This policy is provided under the Washington My Health My Data Act, Nevada SB 370, and the Connecticut Data Privacy Act. It applies to consumer health data — information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status, including efforts to seek health services. It is separate from, and in addition to, our Privacy Policy.
The short version: we collect the minimum needed to enroll you and connect you to a clinician. We do not sell it. We do not share it for advertising. We run no advertising or analytics trackers on this website.
What consumer health data we collect
- Identity and contact information you provide at signup: name, date of birth, sex, email, phone, and mailing address, for you and for the children under 18 you add to your plan. Every member 18 and over provides their own information under their own account.
- The fact that you signed up for a telehealth membership and, if applicable, that a visit occurred and was paid for. The existence of a visit is health-related information; we treat it accordingly.
- Messages you send us through the contact form or support, which may contain health information if you choose to include it.
We do not collect your diagnoses, visit notes, test results, prescriptions, biometric data, or precise geolocation. Those clinical records are created and held by the treating provider and DrCare247, not by Bivvy.
Where it comes from
Directly from you. We do not buy consumer health data, and we do not obtain it from data brokers, advertising platforms, or other third-party sources.
Why we collect it and how we use it
- To create and manage your membership and your family roster;
- To connect you and your family members to a licensed clinician through DrCare247;
- To process payments and prevent fraud;
- To respond to you when you contact us; and
- To secure and operate the service and meet our legal obligations.
Each of these is necessary to provide the service you asked for. We do not process consumer health data for any purpose beyond these without first obtaining your separate consent.
Who we share it with
We share only what is necessary, only with these categories of recipients, and only for these purposes:
- DrCare247 and the treating providers — to establish your care record and deliver visits;
- Stripe — payment processing;
- Clerk — account authentication;
- SendGrid — transactional email such as family invitations and support replies;
- Google Cloud — hosting and encryption key management, under a Business Associate Agreement; and
- Law enforcement or regulators — only when required by law or to protect someone from harm.
We do not sell consumer health data, and we have never sold it. We do not share consumer health data with advertising platforms, data brokers, or social media companies. We do not use it for targeted advertising, cross-context behavioral advertising, or profiling. We do not upload customer lists to any advertising platform.
Tracking technologies
We do not run advertising pixels, tags, or software development kits from Meta, Google, TikTok, Snap, Reddit, LinkedIn, or any similar platform on this website. We use no third-party analytics. The only cookies we set are strictly necessary to keep you signed in and to process payments. We do not use geofencing of any kind, and we do not operate any geofence around any facility that provides health care services.
Your rights
Regardless of where you live, you may:
- Confirm whether we are collecting, sharing, or selling your consumer health data, and receive a list of all third parties with whom we have shared it;
- Withdraw consent to our collection and sharing of your consumer health data;
- Delete your consumer health data. On a deletion request we will delete the data from our records and notify all of our service providers, processors, and affiliates to do the same.
An adult member on someone else's plan makes these requests for themselves. The person paying for their seat cannot make them on their behalf.
Email privacy@bivvyhealth.com with the subject line Consumer Health Data Request. Include the email address on your account so we can verify the request. We will respond within 30 days and may extend once by 30 days where reasonably necessary, in which case we will tell you why.
Withdrawing consent or deleting your data may mean we can no longer provide the membership, since we need this information to connect you to care. We will tell you before that happens.
Appeals
If we decline a request, we will explain why. You may appeal by replying to our decision or emailing privacy@bivvyhealth.com with the subject line Appeal. We will respond to an appeal within 45 days. If we deny the appeal, we will give you a way to contact your state attorney general to submit a complaint.
Changes
We will not collect, use, or share consumer health data for any purpose not described here without first obtaining your affirmative consent. If we make a material change to this policy, we will update the effective date and notify affected members.