Pharma Partnerships
Care Management
Clinical Trials

Privacy Policy

Effective August 6, 2024

IntroductionThis Privacy Policy describes how Spencer Health Solutions, Inc. (“SHS”, “we”, “our”, or “us”) collects, uses, discloses, shares, protects, or otherwise processes your Personal Information (as defined below) and what rights you have with regard to your Personal Information. We advise you to read this Privacy Policy carefully and keep a copy for your own records. This Privacy Policy is incorporated into and made a part of our End User License Agreement (EULA).This Privacy Policy applies to the Personal Information we obtain through your use of our spencer SmartHubTM device and other SHS devices (collectively, the “Devices”), mobile application (the “App”), websites viz:

and any other website that links to this Privacy Policy (collectively, the “Sites”), by email, phone, or other offline interactions (e.g., at a convention or event), or anywhere else we display this Privacy Policy (collectively, the “Services”).  This Privacy Policy applies to registered account holders (“Users”), visitors to the website and other interactions who are not yet Users (“Visitors”), and job applicants (“Applicants”).By using the Services, you agree to the policies and practices described in this Privacy Policy. In addition to this Privacy Policy, our End-User License Agreement (“EULA”) outlines the terms and conditions governing your use of the Services. You can access the EULA by clicking here: https://spencerhealthsolutions.com/terms-conditions/.If you have questions regarding the privacy of your personal information, please write to SHS’s Privacy Officer at dataprivacy@spencerhealthsolutions.com.ProcessorTo safeguard the privacy interests of our Users in the European Union or European Economic Area (“EU”), in the United Kingdom (“UK”), or in Switzerland, we have outsourced the processing of the Personal Information of these Users to Stichting Spencer Europe. Personal Information is processed exclusively by Stichting Spencer Europe.The controller of Personal Information processing in the EU is:Stichting Spencer EuropeWilhelm Rontgenstraat 16
1341 BC Almere, NetherlandsFor EU residents, if you have any questions about the processing of Personal Information, please contact us at any of the following:Via email:support.nl@spencerhealthsolutions.euTelephone number:+31 858 770653.We endeavor to treat such Personal Information of our Users as stated above as required by the EU’s General Data Protection Regulation (“EU GDPR”) or the UK’s General Data Protection Regulation (“UK GDPR”), or Swiss Federal Act on Data Protection (“FADP”), respectively. If you are an EU, UK, or Swiss resident or other individual whose personal information is subject to European data protection law, you have certain rights with respect to your personal information, and additional terms of this Privacy Policy apply to you and to your Personal Information. Please visit the section below “EU-U.S. Data Privacy Framework (EU-U.S. DPF) and to the rights of EU individuals” which also contains our Data Privacy Framework Notice.Information We Collect and How We Collect ItPersonal Information is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to you. It does not include aggregated, deidentified, or anonymized information that is maintained in a form that is not reasonably capable of being associated with or linked to you or a particular household or publicly available information from government records.Depending on how you interact with the Services, we may collect your Personal Information in the following ways:

  • Data You Provide. We collect certain Personal Information you choose to provide to us when you create an account, visit the Sites, or otherwise interact with the Services.
  • Information Collected Automatically. When you interact with the Sites or App, we may also automatically collect certain personal information using pixels, cookies, or similar tools as further described below.
  • Information from Third Parties.  We may also receive personal information from our business associates and other third-party sources, such disclosure is permissible under applicable laws.

Information We CollectWe may collect and process the following types of Personal Information from you, depending on your interaction with the Services and what information you choose to provide:

  • Contact information, such as your name, email address, phone number, address,  company affiliation, or job title;
  • Access information for Users, such as your log-in username and password details;
  • Online and technical identifiers, such as your IP (Internet Protocol) address, device ID, and other information about your device or browser collection through pixels, cookies, and similar tools; for more information, please see our Cookie Policy: https://spencerhealthsolutions.com/cookie-policy/
  • For Job Applicants, professional credentials, such as curriculum vitae/resume, work history, qualifications, or any other type of information that may be included on a resume or curriculum vitae;
  • Demographic information, such as age, date of birth, and gender of Users;
  • Medical or health information of Users;
  • Claims payment information of Users;
  • Information on the performance of the SHS product you use;
  • Communication and correspondence information, such as the content of communications Users send us to report a problem or to submit a query, or User responses to a survey for market research purposes;
  • Information related to transactions you engage in with us;
  • Any other information that you provide to us that can be used to identify you.

Why we collect your Personal InformationSHS uses Personal Information to operate our business and to deliver and improve the Services.SHS collects a variety of personal information, including contact details, user access information, online and technical identifiers, demographic data, general medical information regarding medicines prescribed, schedule adherence compliance and vital sign measurements, technical performance data about SHS products, and general communication content with SHS. This data may be collected automatically.SHS may use your data with your consent for specific purposes identified that align with SHS’ legitimate business interests, documented through “legitimate interest” assessments. Personal information may also be processed to comply with legal and compliance obligations, including regulatory investigation and reporting requirements.Personal data collected by SHS is processed in accordance with the Privacy Policy. Data is analyzed using statistical analysis, machine learning algorithms, and other techniques to improve services. To protect privacy, data is often anonymized or aggregated, preventing the identification of specific individuals. Data is retained only as long as necessary to fulfill its intended purposes or as required by law, after which it is securely deleted to prevent recovery.  Data is only accessible by individuals with a direct need to perform their business function or legal obligations.Personal data collected by SHS may be shared to comply with legal obligations, protect legitimate interests, pursue remedies, enforce agreements, or respond to emergencies. With your consent, data may also be shared with service providers like delivery services, financial institutions, clinical research organizations, care organizations, clinicians and pharmacies.Additionally, SHS uses Personal Information to:

  • Conduct activities for public health and interest;
  • Respond to questions or requests from you, deliver information about our products or Services that may be of interest to you, or otherwise communicate with you;
  • Compliance with legal or regulatory obligations (e.g., adverse event and product complaint reporting, exercising or defending legal claims, financial disclosure reporting, maintaining patient registries);
  • Enhance our products and Services, including through data analytics;
  • Engaging scientific experts and leaders;
  • Prevent fraud and protect the security of our systems;
  • Patient testimonials with express consent (for sales and marketing, advertising, training and education, public relations, and research)
  • Maintain product safety and product efficacy monitoring; and
  • Comply with law and other legal and business processes that are in SHS’s legitimate interest, inclusive of company record retention, safeguarding our physical and electronic workplace, maintaining our systems and records (e.g., testing, validation, fixing software errors), and management

When will we share your Personal Information?We will share your Personal Information as disclosed to you at the time of collection, or in the following circumstances:

  • Service Providers: We may provide your Personal Information to our service providers who help us run and manage our business and process Personal Information on our behalf. The categories of service providers may include delivery services, financial institutions, clinical research organizations, central laboratories, clinical database companies, payroll and benefit companies, and specialty pharmacies, among others.
  • Corporate Transaction: In the event SHS is involved in a merger, reorganization, acquisition, or sale of all or a portion of its assets, or other corporate transactions, we may disclose your Personal Information as part of that transaction.
  • As Required By Law: We may disclose your Personal Information if we determine that the disclosure is necessary: (i) to comply with any law applicable to us, a request from law enforcement, a regulatory agency, or other legal process; (ii) to protect the legitimate rights, privacy, property, interests or safety of SHS, our business partners, personnel, or the general public; (iii) to pursue available remedies or limit damages; (iv) to enforce our EULA; or (v) to respond to an emergency.

How can you request access, amendment, or deletion of your Personal Information?If you wish to request access to the Personal Information we maintain about you, or that we update, amend, or delete such information, you may do so by clicking here and following the instructions in the “Contact Us” section. We will address your request in accordance with applicable laws. Please understand that we may not be permitted to comply with requests to amend or remove Personal Information that relates to consumer product complaints; adverse events or reactions involving medicine, medical products, or medical devices; or other information that we are required to maintain in accordance with a court order or other legal or regulatory process.User Choice and Control Over Personal InformationOpt-Out Choices: We respect your privacy and provide you with the opportunity to exercise choices regarding the use of your personal information. You have the right to opt out of:

  1. The disclosure of your personal information to third parties, except when such disclosure is to an agent acting on our behalf and under our instructions.
  2. The use of your personal information for purposes that are materially different from the purposes for which it was originally collected or subsequently authorized by you.

