Privacy Policy

1. Introduction

This Privacy Policy (this “Privacy Policy”) explains how b.well Connected Health, Inc. (collectively, “b.well”, “we”, “us” or “our”) collects, creates, uses, processes and shares personally identifiable information in any website, mobile application, or interactive feature that links to this Privacy Policy, including our https://portal.icanbwell.com/ website and the mobile application (collectively, the “Application”).

The b.well Terms of Service (“Terms”) include defined terms that we use in this Privacy Policy.  While the Privacy Policy is a separate document, it should be read as part of the Terms.  Conflicts or inconsistencies between this Privacy Policy and the Terms will be interpreted with precedence given to the Privacy Policy with respect to its subject matter. This Privacy Policy also incorporates by this reference the b.well Cookies Policy, which discusses b.well’s use of data from your device and tracking technologies.

We may provide additional privacy notices that supplement or amend the disclosures contained in this Privacy Policy.  These notices are presented in the Application, and maintained under Additional Privacy Notices.

We encourage you to read this Privacy Policy from top to bottom, or to use internal links to read specific sections. We’ve included easy-to-read takeaways with each section.  Please take care not to rely on the section headings or takeaways: They are intended for reference and convenience only. They are not considered in how this Privacy Policy is to be interpreted.

2. Enterprise Sponsors and b.well’s ongoing HIPAA Responsibilities

Your b.well account and our Services may be paid for by an “Enterprise Sponsor” or “Sponsor”.  Your Sponsor may be a healthcare provider, health plan, retail pharmacy or an employer that sponsors a group benefit plan in which you participate.  These sponsors are required to protect any and all Health Data (defined more fully under Categories of Data We Collect) that identifies you personally under the Health Insurance Portability and Accountability Act of 1996, as amended, and its implementing regulations (“HIPAA”) and the Genetic Information Nondiscrimination Act.   This includes Health Data that they contribute to your b.well account, and Health Data from other sources that you choose to share with them.   As their “HIPAA business associate”, b.well is legally and contractually bound to implement measures that safeguard all your Personal Data and to maintain data practices that are at least as stringent as requirements specified by HIPAA, all other applicable laws and your Sponsor’s HIPAA Notice of Privacy Practices.

This Privacy Policy goes further than HIPAA to protect your privacy.  As described more fully under User-Directed Health Data Exchange, Sponsors may not access individually identifiable Health Data originating from other sources without your consent. 

If you do not know who your Sponsor is or would like to receive a copy of your Sponsor’s HIPAA Notice of Privacy Practices, please contact b.well Support through the Application or by emailing us at [email protected].

3. Categories of Data We Collect

We collect the Personal Data described more fully below.  “Personal Data” means any information that can be used to identify you or a member of your family or household.  We also use Personal Data to create Non-Personal Data for limited purposes, also defined below.  “Non-Personal Data” means information that does not identify you or members of your family or household personally, and cannot reasonably be used to re-identify you or members of your family or household after it has been removed of individual identifiers.  

Personal Data includes any data from whatever source and in whatever form or medium that is linked to your account and relates to the health status, the determinants of health, the availability or use of health care services or resources, or the payment or cost for health care by you or by others in your family (“Health Data”).  

All other Personal Data (“Other Personal Data”) contains information that is linked to your account, but does not contain Health Data.  For example, the information we use to authenticate your identity and authorize your access to your Personal Data (“Account Information”).

Some information we receive from you may either be Health Data or Other Personal Data depending on whether the information includes Health Data. “User Content” is content we receive from or about you that is  associated to your Account.  User Content includes self-reported data (“Self-Reported Data”); account credentials for patient portals and other third party applications that you connect to your Account;  machine identifiers that we collect with tracking technologies (“Usage Data”), and data that we access with your permission from your device, or which we transfer to your device (“Device Data”).  

For more information about Usage Data, see the b.well Cookie Policy (“Cookie Policy”).  It describes how tracking technologies can be used and machine identifiers can be collected by us and others, when you use the internet and/or your mobile device to access or use any of our Services.  It also describes some measures you can take to limit the ability of tracking technologies to collect Usage Data from you.   

For more information about Device Data, see the Google Play Supplement for Android Users.  It describes how b.well will provide a prominent in-app disclosure and request for permission to access Device Data, or to store Data from the Application to your device.  Examples are also included throughout this Privacy Policy.

