‍

1. INFORMATION WE COLLECT AND HOW WE USE IT

We may collect the following types of information about you through the Website:

• •      Operate, maintain, and improve the Website;
• Respond to your inquiries,demo requests, and other communications;
• Send you marketing andpromotional communications about our products, services, and events (subject to your preferences);
• Deliver targeted advertising based on your interests and browsing behavior on the Website;
• Analyze Website usage andmeasure the effectiveness of our marketing campaigns;
• Maintain the security of the Website; and
• Comply with our legal obligations.

‍

We use the information we collect to:

• Operate, maintain, and improve the Website;
• Respond to your inquiries,demo requests, and other communications;
• Send you marketing and promotional communications about our products, services, and events (subject to your preferences);
• Deliver targeted advertising based on your interests and browsing behavior on the Website;
• Analyze Website usage and measure the effectiveness of our marketing campaigns;
• Maintain the security of the Website; and
• Comply with our legal obligations.

The Website is a corporate and informational site only. It does not provide medical services, and information on the Website is not medical advice.

‍

‍

2.  DATA BREACH NOTIFICATION

In the event of a data breach affecting your personal information:

• We will notify affect edusers promptly, typically within 72 hours of discovering the breach, unless otherwise required by law.
• Notifications will be sent via email or other appropriate methods and will include: the nature of the breach; the types of information involved; the steps we are taking to addressthe issue; and recommended actions for affected users.
• We will comply with all applicable laws regarding data breach notifications and notify relevant authorities when required.
• Following any breach, we will review and enhance our security measures as necessary.

‍

‍

3.  ONLINE ACTIVITY TRACKING

We collect information about your activity on the Website using technologies such as cookies, flash cookies, web beacons, widgets, and server log files. Most web browsers automatically accept cookies, but you can usually change your browser settings to decline them. If you choose to disable cookies, certain features of the Website may not be available.
‍

Our Website does not currently respond to browser-level “Do Not Track” (DNT) signals. However, we honor the Global Privacy Control(GPC) signal, a standardized opt-out mechanism required under California(CCPA/CPRA), Colorado, Connecticut, and other applicable state privacy laws. If you have enabled GPC in your browser, your opt-out of sale and sharing of personal data will be automatically honored. For other tracking preferences, see the “Your Choices” section below.
‍

We may use your IP address and page-visit data to gather broad demographic information about our visitors and to analyze and improve theWebsite’s design and functionality. A full list of the specific third-party tools and trackers we use — including named vendors, the data each collects,and opt-out instructions — is provided in Section 5 below.

‍

‍

4. THIRD-PARTY TOOLS, TRACKERS, AND SERVICE PROVIDERS

The Website uses the third-party tools, trackers, and service providers listed below. These tools may collect, process, or receive personal information about Website visitors. Where a tool involves the Sale or Sharing of personal information as defined under applicable state law, this isnoted. To opt out of Sale or Sharing, use the Privacy Choices link onour Website, enable the Global Privacy Control (GPC) in your browser, or contact us at privacy@welldocinc.com.

4.1  Analytics

Google Analytics 4 (GA4) — Collects data about how visitors use the Website, including pages visited, time on site, and traffic sources. GA4 may collect device identifiers and anonymized IP addresses. Data is processed by Google LLC. Opt out.
‍

Google Analytics Advertising Reporting Features — Links behavioral analytics data to Google’s advertising ecosystem. May involve Sale or Sharingof personal information under applicable state law. Opt out via Google’s Ads Settings. Ads Settings.
‍

Google Analytics Demographics and Interests Reports — Uses Google’s advertising cookies to infer visitor demographic information and interest categories. May constitute Sharing of personal information. Opt out via Google’s Ads Settings. Ads Settings.
‍

Google Looker Studio — Used for internal analytics reporting. If connected to GA4 data, processes the same categories of data as GA4. Data is processed by Google LLC.
‍

Microsoft Clarity — A behavioral analytics tool that records session replays (including mouse movements, scrolling, clicks, and keystrokes on non-sensitive fields), heat maps, and click tracking. Collects device identifiers, IP addresses, and session behavior data. We configure Clarity to mask all form fields and sensitive inputs. Learn more.
‍

