Privacy Policy

Thank you for visiting the NABR, LLC (“NABR”) website https://nabr.health (the “Site”), contacting NABR, and/or using any NABR mobile and online applications or services (the “Services”). This Privacy Policy is intended to describe how NABR handles information that you provide, or that we learn about the individuals who: visit our website, use our Services, contact us by mail, email or telephone or in person, or who provide us with information through any other means. We recommend that you carefully review this notice before providing us with any information. By accessing and using this Site or the Services, you agree to this Privacy Policy and our Terms of Service.

BY VISITING OR USING THE SERVICES, YOU EXPRESSLY CONSENT TO THE PROCESSING OF YOUR PERSONAL INFORMATION ACCORDING TO THIS PRIVACY POLICY.  IF YOU DO NOT AGREE WITH OUR POLICIES AND PRACTICES, YOUR CHOICE IS TO NOT USE THE SERVICES.  THE SERVICES ARE INTENDED FOR USERS LOCATED IN THE UNITED STATES AND YOUR INFORMATION WILL BE PROCESSED AND STORED IN THE UNITED STATES.  WE MAKE NO REPRESENTATION THAT THE SERVICES ARE APPROPRIATE OR AVAILABLE FOR USE OUTSIDE THE UNITED STATES.  ACCESS TO THE SERVICES FROM COUNTRIES OR TERRITORIES OR BY INDIVIDUALS WHERE SUCH ACCESS IS ILLEGAL IS PROHIBITED.  THE SERVICES MAY ONLY BE USED WITHIN CERTAIN STATES WITHIN THE UNITED STATES AS DESCRIBED IN OUR TERMS OF SERVICE.

NABR IS NOT A MEDICAL PROVIDER.  MEDICAL GROUPS USE THE SERVICES PROVIDED BY NABR TO FACILITATE TELEMEDICINE VISITS WITH PATIENTS.  THE MEDICAL GROUPS INCLUDE NABR MEDICAL GROUP PLLC, AN INDEPENDENT MEDICAL GROUP WITH A NETWORK OF MEDICAL PROVIDERS (“PROVIDERS”), AND OTHER MEDICAL GROUPS.   NABR IS NOT RESPONSIBLE FOR THE USE OR DISCLOSURE OF YOUR INFORMATION BY MEDICAL GROUPS OR PROVIDERS

We Do Not Sell Your Personal Information

NABR does not, to the best of our knowledge, sell or rent personal information that we have collected or retained about you to any other third-party for any purpose. Accordingly, we do not offer individuals the ability to “opt-out” of the selling or renting of personal information because we do not engage in those practices.

Children’s Privacy

The NABR website and Services are not intended for children under the age of 18 years, and NABR does not knowingly collect any information from children under 18 years old through its website. If the parent or guardian of a child under 18 believes that the child has provided us with any information, the parent or guardian of that child should contact us if they want this information deleted from our files. If NABR obtains knowledge from any source that it has information about a child under 18 in retrievable form in its files, we will delete that information from our existing files.

What Information Does Winona Collect and How Is It Used?

Registration Information

NABR will only collect personal information that you voluntarily provide to us or our service providers. When you register to use the services, we may collect information from you that includes, among other things, your name, mailing address, birthdate, e-mail address, telephone number, image of your photo ID and the information contained thereon, and your interest in specific types of products and/or services.  You may also voluntarily provide us with personal information when you contact us with a question or comment or otherwise interact with the Services.

Health Information

NABR is not a “covered entity” under the Health Insurance Portability and Accountability Act of 1996, and its related regulations (“HIPAA”) and is not responsible for the privacy, information or practices of third parties, including the Medical Groups.  NABR technicians, though, may collect Health Information about patients of the Medical Groups during telemedicine consultations.  As such, NABR may be a “business associate” of the Medical Groups.  As a business associate, we will protect your Health Information and disclose it only in accordance with HIPAA.  However, we may use and disclose any information that does not constitute Health Information in any manner permitted under this Privacy Policy.  Health Information does not include information that has been de-identified in accordance with applicable laws.

NABR and/or Medical Groups may de-identify your information so that it is no longer considered protected health information.  They may then disclose, aggregate, sell, or otherwise disclose such de-identified information to third parties for analytics, research, or other purposes.

