Privacy Policy & HIPAA Notice

1. Information We Collect

Depending on how you use the Services, we may collect the following categories of information.

1.1 Information You Provide

You may provide information when you:

• create an account;
• create or manage a Provider profile;
• submit an inquiry to a Provider;
• submit a review or rating;
• contact us;
• subscribe to communications;
• request information or access educational resources, including e-books, guides, or other downloadable materials;
• request information;
• participate in surveys or promotions;
• communicate with customer support; or
• otherwise use features that allow you to submit information.

This information may include your name, email address, telephone number, account credentials, location, professional information, and other information you choose to provide. When you request access to an e-book, guide, or other educational resource, we may collect your email address to provide or facilitate access to the requested resource, communicate with you regarding your request, and, where permitted by law and with any required consent, send related communications.

We collect personal information only for identified, reasonable, and legitimate purposes connected with the Services, subject to applicable law.

1.2 Health-Related Information

Because Liver Directory is focused on liver health, users may voluntarily provide health-related information.

This may include information concerning:

• symptoms;
• diagnoses or medical conditions;
• treatments;
• medications;
• laboratory or test information;
• healthcare providers;
• insurance;
• medical history;
• health concerns; and
• other information relating to an individual's health.

Please do not provide more health information than is reasonably necessary for the particular feature you are using.

Where applicable law requires express or affirmative consent for the collection, use, or sharing of sensitive or consumer health data, we will obtain that consent before the applicable processing, unless an applicable legal exception applies.

If you submit a public review, comment, or other publicly visible content containing health information, that information may become publicly available.

1.3 Provider Information

Physicians and other healthcare Providers may provide information such as:

• name;
• professional title;
• specialty;
• license information;
• certifications;
• practice information;
• practice locations;
• contact information;
• professional biography;
• services offered;
• affiliations;
• photographs;
• insurance information; and
• other professional information.

Providers are responsible for ensuring that information they submit is accurate and that they have the authority and appropriate permissions to provide it.

1.4 Automatically Collected Information

When you use the Services, we and our service providers may automatically collect certain technical information, including:

• IP address;
• browser type;
• device type;
• operating system;
• pages viewed;
• referring and exit pages;
• approximate location;
• date and time of access;
• interactions with the Services;
• device identifiers; and
• other technical or usage information.

We will not use precise geolocation or geofencing in a manner prohibited by applicable law, including to identify, track, or send prohibited health-related messages to consumers seeking healthcare services where the Washington My Health My Data Act applies.

1.5 Cookies and Similar Technologies

We do not use advertising or analytics cookies, and we do not place tracking pixels or tags on the Services.

We use only what the Services need to work:

• one cookie that keeps a Provider signed in to the provider portal, set only when a Provider signs in; and
• your browser's session storage, which keeps your conversation with Aimy, our AI assistant, or a review you are writing while you move between pages. Your browser clears it when you close the tab.

Maps on the Services come from Google, and Provider introduction videos and the videos in our blog posts from YouTube or Vimeo. A map loads with any page that shows one; a video loads only when you play it. Google and YouTube may then set their own cookies under their own privacy policies.

Our newsletter emails may tell us whether an email was opened and which links were clicked.

If we add other cookies or similar technologies, we will update this Privacy Policy first and, where the law requires, ask for your consent.

1.6 Free Guides by Email

When you ask us to email you one of our free guides, we collect the email address you enter, your first name or initial if you choose to give it, the guide you asked for, and whether you also asked for our newsletter.

We use this information only to email you a link to download the guide, which works for 30 days, and to keep a record of your request. We send the guide only after you agree, in the request form, that we may use the information you submit for this purpose.

To protect you and others from unwanted emails, we limit how many guides can be requested in a day for each email address and each IP address.

If you also choose to receive our newsletter, we add your email address to our newsletter list. You can unsubscribe at any time with the link in every newsletter.

Our email service provider sends these emails on our behalf. You may ask us to delete your request at any time, as described in Section 8.3.

2. How We Use Information

We may use information we collect to:

• provide and operate the Services;
• create and manage accounts;
• maintain Provider profiles;
• facilitate communications between users and Providers;
• process Provider inquiries;
• publish reviews and other user content;
• respond to requests and support inquiries;
• improve and personalize the Services;
• analyze usage and performance;
• maintain security;
• prevent fraud, abuse, and unauthorized activity;
• comply with legal obligations;
• enforce our Terms and other agreements;
• communicate with you about the Services;
• send marketing communications where permitted by law; and
• perform other purposes disclosed at the time information is collected or otherwise permitted by law.

