Vitals Privacy Supplement

This PRIVACY SUPPLEMENT supplements the information contained in the Privacy Policy of Vitals Consumer Services, LLC and our related, affiliated and/or subsidiary companies (collectively, “we”, “us”, or “our”) and applies solely to our users who are residents of U.S. states, commonwealths or territories with applicable data privacy laws (“consumers” or “you”) in relation to your use of our products and services (collectively, the “Products and Services”), which are made available to you through a variety of platforms, including, but not limited to, www.vitals.com (the "Website") and our mobile app, which is accessible through tablets, cell phones, and other devices (the “App”). The Website and the App are collectively referred to as the “Platform”.

We adopt this notice to comply with the requirements of certain applicable U.S. data privacy laws and regulations, including the California Consumer Privacy Act, the California Privacy Rights Act and other California privacy laws, Virginia Consumer Data Protection Act, the Colorado Privacy Act, as well as the Connecticut Act Concerning Personal Data Privacy and Online Monitoring (collectively, “Applicable Data Privacy Laws”). Any terms defined in our Privacy Policy or in the Applicable Data Privacy Laws have the same meaning when used in this notice.

INFORMATION WE COLLECT

Certain information that we collect identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (“personal information”).

We have collected personal information from the following categories of information from consumers within the last twelve (12) months:

Personal information may not include:

• Publicly available information from government records.
• De-identified or aggregated consumer information.
  • Information included in categories F, G and K may be collected and used in a de-identified and/or aggregated manner.
• Information excluded, such as:
  • Protected health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the California Confidentiality of Medical Information Act (CMIA) and the Health Information Technology for Economic and Clinical Health Act (HITECH), clinical trial data, or biomedical research study covered by the Federal Policy for the Protection of Human Subjects (Common Rule) or the human subject protection requirements of the United States Food and Drug Administration (FDA); or
  • Personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), the Farm Credit Act of 1971, and the Driver’s Privacy Protection Act of 1994.
  • Information and documents created for purposes of the Health Care Quality Improvement Act of 1986.

Sensitive Personal Information

Sensitive personal information may include (1) personal information that reveals (A) a social security, driver’s license, state identification card, or passport number; (B) account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; (C) precise geolocation; (D) racial or ethnic origin, immigration status, religious or philosophical beliefs, or union membership; (E) the contents of mail, email, and text messages except where we are the intended recipient of the communication; (F) genetic data; (2) the processing of biometric or genetic information for the purpose of uniquely identifying a consumer; (3) personal information collected and analyzed concerning a consumer’s health or diagnosis; (4) personal information collected and analyzed concerning a consumer’s sex life or sexual orientation; and (5) personal information collected from a known child.

We do not collect and store sensitive personal information.

CATEGORIES OF SOURCES FROM WHICH INFORMATION IS COLLECTED.

As described in our Privacy Policy, we may obtain the categories of personal information listed above from the following categories of sources:

• Directly from you, such as when you interact with Vitals.
• Directly and indirectly from your activity on our Website as described herein.
• From third parties that interact with us in connection with providing the Products and Services.

PRODUCTS AND SERVICES

Vitals may obtain, collect, retain, store or otherwise maintain your personal information from the following sources:

• Your Vitals account: this information may include, for example, information you provide to Vitals through your creation, registration and maintenance of a user account on the Platform (“Registration Information”).
• Purchase of Products and Services: to the extent that we offer Products and Services for purchase on the Platform, we may request that you provide personal information, a credit card account number and/or or other payment account information in order for you to access or purchase those Products and Services.
• Other information you provide to Vitals: Some of the Products and Services allow or require you to provide personal information, such as your Healthcare Providers, pharmacies, insurance information, emergency contact information, personal health information, member number, group number and related information. Personal information that you may store through the App by means of taking a photograph with your mobile device (for example, taking a photograph of your health insurance card) may be stored on your mobile device. Accordingly, the safety, security and privacy of your mobile device and the information and photographs that you store on it are your responsibility and not the responsibility of Vitals.
• Interactive Products and Services: some of the Products and Services allow you to interact with Healthcare Providers through the Platform. These interactive Products and Services include, but are not limited to, scheduling appointments with Healthcare Providers. In order to provide you with these interactive Products and Services, we may ask you to provide personal information (such as the medical reasons for your scheduling the appointment). You understand and agree that Vitals may use and/or disclose such personal information to Healthcare Providers that you have selected in connection with providing You with the requested interactive Products and Services.
• Your responses to communications from Vitals: From time to time, Vitals may communicate with you through postal mail, email, fax, telephone, or other forms of electronic communications regarding your Vitals account on the Platform, inquiries you may make to Vitals customer service, the Products and Services and new Products and Services. If you respond to these communications, your responses may also contain personal information.
• Online Appointments: You may schedule an online appointment with a Healthcare Provider through the Platform (“OLA”). In order to do so, You must submit the requested appointment information, including but not limited to your personal information, dates, times, reasons of visit, and any other health-related information (“OLA Information”). We are committed to user privacy and have in place reasonable and appropriate data security policies and measures to protect the personal information, and ensure that users control access to their information. Vitals may engage third party subcontractors, such as Cadit, (“Third Party”) to process your OLA request. You acknowledge and agree that any information that you submit in connection with such OLA request will be submitted to such Third Party and will be subject to the privacy policy and terms of use of such Third Party. We urge you to review the Third Party privacy policies and terms of use carefully. To the extent Vitals engages such Third Parties, Vitals shall ensure that any such Third Party to whom it provides personal information agrees to the same restrictions and conditions that apply to Vitals with respect to such personal information. Please be advised that Cadit may share certain personal information submitted to Cadit with Vitals to create Vitals user accounts and personalize the search experience on our Platform. Vitals does not have, and does not assume, any responsibility for the confidentiality of communications between you and your Healthcare Provider, other than those expressly stated in our Privacy Policy and Terms of Use, or any responsibility for a violation of state or federal laws by your Healthcare Provider. When you use the OLA service, you may automatically receive administrative emails from us. You cannot opt-out of receiving administrative emails sent by us.

You can decline to provide your personal information to us by not engaging in the activities described above, such as by not registering or creating a Vitals account on the Platform or by not using the Products and Services. If you decline to submit personal information, Vitals may not be able to or may choose not to provide to you some or all of its Products and Services. Accordingly, you can determine to a large extent what personal information you wish to provide to us.

ACTIVITY AND COOKIE DATA

Vitals also collects non-personally identifiable server-log information relating to our users. This information may include, but is not limited to, (i) your Vitals account activity, including storage usage, number of log-ins, data displayed or selected, including user interface elements, links, etc, and (ii) your web or mobile application request, Internet Protocol address (“IP address”), the location of your computer (through the IP address), browser type, browser language, browser programming language, computer or mobile device type, the date and time of your request, date and time of access, and one or more cookies that may uniquely identify your browser and referrer Uniform Resource Locator (“URL”). None of this information alone enables Vitals to personally identify or contact you.

When you visit the Platform, we send to your computer and/or your mobile device (such as a smartphone), one or more cookies, which are small files containing a string of characters. A cookie, among other things, uniquely identifies your browser or your mobile device, as applicable, and allows Vitals to “remember” your mobile device and/or your activities on the Platform. Vitals uses cookies to uniquely identify computers and mobile devices of users of the Platform. No personal information is collected or stored in these cookies. We use cookies to improve the quality of the Products and Services. Most browsers and mobile devices are initially set up to accept cookies but you can reset your browser or the settings on your mobile device to reject all cookies. Some browsers also can be set to indicate when a cookie is being sent. Please note that some features of our Platform may not function properly, if your computer or mobile device is set to reject all cookies.

USE OF PERSONAL INFORMATION.

