Platform Privacy Policy

LAST UPDATED: September 2025

This Platform Privacy Policy applies to information that InStep Health, LLC its affiliates, and subsidiaries (“InStep Health,” “we,” “us,” or “our”) collects, receives, uses, and shares about individuals (“users” or “you”) from desktop, mobile devices, and/or internet-connected television (“Devices”) via our Services (as defined below). If you have questions about this Platform Privacy Policy, please email privacy@instephealth.com.

ACCESSIBILITY: IF YOU ARE HAVING ANY TROUBLE ACCESSING THIS PRIVACY POLICY, PLEASE CONTACT US TOLL FREE AT 1-800-783-7171 OR AT 1-847-915-6330, DURING THE HOURS OF 8 a.m.-5 p.m. CST.

This Platform Privacy Policy does not govern the collection and use of data on our website (www.InStepHealth.com) and sites or mobile applications that are managed by our platform members and Publishers, which will each have their own privacy policies and practices. We encourage you to refer to the Website Privacy Policy found at instephealth.com/privacy-policy.html and each platform members’ respective privacy policies for information about such data collection and use practices.

Please note that our privacy practices are subject to the applicable laws of the regions in which we operate. Accordingly, some additional region-specific terms will only apply to individuals in those locations, or as required by applicable laws. If you are a United States resident of a state with a comprehensive consumer privacy law, please see the sections titled Your Rights as a United States Resident for specific disclosures with respect to our collection, use, and disclosure of your information and additional rights you have under applicable U.S. laws.

Overview of Platform Services

InStep Health is an online marketing and advertising technology platform specializing in audience insights and media buying (“Platform”). Through our Platform, advertisers (“Clients”) can place advertisements on websites, mobile apps, emails, and other digital media properties (“Publisher Properties”) belonging to publishers from whom we have purchased media inventory (“Publisher”). Our Platform uses data and technology to help Clients strategize and market their products and/or services, and track campaign performance via the Publisher Properties that fit your interests at the most relevant moments to you (“Services”).

Information We Collect, Store, and/or Access

When you visit a Publisher Property, we collect information about you and your Device. Note that some of this information (such as IP addresses and other unique identifiers) may be considered “personal information” (also called “personal data”) under applicable laws. The information we collect may include the following::

IInformation about Your Browser. This includes information about your browser type, browser language, browser settings, and our cookie information.
Information about Your Device. This includes information about your IP address, device type, device operating system, device make and model, device identifiers such as your IDFA (identifier for advertisers), MAID (mobile advertising identifier) or AAID (android advertising identifier), including through mobile applications and across multiple devices that you may use (“Device Identifiers”). We also collect information about your Device’s Internet Service Provider (ISP).
Information about Your Interactions with Publisher Properties. This includes information about the Publisher Properties you visited or used, the date and time of such visits to Publisher Properties, and geolocation (including city, state, country, zip code, and in some instances, geographic coordinates). We only receive and collect this information from requests sent by our Publishers to fill a Publisher Property with an ad. We use this information to track your activity in connection with showing you an ad, or to associate our unique identifier (“UID”) with other identifiers associated with your browser or Device. We then use this information through our Platform to help decide whether to serve you an ad, to measure your interaction with an ad, and to help Clients serve more relevant ads to you.
Information about Your Interactions with Ads. This includes information about the type of ad served to you, where the ad was served, whether you clicked on the ad, and whether you downloaded the ad’s app.
IInferences About You. This information includes your interests or demographic information (your age or gender). We collect this information from third-party data management platforms. We sync this information to our Platform and UIDs to help our Clients serve more relevant advertisements to you. While we collect and generate such inferences, we do not intentionally collect any protected health information or other sensitive personal information.
Information You Share with our Data Vendors. This information may include offline data about you, such as your name or email, that you allowed our Data Vendors to share with us for advertising purposes. We may sync this information with any other information we collect about you.
Information about Your Identifiers. We collect information about health care professionals, including National Provider Identifiers, which we obtain from public sources

Information Collected by Third Parties

Our Clients, Publishers, Data Vendors (as defined below), and each of their third-party service providers (collectively, “Third Parties”) may use cookies, web beacons, and/or other internet technology within ads and on the Publisher Properties. For example, when you click on an ad served on a Publisher Property, both our Client and Publishers may drop their own cookies to collect information about you. We do not control the information collection and usage practices of these Third Parties. Therefore, we recommend that you review the terms and privacy policy on such Third Parties’ websites.

