Pinpoint Health, Inc. (“Pinpoint,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, retain, and protect information when you use our websites, applications, software, and services (collectively, the “Services”).
Because Pinpoint is an oncology-focused health information platform, some information we process may be particularly sensitive, including information concerning cancer diagnoses, treatments, medications, laboratory results, medical records, and other health information.
Please read this Privacy Policy carefully.
1. Information We Collect
The information we collect depends on how you use Pinpoint and which features you choose to use.
A. Information You Provide Directly
We may collect information you provide when you:
- create an account;
- complete your profile;
- communicate with us;
- contact customer support;
- complete questionnaires or onboarding questions;
- upload documents;
- enter health information;
- enter information about medications or supplements;
- enter information about your diagnosis or treatment;
- provide feedback; or
- otherwise use the Services.
This may include:
- name;
- email address;
- phone number;
- date of birth;
- account credentials;
- demographic information;
- cancer diagnosis and disease information;
- treatment history;
- medications;
- supplements;
- allergies;
- laboratory results;
- pathology information;
- imaging information;
- genetic or genomic information;
- information contained in medical records;
- symptoms and health-related information;
- information concerning treatment goals or preferences; and
- other information you choose to provide.
B. Information From Healthcare Providers and Electronic Health Records
If you choose to connect Pinpoint to a healthcare provider, electronic health record, health information exchange, or other healthcare data source, we may receive information from that source.
Depending on the integration and permissions you authorize, this information may include:
- diagnoses;
- encounters;
- medications;
- allergies;
- laboratory results;
- procedures;
- clinical notes;
- pathology;
- imaging-related information;
- treatment information;
- demographic information; and
- other information made available through the authorized connection.
We use this information to provide the features you request.
You can choose whether to connect an external healthcare data source where that functionality is available.
2. Information Collected Automatically
When you access the Services, we may automatically collect certain technical information, such as:
- IP address;
- browser type;
- operating system;
- device type;
- device identifiers;
- approximate location derived from IP address;
- pages or screens viewed;
- referring pages;
- dates and times of activity;
- interactions with the Services;
- crash reports; and
- other technical or usage information.
We use this information for security, troubleshooting, analytics, product improvement, and operation of the Services.
3. Cookies and Similar Technologies
We may use cookies, local storage, pixels, software development kits, and similar technologies.
These technologies may be used to:
- keep you signed in;
- remember preferences;
- maintain security;
- understand how the Services are used;
- measure performance;
- diagnose technical problems; and
- improve the Services.
Pinpoint will not use tracking technologies in a manner inconsistent with applicable privacy laws or the disclosures made in this Privacy Policy.
4. How We Use Information
We may use information we collect for the following purposes:
Providing the Services
We use information to:
- create and maintain your account;
- provide personalized features;
- organize your health information;
- import information from authorized sources;
- generate summaries and explanations;
- provide educational information;
- analyze information you choose to submit;
- provide supplement and lifestyle information;
- communicate with you;
- provide customer support; and
- otherwise provide functionality you request.
Personalization
We may use information you provide to tailor the Services to your circumstances, including the type of cancer, treatment phase, medications, supplements, goals, and other information you choose to provide.
Artificial Intelligence
We may process information through AI and machine-learning systems to provide features such as:
- summarization;
- question answering;
- information retrieval;
- explanation of medical concepts;
- organization of health information;
- analysis of scientific literature;
- generation of educational content; and
- other features offered through the Services.
AI-generated information may be inaccurate and is not medical advice.
Security and Fraud Prevention
We may use information to:
- authenticate users;
- protect accounts;
- detect fraud;
- investigate abuse;
- prevent unauthorized access;
- monitor security events; and
- protect Pinpoint, users, and third parties.
Product Development
We may use information to understand how the Services are used, diagnose problems, improve functionality, and develop new products.
Where required by law, we will obtain appropriate authorization before using identifiable health information for purposes that require consent.
Legal and Regulatory Compliance
We may use information as necessary to:
- comply with applicable law;
- respond to lawful requests;
- enforce our agreements;
- protect rights and property;
- investigate security incidents; and
- protect the safety of users and others.
5. How We Share Information
We do not sell your personal information or consumer health data for money.
We may disclose information to the following categories of recipients as reasonably necessary to operate Pinpoint:
Service Providers
We may share information with vendors that provide services to us, such as:
- cloud hosting;
- database infrastructure;
- security;
- authentication;
- customer support;
- communications;
- analytics;
- payment processing;
- data storage;
- software infrastructure;
- artificial intelligence and machine-learning services; and
- other technology services.
These providers may access information only as reasonably necessary to provide services to Pinpoint and subject to contractual and legal obligations.
Healthcare Data Sources
If you choose to connect Pinpoint to a healthcare provider or electronic health record system, we may exchange information with that system as necessary to provide the integration you requested.
Legal Requirements
We may disclose information if reasonably necessary to:
- comply with a subpoena, court order, law, or legal process;
- respond to governmental requests;
- enforce our Terms;
- protect our rights or property;
- investigate fraud or abuse; or
- protect the safety of a person.
Business Transactions
If Pinpoint is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, information may be transferred as part of that transaction, subject to applicable law.
With Your Direction or Consent
We may disclose information when you direct us to do so or provide consent.
6. Health Information
Pinpoint may process information that qualifies as consumer health data, personal health information, or another legally protected category of sensitive information under applicable law.
We use health information primarily to provide the Services and features you request.
Pinpoint is not a substitute for your healthcare provider and should not be assumed to be a HIPAA-covered healthcare provider or health plan.
Whether HIPAA applies to a particular use of information depends on the relationship among Pinpoint, the healthcare provider, and other parties involved. When a consumer independently directs a healthcare provider to transmit health information to an app that is not a HIPAA covered entity or business associate, HIPAA does not necessarily govern the app’s subsequent use of that information.
Other federal and state laws may nevertheless apply to Pinpoint’s handling of health information.
7. Consumer Health Data
Depending on where you live, information collected by Pinpoint may constitute “consumer health data” or a similar legally protected category.
Examples may include information concerning:
- health conditions;
- diagnoses;
- treatments;
- medications;
- reproductive or sexual health;
- mental health;
- healthcare services;
- health-related goals;
- symptoms;
- medical records; and
- inferences concerning health.
We do not sell consumer health data.
Where required by applicable law, Pinpoint will provide additional disclosures, consent mechanisms, or rights concerning consumer health data.
Washington residents: Washington’s My Health My Data Act imposes specific requirements on businesses collecting consumer health data, including requirements concerning disclosures, consent, and a separately published consumer health data privacy policy in applicable circumstances. Pinpoint will provide any additional notice or policy required by applicable law.
8. Sale and Targeted Advertising
Pinpoint does not sell your personal information or health information for monetary consideration.
If Pinpoint engages in an activity that constitutes a “sale,” “sharing,” targeted advertising, or similar regulated activity under an applicable privacy law, we will provide any required disclosures and opt-out mechanisms.
9. De-Identified and Aggregated Information
We may create or receive information that has been de-identified, aggregated, or otherwise processed so that it is no longer reasonably capable of being associated with an identifiable individual.
We may use such information for purposes including:
- research;
- analytics;
- product development;
- improving algorithms and models;
- understanding trends;
- quality assurance;
- security; and
- business operations.
Where applicable law imposes requirements concerning de-identification, we will follow those requirements.
10. Artificial Intelligence and Model Providers
Some Pinpoint features may use third-party AI or machine-learning infrastructure.
When such providers process information on Pinpoint’s behalf, we intend to use contractual and technical safeguards appropriate to the service and the information being processed.
Pinpoint does not authorize third-party AI providers to use identifiable Pinpoint health information for their own unrelated advertising purposes.
