Platform Privacy Policy

LAST UPDATED: April 13, 2023

This Platform Privacy Policy applies to information that InStep Health, Inc., its affiliates, and subsidiaries (“InStep Health,” “we,” “us,” or “our”) collects, receives, uses, and shares about individuals (“users” or “you”) from desktop, mobile devices, and/or internet-connected television (“Devices”) via our Services (as defined below). If you have questions about this Platform Privacy Policy, please email privacy@instephealth.com.

ACCESSIBILITY: IF YOU ARE HAVING ANY TROUBLE ACCESSING THIS PRIVACY POLICY, PLEASE CONTACT US TOLL FREE AT 1-800-783-7171 OR AT 1-847-915-6330, DURING THE HOURS OF 8 a.m.-5 p.m. CST.

This Platform Privacy Policy does not govern the collection and use of data on our website (www.InStepHealth.com) and sites or mobile applications that are managed by our platform members and Publishers, which will each have their own privacy policies and practices. We encourage you to refer to the Website Privacy Policy found at instephealth.com/privacy-policy.html and each platform members’ respective privacy policies for information about such data collection and use practices.

Please note that our privacy practices are subject to the applicable laws of the regions in which we operate. Accordingly, some additional region-specific terms will only apply to individuals in those locations, or as required by applicable laws. If you are a United States resident of California, Virginia, Colorado, Connecticut or certain other U.S. states, please see the sections titled California Privacy Rights, and Virginia/Colorado/Connecticut and certain other U.S. State Privacy Rights for specific disclosures with respect to our collection, use, and disclosure of your information and additional rights you have under applicable U.S. laws.

Overview of Platform Services

InStep Health is an online marketing and advertising technology platform specializing in audience insights and media buying (“Platform”). Through our Platform, advertisers (“Clients”) can place advertisements on websites, mobile apps, and other digital media properties (“Publisher Properties”) belonging to publishers from whom we have purchased media inventory (“Publisher”). Our Platform uses data and technology to help Clients strategize and market their products and/or services, and track campaign performance via the Publisher Properties that fit your interests at the most relevant moments to you (“Services”).

Information We Collect, Store, and/or Access

When you visit a Publisher Property, we collect information about you and your Device. Note that some of this information (such as IP addresses and other unique identifiers) may be considered “personal information.” The information we collect may include the following:

• Information about Your Browser. This includes information about your browser type, browser language, browser settings, and our cookie information
• Information about Your Device. This includes information about your IP address, device type, device operating system, device make and model, device identifiers such as your IDFA (identifier for advertisers), MAID (mobile advertising identifier) or AAID (android advertising identifier), including through mobile applications and across multiple devices that you may use (“Device Identifiers”). We also collect information about your Device’s Internet Service Provider (ISP).
• Information about Your Interactions with Publisher Properties. This includes information about the Publisher Properties you visited or used, the date and time of such visits to Publisher Properties, and geolocation (including city, state, country, zip code, and in some instances, geographic coordinates). We only receive and collect this information from requests sent by our Publishers to fill a Publisher Property with an ad. We use this information to track your activity in connection with showing you an ad, or to associate our unique identifier (“UID”) with other identifiers associated with your browser or Device. We then use this information through our Platform to help decide whether to serve you an ad, to measure your interaction with an ad, and to help Clients serve more relevant ads to you.
• Information about Your Interactions with Ads. This includes information about the type of ad served to you, where the ad was served, whether you clicked on the ad, and whether you downloaded the ad’s app.
• Inferences About You. This information includes your interests or demographic information (your age or gender). We collect this information from third-party data management platforms. We sync this information to our Platform and UIDs to help our Clients serve more relevant advertisements to you. While we collect and generate such inferences, we do not intentionally collect any protected health information or other sensitive personal information.
• Information You Share with our Data Vendors. This information may include offline data about you, such as your name or email, that you allowed our Data Vendors to share with us for advertising purposes. We may sync this information with any other information we collect about you.
• Information about Your Identifiers. We collect information about health care professionals, including National Provider Identifiers, which we obtain from public sources.

Information Collected by Third Parties

Our Clients, Publishers, Data Vendors (as defined below), and each of their third-party service providers (collectively, “Third Parties”) may use their own or their affiliates’ cookies, web beacons, and/or other internet technology within ads and on the Publisher Properties. For example, when you click on an ad served on a Publisher Property, both our Client and Partner may drop their own cookies to collect information about you. We do not control the information collection and usage practices of these Third Parties. Therefore, we recommend that you review the terms and privacy policy on such Third Parties’ websites.

How We Collect Information

Cookies and Similarly Technologies. We use cookies, pixels, scripts, web beacons, and/or other similar technology to help us understand your digital actions when you visit a Publisher Property on your Device. For example, when you interact with ads presented on our Publisher Properties, cookies on such Publisher Properties allow us to collect information, like your IP address or other device identifiers, from your Device. We may also receive your Device Identifiers from Third Party cookies, which help us to reach you on Publisher Properties.

