Effective date: October 1, 2018
What Information does Phosphorus Collect?
Information You Provide to Us:
We receive and store any information you knowingly provide to us. For example, through the registration process and/or through your account settings, we may collect Personal Information such as your name, email address, and phone number. We may also collect Protected Health Information (PHI) subject to the HIPAA Privacy Notice. Certain information may be required to register with us or to take advantage of some of our features.
We may communicate with you if you’ve provided us the means to do so. For example, if you’ve given us your email address, we may send you promotional email offers on behalf of other businesses, or email you about your use of the Services. Also, we may receive a confirmation when you open an email from us. This confirmation helps us make our communications with you more interesting and improve our services. If you do not want to receive communications from us, please indicate your preference by emailing firstname.lastname@example.org or calling 855-746-7423.
Cookies and Other Information Collected Automatically
Whenever you interact with our Services, we automatically receive and record information on our server logs from your browser or device, which may include your IP address, geolocation data, device identification, “cookie” information, the type of browser and/or device you’re using to access our Services, and the page or feature you requested. “Cookies” are identifiers we transfer to your browser or device that allow us to recognize your browser or device and tell us how and when pages and features in our Services are visited and by how many people. Cookies can be recognized by the website that downloaded them — or other websites that use the same cookies. This helps websites know if the browsing device has visited them before. You may be able to change the preferences on your browser or device to prevent or limit your device’s acceptance of cookies, but this may prevent you from taking advantage of some of our features. There are different types of cookies:
Session cookies - A session cookie is stored in temporary memory and is not retained after your browser is closed. Session cookies do not collect information from the user’s computer. Session cookies will only stay on your device until you stop browsing.
Persistent cookies - A persistent cookie is stored on a user’s hard drive until it expires (persistent cookies are set with expiration dates) or until the user deletes the cookie. Persistent cookies stay on your browsing device until they expire or are deleted (i.e. after you have finished browsing).
In addition to cookies, Phosphorus may use other similar technologies, like web beacons, flash cookies, or pixels to track how you use our Services.
Web Beacons: We may deliver a file to you through the Services (known as a “web beacon”) from an ad network. Web beacons, or “clear gifs,” are tiny graphics with a unique identifier, similar in function to cookies. In contrast to cookies, which are stored on a user’s computer hard drive or device, clear gifs are embedded invisibly on web pages. We use beacons for similar reasons as cookies, though beacons primarily help us better manage content on our Services by informing us which content is effective. Web beacons allow ad networks to provide anonymized, aggregated auditing, research and reporting for us and for advertisers. Web beacons also enable ad networks to serve targeted advertisements to you when you visit other websites. Because your web browser must request these advertisements and web beacons from the ad network’s servers, these companies can view, edit, or set their own cookies, just as if you had requested a web page from their site. You may be able to opt-out of web beacon tracking conducted by third parties through our Services by adjusting the Do Not Track settings on your browser; please note that we don’t control whether or how these third parties comply with Do Not Track requests.
Pixels: A “pixel” or “tag” can be placed on a website or within an email for the purposes of tracking your interactions with our websites or when emails are opened or accessed. Pixels are often used in combination with cookies.
Phosphorus uses the following types of cookies:
Security: Some cookies help us detect, prevent, and mitigate malicious and fraudulent activities on our Services. Security cookies also support and enable other security features.
Performance: Some of our cookies are essential to make our Services work. They enable you to move around this site and use its features. Without these cookies, services that are necessary for you to be able to use the site, such as load balancing or remembering items in your shopping basket, can't be provided.
Analytics & Research: We use some cookies to collect information about how people are using our Services. For example, these cookies allow us to know which pages are visited the most often, how people are moving from one link to another and if they get error messages from certain pages. Overall, these cookies provide us with analytical information about how our Services are performing and how we can improve them.
Referrals: These cookies are placed on your device when you use one of our special referral pages to create a link to refer our service to your friends. When you create your referrers account and/or send a referral link by email or social media outlet (including but not limited to Facebook and Twitter), a cookie will be placed on your device to help us track the referrals you have made and credit you with any benefit that is available in accordance with our referral program. If you receive a referral to our service and click on the link sent to you, we will also place a cookie on your device so that we can understand how well our referral program is being responded to and provide you with any benefit that is available to you, through the program when you sign up to our Service.
Advertising: These cookies are used to deliver advertisements that are more relevant to you and your interests. They are also used to limit the number of times you see an advertisement as well as help measure the effectiveness of the advertising campaign. They remember that you have visited a website and this information may be shared with other organizations such as advertisers. This means after you are done using our Service you may see some advertisements about our Services elsewhere on the Internet.
Information Collected From Other Websites and Do Not Track Policy
If you use a different browser, please refer to your browser’s documentation. You can also find out more information about how to change your browser cookie settings at www.allaboutcookies.org.
Google Analytics: http://tools.google.com/dlpage/gaoptout (requires you to install a browser add-on)
We may use cookie data to customize content for you that we think you might like, based on your usage patterns. We may also use it to improve the Services – for example, this data can tell us how often users use a particular feature of the Services, and we can use that knowledge to make the Services interesting to as many users as possible.
Will Phosphorus Share Any of the Personal Information it Receives?
Except as expressly provided below, we do not rent or sell your Personal Information in personally identifiable form to anyone. We may share your Personal Information with third parties as described in this section:
Information that’s been de-identified.
We may de-identify your Personal Information so that you are not identified as an individual, and provide that information to our partners (subject to restrictions on Protected Health Information in our HIPAA Notice). We may also provide aggregate usage information to our partners (or allow partners to collect that information from you), who may use such information to understand how often and in what ways people use our Services, so that they, too, can provide you with an optimal online experience. However, we never disclose aggregate usage or de-identified information to a partner (or allow a partner to collect such information) in a manner that would identify you as an individual person.
We allow advertisers and/or merchant partners (“Advertisers”) to choose the demographic information of users who will see their advertisements and/or promotional offers and you agree that we may provide any of the information we have collected from you in non-personally identifiable form to an Advertiser, in order for that Advertiser to select the appropriate audience for those advertisements and/or offers. For example, we might use the fact you are located in San Francisco to show you ads or offers for San Francisco businesses, but we will not tell such businesses who you are. Or, we might allow Advertisers to display their ads to users with similar usage patterns to yours, but we will not disclose usage information to Advertisers except in aggregate form, and not in a manner that would identify you personally. Note that if an advertiser asks us to show an ad to a certain audience or audience segment and you respond to that ad, the advertiser may conclude that you fit the description of the audience they were trying to reach.
In certain situations, businesses or third party websites we’re affiliated with may sell or provide products or services to you through or in connection with the Services (either alone or jointly with us). You can recognize when an affiliated business is associated with such a transaction or service, and we will share your Personal Information with that affiliated business only to the extent that it is related to such transaction or service. We have no control over the policies and practices of third party websites or businesses as to privacy or anything else, so if you choose to take part in any transaction or service relating to an affiliated website or business, please review all such business’ or websites’ policies.
We employ other companies and people to perform tasks on our behalf and need to share your information with them to provide products or services to you, including health professionals in accordance with our HIPAA Notice. Unless we tell you differently, our agents do not have any right to use the Personal Information we share with them beyond what is necessary to assist us.
User Profiles and Submissions:
Certain user profile information, including your name, location, and any video or image content that such user has uploaded to the Services, may be displayed to other users to facilitate user interaction within the Services or address your request for our services. Your account privacy settings may allow you to limit the other users who can see the Personal Information in your user profile and/or what information in your user profile is visible to others. Please remember that any content you upload to your public user profile, along with any Personal Information or content that you voluntarily disclose online in a manner other users can view (on discussion boards, in messages and chat areas, etc.) becomes publicly available, and can be collected and used by anyone. Your user name may also be displayed to other users if and when you send messages or comments or upload images or videos through the Services and other users can contact you through messages and comments.