11. Data Retention
We retain information for as long as reasonably necessary to:
- provide the Services;
- maintain your account;
- provide features you request;
- comply with legal obligations;
- resolve disputes;
- enforce agreements;
- maintain security; and
- otherwise fulfill the purposes described in this Privacy Policy.
Retention periods may vary depending on the type of information and the purpose for which it was collected.
When information is no longer reasonably necessary, Pinpoint may delete, aggregate, or de-identify it, subject to legal, security, backup, and operational requirements.
12. Data Security
Pinpoint uses administrative, technical, and organizational safeguards designed to protect information against unauthorized access, acquisition, alteration, disclosure, or destruction.
Depending on the Services and infrastructure used, safeguards may include:
- encryption in transit;
- encryption at rest;
- authentication controls;
- access controls;
- logging and monitoring;
- infrastructure security controls;
- employee access restrictions;
- security testing; and
- incident response procedures.
No method of electronic transmission or storage is completely secure. Therefore, Pinpoint cannot guarantee absolute security.
13. Data Breaches
If Pinpoint experiences a security incident involving personal or health information, we will investigate the incident and provide notices required by applicable law.
Certain federal rules may impose specific breach-notification requirements on health applications that are not covered by HIPAA, including the FTC’s Health Breach Notification Rule.
14. Your Privacy Choices
Depending on your location and applicable law, you may have rights concerning your personal information, including the right to:
- access information we maintain about you;
- request correction of inaccurate information;
- request deletion of information;
- request a copy of certain information;
- withdraw consent where processing is based on consent;
- opt out of certain sales or sharing;
- limit certain uses of sensitive personal information;
- object to certain processing; and
- appeal certain privacy decisions.
Some rights are subject to legal exceptions.
15. California Privacy Rights
If you are a California resident, you may have rights under the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”).
Depending on the circumstances, these rights may include:
- the right to know what personal information we collect and how it is used;
- the right to access personal information;
- the right to request deletion;
- the right to correct inaccurate information;
- the right to opt out of certain sales or sharing;
- the right to limit certain uses of sensitive personal information;
- the right to non-discrimination for exercising privacy rights; and
- the right to appeal certain decisions.
California law requires covered businesses to provide information concerning the categories of personal information collected, purposes of use, categories of recipients, and applicable consumer rights.
Pinpoint does not sell personal information for money.
16. Washington Consumer Health Data Rights
Washington residents may have additional rights under the Washington My Health My Data Act and other applicable law.
Where applicable, these rights may include rights concerning:
- access to consumer health data;
- deletion of consumer health data;
- consent;
- disclosures of consumer health data;
- authorized representatives; and
- certain disclosures or sales of consumer health data.
Washington law also imposes specific requirements concerning the publication of consumer health data privacy policies for covered entities.
17. How to Exercise Your Rights
To submit a privacy request, contact:
Email: [legal@trypinpoint.me]
Please include enough information for us to understand and verify your request.
We may need to verify your identity before completing certain requests to prevent unauthorized disclosure of personal information.
We will process requests within the time periods required by applicable law.
If you are a California resident, California law generally requires covered businesses to respond to certain consumer requests within 45 days, subject to applicable extensions.
18. Children’s Privacy
The Services are not intended for users under 18.
We do not knowingly collect personal information from children under 18 without legally valid authorization.
If you believe a user under 18 has provided personal information to Pinpoint, contact us at [legal@trypinpoint.me].
19. International Users
Pinpoint is based in the United States. You must be 18+ and reside in the United States to use our service.
20. Third-Party Websites and Services
The Services may contain links to third-party websites, applications, healthcare providers, scientific publications, or other services.
Pinpoint is not responsible for the privacy practices of third parties.
We encourage you to review the privacy policies of third parties before providing them with information.
21. Changes to This Privacy Policy
We may update this Privacy Policy periodically.
If we make material changes, we will provide notice as required by applicable law.
The updated policy will identify the date on which it became effective.
22. Contact Us
If you have questions about this Privacy Policy or Pinpoint’s privacy practices, contact:
Pinpoint Health, Inc.
Email: legal@trypinpoint.me