Privacy Policy

This Privacy Policy explains how ObyMe collects, uses, discloses and protects personal information when you visit our websites, join our waitlist or contact us. We built it around a simple rule: your health information is never sold, and it is never shared with advertising platforms.

1. Who we are and what this policy covers

"ObyMe," "we," "us" and "our" mean ObyMe and the affiliated medical practices that provide care under the ObyMe name. This policy applies to obyme.com and its pages (the "Site"), our waitlist and sign-up forms, and emails, text messages and calls we send about them (together, the "Services").

This policy works alongside three other documents:

• Our Consumer Health Data Privacy Policy, which gives additional detail and rights under the Washington My Health My Data Act, Nevada's consumer health data law (SB 370), Connecticut law and similar state laws.
• Our Notice of Privacy Practices, which governs "protected health information" under HIPAA once you become a patient. If the Notice and this policy differ about your patient records, the Notice controls.
• Our Terms of Use.

The Services are offered in the United States and are intended for adults 18 and older.

2. Notice at collection: what we collect

We collect only what we need for the purposes described in this policy. In the past 12 months we have collected the following categories of personal information.

We do not collect Social Security numbers, financial account details, precise geolocation, biometric data, or insurance information through the Site. Please don't include them in messages to us.

How long we keep it. We keep waitlist information for as long as the waitlist is active and up to 24 months after our last interaction with you, then delete or de-identify it, unless you ask us to delete it sooner or you become a patient. Security logs are kept for up to 90 days. If you become a patient, medical records are kept for the period required by state and federal law. Records of your consent and opt-out choices are kept for at least four years so we can prove we honored them.

3. How we use personal information

• To provide what you asked for: adding you to the waitlist, answering your questions, and letting you know when care is available near you.
• To communicate with you by email and, if you agree, by text message and phone. You can opt out at any time.
• To plan and improve ObyMe: understanding demand by area and stage of pregnancy, mostly using aggregated or de-identified data.
• To measure our advertising: counting how many sign-ups came from each campaign, using campaign tags in our own records. Third-party measurement tools are used only if you opt in (see section 5).
• For security and integrity: preventing spam, fraud and abuse, and debugging.
• For legal reasons: complying with law, responding to lawful requests, and protecting rights and safety.

We use health information only to provide the Services you request, to communicate with you about them, and for the other purposes permitted for sensitive personal information under California law. We do not use it to profile you for advertising, and we never use it to make decisions that produce legal or similarly significant effects about you.

4. How we disclose personal information

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined in the California Consumer Privacy Act. We have not done so in the past 12 months. We do not sell or share the personal information of anyone under 18.

We disclose personal information only to:

• Service providers and processors that help us run the Services, under written contracts that limit their use of the data to our instructions and require them to protect it. They include website hosting and database providers (currently Cloudflare), email and text messaging providers, customer relationship tools, and professional advisers. Any provider that handles protected health information signs a HIPAA business associate agreement.
• ObyMe-affiliated medical practices and clinicians, when you ask to start care.
• Others when required by law, such as to comply with a valid subpoena or court order, and only to the extent required. We will notify you of such requests when the law allows.
• A successor in a merger, acquisition or sale of assets, subject to this policy and to any consent required by law.
• Anyone you direct us to.

We never disclose health information to advertising networks, social media platforms, data brokers, or for anyone else's marketing.

5. Cookies, advertising and your choices

Our pages don't set advertising cookies by default. We use a small amount of browser storage to remember which ad campaign brought you to the Site during your visit and to remember your privacy choices.

We may use advertising measurement tools, such as the Meta Pixel or Google Tag Manager, on our waitlist page only if you opt in through the privacy choices banner. Even then:

• they receive only the fact that someone signed up, plus the standard technical information their tools collect (such as IP address, browser details and the page address);
• they never receive your name, contact details, stage of pregnancy, message, or any other answer you give us; and
• we do not use them on pages where you give us health information about yourself beyond the sign-up form itself, and we do not use session recording or "heat map" tools on the Site.

Your privacy choices. You can change your choice at any time with the "Your privacy choices" link at the bottom of our waitlist page, or by clearing your browser's storage for obyme.com. We treat a Global Privacy Control (GPC) signal from your browser as an opt-out, and when we receive it we don't ask and don't load these tools. We do not track you across other companies' websites, and we don't respond to "Do Not Track" signals differently from GPC because there is no common standard for them.

6. Text messages and calls

We send marketing text messages or make automated calls only if you check the box giving us your express written consent. Consent is never a condition of joining the waitlist or buying anything. Reply STOP to any text to stop, or HELP for help. Message frequency varies, and message and data rates may apply. Mobile numbers and text messaging consent are never shared with third parties or affiliates for their marketing purposes. See the text messaging terms.

7. Your privacy rights

Many states give their residents rights over personal information, including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, Washington and Nevada. We give these rights to everyone in the United States, whatever state you live in:

• Know and access: what personal information we have about you, where it came from, why we use it, and who we disclosed it to, plus a copy in a portable format;
• Correct inaccurate information;
• Delete your information;
• Opt out of sale, sharing, targeted advertising and profiling (we don't do these, but you can still record your choice);
• Limit the use of sensitive personal information (we already limit it to permitted purposes);
• Withdraw consent you've given, including for text messages;
• Appeal a decision we make about your request; and
• Equal treatment: we will not discriminate against you for using your rights.

How to make a request. Email privacy@obyme.com with the subject "Privacy request", the email or phone number you gave us, and what you'd like us to do. We'll confirm we received it within 10 business days and respond within 45 days. If we need more time (up to another 45 days), we'll tell you why. We verify requests by contacting you at the email or phone number we have on file, and we use the information you give for verification only for that purpose.

Authorized agents. Someone else may make a request for you if they have your signed permission or a power of attorney. We may ask you to confirm your identity directly.

Appeals. If we decline your request, you can appeal by replying to our decision or emailing privacy@obyme.com with the subject "Privacy appeal" within 60 days. We'll respond in writing within 45 days, explaining our reasons. If you are not satisfied, you can contact your state attorney general.

California "Shine the Light." We do not disclose personal information to third parties for their own direct marketing.

8. How we protect information

We use administrative, technical and physical safeguards appropriate to health information, including encryption in transit (HTTPS with HSTS), access limited to staff who need it, least-privilege credentials, audit logging, and vendor contracts that require equivalent protection. No system is perfectly secure. If a breach affects your information, we will notify you and the appropriate regulators as required by state law, the FTC Health Breach Notification Rule and, for patient records, the HIPAA Breach Notification Rule.

9. Children

The Services are for adults 18 and older and are not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us information, email privacy@obyme.com and we will delete it.

10. Other websites

The Site may link to websites we don't control, such as labs or partners. Their privacy practices are governed by their own policies.

11. Changes to this policy

We'll post any changes here and update the effective date. If a change is material, for example a new use of health information, we will notify you by email or a prominent notice before it takes effect and, where the law requires, ask for your consent.

12. Contact us

Email privacy@obyme.com with any questions or concerns about privacy. If you use assistive technology and need this policy in a different format, email us and we'll provide it.