This notice describes how Personal Data (defined below) and/or medical information about you may be used and disclosed and how you can obtain access to this information. Please review it carefully.
Introduction
We at zLifespan, Inc. (“we”, “us”, “the Company”, or “zLifespan”) value your privacy and are committed to keeping your personal data confidential. We use your data solely in the context of providing the zLifespan consumer mobile application (the “Platform”), including all relevant content and functionality associated with the Platform (collectively, the “Services”). If you are reading this Privacy Policy, you are a “User”.
Privacy Policy Applicability
This Privacy Policy applies to personal data that zLifespan collects from Users of the zLifespan Services (“Personal Data”). The term “Personal Data” includes any information that can be used on its own or with other information in combination to identify or contact one of our users. Some of the Personal Data we collect and transmit may be considered “health data” (i.e., data related to your physical or mental health), “protected health information” or “PHI” (i.e., information that relates to your past, present, or future physical or mental health or condition(s); the provision of health care to you; or the past, present, or future payment for the provision of health care to you), and/or medical records as defined by state law.
We believe that privacy and transparency about the use of your Personal Data are of utmost importance. Therefore, our privacy practices are intended to comply with the relevant state law related to the use and disclosure of consumer health data, where applicable. Please see our Consumer Health Data Privacy Policy for additional information relating to our use and disclosure of your consumer health data. Additionally, in this Privacy Policy, we provide you with detailed information about our collection, use, maintenance, and disclosure of your Personal Data. This Privacy Policy explains what kind of information we collect, when and how we might use your Personal Data, how we protect Personal Data and your rights regarding your Personal Data.
For additional information related to how we use and disclose your Personal Data and/or consumer health data, please contact our Privacy Officer at privacy@zlifespan.com.
Note regarding third-party sites: Our Services may contain links to other sites that are not operated by zLifespan. If you click a third-party link, you will be directed to that third party’s site. We strongly advise you to review the privacy policy(ies) of every site you visit. zLifespan has no control over and assumes no responsibility for the content, privacy policies, or practices of any third-party sites or services. This Privacy Policy does not apply to your use of or access to any third-party sites or services. When you connect a wearable or health service, you may be sent to sign-in pages operated by third parties such as Terra or Google Health, which are governed by their own privacy policies.
Agreement to Privacy Policy Terms
BY ACCESSING AND/OR USING THE SERVICES, YOU ARE ACKNOWLEDGING THAT YOU HAVE READ AND AGREE TO THE TERMS OF THIS PRIVACY POLICY. IF YOU DO NOT AGREE, YOU MUST IMMEDIATELY CEASE USING THE SERVICES.
Privacy Policy Updates
Please note that we occasionally update this Privacy Policy, and it is your responsibility to stay up to date with any amended versions. We will post any revised Privacy Policy on zlifespan.com and notify you in the app. If we make material changes, we will also notify you by email before the changes take effect. Changes will apply to all Personal Data that we maintain, use, and disclose. If you continue to use the Services following such notice, you are agreeing to those changes.
Account Deletion
If at any point you no longer agree to the use and disclosure of Personal Data, as described in this Privacy Policy, you can delete your user account (“User Account”) within your account settings or by sending a deletion request to privacy@zlifespan.com or through our privacy request form at https://privacy.zlifespan.com with the following information:
- Your login email address; and
- A statement that you are requesting account deletion.
Questions or Concerns
If you have any questions or concerns after reading this Privacy Policy, please do not hesitate to contact us at privacy@zlifespan.com or +1 201-614-5203. We appreciate your feedback.
Collection and Use of Personal Data
What Personal Data Does zLifespan Collect?
We collect eight types of information from our Users: (i) demographic data; (ii) User-provided health data; (iii) uploaded documents; (iv) connected source data; (v) derived and inferred health data; (vi) artificial intelligence (“AI”) assistant interactions; (vii) support data; and (viii) technology data. Each category of data is explained in depth below.
Demographic Data: We collect demographic data from Users, which may include, but not be limited to, your name, date of birth, sex at birth, gender identity, city and state, email address, phone number, and, if you choose to provide one, an emergency contact’s name, relationship, and phone number. The collection of this demographic data is primarily used to create your User Account, which you can use to securely receive the Services.