4.2  Advertising and Remarketing

The following advertising and remarketing tools involvethe Sale or Sharing of personal information (including identifiers, internet activity, and inferences) for targeted advertising purposes under applicable state law. Residents of California, Colorado, Connecticut, Virginia, Texas, and other states have the right to opt out.
‍

Meta Tracking Pixel (Meta Ads Conversion Tracking) — A pixel operated by Meta Platforms, Inc. collects identifiers, browsing behavior, and conversion data for advertising measurement and audience targeting on Facebook and Instagram. Constitutes Sale or Sharing. Opt out.
‍

Facebook Like Button and Social Widgets — Meta’s social plugins load content from Meta’s servers, allowing Meta to collect your IP address and browsing data even if you do not click the button. Data processed by Meta Platforms, Inc.
‍

Facebook Remarketing — Used to serve ads to prior Website visitors by sharing identifiers and behavioral data with Meta Platforms, Inc. Constitutes Sale or Sharing.

‍

Meta Custom Audience — Matches hashed contact information against Meta’s user database for targeted advertising. Involves transferring hashed personal data to Meta Platforms, Inc. Constitutes Sale or Sharing.
‍

LinkedIn Ads — Used for B2B advertising on LinkedIn. LinkedIn (a Microsoft company) processes identifiers and professional profile data for adtargeting.
‍

LinkedIn Insight Tag (LinkedIn Conversion Tracking) — A LinkedIn pixel measures ad campaign performance and collects visitor data for conversion tracking. Involves sharing identifiers and behavioral data with LinkedIn Ireland Unlimited Company / Microsoft Corporation. Constitutes Sale or Sharing. Opt out.
‍

LinkedIn Website Retargeting— Retargets Website visitors with LinkedIn ads by sharing behavioral data with LinkedIn. Constitutes Sale or Sharing.
‍

LinkedIn Matched Audiences — Targets advertising to specific contact lists by sharing hashed contact data with LinkedIn. Constitutes Sale or Sharing.
‍

LinkedIn Predictive Audiences— Uses machine-learning to identify prospective audiences by processing behavioral and profile data. Constitutes Sale or Sharing.
‍

LinkedIn Lookalike Audiences— Expands ad reach by sharing audiencedata with LinkedIn to identify similar users. Constitutes Sale or Sharing.
‍

LinkedIn Button and SocialWidgets — LinkedIn’s social plugins allow LinkedIn to collect your IP address and browsing data when loaded. Data processed by LinkedIn Ireland Unlimited Company / Microsoft Corporation.

‍

4.3  CRM, Marketing, and UserDatabase Management

Salesforce / Salesforce Marketing Cloud / Pardot (Marketing Cloud Account Engagement) — Used to manage contact records, track email marketing engagement, score leads, and support advertising campaigns. The Pardot contact form transmits submission data directly to Salesforce. Salesforce Privacy.
‍

Salesforce Sales Cloud — CRM platform used to store and manage contact and account records. Personal information submitted through Website contact forms may bestored here.
‍

ZoomInfo / ZoomInfo SalesOS —A B2B data intelligence platform operated by ZoomInfo Technologies LLC that aggregates professional contact information from public and third-party sources. We may receive personal information (name, employer, title, email, professional profile) from ZoomInfo that was not collected directly from the individual. Constitutes receipt of data broker information under certain state laws. ZoomInfo Privacy Center.
‍

4.4  Tag Management

Google Tag Manager — A tag management system operated by Google LLC used to deploy and manage the tracking scripts and pixels described in this section.The vehicle through which all third-party tracking technologies are deployed onthe Website.

‍

4.5  Social Widgets and Embedded Content

YouTube IFrame Player and YouTube Button — Embeds YouTube video players and social buttons. When you view embedded content, YouTube may collect your IP address, device information, and viewing behavior. Google Privacy Policy.

‍

Vimeo IFrame Player — Embeds video content via the Vimeo player operated by Vimeo, Inc. Vimeo may set cookies and collect your IP address, device information, and viewing behavior. Vimeo Privacy Policy.

‍

X (Twitter) Post Button and Social Widgets — Social sharing buttons operated by X Corp. (formerly Twitter). Loading these buttons allows X Corp. to collect your IP address and browsing data. X Privacy Policy.

‍

Google Fonts — Fonts loaded from Google’s servers, which receive your IP address when fonts are loaded. Google Privacy Policy.