We may choose to buy or sell assets, and may share and/or transfer customer information in connection with the evaluation of and entry into such transactions. Also, if we (or our assets) are acquired, or if we go out of business, enter bankruptcy, or go through some other change of control, Personal Information could be one of the assets transferred to or acquired by a third party.
Protection of Phosphorus and Others:
Is Personal Information about me secure?
Your account is protected by a password for your privacy and security. You must prevent unauthorized access to your account and Personal Information by selecting and protecting your password appropriately and limiting access to your computer or device and browser by signing off after you have finished accessing your account.
We endeavor to protect the privacy of your account and other Personal Information we hold in our records, but unfortunately, we cannot guarantee complete security. Unauthorized entry or use, hardware or software failure, and other factors, may compromise the security of user information at any time.
What Personal Information can I access?
Through your account settings, you may access, and, in some cases, edit or delete the following information you’ve provided to us:
Name and password
User profile information, including images and videos you have uploaded to the site
Changes and access to your Protected Health Information is covered in our HIPAA Notice.
The information you can view, update, and delete may change as the Services change. If you have any questions about viewing or updating information we have on file about you, please contact us at email@example.com or 855-746-7423.
Under California Civil Code Sections 1798.83-1798.84, California residents are entitled to contact us to prevent disclosure of Personal Information to third parties for such third parties’ direct marketing purposes; in order to submit such a request, please contact us at firstname.lastname@example.org or 855-746-7423.
If you are a resident of the European Union (“EU”), United Kingdom, Lichtenstein, Norway, or Iceland, you may have additional rights under the EU General Data Protection Regulation (the “GDPR”) with respect to your Personal Data, as outlined below.
For this section, we use the terms “Personal Data” and “processing” as they are defined in the GDPR, but “Personal Data” generally means information that can be used to individually identify a person, and “processing” generally covers actions that can be performed in connection with data such as collection, use, storage and disclosure. Phosphorus will be the controller of your Personal Data processed in connection with the Services.
What Rights Do You Have Regarding Your Personal Data? You have certain rights with respect to your Personal Data, including those set forth below. For more information about these rights, or to submit a request, please email email@example.com or 855-746-7423. Please note that in some circumstances, we may not be able to fully comply with your request, such as if it is frivolous or extremely impractical, if it jeopardizes the rights of others, or if it is not required by law, but in those circumstances, we will still respond to notify you of such a decision. In some cases, we may also need to you to provide us with additional information, which may include Personal Data, if necessary to verify your identity and the nature of your request.
Access: You can request more information about the Personal Data we hold about you and request a copy of such Personal Data. You can also access certain of your Personal Data by going to phosphorus.com and logging into your account. Then select your profile to.
Rectification: If you believe that any Personal Data we are holding about you is incorrect or incomplete, you can request that we correct or supplement such data. You can also correct some of this information directly by logging into your account and editing your profile.
Erasure: You can request that we erase some or all of your Personal Data from our systems.
Withdrawal of Consent: If we are processing your Personal Data based on your consent (as indicated at the time of collection of such data), you have the right to withdraw your consent at any time. Please note, however, that if you exercise this right, you may have to then provide express consent on a case-by-case basis for the use or disclosure of certain of your Personal Data, if such use or disclosure is necessary to enable you to utilize some or all of our Services.
Portability: You can ask for a copy of your Personal Data in a machine-readable format. You can also request that we transmit the data to another controller where technically feasible.
Objection: You can contact us to let us know that you object to the further use or disclosure of your Personal Data for certain purposes, such as for direct marketing purposes.
Restriction of Processing: You can ask us to restrict further processing of your Personal Data.
Right to File Complaint: You have the right to lodge a complaint about Phosphorus’s practices with respect to your Personal Data with the supervisory authority of your country or EU Member State.
What Personal Data Do We Collect From You?
We collect Personal Data about you when you provide such information directly to us, when third parties such as our business partners or service providers provide us with Personal Data about you, or when Personal Data about you is automatically collected in connection with your use of our Services.