Purchase Information

If you wish to purchase any product or service made available through the Service (“Purchase”), you may be asked to supply certain information relevant to your Purchase including, without limitation, your name, billing address, telephone number, physical address, primary contact, emergency contact, primary care provider contact and other information necessary for us to provide our services adequately.

Non-Personal Information

Like most website operators, NABR collects non-personally-identifying information of the sort that web browsers and servers typically make available, such as the browser type, language preference, referring site, and the date and time of each visitor request when visitors use the Services. NABR’s purpose in collecting non-personally identifying information is to better understand how NABR’s visitors use the Services. From time to time, NABR may release non-personally-identifying information in the aggregate, e.g., by publishing a report on trends in the usage of its Services.  NABR also collects potentially personally-identifying information like Internet Protocol (IP) addresses and may collect statistics about the behavior of visitors to the Services. For instance, NABR may monitor the Services to help identify spam.  We also may use these technologies to collect information about your online activities over time and across third-party websites or other online services (behavioral tracking).

In addition to log data, we may also collect information about the device you’re using to access the Services, including the type of device, the operating system, device settings, device identifiers and crash data. Whether we collect some or all of this information often depends on what type of device you’re using and its settings.  To learn more about the information your device makes available to us, please review the policies of your device manufacturer or software provider.

We do not collect personal information automatically, but we may tie this information to personal information about you that we collect from other sources or you provide to us.

In addition, we may use third party services such as Google Analytics that collect, monitor and analyze this type of information in order to increase the Services’ functionality. These third-party service providers have their own privacy policies addressing how they use such information.

How we use your information

We use the information we collect to provide you full access and functionality of the Services.  Accordingly, your information may be used for the following purposes: (i) to provide and improve our services, features and content; (ii) to administer your use of our services and accounts; (iii) to enable users to enjoy and easily navigate the Services; (iv) to better understand your needs and interests; (v) to fulfill requests or to respond to questions or comments you may make; (vi) to personalize your experience; (vii) to provide you with announcements, notifications and advertisements related to your interests and use of the Services and other communications such as electronic newsletters, promotional emails or similar messaging; (viii) to provide service announcements; (ix) to protect against users seeking to hack into the Services; (x) to assess the level of general interest in the Services; and (xi) for any other purpose with your consent.

Unless the information is fully anonymized and cannot be used to identify you as an individual, we will only use Health Information as reasonably necessary to provide you with services you directly request. 

With Whom Do We Share Your Information?

Personal Information

In order to provide you with access to the Services, certain third parties that perform services for NABR, such as hosting, analytical, data management or other similar services or are otherwise acting on our behalf (“Service Providers”) may have access to your personal information, including your Health Information.  Service Providers are authorized to use your information only to perform the service for which they are hired and may not share your information with any third parties. They are required to abide by the terms of our Privacy Policy including taking reasonable measures to ensure your personal information is secure. On occasion, we contract with trusted third-party providers who would receive your personal information or Health Information and conduct anonymized aggregate analyses of the data. Through our contractual arrangements, we require our contracting partners to maintain adequate security of personal information provided to them. We do not permit such third parties to sell your personal information to other third parties.

Other Ways We May Share your Personal Information

We may share the information you provide Winona, including your personal information and Health Information with the medical professionals and pharmacies that provide services to you to enable them to continue providing services to you via the Services.

We may disclose non-personally identifiable aggregated information about our users without restriction.

Other than to our employees, contractors and affiliated organizations or as described above, we disclose personally-identifying only when required to do so by law, or when we believe in good faith that disclosure is reasonably necessary to protect the property or rights of Winona, third parties or the public at large.  If you send us a request (for example via chat, a support email or via one of our feedback mechanisms), we reserve the right to publish it in order to help us clarify or respond to your request or to help us support other users.

In addition, in some cases we may choose to buy or sell assets. In these types of transactions, user information is typically one of the business assets that is transferred. Moreover, if NABR or substantially all of its assets were acquired, or in the unlikely event that NABR goes out of business or enters bankruptcy, user information would be one of the assets that is transferred or acquired by a third party. You acknowledge that such transfers may occur, and that any acquirer of NABR may continue to use your personal and non-personal information only as set forth in this policy. Otherwise, we will not rent or sell potentially personally-identifying and personally-identifying information to anyone.

We may also disclose your personally-identifying information if you expressly consent to the disclosure. 

Security

We are committed to protecting your Personal Information and Health Information. We regularly test our facilities and use a variety of security technologies and procedures to help protect your information from unauthorized access, use or disclosure.