‍

Google Hosted Libraries — JavaScript libraries loaded from Google’s hosted library service. Google’s servers receive your IP address on each page load.

‍

4.6  Consent Management

iubenda Consent Database and Privacy Controls — iubenda’s consent management platform collects, records, and honors your cookie and tracking preferences. iubenda is a data processor acting on our instructions.
‍

Cookie Notice & Compliance for GDPR/CCPA — Displays cookie consent notices and manages compliance with applicable cookie laws. Processes your consent choices as a data processor.

‍

4.7  Hosting, Infrastructure, and Security

Amazon Web Services (AWS) — Backend infrastructure hosted on AWS, operated by Amazon Web Services, Inc. AWS processes personal data as a data processor. Data stored in AWS data centers in the United States. AWS Privacy.
‍

Webflow — The Website is built and hosted on Webflow, operated byWebflow, Inc. Webflow processes form submission data, IP addresses, and website traffic as a data processor. Webflow Privacy.
‍

Cloudflare and Cloudflare Bot Management — All Website traffic passes through Cloudflare’s network (Cloudflare, Inc.). Cloudflare processes IP addresses, request headers, and traffic metadata for content delivery, DDoS protection, and bot management. Cloudflare Privacy.
‍

jsDelivr CDN — JavaScript resources may be loaded from jsDelivr(ProspectOne). jsDelivr’s servers receive your IP address when resources are loaded. jsDelivr Privacy.
‍

4.8  Human Resources Tools

BambooHR — An HR information system (Bamboo HR LLC) used to manage employee and applicant data only. BambooHR does not process Website visitor data or Welldoc Platform user data.

‍

‍

5. HOW WE SHARE INFORMATION

We do not sell your personal information to anyone for direct marketing purposes without your consent. We never sell sensitive personal information, including health data, precise geolocation, or biometric data, under any circumstances.
‍

Data Broker Disclosure — We receive personal information about business contacts and prospects from ZoomInfo Technologies LLC, a third-party data broker. This may include names, employers, titles, email addresses, and professional profiles not collected directly from those individuals. California residents and residents of applicable states may request deletion from ZoomInfo at ZoomInfo Privacy Center or from us at privacy@welldocinc.com.
‍

We may share your information with third parties for purposes such as:

• Service Providers — To support Website operations, analytics, marketing, and security. Named providers include Google (Analytics), Microsoft (Clarity), Salesforce (CRM and Marketing), Amazon Web Services, Webflow, Cloudflare, and others listed in Section 4.
• Legal Compliance — To respond to court orders, government requests, law enforcement, and other legal process.
• Protection of Rights — To defend against legal claims, enforce our Terms of Use, or obtain payment for products or services.
• Professional Advisors — To state and federal regulatory agencies, auditors, lawyers, or other professional advisors.
• Business Transfers — In connection with a merger, acquisition, reorganization, sale of assets, or bankruptcy.

‍

‍

6. ANONYMOUS AND AGGREGATE INFORMATION

We collect some information on an anonymous basis. We may anonymize or de-identify information we collect so that it can no longer be linked to you, and may combine or aggregate this data. We may use and share this aggregated data with third parties to perform data analytics and research, including to improve our products and services.
‍

‍

7. CHILDREN'S PRIVACY

Our products and services are not designed to attract children under the age of 13. We do not knowingly collect personally identifying information from anyone under the age of 13. Any information about a child under the age of 13 must be provided by that child’s parent or legal guardian. If you are the parent or legal guardian of a child under 13 and become aware that the child has provided personal information through our services without your consent, please notify us promptly. If we become aware that a child under 13 has provided us with personal information without parental consent, we will take steps to remove it.
‍

As required by the FTC’s updated COPPA Rule (effective June 23, 2025), “personal information” as used in this section includes biometric identifiers such as voiceprints and facial recognition templates, in addition to the categories described elsewhere in this policy. We do not collect biometric identifiers from children under 13.

We do not retain personal information collected from children under the age of 13 for longer than is reasonably necessary to fulfill the purpose for which it was collected. We maintain a written data retention policy addressing personal information collected from or about children.
‍

We will not disclose personal information collected from children under 13 to third parties, or use such information for AI model training or development, without first obtaining separate, verifiable parental consent as required by the updated COPPA Rule.
‍

California — Under 16. We do not collect Personal Information about California consumers below the age of 16. We do not knowingly sell or share the Personal Information of California consumers below the age of 16.

