Privacy Policy

1. Introduction

Assurna Inc. ("Assurna," "we," "us," or "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you visit our website, use our services, or otherwise interact with us.

By accessing our website or using our services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree, please discontinue use of our services immediately.

2. Information We Collect

2.1 Personal Information You Provide

We may collect the following categories of personal information when you voluntarily provide it to us:

• Identity Information: First name, last name, date of birth, and gender.
• Contact Information: Email address, phone number, mailing address, and website URL.
• Professional Information: Occupation, employer, and professional background.
• Financial Information: Payment card details, billing address, and transaction history (processed through secure third-party payment processors).
• Health Information: Medical history, health goals, diagnostic results, biomarkers, genomic data, and other health-related information you provide or that is generated through our services. See Section 6 (HIPAA) for additional protections.
• Communications: Records of your correspondence with us, including emails, chat messages, and call recordings (where permitted by law).

2.2 Information Collected Automatically

When you access our website, we automatically collect certain information, including:

• Device Information: IP address, browser type and version, operating system, device identifiers, and screen resolution.
• Usage Data: Pages visited, time spent on pages, click patterns, referring URLs, and navigation paths.
• Cookies and Tracking Technologies: We use cookies, web beacons, and similar technologies to enhance your experience and gather analytical data. See Section 8 (Cookies) for details.

2.3 Information from Third Parties

We may receive information about you from third parties, including:

• Healthcare providers, laboratories, and diagnostic facilities with your authorization.
• Business partners and referral sources.
• Publicly available sources and databases.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery: To provide, personalize, and improve our longevity and health optimization services.
• Communication: To respond to your inquiries, send appointment reminders, and provide service-related notifications.
• Health Analysis: To generate personalized health protocols, track biomarkers, and provide evidence-based recommendations.
• Billing and Payments: To process transactions and manage your account.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.
• Safety and Security: To protect our services, users, and the public from fraud, abuse, and security threats.
• Research and Development: To conduct anonymized and aggregated research for service improvement (never using identifiable health data without explicit consent).
• Marketing: To send you information about our services, with your consent where required by law. You may opt out at any time.

4. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

• Service Providers: With trusted third-party vendors who assist us in operating our business (e.g., payment processors, cloud hosting providers, analytics services), bound by strict confidentiality agreements.
• Healthcare Partners: With physicians, laboratories, and healthcare providers involved in delivering your protocol, subject to HIPAA protections.
• Legal Requirements: When required by law, regulation, subpoena, or court order.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as a business asset.
• With Your Consent: When you explicitly authorize us to share your information with a third party.

5. Data Security

We implement industry-standard administrative, technical, and physical safeguards to protect your personal information. These measures include:

• AES-256 encryption for data at rest and TLS 1.3 encryption for data in transit.
• Multi-factor authentication and role-based access controls.
• Regular security audits, vulnerability assessments, and penetration testing.
• Employee training on data protection and privacy practices.
• Secure data centers with SOC 2 Type II certification.

While we take every reasonable precaution to protect your data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

6. HIPAA Compliance

Certain health information you provide to us or that is generated through our services may constitute Protected Health Information ("PHI") under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). Where applicable, we comply with HIPAA and its implementing regulations, including:

• Privacy Rule: We limit the use and disclosure of your PHI to the minimum necessary for treatment, payment, and healthcare operations, unless you provide written authorization.
• Security Rule: We implement appropriate administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of electronic PHI.
• Breach Notification Rule: In the event of a breach of unsecured PHI, we will notify affected individuals, the U.S. Department of Health and Human Services, and, where required, the media, in accordance with applicable timelines.
• Business Associate Agreements: We enter into Business Associate Agreements with all third-party vendors who access, maintain, or transmit PHI on our behalf.

You have the right to receive a copy of our Notice of Privacy Practices, which describes in greater detail how your PHI may be used and disclosed. To request a copy, contact us at privacy@assurna.com.

7. Your Rights

7.1 All Users

Regardless of your location, you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of your personal information, subject to legal retention requirements.
• Opt out of marketing communications at any time.
• Withdraw consent for data processing where consent is the legal basis.

7.2 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and the California Privacy Rights Act, including:

• The right to know what personal information is being collected, used, shared, or sold.
• The right to delete personal information held by businesses.
• The right to opt out of the sale or sharing of personal information. We do not sell your personal information.
• The right to non-discrimination for exercising your privacy rights.
• The right to correct inaccurate personal information.
• The right to limit the use and disclosure of sensitive personal information.

7.3 EEA/UK Residents (GDPR)

If you are located in the European Economic Area or the United Kingdom, you have rights under the General Data Protection Regulation, including:

• Right of access, rectification, erasure, and data portability.
• Right to restrict or object to processing.
• Right to lodge a complaint with a supervisory authority.

To exercise any of these rights, contact us at privacy@assurna.com. We will respond within 30 days (or sooner as required by applicable law).

8. Cookies and Tracking Technologies

We use the following types of cookies:

• Strictly Necessary Cookies: Required for the operation of our website (e.g., session management, security).
• Analytical Cookies: Help us understand how visitors interact with our website, allowing us to improve functionality and user experience.
• Functional Cookies: Enable enhanced functionality and personalization (e.g., language preferences).
• Marketing Cookies: Used to deliver relevant advertisements and track campaign effectiveness. These are only set with your consent.

You can manage your cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of our website.

9. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. Health-related records are retained in accordance with applicable medical records retention laws. When data is no longer required, we securely delete or anonymize it.

10. Third-Party Links

Our website may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any third-party site you visit.

11. Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a minor, please contact us immediately at privacy@assurna.com and we will promptly delete such information.

12. International Data Transfers

Your information may be transferred to and processed in countries other than the country in which you reside. These countries may have different data protection laws. We ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission, where applicable.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting the updated policy on our website with a revised "Last Updated" date. We may also notify you via email for significant changes. Your continued use of our services after any modifications constitutes your acceptance of the updated policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

15. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the State of Delaware, United States of America, without regard to its conflict of law principles. Any disputes arising out of or relating to this Privacy Policy shall be subject to the exclusive jurisdiction of the courts located in the State of Delaware.