Information we collect directly from you: We receive Personal Data directly from you when you provide us with such Personal Data, including without limitation the following:
First and last name
Credit/debit card information
Your purchase history
User content, for example, comments and posts you submit publically (which can include Personal Data if you include Personal Data in such content)
Protected Health Information (as set forth in the HIPAA Privacy Notice)
Information we receive from third party sources: Some third parties such as our business partners and service providers provide us with Personal Data about you, such as the following:
Account information for third party services: If you interact with a third party service when using our Services, such as if you use a third party service to log-in to our Services (e.g., Facebook Connect or Twitter OAuth), or if you share content from our Services through a third party social media service, the third party service will send us information about you, such as information from your public profile, if the third party service and your account settings allow such sharing. The information we receive will depend on the policies and your account settings with the third party service.
Information from our advertising partners: We receive information about you from some of our service providers who assist us with marketing or promotional services related to how you interact with our websites, applications, products, services, advertisements or communications.
Information we automatically collect when you use our Services: Some Personal Data is automatically collected when you use our Services, such as the following:
Web browser information
Page view statistics
Transaction information (e.g. transaction amount, date and time such transaction occurred)
Cookies and other tracking technologies (e.g. web beacons, pixel tags, SDKs, etc.) -- For more information, please review our cookies section above).
Location information (e.g. IP address, zip code)
Log data (e.g. access times, hardware and software information)
How Do We Use Your Personal Data? We process Personal Data to operate, improve, understand and personalize our Services. For example, we use Personal Data to:
Create and manage user profiles
Communicate with you about the Services
Process orders and provide Services
Contact you about Service announcements, updates or offers
Provide support and assistance for the Services
Conduct product research and development
Analyze our Services and activities of users of the Services
Personalize website content and communications based on your preferences
Meet contract or legal obligations
Respond to user inquiries
Fulfill user requests
Comply with our legal or contractual obligations
Protect against or deter fraudulent, illegal or harmful actions
Enforce our Terms of Service
We will only process your Personal Data if we have a lawful basis for doing so. Lawful bases for processing include consent, contractual necessity and our “legitimate interests” or the legitimate interest of others, as further described below.
Contractual Necessity: We process the following categories of Personal Data as a matter of “contractual necessity”, meaning that we need to process the data to perform under our Terms of Service with you, which enables us to provide you with the Services. When we process data due to contractual necessity, failure to provide such Personal Data will result in your inability to use some or all portions of the Services that require such data.
Protected Health Information
Legitimate Interest: We process the following categories of Personal Data when we believe it furthers the legitimate interest of us or third parties.
Operation and improvement of our business, products and services
Marketing of our products and services
Research and development
Provision of customer support
Protection from fraud or security threats
Compliance with legal obligations
Completion of corporate transactions
Examples of these legitimate interests include:
Consent: In some cases, we process Personal Data based on the consent you expressly grant to us at the time we collect such data, including for some Protected Health Information as set forth in the HIPAA Privacy Notice. When we process Personal Data based on your consent, it will be expressly indicated to you at the point and time of collection.
Other Processing Grounds: From time to time we may also need to process Personal Data to comply with a legal obligation, if it is necessary to protect the vital interests of you or other data subjects, or if it is necessary for a task carried out in the public interest.
Payment processors and ecommerce platforms
Fraud prevention service providers
Analytics service providers
Staff augmentation and contract personnel
Hosting service providers
Co-location service providers
Telecommunications service providers
Healthcare and insurance providers
We also share Personal Data when necessary to complete a transaction initiated or authorized by you or provide you with a product or service you have requested. In addition to those set forth above, these parties also include:
Other users (where you post information publicly or as otherwise necessary to effect a transaction initiated or authorized by you through the Services)
Social media services (if you interact with them through your use of the Services)
Third party business partners who you access through the Services
Other parties authorized by you
We also share information with third parties when you have given us consent to do so (as indicated at the point such information is collected).