To exercise your opt-out choices, we provide clear, conspicuous, and readily available mechanisms. You can opt out by, updating your preferences in your account settings, clicking an unsubscribe link in emails, or by contacting our customer service by clicking here and following the instructions in the “Contact Us” section.Sensitive Information: For any sensitive information we collect, including personal information specifying medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or information specifying the sex life of the individual, we will obtain your affirmative express consent (opt-in) before:

  1. Disclosing such information to a third party, unless the third party is an agent acting on our behalf and under our instructions.
  2. Using such information for a purpose other than those for which it was originally collected or subsequently authorized by you through the exercise of opt-in choice.

We will treat as sensitive any personal information received from a third party where the third party identifies and treats it as sensitive.Third-Party Agents: When we disclose personal information to third parties acting as agents to perform tasks on our behalf and under our instructions, we will enter into a contract with such agents to ensure that they provide at least the same level of privacy protection as required by the Data Privacy Framework.For further details or to exercise your choices, please contact us at dataprivacy@spencerhealthsolutions.com.Your Marketing ChoicesIf you are a recipient of marketing-related communications from us, you can unsubscribe at any time by following the opt-out instructions in the communication or by contacting us using the information in the “Contact Us” section. Please note that even if we stop all marketing communications, you may still receive administrative, legal, and other important communications from us.Information Supplied by Your Browser / Use of CookiesWe may also automatically collect certain personal information when you visit or use the Sites or App using pixels, cookies, or similar tools. A “cookie” is a small data file stored on your browser if you visit. We use pixels and cookies to collect information such as your device type, browser type, and IP address. We also track the content you visit on the Sites and duration on specific pages of the Sites to help us improve your access to the Sites and enhance our Services. Cookies also enable us to track your general location and similar information that typically remains in aggregate form. If such information does identify you, we will treat it as Personal Information subject to the Privacy Policy. We may also use cookies or pixels to collect data with respect to confirmation that a message has been delivered to you, confirmation that you have read a message, and related information about our digital communications.You can adjust your browser settings to disable or reject cookies but if you disable all cookies or tracking, you may be unable to access all functionality of the Sites or App. We do not permit third parties to track your online activities over time and across other websites based on your use of the Sites.The Sites also use analytics tools such as Google Analytics, a web analytics service provided by Google, Inc. that uses cookies to help us analyze how users navigate the Sites. The information generated by this tool (including IP address) will be transmitted to and stored by Google in aggregate form and used to evaluate use of the Sites, compile reports on Site activity and other services relating to Site usage. You can learn more about Google Analytics and how to opt-out here: https://tools.google.com/dlpage/gaoptout.Do-Not-Track SignalsThe Sites do not currently respond to browser-based “Do Not Track” signals.Links to Third-Party Sites-The Sites may include links to third-party websites we think may be of interest to you. Please note that these websites are independent from the Sites and we are not responsible for the content or privacy practices of such other sites or platforms. Your use of such third-party sites will be subject to the third party’s privacy policies.SecurityWe implement technical and organizational measures designed to safeguard your Personal Information from unauthorized access, use, disclosure, alteration, or destruction, in accordance with applicable laws and regulations. However, no data transmission over the Internet or storage of information can be guaranteed to be 100% secure.Retention of Personal InformationWe will keep your Personal Information for as long as necessary to fulfill the purposes for which we collected it, including any legal, professional, accounting, or reporting requirements. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of Personal Information, the potential risk of harm from unauthorized use or disclosure of your Personal Information, the purposes for which we process your Personal Information, whether we can achieve those purposes through other means, and all applicable legal requirements.Children’s PrivacyThe Services are not directed to or intended for use by individuals under the age of 18 or older if the age of majority is higher in your state without the consent of the user’s parent or legal guardian, and we request that these individuals do not use the Services or provide us with any Personal Information. Consistent with the requirements of applicable laws and regulations, if we learn that we have received Personal Information directly from a child under age 18 without his or her parent or legal guardian’s verified consent, we will delete such Personal Information.Notice to Persons Located in the EEA, UK, or SwitzerlandThis section of this Privacy Policy applies to persons located in the European Economic Area (“EEA”), United Kingdom (“UK”), or Switzerland (“you”). Unless otherwise defined in this section, all capitalized terms shall have the meaning ascribed to those terms in the General Data Protection Regulation (Regulation (EU) 2016/679 (“EU GDPR”). This section describes how we process Personal Information within the scope of the EU GDPR, UK GDPR, and the Swiss Federal Act on Data Protection (“FADP”), collectively referred to in this section as the “GDPR”.Legal Bases for Processing Personal InformationUnder the GDPR, we are required to inform you of the legal bases for our processing of your Personal Information. We process Personal Information for the following legal bases, depending on how you interact with the Services:

    • We may collect and use your Personal Information with your consent for the specific purpose identified in a notice given to you at the point of data collection.
    • We may process your Personal Information in order to manage or fulfill our contractual relationships. For example, in some circumstances, processing of your Personal Information is necessary to fulfill our or your (at your request) obligation in a contract.
    • We may process your Personal Information for our legitimate business interest. Where we rely on legitimate interests, we have conducted legitimate interest assessments to ensure that our interests and yours are balanced.

We may need to collect and process your Personal Information to comply with our legal obligations, including regulatory requirements such as adverse event investigations and reporting.

Individual RightsPersons located in the EEA, UK, or Switzerland have the right to access their Personal Information. This includes the right to receive a copy of all, or a portion of, your Personal Information, as long as our provision of this Personal Information would not adversely affect the rights and freedoms of others. You also have the right to request that we update, correct, or delete your Personal Information, and to restrict our processing of your Personal Information, as provided by applicable law.You also have the right to portability concerning your Personal Information. Subject to certain limitations, the right to data portability allows you to obtain from us, or to ask us to send to a third party, a digital copy of your Personal Information held by us.You can exercise these rights by contacting us here: dataprivacy@spencerhealthsolutions.com.We may request identifying information from you to confirm your identity and ensure your right to exercise any of these rights. We will respond to such requests in accordance with applicable law. If you believe that your Personal Information has been processed in violation of applicable law, you have the right to lodge a complaint with the relevant data protection authority in the country in which you reside, work, or where the alleged violation occurred.You may use the contact information in this notice at any time to withdraw your consent for the processing of your Personal Information where we require your consent as a legal basis for processing your Personal Information. Any withdrawal will apply only prospectively, and we will continue to retain the Personal Information that you provided before you withdrew your consent for as long as permitted or required by applicable law.

Our Data Protection Officer can be reached at dataprivacy@spencerhealthsolutions.com.

International Data Transfers

We may transfer Personal Information from the EEA, UK, or Switzerland to the United States and other countries, some of which have not been determined by the European Commission to have an adequate level of data protection. Any international transfers of your personal information are made pursuant to appropriate safeguards, such as standard data protection clauses adopted by the European Commission. If you wish to enquire further about these safeguards, please contact us at dataprivacy@spencerhealthsolutions.com

EU-U.S. Data Privacy Framework (EU-U.S. DPF) and to the rights of EU individuals

Spencer Health Solutions complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and to the rights of EU individuals as set forth by the U.S. Department of Commerce.  Spencer Health Solutions has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (“DPF Principles”) with regard to the processing of Personal Information received from the EU in reliance on the DPF.  If there is any conflict between the terms in this Privacy Policy and the DPF Principles, the DPF Principles shall govern.

With respect to Personal Information received or transferred pursuant to the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and to the rights of EU individuals, SHS is subject to the regulatory and enforcement powers of the U.S. Federal Trade Commission. To learn more about the DPF and to view SHS’s certification, please see here: www.dataprivacyframework.gov.

Types of Personal Information, Retention of Personal Information, and to Whom Personal Information May be Disclosed

For more details, please refer to the relevant sections of this Privacy Policy above:

  • “Information We Collect”
  • “Notice to Persons Located in the EEA, UK, or Switzerland”
  • “Retention of Personal Information”
  • “When will we share your Personal Information?”

Your Rights to Access or Limit the Use or Disclosure of your Personal Information

Pursuant to the EU-U.S. Data Privacy Framework (EU-U.S. DPF and to the rights of EU individuals, individuals in the EU, UK, and Switzerland have the right to obtain confirmation of whether we maintain Personal Information relating to you in the United States. Upon request, we will provide you with access to the Personal Information that we hold about you. You may also correct, amend, or delete the Personal Information we hold about you. Specific to  the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and to the rights of EU individuals, you can demand erasure of Personal Information that has been handled in violation of the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and to the rights of EU individuals. An individual who seeks access, or who seeks to correct, amend, or delete inaccurate or mishandled Personal Information transferred to the United States under the DPF, should direct their query to dataprivacy@spencerhealthsolutions.com

Third Parties Used by Us

Under the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and to the rights of EU individuals, we are responsible for the processing of Personal Information about you that we receive from the EU, UK, and Switzerland and onward transfers to any third party which performs services on our behalf, as described above. We comply with the DPF Principles for onward transfers of that nature and remain liable in accordance with the DPF Principles, if a third-party agent or service provider which we engage to process Personal Information on our behalf does so in a way that is inconsistent with the DPF Principles, other than where we prove that we are not responsible for the event which gives rise to the damage.

Disclosures for National Security or Law Enforcement

Under certain circumstances, we may be required to disclose your Personal Information in response to valid requests by public authorities, including to meet national security or law enforcement requirements.

Complaints and Independent Recourse Mechanism

SHS uses a self-assessment approach to maintain compliance with this Privacy Policy and periodically reviews this Privacy Policy to confirm it is accurate, comprehensive for the information intended to be covered, prominently displayed, implemented and accessible, and in conformity with the DPF. We encourage interested persons to raise any concerns using the contact information (click here) and we will investigate and attempt to resolve any complaints and disputes regarding the use and disclosure of Personal Information in accordance with the DPF.

In compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and to the rights of EU individuals, Spencer Health Solutions commits to resolve complaints about your privacy and our collection or use of your Personal Information transferred to the United States pursuant to the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and to the rights of EU individuals.  Please direct any inquiries or complaints to us at:

Paul Cunningham

SVP, Product Innovation
Data Privacy Officer
Spencer Health Solutions, Inc.

dataprivacy@spencerhealthsolutions.com

In compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and to the rights of EU individuals, Spencer Health Solutions commits to refer unresolved complaints concerning our handling of Personal Information received in reliance on the DPF to ICDR/AAA, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your complaint from us, or if we have not addressed your complaint to your satisfaction, please visit https://go.adr.org/dpf_irm.html for more information or to file a complaint. The services of ICDR/AAA are provided at no cost to you.

Arbitration

Binding Arbitration is available under the DPF if you have first: (1) raised the claimed issue directly with Spencer Health Solutions and have given us an opportunity to resolve the issue within forty-five days; (2) made use of the independent recourse mechanism listed above; and (3) raised the issue through your local Data Protection Authority to the U.S. Department of Commerce and given the Department of Commerce an opportunity to use best efforts to resolve the issue within the timeframes set forth in the Letter from the International Trade Administration of the Department of Commerce. For more information on binding arbitration, see U.S. Department of Commerce’s EU-U.S. DPF: Annex 1 of the DPF Principles.

Contact Us
If you have any questions about the information contained in this Privacy Policy, please contact us at dataprivacy@spencerhealthsolutions.com.

If you do not receive acknowledgment of your inquiry or your inquiry has not been satisfactorily addressed, you may contact:

In Canada:
Office of the Privacy Commissioner at info@privcom.gc.ca
Website: http://www.privcom.gc.ca

In the United States:
Federal Trade Commission at 1-877-FTC-HELP
Website: http://www.ftc.gov

In the European Union:
Website: http://ec.europa.eu/justice/data-protection/bodies/authorities/eu/index_en.htm