Privacy Policy
Effective Date: 08/06/2024
Introduction
Medical Guardian, LLC (“Medical Guardian,” “we,” “our,” or “us”) is committed to protecting its employees, customers, partners, and constituents from all damaging acts – whether intentional or unintentional. Effective security and privacy protection is a team effort involving the participation and support of every entity that interacts with Medical Guardian environments, services, and information. Accordingly, it is the responsibility of both Medical Guardian and all third parties to be aware of and adhere to our cybersecurity, privacy, and data protection requirements.
This Privacy Policy applies to Medical Guardian and all affiliated brands, subsidiaries, and related services (collectively, the “Company”). It governs the use of our websites, mobile applications, social media pages, blogs, and other online services (collectively, the “Services”).
The purpose of this Privacy Policy is to inform you, as a user of the Services, about:
The categories of information we may collect about you;
The purposes for which that information may be used;
The conditions under which that information may be shared or disclosed; and
Your rights in relation to that information under applicable law.
Each time you use the Services, the current version of this Privacy Policy will apply. By using or accessing the Services, you consent to the collection, use, and disclosure of your information as described in this Privacy Policy.
The Services are hosted in the United States and subject to U.S. state and federal law. If you are accessing the Services from outside the United States, you consent to the transfer of your information to the United States and agree that your use of the Services will be governed by U.S. law.
This Privacy Policy also serves as our notice at collection and describes the categories of personal information we collect and the purposes for which we use it.
International Transfers
Personal information may be transferred to and processed outside your state, province, or country (including in the United States). For transfers from Quebec, we conduct a privacy impact assessment and ensure appropriate safeguards consistent with Law 25.
Collecting Information About You
When you interact with Medical Guardian and its affiliated brands, we may collect several categories of information:
1) Personally Identifiable Information (“PII”)
PII is information that can identify, contact, or locate you (e.g., name, mailing/shipping/billing address, email address, telephone number, payment or billing information, account credentials). We collect PII when you:
-
- Register on our websites or mobile applications;
- Log in with social network credentials;
- Participate in polls, contests, surveys, or other features of our Services;
- Communicate with us directly;
- Create a public profile or account;
- Sign up to receive newsletters or marketing materials;
- Request information about our products and services.
If information is provided to us through a third-party platform (e.g., social media), the collection and sharing of that data is governed by the third party’s privacy policy, not this one. Users are not required to provide PII; however, refusal may limit access to certain features.
2) Other Information / Non-PII
We also collect information that does not, on its own, identify you, including device and browser type, IP address, operating system, general location, demographics (if provided), product/service purchase history, pages viewed and links clicked, session duration, and referring/exit websites. We analyze this information to understand usage patterns, improve user experience, and enhance the Services.
3) Health Information Provided by You
-
-
- Name
- Email address
- Gender
- Birth date and year
- Height and weight
- Activities
- Notes and tags
-
4) Medical Card Information
If you choose to participate in the Medical Guardian Medical Card program, you may provide health and emergency-related information that is associated with your Medical Card and accessible through a QR code printed on the card. This information may include, depending on what you choose to provide, medical conditions, medications, allergies, communication needs, emergency contacts, and other health or emergency-related information.
You are responsible for ensuring that the information you choose to provide is accurate, complete, and up to date.
5) Information Generated by the Devices
Depending upon the type of Device you use, we may automatically receive the following Health Information:
-
-
- Biometric Data
- Heart rate
- Movement data
- Temperature data
- Duration of sleep
- Sleep phases (deep, light, REM, awake)
- Activity data throughout the day
- Automatically generated tags
-
And the following Usage and Technical Data:
-
-
- User ID (randomly generated)
- IP address and high-level location
- Metadata regarding service use
-
De-Identified Data
By submitting your information, you authorize Medical Guardian and its accredited members to communicate with you regarding your options, including by pre-recorded messages and texts to the mobile or landline phone number provided. You also agree to the Medical Guardian Terms of Use & Privacy Policy, including the use of an electronic record to document your agreement.
“Sensitive personal information” may include, for example, precise geolocation, biometric identifiers, government ID numbers, health information, or information about a known child. We do not use or disclose sensitive personal information for purposes other than those permitted by applicable law. Where required (e.g., under Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Iowa, Nebraska, New Hampshire, Minnesota, and Maryland), we will obtain your consent before processing sensitive data. California residents may have the right to limit the use and disclosure of sensitive personal information; see Your Rights Under State and Provincial Laws.
