How we collect, use, and protect your information.

Information we collect

We may collect the following types of information:

• Personal Information. Name, date of birth, address, phone number, email address, and Social Security Number when required for insurance verification.
• Health Information. Medical history, test results, diagnoses, medications, and other protected health information (PHI) as defined by HIPAA.
• Insurance Information. Health plan details, member ID, and eligibility information.
• Usage Data. Information about how you interact with our website and services.

How we use your information

We use your information to:

• Provide healthcare services, including at-home health screenings
• Coordinate care with your healthcare providers
• Process insurance claims and verify eligibility
• Communicate with you about your health and our services
• Comply with legal and regulatory requirements
• Improve our services and develop new offerings

How we protect your information

We implement robust security measures to protect your information, including:

• Encryption of data in transit and at rest
• Access controls and authentication requirements
• Regular security assessments and audits
• Employee training on privacy and security
• Business Associate Agreements with all vendors who handle PHI

Information sharing

We may share your information with:

• Healthcare Providers. Your primary care physician and other providers involved in your care.
• Health Plans. Your insurance company for claims processing and care coordination.
• Business Associates. Third-party vendors who help us provide services, under strict contractual protections.
• Legal Requirements. When required by law or to protect rights and safety.

Your rights

You have the right to:

• Access your health information
• Request corrections to your records
• Request restrictions on certain uses of your information
• Receive an accounting of disclosures
• Receive a copy of this Privacy Policy
• File a complaint if you believe your privacy rights have been violated

SMS messaging terms

Robinhood Health communicates with patients by text message, including through Mariann, our nursing assistant. We collect your mobile phone number and the content of text messages you exchange with us in order to deliver SMS communications and provide your care. Your phone number is used for delivering SMS messages related to your screening program and care, not for unrelated marketing. By providing your mobile number and opting in, you consent to receive text messages from us. These messages may include:

• Screening reminders and follow-ups from Mariann
• Instructions for completing at-home test kits
• Care coordination messages, such as help scheduling with your health center
• Responses to questions you send us

Message frequency varies based on your screening program and your responses. Message and data rates may apply depending on your mobile plan. Consent to receive text messages is not a condition of receiving care.

• To stop. Reply STOP at any time to opt out of text messages. You will receive one final message confirming your opt-out.
• To get help. Reply HELP for assistance, or contact us at privacy@robinhoodhealth.co.

We respect your privacy. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing with subcontractors in support services, such as customer service, secure messaging platforms, electronic health record vendors, and telecommunications providers, is permitted as necessary to provide services on our behalf.

All text messaging originator opt-in data and consent information will not be shared with any third parties, excluding aggregators and providers of the Text Message services. We do not sell or rent personal information, including mobile numbers or messaging consent, to third parties.

Data retention. Text messages that are part of your care are retained as part of your health record for as long as applicable medical record retention laws require. Other SMS data is retained only as long as needed to provide our services and then deleted, unless a longer period is required by law.

TCPA compliance. We comply with the Telephone Consumer Protection Act (TCPA). When you opt out, your number is added to our do-not-text list and you will not receive further messages from us unless you opt back in.

Standard SMS is not an encrypted channel. We limit the health information included in text messages, and you can request a different communication method at any time.

Uses requiring your written authorization

Some uses and disclosures of your health information require your explicit written authorization, including most marketing communications and any sale of your health information. We will not use or disclose your information for these purposes without your authorization, and you may revoke an authorization at any time in writing. For the full description of how we may use and disclose your health information, see our Notice of Privacy Practices.

California privacy rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. Note that health information governed by HIPAA is exempt from certain CCPA/CPRA requirements.