‍

‍

8. DATA PROTECTION AND SECURITY

We take reasonable steps to protect your personal information. We use encryption technology (Secure Sockets Layer / TLS) to help protect personal information during transport across the Internet. Unfortunately, there is always some risk that an unauthorized third party may find a way around our security measures. We cannot guarantee that the Internet or any other technical system will be 100% secure. We are not responsible for the security of information you transmit over networks that we do not control.
‍

A password or biometric authentication is required to access your account. Please keep your credentials confidential.

‍

8.1  Data Retention

We maintain information about you in our business records while you are a customer or User, or until it is no longer needed for business, tax, or legal purposes. We retain different categories of personal information for different periods:

• Account and profile information is retained for the duration of your account plus seven years;
• Health data and transactional records are retained for the minimum period required by applicable law or regulation;
• Marketing preferences and opt-out records are retained indefinitely to honor your choices; and
• Personal information collected from children under age 13 is retained only as long as reasonably necessary for the purpose collected and deleted promptly upon parental request.

You may request information about our retention practices by contacting our Privacy Officer.
‍

8.2  International Transfers

Your information may be transferred to and maintained on computers and servers located outside of your state, province, country, or other governmental jurisdiction where the privacy laws may not be as protective as those in your jurisdiction. If you are located outside the United States and choose to provide information to us, Welldoc transfers personal information to the United States and processes it there.

‍

‍

9. USE OF GOOGLE APIS

Where Welldoc uses and/or transfers information received from Google APIs to any other app, it will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
‍

‍

11. EMAIL AND TEXT COMMUNICATIONS

We may communicate with you electronically or via telephone, including by SMS (text), about our programs, products, services, offers, or general health information. We may communicate via unencrypted methods such as text or unencrypted email. You acknowledge and accept that communications by text or email involve some risk of unauthorized disclosure or interception.
‍

It is your responsibility to provide us with true, accurate, and complete contact information and to make any changes to that information promptly. Failing to update your contact information may delay or prevent us from providing you with communications that rely on that information.

‍

‍

12. THIRD PARTIES AND LINKS

In the event that you provide your information to any third party via any Welldoc service or any offer made available to you by Welldoc, Welldoc is not responsible for such third parties’ use or misuse of your information. You should review the privacy and information-sharing practices of such third parties.
‍

Welldoc may offer links to other sites or within our services so that you can conveniently visit our vendors, advertisers, or other content likely to be of interest. We are not responsible for the content, practices, or policies of sites operated by third parties and urge you to inquire about them before providing any personally identifiable information.

‍

‍

13. CHANGES TO THIS PRIVACY POLICY

We may make changes to this Privacy Policy from time to time. When we do so, we will post the revised Privacy Policy and change the “Effective Date.” Please check the Effective Date to determine if the policy has been modified since you last reviewed it. Your continued use of our services after that date means you agree to this Privacy Policy and any changes to it.

‍

‍

14. CONTACT US

You may contact our Privacy Officer with any inquiry or request regarding this Privacy Policy or the handling of your information:
‍

Welldoc, Inc.

Attn: Privacy Officer

10221 Wincopin Circle, Suite 150

Columbia, Maryland 21044

Email: privacy@welldocinc.com

Phone: 1-888-611-4794

Website: www.welldoc.com

‍

‍

‍

15. INFORMATION FOR CALIFORNIA RESIDENTS

Scope. This section applies only to California residents. It describes how we collect, use, and share Personal Information of California residents in our capacity as a “business” under the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”), and as enforced by the California Privacy Protection Agency (“CPPA”). For purposes of this section, “Personal Information” has the meaning given in the CCPA but does not include information exempted from the CCPA, such as information subject to HIPAA or California’s Confidentiality of Medical Information Act.
‍

15.1  Your California Privacy Rights

As a California resident, you have the following rights. These rights are not absolute, and in certain cases we may decline your request as permitted by law.

‍

• Information. You can request information about how we have collected and used your Personal Information during the past 12 months, including: the categories collected; the sources of collection; the business or commercial purposes for collection; the categories of third parties with whom we share it; and the categories sold or disclosed for a business purpose.
• Access. You can request a copy of the Personal Information we have collected about you during the past 12 months.
• Deletion. You can ask us to delete the Personal Information we have collected from you.
• Correction. You can request that we correct inaccurate Personal Information we have collected about you, subject to certain exceptions.
• Limit Use of Sensitive Personal Information. You can request that we limit our use or disclosure of your Sensitive Personal Information to only that which is necessary to perform the services or provide the goods reasonably expected by an average consumer.
• Opt-Out of Automated Decision-Making / Profiling. You can opt out of automated processing of your Personal Information for purposes that produce legal or similarly significant effects. Contact us at privacy@welldocinc.com to submit such a request.
• Nondiscrimination. You are entitled to exercise the rights above free from discrimination as prohibited by the CCPA.

We do not sell your personal information as defined by the CCPA.

‍

15.2  How to Submit a California Rights Request

You may submit requests by calling us toll free at 1-888-611-4794 or by emailing privacy@welldocinc.com.. We cannot process your request if you do not provide us with sufficient detail to allow us to understand and respond to it.
‍

We will need to verify your identity to process your requests and reserve the right to confirm your California residency. To verify your identity, we may require government identification, a declaration under penalty of perjury, or other information.
‍

Your authorized agent may make a request on your behalf upon our verification of the agent’s identity and our receipt of a valid power of attorney pursuant to California Probate Code Sections 4000–4465, or written and signed permission plus confirmation that you have given the agent authority to submit the request.

‍

15.3  Personal Information We Collect, Use, and Disclose

The table below summarizes the Personal Information we collect by reference to the categories specified in the CCPA.

The business and commercial purposes for which we collect and use this information are described in Section 1 above. The categories of third parties to which we disclose this information are described in the “How We Share Information” section above.

‍

‍

16. INFORMATION FOR RESIDENTS OF OTHER STATES

In addition to California, a growing number of states have enacted comprehensive consumer privacy laws that grant residents specific rights regarding their personal information. As of the effective date of this Privacy Policy, this includes residents of Colorado, Connecticut, Virginia, Texas, Oregon, Montana, Indiana, Kentucky, Rhode Island, Maryland, Minnesota, and other states with applicable laws. If you reside in one of these states, you may have the following rights, subject to applicable exemptions:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate personal information.
• Deletion: Request deletion of your personal information, subject to certain exceptions.
• Opt-Out: Opt out of the sale or sharing of your personal information and opt out of targeted advertising.
• Portability: Receive your personal information in a portable format.
• Opt-Out of Automated Decision-Making: Opt out of profiling or automated decisions that produce legal or similarly significant effects.
• Sensitive Data Consent: Freely give, deny, or withdraw consent for the processing of your Sensitive Personal Information, to the extent required by the law of your state.

To exercise these rights, please contact us at privacy@welldocinc.com or call 1-888-611-4794. We will respond within the timeframe required by applicable law and will not discriminate against you for exercising your privacy rights. Note that certain information may be exempt, including information subject to HIPAA or necessary for us to provide services you have requested.

‍

16.1  Heightened Protections for Sensitive Health Data

We treat your health data as sensitive personal information. We do not sell sensitive personal information, including health data, precise geolocation, or biometric data, as defined under applicable state laws including the Maryland Online Data Privacy Act (MODPA).

‍

16.2  Data Minimization

Consistent with the Maryland Online Data Privacy Act and other applicable state laws, we limit our collection and processing of personal information to what is reasonably necessary and proportionate to provide the products and services you request or as otherwise permitted by law.

‍

16.3  Minnesota Profiling Rights

If you are a Minnesota resident, in addition to the rights listed above, you have the following specific rights in connection with profiling decisions that significantly affect you:

• The right to question the results of the profiling;
• The right to be informed of the reason that the profiling resulted in the decision, if feasible;
• The right to know what actions you could take that would lead to a different decision in the future;
• The right to review the personal data used in the profiling; and
• The right to have inaccurate personal data corrected and the profiling decision re-evaluated.

Minnesota and Maryland residents also have the right to obtain a list of the specific third parties to which we have disclosed personal information. To request this list, contact us at privacy@welldocinc.com.

‍