This Privacy Policy explains how HeartAGE (“HeartAGE,” “we,” “us,” or “our”) collects, uses, discloses, and protects information through theheartage.com, employer screening programs, community screening events, and related communications.
1. Information we collect
Website and inquiry information
When you request a quote, contact us, sponsor an event, or otherwise communicate with us, we may collect your email address, contact details, organization, estimated participant count, selected service, pricing inputs, message, and other information you choose to provide.
Wellness calendar submissions
When an approved organization emails a calendar submission, we process the sender address, email subject and body, event information, message identifiers, authentication and security results, and permitted attachments. Event details and approved flyers may be published publicly. Submitters should provide only information intended for public display and should not include confidential health information.
Screening information
When you participate in a HeartAGE screening, we may collect information needed to perform the screening and calculate an estimated cardiovascular risk result. Depending on the program, this may include age, blood pressure, cholesterol, glucose, body measurements, smoking status, diabetes status, relevant health history, prior results, and other appropriate risk factors. The specific information collected will be described at the screening or in program materials.
Technical information
Our website and service providers may automatically process limited technical information such as IP address, browser type, device information, requested pages, timestamps, and security or diagnostic logs. We use this information to deliver, secure, maintain, and improve the website.
2. How we use information
We may use information to:
- respond to inquiries and prepare screening proposals;
- schedule, administer, and support screening events;
- calculate and explain personal HeartAGE and cardiovascular risk estimates;
- extract, review, publish, update, and remove community wellness calendar listings;
- provide appropriate educational guidance and encourage follow-up when indicated;
- prepare aggregate participation, risk, and program-impact reporting;
- operate, protect, troubleshoot, and improve our website and services;
- comply with applicable law, contracts, and safety obligations; and
- protect the rights, privacy, security, and integrity of HeartAGE, participants, clients, and others.
3. Employer and sponsor reporting
Employers, sponsors, hosts, and community partners may receive participation totals, aggregate cardiovascular risk trends, follow-up activity, and similar program-level information. HeartAGE does not provide an employer or sponsor with an identifiable participant’s private screening results unless the participant has authorized the disclosure or the disclosure is otherwise permitted or required by law.
4. How we disclose information
We may disclose information to vendors that help us host the website, store data, send notifications, administer events, perform laboratory or screening functions, provide professional services, or support our operations. These providers are permitted to process information only for the services they provide to us and are expected to safeguard it appropriately.
Calendar-submission email content may be processed by cloud hosting, email, security, notification, and artificial-intelligence service providers to extract structured event information, check submissions, and operate the public calendar. Public event information and approved flyers are intentionally made available to website visitors.
We may also disclose information when reasonably necessary to comply with law or legal process; respond to an emergency; prevent fraud, abuse, or harm; enforce agreements; protect legal rights; or complete a merger, financing, reorganization, sale, or transfer of relevant operations subject to appropriate protections.
HeartAGE does not sell personal information or personal health information, and we do not use personal screening information for targeted advertising.
5. Health information and HIPAA
HIPAA applies only in defined circumstances to covered entities and their business associates. Whether HIPAA applies to a particular HeartAGE program depends on the parties involved and how the program is structured. When HeartAGE acts as a business associate or is otherwise subject to HIPAA for a program, we handle protected health information as required by applicable law and the governing agreement. Other information may instead be governed by this Policy, other federal or state privacy laws, event notices, consent forms, and client agreements.
6. Data retention
We retain information only for as long as reasonably necessary for the purposes described in this Policy, including providing services, maintaining appropriate business and screening records, resolving disputes, enforcing agreements, and satisfying legal, regulatory, contractual, and security obligations. Retention periods vary based on the type of information and the applicable program.
Raw wellness-calendar emails and their original attachments are ordinarily scheduled for deletion from the inbound system after 90 days. Published event records and approved flyers may be retained for calendar history, corrections, auditing, and operational needs.
7. Security
We use reasonable administrative, technical, and physical safeguards designed to protect information against unauthorized access, loss, misuse, alteration, or disclosure. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.
8. Your choices and requests
You may ask to access, correct, or delete personal information that we maintain about you, or withdraw a consent where applicable, by contacting us. We will evaluate requests under applicable law and may need to verify your identity. Certain information may be retained where required or permitted by law or necessary for legitimate operational purposes.
9. Children’s privacy
Our website is not directed to children under 13. Screening participation by minors, if offered, must occur through an authorized program with appropriate parent or guardian involvement and any required consent.
10. Third-party services
Our website may link to third-party websites or resources. Their privacy practices are governed by their own policies, and HeartAGE is not responsible for those practices.
11. Changes to this Policy
We may update this Policy as our services or legal obligations change. We will post the revised version here and update the effective date. Material changes may also be communicated through other appropriate channels.
12. Contact us
Questions or privacy requests may be sent to sales@theheartage.com or HeartAGE, Philadelphia, Pennsylvania.
This Privacy Policy is intended to describe HeartAGE’s practices. It is not a Notice of Privacy Practices under HIPAA unless HeartAGE expressly identifies it as such for a particular covered program.