Privacy Policy

1. Introduction

This Privacy Policy informs you (or the entity on whose behalf you are using this Service) ("you" or as the context requires "your") what personal information MedMatrix LLC ("Company," "we," or "us") may collect and how Company uses such information. This Privacy Policy is a part of and incorporated into the Terms of Use ("Terms of Use") posted to the applicable Company website and any other written terms and conditions or agreement ("Terms and Conditions") of Company software application(s) ("App(s)") (the Website(s) and the App(s) and related services, collectively, the "Service").

The Company operates the website medmatrixusa.com and related marketing and landing pages, and provides functional medicine and medical aesthetics care from our office at 198 Maine Mall Road, South Portland, Maine. We work with patients 18 and older who have a physical address in Maine, New Hampshire, or Massachusetts. The medical records we keep about patients are also governed by our HIPAA Notice of Privacy Practices. Where HIPAA and this Privacy Policy differ for that information, the HIPAA Notice controls.

BY USING OR ACCESSING THE SERVICE IN ANY MANNER, YOU ACKNOWLEDGE THAT YOU ACCEPT THE PRACTICES AND POLICIES OUTLINED IN THIS PRIVACY POLICY, AND YOU HEREBY CONSENT THAT WE WILL COLLECT, USE, AND SHARE YOUR INFORMATION IN THE FOLLOWING WAYS. IF YOU DO NOT AGREE WITH THIS PRIVACY POLICY, YOU MAY NOT USE THE SERVICE. IF YOU USE THE SERVICE ON BEHALF OF SOMEONE ELSE (SUCH AS YOUR CHILD) OR AN ENTITY (SUCH AS YOUR EMPLOYER), YOU REPRESENT THAT YOU ARE AUTHORIZED BY SUCH INDIVIDUAL OR ENTITY TO ACCEPT THIS PRIVACY POLICY ON SUCH INDIVIDUAL'S OR ENTITY'S BEHALF.

2. Information We Collect

We collect the information you choose to give us, plus limited technical information about your visit:

• Contact details such as your name, email address, postal address, and phone number, which you enter on our practice guide, application, and booking forms.
• Personal Information such as a name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some Personal Information included in this category may overlap with other categories.
• Protected classification characteristics such as age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).
• Health information you submit such as on our application form (/get-started) you may tell us your symptoms, health concerns, past treatments, health focus areas and goals, whether you live in Maine, New Hampshire, or Massachusetts, and whether you are ready to invest in care. On our booking form (/booking) you may select the health goals you want to work on. You provide this voluntarily so we can match you with a provider and prepare for your visit.
• Scheduling details such as the date and time you select for a discovery call, and your acknowledgement that we do not accept insurance.
• Usage and device data such as pages you view, how you navigate the site, your browser type, operating system, IP address, and similar technical details.
• Marketing link data such as if you arrive from one of our ads or links, your name, email, and phone may be passed through the web address (UTM or query parameters) to pre-fill a form, and we may record which campaign or page referred you.

We do not knowingly collect payment card numbers, Social Security numbers, or government identification numbers through our websites.

3. How We Use Your Information

Company uses the Personal Information collected in an effort to improve your experience with the Service, to provide services to you, and to communicate with you about information that you request. Company may also use Personal Information to help target specific offers to you and to help Company develop and improve its Service. Specifically, Company may use your Personal Information to do any of the following (each a "Business Purpose"):

• To respond to your inquiry and send the free practice guide you requested
• To provide you with information, products, or Services that you request from us
• To match you with the appropriate provider and prepare for your appointment
• To schedule your discovery call and confirm appointment details
• To contact you, by phone, text message, and email, about your inquiry, appointments, and care (see Section 4)
• To measure and improve our advertising and the performance of our websites (see Section 5)
• To operate, secure, and improve the website and the patient experience
• For testing, research, analysis, and Services development
• To meet our legal, tax, and recordkeeping obligations

4. Calls, Text Messages, and Email

When you submit a form and give us your phone number, you consent to receive calls, text messages (SMS), and emails from Company at the number and email you provided, including messages sent using automated technology, about your inquiry, appointments, and care. Some of these messages are part of an automated follow-up sequence run through our customer relationship management platform.

Consent to receive text messages is not a condition of becoming a patient or purchasing any service. Message and data rates may apply, and message frequency varies. You can opt out of text messages at any time by replying STOP, opt out of marketing emails using the unsubscribe link, or ask us to stop contacting you by emailing info@medmatrixusa.com. We will still send messages needed to complete a request you have made.

5. Cookies, Analytics, and Advertising

On medmatrixusa.com, analytics and advertising technologies are off by default. When you first visit, a banner asks you to accept or decline. One exception applies: a Google Analytics measurement tag runs in Google's cookieless Consent Mode, meaning that until you accept (and always, if you decline) it sets no cookies, stores no identifiers on your device, and sends Google only aggregate, cookieless signals that Google uses to produce modeled statistics. Everything listed below loads only if you accept. If you decline, or until you make a choice, no cookies are set and none of the tools below load:

• Cookies: We may use some or all of the following types of Cookies:
  • Essential Cookies: Essential Cookies are required for providing you with features or services that you have requested. For example, certain Cookies enable you to log into the secure areas of our Service. Disabling these Cookies may make certain features and services unavailable.
  • Functional Cookies: Functional Cookies are used to record your choices and settings regarding our Service, maintain your preferences over time and recognize you when you return to our Service. These Cookies help us to personalize our content for you, greet you by name, and remember your preferences.
  • Performance/Analytical Cookies: Performance/Analytical Cookies allow us to understand how visitors use our Service such as by collecting information about the number of visitors to the Service, what pages visitors view on our Service, how long visitors are viewing pages on the Service, mouse clicks, mouse movements, scrolling activity, and text typed into the Service. Performance/Analytical Cookies also help us measure the performance of our advertising campaigns in order to help us improve our campaigns and the content for those who engage with our advertising.
  • Retargeting/Advertising Cookies: Retargeting/Advertising Cookies collect data about your online activity and identify your interests so that we can provide advertising that we believe is relevant to you.
• Google Tag Manager (container GTM-MR8CJPZX) and Google Analytics: Manage our measurement tags and may load additional measurement tools we have configured. Accepting enables the cookies and full measurement described in this section; before you accept, only the cookieless Consent Mode tag described above runs.
• Microsoft Clarity (project u4ds1j8974): Records anonymized session replays and heatmaps so we can see where visitors get stuck and improve the site.
• Vercel Analytics: Counts page views and basic traffic patterns.
• Hyros (advertising attribution): Tells us which marketing channel (an ad, an email, a search result, or a direct visit) brought you to our site. If you submit a form, Hyros can receive the contact details you submit together with online identifiers so we can measure and improve our advertising.

Two services load regardless of this choice because they are needed for the site to function. Google reCAPTCHA loads when you submit a form, to protect against spam and abuse; its use is subject to Google's Privacy Policy and Terms of Service. Pages with embedded videos load content and thumbnails from YouTube (a Google service) when you choose to play them, and our contact page loads a Google Maps view; in each case Google may set cookies and collect data under Google's privacy policy.

Advertising on our sites. On medmatrixusa.com, accepting the banner loads only the measurement, analytics, and attribution tools listed above (Cookies, Google Tag Manager, Microsoft Clarity, Vercel Analytics, and Hyros). We do not run Meta or TikTok pixels on medmatrixusa.com. Our marketing and landing pages are separate properties, and on those pages we may use advertising and attribution tools, including Google, Meta (Facebook and Instagram), and TikTok, and Hyros, which can receive the contact details you submit together with online identifiers, to measure and improve our advertising.

You can change your analytics and advertising choice at any time by clearing this site's cookies and local storage in your browser, which brings the banner back, and you can control or block cookies through your browser settings. At this time our websites do not respond to "Do Not Track" or Global Privacy Control browser signals. See Section 10 for additional opt-out rights.

6. Third-Party Services and Data Sharing

We will not rent, sell or otherwise disclose your Personal Information to unrelated third parties without your consent, except as stated in this Privacy Policy. We share information only with the service providers and partners that help us run the practice, and only as needed. You consent that Company may disclose Personal Information to the following third parties ("Authorized Third Party") for a Business Purpose:

• GoHighLevel (LeadConnector): Our customer relationship management and patient-communications platform. When you submit a form, the information goes to GoHighLevel, where we store your contact details and the health goals, focus areas, and notes you provided, and manage our follow-up and scheduling. We maintain a Business Associate Agreement with this provider.
• Cerbo: Our electronic health record system, where your clinical records are kept. We maintain a Business Associate Agreement with this provider.
• Advertising and measurement partners: As described in Section 5, Google measurement tools and Hyros advertising attribution may run on medmatrixusa.com, while Google, Meta, TikTok, and Hyros advertising tools run on our separate marketing and landing pages.
• Microsoft Clarity, Vercel, and Google (Tag Manager, reCAPTCHA, embedded YouTube, and Maps): As described in Section 5.
• Our parent, subsidiary, affiliates, and other related companies
• Service providers
• Third parties you or your agent authorize us to disclose Personal Information to in connection with the Services we provide to you
• To the extent permitted by law, government authorities or third parties pursuant to a legal request, subpoena, or other legal process
• If Company sells all or part of its business or makes a sale or transfer of assets or is otherwise involved in a merger or business transfer, you agree that Company may transfer your Personal Information to a third party as part of that transaction

Payments. We do not collect payment card information through our websites. Payments are taken only in person at our office. We accept HSA, FSA, CareCredit, and major credit and debit cards, processed through Bluefin (the PayConex gateway, using point-to-point encryption) and Elavon. Because our websites never receive card data, card handling is isolated to that encrypted in-office system.