How We Collect Information

We use Google Analytics. For information about Google Analytics please click on this link: https://www.google.com/policies/privacy/partners/. To opt-out of Google Analytics, please copy and paste “tools.google.com/dlpage/gaoptout” into your browser and download the Google Analytics opt-out browser add-on.

Third Party Data Providers. We also receive other data (e.g., demographic information) from Third Party data management platforms that separately collect and use your information from visits to various websites or applications to create “segments” – groups of users that are inferred to share similar interests. We may use information about your inclusion in specific segments based on Client requests so that they may serve more relevant ads to you.

How We Use Your Information

We use the data we collect for these basic purposes:

Core Functionality and Improvement. We use the information we collect to run the core functionalities of the Services and to improve the utility and accessibility of the Services such as by adding new features or capabilities.
Research and Development. We use the information we collect for compiling statistics and conducting research and development for our internal business purposes.
Performance Analytics. For example, analyzing and reporting on ad campaigns and performance, such as number of ad views and click rates on ads.
Performance of the Services. For example, limiting the number of times you see a particular
Enabling Clients to control ad targeting through the Platform. For example, showing ads based on the content you are viewing, geographically targeting ads to users located near a local Client, requesting to target users who fit into certain interest-based segments, or remarketing to such users.
Security, Safety, and Dispute Resolution. We use data to protect the security and safety of our Platform, to detect and prevent fraud, to protect against misuse or unauthorized use of the Platform, to resolve disputes, to enforce our agreements, to limit our legal liability and protect our rights or to protect the rights, property or safety of other users or the public.
Communications. If you email us with any questions or concerns, we may use any personal information that you provide to us in such email to respond to you.
Legal Obligations. We may provide access to your information, including personal information, when legally required to do so, to comply with a court order, to cooperate with police investigations or other legal proceedings.
Mergers and Acquisitions. If we go through a business transition, such as a merger, acquisition by another company, or sale of all or a portion of its assets or a bankruptcy proceeding, your information will likely be among the information transferred. You will be notified by a prominent notice on this Platform Privacy Policy of any such change in ownership or control of your data.
Other Purposes. We may use information for any purposes disclosed to you at the time we collect such information or as otherwise stated in this Platform Privacy Policy.

Who We Share Your Information With

We share your information that we collect in the following cases:

Data Vendors. We may share your information with our data management platform, identity resolution providers, and other companies that provide data –related services to us that allow us to maintain and run the Platform and provide the Services (“Data Vendor(s)”)
Service Providers. We share your information with our service providers, who provide services on our behalf and at our instruction. We share information with service providers for the following purposes:
- Support and Development. We may share your information to provide technical and development support for purposes of maintenance and improvement of the Platform and Services.
- Provision of Services. Functionality and performance support for purposes of providing Clients with access to ad targeting controls.
- Communications. We may share your information in external and internal communications support for purposes of providing you with responding to your inquiries and discussing any technical, security or other issues internally.
- Technology support. We may share your information with third-party services that provide us with infrastructure for the purpose of providing us with software, networking, storage, and other related technology required to run our Platformm.
InStep Health Affiliates. We share your information with our affiliates, subsidiaries, and parent companies to use for the purposes described in this Platform Privacy Policy.
Mergers and Acquisitions. We may share your information in connection with a business transition, such as a merger, acquisition by another company, or sale of all or a portion of its assets, to a third-party buyer or in connection with a bankruptcy proceeding.
Law Enforcement and Regulatory Authorities. We may share your information with law enforcement, regulatory authorities, courts with competent jurisdictions, emergency services or other necessary third parties when legally required to do so, to comply with a court order, to cooperate with police investigations, or for other legal proceedings.

Your Choices and Controls

You have various options to opt-out of receiving targeted advertising that our Clients may conduct via our Platform. Note that different devices require separate opt-outs because each Device type uses different technologies.

Desktop-Based Opt-Out Mechanism: If you wish to opt-out of interest-based advertising provided by InStep Health through the Publisher Properties (when our Clients show you more relevant ads based on your inferred interests), you may use our website’s opt-out tool at https://www.instephealth.com/opt-out.html.
You may visit www.aboutads.info to learn more about targeted advertising and how to opt-out of this type of advertising by certain companies participating in various advertising networks through the Digital Advertising Alliance’s (“DAA”) Self-Regulatory Principles, you can opt-out of targeted advertising by participating companies (including InStep Health) at: aboutads.info/choices/.
Mobile App-Based Opt-Out Mechanism: You may opt-out of targeted advertising provided by third parties by downloading and using the “AppChoices” mobile application, which you can download to your mobile device from your mobile phone’s app store or via the DAA’s App Choices page here.

Please note that electing to opt-out will not stop advertising from appearing on your Device. The ads you see will simply be less relevant to your interests. When you opt out, we record the opt-out on our servers and on cookies in the browser of your Device, and InStep Health will no longer serve you targeted ads on that browser on such Device. If you configure your browser to reject certain cookies, the opt-out may not function properly. If you change browsers or Devices, or delete cookies, you may need to opt-out again to stop receiving targeted ads.

Cookie-based opt-outs are not effective on some mobile services. Users may opt out of certain advertisements on mobile applications or reset advertising identifiers via their device settings. To learn how to limit ad tracking or to reset the advertising identifier on your iOS and Android device, click on the following links:

iOS - https://support.apple.com/en-us/HT202074

Android - https://support.google.com/ads/answer/2662922?hl=en

More information about opting out on mobile devices is available here - https://www.networkadvertising.org/mobile-choice/

Retention of Information

We only keep your personal data as long as it is necessary for the purposes set forth in this Platform Privacy Policy (such as for legitimate business purposes and as permitted by applicable law). The cookies we set on your browser or Device expire within eighteen (18) months after collection. We retain all other information, such as your IP address and other information described above, for up to eighteen (18) months. After 18 months, we anonymize and/or aggregate all information unless we need that information to comply with our legal obligations, resolve disputes or enforce agreements. When we no longer need any collected information, it is deleted, anonymized, and/or aggregated.

Security

We have implemented industry-standard technical and organizational security measures to protect your information from unauthorized access and improper use. From time to time, we review our security procedures to consider appropriate new technology and methods. Please be aware though, that, despite our reasonable efforts, no security measures are impenetrable, though we take all reasonable precautions to protect against security incidents.

Your Rights as a United States Resident

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, New Hampshire, Delaware, Iowa, Nebraska, New Jersey, Tennessee, Minnesota, Maryland, or another U.S. state that has similar privacy legislation (collectively, “Covered States”), you may have specific rights regarding your personal information under: the California Consumer Privacy Act (“CCPA”), Virginia Consumer Data Protection Act, Colorado Privacy Act, Connecticut Data Privacy Act, Utah Consumer Privacy Act, Texas Data Privacy and Security Act, Oregon Consumer Privacy Act, Montana Consumer Data Privacy Act, New Hampshire Data Privacy Act, Delaware Personal Data Privacy Act, Iowa Consumer Data Protection Act, Nebraska Data Privacy Act, New Jersey Data Protection Act, Tennessee Information Protection Act, Minnesota Consumer Data Privacy Act, Maryland Online Data Privacy Act, or similar laws in other U.S. states (collectively, "State Privacy Laws"). This section describes the rights that consumers of Covered States have and explains how to exercise those rights. To be clear, these rights are granted only to the extent that you are considered a consumer of Covered State and we are acting as a “controller” or “business” (as applicable) under State Privacy Laws with respect to your personal information. The rights in this section are not intended to grant you additional rights, but only your rights under the State Privacy Laws.

During the past 12 months, we have collected the categories of information set forth above in the section “Information we Collect, Store and/or Access”, have used it for the purposes set forth above in the section “How We Use Your Information” and have shared it with the parties set forth above in the section “Who We Share Your Information With.”

If you are located in a Covered State, you may have the right to:

Request that we delete your personal information;
Request access to categories of personal information which we have collected about you
Request access to specific pieces of personal information which we have collected about you;
Request that we correct inaccurate personal information;
Request to receive your personal information in a portable and readily usable format (data portability);
Opt-out of the sale of your personal information;
Opt-out of targeted advertising (also called a “shared” under the CCPA); and
Opt-out of certain profiling activities, where required by applicable law.

At this time, we only respond to browser-based opt-out signals sent through the Global Privacy Control or as otherwise required by applicable law. When you opt-out of sale or share via the GPC, we honor that request in the same manner as we honor all do not sell/share/opt-out requests.

You also have the right to be free from discrimination as a result of exercising these rights, and you have the right to appeal a decision to not take action on a request.

If you are a resident of a Covered State, you may designate an authorized agent to make a request on your behalf. We will respond to your authorized agent’s request if they submit proof that they are authorized to act on your behalf, such as a signed document by you with proof of residency. We may deny requests from authorized agents who do not submit proof that they have been authorized by you to act on their behalf or are unable to verify their identity after submitting a request.

We may verify access and deletion requests, but will process opt-out requests without verification unless we suspect fraud.

Appeals Process for Privacy Rights Requests:

If we deny your privacy rights request, you may appeal our decision by contacting us at privacy@instephealth.com or by submitting an appeal through our online form at https://www.instephealth.com/opt-out.html within 60 days of receiving our decision. Please include your name, the original request, the date of our decision, and any information you believe supports your appeal.

We will review your appeal and respond in writing within 45–60 days, depending on applicable law. In certain circumstances, we may need additional time to respond; if so, we will notify you of the extension and the reason for it.

If your appeal is denied, our response will include a written explanation for the decision and information on how you may contact your state Attorney General or other applicable regulatory authority to submit a complaint..

Exercising your rights:
If you are a resident of the applicable states above and wish to submit such a request, please go to https://www.instephealth.com/opt-out.html. We will need to verify your identity before responding to your requests.

Residents of Covered States who wish to opt out of the sale, “share” or targeting adverting through use of their personal information can click https://www.instephealth.com/opt-out.html.

Children’s Privacy

InStep Health does not direct ads via the Platform to children under the age of 18 years old or knowingly collect information from children under the age of 18 years old.

Changes to this Policy

If we change our privacy practices, we will post those changes to this Platform Privacy Policy or other places we deem appropriate so that you are aware of what information we collect, how we use it, and under what circumstances if any, we disclose it. If the change results in data processing activities that are not reasonably necessary to or compatible with the original specified purposes that we disclosed in the prior version of our Privacy Policy, we will provide a reasonable opportunity for you to withdraw any prior consent to any further materially different collection, processing, or transfer of previously collected personal information under the changed terms.

We reserve the right to change this Platform Privacy Policy at any time, so please review it frequently. If we make material changes to this Platform Privacy Policy, we will notify you here prior to the change becoming effective. You can tell when this Platform Privacy Policy has been last updated by checking the date at the top of this page.

How to Contact Us

If you have questions or complaints regarding our privacy policy or practices, you may contact us using the following details::

InStep Health, Inc.
ATTN: Privacy Compliance
111 Water Street
East Dundee, IL 60118
Email: privacy@instephealth.com