We use Google Analytics. For information about Google Analytics please click on this link: https://www.google.com/policies/privacy/partners/. To opt-out of Google Analytics, please copy and paste “tools.google.com/dlpage/gaoptout” into your browser and download the Google Analytics opt-out browser add-on.

Third Party Data Providers. We also receive other data (e.g., demographic information) from Third Party data management platforms that separately collect and use your information from visits to various websites or applications to create “segments” – groups of users that are inferred to share similar interests. We may use information about your inclusion in specific segments based on Client requests so that they may serve more relevant ads to you.

How We Use Your Information

We use the data we collect for these basic purposes:

• Core Functionality and Improvement. We use the information we collect to run the core functionalities of the Services and to improve the utility and accessibility of the Services such as by adding new features or capabilities.
• Research and Development. We use the information we collect for compiling statistics and conducting research and development for our internal business purposes.
• Performance Analytics. For example, analyzing and reporting on ad campaigns and performance, such as number of ad views and click rates on ads.
• Performance of the Services. For example, limiting the number of times you see a particular ad.
• Enabling Clients to control ad targeting through the Platform. For example, showing ads based on the content you are viewing, geographically targeting ads to users located near a local Client, requesting to target users who fit into certain interest-based segments, or remarketing to such users.
• Security, Safety, and Dispute Resolution. We use data to protect the security and safety of our Platform, to detect and prevent fraud, to protect against misuse or unauthorized use of the Platform, to resolve disputes, to enforce our agreements, to limit our legal liability and protect our rights or to protect the rights, property or safety of other users or the public.
• Communications. If you email us with any questions or concerns, we may use any personally identifiable information that you provide to us in such email to respond to you.
• Legal Obligations. We may provide access to your information, including personally identifiable information, when legally required to do so, to comply with a court order, to cooperate with police investigations or other legal proceedings.
• Mergers and Acquisitions. If we go through a business transition, such as a merger, acquisition by another company, or sale of all or a portion of its assets, your information will likely be among the information transferred. You will be notified by a prominent notice on this Platform Privacy Policy of any such change in ownership or control of your data.
• Other Purposes. We may use information for any purposes disclosed to you at the time we collect such information or as otherwise stated in this Platform Privacy Policy.

Who We Share Your Information With

We share your information that we collect in the following cases:

• Data Vendors. We may share your information with our data management platform, identity resolution providers, and other companies that provide data –related services to us that allow us to maintain and run the Platform and provide the Services (“Data Vendor(s)”).
• Service Providers. We share your information with our service providers, who provide services on our half and at our instruction. We share information with service providers for the following purposes:
  • Support and Development. We may share your information to provide technical and development support for purposes of maintenance and improvement of the Platform and Services.
  • Provision of Services. Functionality and performance support for purposes of providing Clients with access to ad targeting controls.
  • Communications. We may share your information in external and internal communications support for purposes of providing you with responding to your inquiries and discussing any technical, security or other issues internally.
  • Technology support. We may share your information with third-party services that provide us with infrastructure for the purpose of providing us with software, networking, storage, and other related technology required to run our Platform.
• InStep Health Affiliates. We share your information with our affiliates, subsidiaries, and parent companies to use for the purposes described in this Platform Privacy Policy.
• Mergers and Acquisitions. We may share your information in connection with a business transition, such as a merger, acquisition by another company, or sale of all or a portion of its assets, to a third-party buyer.
• Law Enforcement and Regulatory Authorities. We may share your information with law enforcement, regulatory authorities, courts with competent jurisdictions, emergency services or other necessary third parties when legally required to do so, to comply with a court order, to cooperate with police investigations, or for other legal proceedings.

Your Choices and Controls

You have various options to opt-out of receiving targeted advertising that our Clients may conduct via our Platform. Note that different devices require separate opt-outs because each Device type uses different technologies.

• Desktop-Based Opt-Out Mechanism: If you wish to opt-out of interest-based advertising provided by InStep Health through the Publisher Properties (when our Clients show you more relevant ads based on your inferred interests), you may use our website’s opt-out tool at https://www.instephealth.com/opt-out.html.
• You may visit www.aboutads.info to learn more about targeted advertising and how to opt-out of this type of advertising by certain companies participating in various advertising networks. Because InStep Health adheres to Digital Advertising Alliance’s (“DAA”) Self-Regulatory Principles, you can opt-out of targeted advertising by participating companies (including InStep Health) at: aboutads.info/choices/.
• Mobile App-Based Opt-Out Mechanism: You may opt-out of targeted advertising provided by InStep Health by downloading and using the “AppChoices” mobile application, which you can download to your mobile device from your mobile phone’s app store or via the Digital Advertising Alliance App Choices page here.

Please note that electing to opt-out will not stop advertising from appearing on your device. The ads you see will simply be less relevant to your interests. When you opt out, we record the opt-out on our servers and on cookies in the browser of your Device, and InStep Health will no longer serve you targeted ads on that browser on such Device. If you configure your browser to reject certain cookies, the opt-out may not function properly. If you change browsers or Devices, or delete cookies, you may need to opt-out again to stop receiving targeted ads.