Your personal information included in each of categories A, B, F, G and K described above may be used for the following business purposes:

• Providing the Platform and the Products and Services to you, including but not limited to, the processing, formatting and displaying of your Information, customized content and the delivery of customized Products and Services to you;
• Auditing, research and analysis in order to troubleshoot, maintain, protect and improve the Products and Services and the Platform;
• Ensuring the technical functioning of Vitals’ network and the Platform, including creating and maintaining backups or other archival copies of personal information and other related data;
• Developing and offering Products and Services, which may include use of your information by Vitals in connection with developing and offering to you Products and Services such as awards, newsletters regarding specific health conditions, health education and/or disease prevention), which Products and Services may be supported by third-party advertising from Healthcare Providers and manufacturers, retailers and/or other service providers within the healthcare industry (e.g., pharmaceutical and/or medical device manufacturers, suppliers, or retailers). Vitals will communicate about these Products and Services to you through postal mail, email, fax, telephone, text message, or other forms of electronic communications; and to personalize your search experience on the Platform.

In addition, we may use personal information about you for other purposes that are disclosed to you at the time we collect the information and/or with your consent.

SHARING YOUR PERSONAL INFORMATION

PERSONAL INFORMATION DISCLOSED FOR A BUSINESS PURPOSE

We may share your information with our subsidiaries, affiliates and companies acquired by or merged with us and our affiliates.

We may disclose your registration information to certain third parties in connection with the various programs, tools and services that are provided through the Platform.

We may share your personal information with employees, contractors and agents of Vitals who need to know such personal information for performing their duties with respect to the purposes set forth in this section. These individuals are bound by confidentiality obligations and may be subject to discipline, including termination, if they fail to meet these obligations.

We may employ third parties to perform services on our behalf. Examples may include services to improve our Platform, marketing, advertising, and promotional efforts and to facilitate transactions, includes processing orders by credit card. These third parties will have access to your personal information only as necessary to perform their services, and they may not use your personal information for any other purpose.

We may disclose your personal information to government authorities and to other third parties when compelled to do so by government authorities, at our discretion, or otherwise as required by law, including but not limited to in response to court orders and subpoenas. We also may disclose your personal information when we have reason to believe that someone is or may be causing injury to or interference with our rights or property, other users of the Platform, or anyone else that could be harmed by such activities.

In the preceding twelve (12) months, we have disclosed your personal information included in each of categories A, B, F, G and K for a business purpose.

We disclose your personal information for a business purpose to the following categories of third parties: (i) service providers, and (ii) third parties to whom you or your agents authorize us to disclose your personal information in connection with the Services.

PERSONAL INFORMATION “SOLD” TO OR “SHARED” WITH THIRD PARTIES

Your registration information may be provided to third party advertisers and retailers, and their affiliates, to offer goods and services that they believe you may be interested in.

Vitals permits third-party advertising companies and networks to place paid advertisements that may be visible when you visit, use and/or access the Platform. These companies and networks include, among others, third party ad servers, ad agencies, advertising networks, advertising technology vendors, and research firms. These third party ad servers and advertisers may use cookies, pixel trackers, or other internet technology to improve the effectiveness and targeting of advertisements to you within the Platform and any other place where that third-party is serving advertisements. The Platform does not have access to, nor control over, advertisers’ or ad service providers’ cookies or how they may be used or how they were collected. In many cases, this information could be used to show you ads based on your interests on other websites.

In the preceding twelve (12) months, we have made available your personal information included in category A, B and D to third parties for advertising services described herein.

We do not “sell” or “share” the personal information of consumers that we know are minors under 16 years of age without affirmative authorization as required under the Applicable Data Privacy Laws.

Retention of Personal Information

If you have an account on the WebMD Sites, we may retain your personal information as long as your account is active in order to provide the Services to you and for a period of (2) years thereafter. If you do not have an account, we may retain certain personal information based on your interactions with the WebMD Sites, such as IP address, as long as relevant to your use of the Services.

YOUR RIGHTS

The Applicable Data Privacy Laws provides consumers with specific rights regarding their personal information. This section describes your consumer rights and explains how to exercise those rights.

RIGHT TO KNOW AND DATA PORTABILITY

You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months or beyond the 12-month period on or after January 1, 2022. Once we receive and confirm your verifiable consumer request, we will disclose to you:

• the categories of personal information we collected about you.
• the categories of sources for the personal information we collected about you.
• our business or commercial purpose for collecting, selling or sharing that personal information.
• the categories of third parties with whom we disclose that personal information.
• the specific pieces of personal information we collected about you (also called a right to access or data portability request).

You may only make a verifiable consumer request for access or data portability twice within a 12-month period.

RIGHT TO DELETE

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and verify your consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.

We may deny your deletion request if retaining the information is necessary for us or our service providers to:

• Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
• Prevent, detect and investigate security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
• Debug products to identify and repair errors that impair existing intended functionality.
• Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 seq.).
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
• Comply with a legal obligation.
• Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

RIGHT TO CORRECT YOUR INACCURATE PERSONAL INFORMATION

You have the right to request that we correct any inaccurate personal information about you, taking into account the nature of the personal information and the purposes of processing your personal information. Once we receive and verify your consumer request, we will use commercially reasonable efforts to correct (and direct our service providers to correct) your inaccurate personal information from our records, unless it is impossible or involves a disproportionate effort.

RIGHT TO OPT-OUT OF THE SALE OF YOUR PERSONAL INFORMATION

You have the right to opt-out of the sale or sharing of your personal information subject to certain exclusions as described below. Once we receive your request, we will not sell or share your personal information, unless an exclusion applies. We may request that you authorize the sale or sharing of your personal information after 12 months following your opt-out.

The Applicable Data Privacy Laws exclude certain transfers of your personal information from what constitutes a sale or sharing thereof:

• As directed by you:
  • When you direct us to intentionally disclose your personal information or use the Services to intentionally interact with us or a third party (provided that third party does not sell or share your personal information, unless that disclosure would be consistent with the Applicable Data Privacy Laws).
• Opt-out signal:
  • We may share an identifier for you if you have opted out of the sale or sharing of your personal information for the purposes of alerting third parties of your election.
• Service provider:
  • We may share your personal information with a service provider that is necessary to perform a business purpose as described above if both of the following conditions are met:
    • we provide notice of the sharing and your opt-out right as described herein.
    • the service provider does not further collect, sell, share or use the personal information of the consumer except as necessary to perform the business purpose.
• Change of control:
  • We may transfer to a third party your personal information as an asset that is part of a merger, acquisition, bankruptcy, or other transaction subject to certain requirements described in the Applicable Data Privacy Laws.

We are unable to process opt-out requests across devices for advertising services described herein. For example, if you opt-out on your browser, we are not able to honor that request if you are using one of our App due to our practices and the limitations described above.

RIGHT TO NON-DISCRIMINATION FOR EXERCISING YOUR PRIVACY RIGHTS

We will not discriminate against you for exercising any of your Applicable Data Privacy Laws rights. Unless permitted by the Applicable Data Privacy Laws, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

We may provide a different level of Services if the difference is reasonably related to value provided by your data.

EXERCISING ACCESS, DATA PORTABILITY, CORRECTION AND DELETION RIGHTS

To exercise the access, data portability, correction and deletion described above, please submit a request to us by either:

• Calling us at (866) 967-1408.
• Clicking here

By calling the toll-free number or using the above link, you will be asked to provide certain identifying information, such as name, email, residency and date of birth, which we will only use to process or verify your request. You will be asked to validate your request by clicking a validation link in an email that will be sent to the email address provided.

The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

You may be asked to provide further verifying documentation, such as proof of residency and identity.

Only you or a person that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. If you are making a request through an authorized agent acting on your behalf, such authorized agent must provide proof of written authorization to do so, and you must verify your identity directly with us, unless such authorized agent provides proof of a power of attorney pursuant to applicable law.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

In case you want to appeal the denial of a decision with regard to a previous request, please submit a request to us by sending an email to [email protected]

EXERCISING YOUR OPT-OUT RIGHT.

You may exercise your opt-out right by visiting the our Website and selecting your preferences within the cookie banner at the bottom of the page, as well as clicking the “Do Not Sell or Share My Personal Information” link in the footer.You may also exercise your opt-out right by enabling an opt-out preference signal as part of your security or privacy settings (where available) in your device or internet browser. The cookie banner will automatically read such signals and comply with your preferences.

You have options and choices about the collection and use of information by third parties on our Platform:

For more information about these third-party ad networks and opting out of tracking, see: https://www.networkadvertising.org/managing/opt_out.asp.

For more information about interest-based information tracking and opting out, see: https://www.aboutads.info/choices/.

For information about disabling and controlling third-party cookies in your browser, see: https://www.aboutcookies.org/Default.aspx?page=1.

Additionally, most browser software can be set to reject all cookies, including third party cookies, however, if you choose to reject our cookies, your ability to access and use the Services will be limited. Typically the cookie settings are within the “options” or “preferences” menu in your browser. The links below provide information about cookie settings for some commonly used browsers:

• Internet Explorer
• Chrome
• Safari
• Firefox

You may control interest-based advertising on your mobile device by enabling the “Limit Ad Tracking” setting in your iOS device’s settings or “Opt out of Ads Personalization” in your Android device’s settings. This will not prevent you from seeing advertisements, but will limit the use of device advertising identifiers to personalize ads based on your interests. If you have questions about how to reject cookies on your specific device please check with the device manufacturer.

As more fully described in our Cookie Policy, in order to give you more control over your privacy choices, we have implemented a DAA (Digital Advertising Alliance) approved opt-out mechanism for interest-based advertising. At the bottom of every page of the WebMD Sites you will see an AdChoices logo (which looks like this: ). In our flagship WebMD App you can find the AdChoices option in the “Settings” screen. By clicking on that logo on the WebMD Sites or following the instructions in the flagship WebMD App, you will be presented with a window that will identify the companies that WebMD uses to direct tailored advertisements to you, both on the WebMD Sites and in the flagship WebMD App as well as on third-party websites. If you would like to stop this tailored advertising from WebMD, you can manage these advertisements through the choices in that window. By clicking the + symbol next to the name of a vendor in that window you will get information about how and where that vendor assists us with the delivery of advertisements.

The DAA also provides a general opt out of the sharing of your information with certain participating third parties through the DAA WebChoices Tool here.

Opt-outs may be stored via cookies. If you clear cookies or if your browser blocks cookies, your opt-out cookie may no longer be available and your opt-out choices may not be honored. We do not maintain or control the opt-out mechanisms described herein and are not responsible for their operation.

Please note that even if you opt-out of interest-based advertising, you will continue to receive generic advertisements through the Services. Please also note that your choice to stop tailored advertising is specific to the browser or mobile device that you are using so if you make a choice to opt out from one computer or mobile device and you want your opt-out to apply to a different computer or mobile device as well, please opt out from that computer or mobile device too.

You may also control interest-based advertising on your mobile device by enabling the “Limit Ad Tracking” setting in your iOS device’s settings or “Opt out of Ads Personalization” in your Android device’s settings. This will not prevent you from seeing advertisements, but will limit the use of device advertising identifiers to personalize ads based on your interests. If you have questions about how to reject cookies on your specific device, please confirm with the device manufacturer.

RESPONSE TIMING AND FORMAT

We shall confirm receipt of your request(s) within 10 business days and provide you information on how we will process your request. We will endeavor to respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. Any disclosures we provide will cover a period of no less than 12 months preceding the receipt of a verifiable consumer request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

CHANGES TO THIS PRIVACY NOTICE

We reserve the right to change or modify this privacy notice and any of our Services at any time and any changes will be effective upon being posted unless we advise otherwise. By continuing to use the Services after changes are made to this privacy notice, you agree to such changes. We encourage you to periodically review this privacy notice for the latest information on our privacy practices.

CONTACT INFORMATION

Please send us an email by using the Contact Us link at the bottom of every page of the WebMD Sites if you have any questions about this privacy notice or the personal information we maintain about you. We will respond to your request within a reasonable timeframe.

You can also contact WebMD’s Privacy Office at:

Effective date: July 1, 2023