Consumer Health Data Privacy Policy

For purposes of this Policy, Consumer Health Data generally means personal information that is linked or reasonably linkable to an individual and that identifies or can reasonably be used to identify that individual’s past, present, or future physical or mental health status, consistent with applicable law.

Protected Health Information governed by HIPAA is expressly excluded from this definition and is not governed by this Policy.

trellOS collects only the categories of Consumer Health Data reasonably necessary to provide requested services and operate our business. These categories may include:

Health-related information you voluntarily provide. If you submit an inquiry, request a demonstration, join a waitlist, complete an application, or otherwise communicate with us, you may voluntarily provide information relating to:

• Medical conditions
• Treatment interests
• Therapeutic areas
• Medication categories
• Clinical specialties
• Healthcare practice focus

We collect this information solely because you choose to provide it.

Purpose of collection: responding to inquiries; evaluating whether trellOS services are appropriate for your organization; supporting onboarding and implementation; regulatory and operational evaluation.

Practice information.We may collect information regarding practice specialty, clinical focus, therapeutic areas, services offered, and geographic service area. Examples may include hormone therapy, weight management, men’s health, women’s health, sexual health, longevity medicine, or other clinical practice areas.

Purpose of collection: customer qualification; platform configuration; pharmacy routing; regulatory scope assessment; operational onboarding.

trellOS does not use:

• Advertising pixels
• Cross-context behavioral advertising technologies
• Third-party advertising networks
• Session replay technologies
• Consumer profiling for advertising purposes

Accordingly, trellOS does not create health-related inferences from website browsing activity for advertising or marketing purposes. See our Cookies page.

Consumer Health Data is collected only from:

• Information you voluntarily provide.
• Communications you send to us.
• Applications submitted by healthcare organizations.
• Information provided by authorized representatives of healthcare organizations during onboarding.

trellOS does not purchase, license, obtain, append, or otherwise acquire Consumer Health Data from data brokers, list vendors, or other third-party marketing sources.

Consumer Health Data may be used only for legitimate business, operational, legal, security, and regulatory purposes, including:

• Responding to inquiries.
• Evaluating customer eligibility.
• Supporting onboarding.
• Providing requested services.
• Regulatory compliance.
• Customer support.
• Fraud prevention.
• Security monitoring.
• Maintaining business records.
• Protecting legal rights.
• Business continuity.
• Platform improvement.

Where applicable law requires affirmative consent for a particular collection, use, or disclosure of Consumer Health Data, trellOS will obtain such consent before engaging in the applicable activity.

trellOS does not sell Consumer Health Data.

trellOS does not disclose Consumer Health Data to third parties or affiliates for their own independent advertising or marketing purposes.

Consumer Health Data may be disclosed only to service providers performing services on behalf of trellOS, including:

• Cloud hosting providers
• Database providers
• Authentication providers
• Email delivery providers
• Customer support providers
• Security service providers
• Professional advisors
• Government agencies or regulators where required by law
• Courts or law enforcement pursuant to lawful legal process
• Successor entities in connection with mergers, acquisitions, financing transactions, bankruptcy proceedings, restructuring, or sale of assets

All service providers are contractually obligated to process Consumer Health Data solely on behalf of trellOS and only for authorized purposes. The current list is at /subprocessors.

Where applicable law requires separate authorization before Consumer Health Data may be sold or disclosed, trellOS will obtain such authorization before doing so.

Subject to applicable law, consumers may have the right to:

• Confirm whether trellOS collects Consumer Health Data.
• Access Consumer Health Data.
• Obtain information regarding categories of Consumer Health Data collected.
• Request correction where permitted by law.
• Request deletion of Consumer Health Data.
• Withdraw consent where processing is based upon consent.
• Obtain information regarding categories of third parties with whom Consumer Health Data has been shared.
• Appeal certain decisions regarding privacy requests where applicable.

To submit a request, please contact privacy@trellos.org. Please include “Consumer Health Data Request” in the subject line.

trellOS may verify the identity of the requesting individual before fulfilling a request. We respond within the timeframes required by applicable law and provide information regarding appeal rights where required.

Unless expressly authorized by you or required by applicable law, trellOS does not:

• Sell Consumer Health Data.
• Share Consumer Health Data with third parties for their independent marketing purposes.
• Use advertising pixels or third-party advertising networks.
• Engage in cross-context behavioral advertising using Consumer Health Data.
• Use geofencing around healthcare facilities for advertising or consumer targeting.
• Create health-related advertising profiles based upon browsing behavior.

trellOS maintains administrative, technical, and physical safeguards reasonably designed to protect Consumer Health Data against unauthorized access, disclosure, alteration, or destruction, consistent with applicable legal requirements, recognized security practices, and industry standards. Security measures may include:

• Encryption in transit
• Encryption at rest where appropriate
• Role-based access controls
• Authentication controls
• Security monitoring
• Audit logging
• Vendor security oversight
• Incident response procedures

No security program can eliminate all risk. Accordingly, trellOS cannot guarantee absolute security.

Consumer Health Data is retained only as long as reasonably necessary to:

• Fulfill the purposes described in this Policy.
• Provide requested services.
• Comply with legal and regulatory obligations.
• Resolve disputes.
• Protect legal rights.
• Satisfy contractual obligations.
• Maintain appropriate business records.

Retention periods may be extended where required by law, litigation holds, investigations, regulatory proceedings, or contractual requirements.

Where deletion is required by applicable law, trellOS will delete Consumer Health Data from active systems and, where applicable, instruct service providers to delete such information consistent with applicable legal and operational requirements.

If trellOS undergoes a merger, acquisition, financing transaction, restructuring, bankruptcy, or sale of all or substantially all of its assets, Consumer Health Data may be transferred as part of that transaction, subject to applicable law.

Because applicable consumer health privacy laws require transparency regarding categories of Consumer Health Data collected and the purposes for which it is processed, trellOS will update this Policy before materially expanding those categories or purposes where required by applicable law.

Where affirmative consent is required by law, trellOS will obtain such consent before collecting, using, or disclosing Consumer Health Data for new purposes.

This Policy is maintained by BrainBox Holdings, LLC on behalf of trellOS. For questions regarding this Policy or to exercise your privacy rights, please contact:

Privacy Office
Email: privacy@trellos.org