Consumer Health Data Privacy Policy

Why there are three privacy documents, and which one applies to you

Our Privacy Policy covers ordinary website information: cookies, analytics, and marketing data.

Our Notice of Privacy Practices covers protected health information (PHI) once you are a patient. That is a HIPAA document and HIPAA rules govern it.

This policy covers the gap between them. Before you are a patient, information you give us about your health is not PHI, but it is still health data, and we protect consumer health data as described in this policy and provide the rights required by applicable consumer health privacy laws. If you later become a patient, the same information may also become PHI. Where that happens, both this policy and the Notice of Privacy Practices apply to it.

What consumer health data we collect

We collect only what the evaluation and your care actually need:

• Your state of residence, asked before any other question, so we can tell you immediately if we cannot treat you.
• Your name, email address and mobile number, asked before the medical questions so the physician can reach you either way.
• Medical history and health information you provide during your evaluation, including medications, conditions, symptoms, treatment history and treatment-related screening information, and whether you asked to speak with the physician before any approval.
• If you go on to become a patient, the clinical intake and records on our patient record platform. That information is PHI and the Notice of Privacy Practices governs it.

We do not calculate a health score. The safety screen either stops an evaluation or lets it continue; nothing is scored, ranked or graded.

What we do NOT do with it

We do not sell consumer health data. We have never sold it and we do not have a process for doing so.

We do not use your evaluation answers, or any inference from them, to target advertising to you, and we do not put them into an advertising platform’s audience or custom-audience tools.

We never send your evaluation answers, your concern, your treatment, the medication you were prescribed, your contact details or a physician’s decision to any advertising company. That is true of every page, every event and every sharing arrangement described below, and it is true whether or not you give us any of the consents on this page.

The one thing an advertising company receives from this website is the Google Ads measurement described under "Advertising pixels and advertising platforms" below: when a visitor who came from a Google ad reaches our confirmation page, Google Ads is told that the confirmation page was reached for that ad click. Because that page is shown only after a request is finished, this tells Google that someone who clicked the ad finished our request steps; it tells Google nothing about what was asked or answered.

We do not use geolocation to infer anything about your health, and we do not operate a geofence around any health care facility.

How we use it

To tell you whether we can treat you in your state, and to stop the process immediately if we cannot.

To give the reviewing physician the information needed to decide whether treatment is appropriate.

To contact you about the evaluation you started, if you gave us your contact details.

To understand how many people start and finish the evaluation. We count steps; we do not attach your answers to that count.

Advertising pixels and advertising platforms: no pixels; one Google Ads measurement on one page

We run no advertising pixels on this website. No page sends your visit to Meta or TikTok, and no page that names a therapy, a condition, a medication or a lab test loads any advertising tag: the home page, the start pages, the pages about a therapy or a lab test, every article, every city page and the evaluation load none.

Google Ads, on the confirmation page only. If you arrive from a Google ad, the page address carries a Google click identifier; our site keeps it in your browser only (local storage, up to 30 days) and sends it nowhere. If you later reach our confirmation page (kesbury.com/thank-you), that page loads the Google Ads tag (with Google’s advertising storage allowed and identifier redaction off on that page only), sets Google’s conversion cookie, and tells Google Ads that a visit from one of its ads reached the confirmation page, with that click identifier. It sends the page address with nothing after it, the referring site’s name only, and no name, email address, phone number, answer, treatment, medication, condition, amount or physician decision. Ad personalization and ad user data are set to denied, enhanced conversions are off, and it is not sent if your browser sends Global Privacy Control or Do Not Track. If you did not arrive from a Google ad, the confirmation page sends nothing to Google Ads.

What is measured on the evaluation, and by whom

Our own first-party counter. Every step of the evaluation (opened, state passed, contact screen shown, submitted and so on) is counted by our own software with a stage word and nothing about you: no answers, no state, no treatment choice, no name, email or phone. Reload protection uses a random token kept only in your browser tab.

No Google Analytics. We do not use Google Analytics on the evaluation or on any other page, so no page view, evaluation event, answer, state, eligibility result or contact detail is sent to Google for analytics. The Google Ads tag runs on the confirmation page only, as described above.

Cloudflare Web Analytics, run by our website host, counts page views and page load timing. It sets no cookie, stores no identifier in your browser and receives nothing you type into a form.

Google reCAPTCHA Enterprise runs on the evaluation to block automated submissions and is subject to Google’s privacy policy and terms.

Who we share it with

Service providers who process data on our behalf under contract, and only for the purposes above: our customer-record platform, our patient record platform, our payment processor, our cloud infrastructure provider, and our email and messaging providers.

Advertising platforms: Google Ads only, and only the confirmation-page measurement described above (a Google click identifier and the fact that the confirmation page was reached). No answer, treatment, medication, condition or contact detail is sent.

A prescribing or dispensing pharmacy, only if you become a patient and a prescription is issued.

Law enforcement or a court, only where we are legally required to and only to the extent required.

How to opt out of each thing separately

There is one thing you may want to switch off, and it has its own control:

• Google Ads measurement on the confirmation page. Turn on Global Privacy Control or Do Not Track in your browser (either one stops it), use any tracker-blocking extension, or clear this site’s data in your browser to remove the stored click identifier.

Our own first-party step counter cannot identify you, so there is nothing about you in it to delete. If you would rather we handled anything else for you, email care@kesbury.com with the subject line "Consumer health data request" and we will delete the records associated with you and tell you what we deleted.

Your rights

Wherever you live, you may ask us to:

• Confirm whether we hold consumer health data about you, and tell you who we have shared it with.
• Withdraw a consent you previously gave, for future collection, use or sharing.
• Delete the consumer health data we hold about you. We will delete it from our own systems and instruct our service providers to do the same. Where the information has also become part of a clinical record, medical-record retention law may require us to keep that record. We will tell you if that applies to you and what we are keeping.
• Appeal, if we refuse a request. We will explain why, and how to contact your state attorney general.

To make a request, email care@kesbury.com with the subject line "Consumer health data request". We will respond within 45 days and will tell you if we need a further 45. We will not charge you, and we will not treat you differently for asking.

How long we keep it

If you complete the evaluation but do not become a patient, we keep your contact record and evaluation answers for as long as they are useful for follow-up, and delete them on request.

If you become a patient, the clinical record is retained for the period medical-record retention law requires, and the Notice of Privacy Practices governs it.

Analytics counts are aggregate and are not linked back to you by name, email address or phone number.

Changes to this policy

If we change how we collect, use or share consumer health data in a way that is materially different from this policy, we will post the revised policy here with a new effective date before the change takes effect. We will not apply a material change retroactively to data already collected without your consent.

Contact

Privacy Officer, RegenHairSolutions LLC dba Kesbury Health — care@kesbury.com, 8051 N. Tamiami Trail, Suite E6, Sarasota, FL 34243.