Selling and sharing.We do not sell your personal information for money in the ordinary sense. However, the advertising activity described in Section 5 involves sharing online identifiers, and on some landing pages the contact information you submit, with advertising partners. Under some state privacy laws, this kind of sharing can be treated as a "sale" of personal information or as "targeted advertising." You can opt out as described in Sections 5 and 10. We may also disclose information if required by law or to protect the safety of our patients, staff, or the public.

7. Data Retention

We retain information about you consistent with all internal policies and procedures. We will retain your Personal Information as needed to fulfill the purposes for which it was collected, and as necessary to comply with our business requirements, legal obligations, resolve disputes, protect our assets, and enforce our agreements, or as is otherwise permitted or required by our data retention policies and procedures.

8. Data Security

We use reasonable measures to protect your information from unauthorized access, alteration, disclosure, or destruction, and the site uses HTTPS encryption for all data transmission. Because our websites do not collect or store payment card data, card information is never exposed through the site. No method of electronic transmission or storage is completely secure, so we cannot guarantee absolute security.

9. Your Privacy Rights

You have the right to:

• Access: You have the right to request certain information, to the extent technically feasible, about our collection and use of your Personal Information over the past 12 months
• Correct: You have the right to request correction of inaccurate information
• Deletion: You have the right to request that we delete the Personal Information that we have collected from you, subject to certain exceptions that may apply under State law
• Opt-Out: You have the right to request that we not share, disclose, disseminate, make available or otherwise transfer your Personal Information with third parties for advertising or similar purposes. You also have the right to opt out of marketing calls, texts, and emails
• Decline: You have the right to decline analytics and advertising, or withdraw a prior acceptance, as described in Section 5
• Automatic Decision Making: You have the right to request information about the logic involved in automatic decision making processes we use involving your Personal Information, and to request that you not be subject to such automated decision making

To exercise any of these rights, email info@medmatrixusa.com or use the contact details in Section 14. You must send us a request that (1) provides sufficient information to allow us to verify that you are the person who we have collected Personal Information from, and (2) describes your request in sufficient detail to allow us to understand, evaluate, and respond to it. We may need to verify your identity before we act on a request, and we will not discriminate against you for exercising these rights.

10. New Hampshire Resident Rights

• NHDPA: Under the New Hampshire Consumer Data Privacy Act ("NHDPA"), New Hampshire residents may have the right to confirm whether we process their personal data, access personal data we maintain about them, correct inaccuracies in their personal data, delete personal data, obtain a portable copy of their personal data, and opt out of the processing of personal data for targeted advertising, the sale of personal data, or certain profiling activities.
• Requests: To exercise your rights to know, access, correct, delete, or opt out of targeted advertising, please contact us at info@medmatrixusa.com with your name and your request. We will try to respond to a verifiable consumer request within 45 days of receipt of your request. If we are unable to process your request in such time, we will inform you of the delay in writing.
• Appeal: If we are unable to comply with all or a portion of your request, we will explain the reasons we cannot comply. You may appeal our decision by resubmitting a request and referencing your first request and we will inform you of any action taken or not taken in response to the request and explain the reasons for our decision within 60 days of receiving the request. If we deny your appeal, you may contact the New Hampshire Attorney General. We will not discriminate against you for exercising these rights.

11. Protected Health Information

The medical information we collect and keep as your healthcare provider is protected health information under the Health Insurance Portability and Accountability Act (HIPAA). How we use and disclose it, and your rights over it, are described in our HIPAA Notice of Privacy Practices. Where HIPAA and this Privacy Policy differ for that information, the HIPAA Notice controls. The information you submit through our website forms before you become a patient is governed by this Privacy Policy.

12. Children's Privacy

Our website and services are intended only for adults over the age of 18. We work exclusively with patients 18 years of age and older who have an address in Maine, New Hampshire, or Massachusetts, and we do not knowingly collect personal information from anyone under 18. If you are a child under the age of 18, please do not attempt to register for or otherwise use the Service or send us any Personal Information. By accessing, using and/or submitting information to or through the Service, you represent that you are not under the age of 18.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

14. Contact Us

If you have questions about this Privacy Policy or want to exercise your rights, contact us: