Healed Website Privacy Notice

1. Scope

This Website Privacy Notice explains how Sigma Health, Inc., doing business as Healed (“Healed,” “we,” “us,” or “our”), collects, uses, discloses, and retains personal information through healed.care and Sigma’s non-clinical membership and support activities.

This notice is not a HIPAA Notice of Privacy Practices and does not replace the notice issued for your healthcare provider. The OpenLoop-operated patient platform presents the terms, telehealth consent, and Notice of Privacy Practices that apply to clinical care and medical records.

2. The Healed website and OpenLoop patient platform

Sigma operates healed.care. OpenLoop operates the Healed-branded platform used for registration, health intake, patient communications, billing, portal access, and access to licensed healthcare professionals. When you move from healed.care into that platform, OpenLoop’s policies and the applicable healthcare provider’s privacy notice apply in addition to this notice.

Sigma may receive limited information from OpenLoop to provide non-clinical membership services and support. When that information is protected health information, Sigma handles it only as permitted by its business-associate obligations, the applicable privacy notice, and law.

3. Information we collect

4. How we use information

• Operate, secure, troubleshoot, and improve healed.care and Sigma’s non-clinical membership services.
• Provide education, care navigation, non-clinical support, account administration, and transaction assistance.
• Coordinate with OpenLoop and other authorized service providers and route patient or privacy requests appropriately.
• Communicate about accounts and services and, with any consent required by law, send marketing communications.
• Prevent fraud, protect safety and security, enforce agreements, and comply with legal obligations.
• Create aggregate or de-identified information that cannot reasonably identify an individual and use it as permitted by law.

We do not use or disclose protected health information for advertising, sell protected health information, or use it to train a general-purpose artificial-intelligence model without a legally valid authorization and any other permission required by law.

5. How we disclose information

• To OpenLoop, treating professional entities, licensed professionals, laboratories, pharmacies, and fulfillment partners as needed for the services requested and as permitted by law.
• To vendors that provide hosting, security, communications, analytics, customer support, professional advice, or other services under appropriate contractual restrictions.
• To comply with law, legal process, regulatory requests, or to protect rights, safety, security, and the integrity of the service.
• In connection with a financing, merger, reorganization, acquisition, or sale, subject to applicable privacy and contractual restrictions.
• At your direction or with your consent.

6. Cookies, analytics, and advertising

On Healed-controlled public webpages, we use necessary technologies and may use Google Tag Manager, Stape, Google Analytics 4, Google Ads, Meta Pixel and Conversions API, TikTok Pixel and Events API, and Microsoft Advertising UET and Conversions API. These technologies may process page and referring URLs, page title, IP address, browser and device characteristics, language, time zone, cookie or browser identifiers, advertising click identifiers, timestamps, and generic interaction or conversion events.

We use a cookie-preference tool to provide choices and allow consent to be withdrawn where required. Advertising and nonessential analytics technologies are limited to Healed-controlled public pages. They are not permitted in OpenLoop health intake, checkout, payment, patient-portal, or clinical areas. We do not send those advertising platforms intake answers, clinical information, medication selections, patient or account identifiers, or enhanced-conversion contact information such as email address, telephone number, or postal address.

We configure public-site events to avoid transmitting health information through URLs, query strings, page titles, structured page metadata, or event parameters. We may initially optimize campaigns using a generic event such as starting an assessment. Completed intake, payment, prescription, and patient outcomes are measured internally or in aggregate unless a different disclosure is specifically authorized and lawfully implemented.

7. Consumer health data notice

Certain state laws regulate “consumer health data” more broadly than HIPAA. This section applies when one of those laws covers information that identifies or can reasonably be linked to a consumer and relates to past, present, or future physical or mental health, diagnosis, treatment, medication, reproductive or sexual health, precise location associated with health services, or other health-related status.

Our separate Healed Consumer Health Data Privacy Notice describes the consumer health data we collect, its sources, purposes, and recipients, and the rights available under applicable state law.

Sigma does not sell protected health information or use geofencing to identify or target a person seeking or receiving healthcare services. Some state laws may classify disclosures of public-site device or interaction information to advertising providers as a sale, sharing, or targeted advertising even when no money is exchanged. Where required, we provide a choice through the cookie-preference tool and honor applicable opt-out rights.

Where applicable, you may request access to, deletion of, or withdrawal of consent for consumer health data, including a list of third parties or affiliates with which it was shared. A sale or use outside the purposes disclosed here requires the consent or authorization required by law. Submit a request or appeal using the contact in Section 12. We may retain information where permitted or required by law and will explain any denial and available appeal process.

8. Communications

Service communications may be necessary to operate an account. Marketing email and text communications are governed by any separate consent and applicable law. You may use an unsubscribe link or reply STOP to supported text programs. Withdrawing marketing consent does not stop necessary service or care communications.

9. Retention and security

We retain personal information for as long as reasonably necessary for the purposes described here, including service delivery, legal and contractual obligations, dispute resolution, security, and recordkeeping. Retention periods depend on the information and applicable requirements. We use administrative, technical, and physical safeguards designed to protect information, but no system is completely secure.

10. Your choices and privacy rights

Depending on your state and the information involved, you may have rights to access, correct, delete, or obtain a copy of personal information; withdraw consent; or appeal a decision. You may also have rights concerning sensitive or consumer health data. We will verify and respond to requests as required by law and will not unlawfully discriminate for exercising a right.

For rights involving a medical record or protected health information held for your healthcare provider, follow the OpenLoop Notice of Privacy Practices. Sigma will route a misdirected request to the appropriate party.

OpenLoop Notice of Privacy Practices

11. Children, external links, and international use

The launch service is for adults age 18 and older and is not directed to children. healed.care may link to services governed by different privacy notices. The service is intended for people located in the United States; information may be processed in the United States.

12. Changes and contact

We may update this notice by posting a revised version and effective date and giving additional notice where required.

Privacy requests, appeals, or security concerns may be submitted to support@store.healed.care or by writing to:
Sigma Health, Inc., doing business as Healed
1 Ferry Building, Suite 201, San Francisco, CA 94111