What is Personal Information?
What Does LyfeMD Do?
LyfeMD owns and operates a mobile application (the “Application“), which is designed to:
(a) provide information and strategies intended to assist our end users with the management of chronic digestive illness or disease;
(b) send periodic notifications or reminders to our end users about their goal achievement;
(c) make in-Application coaching, one-on-one virtual coaching (the “Coaching Services”) and other one-on-one virtual professional services, such as dietic, psychological, kinesthetic and/or counselling services (the “Professional Services”) available to you in connection with the management of chronic digestive illness or disease; and
(d) communicate with our end users about assessments, research studies and additional programming available outside of the Application, including question and answer information sessions.
What Personal Information Do We Collect?
When you access or use the Application and related services, we collect a variety of personal information that you provide, including:
- contact information including your full name, address, email and billing information;
- any information you disclose in the in-Application chat or in connection with the Coaching Services and/or Professional Services; and
- information relating to management of chronic illness, including your age, gender, weight, diagnosis, symptoms, diet, sleep patterns, stress and physical activity, including that which you disclose in connection with the Coaching Services and/or Professional Services.
We may use a technology called “cookies”. A cookie is a tiny data file that our Application sends to your WebView, which may then be stored on your mobile device. The cookie acts as an identification card and allows our Application to recognize your mobile device and records the date and time that you interact with the Application. Cookies may provide us and our third-party service providers with information that we will use to personalize the Application in accordance with your preferences.
Why Do We Collect Personal Information?
We collect the personal information identified above for the purpose of operating, managing, maintaining and improving the Application and related services, which includes:
(a) providing you with access to and use of the Application and the related services;
(b) monitoring the performance of, and performing quality control activities with respect to, the Application and related services;
(c) conducting research and development activities into new or existing products or services;
(d) helping us operate, manage, maintain and improve our operations relating to the Application and related services by:
(i) obtaining comments, suggestions and feedback;
(ii) conducting surveys or polls; and
(iii) obtaining testimonials;
(f) giving notice of any data security breaches or legal proceedings;
(h) any other reasonable purpose for which consent is obtained.
How Do We Use and/or Disclose the Personal Information We Collect?
We only use and/or disclose personal information we collect:
- as permitted or required by applicable law or regulatory requirements;
- when required to comply with valid legal processes such as search warrants, subpoenas, court orders or other legally valid inquiries or orders;
- during emergency situations or where necessary to protect the safety of a person or group of persons; and
- for any additional purposes for which we have obtained your consent to the use or disclosure of your personal information.
In addition, from time to time, we: (i) process personal information that you submit to us to create derivative data that is aggregated and de-identified (i.e., data that cannot identify you as an identifiable individual) (“Anonymized Content“); and (ii) collect, access, use, process, save, store, copy, disclose, distribute, transfer, sell, assign, sublicense and otherwise handle any Anonymized Content for our internal, academic, research, or commercial business purposes, which includes, without limitation, (1) conducting research and reporting on health outcomes, goal achievements and other trends, benchmarks and metrics, and (2) developing both new and improved products and services relating to the management of chronic illness or disease.
We may use third-party service providers to assist us with operating, maintaining and improving the Application and related services. In particular, we may engage third-party service providers to host the components of the Application, store data, provide back-up services, conduct data analytics and/or obtain customer feedback. Personal Information may be processed and stored by LyfeMD or its third-party service providers, as permitted by applicable law, and, as at the date hereof, all personal information will be stored in Canada and/or the United States, where it in certain circumstances it may be accessed by the courts, law enforcement and national security authorities. Third-party service providers may only use and/or disclose personal information to the extent required to perform their designated functions and in accordance with applicable law. In addition, we will ensure that they provide privacy and security protections which are comparable to those provided by LyfeMD. For more information about the way in which our third-party service providers treat personal information, please contact our Privacy Officer.
We and/or our third-party service providers may use and/or disclose your personal information without your knowledge or consent where we are permitted or required by applicable law or regulatory requirements to do so. In particular, we and our third-party service providers may disclose personal information referred to herein in response to a search warrant, subpoenas, court orders or other legally valid inquiry or order (which may include lawful access by governmental authorities, courts or law enforcement agencies), to other organizations in the case of investigating a breach of an agreement or contravention of law or detecting, suppressing or preventing fraud, or as otherwise required or permitted by applicable laws.
Consent is Important to Us
It is important to us that we collect, use or disclose personal information where we have consent to do so. Depending on the sensitivity of the personal information, consent may be implied, deemed (using an opt-out mechanism) or express. Express consent can be given orally, electronically or in writing. Implied consent is consent that can reasonably be inferred from an action or inaction.
You may change or withdraw your consent at any time, subject to legal or contractual obligations. However, it is important to note that we may not be able to destroy or alter our archival/backup data, or secure the removal of personal information where it has been disseminated or used by third-parties.
We may collect, use or disclose personal information without your knowledge or consent where we are permitted or required to do so by applicable law or regulatory requirements.
All communications with respect to such withdrawal or variation of consent should be in writing and addressed to our Privacy Officer.
How is Personal Information Protected?
We are committed to protecting personal information that we collect, store or otherwise process from improper or unauthorized access, collection, use, disclosure, copying, modification, disposal or destruction.
We have implemented administrative, technical, physical and procedural safeguards in order to protect against such unauthorized behavior, taking into account the sensitivity of the information in question. These safeguards include passwords, encryption and other technologies. However, LyfeMD cannot prevent all possible improper or unauthorized access, collection, use, disclosure, copying, modification, disposal or destruction of personal information and, subject to applicable laws, will not be responsible for any damages or liabilities relating thereto.
We will make commercially reasonable efforts, where required by law, to notify all of the applicable parties in the event of any improper or unauthorized access, collection, use, disclosure, copying, modification, disposal or destruction, without delay.
The security of personal information is important to us. Please advise our Privacy Officer immediately if you become aware of any incident involving the loss of or unauthorized access to or disclosure of personal information that we collect, store or otherwise process.
How is Personal Information Retained?
LyfeMD has policies and procedures in place regarding the retention of personal information. In general, LyfeMD retains personal information as required to provide access to and use of the Application and the related services, and by applicable laws.
How can Personal Information be Accessed, Updated or Corrected?
Subject to certain limited exceptions prescribed by law, you may submit a request to access, update or correct your personal information. To review, verify or correct your personal information, please submit a written request to our Privacy Officer.
When making any such request, please note that we may request specific information to enable us to confirm your identity and determine whether you have the right to access, update or correct the personal information relating to such request.
The right to access the personal information that we hold about you is not absolute. There are instances where applicable law or regulatory requirements allow or require us to refuse to provide some or all of the personal information that we hold about you. In addition, your personal information may have been destroyed, erased or made anonymous in accordance with our record retention obligations and practices. In the event that we cannot provide you with access to your personal information, we will endeavor to inform you of the reasons why, subject to any legal or regulatory restrictions.
We may charge a fee to access personal information; however, we will advise you of any fee in advance. If you require assistance in preparing your request, please contact our Privacy Officer.
California Consumer Privacy Act
If you are a resident of California, you are granted specific rights regarding access to your personal information. California Civil Code Section 1798.83, also known as the “Shine The Light” law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us using the contact information provided below.
If you are under 18 years of age, reside in California, and have a registered account with LyfeMD, you have the right to request removal of unwanted data that you publicly post on the Application. To request removal of such data, please contact us using the contact information provided below, and include the email address associated with your account and a statement that you reside in California. We will make sure the data is not publicly displayed on the Application, but please be aware that the data may not be completely or comprehensively removed from all our systems (e.g. backups, etc.).
CCPA Privacy Notice
The California Code of Regulations defines a “resident” as:
(1) every individual who is in the State of California for other than a temporary or transitory purpose and
(2) every individual who is domiciled in the State of California who is outside the State of California for a temporary or transitory purpose
All other individuals are defined as “non-residents.”
If this definition of “resident” applies to you, we must adhere to certain rights and obligations regarding your personal information.
What categories of personal information do we collect?
We have collected the following categories of personal information in the past twelve (12) months:
|Identifiers||Contact details, such as real name, alias, postal address, telephone or mobile contact number, unique personal identifier, online identifier, Internet Protocol address, email address and account name||YES|
|Personal information categories listed in the California Customer Records statute||Name, contact information, health information history, and financial information||YES|
|Protected classification characteristics under California or federal law||Gender and date of birth||YES|
|Internet or other similar network activity||Browsing history, search history, online behavior, interest data, and interactions with our and other websites, applications, systems and advertisements||YES|
|Geolocation data||Device location||YES (if enabled)|
|Audio, electronic, visual, thermal, olfactory, or similar information||Images and audio, video or call recordings created in connection with the Coaching Services and/or Professional Services||YES|
|Inferences drawn from other personal information||Inferences drawn from any of the collected personal information listed above to create a profile or summary about, for example, an individual’s preferences and characteristics||YES|
We may also collect other personal information outside of these categories instances where you interact with us online, or by phone or mail in the context of:
- Receiving help through our customer support channels;
- Participation in customer surveys or contests; and
- Facilitation in the delivery of Coaching Services and/or Professional Services and to respond to your inquiries.
How do we use and share your personal information?
More information about our data collection and sharing practices can be found in this privacy notice.
If you are using an authorized agent to exercise your right to opt-out we may deny a request if the authorized agent does not submit proof that they have been validly authorized to act on your behalf.
Will your information be shared with anyone else?
We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Each service provider is a for-profit entity that processes the information on our behalf.
We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be “selling” of your personal data.
LyfeMD has not disclosed or sold any personal information to third parties for a business or commercial purpose in the preceding 12 months. LyfeMD will not sell personal information in the future belonging to Application users and other consumers.
Your rights with respect to your personal data
Right to request deletion of the data – Request to delete
You can ask for the deletion of your personal information. If you ask us to delete your personal information, we will respect your request and delete your personal information, subject to certain exceptions provided by law, such as (but not limited to) the exercise by another consumer of their right to free speech, our compliance requirements resulting from a legal obligation or any processing that may be required to protect against illegal activities.
Right to be informed – Request to know
Depending on the circumstances, you have a right to know:
- whether we collect and use your personal information;
- the categories of personal information that we collect;
- the purposes for which the collected personal information is used;
- whether we sell your personal information to third parties;
- the categories of personal information that we sold or disclosed for a business purpose;
- the categories of third parties to whom the personal information was sold or disclosed for a business purpose; and
- the business or commercial purpose for collecting or selling personal information.
In accordance with applicable law, we are not obligated to provide or delete consumer information that is de-identified in response to a consumer request or to re-identify individual data to verify a consumer request.
Right to Non-Discrimination for the Exercise of a Consumer’s Privacy Rights
We will not discriminate against you if you exercise your privacy rights.
Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. These verification efforts require us to ask you to provide information so that we can match it with information you have previously provided us. For instance, depending on the type of request you submit, we may ask you to provide certain information so that we can match the information you provide with the information we already have on file, or we may contact you through a communication method (e.g. email) that you have previously provided to us. We may also use other verification methods as the circumstances dictate.
We will only use personal information provided in your request to verify your identity or authority to make the request. To the extent possible, we will avoid requesting additional information from you for the purposes of verification. If, however, we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity, and for security or fraud-prevention purposes. We will delete such additionally provided information as soon as we finish verifying you.
Other privacy rights
- you may object to the processing of your personal data
- you may request correction of your personal data if it is incorrect or no longer relevant, or ask to restrict the processing of the data
- you can designate an authorized agent to make a request under the CCPA on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with the CCPA.
- you may request to opt-out from future selling of your personal information to third parties. Upon receiving a request to opt-out, we will act upon the request as soon as feasibly possible, but no later than 15 days from the date of the request submission.
To exercise these rights, please contact us using the contact information provided below. If you have a complaint about how we handle your data, we would like to hear from you.
Inquiries or Concerns?