Privacy Policy

WEBSITE AND MOBILE APP PRIVACY NOTICE

Effective: October 1, 2018

This Website Privacy Notice informs you of important information about how Boston MD, LLC (“Boston MD,” “we,” “us” or “our”) processes the personal data that we collect in online and offline formats, the privacy practices we undertake, the types of data we collect, how we secure that data, and how long we retain that data.

 

Boston MD does not provide direct medical services.  Rather, we provide consultation and guidance services about medical care.  Your interactions with Boston MD via our services are not intended to take the place of your hands-on medical care directly from your physicians and health care providers (“Provider(s)”).

 

Because we may have access to health information, Boston MD adheres to the requirements outlined by the Health Insurance Portability and Accountability Act (HIPAA), which relates to the security and privacy of an individual’s protected health information (“PHI”).  For more information about your privacy rights as a paid subscriber (“Member”) or recipient of our health care consulting Services, please view Boston MD’s HIPAA Privacy Notice for Health Information.  To the extent that there is a conflict between this Privacy Notice and the HIPAA Notice with respect to PHI, the HIPAA Notice will prevail.

 

When we use the term, “Personal Data,” we mean data that reasonably can be used to identify a living person, or that reasonably relates to a living person, including health information.

 

When we use the term “Services” we mean to refer collectively to:

 

HOW WE COLLECT YOUR PERSONAL DATA

We may collect your Personal Data through different means:

(i) when you decide to interact with us, either by providing us your information through the “Contact Us” page on the Site, by email, regular mail, or telephone;

(ii) when you visit our Site, through automated data tracking technology; and

(iii) when you become a Member and provide us with information directly or authorize third-party medical care Providers and other third parties to provide us your Personal Data.

It is up to you whether you want to provide us with information or authorize third-party Providers to provide us with information. When we ask you to provide information, you can decline and still visit the Site to learn more about us and what we do. However, if you choose not to provide information to us, we may be unable to provide you our Services.

 

TYPES OF PERSONAL DATA WE COLLECT

We may collect the following types of Personal Data, which are or may be capable of identifying an individual (“Personal Data“):

 Types of Information You Provide to Us:

  • Name, address, age, gender, birth date, job title, communication preferences, email address, telephone numbers, address, employer, location, travel information, information to verify identity;
  • Medical records and information that you provide to us or that you authorize third parties to release to us, which may include diagnosis, previous treatments, general health, and health insurance, and information about your current medical condition;
  • Payment information, such as your credit card number; and
  • Records of your correspondence with us.

If you submit any Personal Data to us relating to other people, you represent that you have the authority to do so and permit us to use the information in accordance with this Privacy Notice. By submitting Personal Data, you grant Boston MD the right to transmit, monitor, retrieve, store and use your information in connection with the operation of the Site.

Types of Information We Collect Through Technology:

When you use our Site, we use technology and Google Analytics, to gather information on how visitors are using the Site. Specifically, we use technology to gather information about the browser, device, internet connection, IP address, time zone setting, operating system and platform, via cookies employed on our Site.  An IP address is a number automatically assigned to your computer whenever you access the Internet. IP addresses allow computers (including mobile devices and tablets) and servers to recognize and communicate with one another. We collect IP address information so that we can properly manage our system and gather information about how our site is being used. This includes the device type and browser you are using, location data, the pages you are viewing and your interactions on the page. Your IP address may be associated with records containing Personal Data. We collect details of visits to our Site, including the volume of traffic received, logs and the resources that you have accessed. We may also collect certain location information such as your mobile device’s GPS signal, or information about nearby WiFi access points and cell towers.   (Please also see the “Cookies Notice” section below.)

Health Information We Collect from Members, Third-Party Health Care Providers and Emergency Care Providers: 

When you become a Member or ask us to provide medical consultation Services, we may collect identifiable demographic information, medical records and/or other information, about your past, present, or future physical or mental health, or condition; and information concerning the provision of health care to you that is given to us by you, by Providers, or other third parties.  Please see our HIPAA Privacy Notice for Health Information.