User-Provided Health Data: In addition to demographic information, we may collect information regarding your health status; health conditions, which may include mental health conditions; allergies; medications; and lifestyle information, such as exercise, sleep, stress level, vaccination status, and tobacco and alcohol use. We collect this information to provide you with the Services.
Uploaded Documents: If you choose, we collect files you upload, which may include, but not be limited to, lab reports, prescriptions, images, and insurance cards. We collect this information to provide you with the Services.
Connected Source Data: We may collect information imported from external sources you explicitly authorize and connect to the Platform, including electronic health record (“EHR”) systems, retail pharmacies, health insurers, and personal wearable devices.
Derived and Inferred Health Data: We collect informational summaries computed by the Platform based on your other Personal Data, such as health trend indicators and plain-language record summaries.
AI Assistant Interactions: We collect text queries and prompts you enter when using the Platform’s AI assistant feature.
Support Data: If you contact us for support or to lodge a complaint, we may collect technical or other information from you through log files and other technologies, such as your app version, operating system, and device model, some of which may qualify as Personal Data (e.g., IP address). Such information will be used for the purposes of troubleshooting, customer support, software updates, and improvement of the Services in accordance with this Privacy Policy.
Technology Data: When you use the Services, our servers automatically record technical information, including your IP address, the date and time of each request, and the address of the request. When you sign up, sign in, or sign out, we also record the user agent your device reports. The app sends your device’s time zone so that chat responses and reminders reflect your local time. If you choose to search for nearby clinics, we collect your device’s location at that time and use it only for that search. If you turn on notifications, we collect a push notification token from Apple or Google so that we can send them. If you submit a support request, we collect your app version, operating system, and device model with it. We do not collect advertising identifiers, and the app does not use cookies or third-party analytics or crash-reporting tools. This information is used to provide the Services, keep them secure, and troubleshoot problems.
How Will zLifespan Use Your Personal Data?
zLifespan processes your Personal Data based on legitimate business interests, the fulfillment of our Services to you, compliance with our legal obligations, and/or your consent. We only use or disclose your Personal Data when it is legally mandated or where it is necessary to fulfill those purposes described in this Privacy Policy. Where required by law, we will ask for your prior consent before disclosing your Personal Data to a third party.
More specifically, zLifespan processes your Personal Data for the following legitimate business purposes:
- To provide the Services;
- To fulfill our obligations to you under the zLifespan Terms of Use;
- To communicate with you about and manage your User Account;
- To properly store and track your data within our system;
- To respond to lawful requests from public and government authorities, and to comply with applicable state/federal law, including cooperation with judicial proceedings and court orders;
- To protect our rights, privacy, safety, or property, and/or that of you or others by providing proper notices, pursuing available legal remedies, and acting to limit our damages;
- To handle technical support and other requests from you;
- To enforce and ensure your compliance with our zLifespan Terms of Use or the terms of any other applicable services agreement we have with you;
- To manage and improve our operations and the Services, including the development of additional functionality;
- To manage payment processing;
- To evaluate the quality of service you receive, identify usage trends, and improve your user experience;
- To keep our Services safe and secure;
- To send you information about changes to our terms, conditions, and policies; and
- To allow us to pursue available remedies or limit the damages that we may sustain.
Does zLifespan Use Personal Data for Analytics?
zLifespan does not use third-party service providers to monitor and analyze the use of the Platform as part of our Services.
Where Is Personal Data Processed?
The Personal Data we collect through the Services will be stored on secure servers in the United States. Personal Data may be transmitted to third parties, which parties may store or maintain the data on their secure servers. We store Personal Data on servers in the United States.
With Whom Does zLifespan Share Personal Data?
We may share your personal information with the following categories of individuals/entities:
Business Partners and Vendors: We share Personal Data with a limited number of partners, service providers, and other persons/entities who help run our business (“Business Partners”). Specifically, we may employ third-party companies and individuals to facilitate our Services, provide Services on our behalf, or perform Service-related functions. Our Business Partners are contractually bound to protect your Personal Data and to use it only for the limited purpose(s) for which it is shared. Business Partners’ use of Personal Data may include, but is not limited to, the provision of services such as data hosting, IT services, customer services, and payment processing.
