Enterprise eligibility information may be collected
If you use an enterprise-provided benefit, you may give Function employer or customer names, eligibility details and identification numbers; enterprise customers may also provide contact and eligibility data. Information received from and processed on behalf of those customers is excluded from this policy and may be governed by their agreements.
Supporting quotations
Service-eligibility data, if you are accessing the Service as part of an enterprise customer-provided offering or benefit, you may provide us with relevant information such as your employer or other enterprise customer name, eligibility data, and relevant enterprise customer identification number.
Our enterprise customers, such as employers, gyms and other entities that may provide us with some of your personal information such as your Contact data and Service-eligibility data.
This Privacy Policy does not apply to personal information that we receive from and process on behalf of our enterprise customers while providing Function services to them. For example, to the extent that we receive your personal information from your employer related to your eligibility for our Service, our use of that personal information may be governed by our agreements (including, as applicable, a business associate agreement) with the relevant enterprise customer. If you have questions regarding your personal information that we process on behalf of an enterprise customer, please direct your questions to the relevant enterprise customer.
Data Access & Collection · Company practice
Health and genetic information may be collected or generated
Depending on your use, Function may collect physical or mental health history, diagnoses, treatments, medications, images, biomarkers, samples, results and clinical notes. Sources include self-reported forms, uploaded records and linked devices. Certain available lab tests may also produce inherited-characteristic data; the policy does not say every test generates genetic data.
Supporting quotations
Health-related data, such as mental or physical history, conditions and diagnoses, treatments, medications, medical images, biomarkers, lab samples, lab results, clinical notes, and other physical or mental health information. This may include personal information that you provide directly to us when you complete electronic forms designed for you to self-report your physical or mental health status, upload medical records, or link a wearable or Internet of Things device to our Services.
Genetic data, certain of the lab tests available through the Service may produce data that relates to inherited characteristics.
Data Access & Collection · Company practice
Recordings, transactions, communications and relationships
Function may collect audio or video recordings, order and transaction histories, purchase considerations and tendencies, communications through channels such as email or chat, and your relationship to people whose information you provide. These are possible categories depending on your interaction, not a claim that every user supplies all of them.
Supporting quotations
Audiovisual recording data, such as video and audio recordings of you.
Transactional data, such as information relating to or needed to complete your orders on or through the Service, including order numbers and transaction history. This includes purchase considerations, consumption history and purchase tendencies.
Communications data based on our exchanges with you, including when you contact us through the Service, communicate with us via email, phone, chat features, social media, or otherwise.
Relationship data, such as familial or other relationship to third parties whose personal information you may provide to us.
Data Access & Collection · Company practice
Payment details and identification documents
Transaction data may include card or bank information. A third-party vendor directly collects and processes payment-card information. Function may also collect government-issued identifiers, such as driver's-license numbers, and an image of the relevant ID.
Supporting quotations
Payment data needed to complete transactions, including payment card information or bank account number. We use a third-party vendor to directly collect and process your payment card information, as described further below.
Government-issued identification number data, such as a state or local identification number (e.g., driver’s license or state ID number) and an image of the relevant identification card.
Data Access & Collection · Company practice
Marketing engagement, content and metadata
Function may collect marketing preferences and engagement, and content you generate or share such as photos, reviews and messages. Associated metadata may reveal how, when, where or by whom content was collected or edited, including added location information or keywords.
Supporting quotations
Marketing data, such as your preferences for receiving our marketing communications and details about your engagement with them.
User-generated content data, such as photos, images, music, videos, comments, reviews, questions, messages, and other content or information that you generate, transmit, or otherwise make available on the Service, as well as associated metadata. Metadata includes information on how, when, where and by whom a piece of content was collected and how that content has been formatted or edited. Metadata also includes information that users can add or can have added to their content, such as keywords, geographical or location information, and other similar data.
Inference & Profiling · Company practice
Function may infer information about you
The collection list includes derived data: inferences Function derives or otherwise infers from your personal information. This statement does not specify the particular inference models or outputs.
Supporting quotations
Derived data, such as inferences about you that we derive or otherwise infer from your personal information.
Data Access & Collection · Company practice
The category list is not exhaustive
Function may collect other data not specifically listed, using it as described in this policy or as otherwise disclosed when it is collected.
Supporting quotations
Other data not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.
Linking & Identification · Company practice
Information can be combined with outside sources
Function may combine information from you with the listed kinds of personal information from public records or social media, private data providers, lab or provider partners, corporate affiliates, marketing partners, service providers and third parties you designate, including labs without a Function contract.
Supporting quotations
Third-party sources. We may combine personal information we receive from you with personal information of the kinds identified above that we obtain from other sources, such as:
Public sources, such as government agencies, public records, social media platforms, and other publicly available sources.
Private sources, such as data providers and social media platforms.
Lab and provider partners, including third party healthcare services providers, laboratory services providers, and other providers of medical and medical-adjacent services.
Our corporate affiliates, including certain members of the Function Health group of companies.
Marketing partners, such as joint marketing partners.
Service providers that provide services on our behalf or help us operate the Service or our business.
Third parties that you designate, such as lab providers with whom we do not have a contractual relationship.
Linking & Identification · Company practice
Linked accounts and devices can exchange information
When you log in through or link an outside service or wearable, Function may receive account information made available under that service's settings, including device health-app history. Function may also share your information with the linked service; that party's use is governed by its own policy, terms and account settings. Those outside policies are not supplied here.
Supporting quotations
Linked third-party services, such as Google or other third-party service that you use to log into, or otherwise link to, your Service account. This data may include your username, profile picture and other information associated with your account on that third-party service that is made available to us based on your account settings on that service.
Linked third-party devices, such as wearable or Internet of Things devices that you link to your Service account. This data may include your username, profile picture and other information associated with your account on that third-party service that is made available to us based on your account settings on that service. This may include your device’s health app information historical data related to your use of the wearable device.
Linked third-party services or devices. If you log into the Service with a third-party service such as Google, or choose to link a wearable or Internet of Things device to your Service account, we may share your personal information with that third-party service. The third party’s use of the shared information will be governed by its privacy policy or other relevant terms and the settings associated with your account with the third-party service.
Data Access & Collection · Company practice
Business transactions can bring in personal information
Function may receive personal information in actual or prospective mergers, acquisitions, asset sales or similar transactions, including from a successor, assignee or another transaction party, and in insolvency, bankruptcy or receivership.
Supporting quotations
Business transaction partners. We may receive personal information in connection with an actual or prospective business transaction. For example, we may receive your personal information from an entity we acquire or are acquired by, a successor, or assignee or any party involved in a business transaction such as a merger, acquisition, sale of assets, or similar transaction, and/or in the context of an insolvency, bankruptcy, or receivership.
Data Access & Collection · Company practice
Devices and interactions may be logged automatically
Function, its service providers and business partners may log information about devices and interactions over time with its service, communications and other online services. Examples include device specifications, identifiers including advertising IDs, IP address, language, carrier or network information and general location.
Supporting quotations
Automatic data collection. We, our service providers, and our business partners may automatically log information about you, your computer or mobile device, and your interaction over time with the Service, our communications and other online services, such as:
Device data, such as your computer or mobile device’s operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type (e.g., phone, tablet), IP address, unique identifiers (including identifiers used for advertising purposes), language settings, mobile device carrier, radio/network information (e.g., Wi-Fi, LTE, 3G), and general location information such as city, state or geographic area.
The policy lists precise geolocation when you authorize the mobile app to access your device's location. You can disable Function's precise-location access in your device settings.
Supporting quotations
Precise geolocation data when you authorize our mobile application to access your device’s location.
Mobile location data. You can disable our access to your device’s precise geolocation in your mobile device settings.
Data Access & Collection · Company practice
Browsing and message activity may be tracked
Automatic collection may record viewed pages, searches, navigation, time spent, referring sites and access times, plus opened emails or clicked links. Invisible email pixels may detect opens or forwarding; communications tracking is not limited to messages you send to Function.
Supporting quotations
Online activity data, such as pages or screens you viewed, search history, how long you spent on a page or screen, the website you visited before browsing to the Service, navigation paths between pages or screens, information about your activity on a page or screen, access times and duration of access, and whether you have opened our emails or clicked links within them.
Communication interaction data such as your interactions with our email, text or other communications (e.g., whether you open and/or forward emails) – we may do this through use of pixel tags (which are also known as clear GIFs), which may be embedded invisibly in our emails enabling us to detect if you have opened or forwarded a message.
Data Access & Collection · Company practice
Cookies, local storage and pixels support tracking
Function describes session and longer-lived cookies placed by itself and third parties, used to record browsing and remember preferences, submissions and login state. Local storage provides similar functionality with more storage. Pixels can show when pages, emails or content were opened, viewed or clicked.
Supporting quotations
Cookies and similar technologies. Some of the automatic collection described above is facilitated by the following technologies:
Cookies, which are small text files that websites store on user devices and that allow web servers to record users’ web browsing activities and remember their submissions, preferences, and login status as they navigate a site. Cookies used on our sites include both “session cookies” that are deleted when a session ends, “persistent cookies” that remain longer, “first party” cookies that we place and “third party” cookies that our third-party business partners and service providers place.
Local storage technologies, like HTML5, that provide cookie-equivalent functionality but can store larger amounts of data on your device outside of your browser in connection with specific applications.
Web beacons, also known as pixel tags or clear GIFs, which are used to demonstrate that a webpage or email was accessed or opened, or that certain content was viewed or clicked.
Sharing & Disclosure · Company practice
Chat providers may access chat and browsing data
Chat tools such as Intercom and Decagon operate the service's chat features. These and other third parties may access and use visited webpages, IP address, general location and information shared in chats for purposes described in this policy.
Supporting quotations
Chat technologies, such as those provided by Intercom and Decagon that employ software code to operate the chat features that you can use to communicate with us through the Service. Intercom, Decagon and other third parties may access and use information about webpages visited on our website, your IP address, your general geographic information (e.g., city, state), and other personal information you share through online chats for the purposes described in this Privacy Policy.
Use & Processing · Company practice
Information supports operation, accounts and customer support
Function may use personal information to provide, operate and improve its service and business, process orders and transactions, maintain profiles and respond to requests, questions or feedback. It also reserves purposes otherwise described at collection.
Supporting quotations
We may use your personal information for the following purposes or as otherwise described at the time of collection:
Service delivery and operations. We may use your personal information to:
provide, operate and improve the Service and our business;
process your requests, orders and transactions;
establish and maintain your user profile on the Service;
provide support for the Service, and respond to your requests, questions and feedback.
Use & Processing · Company practice
Information is used to personalize your experience
Function may use personal information to understand needs and interests and personalize the service and communications, including remembering devices, selections and navigation preferences.
Supporting quotations
personalizing the service, including understanding your needs and interests, remembering the devices from which you have previously logged in and remembering your selections and preferences as you navigate the Service;
understand your needs and interests, and personalize your experience with the Service and our communications; and
Security & Safeguards · Company practice
Security and service messages use your information
Function may use personal information for features such as emailed security codes and remembered login devices, and to send service announcements, updates, security alerts and administrative or support messages.
Supporting quotations
enable security features of the Service, such as by sending you security codes via email, and remembering devices from which you have previously logged in;
communicate with you about the Service, including by sending Service-related announcements, updates, security alerts, and support and administrative messages;
Use & Processing · Company practice
Insights, research and product development
Function may use personal information for insights, including research and publishing research-related materials, usage and email-interaction analysis, service or business improvement and new products or services. This passage does not say all these uses are limited to de-identified data or that publishing research means publishing identifiable records.
Supporting quotations
Insights and development. We may use your personal information for:
insights (including research, such as publishing research-related materials);
to analyze your usage of the Service, help us understand user activity on the Service, including which pages are most and least visited and how visitors move around the Service, as well as user interactions with our emails; and
development purposes, including to analyze and improve the Service and our business and to develop new products and services.
Use & Processing · Company practice
Marketing can be personalized and includes an opt-out
Function, its providers and advertising partners may collect and use certain personal information for marketing and advertising. Function may personalize direct marketing for its own or others' products, with an opt-out described later. Interest-based advertising can use partner tracking and user-information sharing, but Function excludes health-related and genetic data from that advertising.
Supporting quotations
Marketing and advertising. We, our service providers and our third-party advertising partners may collect and use certain of your personal information for marketing and advertising purposes:
Direct marketing. We may send you direct marketing communications (including in relation to our products and those of others) and may personalize these messages based on your needs and interests. You may opt-out of our marketing communications as described in the Opt-out of marketing section below.
Interest-based advertising. Our third-party advertising partners may use cookies, pixels and other technologies to collect information about your interaction (including the data described in the automatic data collection section above) with the Service, our communications and other third-party online services over time, and use that information to serve online ads that they think will interest you. This is called interest-based advertising. We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms. We do not use health-related information or genetic data for interest-based advertising.
Sharing & Disclosure · Company practice
Enterprise customers receive limited usage information
Function may tell the enterprise customer that supplied your access whether you redeemed membership and when you booked or completed services or uploaded a scan report. It says it does not provide health-related or genetic data to enterprise customers.
Supporting quotations
Enterprise customers. We may share certain limited personal information with the relevant enterprise customers through which you received access to the Services (e.g., if you redeemed the Function membership, the date you used/obtained the Service (for example, the date(s) you booked and completed the Service aspects such as scans, date of scan report upload)). We do not provide health-related information or genetic data to enterprise customers.
Sharing & Disclosure · Company practice
You can direct sharing with others
Function may share information with third parties when you instruct it or consent, for example your medical provider or that provider's organization.
Supporting quotations
Third parties designated by you. We may share your personal information with other third parties where you have instructed us or provided your consent to do so. For example, we may also share personal information with your medical provider (and/or their affiliated organization).
Sharing & Disclosure · Company practice
Business and marketing partners may receive information
Sharing recipients include parties that jointly offer products or services with Function, or whose products or services may interest you. This category is broader than providers performing services on Function's behalf.
Supporting quotations
Business and marketing partners. Third parties with whom we jointly offer products or services, or whose products or services may be of interest to you.
Linking & Identification · Company practice
Linked services have separate terms and controls
Using third-party login or linking a device may lead Function to share information with that service under the third party's policy, terms and account settings. You may be able to limit information Function receives through those settings, but revoking access does not apply to information already received.
Supporting quotations
Linked third-party services or devices. If you log into the Service with a third-party service such as Google, or choose to link a wearable or Internet of Things device to your Service account, we may share your personal information with that third-party service. The third party’s use of the shared information will be governed by its privacy policy or other relevant terms and the settings associated with your account with the third-party service.
Linked third-party platforms. If you log into the Service with a third-party service such as Google, or choose to link a wearable or Internet of Things device to your Service account, you may be able to use your settings in your account with that platform to limit the information we receive from it. If you revoke our ability to access information from such third-party platform, that choice will not apply to information that we have already received from that third party.
Sharing & Disclosure · Company practice
Advisers, authorities and private parties may receive data
Function may share information with professional advisers where necessary for their services, and with authorities, law enforcement or private parties when it believes in good faith that this is necessary or appropriate for its stated compliance and protection purposes, including legal process, claims and protection against harmful activity.
Supporting quotations
Professional advisors. Professional advisors, such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services that they render to us.
Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the Compliance and protection purposes described above.
Sharing & Disclosure · Company practice
Information can transfer in a business transaction
Actual or prospective investments, financings, offerings, sales, mergers or reorganizations may involve disclosure to counterparties and advisers. An acquirer, successor or assignee may also receive information, including as a transferred business asset in insolvency, bankruptcy or receivership.
Supporting quotations
Business transferees and their advisors. We may disclose personal information in the context of actual or prospective business transactions (e.g., investments in or financings of Function, public stock offerings, or the sale, transfer or merger of all or part of our business, assets or shares, liquidation or reorganization), for example, we may need to share certain personal information with prospective counterparties and their advisers. We may also disclose your personal information to an acquirer, successor, or assignee of Function or a portion of our business assets as part of any merger, acquisition, sale of assets, or similar transaction, and/or in the event of an insolvency, bankruptcy, or receivership in which personal information is transferred to one or more third parties as one of our business assets.
Sharing & Disclosure · Company practice
Public posts can spread beyond your control
Certain content, including health-related data, may become visible to users or the public when you post in public areas or provide an intended-public testimonial. Others may copy, cache, screenshot or store it elsewhere; Function disclaims responsibility for those uses and warns you may be unable to have third-party copies deleted.
Supporting quotations
Other users and the public. Certain user-generated content, including your health-related data and other data you submit to us may be visible to other users and the public, such as when you post comments in publicly accessible parts of the Service or provide a testimonial that is intended to be public. This information can be seen, collected and used by others, including being cached, copied, screen captured or stored elsewhere by others (e.g., search engines), and we are not responsible for any such use of this information. Once you publish content, it may be copied and stored on third-party systems where you might not have the ability to have it deleted.
Cross-references
qualifies (model-proposed): Feedback may become a public testimonial — qualifies: Public testimonials and posts can be copied and retained by others, with limited ability to secure deletion; this qualifies the practical implications of using feedback publicly.
Account & Service Control · User right or choice
Account holders can review and update some information
The general choices section applies to all users, with additional rights for some state residents. Registered users may review and update certain account information through their profile and settings; this is not a promise that all records are editable there.
Supporting quotations
In this section, we describe the rights and choices available to all users. Users who are located in certain U.S. states can find additional information about their rights below.
Access or update your information. If you have registered for an account with us through the Service, you may review and update certain account information by logging into the account and navigating to your account profile and settings.
Account & Service Control · User right or choice
Marketing email and text opt-outs
You can unsubscribe from marketing emails using the email instructions or by contacting Function; effectiveness may take time, and service or other non-marketing emails may continue. You can stop further text messages by replying STOP.
Supporting quotations
Opt-out of communications. You may opt-out of marketing-related emails by following the opt-out or unsubscribe instructions at the bottom of the email, or by contacting us. It may take time for your opt-out to be effective. Please note that if you choose to opt-out of marketing-related emails, you may continue to receive service-related and other non-marketing emails.
If you receive text messages from us, you may opt out of receiving further text messages from us by replying STOP to our message.
Use & Processing · User right or choice
Controls for consented health-based marketing
For marketing you consented to receive based on health-related or genetic data, the policy offers a contact route to control marketing. The saved text masks the email address, so this card cannot supply it. Function says it does not share originator opt-in and related consent data for independent third-party use.
Supporting quotations
For marketing that you have consented to receive based on your health-related data and/or genetic data, you can control how we market to you by contacting us at [[email protected]](https://www.functionhealth.com/cdn-cgi/l/email-protection). Function does not share originator opt-in and related consent data for independent third-party use.
Not stated here
The contact email is rendered as an email-protection placeholder in the stored source; the actual address is not supplied.
Cross-references
contrast (model-proposed): Advertising sharing excludes health and genetic data — contrast: The policy offers controls for consented health/genetic-based marketing while separately excluding these data from interest-based advertising and advertising-partner disclosures. Different marketing contexts are stated, not a blanket permission for targeted ads.
Data Access & Collection · User right or choice
Browser controls can block cookies and email pixels
Most browsers allow removal or rejection of cookies, often accepted by default. Disabling cookies may impair the service. Blocking image loading can prevent web beacons from functioning. The policy links to an outside cookie guide, whose contents are not supplied here.
Supporting quotations
Cookies. Most browsers let you remove or reject cookies. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. Please note that if you set your browser to disable cookies, the Service may not work properly. For more information about cookies, including how to see what cookies have been set on your browser and how to manage and delete them, visit www.allaboutcookies.org. You can also configure your device to prevent images from loading to prevent web beacons from functioning.
Not stated here
The external cookie guide is not supplied; this card cannot provide its additional browser-specific instructions.
Data Access & Collection · User right or choice
Browser and platform tools may limit ad tracking
You may be able to limit interest-based advertising by blocking third-party cookies, using privacy browsers or tracking-blocking plug-ins, or using Google or Facebook's opt-out features. The policy presents these as possible limits, not a guarantee that all tracking or advertising stops.
Supporting quotations
Advertising choices. You may be able to limit use of your information for interest-based advertising through the following settings/options/tools:
Browser settings. Changing your internet web browser settings to block third-party cookies.
Privacy browsers/plug-ins. Using privacy browsers and/or ad-blocking browser plug-ins that let you block tracking technologies.
Platform settings. Google and Facebook offer opt-out features that let you opt-out of use of your information for interest-based advertising. You may be able to exercise that option at the following websites:
Use & Processing · User right or choice
Ad opt-outs may need repeating on each device and browser
The policy points to Google and Facebook settings, Network Advertising Initiative and Digital Advertising Alliance programs, and mobile advertising-ID controls. Apply these settings separately to each browser and device. Industry programs cover participating companies, and Function does not assure that its partners participate. The linked tools' contents are not supplied here.
Supporting quotations
Platform settings. Google and Facebook offer opt-out features that let you opt-out of use of your information for interest-based advertising. You may be able to exercise that option at the following websites:
Digital Advertising Alliance: optout.aboutads.info.
Mobile settings. Using your mobile device settings to limit use of the advertising ID associated with your mobile device for interest-based advertising purposes.
You will need to apply these opt-out settings on each device and browser from which you wish to limit the use of your information for interest-based advertising purposes.
We cannot offer any assurances as to whether the companies we work with participate in the opt-out programs described above.
Not stated here
External platform settings and industry opt-out pages are not supplied; their detailed procedures and coverage cannot be established from this source.
Data Access & Collection · User right or choice
Blocking images can prevent web beacons
Browser or device settings may prevent image loading, which the policy identifies as a way to stop web beacons from functioning. Cookie blocking is a separate control and can make the service work improperly.
Supporting quotations
Blocking images/clear gifs: Most browsers and devices allow you to configure your device to prevent images from loading. To do this, follow the instructions in your particular browser or device settings.
Cookies. Most browsers let you remove or reject cookies. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. Please note that if you set your browser to disable cookies, the Service may not work properly. For more information about cookies, including how to see what cookies have been set on your browser and how to manage and delete them, visit www.allaboutcookies.org. You can also configure your device to prevent images from loading to prevent web beacons from functioning.
Not stated here
The external cookie guide mentioned in the evidence is not supplied; this card does not assess its instructions.
Use & Processing · Company practice
Do Not Track and Global Privacy Control are treated differently
Function says it does not respond to browser Do Not Track signals. Separately, its state-rights notice accepts Global Privacy Control for sale or targeted-advertising opt-outs. GPC applies to the browser or device and associated profile; if logged in, it also applies to the account and associated offline profile. Do Not Track's treatment is not a refusal of all privacy signals.
Supporting quotations
Do Not Track. Some Internet browsers may be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to “Do Not Track” signals. To find out more about “Do Not Track,” please visit http://www.allaboutdnt.com.
Exercising your right to opt-out of/revoke your consent to the “sale” of your personal information or “sharing” of your personal information for targeted advertising purposes. You can submit requests to opt-out of targeted advertising and other sales of personal information by clicking here or by broadcasting the Global Privacy Control signal. For information about how to use the Global Privacy Control, please visit https://globalprivacycontrol.org/. These signals set your opt-out preferences only for the particular browser or device you are using and any consumer profile that we associate with that browser or device unless you are logged into your account, in which case we will honor the signal with respect to that browser or device and your account, including your offline consumer profile associated with that account.
Not stated here
The linked Do Not Track and GPC guides are not supplied; this card describes only Function's stated handling of those signals.
Data Access & Collection · User right or choice
You can disable precise location access
Use mobile-device settings to disable Function's access to precise geolocation. This control concerns precise location, not every kind of location information.
Supporting quotations
Mobile location data. You can disable our access to your device’s precise geolocation in your mobile device settings.
Account & Service Control · Restriction or exception
Declining mandatory information may prevent service
Function says it needs personal information for certain services and may be unable to provide them if you do not supply information it identifies as required or mandatory.
Supporting quotations
Declining to provide information. We need to collect personal information to provide certain services. If you do not provide the information we identify as required or mandatory, we may not be able to provide those services.
Legal Rights & Agreement Rules · User right or choice
Genetic-data and sample rights depend on applicable law
Depending on applicable law, you may have rights to access or delete genetic data or destroy biological samples from which it can be derived. The policy provides a contact route but says rights are not absolute and requests may be denied as permitted by law. The saved email address is masked, so no actual email address can be supplied here.
Supporting quotations
Privacy rights. Depending on the applicable law, you may have certain rights with respect to your personal information (for example, if you reside in a state that provides you with rights in relation to genetic data). These rights may include rights to request access, delete and/or destroy genetic data and biological samples from which genetic data may be derived. To exercise potentially available privacy rights, please contact us at [[email protected]](https://www.functionhealth.com/cdn-cgi/l/email-protection). Not all rights are absolute and we may deny your requests to exercise such rights in accordance with applicable laws.
Not stated here
The stored source masks the contact email as an email-protection placeholder.
Linking & Identification · User right or choice
Revoking a linked platform does not retract earlier data
You may be able to limit information Function receives from a linked login service or device using that platform's account settings. Revoking access does not apply to information Function already received.
Supporting quotations
Linked third-party platforms. If you log into the Service with a third-party service such as Google, or choose to link a wearable or Internet of Things device to your Service account, you may be able to use your settings in your account with that platform to limit the information we receive from it. If you revoke our ability to access information from such third-party platform, that choice will not apply to information that we have already received from that third party.
Cross-references
qualifies (model-proposed): Linked accounts and devices can exchange information — qualifies: Revoking linked-platform access does not apply to information Function already received; the original account/device exchange description must not imply retroactive removal.
Legal Rights & Agreement Rules · Restriction or exception
Outside services follow their own privacy rules
Third-party sites, apps and services are outside this policy, including those Function links to or refers you to. Function says links or integrations are not endorsements or representations of affiliation, disclaims control and responsibility for those services, and encourages reading their policies.
Supporting quotations
This Privacy Policy does not apply to third-party websites, applications, products, services or other properties even if they may link to our Service or we may refer you to such third parties as part of our Service. In addition, our content may be integrated into web pages or other online services that are not associated with us. These links, relationships and other integrations are not an endorsement of, or representation that we are affiliated with, any third party. We do not control websites, mobile applications or services operated by third parties, and we are not responsible for their actions. We encourage you to read the privacy policies of the other websites, mobile applications and services you use.
Security & Safeguards · Company commitment
Safeguards are described without a security guarantee
Function says it employs technical, organizational and physical safeguards designed to protect collected information. It also says internet and information technologies carry inherent risk and it cannot guarantee security.
Supporting quotations
We employ technical, organizational and physical safeguards designed to protect the personal information we collect. However, security risk is inherent in all internet and information technologies and we cannot guarantee the security of your personal information.
Sharing & Disclosure · Company practice
Information may be processed in other countries
Function is headquartered in the United States and may use providers abroad. Information may be transferred to the U.S. or elsewhere with privacy laws that may be less protective than those in your location.
Supporting quotations
We are headquartered in the United States and may use service providers that operate in other countries. Your personal information may be transferred to the United States or other locations where privacy laws may not be as protective as those in your state, province, or country.
Retention & Deletion · Company practice
Retention can continue after your service relationship
Function retains data for collection purposes and legal, accounting, reporting, claims or fraud-prevention needs. It considers sensitivity, risk, purposes, alternative means and legal obligations, and may retain data after account or service use for a legitimate need to address issues. When no longer required, it may delete, anonymize, de-identify or isolate it from processing; deletion is not the sole stated outcome.
Supporting quotations
We generally retain personal information to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes. To determine the appropriate retention period for personal information, we may consider factors such as length of time we have an ongoing relationship with you and provide services to you; the amount, nature, and sensitivity of the personal information; the potential risk of harm from unauthorized use or disclosure of your personal information; the purposes for which we process your personal information and whether we can achieve those purposes through other means; whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them); whether retention is advisable in light of our legal position, such as in regard to applicable statutes of limitations, litigation or regulatory investigations; and applicable legal requirements. For example, we will retain your personal information for as long as you have an account with us or keep using our services, and the length of time thereafter during which we may have a legitimate need to reference your personal information to address issues that may arise.
When we no longer require the personal information we have collected about you, we may either delete it, anonymize it, de-identify it, or isolate it from further processing.
Cross-references
qualifies (model-proposed): Retention depends on purpose and legal needs — qualifies: The detailed retention rule allows legitimate post-account needs and several end-of-need outcomes, including de-identification and isolation rather than deletion alone.
Retention & Deletion · Company practice
Unneeded information need not always be deleted
When Function no longer requires collected personal information, it may delete it, anonymize it, de-identify it or isolate it from further processing. The statement offers several outcomes rather than guaranteeing deletion of every unneeded record.
Supporting quotations
When we no longer require the personal information we have collected about you, we may either delete it, anonymize it, de-identify it, or isolate it from further processing.
Account & Service Control · Restriction or exception
The service is not intended for people under 18
Parents or guardians who believe a minor's information was unlawfully collected, and people whose information was supplied while under 18, are directed to contact Function. If Function learns it collected a child's information without legally required parental or guardian consent, it says it will comply with applicable deletion requirements.
Supporting quotations
The Service is not intended for use by anyone under 18 years of age. If you are a parent or guardian of a minor from whom you believe we have collected personal information in a manner prohibited by law, or if information was provided on your behalf when you were under 18, please contact us. If we learn that we have collected personal information through the Service from a child without the consent of the child’s parent or guardian as required by law, we will comply with applicable legal requirements to delete the information.
Legal Rights & Agreement Rules · Company practice
Policy changes may take effect when posted
Function reserves the right to change the policy at any time. For material changes it will update the date and post the policy or use other appropriate notice. Changes take effect on posting unless otherwise indicated, and later service use indicates acknowledgment that the updated policy applies.
Supporting quotations
The “Last Updated” legend at the top of this Privacy Policy indicates when this Privacy Policy was last updated. We reserve the right to modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy and posting it on the Service or other appropriate means. Any modifications to this Privacy Policy will be effective upon our posting the modified version (or as otherwise indicated at the time of posting). In all cases, your use of the Service after the effective date of any modified Privacy Policy indicates your acknowledging that the modified Privacy Policy applies to your interactions with the Service and our business.
Legal Rights & Agreement Rules · Procedure
Privacy questions and rights requests have a contact route
Function directs questions about its practices and potentially available privacy rights to its listed email contact. The stored page shows an email-protection placeholder, so this analysis cannot reproduce the actual email address.
Supporting quotations
If you have questions about our personal information practices or if you would like to exercise any privacy-related right that may be available to you, please contact us via the method listed below.
The listed contact email is masked in the stored source; its actual address is unavailable here.
Legal Rights & Agreement Rules · Restriction or exception
State privacy rights depend on applicable law and verification
The state notice is part of the full policy and applies, except as otherwise stated, to residents whose state privacy laws apply to Function and grant these rights. Not all rights belong to everyone. Function responds under applicable law, may decline where an exception applies, and may be unable to process access, correction or deletion requests without enough detail to verify identity and respond.
Supporting quotations
U.S. State Privacy Rights Notice at Collection
Except as otherwise provided, this section applies to residents of U.S. states to the extent they have privacy laws applicable to us that grant their residents the rights described below (collectively the “State Privacy Laws”).
This State Privacy Rights Notice at Collection is part of our full Privacy Policy.
This section describes how we collect, retain, use, disclose, sell and share for the purposes of targeted advertising personal information of residents of applicable U.S. states and the rights these users may have with respect to their personal information. Please note that not all rights listed below may be afforded to all individuals and that if your state does not afford you these rights, you may not be able to exercise these rights. In addition, we may not be able to process your access, correction or deletion request if you do not provide us with sufficient detail to allow us to confirm your identity and understand and respond to your request.
Your privacy rights. You may request to exercise the rights listed below. We will respond to your request in accordance with applicable law. We may decline to honor your request where an exception applies.
Legal Rights & Agreement Rules · Context
The state notice defines personal information broadly
For this state-notice section, personal information relates to an identifiable person or can reasonably identify, contact or precisely locate a person, household, computing system or device. This definition is expressly scoped to this section.
Supporting quotations
For purposes of this section, the term “personal information” means information that relates to an identified or identifiable natural person, or that is reasonably capable of being used to identify, contact, or precisely locate a natural person, household, or a particular computing system or device.
Use & Processing · Company commitment
State notice limits re-identification to compliance testing
The general policy says Function will not attempt re-identification except as law requires or permits. The state notice more specifically says it does not attempt to re-identify de-identified information except to test whether its de-identification processes comply with applicable law.
Supporting quotations
We do not attempt to reidentify deidentified information derived from personal information, except for the purpose of testing whether our deidentification processes comply with applicable law.
To create aggregated, de-identified and/or anonymized data. We may create aggregated, de-identified and/or anonymized data from your personal information and other individuals whose personal information we collect. We make personal information into de-identified and/or anonymized data by removing information that makes the data identifiable to you. Except as required or permitted by applicable law, we will not attempt to re-identify any data that has been aggregated, de-identified and/or anonymized. We may use this aggregated, de-identified and/or anonymized data and share it with third parties for our lawful business purposes, including to analyze and improve the Service, promote our business, and for research purposes.
Cross-references
narrows (model-proposed): De-identified data may be used and shared for business purposes — narrows: The state notice states a specific compliance-testing exception to non-reidentification, while the general passage refers more broadly to what law requires or permits. The narrower statement is retained in its stated scope.
Legal Rights & Agreement Rules · User right or choice
Eligible residents may ask what information is processed and disclosed
Subject to applicable state law and exceptions, you can ask whether Function processes your information and request collection and source categories, business or commercial purposes, sale or targeted-advertising categories and recipients, business-purpose disclosure categories and recipient types, and specific third-party recipients. The described reporting covers the past 12 months and continued practices.
Supporting quotations
You can request to know whether we process your personal information.
You can request the following information about how we have collected and used your personal information during the past 12 months and how we will continue to do so:
The categories of personal information that we have collected.
The categories of sources from which we collected personal information.
The business or commercial purpose for collecting, selling, and/or sharing personal information for targeted advertising purposes.
The categories of personal information that we sold or shared for targeted advertising purposes, and the categories of third parties to whom this information was sold or shared, categorized by the type of personal information for each type of third party.
The categories of personal information that we disclosed for business purposes and the types of entities to whom this information was disclosed.
The specific third parties to which we have disclosed personal information.
Legal Rights & Agreement Rules · User right or choice
Access, correction and deletion can be requested
Where applicable state law grants the rights, you may request a portable copy or representative summary, correction of inaccurate personal information, or deletion of information collected from or about you. These are requests subject to the notice's verification requirements and applicable exceptions, not unconditional promises of deletion or a particular export format.
Supporting quotations
Access. You can request a portable copy or representative summary of the personal information that we have collected about you.
Correction. You can ask us to correct inaccurate personal information that we have collected about you.
Deletion. You can ask us to delete the personal information that we have collected from or about you.
Legal Rights & Agreement Rules · User right or choice
Consent withdrawal may be available
You may have the right under applicable state law to revoke consent to Function's processing of personal information. The notice does not promise this right to every person or make every processing purpose depend on consent.
Supporting quotations
Revoke consent. You may have the right to revoke your consent to our processing of your personal information.
Sharing & Disclosure · User right or choice
State notice permits targeted-advertising opt-outs
Eligible residents can opt out of targeted-advertising use of personal information. Function says it does not use health-related data for targeted advertising and, other than targeted advertising, does not sell personal information as defined by applicable law, including sensitive information. It says it has not done so in the prior 12 months and states a separate no-sale/sharing promise for under-18 minors.
Supporting quotations
Opt-out of targeted advertising. We process certain personal information for targeted advertising purposes. You can opt out of the use of your personal information for targeted advertising purposes.We do not use health-related data for targeted advertising.
Other than for targeted advertising purposes, we do not sell personal information (including Sensitive Personal Information), as defined under applicable law. We have not engaged in such activities in the 12 months preceding the date this Privacy Policy was last updated. Without limiting the foregoing, we do not sell or "share"/knowingly sell or "share" personal information (including Sensitive Personal Information) of minors under 18 years of age.
Sharing & Disclosure · Company commitment
Sales are described as limited to targeted advertising
The state notice says Function does not sell personal information, including sensitive information, other than for targeted advertising, and says no other sales occurred in the 12 months before its last update. It also states it does not sell or share, or knowingly sell or share, under-18 minors' information. Health-related data is excluded from targeted advertising and eligible residents can opt out.
Supporting quotations
Other than for targeted advertising purposes, we do not sell personal information (including Sensitive Personal Information), as defined under applicable law. We have not engaged in such activities in the 12 months preceding the date this Privacy Policy was last updated. Without limiting the foregoing, we do not sell or "share"/knowingly sell or "share" personal information (including Sensitive Personal Information) of minors under 18 years of age.
Opt-out of targeted advertising. We process certain personal information for targeted advertising purposes. You can opt out of the use of your personal information for targeted advertising purposes.We do not use health-related data for targeted advertising.
Cross-references
qualifies (model-proposed): No ordinary-course disclosure for money is a limited promise — qualifies: The ordinary-course no-money promise does not mean no disclosure or no statutory sale: the state notice makes an exception for targeted advertising and adds an under-18 commitment.
Inference & Profiling · Company commitment
No automated decisions with legal or similarly significant effects
Function says it does not use personal information in automated processing or profiling of aspects such as health, finances, preferences, behavior or location to make decisions producing legal or similarly significant effects. This is a limit on that type of consequential decision, not a promise of no analytics, inferences or personalization.
Supporting quotations
Automated decision making. We do not use your personal information to engage in automated processing or profiling personal information to evaluate, analyze, or predict personal aspects related to your economic situation, health, personal preferences, interests, reliability, behavior, location, or movements to make a decision that produces legal or similarly significant effects.
Cross-references
qualifies (model-proposed): Function may infer information about you — qualifies: The prohibition concerns automated profiling decisions with legal or similarly significant effects; it does not negate the collection of inferences described elsewhere.
Use & Processing · User right or choice
Eligible residents can opt out of sensitive-data processing
Under the state notice's applicable-law conditions, you can opt out of processing sensitive personal information by not providing it or by notifying Function. The notice does not grant every listed right to every person, and separate service requirements may still affect access when required information is withheld.
Supporting quotations
Sensitive Personal Information
You can opt-out of our processing of your Sensitive Personal Information by electing not to provide it to us or by notifying us of your opt-out.
This section describes how we collect, retain, use, disclose, sell and share for the purposes of targeted advertising personal information of residents of applicable U.S. states and the rights these users may have with respect to their personal information. Please note that not all rights listed below may be afforded to all individuals and that if your state does not afford you these rights, you may not be able to exercise these rights. In addition, we may not be able to process your access, correction or deletion request if you do not provide us with sufficient detail to allow us to confirm your identity and understand and respond to your request.
Legal Rights & Agreement Rules · User right or choice
State rights include nondiscrimination and appeal
Where the state privacy laws apply, you are entitled to exercise the described rights without discrimination prohibited by those laws and may appeal denial of a validly submitted request.
Supporting quotations
Nondiscrimination. You are entitled to exercise the rights described above free from discrimination as prohibited by the State Privacy Laws.
Appeal. You can appeal our denial of any request validly submitted.
Legal Rights & Agreement Rules · Procedure
Use the privacy portal for state-rights requests
Function provides a privacy portal and email route for know, access, correction, deletion, appeal and sensitive-processing-limit requests. Requests must include enough detail to understand and respond to them. The portal link is present, but the stored email is masked; the portal's own contents are not supplied.
Supporting quotations
Exercising your right to know, access, correction, deletion, and appeal [and limiting processing of Sensitive Personal Information]. You may submit requests at our privacy portal or via email to [[email protected]](https://www.functionhealth.com/cdn-cgi/l/email-protection).
We cannot process your request if you do not provide us with sufficient detail to allow us to understand and respond to it.
Not stated here
The linked privacy portal is not supplied and its additional procedures cannot be assessed. The email address is masked in the source.
Sharing & Disclosure · User right or choice
Sale and targeted-advertising opt-outs accept Global Privacy Control
Eligible residents can submit opt-outs through the linked privacy portal or GPC. GPC sets preferences for the current browser or device and associated profile; when logged in, Function says it honors the signal for the account too, including its associated offline profile. This does not automatically set every unrelated device's preferences.
Supporting quotations
Exercising your right to opt-out of/revoke your consent to the “sale” of your personal information or “sharing” of your personal information for targeted advertising purposes. You can submit requests to opt-out of targeted advertising and other sales of personal information by clicking here or by broadcasting the Global Privacy Control signal. For information about how to use the Global Privacy Control, please visit https://globalprivacycontrol.org/. These signals set your opt-out preferences only for the particular browser or device you are using and any consumer profile that we associate with that browser or device unless you are logged into your account, in which case we will honor the signal with respect to that browser or device and your account, including your offline consumer profile associated with that account.
Not stated here
The linked portal and GPC instructions are not supplied; this card does not describe their additional contents.
Security & Safeguards · Procedure
Function may verify identity, residency and deletion intent
Know, access, correction, deletion or appeal requests may require identity verification and confirmation of residency, including contact or other information. Account holders may need to reauthenticate before disclosure or deletion. Function may also ask you to confirm a deletion request.
Supporting quotations
Verification of Identity; Authorized agents. We may need to verify your identity to process your know, access, correction, deletion, or appeal requests and reserve the right to confirm your residency. We may need to request your name, e-mail address, phone number, address or other information, in order to verify your identity and protect against fraudulent requests. If you maintain a password-protected account with us, we may verify your identity through our existing authentication practices for your account and require you to reauthenticate yourself before disclosing or deleting your personal information. If you make a request to delete, we may ask you to confirm your request before we delete your personal information.
Legal Rights & Agreement Rules · Procedure
Authorized agents may need proof of authority
Some state laws allow an agent to submit your request. Function may verify the agent's identity and authority and, depending on the request, require a valid power of attorney. Without one, it may request legally permitted steps such as signed permission, your identity information or confirmation of authorization.
Supporting quotations
Under some State Privacy Laws, you may enable an authorized agent to make a request on your behalf. However, we may need to verify your authorized agent’s identity and authority to act on your behalf. Depending on the kind of request you have made, we may require a copy of a valid power of attorney given to your authorized agent pursuant to applicable law. If you have not provided your agent with such a power of attorney, we may ask you to take additional steps permitted by law to verify that your request is authorized, such as by providing your agent with written and signed permission to exercise your State Privacy Law rights on your behalf, the information we request to verify your identity, or confirmation that you have given the authorized agent permission to submit the request.
Legal Rights & Agreement Rules · Context
The state table separates business disclosures, ad sharing and sales
The table summarizes current practices and the 12 months before the policy's effective date, using definitions in the full policy and state-law categories. Its columns separately identify data, statutory categories, purposes, business-purpose recipients, cross-context behavioral-advertising recipients and sale recipients. Voluntary free-form submissions may contain categories beyond the table; personal information here includes identifiable people, households and devices.
Supporting quotations
Personal information that we collect, use and disclose. We have summarized the personal information we collect and may disclose, sell to or share with third parties by reference below to both the categories of personal information defined in the “Personal Information we collect,” “How we use your personal information,” and “How we share your personal information” sections of this Policy above and the categories of personal information specified in state law. This table describes our practices currently and during the 12 months preceding the effective date of this Privacy Policy. Information you voluntarily provide to us, such as in free-form webforms, may contain other categories of personal information not described below.
See our full Privacy Policy for descriptions of each entry in this table.
Personal Information (“PI”) We Collect Statutory Category of PI Business/commercial purpose for PI collection Categories of third parties to whom we “disclose” PI for a business purpose Categories of third parties with whom we “share” PI for cross-context behavioral advertising purposes Categories of third parties to whom we “sell” PI
For purposes of this section, the term “personal information” means information that relates to an identified or identifiable natural person, or that is reasonably capable of being used to identify, contact, or precisely locate a natural person, household, or a particular computing system or device.
Use & Processing · Company practice
Contact data is listed for operations, development and advertising
The state table classifies contact data as identifiers and customer records. Listed purposes include service delivery and operations, insights and development, direct marketing, interest-based advertising, promotions, contests and events, and compliance and protection. These entries describe stated purposes, not proof that every use occurs for every individual.
Supporting quotations
Contact data
Identifiers
Customer records
Service delivery and operations
Insights and development
Direct marketing
Interest-based advertising
Promotions, and contests, and events
Compliance and protection
Use & Processing · Company practice
Additional contact-data purposes include corporate events
The contact-data row also lists compliance and protection, corporate-event sharing, consent-based uses and creation of aggregated, de-identified or anonymized data. The latter can be used or shared for lawful business purposes; Function generally promises not to re-identify except as law requires or permits. The state notice further limits re-identification to compliance testing.
Supporting quotations
Compliance and protection
Data sharing in the context of corporate events
With your consent
To create aggregated, de-identified and/or anonymized data
To create aggregated, de-identified and/or anonymized data. We may create aggregated, de-identified and/or anonymized data from your personal information and other individuals whose personal information we collect. We make personal information into de-identified and/or anonymized data by removing information that makes the data identifiable to you. Except as required or permitted by applicable law, we will not attempt to re-identify any data that has been aggregated, de-identified and/or anonymized. We may use this aggregated, de-identified and/or anonymized data and share it with third parties for our lawful business purposes, including to analyze and improve the Service, promote our business, and for research purposes.
Sharing & Disclosure · Company practice
Contact-data business disclosures
The contact-data row lists these business-purpose recipients: affiliates, service providers, payment processors, research partners, lab and provider partners, enterprise customers, parties you designate, business and marketing partners, professional advisers, authorities and others, business transferees and their advisers, and other users or the public. The narrative conditions still apply: enterprise sharing is limited, advisers receive data where necessary, authority disclosures depend on good faith, and public visibility concerns public submissions.
Supporting quotations
Affiliates
Service providers
Payment processors
Research partners
Lab and provider partners
Enterprise customers
Third parties designated by you
Business and marketing partners
Professional advisors
Authorities and others
Business transferees and their advisors
Other users and the public
Sharing & Disclosure · Company practice
Contact-data ad sharing is distinct from the sale column
The state table lists ad partners or networks for contact-data sharing for cross-context behavioral advertising, while the sale-recipient column says N/A. This does not erase the stated advertising sharing or define N/A as a universal no-sale guarantee. The general policy excludes health-related and genetic information from advertising-partner disclosures.
Supporting quotations
Ad partners/networks
N/A
Advertising partners and ad networks. Third-party advertising companies for the interest-based advertising purposes described above. We do not provide health-related information or genetic data to such advertising partners.
Not stated here
The table does not explain N/A; no broader meaning is inferred.
Use & Processing · Company practice
Demographic-data categories and uses
The table classifies demographic data as customer records and protected characteristics. Its purposes are service operations, insights and development, direct marketing, interest-based advertising, promotions/contests/events, compliance and protection, corporate-event sharing, consent-based uses and aggregation, de-identification or anonymization. These category labels do not override the policy's health and genetic advertising exclusions.
Supporting quotations
Demographic data
Customer records
Protected characteristics
Service delivery and operations
Insights and development
Direct marketing
Interest-based advertising
Promotions, and contests, and events
Compliance and protection
Data sharing in the context of corporate events
With your consent
To create aggregated, de-identified and/or anonymized data
Sharing & Disclosure · Company practice
Demographic-data business disclosures
For demographic data, the state table lists affiliates, service providers, payment processors, research partners, lab and provider partners, enterprise customers, parties you designate, business and marketing partners, professional advisers, authorities and others, business transferees and their advisers, and other users or the public as business-purpose recipients. The narrative conditions still apply: enterprise sharing is limited, advisers receive data where necessary, authority disclosures depend on good faith, and public visibility concerns public submissions.
Supporting quotations
Demographic data
Affiliates
Service providers
Payment processors
Research partners
Lab and provider partners
Enterprise customers
Third parties designated by you
Business and marketing partners
Professional advisors
Authorities and others
Business transferees and their advisors
Other users and the public
Sharing & Disclosure · Company practice
Demographic-data advertising sharing
Ad partners and networks are listed for cross-context behavioral-advertising sharing of demographic data; the separate sale-recipient cell says N/A. The policy's health-related and genetic advertising exclusion still applies. N/A is left as the table's unexplained notation rather than converted into an absolute no-disclosure promise.
Supporting quotations
Demographic data
Ad partners/networks
N/A
Interest-based advertising. Our third-party advertising partners may use cookies, pixels and other technologies to collect information about your interaction (including the data described in the automatic data collection section above) with the Service, our communications and other third-party online services over time, and use that information to serve online ads that they think will interest you. This is called interest-based advertising. We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms. We do not use health-related information or genetic data for interest-based advertising.
Not stated here
The sale cell N/A is not defined.
Use & Processing · Company practice
Account-data categories and purposes
Account data is classified as identifiers, customer records, sensitive personal information, employment information and internet activity. Listed purposes cover service operations, insights/development, direct and interest-based marketing, promotions/contests/events, compliance/protection, corporate-event sharing, consent-based uses and aggregation/de-identification/anonymization. The inclusion of sensitive information does not mean every account field is sensitive or override specific health-data advertising exclusions.
Supporting quotations
Account data
Identifiers
Customer records
Sensitive personal information
Employment information
Internet activity
Service delivery and operations
Insights and development
Direct marketing
Interest-based advertising
Promotions, and contests, and events
Compliance and protection
Data sharing in the context of corporate events
With your consent
To create aggregated, de-identified and/or anonymized data
Sharing & Disclosure · Company practice
Account-data business disclosures
The account-data row lists affiliates, service providers, payment processors, research partners, lab and provider partners, enterprise customers, parties you designate, business and marketing partners, professional advisers, authorities and others, business transferees and their advisers, and other users or the public as business-purpose recipients. The narrative conditions still apply: enterprise sharing is limited, advisers receive data where necessary, authority disclosures depend on good faith, and public visibility concerns public submissions.
Supporting quotations
Account data
Affiliates
Service providers
Payment processors
Research partners
Lab and provider partners
Enterprise customers
Third parties designated by you
Business and marketing partners
Professional advisors
Authorities and others
Business transferees and their advisors
Other users and the public
Sharing & Disclosure · Company practice
Account-data ad sharing and sale notation
The state table lists ad partners/networks for cross-context behavioral-advertising sharing of account data and N/A for sale recipients. This records two separate columns, not a promise that no account data is shared. Health-related and genetic data remain excluded from interest-based advertising under the general policy.
Supporting quotations
Account data
Ad partners/networks
N/A
Not stated here
The table does not define its N/A sale notation.
Use & Processing · Company practice
Service-eligibility data has its own purpose list
The table classifies service-eligibility data as identifiers and customer records. Listed purposes are service delivery/operations, insights/development, direct marketing, compliance/protection, corporate-event sharing, consent-based uses and aggregated, de-identified or anonymized data. This row does not list interest-based advertising as a collection purpose, although its separate ad-sharing column lists ad partners.
Supporting quotations
Service-eligibility data
Identifiers
Customer records
Service delivery and operations
Insights and development
Direct marketing
Compliance and protection
Data sharing in the context of corporate events
With your consent
To create aggregated, de-identified and/or anonymized data
Cross-references
contrast (model-proposed): Eligibility-data ad sharing is expressly listed — contrast: The service-eligibility row omits interest-based advertising from its purpose list but names ad partners in its cross-context-sharing column. Neither local omission nor N/A in the separate sale column erases that sharing entry.
Sharing & Disclosure · Company practice
Service-eligibility business disclosures
For service-eligibility data, the table lists affiliates, service providers, payment processors, research partners, lab and provider partners, enterprise customers, parties you designate, business and marketing partners, professional advisers, authorities and others, business transferees and their advisers, and other users or the public as business-purpose recipients. The policy excludes information received from and processed on behalf of enterprise customers; inclusion in this table does not remove that scope exclusion. The narrative conditions still apply: enterprise sharing is limited, advisers receive data where necessary, authority disclosures depend on good faith, and public visibility concerns public submissions.
Supporting quotations
Service-eligibility data
Affiliates
Service providers
Payment processors
Research partners
Lab and provider partners
Enterprise customers
Third parties designated by you
Business and marketing partners
Professional advisors
Authorities and others
Business transferees and their advisors
Other users and the public
Sharing & Disclosure · Company practice
Eligibility-data ad sharing is expressly listed
Although the eligibility row's purpose list omits interest-based advertising, its cross-context advertising-sharing column lists ad partners/networks. The sale-recipient cell says N/A. The local purpose-list omission therefore does not establish that eligibility information is never used in ad sharing.
Supporting quotations
Service-eligibility data
Ad partners/networks
N/A
Not stated here
The table does not explain N/A in the sale column.
Data Access & Collection · Company practice
Genetic data maps to multiple statutory categories
The genetic-data row lists identifiers, customer records and protected characteristics among its statutory categories. These are classifications of the row, not permissions to advertise using genetic information.
Supporting quotations
Genetic data
Identifiers
Customer records
Protected characteristics
Use & Processing · Company practice
Genetic-data purposes are narrower than the general marketing rows
The genetic-data row includes customer records and protected characteristics and lists service operations, compliance/protection, corporate-event sharing, consent-based uses and creation of aggregated, de-identified or anonymized data. De-identified data can be used for lawful business purposes; the state notice limits attempted re-identification to legal-compliance testing. This row does not list an advertising purpose.
Supporting quotations
Customer records
Protected characteristics
Service delivery and operations
Compliance and protection
Data sharing in the context of corporate events
With your consent
To create aggregated, de-identified and/or anonymized data
To create aggregated, de-identified and/or anonymized data. We may create aggregated, de-identified and/or anonymized data from your personal information and other individuals whose personal information we collect. We make personal information into de-identified and/or anonymized data by removing information that makes the data identifiable to you. Except as required or permitted by applicable law, we will not attempt to re-identify any data that has been aggregated, de-identified and/or anonymized. We may use this aggregated, de-identified and/or anonymized data and share it with third parties for our lawful business purposes, including to analyze and improve the Service, promote our business, and for research purposes.
We do not attempt to reidentify deidentified information derived from personal information, except for the purpose of testing whether our deidentification processes comply with applicable law.
Sharing & Disclosure · Company practice
Genetic-data recipient list conflicts with the enterprise exclusion
The genetic-data table row lists affiliates, service providers, payment processors, researchers, labs/providers, enterprise customers, your designated parties, business/marketing partners, advisers, authorities, transferees/advisers and other users/the public as business-purpose recipients. But the narrative expressly says no genetic data is provided to enterprise customers. Both statements are retained: this table entry does not establish that genetic data actually goes to employers. Public visibility elsewhere is tied to public submissions.
Supporting quotations
Affiliates
Service providers
Payment processors
Research partners
Lab and provider partners
Enterprise customers
Third parties designated by you
Business and marketing partners
Professional advisors
Authorities and others
Business transferees and their advisors
Other users and the public
Enterprise customers. We may share certain limited personal information with the relevant enterprise customers through which you received access to the Services (e.g., if you redeemed the Function membership, the date you used/obtained the Service (for example, the date(s) you booked and completed the Service aspects such as scans, date of scan report upload)). We do not provide health-related information or genetic data to enterprise customers.
Other users and the public. Certain user-generated content, including your health-related data and other data you submit to us may be visible to other users and the public, such as when you post comments in publicly accessible parts of the Service or provide a testimonial that is intended to be public. This information can be seen, collected and used by others, including being cached, copied, screen captured or stored elsewhere by others (e.g., search engines), and we are not responsible for any such use of this information. Once you publish content, it may be copied and stored on third-party systems where you might not have the ability to have it deleted.
Not stated here
The policy does not explain why enterprise customers appear in this genetic-data row despite the express narrative exclusion.
Cross-references
contrast (model-proposed): Enterprise customers receive limited usage information — contrast: The genetic-data table lists enterprise customers, while the narrative expressly excludes genetic data from those disclosures. This is a reviewed textual tension; it does not establish actual employer access.
Sharing & Disclosure · Company practice
Genetic-data ad-sharing and sale cells say N/A
The genetic row records N/A for both cross-context advertising-sharing and sale recipients. Unlike the unexplained notation alone, the narrative expressly says genetic and health-related data are not provided to advertising partners. The table does not explain its sale notation.
Supporting quotations
N/A N/A
Advertising partners and ad networks. Third-party advertising companies for the interest-based advertising purposes described above. We do not provide health-related information or genetic data to such advertising partners.
Not stated here
N/A is not independently defined in the table.
Use & Processing · Company practice
Health-data uses and consented marketing differ from targeted ads
The health-related row lists identifiers, customer records and protected characteristics, with purposes covering service operations, compliance/protection, corporate events, consent-based uses and aggregation/de-identification/anonymization. Separately, the policy describes controls for marketing consented to on the basis of health or genetic data, while excluding those data from interest-based advertising. These are distinct marketing contexts, not permission for targeted ads using health data.
Supporting quotations
Health-related data
Identifiers
Customer records
Protected characteristics
Service delivery and operations
Compliance and protection
Data sharing in the context of corporate events
With your consent
To create aggregated, de-identified and/or anonymized data
For marketing that you have consented to receive based on your health-related data and/or genetic data, you can control how we market to you by contacting us at [[email protected]](https://www.functionhealth.com/cdn-cgi/l/email-protection). Function does not share originator opt-in and related consent data for independent third-party use.
Interest-based advertising. Our third-party advertising partners may use cookies, pixels and other technologies to collect information about your interaction (including the data described in the automatic data collection section above) with the Service, our communications and other third-party online services over time, and use that information to serve online ads that they think will interest you. This is called interest-based advertising. We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms. We do not use health-related information or genetic data for interest-based advertising.
Not stated here
The stored health-marketing contact email is masked.
Sharing & Disclosure · Company practice
The health-data table also lists enterprise customers
Among the health-data row's business-purpose recipients are affiliates, service providers, payment processors, researchers, labs/providers, enterprise customers, your designated parties and business/marketing partners. The narrative expressly says no health-related or genetic data is provided to enterprise customers. The table and that promise are in tension; the broad recipient list cannot be read as an unqualified authorization to send health data to employers.
Supporting quotations
Health-related data
Affiliates
Service providers
Payment processors
Research partners
Lab and provider partners
Enterprise customers
Third parties designated by you
Business and marketing partners
Enterprise customers. We may share certain limited personal information with the relevant enterprise customers through which you received access to the Services (e.g., if you redeemed the Function membership, the date you used/obtained the Service (for example, the date(s) you booked and completed the Service aspects such as scans, date of scan report upload)). We do not provide health-related information or genetic data to enterprise customers.
Not stated here
The policy does not reconcile the health-data table's enterprise-customer entry with its express no-health-data-sharing promise.
Cross-references
contrast (model-proposed): Enterprise customers receive limited usage information — contrast: The health-data table lists enterprise customers, while the narrative expressly excludes health-related data from those disclosures. Both statements are preserved without inventing an exception or asserting actual sharing.
Sharing & Disclosure · Company practice
Additional health-data business recipients
The health-data row also lists your designated parties, business/marketing partners, professional advisers, authorities and others, business transferees/advisers, and other users/the public. The public-content provision concerns data you expose through public posts or intended-public testimonials, which others may copy and retain. Adviser, legal-process and directed-sharing conditions elsewhere still apply.
Supporting quotations
Business and marketing partners
Professional advisors
Authorities and others
Business transferees and their advisors
Other users and the public
Third parties designated by you
Other users and the public. Certain user-generated content, including your health-related data and other data you submit to us may be visible to other users and the public, such as when you post comments in publicly accessible parts of the Service or provide a testimonial that is intended to be public. This information can be seen, collected and used by others, including being cached, copied, screen captured or stored elsewhere by others (e.g., search engines), and we are not responsible for any such use of this information. Once you publish content, it may be copied and stored on third-party systems where you might not have the ability to have it deleted.
Sharing & Disclosure · Company practice
Health-data advertising and sale cells are marked N/A
Both the health-data row's cross-context ad-sharing and sale-recipient cells show N/A. The narrative separately and expressly excludes health-related and genetic information from advertising-partner disclosures. N/A alone does not explain the table's treatment of sales.
Supporting quotations
N/A N/A
Advertising partners and ad networks. Third-party advertising companies for the interest-based advertising purposes described above. We do not provide health-related information or genetic data to such advertising partners.
Not stated here
The table does not define N/A.
Use & Processing · Company practice
Audiovisual data has a broad purpose list
The table classifies audiovisual recordings as audio/video/visual data and lists service operations, insights/development, direct marketing, interest-based advertising, promotions/contests/events, compliance/protection, corporate events, consent and aggregation/de-identification/anonymization as purposes. Specific health/genetic advertising exclusions still apply. The row's separate ad-sharing cell is N/A, so its advertising purpose must not be equated with a named ad-sharing recipient.
Supporting quotations
Audiovisual recording data
Audio/video/visual data
Service delivery and operations
Insights and development
Direct Marketing
Interest-based advertising
Promotions, and contests, and events
Compliance and protection
Data sharing in the context of corporate events
With your consent
To create aggregated, de-identified and/or anonymized data
Interest-based advertising. Our third-party advertising partners may use cookies, pixels and other technologies to collect information about your interaction (including the data described in the automatic data collection section above) with the Service, our communications and other third-party online services over time, and use that information to serve online ads that they think will interest you. This is called interest-based advertising. We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms. We do not use health-related information or genetic data for interest-based advertising.
Cross-references
contrast (model-proposed): Audiovisual ad-sharing and sale recipients are not specified — contrast: The audiovisual row lists interest-based advertising as a purpose but marks ad-sharing and sale recipients N/A. The analysis preserves this tension without assigning an unsupported meaning to N/A.
Sharing & Disclosure · Company practice
Audiovisual-data business disclosures
For audiovisual recording data, the table lists affiliates, service providers, payment processors, research partners, lab/provider partners, enterprise customers, your designated parties, business/marketing partners, professional advisers, authorities and others, business transferees/advisers, and other users/the public for business-purpose disclosures. These table categories retain the narrative limits: enterprise customers receive limited usage information and no health/genetic data, designated sharing follows your instructions or consent, advisers receive information where necessary, and public visibility relates to public submissions.
Supporting quotations
Audiovisual recording data
Affiliates
Service providers
Payment processors
Research partners
Lab and provider partners
Enterprise customers
Third parties designated by you
Business and marketing partners
Professional advisors
Authorities and others
Business transferees and their advisors
Other users and the public
Enterprise customers. We may share certain limited personal information with the relevant enterprise customers through which you received access to the Services (e.g., if you redeemed the Function membership, the date you used/obtained the Service (for example, the date(s) you booked and completed the Service aspects such as scans, date of scan report upload)). We do not provide health-related information or genetic data to enterprise customers.
Sharing & Disclosure · Company practice
Audiovisual ad-sharing and sale recipients are not specified
The audiovisual row lists an interest-based advertising purpose elsewhere, but both the cross-context ad-sharing and sale-recipient cells say N/A. The table does not explain how that purpose relates to those cells; it does not identify ad partners in these recipient columns.
Supporting quotations
Audiovisual recording data
N/A N/A
Not stated here
N/A is undefined; no universal ban on advertising use is inferred from the recipient cells.
Use & Processing · Company practice
Transaction-data categories and purposes
The state table classifies transactional data as commercial information and internet activity. Purposes include operations, insights/development, direct and interest-based marketing, promotions/contests/events, compliance/protection, corporate events, consent and aggregation/de-identification/anonymization. Health-related and genetic information remains excluded from interest-based advertising.
Supporting quotations
Transactional data
Commercial information
Internet activity
Service delivery and operations
Insights and development
Direct Marketing
Interest-based advertising
Promotions, and contests, and events
Compliance and protection
Data sharing in the context of corporate events
With your consent
To create aggregated, de-identified and/or anonymized data
Interest-based advertising. Our third-party advertising partners may use cookies, pixels and other technologies to collect information about your interaction (including the data described in the automatic data collection section above) with the Service, our communications and other third-party online services over time, and use that information to serve online ads that they think will interest you. This is called interest-based advertising. We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms. We do not use health-related information or genetic data for interest-based advertising.
Sharing & Disclosure · Company practice
Transactional-data business disclosures
The transaction-data row lists affiliates, service providers, payment processors, research partners, lab/provider partners, enterprise customers, your designated parties, business/marketing partners, professional advisers, authorities and others, business transferees/advisers, and other users/the public for business-purpose disclosures. These table categories retain the narrative limits: enterprise customers receive limited usage information and no health/genetic data, designated sharing follows your instructions or consent, advisers receive information where necessary, and public visibility relates to public submissions.
Supporting quotations
Transactional data
Affiliates
Service providers
Payment processors
Research partners
Lab and provider partners
Enterprise customers
Third parties designated by you
Business and marketing partners
Professional advisors
Authorities and others
Business transferees and their advisors
Other users and the public
Enterprise customers. We may share certain limited personal information with the relevant enterprise customers through which you received access to the Services (e.g., if you redeemed the Function membership, the date you used/obtained the Service (for example, the date(s) you booked and completed the Service aspects such as scans, date of scan report upload)). We do not provide health-related information or genetic data to enterprise customers.
Sharing & Disclosure · Company practice
Transaction-data sharing names ad partners
Ad partners/networks are named in the cross-context advertising-sharing column for transactional data. The sale column says N/A. The general policy excludes health-related and genetic data from advertising-partner disclosures, so a transaction category does not authorize sharing such information for ads.
Supporting quotations
Transactional data
Ad partners/networks
N/A
Advertising partners and ad networks. Third-party advertising companies for the interest-based advertising purposes described above. We do not provide health-related information or genetic data to such advertising partners.
Not stated here
The table does not define the sale-column notation N/A.
Use & Processing · Company practice
Communications-data categories and purposes
Communications data is classified as commercial information and internet activity. The row lists service operations, insights/development, direct marketing, interest-based advertising, promotions/contests/events, compliance/protection, corporate events, consent and aggregation/de-identification/anonymization. The health/genetic advertising exclusion remains applicable.
Supporting quotations
Communications data
Commercial information
Internet activity
Service delivery and operations
Insights and development
Direct Marketing
Interest-based advertising
Promotions, and contests, and events
Compliance and protection
Data sharing in the context of corporate events
With your consent
To create aggregated, de-identified and/or anonymized data
Interest-based advertising. Our third-party advertising partners may use cookies, pixels and other technologies to collect information about your interaction (including the data described in the automatic data collection section above) with the Service, our communications and other third-party online services over time, and use that information to serve online ads that they think will interest you. This is called interest-based advertising. We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms. We do not use health-related information or genetic data for interest-based advertising.
Sharing & Disclosure · Company practice
Communications-data business disclosures
The communications-data row names affiliates, service providers, payment processors, research partners, lab/provider partners, enterprise customers, your designated parties, business/marketing partners, professional advisers, authorities and others, business transferees/advisers, and other users/the public for business purposes. These table categories retain the narrative limits: enterprise customers receive limited usage information and no health/genetic data, designated sharing follows your instructions or consent, advisers receive information where necessary, and public visibility relates to public submissions.
Supporting quotations
Communications data
Affiliates
Service providers
Payment processors
Research partners
Lab and provider partners
Enterprise customers
Third parties designated by you
Business and marketing partners
Professional advisors
Authorities and others
Business transferees and their advisors
Other users and the public
Enterprise customers. We may share certain limited personal information with the relevant enterprise customers through which you received access to the Services (e.g., if you redeemed the Function membership, the date you used/obtained the Service (for example, the date(s) you booked and completed the Service aspects such as scans, date of scan report upload)). We do not provide health-related information or genetic data to enterprise customers.
Sharing & Disclosure · Company practice
Communications data may be shared with ad partners
The table names ad partners/networks for cross-context ad sharing of communications data and marks sale recipients N/A. This does not override the narrative exclusion of health-related or genetic information from advertising-partner disclosures.
Supporting quotations
Communications data
Ad partners/networks
N/A
Advertising partners and ad networks. Third-party advertising companies for the interest-based advertising purposes described above. We do not provide health-related information or genetic data to such advertising partners.
Not stated here
N/A in the sale column is not defined.
Use & Processing · Company practice
Relationship-data categories and purposes
Relationship data is listed as identifiers and customer records. Its purposes include service operations, insights/development, direct and interest-based marketing, promotions/contests/events, compliance/protection, corporate events, consent and aggregation/de-identification/anonymization. The policy's health/genetic advertising exclusion still limits the broad purpose labels.
Supporting quotations
Relationship data
Identifiers
Customer records
Service delivery and operations
Insights and development
Direct Marketing
Interest-based advertising
Promotions, and contests, and events
Compliance and protection
Data sharing in the context of corporate events
With your consent
To create aggregated, de-identified and/or anonymized data
Interest-based advertising. Our third-party advertising partners may use cookies, pixels and other technologies to collect information about your interaction (including the data described in the automatic data collection section above) with the Service, our communications and other third-party online services over time, and use that information to serve online ads that they think will interest you. This is called interest-based advertising. We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms. We do not use health-related information or genetic data for interest-based advertising.
Sharing & Disclosure · Company practice
Relationship-data recipients include enterprise customers
Among relationship-data business recipients are affiliates, service providers, payment processors, research partners, labs/providers, enterprise customers and parties you designate. Enterprise sharing is described elsewhere as limited usage information, excluding health/genetic data; designated sharing follows your instruction or consent.
Supporting quotations
Relationship data
Affiliates
Service providers
Payment processors
Research partners
Lab and provider partners
Enterprise customers
Third parties designated by you
Enterprise customers. We may share certain limited personal information with the relevant enterprise customers through which you received access to the Services (e.g., if you redeemed the Function membership, the date you used/obtained the Service (for example, the date(s) you booked and completed the Service aspects such as scans, date of scan report upload)). We do not provide health-related information or genetic data to enterprise customers.
Sharing & Disclosure · Company practice
Additional relationship-data recipients
The relationship-data row also lists parties you designate, business/marketing partners, professional advisers, authorities and others, business transferees/advisers, and other users/the public. Business transfers can include prospective transactions and insolvency; public visibility is described for public submissions, which may be copied beyond your deletion control.
Supporting quotations
Third parties designated by you
Business and marketing partners
Professional advisors
Authorities and others
Business transferees and their advisors
Other users and the public
Business transferees and their advisors. We may disclose personal information in the context of actual or prospective business transactions (e.g., investments in or financings of Function, public stock offerings, or the sale, transfer or merger of all or part of our business, assets or shares, liquidation or reorganization), for example, we may need to share certain personal information with prospective counterparties and their advisers. We may also disclose your personal information to an acquirer, successor, or assignee of Function or a portion of our business assets as part of any merger, acquisition, sale of assets, or similar transaction, and/or in the event of an insolvency, bankruptcy, or receivership in which personal information is transferred to one or more third parties as one of our business assets.
Other users and the public. Certain user-generated content, including your health-related data and other data you submit to us may be visible to other users and the public, such as when you post comments in publicly accessible parts of the Service or provide a testimonial that is intended to be public. This information can be seen, collected and used by others, including being cached, copied, screen captured or stored elsewhere by others (e.g., search engines), and we are not responsible for any such use of this information. Once you publish content, it may be copied and stored on third-party systems where you might not have the ability to have it deleted.
Sharing & Disclosure · Company practice
Relationship data is listed for advertising sharing
For relationship data, ad partners/networks appear in the cross-context advertising-sharing column, while sale recipients are marked N/A. The express health/genetic advertising-partner exclusion remains applicable; N/A is not defined as a blanket prohibition on all sharing.
Supporting quotations
Ad partners/networks
N/A
Advertising partners and ad networks. Third-party advertising companies for the interest-based advertising purposes described above. We do not provide health-related information or genetic data to such advertising partners.
Not stated here
The sale-column notation N/A is not explained.
Charges & Financial Obligations · Company practice
Payment data has three listed purposes
The table classifies payment data as customer records and sensitive personal information. It lists service delivery/operations, compliance/protection and corporate-event sharing as purposes. Corporate-event sharing may involve prospective or actual counterparties and advisers; the row does not list advertising as a collection purpose.
Supporting quotations
Payment data
Customer record
Sensitive personal information
Service delivery and operations
Compliance and protection
Data sharing in the context of corporate events
Data sharing in the context of corporate events, we may share certain personal information in the context of actual or prospective corporate events with our advisors, the prospective or actual counterparties to the corporate event and their advisors.
Sharing & Disclosure · Company practice
Payment-data recipients are broader than payment processors
The table lists affiliates, service providers, payment processors, research partners, labs/providers, enterprise customers, designated parties, business/marketing partners, advisers, authorities, business transferees/advisers and users/the public as business recipients. The narrative says processors directly collect/process card information under their own policies, and enterprise disclosures are limited and exclude health/genetic data. The category list is not proof each recipient receives your card details.
Supporting quotations
Payment data
Affiliates
Service providers
Payment processors
Research partners
Lab and provider partners
Enterprise customers
Third parties designated by you
Business and marketing partners
Professional advisors
Authorities and others
Business transferees and their advisors
Other users and the public
Payment processors. Any payment card information you use to make a purchase on the Service is collected and processed directly by our payment processors, such as Stripe. Stripe may use your payment data in accordance with its privacy policy, https://stripe.com/privacy.
Enterprise customers. We may share certain limited personal information with the relevant enterprise customers through which you received access to the Services (e.g., if you redeemed the Function membership, the date you used/obtained the Service (for example, the date(s) you booked and completed the Service aspects such as scans, date of scan report upload)). We do not provide health-related information or genetic data to enterprise customers.
Not stated here
The linked Stripe privacy policy is not supplied; its additional data uses cannot be described here.
Sharing & Disclosure · Company practice
Payment-data ad-sharing and sale cells say N/A
The payment-data row marks both cross-context advertising-sharing recipients and sale recipients N/A. This notation is distinct from the row's listed business-purpose recipients and is not further defined.
Supporting quotations
Payment data
N/A N/A
Not stated here
The policy does not define N/A in these cells.
Use & Processing · Company practice
Government-ID data is listed for operations and protection
Government-issued identification-number data is classified as customer records and sensitive personal information. The stated purposes are service delivery/operations, compliance/protection and corporate-event sharing, which may include prospective or actual counterparties and advisers.
Supporting quotations
Government-issued identification number data
Customer record
Sensitive personal information
Service delivery and operations
Compliance and protection
Data sharing in the context of corporate events
Data sharing in the context of corporate events, we may share certain personal information in the context of actual or prospective corporate events with our advisors, the prospective or actual counterparties to the corporate event and their advisors.
Sharing & Disclosure · Company practice
Government-ID business recipients include providers and affiliates
The government-ID row begins its business-purpose recipients with affiliates and service providers. Service providers support Function's service or business, such as IT, hosting, support, analytics and chat. These are among the row's recipients, not an exhaustive list.
Supporting quotations
Government-issued identification number data
Affiliates
Service providers
Service providers. Third parties that provide services on our behalf or help us operate the Service or our business (such as online chat functionality providers (including those that leverage generative AI technologies), hosting, information technology, customer support, email delivery, marketing, consumer research and website analytics).
Sharing & Disclosure · Company practice
Government-ID business disclosures remain subject to narrative limits
For government-ID data, the table lists affiliates, service providers, payment processors, research partners, labs/providers, enterprise customers, designated parties, business/marketing partners, advisers, authorities and others, business transferees/advisers, and other users/the public as business recipients. These broad table categories retain the narrative conditions: enterprise disclosures are limited and exclude health/genetic data, designated sharing requires your instruction or consent, advisers receive information where necessary, and public visibility relates to public submissions.
Supporting quotations
Affiliates
Service providers
Payment processors
Research partners
Lab and provider partners
Enterprise customers
Third parties designated by you
Business and marketing partners
Professional advisors
Authorities and others
Business transferees and their advisors
Other users and the public
Enterprise customers. We may share certain limited personal information with the relevant enterprise customers through which you received access to the Services (e.g., if you redeemed the Function membership, the date you used/obtained the Service (for example, the date(s) you booked and completed the Service aspects such as scans, date of scan report upload)). We do not provide health-related information or genetic data to enterprise customers.
Other users and the public. Certain user-generated content, including your health-related data and other data you submit to us may be visible to other users and the public, such as when you post comments in publicly accessible parts of the Service or provide a testimonial that is intended to be public. This information can be seen, collected and used by others, including being cached, copied, screen captured or stored elsewhere by others (e.g., search engines), and we are not responsible for any such use of this information. Once you publish content, it may be copied and stored on third-party systems where you might not have the ability to have it deleted.
Sharing & Disclosure · Company practice
Government-ID ad-sharing and sale cells say N/A
The government-ID row marks both cross-context ad-sharing and sale recipients N/A. This is separate from its business-purpose recipient list and does not itself define a broader guarantee.
Supporting quotations
N/A N/A
Not stated here
The table does not explain N/A.
Use & Processing · Company practice
Marketing data categories and uses
The state table classifies marketing data as commercial information, internet activity and inferences. Listed purposes include operations, insights/development, direct and interest-based marketing, promotions/contests/events, compliance/protection, corporate events, consent-based uses and aggregation/de-identification/anonymization. The policy excludes health-related and genetic data from interest-based advertising.
Supporting quotations
Marketing Data
Commercial information
Internet activity
Inferences
Service delivery and operations
Insights and development
Direct Marketing
Interest-based advertising
Promotions, and contests, and events
Compliance and protection
Data sharing in the context of corporate events
With your consent
To create aggregated, de-identified and/or anonymized data
Interest-based advertising. Our third-party advertising partners may use cookies, pixels and other technologies to collect information about your interaction (including the data described in the automatic data collection section above) with the Service, our communications and other third-party online services over time, and use that information to serve online ads that they think will interest you. This is called interest-based advertising. We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms. We do not use health-related information or genetic data for interest-based advertising.
Sharing & Disclosure · Company practice
Marketing data business recipients
The marketing data row lists affiliates, service providers, payment processors, research partners, labs/providers, enterprise customers, designated parties, business/marketing partners, advisers, authorities and others, business transferees/advisers, and other users/the public for business-purpose disclosures. These broad table categories retain the narrative conditions: enterprise disclosures are limited and exclude health/genetic data, designated sharing requires your instruction or consent, advisers receive information where necessary, and public visibility relates to public submissions.
Supporting quotations
Marketing Data
Affiliates
Service providers
Payment processors
Research partners
Lab and provider partners
Enterprise customers
Third parties designated by you
Business and marketing partners
Professional advisors
Authorities and others
Business transferees and their advisors
Other users and the public
Enterprise customers. We may share certain limited personal information with the relevant enterprise customers through which you received access to the Services (e.g., if you redeemed the Function membership, the date you used/obtained the Service (for example, the date(s) you booked and completed the Service aspects such as scans, date of scan report upload)). We do not provide health-related information or genetic data to enterprise customers.
Other users and the public. Certain user-generated content, including your health-related data and other data you submit to us may be visible to other users and the public, such as when you post comments in publicly accessible parts of the Service or provide a testimonial that is intended to be public. This information can be seen, collected and used by others, including being cached, copied, screen captured or stored elsewhere by others (e.g., search engines), and we are not responsible for any such use of this information. Once you publish content, it may be copied and stored on third-party systems where you might not have the ability to have it deleted.
Sharing & Disclosure · Company practice
Marketing data can be shared with ad partners
The marketing data row names ad partners/networks for cross-context advertising sharing and marks sale recipients N/A. The narrative health/genetic exclusion still applies; the category label does not authorize those excluded data to be disclosed to advertising partners.
Supporting quotations
Marketing Data
Ad partners/networks
N/A
Advertising partners and ad networks. Third-party advertising companies for the interest-based advertising purposes described above. We do not provide health-related information or genetic data to such advertising partners.
Not stated here
The sale-column notation N/A is not defined.
Use & Processing · Company practice
User-generated content categories and uses
The state table classifies user-generated content as audio/video/visual data and internet activity. Listed purposes include operations, insights/development, direct and interest-based marketing, promotions/contests/events, compliance/protection, corporate events, consent-based uses and aggregation/de-identification/anonymization. The policy excludes health-related and genetic data from interest-based advertising.
Supporting quotations
User-generated content data
Audio/video/visual data
Internet activity
Service delivery and operations
Insights and development
Direct Marketing
Interest-based advertising
Promotions, and contests, and events
Compliance and protection
Data sharing in the context of corporate events
With your consent
To create aggregated, de-identified and/or anonymized data
Interest-based advertising. Our third-party advertising partners may use cookies, pixels and other technologies to collect information about your interaction (including the data described in the automatic data collection section above) with the Service, our communications and other third-party online services over time, and use that information to serve online ads that they think will interest you. This is called interest-based advertising. We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms. We do not use health-related information or genetic data for interest-based advertising.
Sharing & Disclosure · Company practice
User-generated content business recipients
The user-generated content row lists affiliates, service providers, payment processors, research partners, labs/providers, enterprise customers, designated parties, business/marketing partners, advisers, authorities and others, business transferees/advisers, and other users/the public for business-purpose disclosures. These broad table categories retain the narrative conditions: enterprise disclosures are limited and exclude health/genetic data, designated sharing requires your instruction or consent, advisers receive information where necessary, and public visibility relates to public submissions.
Supporting quotations
User-generated content data
Affiliates
Service providers
Payment processors
Research partners
Lab and provider partners
Enterprise customers
Third parties designated by you
Business and marketing partners
Professional advisors
Authorities and others
Business transferees and their advisors
Other users and the public
Enterprise customers. We may share certain limited personal information with the relevant enterprise customers through which you received access to the Services (e.g., if you redeemed the Function membership, the date you used/obtained the Service (for example, the date(s) you booked and completed the Service aspects such as scans, date of scan report upload)). We do not provide health-related information or genetic data to enterprise customers.
Other users and the public. Certain user-generated content, including your health-related data and other data you submit to us may be visible to other users and the public, such as when you post comments in publicly accessible parts of the Service or provide a testimonial that is intended to be public. This information can be seen, collected and used by others, including being cached, copied, screen captured or stored elsewhere by others (e.g., search engines), and we are not responsible for any such use of this information. Once you publish content, it may be copied and stored on third-party systems where you might not have the ability to have it deleted.
Sharing & Disclosure · Company practice
User-generated content can be shared with ad partners
The user-generated content row names ad partners/networks for cross-context advertising sharing and marks sale recipients N/A. The narrative health/genetic exclusion still applies; the category label does not authorize those excluded data to be disclosed to advertising partners.
Supporting quotations
User-generated content data
Ad partners/networks
N/A
Advertising partners and ad networks. Third-party advertising companies for the interest-based advertising purposes described above. We do not provide health-related information or genetic data to such advertising partners.
Not stated here
The sale-column notation N/A is not defined.
Use & Processing · Company practice
Device data categories and uses
The state table classifies device data as identifiers, internet activity and geolocation data. Listed purposes include operations, insights/development, direct and interest-based marketing, promotions/contests/events, compliance/protection, corporate events, consent-based uses and aggregation/de-identification/anonymization. The policy excludes health-related and genetic data from interest-based advertising.
Supporting quotations
Device data
Identifiers
Internet activity
Geolocation data
Service delivery and operations
Insights and development
Direct Marketing
Interest-based advertising
Promotions, and contests, and events
Compliance and protection
Data sharing in the context of corporate events
With your consent
To create aggregated, de-identified and/or anonymized data
Interest-based advertising. Our third-party advertising partners may use cookies, pixels and other technologies to collect information about your interaction (including the data described in the automatic data collection section above) with the Service, our communications and other third-party online services over time, and use that information to serve online ads that they think will interest you. This is called interest-based advertising. We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms. We do not use health-related information or genetic data for interest-based advertising.
Sharing & Disclosure · Company practice
Device data business recipients
The device data row lists affiliates, service providers, payment processors, research partners, labs/providers, enterprise customers, designated parties, business/marketing partners, advisers, authorities and others, business transferees/advisers, and other users/the public for business-purpose disclosures. These broad table categories retain the narrative conditions: enterprise disclosures are limited and exclude health/genetic data, designated sharing requires your instruction or consent, advisers receive information where necessary, and public visibility relates to public submissions.
Supporting quotations
Device data
Affiliates
Service providers
Payment processors
Research partners
Lab and provider partners
Enterprise customers
Third parties designated by you
Business and marketing partners
Professional advisors
Authorities and others
Business transferees and their advisors
Other users and the public
Enterprise customers. We may share certain limited personal information with the relevant enterprise customers through which you received access to the Services (e.g., if you redeemed the Function membership, the date you used/obtained the Service (for example, the date(s) you booked and completed the Service aspects such as scans, date of scan report upload)). We do not provide health-related information or genetic data to enterprise customers.
Other users and the public. Certain user-generated content, including your health-related data and other data you submit to us may be visible to other users and the public, such as when you post comments in publicly accessible parts of the Service or provide a testimonial that is intended to be public. This information can be seen, collected and used by others, including being cached, copied, screen captured or stored elsewhere by others (e.g., search engines), and we are not responsible for any such use of this information. Once you publish content, it may be copied and stored on third-party systems where you might not have the ability to have it deleted.
Sharing & Disclosure · Company practice
Device data can be shared with ad partners
The device data row names ad partners/networks for cross-context advertising sharing and marks sale recipients N/A. The narrative health/genetic exclusion still applies; the category label does not authorize those excluded data to be disclosed to advertising partners.
Supporting quotations
Device data
Ad partners/networks
N/A
Advertising partners and ad networks. Third-party advertising companies for the interest-based advertising purposes described above. We do not provide health-related information or genetic data to such advertising partners.
Not stated here
The sale-column notation N/A is not defined.
Use & Processing · Company practice
Precise-location purposes include advertising, with collection controls
The precise-geolocation row classifies the data as geolocation information. Listed purposes include operations, insights/development, direct marketing, interest-based advertising, promotions/contests/events, compliance/protection and corporate-event sharing. The collection section says precise mobile location is collected when you authorize app access, and you can disable that access in device settings. The general health/genetic advertising exclusions remain applicable.
Supporting quotations
Precise geolocation Data
Geolocation data
Service delivery and operations
Insights and development
Direct Marketing
Interest-based advertising
Promotions, and contests, and events
Compliance and protection
Data sharing in the context of corporate events
Precise geolocation data when you authorize our mobile application to access your device’s location.
Mobile location data. You can disable our access to your device’s precise geolocation in your mobile device settings.
Interest-based advertising. Our third-party advertising partners may use cookies, pixels and other technologies to collect information about your interaction (including the data described in the automatic data collection section above) with the Service, our communications and other third-party online services over time, and use that information to serve online ads that they think will interest you. This is called interest-based advertising. We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms. We do not use health-related information or genetic data for interest-based advertising.
Use & Processing · Company practice
Additional precise-location purposes include de-identification
The precise-location row also lists compliance/protection, corporate-event sharing, consent-based uses and aggregation, de-identification or anonymization. De-identified data may be used or shared for lawful business purposes; in this state notice Function says attempted re-identification is limited to testing legal compliance.
Supporting quotations
Compliance and protection
Data sharing in the context of corporate events
With your consent
To create aggregated, de-identified and/or anonymized data
To create aggregated, de-identified and/or anonymized data. We may create aggregated, de-identified and/or anonymized data from your personal information and other individuals whose personal information we collect. We make personal information into de-identified and/or anonymized data by removing information that makes the data identifiable to you. Except as required or permitted by applicable law, we will not attempt to re-identify any data that has been aggregated, de-identified and/or anonymized. We may use this aggregated, de-identified and/or anonymized data and share it with third parties for our lawful business purposes, including to analyze and improve the Service, promote our business, and for research purposes.
We do not attempt to reidentify deidentified information derived from personal information, except for the purpose of testing whether our deidentification processes comply with applicable law.
Sharing & Disclosure · Company practice
Precise-location business disclosures
The precise-location row lists affiliates, service providers, payment processors, research partners, labs/providers, enterprise customers, designated parties, business/marketing partners, advisers, authorities, business transferees/advisers and other users/the public. Narrative limits still apply: enterprise sharing is limited and excludes health/genetic data, designated sharing follows your direction or consent, adviser access must be necessary and public visibility concerns public submissions.
Supporting quotations
Affiliates
Service providers
Payment processors
Research partners
Lab and provider partners
Enterprise customers
Third parties designated by you
Business and marketing partners
Professional advisors
Authorities and others
Business transferees and their advisors
Other users and the public
Enterprise customers. We may share certain limited personal information with the relevant enterprise customers through which you received access to the Services (e.g., if you redeemed the Function membership, the date you used/obtained the Service (for example, the date(s) you booked and completed the Service aspects such as scans, date of scan report upload)). We do not provide health-related information or genetic data to enterprise customers.
Other users and the public. Certain user-generated content, including your health-related data and other data you submit to us may be visible to other users and the public, such as when you post comments in publicly accessible parts of the Service or provide a testimonial that is intended to be public. This information can be seen, collected and used by others, including being cached, copied, screen captured or stored elsewhere by others (e.g., search engines), and we are not responsible for any such use of this information. Once you publish content, it may be copied and stored on third-party systems where you might not have the ability to have it deleted.
Sharing & Disclosure · Company practice
Precise-location data is listed for advertising sharing
The table names ad partners/networks for cross-context advertising sharing of precise geolocation and marks sale recipients N/A. Collection through the mobile app requires location authorization and access can be disabled in device settings. The no-health/genetic-data advertising-partner rule still applies.
Supporting quotations
Ad partners/networks
N/A
Advertising partners and ad networks. Third-party advertising companies for the interest-based advertising purposes described above. We do not provide health-related information or genetic data to such advertising partners.
Precise geolocation data when you authorize our mobile application to access your device’s location.
Mobile location data. You can disable our access to your device’s precise geolocation in your mobile device settings.
Not stated here
The sale-column notation N/A is not defined.
Use & Processing · Company practice
Communication-interaction data is listed for marketing uses
The table classifies communication-interaction data as commercial information and internet activity. Purposes include service operations, insights/development, direct and interest-based marketing, promotions/contests/events, compliance/protection, corporate events, consent and aggregation/de-identification/anonymization. Health-related and genetic data remain excluded from interest-based advertising.
Supporting quotations
Communication interaction data
Commercial information
Internet activity
Service delivery and operations
Insights and development
Direct Marketing
Interest-based advertising
Promotions, and contests, and events
Compliance and protection
Data sharing in the context of corporate events
With your consent
To create aggregated, de-identified and/or anonymized data
Interest-based advertising. Our third-party advertising partners may use cookies, pixels and other technologies to collect information about your interaction (including the data described in the automatic data collection section above) with the Service, our communications and other third-party online services over time, and use that information to serve online ads that they think will interest you. This is called interest-based advertising. We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms. We do not use health-related information or genetic data for interest-based advertising.
Sharing & Disclosure · Company practice
Communication-interaction recipients include service providers
Among business recipients for communication-interaction data are affiliates, service providers, payment processors, research partners, labs/providers, enterprise customers and designated parties. Providers support Function's service or business. The enterprise rule limits disclosures and excludes health/genetic information; sharing with designated parties follows your instruction or consent.
Supporting quotations
Communication interaction data
Affiliates
Service providers
Payment processors
Research partners
Lab and provider partners
Enterprise customers
Third parties designated by you
Enterprise customers. We may share certain limited personal information with the relevant enterprise customers through which you received access to the Services (e.g., if you redeemed the Function membership, the date you used/obtained the Service (for example, the date(s) you booked and completed the Service aspects such as scans, date of scan report upload)). We do not provide health-related information or genetic data to enterprise customers.
Service providers. Third parties that provide services on our behalf or help us operate the Service or our business (such as online chat functionality providers (including those that leverage generative AI technologies), hosting, information technology, customer support, email delivery, marketing, consumer research and website analytics).
Sharing & Disclosure · Company practice
Additional communication-interaction recipients
The communication-interaction row also lists your designated parties, business/marketing partners, advisers, authorities and others, business transferees/advisers, and users/the public. Business transfer disclosures can involve prospective deals or insolvency; public visibility concerns public submissions. Adviser, good-faith legal/protection and directed-sharing conditions elsewhere remain applicable.
Supporting quotations
Third parties designated by you
Business and marketing partners
Professional advisors
Authorities and others
Business transferees and their advisors
Other users and the public
Business transferees and their advisors. We may disclose personal information in the context of actual or prospective business transactions (e.g., investments in or financings of Function, public stock offerings, or the sale, transfer or merger of all or part of our business, assets or shares, liquidation or reorganization), for example, we may need to share certain personal information with prospective counterparties and their advisers. We may also disclose your personal information to an acquirer, successor, or assignee of Function or a portion of our business assets as part of any merger, acquisition, sale of assets, or similar transaction, and/or in the event of an insolvency, bankruptcy, or receivership in which personal information is transferred to one or more third parties as one of our business assets.
Other users and the public. Certain user-generated content, including your health-related data and other data you submit to us may be visible to other users and the public, such as when you post comments in publicly accessible parts of the Service or provide a testimonial that is intended to be public. This information can be seen, collected and used by others, including being cached, copied, screen captured or stored elsewhere by others (e.g., search engines), and we are not responsible for any such use of this information. Once you publish content, it may be copied and stored on third-party systems where you might not have the ability to have it deleted.
Sharing & Disclosure · Company practice
Communication-interaction data is listed for ad sharing
Ad partners/networks are named as recipients for cross-context advertising sharing of communication-interaction data. Sale recipients are marked N/A, without an explanation of that notation. The policy expressly excludes health-related and genetic data from advertising-partner disclosures.
Supporting quotations
Ad partners/networks
N/A
Advertising partners and ad networks. Third-party advertising companies for the interest-based advertising purposes described above. We do not provide health-related information or genetic data to such advertising partners.
Not stated here
The sale-column N/A notation is not defined.
Use & Processing · Company practice
Online activity data categories and purposes
The state table classifies online activity data as commercial information and internet activity. Listed purposes include service operations, insights/development, direct and interest-based marketing, promotions/contests/events, compliance/protection, corporate events, consent and aggregation/de-identification/anonymization. Health-related and genetic information remains excluded from interest-based advertising.
Supporting quotations
Online activity data
Commercial information
Internet activity
Service delivery and operations
Insights and development
Direct Marketing
Interest-based advertising
Promotions, and contests, and events
Compliance and protection
Data sharing in the context of corporate events
With your consent
To create aggregated, de-identified and/or anonymized data
Interest-based advertising. Our third-party advertising partners may use cookies, pixels and other technologies to collect information about your interaction (including the data described in the automatic data collection section above) with the Service, our communications and other third-party online services over time, and use that information to serve online ads that they think will interest you. This is called interest-based advertising. We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms. We do not use health-related information or genetic data for interest-based advertising.
Sharing & Disclosure · Company practice
Online activity data business disclosures
The online activity data row lists affiliates, service providers, payment processors, research partners, labs/providers, enterprise customers, designated parties, business/marketing partners, advisers, authorities and others, business transferees/advisers, and users/the public as business-purpose recipients. Narrative conditions still apply: enterprise disclosures are limited and exclude health/genetic data, designated sharing follows your instructions or consent, advisers receive information where necessary, and public visibility concerns public submissions.
Supporting quotations
Online activity data
Affiliates
Service providers
Payment processors
Research partners
Lab and provider partners
Enterprise customers
Third parties designated by you
Business and marketing partners
Professional advisors
Authorities and others
Business transferees and their advisors
Other users and the public
Enterprise customers. We may share certain limited personal information with the relevant enterprise customers through which you received access to the Services (e.g., if you redeemed the Function membership, the date you used/obtained the Service (for example, the date(s) you booked and completed the Service aspects such as scans, date of scan report upload)). We do not provide health-related information or genetic data to enterprise customers.
Other users and the public. Certain user-generated content, including your health-related data and other data you submit to us may be visible to other users and the public, such as when you post comments in publicly accessible parts of the Service or provide a testimonial that is intended to be public. This information can be seen, collected and used by others, including being cached, copied, screen captured or stored elsewhere by others (e.g., search engines), and we are not responsible for any such use of this information. Once you publish content, it may be copied and stored on third-party systems where you might not have the ability to have it deleted.
Sharing & Disclosure · Company practice
Online activity data ad-sharing recipients
The online activity data row lists ad partners/networks for cross-context behavioral-advertising sharing and N/A for sale recipients. These columns are distinct; the narrative exclusion for health-related/genetic information still applies. No universal no-sale promise is inferred from N/A.
Supporting quotations
Online activity data
Ad partners/networks
N/A
Advertising partners and ad networks. Third-party advertising companies for the interest-based advertising purposes described above. We do not provide health-related information or genetic data to such advertising partners.
Not stated here
The table does not define N/A.
Use & Processing · Company practice
Tracking-technology data categories and purposes
The state table classifies tracking-technology data as identifiers and internet activity. Listed purposes include service operations, insights/development, direct and interest-based marketing, promotions/contests/events, compliance/protection, corporate events, consent and aggregation/de-identification/anonymization. Health-related and genetic information remains excluded from interest-based advertising.
Supporting quotations
Tracking technology data
Identifiers
Internet activity
Service delivery and operations
Insights and development
Direct Marketing
Interest-based advertising
Promotions, and contests, and events
Compliance and protection
Data sharing in the context of corporate events
With your consent
To create aggregated, de-identified and/or anonymized data
Interest-based advertising. Our third-party advertising partners may use cookies, pixels and other technologies to collect information about your interaction (including the data described in the automatic data collection section above) with the Service, our communications and other third-party online services over time, and use that information to serve online ads that they think will interest you. This is called interest-based advertising. We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms. We do not use health-related information or genetic data for interest-based advertising.
Sharing & Disclosure · Company practice
Tracking-technology data business disclosures
The tracking-technology data row lists affiliates, service providers, payment processors, research partners, labs/providers, enterprise customers, designated parties, business/marketing partners, advisers, authorities and others, business transferees/advisers, and users/the public as business-purpose recipients. Narrative conditions still apply: enterprise disclosures are limited and exclude health/genetic data, designated sharing follows your instructions or consent, advisers receive information where necessary, and public visibility concerns public submissions.
Supporting quotations
Tracking technology data
Affiliates
Service providers
Payment processors
Research partners
Lab and provider partners
Enterprise customers
Third parties designated by you
Business and marketing partners
Professional advisors
Authorities and others
Business transferees and their advisors
Other users and the public
Enterprise customers. We may share certain limited personal information with the relevant enterprise customers through which you received access to the Services (e.g., if you redeemed the Function membership, the date you used/obtained the Service (for example, the date(s) you booked and completed the Service aspects such as scans, date of scan report upload)). We do not provide health-related information or genetic data to enterprise customers.