Non-Personal Data takes different forms.  It may be aggregated and summarized for reporting purposes (“Summarized Data”).  If not aggregated, it may be stripped of personal identifiers and replaced by a pseudonym that does not include any individually identifiable data (“De-Identified Data”).  For some purposes, b.well retains control of the capacity to re-associate De-Identified Data to you.  In those cases, the De-Identified Data is called Pseudonymized Data.  When we and nobody else has reasonable means to re-associate De-Identified Data with your identity, we call that De-Identified Data “Anonymized Data”. 

The following chart summarizes the foregoing discussion of how we characterize data, and presents examples with sources of these different categories of Personal Data and Non-Personal Data.

4. Overview of the Purposes of Data Collection

b.well collects your Personal Data to improve your in-app experience, and to help Enterprise Sponsors deliver health-related programs, consistent with the obligations under HIPAA and applicable laws.  

One of the ways you can improve your in-app experience is by building Health Data connections.  Health Data connections are secure, trusted and private ways for you to exercise your right of access to your Health Data from your health plans and healthcare providers.  This is a right that is guaranteed to you under HIPAA.  

We encourage you to consolidate your Health Data from as many sources as possible, because it helps us deliver a more personalized in-app experience, and begin to eliminate friction in the way you access healthcare services.  Personalization, informed by your Health Data, is how we can offer solutions within the Application that helps you take action when you identify a healthcare need, and even let you know when there’s a care need in need of your attention.

5. How b.well Collects Data

We collect Personal Data from you when you interact with the Application.  

In addition, at your direction and with your consent, we can collect Health Data for use in the Application from: 

• Your Enterprise Sponsor
• The health plans that your Enterprise Sponsor sponsors, if you receive coverage or group benefits through them
• Any of your past or present health plans or health care providers, including labs and pharmacies (To learn more, read Data Connections); 
• Third party Health Data aggregation sites, including Blue Button 2.0 from CMS and Lighthouse from the U.S. Veterans Administration (for more information, read Data Connections
• Authorized suppliers of virtual health or wellness-related services 
• Developers of connected health apps, devices or services 
• Other users that you permit to act for you through our Health Circle feature
• Usage Data using tracking technologies, as described in the b.well Cookie Policy.

b.well also provides an in-app disclosure, and requests your consent, whenever it requests Device Data.  For example, at your direction and with your consent, b.well will:

• Collect the GPS location of your device to help you find providers, clinical lab sites or pharmacies near your current location
• Place booked appointments on a digital calendar available to you on your device
• Access the camera and photo album features of your device, so you can 
  • Add a picture of yourself in your account profile
  • Create or upload an image of your government-issued identification documentation, a copy of your COVID-19 vaccination status or evidence of health coverage, or 
  • Share a biometric scan of your face to confirm that a government-issued ID belongs to you

For more information read the Google Play Supplement for Android Users.

6. How b.well Uses Data

We use your Personal Data to:

• Match your Personal Data from multiple sources, and to correctly identify and link accounts and records that contain your Health Data.
• Verify your identity and authenticate access to your account (and if applicable, the account of another user)
• Facilitate your access to and use of the Application
• help you find healthcare providers, labs and pharmacies near you
• Save booked appointments on your choice of digital calendar, for your later reference
• Save a digital file locally on your device or other external storage service that your control, for your later reference (e.g. a government-issued ID, an appointment intake form or an insurance coverage card)
• Create Non-Personal Data, algorithms, data models and other works to support the business purposes described in this Privacy Policy
• Help Enterprise Sponsors perform population health activities, deliver personalized health management solutions and engage in other permitted treatment, payment, and healthcare operations activities under HIPAA, consistent with their respective HIPAA Notice of Privacy Practices and applicable workforce privacy laws
• Carry out our obligations arising from the terms you have accepted
• Personalize your experience in the Application
• Send you communications and provide you with customer service and technical support
• Evaluate service performance and user behavior
• Notify you of new features or service offerings 
• Notify you of other benefits that we can provide
• Bill and collect payment for clinical services, if applicable
• Take action that helps us to maintain the security of the Application and the privacy of your Personal Data, obey laws and help prevent fraud and abuse
• Update any hardware, software or other tools that we provide in conjunction with the Application
• Take actions to enforce our agreements and policies

We use Personal Data to create Non-Personal Data.  We use and share Non-Personal Data to support the legitimate business purposes described above for Personal Data.  We may use Non-Personal Data instead of Personal Data when Non-Personal Data allows us to reduce the risk of unauthorized access, use or sharing of Personal Data.  

We implement safeguards to reduce the risk that Non-Personal Data can be re-associated with you or members of your family or household, unless a legitimate legal basis exists for accessing and using the underlying Personal Data.  These safeguards include selective disclosure of Summarized Data, Pseudonymized Data or fully Anonymized Data based on the business purpose and the risk of re-identification for a given disclosure.