We also share Personal Data when we believe it is necessary to:
Comply with applicable law or respond to valid legal process, including from law enforcement or other government agencies
Protect us, our business or our users, for example to enforce our terms of service, prevent spam or other unwanted communications and investigate or protect against fraud
Maintain the security of our products and services
Last, we share Personal Data with our affiliates or other members of our corporate family. Furthermore, if we choose to buy or sell assets, user information is typically one of the transferred business assets. Moreover, if we, or substantially all of our assets, were acquired, or if we go out of business or enter bankruptcy, user information would be one of the assets that is transferred or acquired by a third party, and we would share Personal Data with the party that is acquiring our assets. You acknowledge that such transfers may occur, and that any acquirer of us or our assets may continue to use your Personal Information as set forth in this policy.
How Long Do We Retain Your Personal Data? We retain Personal Data about you for seven years or as otherwise necessary to provide you Services. In some cases we retain Personal Data for longer, if doing so is necessary to comply with our legal obligations, resolve disputes or collect fees owed, or is otherwise permitted or required by applicable law, rule or regulation. Afterwards, we retain some information in a depersonalized or aggregated form but not in a way that would identify you personally.
What Security Measures Do We Use? We seek to protect Personal Data using appropriate technical and organizational measures based on the type of Personal Data and applicable processing activity. For example, all personal data is encrypted at rest as well as in transit.
With respect to personal data received or transferred pursuant to the Privacy Shield Frameworks, Phosphorus is subject to the regulatory and enforcement powers of the U.S. Federal Trade Commission.
Pursuant to the Privacy Shield Frameworks, EU and Swiss individuals have the right to obtain our confirmation of whether we maintain personal information relating to you in the United States. Upon request, we will provide you with access to the personal information that we hold about you. You may also correct, amend, or delete the personal information we hold about you. An individual who seeks access, or who seeks to correct, amend, or delete inaccurate data transferred to the United States under Privacy Shield, should direct their query to firstname.lastname@example.org. If requested to remove data, we will respond within a reasonable timeframe.
We will provide an individual opt-out choice, or opt-in for sensitive data, before we share your data with third parties other than our agents, or before we use it for a purpose other than which it was originally collected or subsequently authorized. To request to limit the use and disclosure of your personal information, please submit a written request to email@example.com.
In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
Phosphorus’ accountability for personal data that it receives in the United States under the Privacy Shield and subsequently transfers to a third party is described in the Privacy Shield Principles. In particular, Phosphorus remains responsible and liable under the Privacy Shield Principles if third-party agents that it engages to process the personal data on its behalf do so in a manner inconsistent with the Principles, unless Phosphorus proves that it is not responsible for the event giving rise to the damage.
In compliance with the Privacy Shield Principles, Phosphorus commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to Privacy Shield. European Union and Swiss individuals with Privacy Shield inquiries or complaints should first contact Phosphorus by email at firstname.lastname@example.org or via post at:
Phosphorus Data Protection Officer, 1140 Broadway, Suite 1100, New York, NY 10001, email@example.com
Phosphorus has further committed to refer unresolved privacy complaints under the Privacy Shield Principles to an independent dispute resolution mechanism, the BBB EU PRIVACY SHIELD, operated by the Council of Better Business Bureaus. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit www.bbb.org/EU-privacy-shield/for-eu-consumers for more information and to file a complaint. This service is provided free of charge to you.
If your Privacy Shield complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See Privacy Shield Annex 1 at https://www.privacyshield.gov/article?id=ANNEX-I-introduction
What If You Have Questions Regarding Your Personal Data? If you have any questions about this section or our data practices generally, please contact us using the following information:
Physical Address: 1140 Broadway, Suite 1100, New York, NY 10001
Email Address: firstname.lastname@example.org
Designated Representative and Contact Information: DP-Doc, Phosphorus, Ballindamm 39, 20095 Hamburg, email@example.com
Data Protection Officer and Contact Information: Alexander Bisignano, 1140 Broadway, Suite 1100, New York, NY 10001, firstname.lastname@example.org