S. state privacy laws (including the California Consumer Privacy Act, as amended by the CPRA, and comparable laws in states such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana) may give you the right to:

• know and access the personal information we have collected about you;
• correct inaccurate personal information;
• delete personal information you have provided;
• obtain a portable copy of your personal information;
• opt out of the sale of personal information and of sharing/processing for targeted (cross-context behavioral) advertising — which we do not do; and
• not be discriminated against for exercising these rights.

We do not sell personal information, do not share it for cross-context behavioral advertising, and do not use it to make decisions that produce legal or similarly significant effects. We do not collect "sensitive personal information" through the Site.

How to exercise your rights. Email privacy@smarthealthnetwork.org. We will verify your request using the information we have (for example, by confirming control of the email address associated with your submission) and respond within the time required by applicable law (generally within 45 days, with an extension where permitted). You may use an authorized agent to submit a request on your behalf; we may ask the agent for proof of authorization and may ask you to verify your identity directly.

Appeals. If we decline your request, you may appeal by replying to our response or emailing privacy@smarthealthnetwork.org with "Appeal" in the subject line. We will respond to your appeal within the time required by applicable law and, where required, tell you how to contact your state attorney general if you disagree with the outcome.

California "Shine the Light." California residents may request information about disclosures of personal information to third parties for those third parties' direct marketing purposes. We do not make such disclosures.

International users

The Site is operated from the United States and is intended primarily for users in the United States. If you access the Site from outside the United States, your information will be processed in the United States.

If you are in the European Economic Area or the United Kingdom, we process your personal information on the basis of your consent, our legitimate interest in operating and securing the Site and responding to your inquiries, and, where applicable, steps taken at your request before entering into an arrangement with us. You have the rights to access, correct, delete, restrict, and port your personal information and to object to processing; where transfers occur, we use appropriate safeguards. To exercise these rights or ask questions, email privacy@smarthealthnetwork.org.

Children

The Site is intended for businesses and professionals and is not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us information, email privacy@smarthealthnetwork.org and we will delete it.

Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date above and, for material changes, provide a more prominent notice. Your continued use of the Site after an update means you accept the updated policy.

Contact us

Questions or requests about this policy or your information: privacy@smarthealthnetwork.org

Smart Health Network PBC, a Delaware public benefit corporation.