7. User-Directed Health Data Exchange

We do not sell or trade Personal Data to other third parties through the Application.  

The Application incorporates a permissions-based framework that is based on the principle of only sharing your Health Data with your informed, affirmative and voluntary consent.  “Informed” and “Affirmative” means that you (which may include your lawful representatives, health care agent, or legal guardian) have indicated consent by a deliberate act within the Application, and you have been presented with sufficient context to understand the scope of permission you are granting.  “Voluntary” means that your access to the Application is not conditioned upon your granting this consent.  If some features or benefits of the Application are not available without consent, we explain these limitations at the time your consent is requested.  

A. Sharing with your Enterprise Sponsor

If you use the Application to collect Health Data, you can decide whether to share this Health Data with your Enterprise Sponsor. We request this permission when you create a new Account.   

Sharing your individual-level Health Data helps your Enterprise Sponsor deliver more personalized and integrated outreach and programming. If you decide not to share your individual-level Health Data, your Enterprise Sponsor can still gain insights about programming delivered through the Application, but only using Summarized Data.  

For Employees and Dependents; keep in mind, Enterprise Sponsors that are your employer will never be granted access to your individual-level Health Data; just to Summarized Data or other forms of Non-Personal Data.  The only exception is if the Application collects Health Data for a justifiable workplace safety purpose.  In that case, the data practices are detailed under Additional Privacy Notices.

At any time, you can stop sharing individual-level Health Data with Enterprise Sponsors.  b.well will implement these changes within a reasonable time.  Keep in mind, we cannot retroactively apply these changes, but Health Data collected after implementing the change will not be shared with the Sponsor.  

B. Sharing with Other Users (Health Circle)

You can set permissions to automatically share some or all of your Health Data with family members, friends, professional caregivers or other individuals that you identify in your circle of support (your “Health Circle”).  You can also set permissions that allow another user to exercise account privileges on your behalf.    

Health Circle permissions can be set to “access” or “edit” privileges, according to your preferences.  Individuals invited to your Health Circle must first create an Account.  A user in your Health Circle with “access” privileges can view your Health Data, but cannot act through the Application on your behalf.  A user in with “edit” privileges can view your Health Data, and also perform some activities through the Application on your behalf.  

Be advised, Health Data can include genetic or family history information that is relevant to other family members.  While we do not require you to obtain consent from these family members before you share this data with others, you should only share access to your Account with individuals you trust, and you accept all responsibility for disclosures that are made to them.

Parents as Personal Representatives of Minors: In most cases, parents have access and edit privileges for Health Data of their minor children through Health Circle.   However, we retain discretion to deny a parent’s access to a minor’s Health Data according to applicable state law. Be advised: For minor children above the age of consent for specific clinical services under applicable state law, Health Data related to those services may not be accessible to parents.  Also, once minor children reach the age of majority, we automatically terminate a parent’s access to Health Data in their child’s account.  To regain access, the majority-age child can set permissions through Health Circle.

C. Sharing with Your Healthcare Practitioners

From your account, you can share a copy of your clinical data summary with the healthcare provider(s) you designate. 

D. Sharing with Your Personal or Legal Representative, Healthcare Agent or Legal Guardian

Although we strongly discourage sharing your credentials with someone, should you choose to do so, we deem these individuals to be acting with your consent.  

E. Sharing with Authorized Suppliers

You can set permissions to automatically share some or all of your Health Data with an authorized supplier.  At any time, you can revoke these sharing permissions, and we will implement the changes within a reasonable time. We will not be able to retroactively revoke access to Health Data that has already been shared with these suppliers. You will need to contact these suppliers directly concerning your rights with respect to that data.

8. When b.well May Disclose Data to Others

We consider your Personal Data and Non-Personal Data to be confidential.  We do not sell your Personal Data to third parties (other than in connection with a Business Transfer).  Nor do we knowingly share your Personal Data or Non-Personal Data with third parties for marketing purposes without your consent. 

There are limited occasions when b.well has a legitimate business purpose to disclose Personal Data or Non-Personal Data to third parties without your voluntary and affirmative in-app consent.  These occasions are described below.

A. Third Party Service Providers

To deliver the Application, we use a variety of third party service suppliers of technology, internet service hosting, payment processing, technical integration, marketing, analytics, customer service and support providers. We share the minimum necessary Personal Data and Non-Personal Data with these third parties for them to provide their services to us. These companies are acting on our behalf and are required, by contract with us, to keep Personal Data confidential, and are only authorized to use it for specified purposes, consistent with this Privacy Policy.

