This Privacy Policy (the “Policy”) describes the personal data collected and processed by Qoluna Health, Inc. and its subsidiaries (collectively, “Qoluna,” “we” or “us”) through our consumer websites, apps and services (the “Services”). By accessing and using any of our Services, you agree to this Policy.
Table of Contents
1. Personal Data We Collect
We collect data that is linked to or can be linked to a specific individual, which may include information about your health or wellness, for the purposes described in this Policy. This data, called “personal data” (sometimes also referred to as “personal information”), may be provided directly by you to us, provided to us by third parties, such as wearable device manufacturers, data providers, or promotional partners, or collected from you automatically through your service usage, cookies, and other technologies. We may combine personal data we collect from these sources or through our various Services.
De-identified Data. We may de-identify your personal data using any of a variety of means, such as by removing identifying characteristics and/or blending your data with data about other individuals. Such de-identified data can no longer be associated to you and is considered non-personal to the full extent allowed by applicable law. We utilize technical and operational processes to maintain and use de-identified data and do not make attempts to re-identify it. We may use and share any non-personal information with third parties for any purpose in our discretion and as permitted by law, including for advertising, research and marketing purposes, but we require any third party receiving de-identified information from us to maintain the information as de-identified and not reassociate it to any individual. If we combine non-personal data with personal data, we treat the combined information as personal data and subject to this Policy.
2. Additional Details About our Personal Data Practices
Please see the Data Collection and Use Table [insert link] in Section 11 below for details about the (1) categories of personal data we collect, (2) purposes for which we collect that information, (3) categories of third parties to whom that information may be disclosed for a business purpose and (4) categories of third parties to whom the information may be sold for monetary value or other valuable consideration or shared for cross contextual behavioral advertising/targeted advertising.
Personal Data We Collect Directly From or About You. You may provide us with the information described in the Data Collection and Use Table [insert link] directly when you engage with the Services, such as signing up for an account. We also may collect personal data directly from you when you choose to provide it to us, such as when you respond to a survey, register for an account, or otherwise use or access the Services. You may also make personal data, such as health data, available to us when you connect a wearable device to the Services. Please see Data Collected Through Mobile and Connected Devices [insert link] for more information about how data from your wearable devices may be disclosed to us.
Inferences. We use proprietary and licensed modeling tools and algorithms to infer additional information about you from data that we collect directly from or indirectly about you to personalize your service and marketing. We do not use inferences to make determinations that would have a legally significant impact on you.
Real Time Chat. The Services may offer you a chat feature, which will record, use, and retain your information provided, as well as the communications within the chat, for purposes of assisting you during the conversation, provide related support for your account and/or the Services, to improve our products and services, and for marketing purposes. During a chat, you may interact with a generative artificial intelligence. The chat session, including any information contained within it, may be retained and used by the generative AI application to learn and improve its ability to provide support to customers of the Services. If you do not consent to such recording, use and retention, you must not use the chat assistance feature.
Personal Data We Receive or Collect from Third Parties. We may receive information about you from service providers, third parties with whom we have a business relationship, advertising networks and agencies, advertising technology companies, marketing companies, data providers, sources of publicly available information, governmental or quasi-governmental agencies or organizations, and other users of the Services (such as when users provide your information to “refer a friend” or similar programs that we may offer). We may combine and store the supplemental information with other information we may have already received or collected from you, for use as set forth in this Policy.
Data We Collect Automatically: Device Data. We, our service providers, or third parties with whom we have a business relationship may automatically collect and/or store certain data about your device when you visit or interact with the Services (“Device Data”). This Device Data may be stored and/or accessed from your computer, tablet, mobile device, or other device (including wearable devices) whenever you visit or interact with the Services. Device Data may include, but is not limited to:
Your IP address, mobile or connected device identifier when made available by the device manufacturer
Information about the device such as model, operating system version, date/time of access, mobile network information
Approximate location of your device using location inferred from IP address or if you choose to provide it (such as country, city, state or zip code)
Precise Geolocation (e.g., longitude/latitude, or proximity to beacon) only when you grant permission through your device settings.
How you use and interact with the Services. This information will depend on the format and subscription through which you access the Services and may include the webpage, link or advertisement that referred you to the Services you are visiting, areas of the Services that you visit or use, access times and time zone, search terms, downloads, and content you view and duration of viewing.
Device Data may be collected through the following technologies:
Cookies and Local Storage. Cookies and local storage are text files placed within a web browser or application on a device when it is used to visit the Services. Certain web browsers and browser add-ons may provide additional local data storage mechanisms.
We may use cookies and similar technologies to help keep your use of the Services more secure, to study usage patterns on the Services, to study the effectiveness of our customer communications, to maintain the integrity of the Services, to measure crash analytics and other maintenance related information, to manage and measure the performance of advertisements displayed on or delivered by or through the Services or by Qoluna on other sites, and to personalize your experience through the Services, such as to recognize you when you return to the Services. Most browsers provide you with the ability to disable, decline, or clear cookies and local storage; please check your browser’s settings for further information. Some cookies are necessary for the functionality of the website (“Essential Cookies”). These cookies may not be disabled.
In addition, third parties may place cookies on our websites to improve and optimize our advertising campaigns or those of third party advertisers. Some third party advertisers may embed cookies or tags within the advertising creative that is served through the Services. These cookies or tags send information to the advertiser or its services providers to manage and measure the performance of their campaigns.
You may manage whether or not to accept cookies (other than Essential Cookies) on websites operated by Qoluna through the Manage Cookies [adjust this name/link to fit the Qoluna website(s)] link on each respective website. Note that such cookie preferences do not transfer between browsers and must be reset for each browser or device that you use to access a site. For more information about cookies, please visit https://www.aboutcookies.org. Please note that if you disable or refuse cookies, certain parts of the Services may then be inaccessible or not function properly.
Pixel Tags. Small graphic images or other web programming code (also known as web beacons or pixel tags or 1x1 GIFs or clear GIFs) may be included in our web pages and email messages. These technologies are used to understand how end users interact with the Services, including to count visitors to the Services, to review the effectiveness of our offers and ad campaigns, to count how many of our email messages were opened, or to count how many particular products were viewed. The information we collect through this technology may include the first date and time you open our email, and whether you click any links included in our email.
Embedded Scripts. Qoluna.com may use an embedded script to collect information about your usage of the online Service.
Session Replay Technology. Qoluna may record through session replay technology details of your interactions with the Services such as what pages you visit, how long you visit those pages, what sections of the page you spend the most time reviewing, and any links you click or information you provide. We use this information for our internal business purposes, such as for website analytics, to improve the Services and our products and services, and to address functionality issues.
Data Collected Through Mobile and Connected Devices:
Software Development Kits (“SDKs”). To facilitate the Services, we may connect to the wearable devices, AI/ML services and advertising operations by certain third parties with whom we have a relationship and collect data through the use of embedded scripts and tools provided in SDKs. These SDKs are included in the app itself and may collect information when you install the mobile app or access the Services through mobile devices. Such data may include hardware model, operating system and version, device ID, mobile network information, and application usage behavior. Some Device Data may be deemed personal data, to the extent that it remains associated with a device identifiable to you in some way. When this is the case, we treat Device Data as personal data. Device Data is used for the business and commercial purposes disclosed in this Policy, such as to deliver and personalize the Services to you, to understand service usage and improve the Services, to debug, troubleshoot, prevent fraud and other security related purposes, to identify you across devices for service and advertising purposes, and to facilitate your request to log in to the Services through a third party or social media platform, conduct a transaction through a third party or share content with a friend or other third party account. Settings specific to your mobile or connected device manufacturer may allow you to change or block the transmission of your device ID and other Device Data. Please see the privacy policy of your device manufacturer for details. Qoluna does not sell personal data collected through SDKs to third parties nor allow third parties to collect such information directly for monetary consideration.
