Privacy Policy
A Privacy Policy is a statement or a legal document that states how a company or website collects, handles and processes data of its customers and visitors. It explicitly describes whether that information is kept confidential, or is shared with or sold to third parties. A Privacy Policy is a statement or a legal document that states how a company or website collects, handles and processes data of its customers and visitors. It explicitly describes whether that information is kept confidential, or is shared with or sold to third parties.
Effective Date: October 20, 2023
We encourage you to read this document to understand the terms, policies, and more that apply to you when you use our websites, products, or services, including how we process your personal information and how you can update and manage that information.
Istishartak Privacy Policy
Istishartak LLC (“Istishartak”, “Company”, “we”, “us”, or “our”) operates the websites located at istishartak.com, and other websites, products, services, and mobile applications with links to this Privacy Policy, including without limitation the Istishartak webpages and secure applications (`collectively, the “Sites” or “Websites”,unless otherwise specified). Users of the Sites or Services are referred below as “Users”, “Members”, “you”, “your”, or “yours”.
We offer online telehealth services enabling our Members to report their health history and engage independent healthcare professionals (“Healthcare Professionals”) to obtain medical and healthcare services. The Healthcare Professionals who deliver Services through Istishartak are independent professionals or groups of independently owned professional practices (collectively, “Istishartak Professionals”). Please refer to the Istishartak Professionals Notice of Privacy Practices to learn more about these groups and how they’re organized.
Please note that Users in different regions may be subject to different data protection laws, regulations, and standards. As such, this document has a section dedicated to California consumers, as well as a section dedicated to consumers subject to European Union jurisdiction.
Please read this Privacy Policy carefully before using the Sites or Services. By visiting or using any of the Sites or Services, you are accepting the practices described in this Privacy Policy, as well as the Istishartak Terms of Service and other terms, agreements, statements of rights, consent forms, and policies referenced above, as applicable. If you do not agree to this Privacy Policy, or any of the documents referenced above, please do not use the Sites or Services.
When visiting or using any of the Sites or Services, including Istishartak (“Istishartak”), or any other website or mobile application that reference or link to this Privacy Policy, your information will be processed by Istishartak for the purposes stated below, and in accordance with the Istishartak Notice of Privacy Practices, where applicable and legally permissible.
What is the purpose of this Privacy Policy?
This Privacy Policy discloses Istishartak’s personal information gathering and
dissemination practices with respect to the Sites, as well as any other websites, mobile
applications, or other products and services provided by us that link to this Privacy
Policy. When we use the term “personal information” in this Privacy Policy, we mean
information that on its own, or in combination with other information, could reasonably
identify you.
We have also created this Privacy Policy to demonstrate our commitment to privacy.
We recognize that when you provide us with information about yourself that you trust
us to act in a responsible manner with that information. We are committed to making
sure we earn that trust.
The personal information we receive or obtain through your use of the Services may be
subject to different state and federal privacy laws, including the Health Insurance
Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”).
Descriptions in this Privacy Policy regarding our collection, use and disclosure of
personal information may be subject to or further restricted by the requirements of
these laws. In addition, where Istishartak collects, creates, maintains, uses and
discloses Protected Health Information (“PHI”), which is personally identifiable health
information protected by HIPAA, we may be and likely are subject to certain
agreements, including with health plans and health care providers. In those cases, our
collection, creation, maintenance, use and disclosure of PHI will be in accordance with
such agreements and your health plan’s (“Plan”) Notice of Privacy Practices, where
applicable. As such, references below to HIPAA, PHI, and related are provided for
informational purposes. For official notices concerning, or for more information or
questions about, the use and disclosure of your PHI, please refer to your Plan’s Notice
of Privacy Practices, as applicable.
What information do we collect from users and how is it used?
The following describes the types of personal and other information Istishartak may collect about you, and how we may use and maintain that information, including, but not limited to:
To whom does Istishartak disclose information about you that we collect?