B. Law Enforcement and Regulatory Authorities

We do not disclose Personal Data to law enforcement or regulatory authorities unless we determine it is necessary to do so under law to comply with a valid court order, subpoena, search warrant, required by law, or in case of an emergency.  

C. Civil Proceedings

If b.well is a party to a legal proceeding with you, we may disclose your Personal Data to the court or arbitrator for purposes of resolving a civil dispute.  If b.well is not a party to a legal proceeding, we may be required by law to disclose your Personal Data pursuant to a valid subpoena, discovery request or other lawful process.  Even if additional protections are not required by applicable laws, we use our reasonable best efforts to obtain your authorization or seek a qualified protective order to protect Personal Data, before disclosing it in a civil proceeding.   We also use reasonable best efforts to limit disclosures of Personal Data to the minimum necessary to accomplish their intended purpose.  

D. Affiliates

b.well can share your Personal Data or Non-Personal Data with affiliated entities, as permitted by HIPAA and contract.  

E. Business Transfers

If we enter into a merger, acquisition, or the sale of all or part of our assets, your Personal Data and any Non-Personal Data derived from your Personal Data will likely be part of the assets transferred.  If this happens, we will attempt to notify you, using the e-mail address you have provided in your account profile.  We will use our reasonable best efforts to ensure that the successor entity maintains commitments that are consistent with this Privacy Policy; otherwise, we will disable your Account and dispose of your Personal Data, as specified under Data Retention and Account Changes.

F. Advertising Networks, Cross-Device Linking and Do Not Track Signals

Third parties, like advertising networks, web analytics companies and social media and networking platforms, may collect information about your online activities over time and across multiple web and mobile platforms.  Their use of Tracking Technologies when you access the Application may be used to predict or determine a likely association or relationship between two or more devices, or to help them serve you content on other websites and social media platforms.  We are not responsible for third party Tracking Technologies used by these third parties, or for the targeted advertisements they may cause to be served to you on other platforms.  We encourage you to check the privacy policies of these third parties to learn more about their privacy practices, and use browsers, broadband services and devices that you trust when you access and use the Application

9. Email, Text Messages and Push Notifications

Within the Application, you can choose to receive personalized communications via email, text message, and push notifications (“electronic communications”).  By default, we only include Account Information (user name, contact information) and generalized health information in these communications through the Application.  Within the Application, you can select your preferred communication methods.  You may be given the option to specify more Personal Data to be displayed.  

When selecting these preferences, keep in mind that electronic communications are not confidential or secure methods of communication.  Any Health Data, including PHI, that you accept through electronic communications may be at risk of exposure to unwanted and unauthorized parties, and also could be intercepted, read by a third party, and/or used for inappropriate purposes. In addition, once an electronic communication is received by you, someone may be able to access or view your screen on your phone, applications, digital devices, or email accounts and read the message. You understand that it is your responsibility to make sure that only authorized people are allowed to access your email, phone messages, cell phone, and digital devices. 

By accepting this Privacy Policy, you acknowledge your understanding of  these risks and give permission to b.well to communicate with you via unsecured electronic communications. You agree and accept full responsibility for disclosures of Personal Data to others due to your communications preferences.

If you correspond with us by e-mail or text, you should be aware that your transmission might not be secure from access by unauthorized parties. We have no liability for disclosure of your information due to errors or unauthorized acts of third parties during or after transmission.

10. Data Retention and Account Changes

Data Retention 

In general, we retain Personal Data and Non-Personal Data for as long as your account is active or as needed to provide you access to the Application.  We delete the Personal Data of dormant accounts after 10 years, and delete the Personal Data of permanently disabled (closed) accounts after 30 days.  We may retain Non-Personal Data indefinitely. 

These data retention policies may be overridden in our sole discretion if we are allowed or required to retain your Personal Data to comply with our legal and contractual obligations, to resolve disputes or to enforce our agreements with you.  For example, we cannot delete Health Data in the systems and services that support the Application when that Health Data originates with an Enterprise Sponsor or after you consent to share Health Data with an Enterprise Sponsor. Under these circumstances, your Health Data is retained as PHI, and is subject to the Enterprise Sponsor’s privacy policies and applicable data retention laws.  

Closing Your Account

You can close your account at any time and for any reason.  To close your account, please contact us through the Application under Support.  When you ask us to delete your account or Personal Data in full, we will first suspend your account for 30 days. During this suspense period, you will retain direct access to data in your account so you can securely download your Health Data.  You can also change your mind and request that your suspended account be re-activated.  After the suspense period expires without a request from you to reinstate your account, we permanently disable your account and delete your Personal Data as described above.  Permanently disabling your account means that you will no longer have access to your Personal Data through your account. 

Suspending or Terminating Services 

We may suspend or terminate your access to your account or to one or more features within the Application, at our sole discretion, at any time and without notice to you.  For example, we may suspend or permanently disable accounts that have not been authenticated, or which have not been accessed for a prolonged period of time.  Before permanently disabling your account, we will attempt to notify you using the e-mail address you have provided in your account profile. However, we are not obligated to notify you in advance in some cases (for example, if we have a reasonable belief that you have repeatedly and flagrantly violated the Terms, by court order, or if we have a reasonable suspicion that the privacy or confidentiality of others Personal Data may be compromised, or that your access poses a danger to other users). 

Be advised, given the complexity of our production environment and the security measures in place to safeguard the confidentiality, integrity and availability of all Personal Data, it is not feasible for us to destroy or erase all electronic copies of your Personal Data, particularly those created pursuant to our standard electronic backup and archival procedures. Moreover, you understand that the suspension or termination will not apply to any uses and releases of your Personal Data already made by b.well before the suspension or termination. However, the personnel with access to these retained copies is curtailed and monitored; access is limited to that reasonably necessary for the performance of their information technology duties (e.g., for purposes of system recovery) or legal duties. All Personal Data that is not destroyed as permitted remains subject to the Privacy Policy in effect at the time of your request for deletion, for as long as we retain your Personal Data.

11. Information Security

We implement industry-leading safeguards to protect your Personal Data from unauthorized access, disclosure, use, modification and loss.  Information security measures include: secure storage, encryption of digital records in transit and at rest, periodic log reviews, and system backups. We regularly review our data protection practices to consider appropriate new technological and other safeguards. Designated officers are responsible for ensuring that our data practices and security measures are consistent with this Privacy Policy, the Terms and applicable laws.  Our system of security and privacy controls are evaluated by independent assessors against industry-recognized information security frameworks.  We maintain a formal training program to ensure our workforce is familiar with common and emergent security and privacy risks, and their responsibilities for safeguarding consumer information and to report concerns to their immediate supervisors. Despite these and other measures, we cannot and do not guarantee that your Personal Data will be absolutely safe from interception or intrusion during transmission or while stored on our systems, or otherwise.  You acknowledge and agree that you create, collect and maintain your Personal Data in the Application at your own risk.

If we believe that the security of your Personal Data may have been compromised, we will notify you about the breach using the email provided in your Account Profile.  The notification will include the following information:  (a) A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known; (b) A description of the types of unsecured Health Data that were involved in the breach; (c) Steps individuals should take to protect themselves from potential harm resulting from the breach; (d) A brief description of what the entity that suffered the breach is doing to investigate the breach, to mitigate harm, and to protect against any further breaches; and (e) Contact procedures for individuals to ask questions or learn additional information, which shall include a toll-free telephone number, an email address, Web site, or postal address. 

We will provide this notice to you using the email address you provide to us in your Account Profile.  If you prefer that we notify you by first class mail, please let us know by contacting Support through the application or by emailing [email protected].  You can also request a print copy, at no charge, of any electronic notice that we may have sent to you about the incident.

12. Changes to this Privacy Policy

We reserve the right to change this Privacy Policy. When we change it, we will notify you in the application and by email to the address you have provided us in your Account.  These notifications will include a link to the updated Privacy Policy.  The updated Privacy Policy will indicate its effective date, and include links (i) to the privacy policy it is replacing and (ii) a summary of changes.  

To continue using the application, you will be required to accept the updated Privacy Policy.  If we make significant changes (for example, a new use or disclosure of Personal Data that we have already collected and stored), we will give you a reasonable amount of time to consider the changes before they become effective.  If you do not accept the updated Privacy Policy, you will be blocked from accessing your account.  If you are blocked from your account, please contact [email protected] for assistance with closing your account and getting a machine-readable copy of your Health Data.

Sometimes, we might supplement this Privacy Policy with an additional notice.  This allows us to add conditions for a specific feature in the Application without having to change the Privacy Policy.  These additional notices are published under Additional Privacy Notices.

13. Marketing to Minors

We do not knowingly market to or solicit Personal Data from children under the age of 13. We do not knowingly permit anyone under the age of 13 to have their own Account without first obtaining clear, verifiable consent from their parent or legal guardian.  If we obtain actual knowledge that we have collected Personal Data from a user under thirteen (13) years of age without their legal representative’s consent, we will use reasonable efforts to refrain from further using such Personal Data, and take steps to disable further use or access in a retrievable form.

