Draft — under legal review
This document is a working draft and may change before it takes effect. Bracketed items are still being finalized.
Your privacy & terms
Privacy Policy
Last updated: [EFFECTIVE DATE]
Our Privacy Promises at a Glance
- Your health information stays out of advertising. We never share what you enter in your client portal with Facebook/Meta, Google, or any other advertiser. Those pages have no advertising pixels and no session recording.
- Your quiz answers are treated as sensitive. We do not send your quiz answers to advertising platforms.
- We do not sell your personal information for money, and we never sell health information.
- You control marketing. You can turn off advertising cookies, unsubscribe from emails, and reply STOP to texts at any time. We honor Global Privacy Control signals.
- We will tell you about a breach. If your information is ever exposed, we will notify you as the law requires.
1. Who We Are and What This Policy Covers
Measured Health is the business name of CoolCRYO LLC, 4040 Cheyenne Blvd, Suite C, Rapid City, SD 57703 ("we," "us," "our," or the "Company").
This Website Privacy Policy explains how we collect, use, and share personal information when you:
- visit our public website at measuredhealth.me and related pages (the "Marketing Zone")
- take our online quiz
- sign up for emails or text messages
- contact us or book a call
Your health information as a client is covered by a different notice. Our secure client portal and intake forms (the "Protected Zone") hold your health history, scans, labs, photos, check-ins, and messages. That information is covered by our Notice of Privacy Practices. Where that notice gives you stronger protections, it controls. This policy still applies to cookies, accounts, and marketing.
Independent Prescribing Providers. If you choose to talk with a licensed prescriber in the Asher Health network (a "Prescribing Provider"), that provider is independent from us. The provider and Asher Health have their own privacy policies.
2. Information We Collect
| Category | Examples | Where it comes from |
|---|---|---|
| Contact information | Name, email, phone number, ZIP code | You (forms, quiz, booking, calls) |
| Quiz answers | Age range, goals, what you've tried before, readiness to start, concerns | You (our online quiz) |
| Booking and purchase information | Appointment times, services bought, payment status. Card numbers are handled by our payment processor, not stored by us. | You, our booking tool, our payment processor |
| Communications | Emails, texts, chat or call notes about scheduling and questions | You and our staff |
| Marketing preferences and consents | Email opt-in, text opt-in, cookie choices, Global Privacy Control signal | You and your browser |
| Device and usage information | IP address, browser type, pages viewed, links clicked, referring site, approximate location (city or state) | Cookies and similar tools (Section 5) |
| Advertising information | Which ad you clicked; whether you submitted a form (a "lead") | Advertising platforms and cookies |
| Health information in the Protected Zone | Health history, scans, labs, photos, check-ins, messages | You and your care team. Covered by our Notice of Privacy Practices. |
We do not knowingly collect information from anyone under 18 (Section 12).
3. Your Quiz Answers
Our quiz asks about your goals and history so we can give you a personalized result. Some answers may relate to your health, such as weight goals or past diets. We treat quiz answers as sensitive information:
- No quiz answers go to advertisers. We do not send your answers, your quiz result, or your "track" to Meta, Google, or any other advertising platform.
- Only a generic "lead" signal. When you finish the quiz and give us your contact information, our site may tell an advertising platform that "a lead was submitted." That signal does not include your answers, result, health details, or any page address that reveals them. For visitors from states that require opt-in consent before consumer health data is shared, including Washington, Nevada, and Connecticut, we send this lead signal only if you have opted in to advertising cookies.
- No session recording on the quiz. We do not use screen-recording or "session replay" tools on the quiz or any form that asks about health.
- Who uses your answers. Our team uses them to prepare for your call and suggest a program track. They are stored in our secure system.
- CRM sync is limited. Only your name, email, phone, lead stage, and marketing consent go to our marketing contact system. Your quiz answers do not.
4. How We Use Personal Information
We use personal information to:
- Provide what you ask for. Examples: your quiz result, a booked call, an assessment, or a reply to a question.
- Communicate with you. Examples: confirmations, reminders, and, if you agree, marketing emails and texts.
- Run and improve our website. Examples: understanding which pages are useful, fixing errors, and testing designs.
- Advertise. We measure whether our ads work and show our ads to people who may be interested. This is subject to your choices in Section 6.
- Keep things safe and secure. We prevent fraud, spam, and misuse, and protect our systems.
- Follow the law. We keep required records, respond to lawful requests, and enforce our Terms of Use.
We do not use your health information or quiz answers to build advertising audiences. Examples of audiences we do not build: "people interested in weight loss" lists or lookalike audiences from client health data.
5. Cookies, Pixels, and Similar Tools
Cookies are small files a website stores on your browser. Pixels (or "tags") are small pieces of code that send information to another company when a page loads or you take an action. We use them only in the Marketing Zone and only as described below.
Where we never use advertising, analytics, or session-recording tools:
- the client Portal
- intake and health-history forms
- the quiz questions
- assessment, scan, lab, and check-in pages
- any page that collects or shows health information
| Tool | Provider | Type | What it does | Where it runs | Your choice |
|---|---|---|---|---|---|
| Session and security cookies | Us | Strictly necessary | Keeps you signed in, protects forms from spam and attacks, remembers your cookie choices | Entire site and Portal | Required for the site to work |
| [Booking / form embed cookies] | [GoHighLevel / Vagaro] | Functional | Lets embedded booking and contact forms work | Booking and contact pages only (no health questions) | Can be blocked in your browser; forms may not work |
| Google Analytics 4 | Google LLC | Analytics | Counts visits and shows which pages are popular. IP addresses are not stored by GA4. | Marketing Zone only | Cookie banner; GPC; Google opt-out add-on |
| Meta Pixel | Meta Platforms, Inc. | Advertising | Measures ad results and helps show our ads on Facebook and Instagram. Receives only page visits and a generic "lead" event. No quiz answers or health data. [Automatic Advanced Matching OFF.] | Marketing Zone only | Cookie banner; GPC; Meta ad settings |
| Google Ads conversion tag and conversion linker | Google LLC | Advertising | Measures ad results and helps show our ads on Google. Receives only a generic "lead" event. [Enhanced conversions OFF.] | Marketing Zone only | Cookie banner; GPC; Google ad settings |
| [Smartlook / SESSION RECORDING TOOL] | [PROVIDER] | Session recording | Records mouse movements and clicks so we can find confusing page designs. All form fields are masked, so typed text is never recorded. | Only non-health Marketing Zone pages (e.g., home, articles, about). Never on the quiz, forms, or Portal. | Cookie banner; GPC |
Cookie banner. When you first visit, a banner lets you accept or reject analytics and advertising cookies. You can change your choice at any time with the "Cookie Settings" link at the bottom of every page. Analytics and advertising tools do not load until you click "Accept."
Global Privacy Control (GPC). If your browser sends a GPC signal, we treat it as a request to opt out of targeted advertising and any "sale" or "sharing" of your personal information for that browser. We will not load advertising pixels. Learn more at globalprivacycontrol.org.
"Do Not Track." Browsers' older "Do Not Track" setting has no common standard. We do not respond to it separately, but we do honor GPC.
Ad platform settings. You can also limit ads through:
- Meta: facebook.com/adpreferences
- Google: adssettings.google.com
- Industry tools: optout.aboutads.info and optout.networkadvertising.org
6. Your Marketing Choices
6.1 Email
If you sign up, we send emails about our programs, tips, and offers. Every marketing email has an unsubscribe link. We will honor your request within 10 business days, as the CAN-SPAM Act requires (15 U.S.C. §7704(a)(4)). We will still send account and service messages, such as receipts and appointment confirmations.
6.2 Text messages
We send texts only if you agree. Account and care texts (like reminders) and marketing texts have separate consent checkboxes. Agreeing to texts is never required to buy anything. Reply STOP to stop texts or HELP for help. Message and data rates may apply. See our SMS Text Messaging Terms.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent will not be shared with any third parties.
6.3 Health details in messages
Our texts and emails do not include health details. They tell you to sign in to the Portal to read your messages and results.
7. How We Share Personal Information
We share personal information only as described here.
| Who | Why | What |
|---|---|---|
| Cloud hosting and security (DigitalOcean) | Host our website, database, files, and backups securely | All categories, encrypted. Health data is covered by a HIPAA business associate agreement. |
| AI services (Claude, provided by Anthropic) | Draft reports and documentation for staff review | Protected Zone data only, under Anthropic's HIPAA business associate agreement. Not used to train AI models. |
| Email and text-message delivery (Twilio; Google Workspace; GoHighLevel) | Send confirmations, reminders, and marketing you agreed to | Name, email, phone, consent status. No health details. |
| Marketing contact system (GoHighLevel) | Manage leads and marketing communications | Name, email, phone, lead stage, marketing consent only |
| Booking (Vagaro; [CALENDAR TOOL]) | Schedule in-clinic and phone appointments | Name, contact information, appointment time and type |
| Payment and financing (card processor; Cherry, CareCredit, Afterpay if you choose them) | Process payments and financing you apply for | Name, contact, billing, and amount. No health details. |
| Analytics and advertising (Google, Meta) | Measure and deliver ads (Section 5) | Device and usage information; a generic lead event. No quiz answers or health data. |
| Session recording ([PROVIDER]) | Improve page design | Masked activity on non-health pages only |
| Prescribing Providers and their platform (Asher Health) | Only if you ask to be evaluated for prescription options | What the provider needs to evaluate you. Covered by our Notice of Privacy Practices. |
| Laboratories ([LAB PARTNER]) | Run tests you choose as a client | Covered by our Notice of Privacy Practices |
| Professional advisors | Legal, accounting, and insurance advice | As needed, under confidentiality duties |
| Government and legal | Follow the law, respond to valid legal process, protect rights and safety | As required |
| Business transfer | If we merge, sell, or reorganize our business | Personal information may transfer, subject to this policy. Health information transfers only as the law allows. |
Our service providers may use your information only to provide services to us. They are bound by contract.
8. We Do Not Sell Your Personal Information
We do not sell personal information for money. We never sell or "share" health information or quiz answers.
Some state laws define "sale," "sharing," or "targeted advertising" broadly enough to include advertising cookies and pixels. To the extent our use of the Meta Pixel or Google Ads tags counts under those laws, you can opt out. Use the cookie banner, "Cookie Settings," GPC, or the request methods in Section 13.
9. How Long We Keep Information
We keep personal information only as long as we need it for the purposes in this policy, or as the law requires.
| Information | How long we keep it |
|---|---|
| Quiz answers and lead information (if you don't become a client) | [24] months after your last contact with us, then deleted or de-identified |
| Marketing contact information | Until you unsubscribe, plus [12] months to honor your opt-out. A minimal suppression record is kept so we don't contact you again. |
| Consent records (texts, emails, cookies) | At least [5] years, to prove consent |
| Analytics data | [14] months (Google Analytics setting) |
| Session recordings | [30] days |
| Client records in the Protected Zone | As described in our Notice of Privacy Practices and our records retention schedule: [at least 6 years after your last service] |
10. How We Protect Information
We use administrative, technical, and physical safeguards to protect your information. They include:
- encryption in transit and at rest
- multi-factor sign-in for staff and clients
- role-based access, so staff see only what they need
- audit logs of every view and change to health information
- secure, separate storage for files
- regular access reviews
- tested backups
No system is perfectly secure, but we work hard to protect your information and keep improving.
11. If There Is a Breach
If personal information about you is exposed in a security breach, we will notify you as the law requires. Depending on the information and our legal status, we will follow:
- the HIPAA Breach Notification Rule (45 CFR §§164.400–414)
- the FTC Health Breach Notification Rule (16 CFR Part 318)
- South Dakota's breach law (SDCL §§22-40-19 through 22-40-26)
- other state laws that apply
In general, we will notify you without unreasonable delay and within 60 days of discovery. Notice will come by email or mail and will explain what happened and what you can do.
12. Children
Our website and services are for adults 18 and older. They are not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, contact us and we will delete it.
13. Your State Privacy Rights
Depending on where you live, you may have some or all of the following rights. We extend these rights to all of our customers, wherever they live, subject to legal exceptions.
| Right | What it means |
|---|---|
| Know / access | Confirm whether we process your personal information, and get a copy |
| Correct | Fix inaccurate personal information |
| Delete | Ask us to delete personal information we have about you, subject to legal exceptions (for example, records we must keep) |
| Portability | Get your information in a usable format. Clients can also use Export My Records in the Portal. |
| Opt out of targeted advertising, "sale," and "sharing" | Stop the use of your information for targeted ads. Use the cookie banner, GPC, or a request. |
| Opt out of profiling | We do not use personal information for profiling that produces legal or similarly significant effects |
| Consent for sensitive data | Where state law requires it, we ask for your consent before we process sensitive data, including health data |
| Withdraw consent | Withdraw any consent you gave us |
| Appeal | If we deny your request, you can appeal (see below) |
| Non-discrimination | We will not treat you differently for using your rights |
How to make a request. Email privacy@measuredhealth.me, call 605-301-3189, or use the form at [PRIVACY REQUEST URL]. Clients can also send a Portal message to "Privacy Officer."
Verification. We will verify your identity before acting. Usually we confirm information we already have, or ask you to sign in to your Portal account.
Authorized agents. You may use an authorized agent. We may ask for written permission signed by you and may verify your identity directly.
Timing. We will respond within 45 days. If we need more time, we will tell you, and we may take up to 45 more days where the law allows.
Appeals. If we deny your request, reply to our decision with the word "Appeal" or email privacy@measuredhealth.me. We will respond within the time your state's law requires, usually 45 or 60 days. If you are not satisfied, you may contact your state Attorney General.
State-specific notes:
- Washington, Nevada, and Connecticut (consumer health data). These states have special laws for "consumer health data." Examples are Washington's My Health My Data Act (RCW ch. 19.373), Nevada's consumer health data law (NRS 603A.400 et seq.), and Connecticut's Data Privacy Act consumer health data provisions (Conn. Gen. Stat. §42-515 et seq.). If you live in one of these states, see our Consumer Health Data Privacy Policy below.
- California. California residents may ask once a year about disclosures of personal information to third parties for their direct marketing (Cal. Civ. Code §1798.83). We do not make those disclosures.
- Nevada. We do not sell "covered information" as defined in NRS 603A.320. Nevada residents may still send an opt-out request to privacy@measuredhealth.me.
14. Links to Other Websites
Our site may link to other websites, such as Asher Health, financing companies, or social media. We do not control those sites. Read their privacy policies.
15. Changes to This Policy
We may update this policy. We will post the new version here and change the "Last updated" date. If we make a material change, especially one about health information, we will tell you by email or a notice on our site before it takes effect. Where the law requires, we will ask for your consent. We will not use personal information we already collected in a materially different way without your consent.
16. Contact Us
Contact: Privacy Officer
Measured Health / CoolCRYO LLC
4040 Cheyenne Blvd, Suite C, Rapid City, SD 57703
Phone: 605-301-3189
Email: privacy@measuredhealth.me
Consumer Health Data Privacy Policy
(Wash. RCW 19.373.020; NRS 603A.450; Conn. Gen. Stat. §42-526 et seq.)
Last updated: [EFFECTIVE DATE]
This policy explains how Measured Health / CoolCRYO LLC handles "consumer health data." That is personal information that is linked or reasonably linkable to you and identifies your past, present, or future physical or mental health status.
This policy applies to residents of Washington, Nevada, and Connecticut, and to anyone whose consumer health data is collected in those states. It does not cover information protected by HIPAA, which our Notice of Privacy Practices covers.
A. Categories of consumer health data we collect, and why
| Category | Examples | Purpose |
|---|---|---|
| Health goals and history from our quiz | Weight goals, age range, past approaches, readiness | Give your quiz result; prepare for your call; recommend a program track |
| Interest in or purchase of health services | The fact that you booked an assessment or joined a program | Schedule and provide services; billing; account management |
| Body measurements and wellness information (non-HIPAA) | Information you enter before becoming a client | Prepare for your assessment |
| Inferences | Your recommended program track | Recommend services that fit you |
| Precise location | We do not collect precise location. | — |
| Biometric data | We do not collect biometric identifiers such as face geometry. | — |
B. Sources
We collect consumer health data directly from you, through our quiz, forms, and conversations. We also create it from information you give us (inferences).
C. Categories of consumer health data we share
- Service providers (processors) who help us run our business, such as cloud hosting and our secure database: all categories above, under contract.
- Prescribing Providers and Asher Health: only if you ask to be evaluated, and only with your consent.
- We do not share consumer health data with advertising platforms. The generic "lead" event described in Section 3 of our Website Privacy Policy is sent only if you opt in.
- We do not sell consumer health data. We would need your signed, valid authorization under RCW 19.373.070 before any sale.
D. Third parties and affiliates we share with
| Category | Names |
|---|---|
| Processors | DigitalOcean (hosting, database, files, backups); Anthropic (AI that helps staff draft documentation); Google Workspace (email, no health details); Twilio (contact and consent data only) |
| Third parties (only at your direction) | Asher Health and its network Prescribing Providers; [LAB PARTNER] |
| Affiliates | [NONE / LIST] |
You may ask us for a list of every third party and affiliate that has received your consumer health data, with their contact information.
E. Consent
We collect consumer health data only with your consent or as needed to provide a product or service you asked for. We share it only with your separate consent or as needed to provide what you asked for (RCW 19.373.030). Our consent requests are clear and separate. They are never hidden in general terms. You can withdraw consent at any time.
F. Geofencing
We do not use geofences around health care facilities to identify, track, collect data from, or send health-related messages or ads to people (RCW 19.373.080; NRS 603A.540; Conn. Gen. Stat. §42-526(b)).
G. Your rights
You have the right to:
- Confirm whether we collect, share, or sell your consumer health data, and access it, including a list of all third parties and affiliates we shared it with and their contact information
- Withdraw consent to our collection and sharing
- Delete your consumer health data. We will also tell our processors and third parties to delete it. Data in archives or backups is deleted within 6 months.
- Appeal if we deny your request
- Be free from discrimination for using these rights
How to use your rights: Email privacy@measuredhealth.me, call 605-301-3189, or use [PRIVACY REQUEST URL]. We will verify your identity and respond within 45 days. Where allowed, we may extend once by 45 more days and will tell you why.
Appeals: Email privacy@measuredhealth.me with the subject line "Appeal." We will respond within 45 days. If we deny your appeal, you may contact:
- Washington Attorney General: www.atg.wa.gov/file-complaint
- Nevada Attorney General: ag.nv.gov
- Connecticut Attorney General: portal.ct.gov/ag
H. Contact
Privacy Officer · privacy@measuredhealth.me · 605-301-3189 · 4040 Cheyenne Blvd, Suite C, Rapid City, SD 57703