Istishartak will not share, rent, sell or otherwise disclose any of the personally identifiable information that we collect about you, except when we have your permission or in any of the following situations:
Your Rights Under HIPAA Regarding Protected Health Information
This section excludes Services performed by or associated with the Istishartak
Professionals. For more information, please see the Istishartak Notice of Privacy
Practices.
You have certain rights regarding your protected health information under HIPAA that
may be available to you. For official notice concerning these rights, you should refer to
your Plan’s Notice of Privacy Practices.
What security measures do the Sites employ?
To help protect the privacy of data you transmit through the Sites, where personally identifiable information is requested, Istishartak also uses technology designed to encrypt the information that you input before it is sent to us using Secure Sockets Layer (SSL) technology or similar encryption technology. In addition, we take steps to protect the user data we collect against unauthorized access. However, you should keep in mind that the Sites and our services are run on software, hardware and networks, any component of which may, from time to time, require maintenance or experience problems or breaches of security beyond our control. Please also be aware that despite our best intentions and the guidelines outlined in this Privacy Policy, no data transmission over the Internet or encryption method can be guaranteed to be 100% secure.
How can you correct or update information that we collect about you?
You may correct or update information collected about you by managing your account profile, contacting us via the contact information below, or submitting a privacy request as laid out below under “How to exercise your privacy rights”. We will respond in accordance with our agreements and legal requirements. If necessary, we may retain original and updated information for reasons such as technical constraints, dispute resolution, troubleshooting and agreement enforcement.
What are the policies of linked Sites and other third parties?
This Privacy Policy only addresses the use and disclosure of certain information Istishartak collects from or about you. You should be aware that when you are on the Sites, you may be directed to other websites that are beyond our control, and we are not responsible for the privacy practices of third parties or the content of linked websites. We encourage you to read the posted privacy policy whenever interacting with any website.
How will I know about changes in the Privacy Policy?
Istishartak’s Sites are owned and operated by Istishartak. Our Sites are continually under development and changes to the Sites or Services may be made at any time. We reserve the right to revise or remove any part of this Policy in our sole discretion at any time and without prior notice to you, unless where legally required. Thus, you should visit this page periodically for changes. Any changes to this Policy are effective upon posting to the Sites, unless otherwise specified. If you disagree with this Policy, your sole remedy is to discontinue your use of the Sites and Services. Your continued use after a change has been posted constitutes your acceptance of the changes.
What is our policy on children users of our Sites?
Istishartak does not knowingly collect or maintain personally identifiable information
from persons under 18 years old, and no part of our Sites is directed to persons under
18. IF YOU ARE UNDER 18 YEARS OF AGE, PLEASE DO NOT USE OR ACCESS
OUR SITES AT ANY TIME OR IN ANY MANNER, except where allowed in
accordance with our Terms of Service. Where permitted, any personal information
relating to those children will be health information governed by this Privacy Policy or
the applicable Notice of Privacy Practices.
If you are a parent or guardian and discover that your child under the age of 18, or
equivalent minimum age depending on jurisdiction, has obtained an Istishartak
account, then you may alert us using the contact information below under “Contact
Us” and request that we delete that child’s personal information from our systems. If
we learn that we have collected the personal information of a child under 18, or
equivalent minimum age depending on jurisdiction, outside the above circumstances
we will take steps to delete the information as soon as possible, except where
prohibited by applicable law.
What law governs my use of the Sites and Istishartak’s services?
By choosing to visit Istishartak’s Sites, use our Services, or otherwise provide information to us, you agree that any dispute over privacy or the terms contained in this Privacy Policy will be governed by the law of the State of Delaware. You also agree to abide by any limitation on damages contained in our Terms of Service or other agreement that we have with you.
Additional Information About This Privacy Statement
Our Sites are owned and operated by Istishartak. The terms indicated in this Privacy Policy will remain effective, even if the Member’s coverage is terminated, to the extent we retain information about a Member.
Information about Particular Services
Please note that the descriptions below concerning particular services may not apply to all services, sites, or mobile applications provided by Istishartak.
