Privacy Policy

1. Introduction

Trusted Telehealth®, Inc. and its affiliates (including MyOncCompanion™) (“TTH.ai”, “we”, “us”, or “our”) are committed to protecting your privacy. This Global Privacy Notice explains how we collect, use, disclose, and protect personal data worldwide across our websites, mobile applications, and digital tools (the “Services”).

This Notice supplements our HIPAA Notice of Privacy Practices (NPP) and Digital Tools Privacy Notice, which govern the processing of Protected Health Information (PHI). This Notice focuses on personal data outside the HIPAA context.

2. Information We Collect

• Personal Identifiers: Name, email, phone, address.
• Financial/Billing: Billing details handled via PCI‑compliant providers; we do not store full card numbers.
• Technical & Usage: Device info, IP, browser/OS, app version, pages/screens viewed, timestamps, language, and analytics.
• Employment/Recruitment: Job applications, CVs, interview notes.
• Marketing/Event: Preferences, campaign engagement, event registrations.
• Sensitive Data: Health/PHI (HIPAA), precise geolocation, government IDs—collected only where lawful and with safeguards.

3. How We Use Personal Data

• Provide & Operate Services (account creation, support, service delivery).
• Improve & Secure Services (analytics, QA, debugging, security monitoring, research).
• Marketing & Communications (where permitted/with consent; opt‑out anytime).
• Compliance & Protection (legal obligations, fraud/abuse prevention, enforcement of terms).
• De‑identified/Aggregated Use for internal analytics and reporting.

4. How We Share Personal Data

We do not sell Personal Data.

We may disclose to: (i) service providers/processors (hosting, IT/security, analytics, support, payments, communications), (ii) care partners where permitted/authorized, (iii) legal authorities where required, and (iv) parties to corporate transactions (subject to confidentiality). All disclosures are subject to contracts and appropriate safeguards, such as Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTA) for international transfers.

5. Cookies, Tracking & Session Replay

We use cookies, pixels, SDKs, analytics tools (e.g., Google Analytics), advertising technologies (e.g., Google Ads/AdSense), and session replay tools (e.g., FullStory, Quantum Metric). Consent is obtained where required. Details and retention are provided in Annex A (Cookie Policy), Annex B (CPRA Disclosures), and Annex C (Vendors & Session Replay). We honor Global Privacy Control (GPC) signals where applicable.

6. Your Privacy Rights (Global Summary)

Depending on your location, you may have rights to access, rectification/correction, deletion/erasure, restriction, objection, portability, opt‑out of marketing, withdraw consent, and to appeal certain decisions. See Annex E (U.S. State Privacy Addendum) for California, Colorado, Virginia, Connecticut, Utah, and others; and Section 14 for EU/UK/Swiss details.

7. International Data Transfers

We use appropriate safeguards for cross-border transfers, including the EU Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum (IDTA), and Swiss-compatible terms, as well as Transfer Impact Assessments where required. Copies are available upon request.

8. Data Security

We implement technical/organizational measures: encryption in transit/at rest (as appropriate), MFA, role‑based access controls, audit logging, vendor due diligence, and secure development practices. No system is perfectly secure; report suspected incidents to security@tth.ai.

9. Data Retention

We retain Personal Data only as long as necessary for the purposes described and to meet legal obligations.

• Website & Cookies: Per Cookie Policy (Annex A).
• Consents/Authorizations: ≥6 years per Consent Retention Policy and HIPAA.
• Training/HR: Per Training Retention Policy.
• PHI: ≥6 years per HIPAA unless longer by law.

10. Children’s Privacy

Public sites are not directed to children under 13 (COPPA). For jurisdictions with higher ages (e.g., 16 under GDPR/CPRA), we do not knowingly process children’s data without valid consent/authorization.

11. Exercising Your Rights

Submit requests via our Data Subject/Consumer Rights Portal at https://www.tth.ai/privacy/requests, email privacy@tth.ai, or call +1 (888) 914‑9661 (PIN 494 202). We verify identity and respond within applicable timeframes. Authorized agent procedures are in Annex D. Appeals processes are provided where required.

12. Do Not Track / Global Privacy Control

We honor GPC in jurisdictions that require recognition of universal opt-out mechanisms. We may not respond to all browser DNT signals unless required by law.

13. Third‑Party Links

Our Services may link to third‑party sites/applications; their privacy practices are governed by their own notices.

14. EU/EEA, UK & Switzerland (Supplement)

• Controller: Trusted Telehealth®, Inc. (for public sites). For specific digital tools, we may act as a processor/business associate.
• Legal Bases: Contract performance; legitimate interests (security, improvement); consent (certain marketing/cookies); legal obligations; vital interests (rare).
• Rights: Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent.
• Complaints: EU—supervisory authorities (see EDPB list); UK—ICO; CH—FDPIC.
• Transfers: See Section 7.

15. Changes to this Notice

We will update this Notice as needed and post the revised version with a new “Last Updated” date. Material changes will be communicated as required.

16. Contact Us

• Data Protection Officer (DPO): dpo@tth.ai
• Privacy Team: privacy@tth.ai
• Security Incidents: security@tth.ai
• Address: 660 West Germantown Pike, Suite 500, Plymouth Meeting, PA 19462, USA
• EU/UK representatives: details will be posted once appointed.

Annex A – Cookie & Tracking Policy

• Categories & Examples:
• Strictly Necessary – auth/session, load balancing, security (cannot be disabled).
• Functional – remembering preferences.
• Analytics – usage trends (e.g., Google Analytics).
• Advertising – ad delivery/measurement (e.g., Google Ads/AdSense).
• Session Replay – UX diagnostics (e.g., FullStory, Quantum Metric).

Consent & Controls: We obtain consent for non-essential cookies as required. Manage via our Cookie Preferences Center and browser settings. Retention & lifetimes align with our Cookie Retention Policy.