We do not use health-related information for purposes incompatible with the purpose for which it was collected.

If we intend to use personal information, including consumer health data, for a new purpose not previously disclosed, we will provide any notice and obtain any consent required by applicable law before doing so.

3. Provider Inquiries and Communications

If you submit an inquiry or request to contact a Provider through the Services, information you provide may be shared with the Provider or other parties involved in facilitating the inquiry.

For example, this may include your:

• name;
• contact information;
• inquiry;
• selected Provider;
• location; and
• information you voluntarily include in your message.

The Provider will be responsible for its subsequent use and handling of information after receiving it.

You should review the Provider's own privacy practices before providing additional information directly to that Provider.

Liver Directory does not control how an independent Provider uses information after receiving it directly from you, except to the extent required by applicable law or a contractual arrangement.

4. Reviews and Public Information

Some features of the Services may allow you to submit reviews, ratings, comments, questions, photographs, or other content.

Information that you choose to make public may be visible to other users and may be indexed by search engines or copied by third parties.

Do not publicly post another person's private or health information without appropriate authorization.

We may moderate, remove, restrict, or decline to publish content that violates our Terms, applicable law, or our content policies.

5. How We Share Information

We may disclose information to the following categories of recipients when reasonably necessary and permitted by law:

5.1 Healthcare Providers

We may share information with Providers when you request contact, submit an inquiry, or otherwise choose to communicate with a Provider through the Services.

5.2 Service Providers

We may use vendors and service providers that help us operate the Services, such as providers of:

• hosting;
• cloud storage;
• security;
• analytics;
• communications;
• customer support;
• payment processing;
• email services;
• technical infrastructure; and
• other business functions.

Where applicable, we require service providers to handle information according to our instructions and applicable contractual and legal requirements.

For purposes of applicable privacy laws, the categories of third parties with whom we may share information include healthcare Providers, hosting and cloud providers, security providers, analytics providers, communications and email providers, customer support providers, payment processors, technical infrastructure providers, professional advisers, and governmental or legal authorities where permitted or required by law.

5.3 Legal and Safety Purposes

We may disclose information when reasonably necessary to:

• comply with law, regulation, legal process, or governmental requests;
• protect the rights, safety, or property of Liver Directory or others;
• detect or prevent fraud, abuse, or security incidents;
• enforce our Terms; or
• respond to an emergency or other lawful request.

5.4 Corporate Transactions

Information may be transferred as part of a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar corporate transaction, subject to applicable law.

5.5 With Your Direction or Consent

We may disclose information when you request or authorize us to do so.

6. HIPAA and Protected Health Information

6.1 HIPAA Applicability

The Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) applies to certain healthcare providers, health plans, healthcare clearinghouses, and their business associates.

Not every entity that handles health-related information is a HIPAA covered entity or business associate. HHS explains that HIPAA's Privacy Rule applies to covered entities and, in relevant circumstances, business associates.

Accordingly, the fact that Liver Directory may receive or process health-related information does not by itself mean that all information handled through the Services is “protected health information” (“PHI”) under HIPAA.

6.2 When Liver Directory May Act as a Business Associate

In certain arrangements, Liver Directory may provide services to a healthcare Provider that involve creating, receiving, maintaining, or transmitting PHI on the Provider's behalf.

Where the relationship legally qualifies as a business associate relationship under HIPAA, the parties may enter into a separate Business Associate Agreement (“BAA”).

A BAA is generally used to establish permitted uses and disclosures of PHI and appropriate safeguards when a business associate performs covered functions or services for a covered entity.

Where applicable, the BAA will govern the parties' HIPAA-specific obligations.

6.3 Our Handling of PHI

If we are acting as a business associate and receive PHI on behalf of a covered entity, we will handle that PHI in accordance with the applicable BAA and applicable HIPAA requirements.

We will not use or disclose PHI except as permitted or required by the applicable BAA, HIPAA, or other applicable law.

6.4 Provider Responsibilities

Providers remain responsible for their own HIPAA obligations and for determining whether they are covered entities or otherwise subject to HIPAA.

Providers are responsible for ensuring that they have appropriate legal authority to provide information to Liver Directory and that their use of the Services complies with applicable privacy, security, confidentiality, and professional obligations.

6.5 HIPAA Is Not a General Guarantee

Liver Directory does not represent that every feature of the Services is subject to HIPAA or that every type of information submitted to the Services constitutes PHI.

Unless expressly stated in a separate agreement, you should not assume that a particular feature, communication, or information submission is a HIPAA-covered service.