The services contained in this section enable us to monitor and analyze web traffic and can be used to keep track of User behavior. Google Analytics (Google Inc.) Google Analytics is a web analysis service provided by Google Inc. (“Google”). Google utilizes the Data collected to track and examine the use of this Application, to prepare reports on its activities and share them with other Google services. Google may use the Data collected to contextualize and personalize the ads of its own advertising network. Personal Data collected: Cookies and Usage data. Place of processing: US – Google Privacy Policy – Google Opt Out
This Website uses an internal analytics system that does not involve third parties. Personal Data collected: Cookies and Usage Data. Google Tag Manager (Google Inc.) Google Tag Manager is an analytics service provided by Google Inc. Personal Data collected: Cookies and Usage data. Place of processing: US – Google Tag Manager Privacy Policy
This type of service allows this Website to monitor the use and behavior of its components so its performance, operation, maintenance and troubleshooting can be improved. Which Personal Data are processed depends on the characteristics and mode of implementation of these services, whose function is to filter the activities of this Website
Managing contacts and sending messages
This type of service makes it possible to manage a database of email contacts, phone contacts or any other contact information to communicate with the User. These services may also collect data concerning the date and time when the message was viewed by the User, as well as when the User interacted with it, such as by clicking on links included in the message.
Interaction with external social networks and platforms
This type of service allows interaction with social networks or other external platforms directly from the pages of this Application. The interaction and information obtained through this Application are always subject to the User’s privacy settings for each social network. This type of service might still collect traffic data for the pages where the service is installed, even when Users do not use it.
User database management
This type of services allows Istishartak to build user profiles by starting from an email address, a personal name, or other information that the User provides to this Application, as well as to track User activities through analytics features. This Personal Data may also be matched with publicly available information about the User (such as social networks’ profiles) and used to build private profiles that Istishartak can display and use for improving this Application. Some of these services may also enable the sending of timed messages to the User, such as emails based on specific actions performed on this Application. Personal Data collected: email address and various types of Data as specified in the privacy policy of the service. Place of processing: US
Heat mapping and session recording
Heat Mapping services are used to display the areas of a page where Users most frequently move the mouse or click. This shows where the points of interest are. These services make it possible to monitor and analyze web traffic and keep track of User behavior. Some of these services may record sessions and make them available for later visual playback
Contacting the User
Contact form (this Website)
By filling in any contact form with their Data, the User authorizes this Website to use these details to reply to requests for information, quotes or any other kind of request as indicated by the form’s header. Personal Data collected: various types of Data.
System logs and maintenance
For operation and maintenance purposes, this Website and any third-party services may collect files that record interaction with this Website (System logs) use other Personal Data (such as the IP Address) for this purpose. Logging data may be collected in order to assist with troubleshooting crashes and other issues.
Web Beacons
A web beacon (also referred to as clear gif, pixel tag or single-pixel gif) is a transparent graphic image used in tandem with cookies that enables us to record a user’s actions. Istishartak uses web beacons to count users who have visited certain pages, verify system and server integrity and for similar statistical measures. Istishartak may also use pixel tags in HTML-based emails sent to its users to track which emails are opened by recipients.
Data Retention
Istishartak retains personal information, subject to this Policy, only for as long as necessary for the purposes for which the data was collected and processed. Data collected for the provision of Services is retained for the longer of as needed to provide Services; as specified in a relevant agreement (e.g., with your Plan); or as otherwise required, including by applicable law or regulation.
Additional Information for EU / EEC Users
The disclosures in this section are only applicable to individuals in the European Economic Area, Switzerland, and the United Kingdom. This part of the document integrates with and supplements the information contained in the rest of the Privacy Policy
Data Is required to provide services
Unless otherwise specified, all Personal Data (as defined under the GDPR) requested is mandatory and your choice to not provide such Personal Data may make it impossible to provide services to you. In cases where we have made clear that some Personal Data is not mandatory, you are free not to communicate this Personal Data without any consequences on the availability or the functioning of the service. If you are uncertain about which Personal Data is mandatory then you are welcome to contact Istishartak at the contact details below under “Contact Us”.
Additional information about your Personal Data
In addition to the information contained in this privacy policy, upon your request we may provide you with additional and contextual information concerning particular services or the collection and processing of Personal Data
Your GDPR rights
Solely to the extent applicable to us, if you are subject to the GDPR, you may have certain rights and protections about the collection, sharing, and use of your Personal Data including as follows:
Requests should be sent to the Data Controller via the contact details below under “Contact Us”
Additional information regarding methods of processing
We take security measures to prevent unauthorized access, disclosure, modification, or unauthorized destruction of the Personal Data. The Personal Data processing is carried out using computers and/or IT enabled tools, following organizational procedures and modes strictly related to the purposes indicated. In addition to us, in some cases, the Personal Data may be accessible to certain types of persons in charge, involved with the operation of this Website (administration, sales, marketing, legal, system administration) or external parties (such as third-party technical service providers, mail carriers, hosting providers, IT companies, communications agencies) appointed, if necessary, as Data Processors by us. If applicable, this list may be requested and by a GDPR-covered Person from us at any time.
Legal basis for processing
We may process Personal Data relating to Users if one of the following applies:
In any case, we will gladly help to clarify the specific legal basis that applies to the processing, and in particular whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract.
Place of processing
Personal Data is processed at our operating offices, in data centers located in the United States and in any other places where the parties involved in the processing are located. The United States has different (and sometimes lesser) privacy protections than other jurisdictions. By providing Personal Data, using this website, using mobile applications provided by us, or requesting services, you consent to the transfer of your Personal Data to the United States and the processing of such Personal Data in the United States.
Retention time
Personal Data shall be processed and stored as noted above under Data Retention. Where Personal Data is processed subject to the General Data Protection Regulation, such Personal Data collected for the purposes of our legitimate interests shall be retained as long as needed to fulfill such purposes, including but not limited to retention of records of completed services as required by law, regulation and healthcare practice and for the other reasons described in this policy. Users may find specific information regarding the legitimate interests pursued by us within the relevant sections of this document or by contacting us at the contact details below under “Contact Us”. Furthermore, we may be obliged to retain Personal Data for a longer period whenever required to do so for the performance of a legal obligation (including but not limited to retention of records of healthcare services performed or recommended) or upon order of an authority.
Purposes of processing
Personal Data about you is collected to allow us to provide services to you, as well as
for the following purposes: Analytics, Remarketing and behavioral targeting, Interaction
with external social networks and platforms, Managing contacts and sending
messages, User database management, Heat mapping session recording, Content
commenting, Displaying content from external platforms, Content performance and
features testing (A/B testing), Generation models of medical and clinical conditions,
Generation models of physician and clinical performance, Infrastructure monitoring and
Contacting the User.
Information not contained in this policy
More details concerning the collection or processing of Personal Data may be
requested from the Data Controller at any time. Please see the contact information
below under “Contact Us”.
Data Protection Officer
The Data Protection Officer shall be the HIPAA Privacy Officer.
Legal Basis
This privacy statement has been prepared based on provisions of multiple legislations,
including Art. 13/14 of Regulation (EU) 2016/679 (General Data Protection Regulation
or “GDPR”).
Additional Information for California Consumers
This part of the document integrates with and supplements the information contained
in the rest of the Privacy Policy, and applies to any personal information processed by
Istishartak of Users who are consumers, residing in the state of California, United
States of America, and subject to The California Consumer Privacy Act of 2018. For
such consumers, these provisions supersede any other possibly divergent or
conflicting provisions contained in the Privacy Policy.
This section of the Policy uses the term “personal information“ as it is defined in
CCPA.
Categories of personal information collected, disclosed or sold
Please refer to the list above under “What information do we collect from users and
how is it used?”
How we use the information we collect: sharing and disclosing of your personal
information with third parties for a business purpose
We may disclose the personal information we collect about you to a third party for
business purposes. In this case, we enter a written agreement with such third party
that requires the recipient to both keep the personal information confidential and not
use it for any purpose(s) other than those necessary for the performance of the
agreement.
We may also disclose your personal information to third parties when you explicitly ask
or authorize us to do so, in order to provide you with our Service.
To find out more about the purposes of processing, please refer to the relevant section
of this document.
Your right to opt out of the sale of personal information
We do not sell Member information, including lists of Members or any personal
information of Members otherwise.
To the extent our website uses third party cookies and these cookies collect personal
information, such collection may in some cases be considered a “sale” of personal
information for purposes of the CCPA.
You have the right to opt out of the sale of your personal information. This means that
whenever you request us to stop selling your data, we will abide by your request.
You can opt out of such sales. Such requests can be made freely, at any time, without
submitting any verifiable request by following the below instructions.
Instructions to opt out of the sale of personal information
On our Sites are cookie banners with a button labeled “Do not sell my data.” This
button was added in order to comply with the CCPA, and it offers information about
our use of these third-party cookies, and provides consumers an opportunity to optout of certain of these cookies.
Should you wish to opt-out of these cookies, please click on the “Do not sell my data”
button on the banner that pops up. This will result in the placement of an opt-out
cookie on your device browser.
If you’d like to know more, you can contact us at the contact details below under
“Contact Us”.
What are the purposes for which we use your personal information?
We may use your personal information to allow us to render services to you, the
operational functioning of the Sites and features thereof (all together, “business
purposes”).
We may also use your personal information for other reasons such as for commercial
purposes as well as for complying with the law and defending our rights before the
competent authorities where our rights and interests are threatened or we suffer an
actual damage.
Your California privacy rights
The right to know and to portability
You have the right to request that we disclose to you:
If we deliver our response electronically, the information enclosed will be “portable”, i.e. delivered in an easily usable format to enable you to transmit the information to another entity without hindrance – provided that this is technically feasible.
The right to request the deletion of your personal information
You have the right to request that we delete any of your personal information, subject
to exceptions set forth by the law (such as, including but not limited to, where the
information is used to identify and repair errors on this Website, to detect security
incidents and protect against fraudulent or illegal activities, to exercise certain rights
etc.). For example, we cannot delete information that explains medical treatment
decisions, as we are legally obligated to keep such information.
If no legal exception applies, as a result of exercising your right, we will delete your
personal information and direct any of our service providers to do so.
How to exercise your privacy rights
How to make a request
At Istishartak, member and consumer privacy are very important to us. As a result,
before we process any requests we first must verify your identity and ensure we have
enough information. To exercise rights described throughout the Privacy Policy, you
must submit to us a “verifiable request by:
With that in mind, at this time:
You can submit a maximum number of 2 requests over a period of 12 months. If you choose to exercise your privacy rights, you will not receive discriminatory treatment or a lesser degree of service from us.
How and when we are expected to handle your request
Unless otherwise specified in this Policy, the following applies for timing and
expectations around how and when we will respond to your requests. If our response
to a privacy request is restricted by an agreement between us and your Employer, we
will process your requests in accordance with that agreement and related
authorization. Otherwise, the following applies.
To the best of our ability, we will confirm receipt of your verifiable request within 10
days and provide information about how we will process your request.
For CCPA-related requests, we will respond to your request within 45 days of its
receipt, and for all other requests within 30 days of receipt. Should we need more time,
we will explain to you the reasons why, and how much more time we need. In this
regard, please note that we may take up to 90 days to fulfill your request.
Our CCPA disclosures will cover the preceding 12 month period.
Should we deny your request, we will explain to you the reasons behind our denial.
We do not charge a fee to process or respond to your verifiable request unless such
request is manifestly unfounded or excessive. In such cases, we may charge a
reasonable fee, or refuse to act on the request. In either case, we will communicate our
choices and explain the reasons behind it.
Contact Us
If you have questions, want to submit a request, have concerns about this Policy or
Istishartak’s Privacy Practices, or would like to report a violation, see the below contact
options:
You may contact us by mail at:
Istishartak LLC
c/o Privacy Officer
16192 Coastal Highway
Lewes, Delaware 19958
USA
You may email us at privacy@istishartak.com
If you are registered, you may submit a message through the once logged-in.
Or you may call our general support line at (401) 263-1839