Health Data and Measurement Policy

1. Who this policy covers

This policy is published by AnthologyRX LLC ("AnthologyRX", "we", "us"). It covers visitors to anthologyrx.com and anthologyrxplus.com and people who start our online assessment at join.anthologyrx.com. Clinical services are provided by an independent licensed provider network, Arora Health & Aesthetics, LLC. The assessment is operated on a platform provided by Bask Health ("Bask"), which acts as our service provider. Our website and measurement systems are hosted by Vercel, Inc., and our measurement records are stored with Neon (part of Databricks, Inc.). Contact for anything in this policy: privacy@anthologyrx.com.

Because we offer prescription treatments, information about which pages you read or how far you get through the assessment can reveal a health interest or care you are seeking. We treat every record described in this policy as consumer health data, and where it relates to a person who becomes a patient, as protected health information handled under our HIPAA Privacy Policy.

2. What is recorded, and from where

Always, because the service needs it (necessary functions). Security and fraud controls, the logs our hosting provider keeps to run the site, and a small cookie that remembers the choice you made on the measurement card. None of this is used to build a profile of your interests.

Only with your permission (internal measurement). When you choose Allow on the measurement card, we record:

• The pages you view on our websites, including treatment pages, and the plan or option selectors you change on them.
• Your interactions on those pages: links and buttons clicked, how far you scroll, which sections you spend time on, questions you open in an FAQ, and site search terms, which are reduced to a catalogue category before they are stored.
• The campaign labels on the link that brought you to us (for example the source and campaign name) and, if an advertising platform added a click reference to that link, that reference. These are used only inside our own systems.
• Your progress through the online assessment: which screens you reach, how long each is open, whether you go back, and where you stop. Your answers are not recorded by this measurement. They are handled by the assessment platform and the provider network under the notices shown there.
• A random identifier stored in a cookie on your browser, and a short-lived handoff reference that links your visit to the assessment and to any order you place, so that we can see which information and campaigns lead people to start care.
• Your device type, screen size, browser language, page load times and site errors, and the approximate region your connection appears to come from.
• A record of the choice you made on the card, when you made it, which version of this policy you saw, and whether your browser sent a Global Privacy Control signal.

Only if you switch it on (Google Analytics). Under Manage on the card you can separately allow Google Analytics. If you do, page views and clicks are sent to Google LLC with treatment names removed from page paths and titles. Google is an independent company with its own privacy policy. It is off unless you turn it on, and it stays off when your browser sends a Global Privacy Control signal.

We do not record what you type into forms, we do not record your screen, and we do not use fingerprinting. We do not collect precise geolocation.

3. What it is used for

• To understand which information and campaigns help people decide to use our service, and to report that internally.
• To find where people get stuck on the site or in the assessment and fix it.
• To measure how quickly reviews are completed and how often assessments lead to treatment, in aggregate.
• To run the necessary security and service functions described above.

We do not use these records to build advertising profiles, to target you with advertising elsewhere, or to make decisions about your care. Prescription orders are never reported to an advertising platform as a purchase signal.

4. Who receives it

Service providers acting for us. Vercel, Inc. (hosting and the functions that receive measurement records), Neon, part of Databricks, Inc. (database storage), and Bask Health (operation of the assessment). Each is bound by contract to use the records only to provide its service to us.

The assessment platform's own tools. Bask keeps the service and security logs it needs to run the assessment, and its platform may load analytics tools under Bask's own configuration. Those tools are described in the notices shown on the assessment itself. Our optional measurement on the assessment happens only if you allowed it on the card.

Independent recipients. Google LLC, only if you switch on Google Analytics under Manage. No other independent company receives these records.

We do not sell consumer health data. We do not share it for cross-context behavioral advertising. We do not disclose it to advertising platforms.

5. Your choices

Allowing and declining. The measurement card appears on your first visit. Allow and Decline are offered equally. Declining does not change your care, your prices, or your ability to start an assessment.

Withdrawing. Open Privacy choices in the footer of any page and choose Decline or change the switches. Withdrawal is as easy as allowing, and it takes effect immediately: future optional recording stops, pending sends are discarded, and your visit is no longer linked to a new assessment or order. Records already collected are kept only for the periods in section 7 and are then deleted; you can also ask us to delete them sooner (section 6).

Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as a refusal of sharing with independent recipients. Choosing Allow on the card does not override it. It does not by itself refuse our own internal measurement, which you control with the card.

Policy changes. If this policy changes in a way that affects what is recorded or who receives it, you will be asked again, and your earlier choice is treated as withdrawn until you answer.

6. Your rights and how to use them

You can ask us to confirm whether we hold consumer health data about you, to give you a copy, to tell you who received it, to delete it, and to withdraw any permission you gave. Write to privacy@anthologyrx.com.

Verifying a request. Measurement records are held against a random identifier, not your name. To find records from your browser, open Privacy choices in the footer and quote the reference shown there. If you are a patient and your request concerns your care records, we verify your identity through the patient account before responding.

Timing and appeals. We respond within 45 days, and may extend once by a further 45 days where reasonably necessary, telling you why. If we decline a request, you may appeal by replying to our response with the word "appeal"; we answer appeals within 45 days in writing with our reasons. If your appeal is denied you may contact the attorney general of your state; Washington residents may contact the Washington State Office of the Attorney General.

Deletion. Deletion covers the live records, queues, and our own backups within the periods our providers allow for backup expiry, and we instruct our service providers to delete their copies. Clinical records held under medical record retention duties are not measurement records and are governed by our Notice of Privacy Practices.

7. How long we keep it

• Page load times and site errors: 30 days.
• Detailed page and assessment activity: 90 days, after which only aggregate reports remain.
• The link between a visit and the assessment, where no order followed: 30 days.
• The link between a visit and an order that was placed: kept with the transaction record for as long as accounting and record-keeping duties require.
• Your recorded choice on the card: six years, as evidence of the permission you gave or withheld.
• Aggregate reports that no longer identify anyone: kept for planning and comparison over time.

8. How it is protected

Measurement records are stored in a restricted system that only named staff can reach, separate from clinical records. We do not store your IP address, your user agent string, your name or your email address in it; identifiers are random values or keyed hashes. These records may still be linked to your activity or orders by authorized systems, so we protect them as personal and health information rather than treating them as anonymous. Data travels over encrypted connections, our providers hold recognised security certifications, and access is logged.

9. Relationship to HIPAA and other notices

Your choice on the measurement card is not a HIPAA authorization and does not permit any use of your medical records beyond what our Notice of Privacy Practices describes. Where a specific use of your health information needs a signed authorization, we will ask for it separately and in writing.

10. Changes and contact

We will post changes to this policy here with a new effective date, and we will ask for your permission again where the change affects what is recorded or who receives it. Questions, requests and appeals: privacy@anthologyrx.com.