14. International Data Transfers

The Application is hosted in the United States and does not transfer your Personal Data to regions outside the United States.  Third party service providers that support the Application may have personnel located outside of the United States, who may access Personal Data.  

If you access the Application from outside the United States, the laws of the applicable jurisdiction governing data collection and use may differ from United States law.  You also consent to the transfer of Personal Data to the United States for storage and processing.

15. Accessibility

We use editorial content and graphical design to help you understand our data practices in appropriate context within the application, and this Privacy Policy can be accessed from our website and the application. This Privacy Policy is also available to read in Spanish. If you still have a question, you can ask for further clarification by contacting b.well Support through the application or by emailing [email protected]. We do our best to acknowledge your request within 2 days, and respond within 30 days. Responses may be delayed if we cannot verify your identity or your legal authority to receive requested data. If you feel that any of your privacy concerns have not been addressed, please let us know by contacting Support within the application or by emailing [email protected].

16. Users in the European Economic Area: Your Privacy Rights

The Services that link to this Privacy Policy are intended for users located in the United States, and we only store Personal Data in our control in data centers located in the United States. For these reasons, we do not self-certify under the E.U.-U.S. Privacy Shield or the Swiss-U.S. Privacy Shield to comply with data protection requirements when transferring Personal Data from the European Economic Area (EEA) to the United States.

That said, if you create a b.well account and reside in the EEA, the data protections specified by the EEA’s General Data Protection Regulation (GDPR) may be applicable to you. In consequence, the following chart discloses our legal basis for collecting and using your Personal Data and the rights guaranteed to you as an EEA resident with respect to your Personal Data. As applicable, the chart includes links to relevant sections of this Privacy Policy that give effect to GDPR requirements. Be advised: The GDPR represents a minimum set of data protection standards that the individual nations within the EEA are required to implement: The actual laws of the nation of the EEA where you reside may confer additional rights to you, which are not included in this comparison chart.

1. Legal Basis for Processing

Our legal basis for collecting and using your Personal Data depends on the personal information concerned and the specific context in which we collect it. We always seek your explicit consent before collecting and using your Health Data for the Services. In some cases, we also may have an independent legal basis for collecting and using some or all of your Health Data. For example, we can collect and process Health Data on behalf of Enterprise Sponsors as their HIPAA business associate, including Health Data from third party sources that you consent to share with b.well and your Sponsor.

We collect and process Health Data and Other Personal Data for the purposes listed in How b.well Uses Data. These purposes are subject to overriding individual rights guaranteed under the GDPR, listed below. If we are unable to deliver Services and simultaneously help you exercise these rights to the fullest extent, we will let you know the reasons why. At that point, you can decide either to Close your b.well account, or withdraw your request to exercise these rights.

In some cases, we may also have a legal obligation to collect personal information from you or may otherwise need the personal information to protect your vital interests or those of another person. An example is if we need to verify your identity or authority to access Health Data to fulfill a data request.

If we ask you to provide personal information to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your personal information is mandatory or not (as well as of the possible consequences if you do not provide your personal information).

If we collect and use your personal information in reliance on our legitimate interests (or those of any third party), this interest will normally be to operate our Services, to communicate with you about our Services and for other legitimate commercial interests, like those listed in How b.well Uses Data. We may have other legitimate interests and if appropriate we will make clear to you at the relevant time what those legitimate interests are.
If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us by email to [email protected] subject line: GDPR Privacy.

1. Individual Rights of EEA Users

Access

You may request access to your Health Data through the application. For Other Personal Data, contact b.well Support through the application or by emailing [email protected].

Correction

You can correct inaccurate/incomplete Personal Data that originates in our Services by editing information in your Account Profile. Health Data that originates from other sources must be corrected at the source.

Object to, Limit, or Restrict Use of Data

You can ask us to stop using all or some of your Personal Data or to limit some or all of our uses of it by changing your data sharing permissions in the application. If you wish to limit or restrict use of your Personal Data further, we may not be able to deliver Services. If that is the case, your remaining option is to Close your b.well account.

Deletion

In certain circumstances, you can request a right “to be forgotten” (this is a right to have your information deleted or our use of your data restricted). We will honor these requests unless we have to retain this information to comply with a legal obligation or unless we have an overriding interest to retain it. Please read Data Retention and Account Changes.

Portability

In certain circumstances, you can exercise the right to data portability (this is a right to obtain a transferable version of your Personal Data to transfer to another provider). Please read User-Direct Health Data Exchange.

17. California Residents: Your California Privacy Rights

California Privacy Act Notice. Under California Civil Code Sections 1798.83-1798.83

This Privacy Policy must be made available in the languages we use in the ordinary course of disclosing contracts, disclaimers, and other information to consumers.

This Privacy Policy is available in Spanish. Please do not hesitate to contact b.well Support by email [email protected]. or telephone at (855) 972-9355 if you experience difficulty with accessing the application or our Services. We would like to learn from your feedback to make our Services more accessible.

California Consumer Privacy Act (CCPA) Notice. California Civil Code Sections 1798.100-1798.198 and their implementing regulations

This Privacy Policy must be made available in the languages we use in the ordinary course of disclosing contracts, disclaimers, and other information to consumers.

This Privacy Policy is available in Spanish. Please do not hesitate to contact b.well Support by email [email protected]. or telephone at (855) 972-9355 if you experience difficulty with accessing the application or our Services. We would like to learn from your feedback to make our Services more accessible.

This Privacy Policy must be accessible in print form

You should be able to print a copy of our Privacy Policy from most web browsers. You can also email or print the Privacy Policy from the application.

California residents can request a disclosure in machine-readable format of the categories and specific pieces of personally identifiable information that we have collected about you and your household during the 12 months preceding our receipt of a verifiable consumer request (limit two times per 12-month period). You can also ask where this information came from, and what we use it for.

Within the application, you can securely download a machine readable copy of your Health Data. To request a machine-readable copy of all categories and specific pieces of Personal Data about you and your household during the preceding 12 month period – and the sources of this Personal Data – please contact b.well Support through the application or by emailing [email protected].

California residents have the right to opt out of any sale of their personal information, unless the business does not sell personal information, and states in its privacy policy that it does not and will not sell personal information.

Also businesses subject to the CCPA that sell the personal information of California residents must disclose additional information about the personal information they’ve sold in the preceding 12 months.

b.well does not knowingly sell Personal Data to any third party. For this reason, provisions in the CCPA that give California residents to opt out of these sales, and receive an accounting of disclosures related to these sales, do not apply to b.well.

Businesses subject to the CCPA must give notice to California residents when they offer financial incentives – or vary their service terms – in exchange for selling their personal information.

b.well does not offer financial incentives or vary our service terms as a way to induce you or other users to permit us to sell your Personal Data.

Businesses subject to the CCPA must honor requests that enable California residents to request that their personal information be deleted.

See Data Retention and Account Changes.

18. Additional Privacy Notes

b.well gives you the option of creating a secure, authenticated Digital Identity.  Your Digital Identity is similar to sharing your government ID when you arrive for a clinical appointment or ask for a copy of your medical records, except that it is accomplished remotely.

Digital Identity is a critical component of protecting your privacy, because it provides strong proof that you are who you say you are.  That level of proof is important as more healthcare services become available online.  For example:

• Scheduling care and check in.  Using your Digital Identity can help when scheduling care and completing pre-visit forms.  
• Accessing digital health solutions. A Digital Identity can streamline your access to virtual or digital solutions through b.well.
• Requesting your health data. Strong proof of your Digital Identity is a requirement for requesting your Health Data through health information exchanges and networks. 

Here are the steps involved with creating a Digital Identity.

• We share these privacy practices with you before collecting any of the information we need to verify your identity.  
• We ask you to provide your cell phone number, social security number (if you have one), and a government-issued identification document with a picture on it (a “Government ID”).  If you have not yet given consent for b.well to use the camera or photo library feature of your device, we may ask you for permission to use these features, to collect an image of your Government ID.
• In addition, to make sure the Government ID is yours, we may ask you for permission to use the camera on your device, to collect a biometric scan of your face (“Biometric Information”).   
• We will ask you to affirm that the information you provide as part of collecting the Digital Identity is true and accurate, and only belongs to you.
• Once b.well collects this information, we encrypt it, together with some additional identity attributes already associated with your account (for example, your name, date of birth, and email address), and securely transmit it to b.well’s identity verification service provider (“IDP”).  The IDP is contractually obligated to maintain the security of the information we transmit, and only use the information to fulfill its duties as an IDP.
• The IDP authenticates the Government ID, affirms that the Government ID belongs to you, and confirms the accuracy of information contained on the Government ID.  If the IDP is able to verify your Digital Identity, b.well will let you know.

We will only use this information for the purposes of verifying your identity.

