Sharecare Privacy Policy
Sharecare provides web and mobile delivery of traditional health, wellness, and other services designed to allow you to manage all of your health information in one place. Sharecare’s digital platform and services may be offered through your employer, health plan, or other program sponsor, always on a voluntary basis. Sharecare is a U.S. based corporation, organized under the laws of the State of Delaware, and is headquartered at 255 East Paces Ferry Road NE, Suite 700, Atlanta, Georgia, 30305.
Sharecare values your trust, and protecting your information is our highest priority. Sharecare is committed to your privacy. This Privacy Policy explains what information Sharecare and its affiliates (collectively, “Sharecare” or “We”) protects your information when you use our products and services (“Services”), including the following:
- What information Sharecare and its affiliates collect;
- How we collect the information;
- How we use the information;
- Legal grounds for the processing of your information;
- With whom we may share the information;
- Privacy rights, choices, and account termination;
- Retention Periods and protection of your information;
- Children’s privacy;
- When this Privacy Policy applies;
- Compliance and cooperation with regulatory authorities;
- California Privacy Rights;
- Rights in other jurisdictions such as the European Economic Area (“EEA”);
- Privacy Policy updates; and
- How you can contact us.
Please visit our Terms page for additional terms and conditions applicable to the Services.
Information We Collect
The information Sharecare collects is highly variable based on the type of Services you use and the manner in which you access them. Depending on these factors, Sharecare may collect the following information about you:
Personal Information. This is any information that directly or indirectly identifies you, such as your name, email address, or other identifying information about you.
Protected Health Information (“PHI”). PHI is your Personal Information that is protected under the U.S. Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). HIPAA and other laws closely regulate how Sharecare may handle, protect, and share your PHI. Sharecare may offer certain Services to you based on your relationship with employers, healthcare providers, insurance companies, or other entities (each an "Enterprise Organization") with an interest in your health ("Enterprise Programs"). If such Enterprise Organizations are Covered Entities as defined by HIPAA, Sharecare must comply with HIPAA in connection with the corresponding Enterprise Program. PHI is considered a subset of Personal Information.
Health Information that is Not PHI. If you are engaging with Sharecare’s consumer-oriented Services, i.e. not as a member or patient as a Covered Entity as defined by HIPAA, we may collect health-related information such as your health conditions, symptoms, measurements (e.g. height, weight), diagnoses, treatments, and other similar information as would be typical of one’s personal health history. We may also collect information related to health topics you are researching on our sites, which or may or may not be indicative of your own health-related information. We may also collect information identifying your attempts to seek healthcare services (including, in limited cases and only with your express consent via your device, specific location information) through your use of provider-search or similar tools. Identifiable health information is considered a subset of Personal Information.
Other Information. Other Information is information that, by itself, does not individually identify you such as browser type, operating system, technical data, and usage. We may link together different types of Other Information or link Other Information to Personal Information and/or Health Information..
How We Collect Information
We collect information in the following ways:
- Information You Give Us Upon Registration. Many of our Services require you to sign up for a Sharecare Account. When you do, we’ll ask for Personal Information like your name, date of birth, email address, telephone number or credit card. If you want to take full advantage of the sharing features we offer, we might also ask you to create a publicly visible Sharecare Profile, which may include your name and photo.
- Information from Your Employer or Health Plan. When you are eligible to participate in an Enterprise Program, an Enterprise Organization may provide us with PHI such as your name, date of birth, gender, mailing address, health coverage details, and health plan identification number, among other things. In connection with certain services, we may receive claims and other health-specific information from your health plan and/or its carriers. We use this information to provide services to you on behalf of your health plan or employer, in our capacity as a business associate under HIPAA.
- Information Provided to Us by Your Healthcare Provider or Third-Party Lab. When you participate in an Enterprise Program and engage with an advocate or participate in a health screening, with your authorization we may receive information from your health provider or third-party lab such as your health records, biometric data and blood test data and results.
- Information from Other Sources. We may obtain information about you from affiliates, partners, and other third parties. This information may be used to provide Services to you and to provide analysis about you in comparison to people who are demographically similar to you. We may combine the information we obtain from third parties with information that we have collected about you.