Our Advisors: We may share your Personal Data with third parties that provide advisory services to zLifespan, including, but not limited to, our lawyers, auditors, accountants, and banks (collectively, “Advisors”). Personal Data will only be shared with Advisors if zLifespan has a legitimate business interest in the sharing of such data.
Third Parties Upon Your Direction or Consent: You may direct zLifespan to share your Personal Data with third parties, such as your designated healthcare providers or care team members. Upon your request and consent, we may share such Personal Data with those third parties that you identify. While Personal Data you input and manage directly in the Platform is non-HIPAA consumer health data, messages and records transmitted directly to or from your healthcare provider or care team through a provider-messaging workflow are handled by zLifespan as a “Business Associate” under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and governed by a Business Associate Agreement (“BAA”) between zLifespan and your healthcare provider or care team.
Third Parties Pursuant to Business Transfers: In the event of a reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of zLifespan’s corporate entity, assets, or stock (including in connection with any bankruptcy or similar proceedings), we may share your Personal Data with a third party.
Government and Law Enforcement Authorities: If reasonable and necessary, we may share your Personal Data to (i) comply with legal processes or enforceable governmental requests, or as otherwise required by law; (ii) cooperate with third parties in investigating acts or omissions that violate this Privacy Policy or the zLifespan Terms of Use; or (iii) bring legal action against someone who may be violating the zLifespan Terms of Use or who may be causing intentional or unintentional injury or interference to the rights or property of zLifespan or any third party, including other users of our Services.
How Long Does zLifespan Retain Personal Data?
zLifespan retains your Personal Data only if necessary and as required for our business operations, the provision of Services, archival purposes, and/or to satisfy legal requirements. The exact period of retention will depend on: (i) the amount, nature, and sensitivity of the Personal Data; (ii) the personal risk of harm for unauthorized use or disclosure; (iii) the purposes for which we process your Personal Data, including whether those purposes can be achieved through other means; and (iv) business operations and legal requirements. In general, zLifespan deletes your Personal Data within thirty (30) days after your User Account is closed (the “Retention Period”), unless applicable law requires us to keep it longer or it is needed for a pending dispute. Copies held in backups are deleted when those backups expire on their normal schedule. Personal Data you chose to share with your healthcare provider becomes part of that provider’s records and is retained under the provider’s own policies.
At the end of the applicable Retention Period, we will remove your Personal Data from our databases and will require that our Business Partners remove any identifiable Personal Data from their databases. If there is any data that we are unable to delete entirely from our systems for technical reasons, we will put in place appropriate measures to prevent any further processing of such data. Please note that once we disclose your Personal Data to third parties, we may not be able to access that Personal Data and we cannot force the deletion or modification of such information by third parties.
What Happens to Personal Data Submitted by Minors?
zLifespan does not knowingly collect Personal Data from individuals under the age of 18. The Services are intended only for adults 18 and older, and each User Account is for one adult’s own use. Registration by individuals under 18 is prohibited, and Users may not create accounts or profiles for children or other dependents. If we learn that we have collected Personal Data from an individual under 18, we will deactivate the associated User Account and take reasonable measures to promptly delete such data from our records. If you are aware of an individual under the age of 18 accessing the Services, please contact us at privacy@zlifespan.com.
User Rights
What Rights Do Users Have Concerning Their Personal Data?
As a user of zLifespan’s Services, you have certain rights relating to your Personal Data. These rights are subject to local data protection and privacy laws and may include the right to:
- Access Personal Data held by zLifespan;
- Erase/delete your Personal Data, to the extent permitted by applicable data protection and privacy laws and to the extent technologically feasible;
- Receive communications related to the processing of your Personal Data;
- Restrict the processing of your Personal Data to the extent permitted by law;
- Object to the further processing of your Personal Data, including the right to object to marketing;
- Request that your Personal Data be transferred to a third party, if possible;
- Receive your Personal Data in a structured, commonly used, and machine-readable format; and/or
- Rectify inaccurate personal information and, considering the purpose of processing the Personal Data, ensure it is complete.
Where the processing of your Personal Data by zLifespan is based on consent, you have the right to withdraw that consent at any time. If you would like to withdraw your consent or exercise any of the above rights, please contact us at privacy@zlifespan.com, submit a request at https://privacy.zlifespan.com, or call +1 201-614-5203.
How Can Users Update, Correct, or Delete Personal Data or Their User Account?
You have the right to request restrictions on the uses and disclosures of your Personal Data. While we are not required to agree to all restriction requests, we will attempt to accommodate reasonable requests when appropriate.
You may change your email address and other contact information by accessing your User Account. If you need to make changes or corrections to other information, you may contact us at privacy@zlifespan.com. To comply with certain requests to limit the use of your Personal Data, we may need to terminate your ability to access and/or use some or all the Services. BY REQUESTING TO LIMIT THE USE OF YOUR PERSONAL DATA OR DELETE PERSONAL DATA, YOU ACKNOWLEDGE AND AGREE THAT ZLIFESPAN WILL NOT BE LIABLE TO YOU FOR ANY CORRESPONDING LIMITATION IN THE SCOPE OF SERVICES OR TERMINATION OF SERVICES AS NECESSARY TO COMPLY WITH YOUR REQUEST.
You have the right to request the deletion of any Personal Data from your User Account or zLifespan Services. To request deletion of your Personal Data, please submit a request at https://privacy.zlifespan.com or email us at privacy@zlifespan.com, and include a description of the Personal Data you would like removed. We will respond to all requests for data deletion as soon as reasonably possible.
Should you decide to delete your User Account entirely, you may do so through your account settings in the app, through our privacy request form at https://privacy.zlifespan.com, or by emailing privacy@zlifespan.com. By terminating your User Account, you agree that you will not be able to access any information previously contained in your User Account. You further understand that it may not be technologically possible to remove all your Personal Data from our systems. While we will use reasonable efforts to remove your Personal Data, the need to back up our systems to protect information from inadvertent loss means a copy of your Personal Data may exist in a non-erasable form that will be difficult or impossible for us to locate or remove.
Protection of Personal Data
Is Personal Data Secure?
zLifespan understands the importance of data confidentiality and security. We use a combination of reasonable physical, technical, and administrative security controls to (i) maintain the security and integrity of your Personal Data; (ii) protect against any threats or hazards to the security or integrity of your Personal Data; and (iii) protect against unauthorized access to or use of such information in our possession or control that could result in substantial harm to you.
While zLifespan uses reasonable security controls, WE CANNOT GUARANTEE OR WARRANT THAT SUCH TECHNIQUES WILL PREVENT UNAUTHORIZED ACCESS TO YOUR PERSONAL DATA. ZLIFESPAN IS UNABLE TO GUARANTEE THE SECURITY OR INTEGRITY OF PERSONAL DATA TRANSMITTED OVER THE INTERNET, AND THERE IS NO GUARANTEE THAT YOUR PERSONAL DATA WILL NOT BE ACCESSED, DISCLOSED, ALTERED, OR DESTROYED BY BREACH OF ANY OF OUR PHYSICAL, TECHNICAL, OR ADMINISTRATIVE SAFEGUARDS. ACCORDINGLY, WE DO NOT AND CAN NOT ENSURE OR WARRANT THE SECURITY OR INTEGRITY OF ANY PERSONAL DATA YOU TRANSMIT TO US. YOU ASSUME THE RISK THAT UNAUTHORIZED ENTRY OR USE, HARDWARE OR SOFTWARE FAILURE, AND OTHER FACTORS MAY COMPROMISE THE SECURITY OF YOUR PERSONAL DATA AT ANY TIME.
What Safeguards Does zLifespan Have in Place to Secure Personal Data?
zLifespan stores Personal Data on secured servers and uses a combination of technical, administrative, and physical safeguards to protect your personal information. Such safeguards include, but are not limited to: encryption in transit and at rest, access controls, and secure credential handling.
How Can Users Protect Their Personal Data?
You are solely responsible for preventing unauthorized access to your devices and your User Account by protecting your account credentials and limiting access to your devices. zLifespan has no access to or control over your device’s security settings, and it is your responsibility to implement any device-level security features and protections you feel are appropriate (e.g., password protection, encryption, remote wipe capability). We recommend that you take all appropriate steps to secure any device that you use to access our Services.
Please note that zLifespan will never send you an email requesting confidential information, such as account numbers, usernames, passwords, or Social Security Numbers. If you receive a suspicious email from zLifespan, please notify us at privacy@zlifespan.com.
Further, if you know of or suspect any unauthorized use or disclosure of your User Account information or any other security concern, please notify zLifespan immediately.
What If zLifespan Experiences a Data or Security Breach?
zLifespan takes the security of your Personal Data seriously. In the event of a data or security breach, zLifespan will take the following actions: (i) promptly investigate the security incident, validate the root cause, and, where applicable, remediate any vulnerabilities within zLifespan’s control which may have given rise to the security incident; (ii) comply with laws and regulations directly applicable to zLifespan in connection with such security incident; (iii) as applicable, cooperate with any affected zLifespan User or client in accordance with the terms of zLifespan’s contract with such User or client; and (iv) document and record actions taken by zLifespan in connection with the security incident and conduct a post-incident review of the circumstances related to the incident and actions/recommendations taken to prevent similar security incidents in the future. zLifespan will notify you of any data or security breaches as required by and in accordance with applicable law.
In the event of a data or security breach involving unsecured identifiable consumer health data, zLifespan will investigate promptly and notify affected individuals and the Federal Trade Commission (“FTC”) without unreasonable delay, and in no case later than sixty (60) calendar days following discovery, in compliance with the FTC Health Breach Notification Rule (16 C.F.R. Part 318). If five hundred (500) or more residents of a single state are affected, we will also issue required media notices and notify relevant state regulatory authorities.
Advertising, Marketing, and Tracking
Does zLifespan Send Marketing or Advertisement Materials?
We may send you marketing about zLifespan’s own products and services, and you can opt out at any time. We do not sell your Personal Data, and we do not share it with third parties for their own marketing.
Can Users Opt-Out of Receiving Communications from zLifespan?
We may send communications, including emails, to you regarding your User Account and the Services. You can choose to filter any User Account and Services emails using your email settings, but we do not provide an option for you to opt-out of these communications.
What Is zLifespan’s Cookie Policy?
The zLifespan app does not use cookies. When you sign in to a connected service, such as a healthcare provider, insurer, or wearable account, that service’s sign-in page opens in your device’s web browser, and any cookies are set by that service under its own policies. The use of cookies on our website is described in the zLifespan Website Privacy Policy.
Do Not Track Disclosure
Some web browsers may transmit do not track (“DNT”) signals to websites with which the user communicates. To date, there is no industry standard for DNT, and users cannot know how a given company responds to a DNT signal they receive from browsers. zLifespan is committed to remaining apprised of DNT standards. However, zLifespan does not support DNT browser settings and does not currently participate in any DNT frameworks that would allow zLifespan to respond to signals or other mechanisms regarding the collection of your personal information.
California Privacy Rights
If you are a California resident, the California Consumer Privacy Act (“CCPA”) may apply to you.
Under California Civil Code sections 1798.100-1798.199, California residents are entitled to ask for and obtain from us an annual list identifying the categories of personal customer information which we shared, if any, with our affiliates and/or third parties in the preceding calendar year for marketing purposes. This list will be provided free of charge. Contact information for such affiliates and/or third parties must be included. If you are a California resident and would like a copy of this notice, please submit a written request to the following address:
zLifespan, Inc.
8 Providence Street
New Providence, NJ 07974
Additional State Privacy Rights
If you are a Connecticut, Nevada, or Washington resident, applicable state privacy laws may apply to you and to your personal information defined as “consumer health data”. Please see our Consumer Health Data Privacy Policy for more information about your rights.