Our Data Retention Criteria

We store your personal information for as long as is needed to fulfill the purposes outlined in this Privacy Policy, following which time it is either anonymized (where permitted by applicable law), deleted or destroyed. 

Our Use of Cookies and Analytical Tools

Cookies are text files containing small amounts of information which are downloaded to your hard disk or to your browser’s memory when you visit one of our Sites. Cookies are useful because they help arrange the content and layout of our Sites and allow us to recognize those computers or other devices that have been to our Sites before. Cookies do many different jobs, such as allowing our Sites to remember your preference settings and helping us to enhance the usability and performance of our Sites and your experience using them. Our Sites also may contain electronic images known as web beacons – sometimes called single-pixel gifs – that allow us to count the number of users who have visited specific pages. We may also include web beacons in promotional e-mail messages or newsletters in order to determine whether messages have been opened and acted upon. The type of cookie or similar technology that may be used on our Sites can be categorized as follows: Strictly Necessary, Performance, Functionality & Profile and Advertising.

  • Strictly Necessary Cookies. These cookies are essential for basic functionalities of the Site, and they enable you to move around our Sites and use their features, particularly in connection with information searches and order placement. Without these cookies, services you have asked for cannot be provided. These cookies do not gather information about you that could be used for marketing or remembering where you have been on the internet. Examples of strictly necessary cookies are a shopping basket cookie, which is used to remember the products that you wish to purchase when you add products to your shopping basket or proceed to checkout, a login/ authentication cookie which allows and manages your login to the Site and identifies you after logging in for a single session, a session cookie which is required to carry out the data transmission and provide the Site to you, a security cookie that detects repeat failed login attempts or similar abuses of the Sites. These types of cookies are regularly stored only as long as required for their purpose.
  • Performance Cookies. These cookies collect information about how you use our Sites, for example which pages you go to most often and if you get any error messages from certain pages. These cookies collect information that is used to improve how our Sites work. Without these cookies we cannot learn how our Sites are performing and make relevant improvements that could better your browsing experience. Examples of performance cookies that our Sites use include cookies from Google and Adobe Analytics (see further discussion below).
  • Functionality & Profile Cookies. These cookies allow our Sites to store information that you provide, such as preferences, and to store technical information useful for your interactions with our Sites. For instance, they remember your user ID and elements of your user profile. They also ensure that your experience using the Sites is relevant to you. They may also be used to provide services you have asked for such as watching a video or commenting on a blog. These cookies will not be used to track your browsing activity on other websites.  Without these cookies, a website cannot remember choices you have previously made or personalize your browsing experience. For example, we use a cookie to store your language preferences, which allows us to present you with product search results in the correct language, and we use a cookie to store your choice about the appearance of the cookie information banner that we display on our Sites. This cookie will help us remember your choice about the appearance of the cookie information banner when you subsequently visit the same site where you made your choice about the banner and any other NABR sites with the same domain or the same top-level domain.
  • Advertising Cookies and Similar Technologies. These cookies or similar technologies may be used to deliver advertisements that are more relevant to you and your interests. They may also be used to limit the times you see an advertisement as well as help to measure the effectiveness of the advertising campaign. These cookies may track your visits to other websites. Without these cookies or other technologies, online advertisements you encounter will be less relevant to you and your interests.

Setting your cookie preference

You can usually modify your browser settings to decline cookies and you can withdraw your consent at any time by modifying the settings of your browser to reject or disable cookies or by opting out of specific cookies through the opt-out options shared below. If you choose to decline cookies altogether, you may not be able to fully experience the features of the Sites that you visit.

Our use of web analytics

We use different analytic tools which serve the purpose of measuring, analyzing and optimizing our marketing measures and provide you with customized advertisements that could be of particular interest to you. In particular, we use the following tools:

  • Google Analytics uses cookies which enable an analysis of your use of the Sites. The information collected (IP address, browsing activities and other data linked to your usage of the Sites) is usually transferred to a Google server in the USA and stored there.  You can prevent Google Analytics from recognizing you on return visits to the Sites by disabling cookies on your browser. To see how you can opt-out of certain Google features, visit: Google Analytics Opt Out Link.
  • Facebook Pixels allow user behavior to be tracked after they have been redirected to our website by clicking on a Facebook ad.  This enables us to measure the effectiveness of Facebook ads for statistical and market research purposes.  Facebook may link his information in your Facebook account and use it for its own promotional purposes.  
  • Mixpanel analyzes customer-driven event data and creates funnel reports so we can better understand how our users interact with the Services. 
  • Segment collects user events from the Services and provides a data toolkit to allow us to use the data more efficiently.