 

HOW AND WHY WE USE YOUR INFORMATION (LEGAL BASIS)

We only collect the information reasonably necessary to respond to inquiries about our Services, to provide you the Services, to carry out our operations, as required by law, and for the other legitimate business purposes, under applicable data protection legislation (“Legitimate Interest(s)“) as provided below:

  • To inform you about the Services in which you have indicated an interest; Respond to your questions and requests and improve customer service; To assist in business development and general marketing and building relationships;
  • To record your name and contact information, health and travel information, and other Personal Data for legitimate business purposes, so that we know about you and how to give you appropriate guidance, and for health and safety purposes so that we can provide our Member Services to you in the event of an emergency;
  • To perform our contract with you as a Member; satisfy contractual necessity to conduct our operations and provide you with the services and products we offer; to perform essential business operations and to manage your account; to contact you with information about patient care issues, treatment choices, and follow-up care instructions;
  • To improve the Site to provide you with better services, for example, we may use your personal data to improve the layout of our website based on the click path you utilized to access certain information within the website; and
  • To comply with legal obligations and professional responsibilities; To verify your identity or conduct internal audits or reviews.

We do not monitor or profile visitors to our Site or collect, in any automated manner, any special categories of sensitive Personal Data about you (for example, your religious or philosophical beliefs, information about your health and genetic and biometric data, or any information about criminal convictions and offences.) No automated decision-making, including profiling, is used when processing your Personal Data.

Additional Uses of Personal Data:

In addition to the uses described above, we may use your Personal Data for the following purposes.  Some of these uses may, under certain circumstances be based on your consent, may be necessary to fulfill our contractual commitments to you, or are necessary to serve our legitimate interests (“Legitimate Interest(s)”) in the following business operations:

  • Providing you with newsletters, articles, alerts and announcements, event invitations, and other information that we believe may be of interest to you;
  • Providing you with marketing information about our services and;
  • Conducting research, surveys, and similar inquiries to help us understand Member needs;
  • Analyzing your interactions with us and our website, and improving our products, services, programs, and other offerings;
  • Preventing, investigating, or providing notice of fraud, unlawful or criminal activity, or unauthorized access to or use of Personal Data, our Site or data systems; or to meet legal obligations; and
  • Enforcing our Terms of Use and other agreements.

 

HOW WE SHARE AND DISCLOSE PERSONAL DATA

We may disclose aggregated information that does not identify any individual (and therefore, is not deemed to be Personal Data) without restriction.  We share Personal Data with the following categories of recipients:

Third-party Vendors.  Your Personal Data will only be shared with and processed by our affiliates and non-affiliated third-party service providers as permitted by law and for the purposes described in this Privacy Notice.  We may disclose Personal Data to certain non-affiliated specialized service providers, including professional advisors, consultants, insurers, technical service providers, health care providers, and other third parties, who are bound by contractual obligations to keep Personal Data confidential and use it only for the purposes for which we disclose it to them.  We may disclose your Personal Data to third-party service providers to provide us with services such as Site hosting, including information technology and telephony services, and related infrastructure, customer service, e-mail delivery, auditing and other similar services.

Healthcare providers, insurance companies, and other healthcare-related entities. We may share your information with other health care providers, laboratories, government agencies, insurance companies, organ procurement organizations, medical examiners or funeral directors, and other entities relevant to providing you with treatment options and support.  If you are a Member, we may disclose and share your health information in the following ways:

  • with your family, close friends, or others involved in your care, including Providers who are treating you;
  • if we believe it is in your best interest or to lessen a serious and imminent threat to your health or safety, if you are not able to tell us your preference, for example, if you are unconscious;
  • with other professionals or Providers who are treating you;
  • if state or federal laws require it, including with the Department of Health and Human Services if it wants to see that we’re complying with federal privacy law.
  • with organ procurement organizations, a coroner, medical examiner, or funeral director when an individual dies.
  • for workers’ compensation claims, for law enforcement purposes under specific conditions such as reporting when someone is the victim of a crime;
  • with health oversight agencies for activities authorized by law;
  • in a disaster relief situation or a public health event to lessen a serious and imminent threat to the health or safety of others;
  • to help in preventing disease; helping with product recalls; reporting adverse reactions to medications; reporting suspected abuse, neglect, or domestic violence;
  • for special government functions such as military, national security, and presidential protective services; and/or
  • in response to a court or administrative order, or in response to a subpoena.

Corporate affiliates. We may share your information with our corporate affiliates that are subject to this policy.

Business transfers. When applicable, we may share your information in connection with a substantial corporate transaction, such as the sale of a website, a merger, consolidation, asset sale, or in the unlikely event of bankruptcy.

With your consent or at your direction. We may share information for any other purposes disclosed to you at the time we collect the information or pursuant to your consent or direction.

Other Legal Reasons.  In addition, we may use or disclose your Personal Data as we deem necessary or appropriate: (1) under applicable law, including laws outside your country of residence; (2) to respond to requests from public and government authorities including public and government authorities outside your country of residence; (3) to pursue available remedies or limit damages we may sustain; (5) to protect our operations or those of any of our affiliates; (6) to protect the rights, privacy, safety or property of Boston MD, our affiliates, you and others; and (7) to enforce our terms and conditions.

Boston MD keeps Personal Data on file, but does not share, sell, license or transmit this information to third parties or external vendors unless required to do so by legal, judicial or governmental proceedings, or to provide the services requested.

 

DATA SECURITY

We are required by law to use reasonable organizational, technical and administrative measures to maintain the privacy and security of your Personal Data within our organization.  Accordingly, we prevent unauthorized access by a secure firewall and use of security technologies to protect the integrity and privacy of any Personal Data you provide.  Although we work hard to protect your Personal Data, Boston MD cannot guarantee the security of any information you transmit to us through online forms and applications, and you do so at your own risk.  Please note that email is considered a nonencrypted (and therefore nonsecure) form of communication, and it can be accessed and viewed by others without your knowledge and permission. For that reason, to protect your privacy, please do not use email to communicate information that you consider confidential.  Unfortunately, no data transmission or storage system can be guaranteed to be secure at all times.  If you have reason to believe that your interaction with us is no longer secure, please immediately notify us in accordance with the “Contact Us” section below. We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.

 

ADDITIONAL DISCLOSURES – EUROPEAN ECONOMIC AREA

This section applies only to our processing of Personal Data within the scope of the Data Protection Act 2018 (“DPA“), the EU Data Protection Directive 95/46/EC, the Electronic Communications Data Protection Directive 2002/58/EC, the Privacy and Electronic Communications (EC Directive) Regulations 2003, and Regulation (EU) 2016/679, known as the General Data Protection Regulation (“GDPR”) from one or more of the European Union Member States plus Iceland, Lichtenstein and Norway (together known as the “European Economic Area” or “EEA”). Defined terms shall have the meanings ascribed in the GDPR, unless otherwise defined herein.

Data Retention.  We retain Personal Data pursuant to our records retention program, for as long as is necessary for the purposes set out in this Website Privacy Notice, unless a longer period is required under applicable law or is needed to resolve disputes or protect our legal rights, in accordance with the principles set forth in Article 5(1) of the GDPR.  The criteria used to determine the period for which Personal Data about you will be stored varies depending on the legal basis under which we process such Personal Data:

Legitimate Interests

 For a reasonable period based on the particular interest, considering the fundamental interests and the rights and freedoms of the Data Subjects.
Contractual Necessity For the duration of the contract plus some additional limited period that is necessary to comply with law or that represents the limitation period for legal claims that could arise from the contractual relationship.
Legal Obligation For the duration of time we are legally obligated to keep the information, which for health information kept by a Medical Professional, is seven (7) years
Consent For the period necessary to fulfill the underlying agreement with you for Member Services, subject to your right, under certain circumstances, to have certain Personal Data about you erased (see Data Subject Rights below).

If we face a threat of legal claim, we may need to apply a “legal hold” that retains information beyond our typical retention period.  In that case, we will retain the information until the hold is removed, which typically means the claim or threat of claim has been resolved.

Transfers of Information Across Borders.  Any information that you provide to us may be stored and processed in, and transferred between, any of the countries in which you may be located, and/or in which Boston MD and its agents, contractors and affiliated organizations have offices, to enable Boston MD to use that information as set out in this Privacy Notice. This includes countries such as China and the United States.  Not all these countries have data protection laws equivalent to those in force in the EEA.

Data Subject Rights.  Individuals from the EEA whose Personal Data we process subject to the GDPR have certain rights as required by law, including the right of access, rectification, restrict processing, objection, withdraw consent, erasure, data portability, and to make a complaint, as follows:

Access.  Individuals have the right to know if we are processing Personal Data about them and, if so, to access and obtain a copy of Personal Data about them, as well as information relating to the processing of that data.

Rectification.  Individuals have the right to have us correct or update any Personal Data about them that is inaccurate or incomplete.

Restrict Processing.  Individuals have the right to restrict or limit the ways in which we process Personal Data about them where the accuracy of the Personal Data is contested by them, where data has been obtained by us unlawfully, where the individual has objected to our processing of the data (see right of objection below) and we are considering whether to cease processing, or where we no longer need to process the Personal Data.

Objection.  Individuals have the right to object to our processing of their Personal Data where we are relying on Legitimate Interests as our legal basis and their rights override our Legitimate Interests in processing their Personal Data. Individuals also have the right to object to our processing of their Personal Data for direct marketing purposes or for research or statistical purposes.

Withdrawal of Consent.  Where we rely on consent as the basis for processing Personal Data, individuals have the right to withdraw their consent.

Erasure.  Individuals have the right to request deletion or erasure of their Personal Data in several circumstances where required by law. These include where we no longer require the Personal Data for the purposes for which it was collected, the individual has withdrawn consent or, where we are relying on Legitimate Interests as a legal basis, and the individual’s rights override our Legitimate Interests.

Data Portability.  Individuals have the right to obtain a copy of the Personal Data we hold about you in a structured machine-readable format and to have it transmitted to another controller. This right only occurs where we are relying on your consent or performance of a contract as our legal basis and the processing is carried out automatically.

Make a Complaint.  Individuals also have the right to make a complaint about our Personal Data handling practices to their local Supervisory Authority.

 

RESIDENTS OF STATE OF CALIFORNIA, UNITED STATES

California residents are entitled once a year, free of charge, to request and obtain certain information regarding our disclosure, if any, of certain categories of Personal Data to third parties for their direct marketing purposes in the preceding calendar year. We do not share Personal Data with third parties for their own direct marketing purposes. To make such a request, please send an email to info@bostonmd.org or write to us at 22 Welgate Road, Medford, MA  02155. You may opt out of any marketing by us and from the disclosure of your Personal Data to third parties.

 

CAPACITY

This website is only intended for individuals who are at least 18 years of age. We do not knowingly encourage or solicit visitors to this website who are under the age of 18 or knowingly collect Personal Data from anyone under the age of 18 without parental fiduciary consent. If we learn we have collected or received Personal Data from a child under 18 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 18, please contact us at info@bostonmd.org.

 

E-MAIL MARKETING

We may periodically send you relevant alerts and newsletters by e-mail. To help improve our marketing activities, we often receive a confirmation when you open an e-mail or click on a link included in one of these emails, if your computer supports such capabilities. Instructions on how to unsubscribe from these alerts and newsletters are included in each e-mail.

 

COOKIES NOTICE

How we use Cookies.  We use cookies and related technologies (“Cookies”) to provide Services, gather information when users navigate through the Sites to enhance and personalize the experience, to understand usage patterns, and to improve our Sites, products, and Services.

Cookies on our Sites are generally divided into the following categories:

Essential Cookies.  These cookies are strictly necessary to provide you with our Services and to use some of their features, such as access to secure areas. Because these cookies are strictly necessary to deliver the Services, you cannot refuse them without impacting how our Services function.

Performance and Functionality Cookies. These cookies are used to enhance the performance and functionality of our Services but are non-essential to their use. However, without these cookies, certain functionality may become unavailable.

Analytics and Customization Cookies. These cookies collect information that is used to help us understand how our Services are being used or how effective our marketing campaigns are, or to help us customize our Services for you to enhance your experience.

Targeting Cookies. These record your visit to our Sites, the pages you have visited and the links you have followed to recognize you as a previous visitor and to track your activity on the Sites and other Sites you visit. These Cookies qualify as persistent cookies, because they remain on your device for us to use during a next visit to our Sites. You can delete these cookies via your browser settings. See below for further details on how you can control third-party targeting cookies.

Google Analytics.  This Site uses Google Analytics.  We will not and will not assist or permit any third party to pass information to Google that Google could use or recognize as personally identifiable data.  You may see how Google uses data when you use this Site at www.google.com/policies/privacy/partners.

How to Control Cookies:

You can review your Internet browser settings, typically under the sections “Help” or “Internet Options,” to exercise choices you have for certain Cookies. If you disable or delete certain Cookies in your settings, you may not be able to use features of the Sites. To learn more about the use of Cookies by Google for analytics see https://policies.google.com/technologies/cookies.  And to exercise choice regarding those Cookies, please see the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout. The opt-outs described above are device- and browser-specific and may not work on all devices.

 

LINKS TO OTHER SITES

Occasionally we may provide links to other sites for your convenience and information. These sites operate independently from our Sites and are not under our control. These sites may have their own privacy notices or terms of use, which you should review if you visit any sites linked through our Sites. We are not responsible for the content or use of these unrelated sites.

 

UPDATES TO THIS PRIVACY NOTICE

Although most changes are likely to be minor, Boston MD may change its Privacy Notice from time to time, and at Boston MD’s sole discretion. Boston MD encourages visitors to frequently check this page for any changes to its Privacy Notice.

 

HOW TO CONTACT US

If you have any queries, questions or concerns about this Privacy Notice or our Personal Data handling practices, please contact us at info@bostonmd.org or write to us at 22 Welgate Road, Medford, MA  02155.