Telephone Consumer Protection Act (TCPA) Compliance
By submitting your information, and approving the second authorization on the initial message we will send you, you authorize Medical Guardian and its affiliates to communicate with you, including via text messages or pre-recorded messages at the number(s) you provide, consistent with the TCPA and applicable law. You consent to the use of an electronic record to document your agreement. Message and data rates may apply. You can opt out of marketing texts as described in Opting Out & Updating Information below.
Using Information About You
We may use information we collect to:
-
-
- Provide, maintain, and improve the Services;
- Notify Emergency Services and your Emergency Contacts in the event of an emergency;
- Provide emergency responders, healthcare providers, caregivers, family members, or other individualswho scan a Medical Card QR code with access to health and emergency-related information you have chosen to make available through that feature;
- Improve our Websites;
- Process transactions and fulfill orders;
- Provide Customer Service;
- Protect your Privacy;
- Communicate with you regarding your account, the Services, updates, and promotions;
- Design Training Programs for our personnel;
- Customize content, offers, and advertising;
- Conduct research, analytics, troubleshooting, and product development;
- Protect the security and integrity of our systems and prevent fraud or misuse;
- Comply with legal obligations and enforce our agreements.
-
With your authorization specifically allowing us to share your PII, We may share PII with:
Authorized Service Providers – companies that process payments, provide analytics, deliver targeted advertising, manage promotions, provide customer support, host infrastructure, or otherwise support our operations. These providers may access PII only as needed to perform services for us and are not permitted to use it for other purposes.
Business Partners – Medical Guardian may work with select partners whose products or services may be relevant to our customers. In such cases, we may share limited information so they can provide you with details, offers, or promotions. The partner’s use of your information will be governed by that partner’s privacy policy and practices. You can opt out of receiving such partner marketing as described below.
Ad Networks – including Google, Amazon, and other networks that help deliver interest-based advertising.
Medical Card Disclosure
If you activate or use a Medical Guardian Medical Card, you expressly authorize Medical Guardian to display the information associated with your card when the QR code on the card is scanned.
You understand and acknowledge that the QR code is intended to facilitate access to important medical and emergency information during emergency situations. Information displayed through the QR code may be viewed by emergency medical technicians, first responders, healthcare providers, caregivers, family members, facility staff, or any other person who scans or otherwise gains access to the card.
Because Medical Guardian cannot verify or control the identity of every individual who scans the QR code, you acknowledge and accept that information associated with the card may be accessed by persons other than intended emergency responders.
By creating, maintaining, updating, or using a Medical Card profile, you expressly consent to the disclosure of the information associated with your card to any person who scans the QR code and accesses the profile.
Cookies and Tracking Technologies
We use cookies, web beacons, and similar technologies to operate the Services, recognize you, store preferences, understand usage, and deliver advertising.
Third-party vendors, including Google, Amazon, and other advertising networks, may use cookies and tracking technologies to collect information about your visits to our Services and other sites to deliver interest-based ads. These vendors may combine information collected from our Services with data from other sources.
Your Choices
Manage or opt out of interest-based advertising via:
Amazon: https://www.amazon.com/adprefs
Google: https://www.google.com/settings/ads or the Google Analytics Opt-out Add-on: https://tools.google.com/dlpage/gaoptout
Digital Advertising Alliance (U.S.): https://optout.aboutads.info
Your Online Choices (EU): https://www.youronlinechoices.eu
DAA Canada: https://youradchoices.ca
You may also configure your browser to refuse cookies. Some features may not function properly if cookies are disabled.
Opt-Out Preference Signals (Global Privacy Control)
Where required by applicable law, we recognize and honor browser-based opt-out preference signals (such as Global Privacy Control (GPC)) as a request to opt out of targeted advertising and/or the sale or sharing of personal information. Where we can associate a signal with a known account, we will apply the preference to that account; otherwise, we apply it to the specific browser or device that sent the signal.
Legally Required Sharing
We may disclose information if required by law, regulation, subpoena, or legal process; to law enforcement or government authorities; or when we believe disclosure is necessary to protect our rights, enforce agreements, prevent fraud or harm, or respond to security incidents.
Business Transfers
If Medical Guardian sells, merges, reorganizes, finances, or transfers all or part of its business or assets (including bankruptcy or similar proceedings), PII may be transferred to the acquiring or successor entity and will remain subject to this Privacy Policy unless and until replaced by a subsequent version.
You may opt out of marketing communications from us or our business partners by:
- Using the unsubscribe link in our emails;
- Calling us at 1-800-313-1191; or
- Emailing customerservice@medicalguardian.com.
Even if you opt out of marketing, we may still contact you with account-related or service-related messages (e.g., service announcements, administrative notices, legally required notifications).
To update, correct, or delete your information, contact us at customerservice@medicalguardian.com or 1-800-313-1191.
“Do Not Track” Signals
Some browsers offer a “Do Not Track” signal. Our Services do not currently respond to DNT signals. You can limit tracking via the opt-out mechanisms in Cookies and Tracking Technologies.
Your Rights Under State and Provincial Laws
Residents of certain jurisdictions, including California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Delaware (DPDPA), Tennessee (TIPA), Iowa (ICDPA), Nebraska (NDPA), New Hampshire (NHDPA), Minnesota (MNDPA), Maryland (MODPA), Washington (MHMDA), and Quebec (Law 25) may have some or all of the following rights, subject to verification and exceptions:
-
- Confirm/Access the personal information we process about you and obtain a copy.
- Correct inaccuracies.
- Delete personal information.
- Portability of certain information.
- Opt out of (i) targeted advertising, (ii) the sale or sharing of personal information, and (iii) profiling in furtherance of decisions that produce legal or similarly significant effects.
- Limit use/disclosure of Sensitive Personal Information (where applicable, e.g., California).
- Non-discrimination for exercising your rights.
Minors (California). We do not sell or share personal information of consumers we know are under 16 years of age without prior opt-in consent (from the minor if 13-16, or from a parent/guardian if under 13).
How to Exercise Your Rights. Submit requests to privacy@medicalguardian.com or via the contact methods in Opting Out & Updating Information. We will take reasonable steps to verify your identity (for example, by matching information you provide with information already maintained). You may also designate an authorized agent to submit requests on your behalf where permitted by law; we may require proof of authorization and verification of your identity.
Appeals. If we deny your request, you may appeal our decision by replying to our response or by emailing privacy@medicalguardian.com with the subject line “Privacy Request Appeal”. If your appeal is denied, you may contact your state attorney general or local privacy regulator.
Appeal Response Time. We will respond to appeals within the time required by applicable law (e.g., 60 days in Virginia) and will provide the reasons for our decision.
Response Time. We will respond to verifiable consumer requests within 45 days of receipt. If reasonably necessary, we may extend this period by an additional 45 days and will inform you of the extension and reason.
Nevada Residents. We do not sell “covered information” as defined by Nev. Rev. Stat. § 603A; if our practices change, Nevada residents may submit sale-opt-out requests to privacy@medicalguardian.com.
California “Shine the Light.” California Civil Code § 1798.83 permits California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. Submit such requests to info@medicalguardian.com or the postal address in Contact Information (one request per year).
Washington Residents (My Health My Data Act). Washington’s My Health My Data Act (MHMDA) provides additional protections for “consumer health data,” which the MHMDA defines broadly to include any personal information that identifies or is reasonably linkable to your physical or mental health condition, use of health-related services, or similar information. Medical Guardian may collect consumer health data in connection with the Services. Washington residents have the right to confirm whether we collect, share, or sell consumer health data about them; to access that data; to withdraw consent to its collection or sharing; and to request deletion. We will not sell consumer health data without your valid authorization. To exercise your rights under the MHMDA, submit a request to privacy@medicalguardian.com. You may also file a complaint with the Washington State Attorney General.
Data Retention & Destruction
We retain personal information only as long as necessary to fulfill the purposes for which it was collected, to meet legal and regulatory obligations, to resolve disputes, and to enforce agreements. When no longer required, we securely delete or anonymize data consistent with our Data Retention and Destruction Policy.
Use of Artificial Intelligence and Automated Processing
Overview
By using our Services you agree that Medical Guardian and its affiliated brands may use artificial intelligence (AI), machine learning (ML), and automated processing technologies in connection with our Services, internal operations, and business functions. This section describes how we use these technologies, what data they may process, and your rights in relation to automated decision-making.
How We Use AI Technologies
We may use AI and automated processing tools to:
-
-
- Improve and personalize the Services – including content recommendations, customer support chatbots, and predictive features within our platforms;
- Detect and prevent fraud, abuse, and security threats – including anomaly detection across account activity and system events;
- Analyze usage patterns – to enhance product functionality, resolve technical issues, and support business analytics;
- Assist internal operations – including administrative workflows, communications, and process automation; and
- Support marketing and advertising – including automated segmentation, propensity modeling, and targeted outreach, subject to applicable opt-out rights described in this Policy.
-
Data Used in AI Systems
AI and ML systems we operate or use may process the categories of personal information described in the Collecting Information About You section of this Policy, including identifiers, usage data, and inferred characteristics. We do not use sensitive personal information (as defined by applicable law) as a direct training input for AI systems without your specific consent, except where permitted by law.
We take reasonable measures to ensure that data used in AI contexts is handled consistently with the purposes described in this Policy and is subject to appropriate access controls, minimization, and retention limits.
Third-Party AI Tools and Service Providers
We may engage third-party AI service providers (e.g., large language model vendors, analytics platforms, automation tools) to support our operations. These providers access personal information only to the extent necessary to perform services on our behalf and are prohibited from using it for independent purposes. Such providers are subject to contractual data protection obligations consistent with applicable law.
We do not sell or share personal information with third-party AI providers for their own AI training purposes.
Automated Decision-Making and Profiling
In certain contexts, we may use automated processing – with or without human review – to evaluate, segment, or make decisions about users. Where such processing produces decisions that have legal or similarly significant effects on you (as defined under applicable state law, including Colorado, Connecticut, Texas, Oregon, Montana, Minnesota and Maryland), you may have the right to:
-
-
- Opt out of the processing;
- Request human review of the automated decision; and
- Receive an explanation of the logic applied and the outcome.
-
To exercise these rights, submit a request to privacy@medicalguardian.com. We will respond consistent with applicable law and the timeframes described in the Your Rights Under State and Provincial Laws section of this Policy.
AI and Children’s Data
We do not use AI or automated processing to collect, infer, or profile information about individuals we know to be under the age of 13, consistent with our obligations under COPPA and this Policy.
Retention of Data Processed by AI Systems
Personal information processed through AI or automated systems is retained, consistent with our Data Retention & Destruction Policy. Outputs, inferences, or derived data generated by AI systems are treated as personal information where they can be linked back to an individual, and are subject to the same deletion and correction rights described in this Policy.
Accountability and Human Oversight
Medical Guardian maintains internal governance practices for AI use, including review of AI tools prior to deployment, ongoing monitoring for accuracy and bias, and periodic assessment of AI-related risk. We do not rely solely on automated outputs for decisions that materially affect customer accounts, service eligibility, or healthcare-adjacent recommendations without appropriate human oversight.
Data Encryption
We protect information in transit using HTTPS and employ encryption for data at rest where appropriate. Our practices align with applicable HIPAA and NIST guidance, including:
-
-
- Role-based access controls;
- Audit logging and monitoring;
- Regular security assessments and reviews.
-
Security
We implement administrative, technical, and physical safeguards designed to protect information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission or storage is completely secure, and we cannot guarantee nor do we warrant absolute security. Please protect your account credentials and notify us immediately of suspected unauthorized access.
Linking to Other Websites
Our Services may contain links to websites not controlled by Medical Guardian. We are not responsible for the privacy practices or content of third-party websites. Review the privacy policies of any third-party sites you visit before providing personal information.
Public Forum Access
Some areas of the Services (e.g., blogs or reviews) may allow you to post content. Information you post is public, and can be read, collected, and used by others. Use caution when disclosing personal information. Posting is governed by our Terms of Use.
Children’s Privacy (COPPA)
Our Services are not directed to children under 13, and we do not knowingly collect PII from children under 13 except as permitted by law. Any person who provides information through the Services represents that they are at least 13 years of age. If we learn that we collected information from a child under 13 without verified parental consent, we will delete it. Parents or legal guardians may contact us (see Contact Information) to request deletion and account termination.
We may update this Privacy Policy from time to time. We will post the revised policy with an updated Effective Date. In some cases, we may also provide additional notice (e.g., email or prominent in-service notice). We will not materially alter the level of Privacy offered by us during your active subscription without providing at least 30 days notice and, where the change materially changes how we protect your privacy in any way that causes you to revoke your agreement to our policies, offering you the option to cancel your account with a pro-rata refund.
Contact Information
Medical Guardian, LLC
1818 Market Street, Suite 1200
Philadelphia, PA 19103
Privacy Officer (Quebec, Washington, Maryland): Executive Vice President of Technology / CISO (delegated), reachable at privacy@medicalguardian.com. This address also serves as the designated intake point for privacy rights requests under the Washington My Health My Data Act and the Maryland Online Data Privacy Act.
Email: info@medicalguardian.com
Customer Service: customerservice@medicalguardian.com | 1-800-313-1191
Privacy Requests: privacy@medicalguardian.com
Review Cycle
The Office of the Executive Vice President of Technology / CISO reviews this Privacy Policy annually or as needed due to: (1) Company environment changes; (2) legal or regulatory updates; (3) corporate directives; or (4) information security framework updates. Senior management approval is required prior to any changes.