Connected Devices. The Services may also access your personal data through third party devices such as connected wearable devices. When you connect a wearable device to Qoluna, we do not control these devices, your underlying subscription with that device, or their collection and use of your personal data, including in relationship to targeted advertising they may deliver through a connected device. The disclosure of data to Qoluna from a third party device is done with your consent based on the disclosure parameters you establish with the third party device manufacturer. Please contact the manufacturer of the connected device or purveyor of the connected services for information on their privacy practices and policies.
Sharing with Third Parties
We may share personal data we have collected about you in the circumstances described below or elsewhere in the Policy. Please note that we are not responsible for the privacy practices of any third party with whom you interact or who interacts with you directly. If you decide that you do not want to receive communications from a third party, or have questions about their privacy practices, you will need to contact such third party.
A. Other Qoluna Users
Personal data on your account or subscription may be accessible to other individuals and/or applications that you allow to interact with your account/subscription. It is solely your choice whether or not you allow other individuals to have access to your account or sign-in credentials.
B. Subsidiaries
Qoluna may share personal data collected in conjunction with the Services with our subsidiaries for business, analytical, marketing, operational and advertising purposes and to offer, provide, and improve services and products offered both individually and jointly.
C. Unaffiliated Third-Party Business Relationships
We may share your email address with unaffiliated third parties with whom we have a business relationship for ours or for their own business and advertising purposes. These third parties may include companies with whom we have marketing, licensing, sponsorship, product or service distribution, advertising or similar agreements. Such third party’s use of the personal data is subject to their privacy policy and data practices. You may opt-out of our sharing of your email address for third-party marketing by sending an email request to opt-out of sharing for third-party marketing to support@qoluna.com. We may also share your personal data with unaffiliated third parties who provide services to help us find new audiences that will be most responsive to our services and communications and to help us optimize our marketing and advertising campaigns. We may use personal data, such as your email address, to create an identifier that is less identifiable to you directly (a pseudonym), that would be used to deliver you relevant or personalized advertising across unaffiliated websites, applications or devices without sharing your directly identifying information. Some states give their residents the right to opt-out of the sharing of personal data for use in targeted or behavioral advertising or in certain other contexts. Please see State-Specific Rights below [insert link] for additional information.
Note that when you elect to accept a promotional offer for a service offered by a third party as part of the Services, we will only share information with that third party in order to confirm your eligibility for the associated service or as needed to maintain your access to the promotion, unless you consent to additional sharing or uses by the third party.
D. Third Parties to Whom you Agree or Direct Us to Share Your Personal Data
We may share your personal data when you expressly consent or otherwise direct us to do so. For example, you may direct us to share your information with a Third Party Service in order to help you manage an electronic health record. Your personal data may contain health or wellness information but is not considered protected health information under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). To the extent our Services change and HIPAA becomes applicable to your data, we will communicate this change to you in accordance with our Terms of Use.
E. Social Media and Other Third Party Platforms
We may facilitate interactions with social media or other third party platforms which may include the ability to “like” or “share” content. You may also have the opportunity to log in through or otherwise connect your third party platform account to your subscription service. When you interact with these third party platforms through the Services, we will receive your personal data from the third party platform service and you agree to share data, which may be personal, about your interactions with the Services with that social media service. We may also receive personal data identifying you if other users of social media give us access to their profiles and you are one of their connections or “friends.”
Personal data collected and stored by the third party is subject to that third party’s privacy practices, including, without limitation, whether the third party continues to share data with us, the types of data shared, and your choices with regard to what is visible to others on that third-party website or service. The third party may allow you to remove the application or feature; however we may retain data previously collected.
A third party platform or service, such as Facebook/Meta or TikTok, may place cookies on your device or and/or on the Services that collect information about your use of the Services, including your IP address or other device identifiers, and which pages you visit on the Services. The third party platform may be able to collect personal data about you on your visits to the Services regardless of whether or not you affirmatively interact with the feature and whether or not you are logged into (or have) an account with the third party platform. If you are logged out or do not have an account and visit a page with a social plug-in, your browser sends a more limited set of data, such as the webpage you are visiting, the date and time of your visit, and other browser-related information. Please see Cookies and Local Storage and Third Party Advertising and Analytics/Privacy Controls [insert links] about how to manage cookies and tags online.
F. Information You Disclose Publicly. Services may offer message boards, chats, forums, and other public areas (“Community Forums”) where you can choose to interact with others and/or to post or submit comments, images, and content. Note that anything you choose to disclose in such a Community Forum is public. Similarly, any information you choose to post to a social media or third-party platform will be publicly available. This Policy does not apply to collection and use of such public information. Think carefully before you post and use caution before disclosing any personal data.
G. Sweepstakes, Promotions, and Surveys.
We may offer sweepstakes, contests, giveaways, research surveys and other promotions (any of which, a “Promotion”) that require registration or request additional information. By participating in a Promotion, you are agreeing to the provisions, conditions, or official rules that govern the Promotion, which may contain specific requirements (including, allowing the sponsor(s) of the Promotion to use your name, voice, likeness, or other indicia of persona in advertising or marketing materials where allowed by law). If you choose to enter a Promotion, personal data may be disclosed to third parties, to vendors facilitating the implementation of the Promotion, or to the public in connection with the administration of such Promotion, including in connection with winner selection, prize fulfillment, as required by law, or as permitted by the Promotion’s terms or official rules.
H. Third Parties in the Course of a Business Transaction.
In the event one or more entities of Qoluna goes through a business transaction, Qoluna reserves the right to disclose and transfer all personal data related to the respective Services to the full extent allowed by law (including, without limitation, during the course of any due diligence process): (i) to a subsequent owner, co-owner or operator of the Services; or (ii) in connection with a corporate merger, consolidation, restructuring, bankruptcy, the sale of certain of Qoluna’s ownership interests, assets, or both, or other company change. By providing your information, you understand and agree that we may transfer such information to the acquiring entity without your further consent, except where required by law.
3. Third Party Advertising and Analytics/Privacy Controls
Qoluna engages in third party business relationships, including with advertising companies, ad agencies, ad tech providers, measurement and attribution vendors, and analytics providers to place and display Qoluna ads, to deliver third party ads on the Services, and to provide us with information regarding the use of the Services and ad effectiveness. In addition, some advertisers, agencies and ad tech vendors may utilize their own tracking technologies embedded in their ads or on your device, and they may otherwise collect or have access to data about your device and other information about you, some of which may be personal data under certain state laws. Some of these parties may collect personal data over time when you visit the Services or other online websites and services. We may share data that has been aggregated, de-identified, or pseudonymized or Device Data and location information with advertising companies, analytics providers, and attribution and measurement vendors, including for the purpose of serving you more relevant ads on and off the Services.
There are a variety of means and tools that allow you to place some limits on the collection and use of your personal data for marketing by third parties, or by Qoluna on other sites and applications:
Cookie Opt-Out Tools. To disable sharing through cookies set on our site by third parties for advertising and analytics purposes, please adjust your settings by clicking on either Manage Cookies [adjust to fit the Qoluna website(s)] from the footer of our webpages. By disabling or refusing cookies, certain aspects of the Services may be inaccessible or not function properly.
NAI/DAA Opt-Out. Some advertising companies are members of the Network Advertising Initiative (“NAI”) or Digital Advertising Alliance (“DAA”). The NAI provides information regarding targeted advertising, the opt-out procedures of NAI members, and a tool to opt out from participating NAI members using your hashed email address for interest-based advertising. You may also want to visit the DAA’s website for more about targeted advertising and an opt-out for DAA-participating companies.
Mobile Device/AppChoices. Mobile devices contain settings that may allow you to disable tracking advertising or analytics. If you are using an iOS-based device and do not want to receive advertisements personalized to you or your individual interests, you may be able to limit these advertisements by enabling “Limit Ad Tracking” on your iOS Device following the instructions provided by Apple. If you are using an Android-based device and do not wish to receive advertisements personalized to you, you can visit Google’s Ads Settings page from a browser on your Android-based device and make your choices there. In addition, the digital advertising industry has provided the ability for mobile users to register at AppChoices for their intent not to receive targeted advertising.
Google Analytics/Adobe Analytics. We utilize Google Analytics and Adobe Analytics, which use cookies and similar technologies, to collect and analyze information about the use of the Services and report on activities and trends. These services may also collect information about the use of other websites, apps, and online services. You can learn about Google’s practices, and opt out of them by downloading the Google Analytics opt-out browser add-on. Learn about Adobe’s practices here.
Note that cookie settings and other technological controls are specific to the browser or device on which such control is implemented. When cookies or other such tags are disabled, we are not able to recognize you when you use a different device to access the Services, and therefore cannot apply the settings from the initial device. You will need to manage your cookies and tag settings as well as any global privacy controls individually on each device with which you access the Services.
By continuing to access the Services, you understand that even in light of your cookie settings and other opt-out choices, you will continue to receive ads that are delivered generally to anyone in a certain geographical region or based on aggregated or non-personal data.
4. Your Choices and Opt Out Rights
A. Marketing Messages from Us. You can manage how we use your personal data to contact you with regard to Qoluna services by setting your contact preferences in your account settings online or in the app.
Email. You may unsubscribe from marketing emails and newsletters we send you through the opt-out link included in the footer of each such email. We will continue to send you certain communications relating to your use of the Services, renewal notices, notices of changes to this Privacy Policy or other terms, or similar administrative and transactional messages.
Text Messages. Qoluna may use text messaging to send you offers, to facilitate account management or otherwise assist you in your access to the Services or your subscription. To the extent that you choose to stop receiving marketing texts, you may unsubscribe by replying “STOP” to the short code. Your consent to receive text messages will not be given to a third party for purposes related to other goods and services.
Push Notifications. We may send promotional and non-promotional push notifications or alerts through the Services. You control whether you receive those messages in your device settings at any time.
Telemarketing. You may opt out of telemarketing sales calls by contacting us at support@qoluna.com. We may have more than one telephone number on record for you or your household members; you must specify all the phone numbers you are directing us to not call. Although your request will be processed immediately, it may take up to ten (10) days to remove your information from active telemarketing and solicitation lists that are in flight. Please note, even if you opt out of telemarketing sales calls, you may continue to receive calls for service and account-related matters.
B. Changing Your Information. You are responsible for maintaining the accuracy of the information you submit to us, such as contact information you have provided for your account. You are able to make changes to your account information using the settings under your account.
Note that when you edit your personal data or change your preferences, the previous information will be retained internally as part of the history of your account for analytical, administrative, legal and security purposes, or within backup media. If you have made any public postings on the Services including community forums or on social media platforms, those communications generally cannot be removed even if you cancel or deactivate your account. We cannot completely delete your personal data except by also deleting your account with us. We may not be able to accommodate your request if we believe it would violate any law or legal requirement or if we have a legal basis or obligation to maintain it, or if it would cause the information to be incorrect.
5. Security and Retention
Qoluna takes commercially reasonable steps designed to secure your personal data; however no data transmission over the Internet, wireless transmission, or electronic storage of information can be guaranteed to be 100% secure. Qoluna cannot ensure or warrant the security of any information we collect. You use the Services and provide us your information at your own risk.
We retain personal data for as long as it is necessary for the purposes set out in this Policy, including to provide the Services to you; to send you information related to Qoluna, our products and services and your account; to conduct internal research, develop and improve new products and services; to exercise the choices and rights you have requested; to comply with our contractual obligations; to protect our legal rights and obligations, resolve disputes and enforce our Terms for Use for the Services; and to comply with legal and regulatory requirements.
6. General Audience Sites
Users must be 18 and older to sign up for use of the Services. We do not knowingly collect any personal data from individuals younger than the age of 13.
7. Consent to Transfer
Please be aware that the data we collect will be transferred to and processed in the United States and other countries. By using the Services, or providing us with any data, you fully understand and consent to this transfer to, and processing, usage, sharing, and storage of your data in the United States and other jurisdictions, for which the privacy laws may not be as comprehensive as those in the country where you reside and/or are a citizen. As a result, this data may be subject to access requests from governments, courts, or law enforcement in the United States and other countries according to the laws in those jurisdictions. Your data will also be disclosed to third parties as described in the Sharing with Third Parties [insert link] section above.
8. Changes to This Privacy Policy
We reserve the right to change this Privacy Policy at any time. If we make material changes to our privacy policy, we will update the effective date and post a notice on the Services. We may also provide notice to you in other ways, such as through contact information you have provided, and provide you with the ability to opt-in or opt-out of the changes as required by law. Note that when applicable, you may need to consent to a revised policy in order to continue to use the Services. Your continued use of any of the Services after the effective date of the revised Privacy Policy will constitute your consent to those changes to the fullest extent allowed by applicable law.
9. How To Contact Us
You may contact us by email at support@qoluna.com. The information you provide is used to respond directly to your questions or comments. We may also file your comments and share them with our consumer care team to improve our service in the future. If you still have questions or concerns about our privacy policy, please write to us at:
Qoluna Health, Inc.
support@qoluna.com
10. State Specific Rights.
As set forth below, residents of certain U.S. states may have the ability to exercise additional rights and choices regarding their personal data. We will take reasonable steps to accommodate your request but may need to verify your identity before doing so.
A. Colorado, Connecticut, Oregon, Texas, Utah, and Virginia. We set forth in this Policy the categories of personal data we process, the purpose for processing personal data, the categories of personal data shared, and the categories of third parties with whom personal data is shared. Residents of CO, CT, OR, TX, UT, and VA have certain privacy rights with respect to this data, as described below.
Your Rights
Access Your Information/Obtain Your Information/Data Portability (CO, CT, DE, IA, MT, NE, NH, NJ, OR, TX, UT, VA Residents) –You have the right to confirm whether we are processing your personal data and request to access such data, obtain a copy of your personal data, and, to the extent feasible, in a readily usable format to allow data portability. Your state may also provide you the right to request a list with certain additional information about certain third parties to which Qoluna may have disclosed your personal data.
Delete Your Information (CO, CT, DE, IA, MT, NE, NH, NJ, OR, TX, UT, VA Residents). You have the right to request the deletion of your personal data, subject to certain exemptions and exceptions.
Correct Your Information (CO, CT, DE, MT, NE, NH, NJ, OR, TX, VA Residents). You have the right to correct the personal data we hold about you.
Sensitive Data. If you are a CO, CT, DE, MT, NE, NH, NJ, OR, TX, or VA resident, to the extent Qoluna processes sensitive data, we will obtain your consent to the processing of any Sensitive Data (as defined by the applicable state law) before any such data is collected. You may also opt out using the methods to exercise your rights listed below in this section. If you are a IA or UT resident, you have the right to opt out of the processing of Sensitive Data, each as defined by the UT privacy law, to the extent that Qoluna processes any such data.
Opt-Out of Sale of Your Personal Data and Targeted Advertising (CO, CT, DE, IA, MT, NE, NH, NJ, OR, TX, UT, VA residents) - You have the right to opt-out of “Sale” of personal data or from the use of personal data in “Targeted Advertising”, as defined by the applicable state law, using the methods to exercise your rights listed below in this section. Qoluna does not sell personal data to third parties for monetary compensation. Sharing of IP address or mobile ad IDs with third party advertising vendors and certain other targeted advertising practices may constitute a “sale” under definitions set forth in certain state laws. Please note that opting out of “sale” or “targeted advertising” in any of these states will not opt you out of all advertising. You may continue to receive ads delivered through the Services based on listening content, region, or other general categories to which non-personal data applies.
Cookie-Based Opt-outs for Sale and Targeted Advertising
Qoluna may use technologies, such as cookies and pixels, in the course of web-based or online advertising, analytics or similar activities that collect or share personal data in a manner that may constitute a “sale” or support “targeted advertising” under certain state laws. You may opt out of cookies set by third parties for advertising or analytics by using the Cookie Manager [adjust to fit the Qoluna website(s)] [a]from the footer of our web pages. Please also review the Third Party Advertising and Analytics/Privacy Controls [insert link] section above for information on industry tools and device settings that may be available to you. Please note that disabling or refusing cookies may impact the functionality of our Services.
Right to Opt-Out of Profiling in furtherance of legal or similarly significant effects. Qoluna does not process personal data for the purposes of profiling in furtherance of decisions that produce legal or similarly significant effects.
Right to Appeal (CO, CT, DE, IA, MT, NE, NH, NJ, OR, TX, and VA Residents) – You have the right to appeal our decision relating to your request. You may submit an appeal by contacting us at support@qoluna.com, depending on your subscription service and follow the instructions on the form.
Exercise Your Rights
If you are a Consumer residing in CO, CT, DE, IA, MT, NE, NH, NJ, OR, TX, VA, or UT (as defined in each state’s respective law) and would like to exercise your applicable rights as outlined above by contacting us at: support@qoluna.com.
Authorized Agents Submitting Opt-Out Requests for Sales and Targeted Advertising (CO, CT, DE, MT, NE, NH, NJ, OR, and TX Residents Only) - If you are an authorized agent submitting a request to opt out of sales or targeted advertising on behalf of a resident of a state that permits such submissions by authorized agent, please submit the request pursuant to the instructions on the respective form. We may authenticate the consumer’s identity and that you are authorized to submit the request on the consumer’s behalf in order to be able to fulfill your request. Please keep in mind that if we cannot authenticate that you are authorized to act on the consumer’s behalf or we cannot authenticate the consumer’s identity, we may deny the request.
B. Nevada. If you are a Nevada resident please note that we do not sell your personal data (or “covered information”) as defined in Nevada S.B. 220. However, if you are a Nevada resident, you may still submit an opt-out request, and if our practices were to change in the future, we would honor your request. Your request to opt out of the sale of your covered information must be submitted to support@qoluna.com with your full name, street address, city, state, zip code, and a valid email address so that we can contact you if needed regarding your request. If you previously provided a phone number, including it will assist us in making sure we identify you as someone who wants to opt out. You may be required to take reasonable steps as we determine from time to time to verify your identity and/or the authenticity of your request.
Nevada residents have the right to know about the collection, sharing, sale, and use of health-related data about them. Qoluna does not collect, share, sell, or use health-related data about consumers, as defined by Nevada S.B.370.
Under Nevada state law, consumers have the right to know about the collection, sharing, sale, and use of health-related data about them. Please see the Nevada Consumer Health Data Privacy Notice [insert link] for more information on how Qoluna collects, shares, sells, or uses health-related data about consumers, as defined under the Nevada Consumer Health Data Privacy Act.
C. California. Your Rights Under the California Consumer Privacy Act of 2018 (CCPA) and as amended by the California Privacy Rights Act of 2020 (CPRA): If you are a California resident, please see California Consumer Privacy Act Notice [insert link] for additional information about your privacy rights and how to exercise them.
Global Privacy Control (GPC) and Do Not Track (DNT) Signals. Global Privacy Controls (“GPC”) and Do Not Track (“DNT”) offered by some web browsers are settings that automatically inform websites of your privacy preferences. When you choose to turn on the GPC/DNT setting in your browser, your browser sends a special signal to websites, analytics companies, ad networks, plug in providers, and/or other web services you encounter while browsing to exercise your privacy rights and stop tracking your activity. You can learn more about and set up GPC at https://globalprivacycontrol.org/#about and set up Do Not Track at http://www.allaboutdnt.com. We comply with GPC as required under applicable law, but because there is not yet an accepted standard for how to respond to browser DNT signals, we do not currently respond to them.
Your Rights under California’s “Shine the Light” law (Civil Code Section 1798.83, also known as S.B. 27). California residents have the right to request from companies conducting business in California certain information relating to third parties to which the company has disclosed certain categories of personal information during the preceding year for the third parties’ direct marketing purposes. Alternatively, the law provides that a company may comply, as Qoluna does, by disclosing in its privacy policy that it provides consumers choice (opt in or opt out) regarding sharing personal information with third parties for those third parties’ direct marking purposes, and information on how to exercise that choice. As stated in this Privacy Policy, Qoluna provides you choice prior to sharing your personal information with third parties for their direct marketing purposes. If you do not opt-in or if you opt-out at the time we offer that choice, we do not share your information with that identified third party for its direct marketing purposes.
If you are a California resident and you have questions about our practices with respect to sharing information with third parties for their direct marketing purposes and your ability to exercise choice, please write to us at: Qoluna Health, Inc., support@qoluna.com, Attn: Legal Department – Shine the Light Privacy Request. Shine the Light requests that come to us by other means may result in a delayed response. You must include your name, street address, city, state, and ZIP code. We are not responsible for notices that are not labeled or sent properly, or do not have complete information.
D. Washington. Under Washington state law, consumers have the right to know about the collection, sharing, sale, and use of health-related data about them. Please see the Washington Consumer Health Data Privacy Notice [insert link] for more information on how Qoluna collects, shares, sells, or uses health-related data about consumers, as defined under the Washington My Health My Data Act.
11. TABLE OF OUR DATA COLLECTION AND USE PRACTICES
The following Table sets out by category of personal data collected:
A. The purposes for which personal data is collected;
B. Categories of third parties to whom personal data may be disclosed for a business purpose; and
C. Categories of third parties to whom the information may be sold for monetary value or other valuable consideration or shared for cross contextual behavioral or targeted advertising, each term as defined by applicable law
Please Note All Categories of Personal Data Below May be Used for the Following Purposes:
Legal (to resolve disputes; enforce our agreements and policies; protect our or others’ rights/assets; comply with our contractual obligations; cooperate in governmental or other legal inquiries; fulfill regulatory reporting obligations),
Business Transitions (in connection with a merger, acquisition, consolidation, bankruptcy, or other corporate transition, affecting all or part of our assets, including during due diligence),
Security (to protect the Services; investigate, detect, prevent, and protect against issues of our systems, fraud, crime, or other activities that violate our policies or applicable laws; to protect the health and safety of our users or the general public), and
Other purposes as disclosed at the time of collection or with your consent.
Please Note All Categories of Personal Data Below May be Disclosed To the Following:
Law Enforcement and Government Agencies/Where Required By Law (including third parties in connection with court or other legal actions including valid subpoenas)
Third parties in the course of a Business Transition
Third parties to whom you agree or direct us to share your information
Other service providers who use your personal data to provide services to us or to you.