Cookie-based opt-outs are not effective on some mobile services. Users may opt out of certain advertisements on mobile applications or reset advertising identifiers via their device settings. To learn how to limit ad tracking or to reset the advertising identifier on your iOS and Android device, click on the following links:

iOS - https://support.apple.com/en-us/HT202074

Android - https://support.google.com/ads/answer/2662922?hl=en

More information about opting out on mobile devices is available here - https://www.networkadvertising.org/mobile-choice/

Retention of Information

We only keep your personal data as long as it is necessary for the purposes set forth in this Platform Privacy Policy (such as for legitimate business purposes and as permitted by applicable law). The cookies we set on your browser or Device expire within eighteen (18) months after collection. We retain all other information, such as your IP address and other information described above, for up to eighteen (18) months. After 18 months, we anonymize and/or aggregate all information unless we need that information to comply with our legal obligations, resolve disputes or enforce agreements. When we no longer need any collected information, it is deleted, anonymized, and/or aggregated.

Security

We have implemented industry-standard technical and organizational security measures to protect your information from unauthorized access and improper use. From time to time, we review our security procedures to consider appropriate new technology and methods. Please be aware though, that, despite our reasonable efforts, no security measures are impenetrable, though we take all reasonable precautions to protect against security incidents.

Your Rights as a United States Resident

The residents of certain U.S. states have additional rights regarding the collection, processing, and use of their personal information.

California Privacy Rights

The California Consumer Privacy Act of 2018 (“CCPA”), as amended by the California Privacy Rights Act of 2020, provides you with specific rights regarding your "personal information," as that term is defined under the CCPA. This section describes the rights that California consumers have and explains how to exercise those rights. For the purposes of this section, personal information does not include: (i) information that is lawfully made available from federal, state or local government records; (ii) de-identified or aggregated data; or (iii) information excluded from the scope of the CCPA. To be clear, these rights are granted only to the extent that you are a California consumer and we are acting as a “business” under the CCPA with respect to your personal information. The rights in this section are not intended to grant you additional rights, but only your rights under the CCPA.

During the past 12 months, we have collected the categories of information set forth above in the section “Information we Collect, Store and/or Access”, have used it for the purposes set forth above in the section “How We Use Your Information” and have shared it with the parties set forth above in the section “Who We Share Your Information With.” If you are located in California, you have the right to request that we:

• Delete your personal information;
• Provide access to categories of personal information which we have collected about you;
• Provide access to specific pieces of personal information which we have collected about you;
• Correct inaccurate personal information; and
• Opt-out of the sale of your personal information, including the sharing of your personal information for cross contextual behavioral advertising. Some browsers offer you the ability to opt out of cookie-based and other online tracking, which may be considered a “sale” or “sharing” of your personal information. At this time, we only respond to browser-based opt-out signals sent through the Global Privacy Control or as otherwise required by applicable law. When you opt-out of sale or share via the GPC, we honor that request in the same manner as we honor all do not sell/share requests. We do not respond to do not track or other browser-based signals. We do not knowingly sell or share the personal information of anyone under 16 years of age.

You also have the right to be free from discrimination as a result of exercising these rights.

If you are a California resident, you may designate an authorized agent to make a request to access or a request to delete on your behalf. We will respond to your authorized agent’s request if they submit proof that they are authorized to act on your behalf, such as a signed document by you with proof of California residency. We may deny requests from authorized agents who do not submit proof that they have been authorized by you to act on their behalf or are unable to verify their identity after submitting a request.

Virginia/Colorado/Connecticut and certain other U.S. State Privacy Rights

If you are located in Virginia, Colorado, Connecticut or another U.S. state with a consumer privacy law that applies to us and you, you have the right to request that we:

• Delete your personal information;
• Provide access to categories of personal information which we have collected about you;
• Provide access to specific pieces of personal information which we have collected about you;
• Correct inaccurate personal information;
• Opt-out of the sale of your personal information; and
• Opt-out of targeted advertising.

You also have the right to be free from discrimination as a result of exercising these rights, and you have the right to appeal a decision to not take action on a request.

Exercising your rights:
If you are a resident of the applicable states above and wish to submit such a request, please go to https://www.instephealth.com/opt-out.html. We will need to verify your identity before responding to your requests.

Residents of the applicable states above who wish to opt out of the sale of their personal information can click https://www.instephealth.com/opt-out.html. We will need to verify your identity before responding to your requests, such as providing proof of residency.

Children’s Privacy

InStep Health does not direct ads via the Platform to children under the age of 16 years old or knowingly collect information from children under the age of 16 years old.

Changes to this Policy

If we change our privacy practices, we will post those changes to this Platform Privacy Policy or other places we deem appropriate so that you are aware of what information we collect, how we use it, and under what circumstances if any, we disclose it.

We reserve the right to change this Platform Privacy Policy at any time, so please review it frequently. If we make material changes to this Platform Privacy Policy, we will notify you here prior to the change becoming effective. You can tell when this Platform Privacy Policy has been last updated by checking the date at the top of this page.

How to Contact Us

If you have questions or complaints regarding our privacy policy or practices, you may contact us using the following details:

InStep Health, Inc.
ATTN: Privacy Compliance
111 Water Street
East Dundee, IL