- Information We Get from Your Use of Services. We may collect information about the Services that you use and how you use them. This information includes:
- Information You Provide. We may collect information provided by you while using our Services. For example, your completion of the RealAge Test results in our collection of the information you provide in response to its questions.
- Computer, Tablet, or Mobile Telephone information. We may collect device-specific information such as your hardware model, operating system version, unique device identifiers, device sensors and mobile network information including phone number. Sharecare may associate your device identifiers or phone number with your Sharecare Account. We will comply with the usage/license restrictions and requirements applicable to the device from which the information comes.
- Information from Wearables: When you connect your wearable fitness tracker, heart rate monitor, pedometer or other wearable technology (“Wearable”) with the Services, we may collect information about your steps, fitness activities, exercise frequency, sleep, and information about nutrition, such as calorie intake, nutritional statistics, blood pressure, and other biometric data. You may disable this integration through your device.
- Log Information. When you use our Services or view content provided by Sharecare, we may automatically collect and store certain information in server logs. This may include:
- details of how you used our service;
- Internet protocol address;
- device event information such as crashes, system activity, hardware settings; browser type, browser language, the date and time of your request and referral URL; and
- cookies that may uniquely identify your browser or your Sharecare Account.
- Location Information. The large majority of Sharecare services do not depend on your location; however, some Services are location-enabled. When you use a location-enabled Sharecare service, we may collect and process information about your actual location, like GPS signals sent by a mobile device. We may also use various technologies to determine location, such as sensor data from your device that may, for example, provide information on nearby Wi-Fi access points and cell towers.
- Unique Application Numbers. Certain Services include a unique application number. This number and information about your installation (for example, the operating system type and application version number) may be sent to Sharecare when you install or uninstall that service or when that service periodically contacts our servers, such as for automatic updates.
- Local Storage. We may collect and store information (including Personal Information) locally on your device using mechanisms such as browser web storage (including HTML 5) and application data caches.
- Cookies and Anonymous Identifiers. We use various technologies to collect and store information when you visit a Sharecare service, and this may include sending one or more cookies or anonymous identifiers to your device, pursuant to our Cookie Policy. We also use cookies and anonymous identifiers when you interact with Services we offer to our partners, such as Sharecare features that may appear on other sites. See the section “Transparency, Your Privacy Rights, Choices, and Account Termination” below for information about your opt-out choices.
How We Use Information We Collect
To Provide Services To You. We use the information that we collect about you to provide, maintain, protect and improve the Services that Sharecare provides to you.
To Provide Enterprise Programs To You. We use the information that we collect about you to provide Services on behalf of an Enterprise Organization to you and the Enterprise Organization.
Analytics. We use analytics tools and other third-party technologies, such as Google Analytics, to collect information in the form of various usage and user metrics when you use our site. These tools and technologies collect and analyze certain types of information, including cookies, IP addresses, device and software identifiers, referring and exit URLs, onsite behavior and usage information, feature use metrics and statistics, usage and demographics, and other similar information. You can deactivate Google Analytics using a browser add-on if you do not wish the website analysis to take place. You can download the add-on here: tools.google.com/dlpage/gaoptout.
To Improve Our Services. We use de-identified, anonymous information that we collect about you for statistical and analysis purposes to improve our products and services, and to provide population statistical analysis and well-being trend information.
For Certain Data and User Types, for Advertising. In certain limited scenarios (never in connection with an Enterprise Program), we may also personalize your experience on our sites and third-party sites by showing you advertisements from Sharecare or our advertising partners that are tailored to your interests. Use our privacy webform and our cookie consent tools to opt out of advertising to the extent it is applicable to you.
Legal Grounds for Processing Your Personal Information
We rely on the following legal grounds to process your Personal Information:
Consent. We may use your Personal Information as described in this Privacy Policy subject to your consent. To withdraw your consent for any uses of Personal Information described above, please review the section titled “Privacy Rights, Choices, and Account Termination” or contact us at privacy@sharecare.com.
Performance of Services. We may need to collect and use your Personal Information to enter into and perform under an agreement with you or an Enterprise Organization.
Legitimate Interests. We may use your Personal Information for our legitimate interests, including but not limited to marketing, to provide our Services and to improve our Services and the content on our sites.
What Information We Share
We take your privacy seriously. We do not sell your Personal Information to third parties as part of any Enterprise Program and all information disclosed is the minimum amount necessary to fulfill the legitimate business purpose. We do not sell anyone’s sensitive data to data miners or data brokers. We do not share Personal Information with companies, organizations and individuals outside of Sharecare except in the following circumstances:
- With Your Consent. We may share your Personal Information with companies, organizations or individuals outside of Sharecare when we have your consent to do so. This includes information shared via cookies, pixels, and similar trackers, which we only share with your affirmative consent by way of our cookie banner. Third parties receiving such data would include ad exchanges, and, on our doctor search pages, our partner, Healthgrades.
Also, in limited circumstances, where a third party has hosted a link to one of our sites, we may share your basic identifying information (name and email address) back with the third party on whose site you found the link. This sharing is strictly tied to the performance of the promotional link you found on the third-party site; we do not share with such third parties any information related to your use of our Services.
- As Part of an Enterprise Program. We may share your information according to the direction of your Enterprise Organization and any privacy policy and/or contractual requirements that they may ask us to comply with. Your Enterprise Organization may require Sharecare to share your Personal Information with the following:
- Enterprise Organization. Under U.S. laws, we may share PHI with your health plan for the administration of your plan. If you receive Services through your relationship with a non-US-based Enterprise Organization, we will adhere to the applicable laws in your country.
- Healthcare Providers. We may share information with your healthcare providers and any clinics or organized healthcare organizations with whom they are associated, provided such sharing is allowable under HIPAA.
- Your Employer. We will not share your PHI with your employer for employment-related purposes. We may only share the information needed for your employer to deliver Enterprise Programs. For example, we may share completion status of a wellness plan requirement but not the actual results of the required action or activity.
- Third-Party Service Providers. We may disclose your PHI to our business associates who perform various functions on our behalf, but Sharecare requires these third parties to agree in writing to safeguard your PHI appropriately and in accordance with the law. Sharecare does not sell or rent your PHI to third parties. Sharecare does not use your PHI to market, sell, or otherwise promote goods or services that are not health-related benefits provided by your health plan, employer, or provider.
- To Processors. We may, from time to time, outsource some or all of the operations of our business to third-party service providers. In such cases, it may be necessary for us to disclose your information to those service providers. In some cases, the service providers may collect information directly from you on our behalf. We restrict how such service providers may access, use and disclose your information. We employ other companies and individuals to perform functions on our behalf. Examples include processing compensation, providing employee benefits, and performing legal and other professional services. These agents may have access to your information as needed to perform their functions, but they are not permitted to use it for other purposes.
- For Legal Reasons. We may disclose any information about you when, in our opinion, such disclosure is necessary to prevent fraud or to comply with any statute, law, rule or regulation of any governmental authority or any order of any court of competent jurisdiction. We will share Personal Information with companies, organizations or individuals outside of Sharecare if we have a good-faith belief that access, use, preservation or disclosure of the information is reasonably necessary to: enforce applicable Terms of Use, including investigation of potential violations; detect, prevent, or otherwise address fraud, security or technical issues; and protect against harm to the rights, property or safety of Sharecare, our users or the public as required or permitted by law.
- In a Transaction. As we continue to develop our business, we might sell, buy or merge with companies, subsidiaries, or business units. In such transactions, data generally is one of the transferred business assets but remains subject to the promises made in any pre-existing privacy statement (unless, of course, the person consents otherwise). Also, in the unlikely event that Sharecare or all of its assets is acquired, your information may be one of the transferred assets.
- After Being Fully Deidentified, Incapable of Reidentification. We may share aggregated, de-identified information publicly and with our partners to evaluate the effectiveness, value, and analytic trends of the Services.
How We Protect Your Information
We work hard to protect Sharecare and our users from unauthorized access to or unauthorized alteration, disclosure or destruction of information we hold. Sharecare is committed to using industry-leading security practices such as ISO27001 and HITRUST. In particular:
- We comply with HIPAA’s security rule, where applicable.
- We encrypt many of our Services using SSL.
- We review our information collection and storage and processing practices, including physical security measures, to guard against unauthorized access to systems.
- We restrict access to Personal Information to Sharecare employees, contractors and agents who need to know that information in order to process it for us, and who are subject to strict contractual confidentiality obligations and may be disciplined or terminated if they fail to meet these obligations.
We keep Personal Information housed on servers in the United States. If you are located outside of the United States, information we collect (including cookies) are processed and stored in the United States. By using the Services and providing information to us, you consent to the transfer to and processing of the information in the United States, which currently lacks an adequacy decision with the European Commission.
Transparency, Privacy Rights and Choices, and Account Termination
Our goal is to be clear about what information we collect, so that you can make meaningful choices about how it is used.
Subject to your specific use of the Services, your privacy rights include:
- Transparency and the right to information. Through this policy we explain how we use and share your information. However, if you have questions or need additional information you can contact us any time at privacy@sharecare.com.
- Right of access, restriction of processing, erasure. You may contact us to request information about the Personal Information we have collected from you, or to request that your Personal Information be deleted. We will do our best to honor your requests, subject to any legal, ethical and contractual obligations. To make a request or to ask us a question about our data practices, please use our privacy webform, contact us via email at privacy@sharecare.com, or make use of the self-service tools in the “Settings” menu of your mobile app, if applicable. When requesting access to your Personal Information, please note that we may request specific information from you to enable us to confirm your identity and right to access, as well as to search for and provide you with the Personal Information that we hold about you. You may designate an authorized agent to request information on your behalf, provided that the authorized agent complies with our verification procedures to ensure your permission has been obtained.
- Your right to access or delete the Personal Information we hold about you is not absolute. There are instances where applicable law or regulatory requirements allow or require us to refrain from taking certain actions with respect to some or all of the Personal Information that we hold about you. In addition, some or all of the Personal Information may have been destroyed, erased or made anonymous. In the event we cannot provide you with access to your Personal Information, or we are unable to delete it, we will inform you of the reasons why, subject to any legal or regulatory restrictions.
- Right to correct your information. We endeavor to ensure that Personal Information in our possession is accurate, current and complete. If an individual believes that the Personal Information about him or her is incorrect, incomplete or outdated, he or she may request the revision or correction of that information. We reserve the right not to change any Personal Information we consider accurate. If it is determined that Personal Information is inaccurate, incomplete or outdated, we will use reasonable efforts to revise it and, if necessary, use reasonable efforts to inform agents, service providers or other third parties, which were provided with inaccurate information, so records in their possession may be corrected or updated.
- Right to withdraw your consent at any time. When we process your Personal Information based on your consent, you have the right to withdraw that consent at any time. This includes any HIPAA authorizations, consents regarding your participation in an Enterprise Program, email/text/other communication consents, or any other consent that you have provided to Sharecare. You may withdraw your consent by contacting us at privacy@sharecare.com, or, for certain consents, through your Sharecare account settings. Withdrawing consents may significantly limit your ability to use the Services.
- Right to object or opt out at any time. You have the right to object at any time to receiving marketing or promotional materials from us by either following the opt-out instructions in commercial e-mails or by contacting us, as well as the right to object to any processing of your Personal Information or to participating in any program. We will consider any request you make to us, and provide a reply in a timely manner, according to our legal, ethical and contractual obligations. Some non-marketing communications are not subject to a general right to opt out, such as communications about transactions and disclosures to comply with legal or ethical requirements. In addition, if you are part of an Enterprise Program, you may need to opt out of services with your Enterprise Organization, such as your employer or health plan. Sharecare will make reasonable attempts to communicate such opt-out requests to the applicable Enterprise Organization.
- Right to data portability. You have the right to data portability of your own personal data by contacting us; there are also options within the Sharecare account settings to request such data. There are instances where applicable law or regulatory requirements allow or require us to refrain from transmitting your Personal Information to certain recipients or may require additional documentation before transmitting your information. In addition, some or all of the Personal Information may have been destroyed, erased or made anonymous. In the event we cannot fulfill your data portability request or require additional information to do so, we will contact you.
- Right not to be subject to an automated decision, including profiling. We do not make automated decisions using your Personal Information that may negatively impact you.
- Right to lodge a complaint with the competent regulatory authority, such as your state’s attorney general, if you believe that the processing of your Personal Information does not comply with the applicable legal requirements.
- Right to manage your email notifications.
- Right to control who you share information with through your device’s privacy settings.
- Right to take information out of many of our Services by contacting Sharecare Customer Support or privacy@sharecare.com.
Terminating Your Account. You may terminate your account with us at any time through the account settings in your Sharecare account, by contacting our Customer Service, or emailing privacy@sharecare.com. Terminating your account will revoke any applicable consents or opt-ins but will be subject to any data retention requirements as described below.
Your Use After Termination of an Enterprise Program. Upon termination by you or Sharecare of the relationship with your Enterprise Organization, you may have the opportunity, under certain Services, to continue to use your personal profile and to access information about yourself, including Personal Information provided by an Enterprise Organization, in that profile. In order for you to continue to access the personal health information provided by your Enterprise Organization, you may need to execute a voluntary HIPAA Authorization or other express consent allowing Sharecare to receive and use your personal health information. If you choose not to authorize Sharecare to receive such information about you, you may not be able to use some of the Services or features of the Services. Information that you were able to access as part of an Enterprise Program may no longer be available to you post-termination without such authorization. If you continue to use Services made available by Sharecare after termination of the relationship with your Enterprise Organization, your Sharecare account will continue to be governed by the Sharecare Terms of Use and Privacy Policy.
Retention of Collected Information. Except as otherwise permitted or required by applicable law or regulatory requirements, we will retain your Personal Information only for as long as we believe it is necessary to fulfill the purposes for which the Personal Information was collected (including for the purpose of meeting any legal, accounting or other reporting requirements or obligations). You may request that we delete the Personal Information about you that we hold, as described above. Where there is no legal, fiscal, administrative, or contractual requirement to retain information for a longer or shorter period, information will be destroyed within five (5) years of its collection.
Cookies. We use a cookie banner to obtain your consent to the use of cookies. In addition to refusing to provide your consent, you may also set your browser or device to block all cookies, including cookies associated with our Services, or to indicate when a cookie is being set by us. However, many of our Services may not function properly if your cookies are disabled. For example, we may not remember your location preferences. See our Cookie Policy for more information.
Communities. In connection with certain Services, Sharecare offers peer-to-peer discussion boards (“Communities”) to users who wish to participate. Please note that if you are participating in an enterprise program through a HIPAA Covered Entity and you engage with any Communities, your voluntary disclosure of information to other members of the Community may render the disclosed information no longer subject to HIPAA.
Payments. We may provide paid products and/or Services within the Services. In that case, we use third-party Services for payment processing (e.g. payment processors). We will not store or collect your payment card details. That information is provided directly to our third-party payment processors whose use of your personal information is governed by their Privacy Policy. These payment processors adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council, which is a joint effort of brands like Visa, MasterCard, American Express and Discover. PCI-DSS requirements help ensure the secure handling of payment information.
The payment processors we work with are:
- Apple Store In-App Payments (https://www.apple.com/legal/privacy/en-ww/)
- Google Play In-App Payments(https://www.google.com/policies/privacy/)
- Stripe (https://stripe.com/us/privacy )
Information Shared By You. Many of our Services let you share information with others. Remember that when you share information publicly, it may be indexable by search engines. Our Services provide you with different options on sharing and removing your content.
Information of Children. The Services are not directed to or intended for use by minors. In compliance with laws, we will not intentionally collect any Personal Information from children under the age of 18. If you think that we have collected Personal Information from a minor child, please contact us.
In connection with some Enterprise Programs, adult plan-holders may enter or request information about minor dependents to be incorporated into the Services; such information may be processed by Sharecare as authorized and directed by the adult plan-holder and/or the applicable health plan. Such data is protected per applicable law, including but not limited to HIPAA. Sharecare maintains policies to prevent the unauthorized disclosure of sensitive information between plan-holders and dependents.
When This Privacy Policy Applies
Our Privacy Policy applies to all of the Services offered by Sharecare Inc. and its affiliates, including Services offered on other sites, but excludes Services that have separate privacy policies that do not incorporate this Privacy Policy, and Services that you may receive as a result of your participation in an Enterprise Program with a privacy policy that expressly supersedes this Privacy Policy.
Our Privacy Policy does not apply to Services offered by other companies or individuals, including products or sites that may be displayed to you in search results, sites that may include Sharecare Services, or other sites linked from our Services.
Compliance and Cooperation with Regulatory Authorities
We regularly review our compliance with our Privacy Policy. When we receive a formal written complaint, we will contact the person who made the complaint to follow up. We work with the appropriate regulatory authorities, including local data protection authorities, to resolve any complaints regarding the transfer of Personal Information that we cannot resolve with our users directly.
California Privacy Rights
Residents of the State of California may have additional rights as set forth in our Privacy Notice for California Residents. To opt out of any potential sale of your Personal Information or sharing of your information for advertising purposes, click here: DO NOT SELL OR SHARE MY PERSONAL INFORMATION.
Other Jurisdictions
You may choose to use our services if you reside outside of the U.S. We comply with any applicable laws and regulations based on the geographical location you select during your registration. Other jurisdictions, including but not limited to the European Economic Area (“EEA”), provide certain rights regarding Personal Information. Nothing in this Privacy Policy limits or attempts to limit your rights under applicable laws, including your ability, depending on your country of residence, to file a complaint with your local Data Protection Authority.
It is necessary for us to perform our obligations in accordance with any contract or engagement that we may have with you. It is in our legitimate interest or a third party's legitimate interest to use Personal Information in such a way to ensure that we provide the Services in the best way that we can.
Sharecare is located in the United States. When you submit Personal Information to us, or when others provide Personal Information to us, we will receive it and process it in the United States.
As detailed above, we sometimes provide Personal Information to third parties to perform services. If we transfer Personal Information received from the EEA to a third party, the third party's access, use, and disclosure of the Personal Information must also be in compliance with our Data Processing Addendum, including but not limited to the Standard Contractual Clauses contained therein.
Without limiting any other rights contained in this Privacy Policy, privacy rights under European Data Protection law, which may be exercised by all users, include:
- Transparency and the right to information. Through this policy we explain how we use and share your Personal Information. However, if you have questions or need additional information you can contact us any time.
- Right of access, restriction of processing, erasure. See the above sections of this Privacy Policy dealing with such rights.
- Right to withdraw your consent at any time. See the above section of this Privacy Policy dealing with such right.
- Right to object at any time. You have the right to object at any time to receiving marketing or promotional materials from us by either following the opt-out instructions in commercial e-mails or by contacting us, as well as the right to object to any processing of your Personal Information based on your specific situation.
- Right to data portability. You have the right to data portability of your own personal data by contacting us.
- Right not to be subject to an automated decision, including profiling. We do not make automated decisions using your personal data that may negatively impact you.
- Right to lodge a complaint with the competent Personal Data supervisory authority, if you believe that the processing of your Personal Information does not comply with legal requirements.
If you reside or otherwise find yourself outside of the U.S., we are committed to facilitating the exercise of your rights granted by the European Data Protection law and/or the laws of your country. If you have any inquiries or complaints about our handling of your Personal Information or about our privacy practices generally, please contact us (including our Data Protection Officer) at: privacy@sharecare.com. We will respond to your inquiry promptly.
Our EEA representative is Sharecare Digital Health International Limited, 88 Harcourt Street, Dublin 2 D02 DK18.
Changes to this Privacy Policy
Our Privacy Policy may change from time to time. This Privacy Policy is not intended to and does not create any contractual or other legal rights in or on behalf of any party. If we change this Privacy Policy, we will post any privacy policy changes on this page and, if the changes are material, we will provide a more prominent notice by sending you an email and/or posting a notice in the Services. Sharecare reserves the right to modify this Privacy Policy at any time, so please review it frequently.
Last modified: August 1, 2024