Your Rights and Responsibilities

You are permitted, and hereby agree, to only provide personal information to NABR if such personal information is accurate, reliable, and relevant to our relationship and only to the extent such disclosure will not violate any applicable data protection law, statute, or regulation.

You may have certain rights under applicable data protection law with respect to personal information about you that is collected through the Sites or when you contact or otherwise engage with us. To exercise any of these data privacy rights, please contact us, or have your authorized agent contact us, in accordance with the “Contact Us” section listed below. In the event you submit, or your authorized agent submits on your behalf, a data request, you (and your authorized agent) hereby acknowledge and agree, under penalty of perjury, that you are (or the authorized agent of) the consumer whose personal information is the subject of the request. We will respond to any data requests within the timeframes required by law, and we may charge a fee to facilitate your request where permitted by law.

Marketing. You have the right to opt-out of receiving electronic direct marketing communications from us.  All electronic direct marketing communications that you may receive from us, such as e-mail messages, will give you an option of not receiving such communications from us in the future.

California Privacy Rights.  California Civil Code Section § 1798.83 permits users of the Sites that are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. Pursuant to the California Consumer Privacy Act of 2018, as amended (“CCPA”), California residents may have certain data privacy rights, such as the right to be notified about what personal information categories are collected about you, and our intended use and purpose for collecting your personal information. You may have the right to request access to your personal information and, to the extent feasible, request that it be transmitted in certain forms and formats.  You may have the right to request that we (and any applicable service provider) delete your personal information. You have the right not to be subject to discrimination for asserting your rights under the CCPA.  If you make, or an authorized agent on your behalf makes, any request related to your personal information, NABR will ascertain your identity to the degree of certainty required under the CCPA before addressing your request.  NABR may require you to match at least three pieces of personal information we have previously collected from you before granting you access or otherwise responding to your request. 

Do Not Track. Some web browsers may transmit “do-not-track” signals to the Sites with which the user communicates. Because of differences in how web browsers incorporate and activate this feature, it is not always clear whether users intend for these signals to be transmitted, or whether they even are aware of them. We currently do not take action in response to these signals.

European Union (EU) Privacy Disclaimer

NABR processes personal information in accordance with the legal bases set forth in the EU General Data Protection Regulation (GDPR) or EU Member State law. For example, our processing of Personal Data on individuals (as described above) is justified based on statutory provisions that (1) processing is based on the consent; (2) processing is necessary for NABR’s   legitimate interests as set out herein; and (3) processing is necessary for the performance of a contract to which you are a party. If you are in the EU or afforded protection under the GDPR, you may have certain rights with respect to the Personal Data. To the extent permitted by applicable data protection laws, you may access the Personal Data we hold about you; request that inaccurate, outdated, or no longer necessary information be corrected, erased, or restricted; and, request that we provide your Personal Data in a format that allows you to transfer it to another service provider. You also may withdraw your consent at any time where we are relying on your consent for the processing of your Personal Data. You may object to our processing of your Personal Data where that processing is based on our legitimate interest. You have the right to lodge a complaint with your competent data protection authority. If you wish to exercise any of these rights, please contact us in accordance with the instructions provided below.

Nevada Privacy Disclaimer

Pursuant to Nevada law, a Nevada “consumer” (as the term is defined therein), may, at any time, submit a verified request through a designated request address to an “operator” directing the operator not to make any sale of his or her personal information that the operator has collected or will collect about the consumer. For clarity purposes, NABR does not sell or exchange your personal information for monetary consideration to a third party for the third party to license or sell the information to additional persons or parties.

Links to Third-Party Websites

The Services may contain links to other sites that are not operated by us. If you click on a third-party link, you will be directed to that third party’s site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over, and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

Changes to This Privacy Policy

We may occasionally update this Privacy Policy. When we do, we will revise the “last updated” date at the top of the Privacy Policy and take such additional steps as may be required by law.  We recommend that you periodically review our Privacy policy for updates.

Contact Us

If you have questions regarding this Privacy Policy, our handling of your personal information, or would like to request more information or exercise a data right, please contact us using the webpage at ____________________ or by telephone at (___) ___________.