Be advised: While b.well applies reasonable and appropriate measures to safeguard the accuracy and integrity of its proofing process, and that of its IDP, no remote identity proofing solution is 100% guaranteed to deliver a Digital Identity, or to prevent the willful subversion of its proofing processes.  The warranty disclaimers, limitations of liability and indemnification provisions of b.well’s Terms of Service apply to your use of b.well’s digital identity proofing features.

Please contact b.well at [email protected] immediately if you have questions or concerns about your Digital Identity or the Digital Identity process.

Google has determined that b.well is subject to Google’s additional disclosure and consent requirements. As a result, we are required to provide the following information so we can make b.well available to you in the Google Play store.  

• The Application interacts with your device’s calendar, camera and external storage only if you choose to use these device features. b.well displays prominent in-app disclosures at the time access to these features is requested, about the reasons for accessing these device features. b.well cannot access these features without your affirmative, voluntary and informed consent.  
• By way of example, the Application might request access to a digital calendar to store an appointment reminder, access your device’s camera or photo library, or temporarily use external storage to edit an image  to (i) add a photo to your b.well profile, (ii) add documents to your b.well digital wallet (for example, your COVID-19 vaccination record, lab test results, or an insurance card) or (iii) verify your identity.  
• As another example, b.well might request your device’s location to help you search for care settings nearby or to confirm continued network connectivity.
• The Application was not created specifically for the COVID-19 pandemic. It existed before the COVID-19 pandemic to allow you to access and maintain your Health Data in one place. The Application can help you to access and manage COVID-19-related vaccination information, laboratory test results, and documents with illness-related information, and/or to store it in the Application for your personal convenience.  You choose if or how you want to access, display, use or share this information, just like you can make those decisions about Health Data relating to other conditions, services, tests or vaccinations.

19. Questions or Concerns

If you have a question about b.well, including our related data practices, you can use the Support feature within the application to send us an email, or start a chat or phone call during business hours, Monday through Friday (excluding U.S. federal holidays). Please allow 1-3 business days for us to acknowledge your request. We will work to promptly resolve your questions or concerns.

Concerns or complaints can also be directed to the b.well Privacy Officer in writing, as follows:

Chief Privacy Officer
b.well Connected Health, Inc.
145 West Ostend Avenue, Suite 300
Baltimore MD 21230

Government regulators offer consumer resources as well, including the U.S. Federal Trade Commission (https://consumer.ftc.gov) and the Office of Civil Rights at the U.S. Department of Health and Human Services (https://www.hhs.gov/hipaa/filing-a-complaint/).

20. Revision History

June 7, 2023 Revisions

• Added the Questions or Concerns section.
• Updated the Google Play Supplement for Android Users, explaining the purposes for requesting permissions to access device location services

November 16, 2022 Revisions

Updated Device Data under Categories of Data We Collect to specify that documents or media (image, audio, video) files may be uploaded by users, using the camera, photo library or read/write internal and/or external storage features of their device, and conforming changes to the Google Play Supplement for Android Users.

September 07, 2022 Revisions

Removed the COVID-19 Return to Work Supplement from Additional Privacy Notices. 

August 9, 2022 Revisions

• Updated §1 Intro`clarify that the b.well Cookie Policy is part of the Privacy Policy, and also updated the Key Takeaway
• Re-ordered the sections, by moving “Enterprise Sponsors and b.well’s ongoing HIPAA responsibilities” to §2, to emphasize key data practices and privacy principles
• Updated §3.a (Categories of Data) 
  • Updated the Key Takeaway to include a prominent disclosure that the application collects sensitive personal information, as required by Google Play policies.
  • Clarified that “Non-Personal Data” also refers to data that cannot be reasonably used to re-identify an individual, family or household to the data originally associated with that individual, family or household
  • Added Device Data as a sub-category of User Content
  • Clarified that User Content may be Health Data or Other Personal Data, and depends on  whether Health Data is included in User Content
  • Added examples to the chart to reflect the updated Data Category taxonomy, including Device Data
• Added §4 (Overview of the Purposes of Data Collection)
• Updated §5 (How b.well Collects Data)
  • Added explanations of how Device Data might be collected by the Application 
• Added §7 (User-Directed Health Data Exchange)
  • Consolidated disclosures from other sections under this heading
  • Disclosures requiring user consent are collected under this heading
• Updated §8 (When b.well May Disclose Data to Others)
  • Limited disclosures under this heading to examples when user consent will not be required
• Updated Additional Privacy Notices
  • Added Google Play Supplement for Android Users 
  • Added Digital Identity Supplement