Category of Personal Data | A. Purpose for Collection |
B. Categories of Third Parties Personal Data is Disclosed To | |
C. Third Parties to whom Personal Data is Sold or Shared for Targeted Advertising | |
Registration Data - This may include your name, email address, mailing address, phone number, birth year, zip code. | A. Purposes for Collection: 1. Provide You Services (process transactions and orders ;facilitate access to Qoluna services, create and manage your account on Services; identify and recognize you across services and devices; send service and account related communications; respond to your inquiries; provide customer service; send you information that you requested or agreed to receive such as newsletters; facilitate your participation in activities you sign up for such as sweepstakes, contests, research); 2.Internal Business Purposes (provide and improve our services; develop new products and services; market research, auditing and publication; understand how you use our services, including analyzing trends and usage patterns; analyze the effectiveness of our marketing efforts); 3.Marketing (to send you special deals, offers, invites to events, and similar information from us or third parties); 4.Advertising (to identify your preferences, tailor content, including advertising and listening recommendations, to you on the Services and on other websites and services; to monitor and control the ad delivery, performance and frequency); 5.Administrative (investigate and prevent fraud and other illegal activities; detect and troubleshoot technical issues). |
B. Categories of Third Parties the Data Is Disclosed to: 1. Technology Systems Service Providers (including web hosts, database hosts, software-as-a-service providers, cloud computing providers, technology maintenance, repair), 2. Customer Service Providers (call centers, live chat agents, automated and artificial intelligence chat providers, email delivery and text messaging vendors), 3. Order Fulfillment Service Providers (payment processors, order fulfillment centers, delivery services, order tracking vendors), 4. Third-Party Business Relationships (unaffiliated parties that are joint marketing and licensing relationships), 5. Sweepstakes/Promotions Vendors, 6. Third-Party Advertising Entities and Analytics Providers (analytics companies, advertising agencies), 7. Affiliates and Subsidiaries 8. Other Qoluna Users (including those on your account/subscription). | |
C. Categories of Third Parties to Whom the Data is Sold/Shared for Targeted Advertising: Third-Party Advertising Entities and Analytics Providers, Third-Party Business Relationships | |
Payment Data (if you purchase a product or service from Qoluna directly) – This may include, credit or debit card number, expiration date, billing zip code, secure payment token associated with your payment card. | A. Purposes for Collection: 1. Provide You Services (process transactions, orders, and refunds); 2. Administrative (to conduct sales audits, manage chargebacks, investigate and prevent fraud and other illegal activities). |
B. Categories of Third Parties the Data Is Disclosed to: 1. Customer Service Providers (call centers, live chat agents), 2. Order Fulfillment Service Providers (payment processors, order fulfillment centers, delivery services, order tracking vendors), 3. Security Vendors | |
C. Categories of Third Parties to Whom the Data is Sold/Shared for Targeted Advertising: This category of data is not sold or shared for targeted advertising. | |
Sensitive Personal Data (data revealing ethnic origin/race, mental or physical health condition or diagnosis, sex life or sexual orientation, or citizenship or citizenship status). | A. Purposes for Collection: 1. Provide You Services (process transactions and orders ;facilitate access to Qoluna services, create and manage your account on Services; identify and recognize you across services and devices; send service and account related communications; respond to your inquiries; provide customer service; send you information that you requested or agreed to receive such as newsletters; facilitate your participation in activities you sign up for such as sweepstakes, contests, research); 2. Internal Business Purposes (market research; understand how you use our services, including analyzing trends and usage patterns); 3. Advertising (to tailor content, including advertising and listening recommendations, to you on the Services and on other websites and services); 4. Marketing (to send you special deals, offers, invites to events, and similar information from us or third parties). |
B. Categories of Third Parties the Data Is Disclosed to: 1. Technology Systems Service Providers (including web hosts, database hosts, software-as-a-service providers, cloud computing providers, technology maintenance, repair), 2. Customer Service Providers (call centers, live chat agents, automated and artificial intelligence chat providers, email delivery and text messaging vendors), 3. Order Fulfillment Service Providers (payment processors, order fulfillment centers, delivery services, order tracking vendors), 4. Third-Party Business Relationships (unaffiliated parties that are joint marketing and licensing relationships), 5. Sweepstakes/Promotions Vendors, 6. Third-Party Advertising Entities and Analytics Providers (analytics companies, advertising agencies), 7. Affiliates and Subsidiaries, 8. Other Qoluna Users (including those on your account/subscription). | |
C. Categories of Third Parties to Whom the Data is Sold/Shared for Targeted Advertising: Third-Party Advertising Entities and Analytics Providers Third-Party Business Relationships | |
Precise Geolocation Data of Device (may be considered Sensitive Personal Data under applicable state law) – means location derived by technological means within 1750 feet. | A. Purposes for Collection: 1. Advertising (to tailor content, including advertising and listening recommendations, based on your location; to manage advertising campaigns and report on and understand performance); 2. Administrative (troubleshooting service problems; investigate and prevent security incidents and threats, fraud and other illegal activities). |
B. Categories of Third Parties the Data Is Disclosed to: 1. Technology Systems Service Providers (including webhosts, database hosts, software-as-a-service providers, cloud computing providers, technology maintenance, repair, security vendors), 2. Third Party Advertising Entities and Analytics Providers (analytics companies, marketing agencies), 3. Security Vendors, 4. Affiliates and Subsidiaries | |
C. Categories of Third Parties to Whom the Data is Sold/Shared for Targeted Advertising: 1. Affiliates and Subsidiaries, 2. Third-Party Advertising Entities and Analytics Providers | |
Other Demographic Data– This may include gender, marital status, number of drivers in your household, name of your university and military affiliation (active duty, veteran),consumer interest segments. | A. Purposes for Collection: 1. Provide You Services (facilitate access to Qoluna services, create and manage your account on Services; determine and verify eligibility for student and military discounts; facilitate your participation in activities you sign up for such as sweepstakes, contests, research); 2. Internal Business Purposes (market research; understand how you use our services, including analyzing trends and usage patterns); 3. Marketing (to send you special deals, offers, invites to events, and similar information from us or third parties); 4. Advertising (to tailor content, including advertising and listening recommendations, to you on the Services and on other websites and services). |
B. Categories of Third Parties the Data Is Disclosed to: 1. Technology Systems Service Providers (including webhosts, database hosts, software-as-a-service providers, cloud computing providers, technology maintenance, repair), 2. Customer Service Providers, 3. Third-Party Business Relationships (parties that are joint marketing and licensing relationships), 4. Security Vendors, 5. Sweepstakes/Promotions Vendors, 6. Third-Party Advertising Entities and Analytics Providers (analytics companies, advertising agencies), 7. Affiliates and Subsidiaries | |
C. Categories of Third Parties to Whom the Data is Sold/Shared for Targeted Advertising: Third-Party Advertising Entities and Analytics Providers, Third-Party Business Relationships | |
Transaction Data – (This may include subscription status, services and products purchased or considered, purchase and cancellation history, amount of purchase, date of purchase) | A. Purposes for Collection: 1.Provide You Services (facilitate access to Qoluna services, create and manage your account on Services; send transactional messages regarding your use of the services, purchases, and other service and account related communications; provide customer service); 2.Internal Business Purposes (provide and improve our services; market research, auditing and publication; understand how you use our services, including analyzing trends and usage patterns); 3. Marketing (to send you special deals, offers, invites to events, and similar information from us or third parties); 4.Advertising (to identify your preferences; tailor content, including advertising and listening recommendations, to you on the Services and on other websites and services); 5.Administrative (conduct sales audits, manage charge backs, investigate and prevent fraud and other illegal activities; detect and troubleshoot technical issues). |
B. Categories of Third Parties the Data Is Disclosed to: 1. Other Qoluna Users (including those on your account/ subscription), 2. Technology Systems Service Providers (including webhosts, database hosts, cloud computing providers, software-as-a-service providers, technology maintenance, repair), 3. Customer Service Providers (call centers, live chat agents, automated and artificial intelligence chat agents, email delivery and text messaging vendors), 4. Order Fulfillment Service Providers (payment processors, order fulfillment centers, delivery services, order tracking vendors), 5. Third-Party Business Relationships (unaffiliated parties that are joint marketing and licensing relationships), 6. Third-Party Advertising Entities and Analytics Providers (analytics companies, marketing agencies), 7. Security Vendors, 8. Affiliates and Subsidiaries | |
C. Categories of Third Parties to Whom the Data is Sold/Shared for Targeted Advertising: 1. Affiliates and Subsidiaries, 2. Third-Party Advertising Entities and Analytics Providers, 3. Social Media and Other Third-Party Platforms, 4. Third-Party Business Relationships | |
Account Information and Settings – This may include username, password, communication preferences, content settings (i.e., allowing explicit content or artist audio messages). | A. Purposes for Collection: 1.Provide You Services (process transactions and orders; facilitate access to Qoluna services, create and manage your account on Services; identify and recognize you across services and devices; send service and account related communications; respond to your inquiries;); 2. Internal Business Purposes (provide and improve our services); 3. Marketing (to send you special deals, offers, invites to events, and similar information from us or third parties in accordance with your preferred communication channel); 4. Administrative (verify your identity; investigate and prevent fraud and other illegal activities; detect and troubleshoot technical issues). |
B. Categories of Third Parties the Data Is Disclosed to: 1. Technology Systems Service Providers (including webhosts, database hosts, software-as-a-service providers, cloud computing providers, technology maintenance, repair), 2. Customer Service Providers (email delivery and text messaging vendors), 3. Security Vendors, 4. Affiliates and Subsidiaries | |
C. Categories of Third Parties to Whom the Data is Sold/Shared for Targeted Advertising: This category of data is not sold or shared for targeted advertising. | |
Device Data –This may include IP address, mobile device ID, other unique ID, device information (device model, operating system version, date and time of access, mobile network information, cookie settings). | A. Purposes for Collection: 1. Provide You Services (facilitate access to Qoluna services, create and manage your account on Services; identify and recognize you across services and devices); 2. Internal Business Purposes (provide and improve our services; market research and auditing; understand how you use our services, including analyzing trends and usage patterns); 3. Marketing (to send you special deals, offers, invites to events, and similar information from us or third parties); 4. Advertising (to tailor content, including advertising and listening recommendations, to you on the Services and on other websites and services; to monitor and control the ad delivery, performance and frequency); 5. Administrative (investigate and prevent fraud and other illegal activities; detect and troubleshoot technical issues). |
B. Categories of Third Parties the Data Is Disclosed to: 1. Other Qoluna Users (including those on your account/subscription), 2. Technology Systems Service Providers (including webhosts, database hosts, software-as-a-service providers, cloud computing providers, technology maintenance, repair), 3. Customer Service Providers (email delivery and text messaging vendors), 4. Third-Party Business Relationships (unaffiliated parties that are joint marketing and licensing relationships), 5. Third-Party Advertising Entities and Analytics Providers (analytics companies, marketing agencies), 6. Security Vendors, 7. Affiliates and Subsidiaries | |
C. Categories of Third Parties to Whom the Data is Sold/Shared for Targeted Advertising: 1. Affiliates and Subsidiaries, 2. Third-Party Advertising Entities and Analytics Providers, 3. Third-Party Business Relationships | |
Audio and Visual Data – This may include images, video, audio recordings, voice data when you use certain features of Qoluna services. | A. Purposes for Collection: 1.Provide You Services (facilitate access to Qoluna services, including to understand and respond to voice commands; respond to your inquiries and provide customer service); 2. Internal Business Purposes (provide and improve our services; market research and auditing); 3. Administrative (detect and troubleshoot technical issues). |
B. Categories of Third Parties the Data Is Disclosed to: 1. Technology Systems Service Providers (including webhosts, database hosts, software-as-a-service providers, cloud computing providers, technology maintenance, repair), 2. Security Vendors | |
C. Categories of Third Parties to Whom the Data is Sold/Shared for Targeted Advertising: This category of data is not sold or shared for targeted advertising. | |
Coarse Geolocation Data – This may include rough or approximate location at hometown, city, state, region/country level and may be derived from IP address. Does not include precise geolocation (see above). | A. Purposes for Collection: 1. Provide You Services (facilitate access to Qoluna services, create and manage your account on Services; personalize your service; exercise territorial limits where required); 2. Internal Business Purposes (provide and improve our services; market research and auditing; understand how you use our services, including analyzing trends |
and usage patterns); 3. Marketing (to send you offers, invitations to events, and similar information from us or third parties); 4. Advertising (to tailor content, including advertising and listening recommendations, based on your location on the Services and on other websites and services); 5. Administrative (investigate and prevent fraud and other illegal activities). | |
B. Categories of Third Parties the Data Is Disclosed to: 1. Technology Systems Service Providers (including webhosts, database hosts, software-as-a-service providers, cloud computing providers, technology maintenance, repair, security vendors), 2. Customer Service Providers (email delivery and text messaging vendors), 3. Third-Party Advertising Entities and Analytics Providers (analytics companies, marketing agencies), 4. Security Vendors, 5. Affiliates and Subsidiaries | |
C. Categories of Third Parties to Whom the Data is Sold/Shared for Targeted Advertising: 1. Affiliates and Subsidiaries, 2. Third-Party Advertising Entities and Analytics Providers |
Nevada Consumer Health Data Privacy Notice
Updated: September 25, 2025
This Nevada Consumer Health Data Privacy Notice supplements the information in the Qoluna Privacy Policy. It applies solely to Nevada consumers who interact with us in an individual or household capacity and applies only to personal information defined as “consumer health data” subject to the Nevada Consumer Health Data Privacy Act.
What Does This Privacy Notice Cover?
This Notice describes what consumer health data we collect, how we collect and use it, who we disclose it to and why, and the choices you may have regarding our use or disclosure of your consumer health data. This Notice only applies to consumer health data, which is a subset of personal information that identifies your past, present, or future physical or mental health status. Examples of consumer health data are provided below.
What Is Not Covered in This Privacy Notice?
This Notice does not apply to any personal information other than consumer health data subject to the Nevada Consumer Health Data Privacy Act. Consumer health data does not include information generated by your interactions with us, such as browsing or purchasing, that does not identify your health status.
Consumer health data also does not include publicly available information, protected health information subject to HIPAA, or personal information that has been deidentified. To the extent we process deidentified information, we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.
What Categories of Consumer Health Data Do We Collect?
We may collect or receive the categories of consumer health data listed below. Not all categories will be collected or received for every individual, unless that information constitutes protected health information subject to HIPAA.
Information identifying bodily functions, vital signs, or symptoms
Measurements of bodily functions, vital signs, or symptoms
Information identifying a health condition, treatment, disease, or diagnosis
Information identifying a health-related surgery or procedure
Information identifying the purchase of prescribed medication
Information identifying diagnoses or diagnostic testing, treatment, or medication
Reproductive or sexual health information
Information that identifies an individual’s intention to seek health care services
Information that we derive or extrapolate from data that is not consumer health data, and then use to associate an individual to the information listed above
What Are the Categories of Sources From Which We Collect Your Consumer Health Data?
We may obtain consumer health data from different sources, as described in the Additional Details About Our Personal Data Practices section of the Qoluna Privacy Policy [insert link] and provided below:
Provided directly by you or a member of your household
Collected from a device associated with you or your household
Collected from a Qoluna subsidiary
Collected from third party service provider
What Are the Purposes for Collecting Your Consumer Health Data?
We may collect and use consumer health data as provided below:
To provide you with the Qoluna’s products and services that you request.
To exchange data with connected devices, such as wearable devices.
To provide customer support service.
To fulfill our legal functions or obligations, such as maintaining and auditing compliance.
Helping to ensure security and integrity of our systems, including detection and prevention of security incidents.
To detect or prevent harmful behavior such as identity theft, fraud, harassment, or deceptive activities, or activities that are illegal under applicable law.
For other purposes with your consent
What Categories of Consumer Health Data Do We Share?
We may share each of the categories of consumer health data described above. In particular, we may share consumer health data, with your consent, to complete transactions or provide products or services you have requested, and for the purposes described herein.
Who Do We Share Your Consumer Health Data With and Why?
We may share consumer health data with business partners such as those providing advertising and technology services, governmental agencies and legal bodies, Qoluna subsidiaries, and purchasers of or successors to our business or assets.
We also may permit third parties to collect consumer health data over time on our websites and mobile apps, and across other participating websites and mobile apps.
How Can You Exercise Your Nevada Consumer Health Data Rights?
If you are a resident of Nevada, you may have the right to (1) confirm whether we have collected your consumer health data; (2) confirm whether we have disclosed or sold your consumer health data; (3) delete your consumer health data; or (4) withdraw your consent or authorization relating to such data. You can make these requests by contacting us at support@qoluna.com.
How To Submit an Appeal
You may appeal our decision with respect to a request you have submitted by contacting us at [b]support@qoluna.com.
How Will I Know if This Privacy Notice Changes?
We will provide notice of significant updates, but please check this Notice periodically for changes. We will post the effective date at the top of this Notice.
You may contact us with questions or comments about this Notice or how we handle your consumer health data at:
Qoluna Health, Inc.
support@qoluna.com
Washington Consumer Health Data Privacy Notice
Updated: September 25, 2025 .
This Washington Consumer Health Data Privacy Notice supplements the information in the Qoluna Privacy Policy. It applies solely to Washington consumers who interact with us in an individual or household capacity and applies only to personal information defined as “consumer health data” subject to the Washington My Health My Data Act.
What Does This Privacy Notice Cover?
This Notice describes what consumer health data we collect, how we collect and use it, who we disclose it to and why, and the choices you may have regarding our use or disclosure of your consumer health data. This Notice only applies to consumer health data, which is a subset of personal information that identifies your past, present, or future physical or mental health status. Examples of consumer health data are provided below.
What Is Not Covered in This Privacy Notice?
This Notice does not apply to any personal information other than consumer health data subject to the Nevada Consumer Health Data Privacy Act. Consumer health data does not include information generated by your interactions with us, such as browsing or purchasing, that does not identify your health status.
Consumer health data also does not include publicly available information, protected health information subject to HIPAA, or personal information that has been deidentified. To the extent we process deidentified information, we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.
What Categories of Consumer Health Data Do We Collect?
We may collect or receive the categories of consumer health data listed below. Not all categories will be collected or received for every individual, unless that information constitutes protected health information subject to HIPAA.
Information identifying bodily functions, vital signs, or symptoms
Measurements of bodily functions, vital signs, or symptoms
Information identifying a health condition, treatment, disease, or diagnosis
Information identifying a health-related surgery or procedure
Information identifying the purchase of prescribed medication
Information identifying diagnoses or diagnostic testing, treatment, or medication
Reproductive or sexual health information
Information that identifies an individual’s intention to seek health care services
Information that we derive or extrapolate from data that is not consumer health data, and then use to associate an individual to the information listed above
What Are the Categories of Sources From Which We Collect Your Consumer Health Data?
We may obtain consumer health data from different sources, as described in the Additional Details About Our Personal Data Practices section of the Qoluna Privacy Policy [insert link] and provided below:
Provided directly by you or a member of your household
Collected from a device associated with you or your household
Collected from a Qoluna subsidiary
Collected from third party service provider
What Are the Purposes for Collecting Your Consumer Health Data?
We may collect and use consumer health data as provided below:
To provide you with the Qoluna’s products and services that you request.
To exchange data with connected devices, such as wearable devices.
To provide customer support service.
To fulfill our legal functions or obligations, such as maintaining and auditing compliance.
Helping to ensure security and integrity of our systems, including detection and prevention of security incidents.
To detect or prevent harmful behavior such as identity theft, fraud, harassment, or deceptive activities, or activities that are illegal under applicable law.
For other purposes with your consent
What Categories of Consumer Health Data Do We Share?
We may share each of the categories of consumer health data described above. In particular, we may share consumer health data, with your consent, to complete transactions or provide products or services you have requested, and for the purposes described herein.
Who Do We Share Your Consumer Health Data With and Why?
We may share consumer health data with business partners such as those providing advertising and technology services, governmental agencies and legal bodies, Qoluna subsidiaries, and purchasers of or successors to our business or assets.
We also may permit third parties to collect consumer health data over time on our websites and mobile apps, and across other participating websites and mobile apps.
How Can You Exercise Your Washington Consumer Health Data Rights?
If you are a resident of Washington, you may have the right to (1) request access to your consumer health data; (2) confirm whether we have disclosed or sold your consumer health data; (3) delete your consumer health data; or (4) withdraw your consent or authorization relating to such data. You can make these requests by contacting us at support@qoluna.com.
How To Submit an Appeal
You may appeal our decision with respect to a request you have submitted by contacting us at support@qoluna.com.
How to Contact Us
We will provide notice of significant updates, but please check this Notice periodically for changes. We will post the effective date at the top of this Notice.
You may contact us with questions or comments about this Notice or how we handle your consumer health data at:
Qoluna Health, Inc.
support@qoluna.com
California Consumer Privacy Act Notice
Last Updated: September 9, 2024
This California Consumer Privacy Act Notice (“Notice”) supplements the information contained in the Qoluna Privacy Policy [insert link] and applies only to California residents regarding their
personal information, as required by the California Consumer Privacy Act of 2018 (“CCPA”), CCPA as amended by the California Privacy Rights Act of 2020 (“CRPA”) and any implementing regulations adopted thereunder. Terms used herein (including defined capitalized terms) shall have the meanings set forth in the CCPA, CPRA, and the associated regulations, and in our Privacy Policy [insert link] and Terms of Use [insert link].
Your Rights
Under the CCPA, California Consumers have the following rights, all subject to the meanings and exceptions set forth in the CCPA:
Right to Know or Access – the right to request that we disclose to you what personal information we collect, use, disclose, share and sell, including the right to request that we provide to you the categories and specific pieces of personal information we have collected about you;
Right to Delete – the right to request that we delete certain personal information we collect about you, subject to exceptions specified under the CCPA;
Right to Correct – the right to request that we correct inaccurate personal information we hold about you;
Right to Opt-Out of Sale or Sharing – you may opt-out from the sale of your personal information, or from the sharing of your personal information to a third party for crosscontext behavioral advertising and
Right to Limit the Use and Disclosure of Sensitive personal information – you may tell us to limit the use or disclosure of your Sensitive personal information to purposes set forth in the statute, including for use which is necessary and anticipated to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services.
More information on each of these rights is below. In your request, you must provide enough information to allow us to verify that you are the person about whom we collected personal information, or their authorized representative. You must also describe your request with enough detail so that we can understand, evaluate, and respond to it. We can’t respond to your request if we can’t verify your identity. Making such a request does not require you to create an account with us, and we will only use the information you provide in a request to verify your identity. Please note to ensure the integrity of our systems and the proper fulfillment of your request, we cannot simultaneously process requests for access and deletion. Please wait until you are notified that a pending request for access or deletion has been completed before submitting a subsequent request for the second process.
Right to Limit the Use and Disclosure of Sensitive Personal Information
As disclosed in the chart below, some of the personal information we collect may be considered sensitive personal information under California law. This includes health data, race or ethnicity, religion, and precise geolocation derived from a device and intended to locate a consumer. If you are a California Consumer and would like to exercise your Right to Limit Use and Sharing of such sensitive personal information, please submit your request by contacting us at support@qoluna.com.
Do Not Sell My Personal Information or Share For Cross Contextual Behavioral Advertising We sometimes share personal information to third parties as disclosed in the chart below, which in some instances may qualify as a sale under CCPA. If you use us or tell us directly to share your personal information with a third party, that disclosure is not a sale.
We may share your personal information to third parties for the purpose of cross-context behavioral advertising, i.e. targeted advertising.
If you are a California Consumer and would like to exercise your Right to Opt-out of Sale or Sharing for Cross-Contextual Behavioral Advertising, please submit your request at support@qoluna.com.
Cookie-Based Opt-Outs for Do Not Sell My Personal Information or Share for Cross-Contextual
Behavioral Advertising
Qoluna engages third parties in online advertising practices, which may be considered a sale or sharing for cross-context behavioral advertising, as defined in the CCPA and CPRA. You may opt out of cookies set by third parties by launching the Cookie Manager [adjust to fit Qoluna website(s)] from the footer of our web pages. In addition, the Digital Advertising Alliance also offers tools for California consumers to send requests under the CCPA and CPRA to opt out of the sale of personal information by some or all of the participating companies. For more information, visit https://www.privacyrights.info/.
Right to Know
As a California Consumer, you have the right to know the categories of personal information we have collected about you, the categories of sources from which personal information is collected, our business and commercial purposes for collecting or selling personal information, and the categories of personal information we have disclosed for a business purpose, the categories of third parties with whom we share personal information, the categories of personal information we have sold and the categories of third parties to whom the personal information was sold, in the 12-month period preceding our receipt of your request. You also have the right to request access to the specific pieces of personal information we have collected about you in the preceding 12-month period, or upon specific request which we will deliver to you electronically, in a portable format where feasible. If you are a California Consumer and would like to exercise your Right to Know, contact us at support@qoluna.com.
You can submit up to two requests to know within a 12-month period. In order to have us provide specific pieces of information, we may require a signed declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request.
Right to Delete
California Consumers have the right to request deletion of the personal information about you that we have collected from you, subject to the exceptions set forth under the CCPA. If you are a California Consumer and would like to exercise your Right to Delete, contact us at support@qoluna.com.
Please note that as part of the verification process, once you submit a request to delete, we may follow up and require you to confirm that you want your information deleted. Please note that if you have an active subscription to any of the Service(s) (including trial, paid or other), when you request deletion, we will not cancel your subscription, and we will retain such information as reasonably necessary to provide the service(s), manage contact preferences, and otherwise in accordance with the exceptions noted above..
Please note that even in light of a request for deletion, we are unable to delete information needed to:
Continue to provide service(s) if you have an active trial, paid or other subscription to the Services, fulfill the terms of a written warranty, provide goods or services you’ve requested, complete a transaction or perform a contract ;
Help ensure security and integrity;
Identify, repair, and debug errors that impair the Services, our systems, or other functionality;
Comply with legal or reporting obligations, including to pursue or defend legal claims, exercise or enable others to exercise any rights provided by law, enforce or comply with contractual obligations, respond to valid requests for information, and comply with or enforce applicable laws and regulations;
Enable other internal uses consistent with your expectations based on your relationship with us or the context in which you provided the information; or
Enable or enforce any other exceptions provided by CCPA or CPRA.
Right to Correct Inaccurate Information
California Consumers have the right to request that we correct inaccurate information we hold about you. If you are a California Consumer and would like to exercise your Right to Correct, contact us at support@qoluna.com.
Right to Nondiscrimination for the Exercise of a Consumer’s Privacy Rights
California consumers have the right to not receive discriminatory treatment for exercising CCPA and CPRA rights. We will not discriminate against you for exercising any of your CCPA and CPRA rights.
Verification
We will take reasonable steps to verify your identity based upon the information you provide and the type of request you are making.
For your protection, you must provide sufficient information to verify your identity in order for us to fulfill a request to access, delete or correct personal information. We may ask that you provide us with information, beyond your full name and email address in order to verify your identity and fulfill your request. If we are unable to verify that the individual submitting the request is the same individual about whom we have collected information (or someone authorized by that individual to act on their behalf), we will not be able to process the request.
Authorized Agents
If you are an authorized representative submitting a request on a California Consumer’s behalf, please submit the applicable request pursuant to these instructions along with a written permission signed by the individual who is the subject of the request, authorizing you to make the request on their behalf. The written permission must state your full legal name and the full legal name of the individual who is the subject of the request and needs to be clear about the permission granted. Alternatively, you may submit a copy of a power of attorney under Probate Code sections 4000-4465. In either case, please also indicate in your submission the nature of your request. Both your identity and that of the consumer may be independently verified before we fulfill your request. We may ask the consumer to verify their identity directly with us, unless as an authorized agent, you are acting specifically pursuant to a power of attorney under the California Probate Code. Please keep in mind that if we do not receive adequate proof that you are authorized to act on the consumer’s behalf, we may deny the request. For the safety and security of our customers, any specific pieces of personal information requested under a CCPA Right to Access request will be returned to the requesting customer and not to an authorized agent, unless the authorized agent is acting specifically pursuant to a power of attorney under the California Probate Code.
Users Younger Than 18
Qoluna does not knowingly collect, sell or share personal information of users under 18 years of age.
Collection and Sharing of Personal Information
Categories of Personal Information We Collect
The personal information we collect about you will depend upon how you access and use the Qoluna Services or otherwise interact with us. Accordingly, we may not collect all of the below information about you.
In addition to the below, we may collect and/or use additional types of information and will do so after providing notice to you and obtaining your consent to the extent such notice and consent is required by the CCPA and CPRA.
Below are the categories of personal information collected by Qoluna:
Category of PI collected | Categories of Sources of PI | Business or Commercial Purposes for which PI is Collected | Categories of Third Parties to whom this type of PI May Be Disclosed for a Business Purpose | Categories of Third Parties to whom this type of PI May Be Sold or Shared for Cross Contextual Behavioral Advertising
|
Identifiers and Contact Information (such as name, email address, account name or alias, username, password, IP address, account ID, electronic serial number (ESN), radio ID, other device and other technological identifiers) |
product retailers, analytics providers, marketing companies, advertising agencies and other entities, data providers
organizations
|
Devices;
|
agree to or request that we share your information with them, ● Other third parties (including government agencies) as required by law or in connection with court proceedings (such as pursuant to subpoenas or court orders)
|
and sometimes location-based advertisements, which may be considered a “sale” or “share” under the CCPA and CPRA under certain circumstances.
|
issues;
agreements and policies;
| ||||
Payment Information (if you purchase a product or Service directly from Qoluna, this include the digits of your payment card, expiration date, billing zip code, and a secure payment token associated with your payment card) |
|
|
or court orders)
| We do not sell or share this Personal Information. |
agreements and policies;
| ||||
Collected Characteristics (such as gender, age, ethnicity, marital status, number of drivers or individuals in your household, and content preferences, and consumer interest segments) |
|
|
|
entities with whom we have marketing or licensing agreements may have access to this data, including to better serve you more relevant and sometimes location-based advertisements, which may be considered a “sale” or “share” under the CCPA and CPRA under certain circumstances. |
Commercial information (such as products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.) |
product retailers, analytics providers, marketing companies, advertising agencies and other entities, data providers
technology
|
auditing;
usage patterns;
parties;
|
agree to or request that we share your information with them ● Other third parties (including government agencies) as required by law or in connection with court proceedings (such as pursuant to subpoenas or court orders). |
considered a “sale” or “share” under the CCPA and CPRA under certain circumstances. |
Internet or other activity information (such as hardware model, browser, internet service provider, operating system, listening behavior, interactions with content on the Services) |
product retailers, analytics providers, marketing companies, advertising agencies and other entities, data providers
|
auditing;
Devices;
parties;
agreements and policies;
|
account/subscription;
| ● Subsidiaries and affiliated companies ● Third party advertising, analytics, and business partners, including unaffiliated entities with whom we have marketing or licensing agreements may have access to this data, including to better serve you more relevant and sometimes location-based advertisements, which may be considered a “sale” or “share” under the CCPA and CPRA under certain circumstances. |
Geolocation Information (approximate or rough location, region, country)
|
technologies
|
usage patterns;
|
| ● Subsidiaries and affiliated companies ● Third party advertising, analytics, and business partners, including unaffiliated entities with whom we have marketing or licensing agreements may have access to this data, including to better serve you more relevant and sometimes location-based advertisements, which may be considered a “sale” or “share” under the CCPA and CPRA under certain circumstances. |
promotions, special deals or services offered by us or third parties;
issues;
agreements and policies;
| ||||
Audio and visual information (such as images, audio, or video recordings) |
of the Services)
companies
|
respond to voice commands;
agreements and policies;
|
Third parties or their affiliated companies when you agree to or request that we share your information with them,
| We do not sell or share this personal information. |
Inferences drawn from information we collect (These may relate to your perceived interests, preferences, characteristics, or behavior) | We may draw inferences ourselves or acquire them from third parties such as advertising networks and data providers
|
auditing;
parties; |
agree to or request that we share your information with them, ● Other third parties (including government agencies) as required by law or in connection with court proceedings (such as pursuant to subpoenas or court orders). | ● Subsidiaries and affiliated companies ● Third party advertising, analytics, and business partners including unaffiliated entities with whom we have marketing or licensing agreements, may have access to this data, including to better serve you more relevant and sometimes location-based advertisements, which may be considered a “sale” or “share” under the CCPA and CPRA under certain circumstances. |
Sensitive Personal Information (“SPI”) (such as personal information that reveals an account log-in or debit or credit card number in combination with password or other credentials, racial or ethnic origin, religion, health, sexual orientation, precise geolocation) |
product retailers, advertisers, agencies, and other advertising entities, and data providers
kits |
|
| ● Subsidiaries and affiliated companies ● Third party advertisers, advertising agencies, measurement companies and analytics companies, to serve you more relevant and sometimes location-based advertisements, which may be considered a “sale” or “share” under the CCPA and CPRA under certain circumstances.
|
QUESTIONS AND CONTACT INFORMATION
If you have any questions about any of the information on this page, contact us at support@qoluna.com.
4910-6264-9446 v.2
[a]Do not currently have this implemented
[b]support@qoluna.com