Where applicable, privacy obligations may also arise under non-HIPAA laws that protect consumer health data. Compliance with HIPAA does not replace or limit obligations under other applicable privacy laws.

7. California Privacy Rights

Depending on your circumstances and whether applicable thresholds and exemptions apply, California privacy laws may provide certain rights concerning your personal information.

California law treats certain information relating to a consumer's health as sensitive personal information.

Depending on applicable law, these rights may include rights relating to:

• knowing about personal information collected;
• accessing personal information;
• correcting inaccurate personal information;
• deleting personal information;
• obtaining information about disclosures;
• opting out of certain sales or sharing activities;
• limiting certain uses of sensitive personal information; and
• non-discrimination for exercising applicable privacy rights.

The availability and scope of these rights depend on applicable law, your relationship with us, and applicable exemptions.

You may contact us using the information in Section 14 to exercise applicable privacy rights.

We may need to verify your identity before processing certain requests.

7.1 Canadian Privacy Rights

If you are in Canada and applicable law applies to our processing, you may have rights to know what personal information we collect, the purposes for which it is collected, how it is used or disclosed, access and correct your information, withdraw consent where permitted, and challenge our privacy practices. These rights may arise under PIPEDA or applicable substantially similar provincial privacy legislation, including Québec's private-sector privacy law as amended by Law 25.

For Québec residents, where applicable, we will provide privacy information in clear and simple language, obtain consent as required, maintain appropriate safeguards, address privacy complaints, and comply with requirements for transfers of personal information outside Québec, including applicable privacy impact assessments and contractual protections.

8. Your Privacy Choices

8.1 Marketing Communications

You may opt out of promotional emails by using the unsubscribe mechanism included in the communication.

Opting out of marketing communications does not prevent us from sending transactional, administrative, security, or service-related communications.

8.2 Cookies

We do not use advertising or analytics cookies, so there are no cookie settings to manage.

You can block or delete cookies, including those set by Google or YouTube, in your browser settings. Providers who block cookies cannot stay signed in to the provider portal.

8.3 Privacy Requests

You may contact us to request access, correction, deletion, or other privacy rights available to you under applicable law.

You may also withdraw consent for future collection, use, or sharing where withdrawal is permitted by applicable law. Withdrawal does not affect processing already carried out lawfully before withdrawal and may affect our ability to provide certain Services.

9. Data Retention

We retain personal information for as long as reasonably necessary to:

• provide the Services;
• maintain accounts and business records;
• fulfill the purposes described in this Privacy Policy;
• comply with legal, regulatory, accounting, or reporting obligations;
• resolve disputes;
• enforce agreements; and
• protect our legal rights.

Retention periods may vary depending on the type of information and the purpose for which it was collected.

When information is no longer reasonably necessary, we may delete, de-identify, aggregate, or otherwise dispose of it, subject to applicable law and legitimate business requirements.

Where applicable law requires deletion or anonymization when the purposes for which information was collected have been achieved, we will follow those requirements, subject to lawful exceptions and required retention periods.

10. Data Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, use, alteration, disclosure, or destruction.

However, no internet transmission, electronic storage system, or security measure is completely secure.

We cannot guarantee the absolute security of information transmitted to or stored by us.

If a privacy or security incident occurs, we will take reasonable measures to contain and address it and provide notifications or reports when required by applicable law.

11. Children's Privacy

The Services are intended for individuals who are 18 years of age or older.

We do not knowingly permit individuals under 18 to create accounts, submit reviews, or use features requiring submission of personal information.

If we learn that we have collected personal information from a person under 18 in violation of our policies or applicable law, we may take steps to delete the information and restrict the associated account.

Parents or legal guardians may contact us regarding information concerning a minor.

12. Third-Party Services

The Services may integrate with or link to third-party services.

Those third parties may independently collect information according to their own privacy policies.

We are not responsible for the privacy practices of third-party services that we do not control.

You should review the privacy policies of third-party services before using them.

13. International Users

Liver Directory is intended primarily for users in the United States.

If you access the Services from outside the United States, your information may be transferred to, stored in, or processed in the United States or other jurisdictions where we or our service providers operate.

Privacy and data protection laws in those jurisdictions may differ from the laws of your country.

If personal information of a Québec resident is communicated or entrusted to a person or service provider outside Québec, we will conduct and document any privacy impact assessment and use any written contractual protections required by applicable Québec law before the transfer, where the law applies.

14. Contact Us

If you have questions about this Privacy Policy or wish to submit a privacy request, contact us at: