Online Services Privacy Policy
Last Revised: 02/17/21
Sanvello Health, Inc. (“we,” “us,” “our,” and “Company”) recognizes that the privacy of your information is important. This Online Services Privacy Policy (“Privacy Policy”) describes our practices in connection with information that we collect through the online and mobile websites, platforms, services, and applications that we own or operate and that contain a link to this Privacy Policy (collectively, “Online Services”). Our Online Services are designed to provide tools for you to use to reduce stress, anxiety, and depression.
If you are visiting us from the European Union or European Economic Area, please see the section entitled “Additional Information for European Union Users” for information on how we comply with privacy laws applicable to you.
By using the Online Services, you consent to our collection, use, disclosure, and storage of information as described in this Privacy Policy.
Our Privacy Policy explains:
- What information we collect from you (“Information”) as described below under “What Information We Collect”
- How We Use Information
- How We Share Information
- How to Manage Your Information
- How We Protect Information
- CCPA Notice and Additional Rights for California Residents
- Additional Rights for European Union Residents
- Additional Right for Brazil Users
- Social Media Disclaimer
- When This Privacy Policy Applies
- Contact Us
- Changes
What Information We Collect
When you register for Online Services, we may collect the following Information from you:Â
- First and last name
- Nickname
- E-mail address
- Health plan provider name, Member ID and Group ID (if you were referred by your health plan)
- Password
- Gender
- Date of birth
- Location(Address, City, State, Zip)
- Other demographic information
- Mood
- Goals
- Thought records
- Assessments and questionnaires
- Usage data
- Health and other biometric data (if connected)
- Messages and session recordings with your coach (if connected)
- Messages, appointments and session recordings with your clinician (if connected)
- Device and System data such as type of phone, operating system and network information
- Other Information described in this Privacy Policy
We may enter into business associate agreements with mental health providers (“Providers”) and health plans or health insurers, including, employer-sponsored health plans (“Health Insurers”), to make our Online Services available to patients of such Providers or enrollees, members, or participants of such Health Insurers (“Sanvello Partners”). When you use our Online Services, we may collect Information about you, directly or indirectly, from or through applicable Sanvello Partners. We will comply with applicable business associate agreements, this Privacy Policy, and the Health Insurance Portability and Accountability of 1996, as amended, and its implementing regulations (collectively, “HIPAA”) with respect to your Information that is protected health information, as defined under HIPAA. This Privacy Policy is separate from applicable Sanvello Partners’ HIPAA notices of privacy practices. Your Provider or Health Insurer’s notice of privacy practices describes in detail how it uses and discloses your protected health information. Please contact your Provider or Health Insurer for a copy of their HIPAA Notice of Privacy Practices.
When you use Online Services, you may provide certain Information directly to us, including when you allow us to obtain Information about you from other sources.
We may also obtain automatically collected Information through the Online Services. We may use common technologies such as cookies, tokens, tags, beacons, scripts and web server logs, as well as functionality that can collect data from a mobile device. The automatically collected Information may include demographic, de-identified, aggregated, or certain information collected automatically through your device such as technical information about your device, web browser information, and server log files collected by us or provided by you. Our mobile applications may also collect Information specific to use of your mobile device, such as a unique device identifier and precise geolocation information.
You may limit the Information you provide or make available to us if you want to; however, that may limit your ability to access or use certain functions of the Online Services or to request certain services or information.
Certain features of the Online Services may actively record information about you as you use the Online Services. This tracking is accomplished through integration with Apple’s HealthKit API and the Apple Health App. We use this information solely for the purpose of providing you with health-related feedback and self-care suggestions.
You may limit the Information you provide or make available to us if you want to; however, that may limit your ability to access or use certain functions of the Online Services or to request certain services or information.
Our Online Services operate on computer servers in the United States; therefore, any Information you provide will be processed by a computer server located within the United States.
How We Use InformationÂ
We may use the Information for a number of purposes such as:
- To respond to an e-mail or particular request from you.
- To communicate with you.
- To provide you with content through our Online Services or other services that we may offer.
- To process an application as requested by you.
- To authenticate you on any portion of our Online Services and with vendors acting on our behalf.
- To administer surveys and promotions.
- To personalize your experience on our Online Services.
- To provide you with informational or promotional offers, as permitted by law, that we believe may be useful to you, such as information about products or services provided by us or other businesses.
- To perform analytics and to improve our products, Online Services, and advertising.
- To comply with applicable laws, regulations, and legal process.
- To protect someone’s health, safety, or welfare.
- To protect our rights, the rights of affiliates or related third parties, or take appropriate legal action, such as to enforce our Terms of Use.
- To keep a record of our transactions and communications.
- To conduct health and behavioral research, including with research partners.
- To debug to identify and repair errors
- As otherwise necessary or useful for us to conduct our business, so long as such use is permitted by law or for any other purpose with your consent.
We may use Information to contact you through any contact information you provide through our Online Services or any other services we offer, including any e-mail address, telephone number, or cell phone number.
We may, when permitted, combine your Information with other information, whether online or offline, maintained or available to us from you or from other sources, such as from our vendors, and we may use and disclose combined data for the purpose described in this Section or for internal business purposes.
We may, when permitted, use and disclose de-identified and aggregated data for any purpose, which may include, without limitation, disclosures to third parties for analytics purposes such as evaluating the Online Services and providing additional benefits, programs, and services.Â
We may use your Information, including personally identifiable information, for internal research purposes, and we may share such information with third party research partners who are bound to maintain the confidentiality of any of personally identifiable information and use it only for such research purposes as described below under “How We Share Information.”
Posting Messages, Comments, and Content
Our Online Services may have collaboration areas, including but not limited to “blogs,” “bulletin boards,” “leader boards,” and “health games” that permit users to have collaborative discussions and/or share information. Some of our Online Services may permit you to select a display name or image that will be “nickname” on the Online Service.
Please note, any information you submit or post to these collaboration areas, including your display name or image, may be visible by other users of the Online Service, and such users may share with others. Therefore, please be thoughtful in what you write and understand that this information may become public.
How to Manage Your Information
Our Online Services may permit you to view your profile, if applicable, and access related Information about you and to request changes to, or deletion of, such Information. If this function is available, you may have access to a page on the Online Services through which you may review your profile, if applicable, and related Information about you, and you may have options to modify or delete or such Information. Please remember, however, if we have already disclosed some of this Information to third parties, we may not have access to that disclosed information and may not be able to force the deletion or modification of any information by the third parties to whom we have made those disclosures.
If you need additional assistance in opting-out of a communication, please contact us at info@sanvello.com. Please be aware that opt-outs may not apply to certain types of communications, such as account status, Online Service updates, or other communications.
How We Protect InformationÂ
We maintain administrative, technical, and physical safeguards designed to protect the Information that you provide on our Online Services. These safeguards vary based on the sensitivity of the Information that is being collected, used and stored. However, no security system is impenetrable and we cannot guarantee the security of our Online Services, nor can we guarantee the security of the Information you transmit to us over the Internet, including your use of e-mail. We are not liable for the illegal acts of third parties such as criminal hackers.
It is your responsibility to safeguard the devices you use to access our Online Services (such as laptops, tablets and mobile devices), and to use appropriate security settings on those devices. If those devices are lost, stolen or misplaced, others may be able to access your account and your personal Information using those devices. If you log into the Online Services using a public computer or device, or the computer or device of another person, you should affirmatively log out of your account (i) prior to ending your session, or (ii) if you will be inactive on the Online Services for more than a few minutes otherwise, the next user of that computer or device may be able to access your account and the Information in your account if your session has not ended.
You agree that we are not responsible for any harm that may result from someone accessing your account or personal Information on a lost, stolen or misplaced device or on a public computer or kiosk where you do not for any reason take the necessary steps to log out of your account prior to ending a session on such public computer or kiosk.
We offer mobile applications that enable us to communicate with you through push notifications. You may be able to turn off push notifications in your mobile phone settings. You may also be able to control preview settings in your e-mail applications. Please note, choosing to disable certain functionality of the mobile application may impact the functionality of other areas of the mobile application.
We retain Information for as long as necessary for the purpose for which it is collected, subject to a longer period if the Information is relevant to a legal challenge.
Children under 13
We will not intentionally collect any personal information (as that term is defined in the Children’s Online Privacy Protection Act) from children under the age of 13 through our Online Services without receiving parental consent. If you think that we have collected such personal information from a child under the age of 13 through our Online Services, please contact us immediately at info@sanvello.com.Â
SSN Protection Policy
It is our policy to protect the confidentiality of Social Security numbers (“SSNs”) that we receive or collect in the course of business. We secure the confidentiality of SSNs through various means, including physical, technical, and administrative safeguards that are designed to protect against unauthorized access. It is our policy to limit access to SSNs to that which is lawful, and to prohibit unlawful disclosure of SSNs.
CCPA Notice and Additional Rights for California Residents
The following sections below (California Privacy Rights, Shine the Light Law, California Consumer Privacy Act, and California Minors under 18) apply only if you are a California resident using our Online Services:
California Privacy Rights
California law permits our customers who are California residents to request certain information regarding the use and disclosure of personal information
Shine the Light Law
California residents may request certain information regarding the disclosure of personal information to third parties for their direct marketing purposes.
If we have disclosed any personal information to third parties for direct marketing purposes, we will provide a list of the categories of personal information, along with the names and addresses of these third parties to you at your request. To make such a request, contact us at the toll-free number or e-mail address found in the “Contact Us” section of this Policy.
This request may be made no more than once per calendar year. We reserve our right not to respond to requests submitted other than to the specified e-mail address or toll-free number found in the “Contact Us” section of this Policy. You should put “California Privacy Rights” in the e-mail subject line and in the body of your request. You must provide us with specific information regarding yourself so that we can accurately respond to the request.
California Consumer Privacy Act (CCPA) Notice
This privacy notice is for California residents in compliance with the California Consumer Privacy Act of 2018 (CCPA). It explains what Personal Information (PI) we collect about you, where and from whom we obtain it, why we collect it, and your rights regarding it.
PI We Collect And Disclose For Business Purposes
In the preceding twelve (12) months, we have collected the following PI about California residents and have disclosed it for business purposes described:
Category | Examples | Collected | Categories of Third Parties to Which We Disclose PI For Business Purposes |
---|---|---|---|
Identifiers | A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiers. | Yes | Contracted Service Providers, Vendors |
Personal information categories listed in the California Customer Records law | A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some Personal Information included in this category may overlap with other categories. | Yes | Contracted Service Providers, Vendors |
Protected classification characteristics under California or federal law | Age (40 years or older), gender, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions) | Yes | Contracted Service Providers, Vendors |
Biometric information | Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data. | Yes | Contracted Service Providers, Vendors |
Internet and/or network activity | Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement. | Yes | Contracted Service Providers, Vendors |
Inferences drawn from other personal information | Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. | Yes | Contracted Service Providers, Vendors |
PI does not include:
- De-identified or aggregated consumer information
- Publicly available information from government records
- Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data
- PI covered by other privacy laws, including: The Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA), the California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994
Categories of Sources of PI
We obtain the categories of PI listed above from:
- You or your authorized agent,
- Service providers,
- Affiliates,
- Publicly available information,
- Organizations with which you are employed or affiliated, or
- Activity on our apps and websites.
The collections from these sources can occur online, in person, paper or other electronic means.
In the preceding twelve (12) months, we have not sold any PI.
Third parties are not allowed to use or disclose your PI other than as specified in our contract and as permitted by law.
If we seek to use your PI for a materially different purpose than we previously disclosed in this notice, we will notify you and will not use your PI for this new purpose without your explicit consent.
Your Rights
- You have the right to request that we disclose certain information to you about our collection and use of your PI over the preceding twelve (12) months prior to your request. Once we receive and confirm your verifiable consumer request, we will disclose to you:
- What PI we collect about you
- Where and from whom we collect PI about you
- Our business purpose for collecting PI about you
- The types of third parties with whom we share your PI
- The specific pieces of PI we collect about you (however, we will not disclose your actual Social Security number, driver’s license number or other government-issued identification number, financial account number, any health insurance or medical identification number, an account password, or security questions and answers)
- The types of PI that we disclosed about you for a business purpose, and the categories of third parties to whom we disclosed your PI
- You have the right to be informed about the PI that we collect about you at the time that or before we collect it. This is that notice.
- You have the right to request that we delete any PI about you that we have. Applicable law may require or permit us to decline your request. If we decline your request, we will tell you why.
- You will not be discriminated against or penalized for exercising your rights to your PI, and we will honor your rights by not:
- Denying you services,
- Charging you different prices or rates for services,
- Imposing penalties, or
- Providing you with a different level or quality of services.
How to Exercise Your Rights
- You can submit requests for information about your PI by calling us at 877-441-0121 or emailing us at info@sanvello.com.
- You may be required to submit proof of your identity for these requests to be processed.
- We will not be able to comply with your request if we are unable to confirm your identity.
- You may designate an authorized agent to make a request on your behalf subject to proof of identity and authorization.
Timing
- Our responses to any of your requests for the information described above will be limited to information that we have collected in the preceding twelve (12) months before our receipt of your verified request.
- You will receive our response to your request within 45 days of your request, unless we provide you with notice that it will take more than 45 days to respond (in that case, we won’t take more than 90 days to respond).
California Minors Under 18
If you are a California resident under the age of 18 and are a registered user of our Online Services, you may request that we remove from our Online Services any content you post to our Online Services that can be accessed by any other user (whether registered or not). Please note that any content that is removed from visibility on our Online Services may still remain on our servers and in our systems.
To request removal of content under this provision, please write or e-mail us at the postal or e-mail address found in the please Contact Us section of this Policy. When you write us, please provide us with a description of the content, the location of the content on our Online Services, and any other information we may require in order to consider your request. Please note that removal of content under this provision does not ensure complete or comprehensive removal of the content or information posted on the Online Services by you.
Additional Rights for European Union Residents
The following sections below (Personal Information, Controller and Data Protection Officer, Lawful Basis for Data Processing, Retention, and Your Rights) apply only if you a resident in the European Union or European Economic Area using our Online Services (an “EU User”):
Personal Information
References to “personal information” in this Privacy Policy are equivalent to “personal data” governed by European data protection legislation.
Controller and Data Protection Officer
Sanvello Health is the controller of your personal information for purposes of European data protection legislation. You can contact our Data Protection Officer at info@sanvello.com.Â
European Union and United Kingdom Residents under 16
Sanvello’s Online Services may not be used by any European Union and United Kingdom residents under the age of 16. Â
Â
Lawful Basis for Data Processing
We will only collect, store, and process the personal information of EU Users where a lawful basis for such processing exists, which will typically fall under one of the following scenarios:
- You, the Data Subject, have given consent to the processing of your personal information for one or more specific purposes, for example by consenting to receiving electronic marketing, in which case you may withdraw your consent subsequently at any time (by emailing info@sanvello.com) without affecting the lawfulness of processing based on consent before its withdrawal;
- Processing is necessary for the performance of a contract to which you, the Data Subject, are party;

- Processing is necessary for compliance with a legal obligation to which Sanvello Health as a Controller is subject;

- Processing is necessary for the purposes of the legitimate interests pursued by us as the Controller, or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of you, the Data Subject, which require protection of your personal information.
- Stop sending you direct marketing communications. You may continue to receive Service-related and other non-marketing emails.
- Provide you with information about our processing of your personal information and give you access to your personal information.
- Update or correct inaccuracies in your personal information.
- Delete your personal information.
- Transfer a machine-readable copy of your personal information to you or a third party of your choice.
- Object to our reliance on our legitimate interests as the basis of our processing of your personal information that impacts your rights.
Use for New Purposes
We may use your personal information for reasons not described in this Privacy Policy where permitted by law and the reason is compatible with the purpose for which we collected it. However, we will not share personal information of EU Users with a third party for research purposes (i.e., research not related to improving our products or services) without obtaining your prior consent to do so, as required by applicable law in the European Union.
Retention
If you are an EU User, we will only retain your personal information for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements.
By law, we have to keep basic information about our customers (including contact, identity, financial, and transaction Information) for six years after customers cease being customers for tax purposes.
In some circumstances, we may anonymize your personal information (so that it can no longer be associated with you) in which case we may use this information indefinitely without further notice to you.
Your Rights
European data-protection laws give EU Users certain rights regarding their personal information. In relation to EU Users’ personal information that we hold, you may ask us to take the following actions:
You can submit these requests by email to info@sanvello.com. We may request specific information from you to help us confirm your identity and process your request. Applicable law may require or permit us to decline your request. If we decline your request, we will tell you why, subject to legal restrictions. If you would like to submit a complaint about our use of your personal information or response to your requests regarding your personal information, you may contact us as described below or submit a complaint to the data-protection regulator in your jurisdiction.
Additional Rights for Brazil Residents
The following sections below (Personal Information, Controller and Data Protection Officer, Lawful Basis for Data Processing, Retention, and Your Rights) apply only if you are a resident in Brazil using our Online Services (a “Brazil User”):
Personal Information
References to “personal information” in this Privacy Policy are equivalent to “personal data” governed by Brazil data protection legislation.
Controller and Data Protection Officer
Sanvello Health is the controller of your personal information for purposes of Brazil data protection legislation. You can contact our Data Protection Officer at info@sanvello.com.Â
Brazil Residents under 18
Sanvello’s Online Services may not be used by any Brazil residents under the age of 18. Â
Â
Lawful Basis for Data Processing
We will only collect, store, and process personal information of Brazil Users where a lawful basis for such processing exists, which will typically fall under one of the following scenarios:
- You, the Data Subject, have given consent to the processing of your personal information for one or more specific purposes, for example by consenting to receiving electronic marketing, in which case you may withdraw your consent subsequently at any time (by emailing info@sanvello.com) without affecting the lawfulness of processing based on consent before its withdrawal;
- Processing is necessary for the performance of a contract to which you, the Data Subject, are party;
- Processing is necessary for compliance with a legal obligation to which Sanvello Health as a Controller is subject;
- Processing is necessary for the purposes of the legitimate interests pursued by us as the Controller, or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of you, the Data Subject, which require protection of your personal information.
Purpose of Data Processing and Disclosures of Personal Data
The Company will use and otherwise process personal data as described in this Privacy Policy and as required or permitted by law.
Retention
If you are a Brazil User, personal data will be retained only for so long as reasonably necessary for the purposes set out above, in accordance with applicable laws.
Your Rights
Brazil Users may contact us, at the address listed below in the “Contact Information” section, to request confirmation of the existence of processing, access to the personal data we hold about them, to correct any inaccuracies, incompletions or mistakes, or to request anonymization, blocking, or deletion of this data, port personal data to another service provider, or to withdraw consent to the processing of personal data, in accordance with applicable law. Brazil Users may also request information about third parties with whom we share personal data.
The Company may be unable to comply with such a request where doing so would place it in breach of its obligations under applicable laws, regulations, or codes of practice. However, in some circumstances, you may be able to request that your data be blocked from further processing. You may also have a right to data portability to another data controller under certain circumstances. Where we rely on consent to process personal data, consent may be withdrawn at any time, free of charge, although the withdrawal may impact or disrupt the services we provide.
If a Brazil User is aware of changes to or inaccuracies in his or her personal data, he/she should inform us of such changes at the address listed below in the “Contact Information” section, so that the personal data may be updated or corrected.
Brazil Users have the following rights in relation to their data: (i) confirmation of the existence of data processing; (ii) access to data; (iii) correction of incomplete, inaccurate, or outdated data; (iv) anonymization, blocking, or elimination of unnecessary, excessive or treated data in disagreement with the provisions of the Law; (v) data portability, by means of an express request and subject to commercial and industrial secrecy; (vi) elimination of personal data processed with consent; (vii) information of the public and private entities with which the controller shares its personal data; (viii) information on the possibility of not providing consent, and on the consequences of refusal; and (ix) revocation of consent, all of which may be exercised through mechanisms provided in art. 18 of the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados Pessoais).
When This Privacy Policy Applies
Our Policy applies to Online Services that we own or operate and that contain a link to this Privacy Policy. Our Policy does not apply to information collected through other means such as by telephone, via mobile application that do not link to this Privacy Policy, or in person, although that information may be protected by other privacy policies.
Our Policy does not apply to the practices of other companies or other websites or software applications that may be linked from or made available through our Online Services. Some online services offered by us may be governed by a separate privacy policy.
The inclusion of a link on our Online Services or the ability to utilize a third-party website or software application through our Online Services does not imply that we endorse or otherwise monitor the privacy or security practices of that third-party website or software application or the accuracy of its content. Your use of the third-party website or software application is governed by that third party’s privacy policy.
This Privacy Policy is not intended to and does not create any contractual or other legal rights in or on behalf of any party.
Contact Us
Contact us regarding this Policy; our privacy practices; or you believe we, or any company associated with us, has misused your Information, at info@sanvello.com or 877-441-0121.
We have appointed a representative based in the United Kingdom, Sanvello Health Limited, at Thames House, Mere Park, Dedmere Road, Marlow, Bucks SL7 1PB, United Kingdom, which can be contacted at EUprivacy@sanvello.com.
Changes
We will review this Privacy Policy annually and update it from time to time. Any changes will be posted on this page and will become effective as of the “Last Revised” date. We encourage you to review this Policy periodically to be sure you are aware of those changes.
Social Media Disclaimer
Are you using social media? So are we! We encourage you to read, share, follow us and provide commentary on Facebook®, Twitter®, Pinterest®, Instagram® and other social media sites (“Social Media Site”). Before you post, please make sure you read our social media disclaimer:
We are under no obligation to screen or monitor your posts or any other user content; however, we reserve the right to monitor participation to ensure that you stay on topic, are courteous and avoid making offensive comments. Your posts and user content must adhere to the following requirements and cannot:
We reserve the right to edit comments for content, remove off-topic contributions, delete offensive comments or remarks, block offensive contributors, and delete actual or suspected spam content from any Social Media Site. Please be aware that once you post something online, there is the potential for numerous individuals to read your words, even years from now. Therefore, we suggest that you exercise caution when posting on any Social Media Sites and that you not disclose Information like your location, medical record number, personal medical information, financial information, etc. We are not responsible for the content of any comments or responses posted by others to any website or Social Media Site we manage or monitor. We do not control the placement of any marketing or advertising displayed on our pages by social media or third-party organizations.Â
Please remember that information posted on any of our social media profiles or platforms is for general informational purposes only and should not be considered medical advice and should not replace a consultation with your health care or financial professional. Always consult an appropriate health care or financial professional for your specific needs. If you are experiencing a medical emergency, call 9-1-1 or your local emergency number. Some treatments mentioned on social media formats may not be covered by your Health Insurer. Please refer to your benefit plan documents for information about coverage.
We reserve the right to respond to any post or user content, and we may occasionally privately request your contact information to assist offline with your consent by routing the matter to the appropriate persons or department for further handling. Any further questions about your account, claims, benefits or request for additional information can be addressed by visiting your member website or calling the toll-free member phone number on the back of your health plan ID or other membership card.
All trademarks are the property of their respective owners.