Other users and the public. Certain user-generated content, including your health-related data and other data you submit to us may be visible to other users and the public, such as when you post comments in publicly accessible parts of the Service or provide a testimonial that is intended to be public. This information can be seen, collected and used by others, including being cached, copied, screen captured or stored elsewhere by others (e.g., search engines), and we are not responsible for any such use of this information. Once you publish content, it may be copied and stored on third-party systems where you might not have the ability to have it deleted.
Sharing & Disclosure · Company practice
Tracking-technology data ad-sharing recipients
The tracking-technology data row lists ad partners/networks for cross-context behavioral-advertising sharing and N/A for sale recipients. These columns are distinct; the narrative exclusion for health-related/genetic information still applies. No universal no-sale promise is inferred from N/A.
Supporting quotations
Tracking technology data
Ad partners/networks
N/A
Advertising partners and ad networks. Third-party advertising companies for the interest-based advertising purposes described above. We do not provide health-related information or genetic data to such advertising partners.
Not stated here
The table does not define N/A.
Inference & Profiling · Company practice
Inferences categories and purposes
The state table classifies inferences as inferences derived from the preceding personal-information categories. Listed purposes include service operations, insights/development, direct and interest-based marketing, promotions/contests/events, compliance/protection, corporate events, consent and aggregation/de-identification/anonymization. Health-related and genetic information remains excluded from interest-based advertising. Function separately excludes automated profiling decisions that produce legal or similarly significant effects; this does not prohibit all inferences.
Supporting quotations
Inferences from the above kinds of personal information
Inferences
Service delivery and operations
Insights and development
Direct Marketing
Interest-based advertising
Promotions, and contests, and events
Compliance and protection
Data sharing in the context of corporate events
With your consent
To create aggregated, de-identified and/or anonymized data
Interest-based advertising. Our third-party advertising partners may use cookies, pixels and other technologies to collect information about your interaction (including the data described in the automatic data collection section above) with the Service, our communications and other third-party online services over time, and use that information to serve online ads that they think will interest you. This is called interest-based advertising. We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms. We do not use health-related information or genetic data for interest-based advertising.
Automated decision making. We do not use your personal information to engage in automated processing or profiling personal information to evaluate, analyze, or predict personal aspects related to your economic situation, health, personal preferences, interests, reliability, behavior, location, or movements to make a decision that produces legal or similarly significant effects.
Sharing & Disclosure · Company practice
Inferences business disclosures
The inferences row lists affiliates, service providers, payment processors, research partners, labs/providers, enterprise customers, designated parties, business/marketing partners, advisers, authorities and others, business transferees/advisers, and users/the public as business-purpose recipients. Narrative conditions still apply: enterprise disclosures are limited and exclude health/genetic data, designated sharing follows your instructions or consent, advisers receive information where necessary, and public visibility concerns public submissions.
Supporting quotations
Inferences from the above kinds of personal information
Affiliates
Service providers
Payment processors
Research partners
Lab and provider partners
Enterprise customers
Third parties designated by you
Business and marketing partners
Professional advisors
Authorities and others
Business transferees and their advisors
Other users and the public
Enterprise customers. We may share certain limited personal information with the relevant enterprise customers through which you received access to the Services (e.g., if you redeemed the Function membership, the date you used/obtained the Service (for example, the date(s) you booked and completed the Service aspects such as scans, date of scan report upload)). We do not provide health-related information or genetic data to enterprise customers.
Other users and the public. Certain user-generated content, including your health-related data and other data you submit to us may be visible to other users and the public, such as when you post comments in publicly accessible parts of the Service or provide a testimonial that is intended to be public. This information can be seen, collected and used by others, including being cached, copied, screen captured or stored elsewhere by others (e.g., search engines), and we are not responsible for any such use of this information. Once you publish content, it may be copied and stored on third-party systems where you might not have the ability to have it deleted.
Sharing & Disclosure · Company practice
Inferences ad-sharing recipients
The inferences row lists ad partners/networks for cross-context behavioral-advertising sharing and N/A for sale recipients. These columns are distinct; the narrative exclusion for health-related/genetic information still applies. No universal no-sale promise is inferred from N/A.
Supporting quotations
Inferences from the above kinds of personal information
Ad partners/networks
N/A
Advertising partners and ad networks. Third-party advertising companies for the interest-based advertising purposes described above. We do not provide health-related information or genetic data to such advertising partners.
Not stated here
The table does not define N/A.
Retention & Deletion · Company practice
The state notice repeats purpose-based retention
Function generally keeps data for collection purposes, legal/accounting/reporting needs, claims and fraud prevention. It weighs relationship duration, sensitivity, risks, purpose, alternatives and legal requirements, including legitimate needs after account or service use ends. When no longer needed, data may be deleted, de-identified, anonymized or isolated from further processing; no universal retention period or deletion-only outcome is promised.
Supporting quotations
Retention. We generally retain personal information to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes. To determine the appropriate retention period for personal information, we may consider factors such as length of time we have an ongoing relationship with you and provide services to you; the amount, nature, and sensitivity of the personal information; the potential risk of harm from unauthorized use or disclosure of your personal information; the purposes for which we process your personal information and whether we can achieve those purposes through other means; whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them); whether retention is advisable in light of our legal position, such as in regard to applicable statutes of limitations, litigation or regulatory investigations; and applicable legal requirements. For example, we will retain your personal information for as long as you have an account with us or keep using our services, and the length of time thereafter during which we may have a legitimate need to reference your personal information to address issues that may arise.
When we no longer require the personal information we have collected about you, we may either delete it, de-identify it, anonymize it, or isolate it from further processing.
Data Access & Collection · Company practice
Under-18 collection statement is framed in terms of knowledge
Function says it has no actual knowledge of collecting, selling or sharing information of residents under 18. Separately, the service is not intended for under-18 use, the policy states a no-sale/sharing commitment for minors, and it promises legally required deletion if it learns of child collection without required parental consent. The knowledge statement is not proof that no minor information exists.
Supporting quotations
Consumers under 18. We do not have actual knowledge that we have collected, sold, or shared the personal information of residents who are under 18 years of age.
The Service is not intended for use by anyone under 18 years of age. If you are a parent or guardian of a minor from whom you believe we have collected personal information in a manner prohibited by law, or if information was provided on your behalf when you were under 18, please contact us. If we learn that we have collected personal information through the Service from a child without the consent of the child’s parent or guardian as required by law, we will comply with applicable legal requirements to delete the information.
Other than for targeted advertising purposes, we do not sell personal information (including Sensitive Personal Information), as defined under applicable law. We have not engaged in such activities in the 12 months preceding the date this Privacy Policy was last updated. Without limiting the foregoing, we do not sell or "share"/knowingly sell or "share" personal information (including Sensitive Personal Information) of minors under 18 years of age.
Sharing & Disclosure · User right or choice
Nevada residents can opt out of potential future monetary sales
Nevada residents may opt out of sales, as defined, of certain personal information for monetary consideration. Function says it does not currently engage in such sales but offers an email route to opt out of potential future sales. The saved source masks that address, so this card cannot provide the actual email.
Supporting quotations
Additional information for Nevada residents. Nevada residents have the right to opt-out of the sale, as defined, of certain personal information for monetary consideration. While we do not currently engage in such sales, if you are a Nevada resident and would like to make a request to opt out of any potential future sales, please email [[email protected]](https://www.functionhealth.com/cdn-cgi/l/email-protection).
Not stated here
The source renders the Nevada contact email as an email-protection placeholder; its actual address is not supplied.
Legal Rights & Agreement Rules · Context
What this policy covers
This policy covers Function Health and certain affiliates' linked websites, apps, social media, marketing, events and other described services. Specific products may have supplemental or separate notices, including Ezra's linked policy. Third-party services are outside this policy, even when Function links or refers you to them; those policies are not supplied here.
Supporting quotations
This Privacy Policy describes how Function Health, Inc. and certain of its corporate affiliates (collectively, “Function,” “we,” “us” or “our”) process personal information that we collect or otherwise generate through our digital or online properties or services that link to this Privacy Policy (including as applicable, our website, mobile applications, social media pages) as well as our marketing activities, live events and other activities described in this Privacy Policy (collectively, the “Service”). Function may provide to individuals supplemental or separate privacy policies for specific products or services that we offer including those at the time we collect personal information (also known as “just-in-time” disclosures). For example, for information about how our corporate affiliate Ezra AI, Inc. processes personal information, please see Ezra’s privacy policy, available at https://ezra.com/privacy.
This Privacy Policy does not apply to third-party websites, applications, products, services or other properties even if they may link to our Service or we may refer you to such third parties as part of our Service. In addition, our content may be integrated into web pages or other online services that are not associated with us. These links, relationships and other integrations are not an endorsement of, or representation that we are affiliated with, any third party. We do not control websites, mobile applications or services operated by third parties, and we are not responsible for their actions. We encourage you to read the privacy policies of the other websites, mobile applications and services you use.
Not stated here
Ezra's linked privacy policy is not supplied here; this card cannot describe Ezra's separate processing practices.
Legal Rights & Agreement Rules · Context
Consumer health data has a supplemental policy
Function may process information identifying past, present or future physical or mental health. Where applicable state consumer-health-data laws cover it, a separate Consumer Health Data Privacy Policy supplements this policy. Its terms are not supplied in this analysis.
Supporting quotations
Function may process personal information that identifies your past, present, or future health or mental health status, or that otherwise constitutes “consumer health data” or equivalent terms as defined by applicable US state laws (“Consumer Health Data”). To the extent such laws apply to your Consumer Health Data, please see our Consumer Health Data Privacy Policy, which supplements this Privacy Policy.
Legal Rights & Agreement Rules · Restriction or exception
Enterprise-customer processing is excluded
This policy does not cover information Function receives from and processes on behalf of enterprise customers. Employer-provided eligibility information, for example, may instead be governed by the customer's agreement, including a business associate agreement where applicable. Questions about that processing should go to the enterprise customer.
Supporting quotations
This Privacy Policy does not apply to personal information that we receive from and process on behalf of our enterprise customers while providing Function services to them. For example, to the extent that we receive your personal information from your employer related to your eligibility for our Service, our use of that personal information may be governed by our agreements (including, as applicable, a business associate agreement) with the relevant enterprise customer. If you have questions regarding your personal information that we process on behalf of an enterprise customer, please direct your questions to the relevant enterprise customer.
Data Access & Collection · Company practice
Collection varies with your relationship and use
Function's collection depends on your relationship and interaction with the service; an enterprise prospect's representative provides less information than a member obtaining tests. Information provided or generated may include contact and address details, age, gender, race or ethnicity, sex assigned at birth, sexual orientation, account credentials, photographs, social profiles, preferences and survey or promotion participation.
Supporting quotations
The personal information we collect may differ depending on your relationship with us. For example, if you are a representative of a prospective enterprise customer, we will collect limited personal information in comparison to if you were a Function member who obtains tests through Function. Please consider your relationship with us in the context of reading this Privacy Policy.
Information you provide to us or that we generate about you. Depending on how you interact with the Service, the personal information you may provide to us through the Service or that we generate about you or otherwise may include:
Contact data, such as your first and last name, salutation, email address, billing and mailing addresses, and phone number.
Demographic data, such as your city, state, country of residence, postal code, age, date of birth, gender or gender identity, racial or ethnic identity, assigned sex at birth, and sexual orientation.
Account data, such as the username and password that you may set to establish an online account on the Service, date of birth, biographical details, photograph or picture, links to your profiles on social networks, preferences, information about your participation in our promotions or surveys, and any other information that you add to your account profile.
Legal Rights & Agreement Rules · Context
Additional notice for U.S. residents
The policy directs U.S. residents to its State Privacy Rights Notice at Collection for additional information. Specific rights and exclusions depend on that notice's conditions.
Supporting quotations
NOTICE TO U.S. STATE RESIDENTS: Please see the U.S. State Privacy Rights Notice at Collection section of this Privacy Policy for additional information if you are a U.S. resident.
Legal Rights & Agreement Rules · Context
HIPAA does not cover every piece of information
Function and its affiliates may act as HIPAA business associates, but the policy says HIPAA does not apply to all personal information they process. The company describes protective measures and privacy principles without promising universal HIPAA coverage.
Supporting quotations
We built Function for families, ourselves and you. Your privacy is one of our top priorities. We empower you to take control of your health and that includes having control of certain aspects of your personal information. While Function and its corporate affiliates may operate as a “business associate” as the Health Insurance Portability and Accountability Act (“HIPAA”) defines that term, HIPAA does not apply to all personal information that we process. Regardless, we leverage measures designed to protect and process your personal information in accordance with our guiding privacy principles below and as otherwise stated in this Privacy Policy. Please read the Privacy Policy in full to understand our personal information practices.
Sharing & Disclosure · Company commitment
No ordinary-course disclosure for money is a limited promise
Function says it does not disclose personal information to third parties for money in ordinary daily operations. This is not a promise of no sharing: advertising partners may collect interaction data and Function may share user information for interest-based advertising. Function says it does not use health-related or genetic information for that advertising.
Supporting quotations
Your identity is not for sale for money. In the ordinary course of our daily operations, we do not disclose your personal information to third parties in exchange for money. For more information on how we may disclose your personal information, please see How we share your personal information.
Interest-based advertising. Our third-party advertising partners may use cookies, pixels and other technologies to collect information about your interaction (including the data described in the automatic data collection section above) with the Service, our communications and other third-party online services over time, and use that information to serve online ads that they think will interest you. This is called interest-based advertising. We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms. We do not use health-related information or genetic data for interest-based advertising.
Retention & Deletion · Company practice
Retention depends on purpose and legal needs
Function says it collects data to provide its products and services and retains it as needed for collection purposes, member interests and legal requirements. Retention can cover the account or service relationship and a later period of legitimate need, including legal claims, accounting, reporting or fraud prevention. The policy gives factors, not a universal fixed deletion deadline.
Supporting quotations
We limit the information we collect and retain. We collect personal information to provide you with our products and Services. We retain your personal information for the period of time necessary to fulfill the purposes for which we collected it, including delivering requested products and Services, protecting the interests of our members, and for the period of time required by law.
We generally retain personal information to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes. To determine the appropriate retention period for personal information, we may consider factors such as length of time we have an ongoing relationship with you and provide services to you; the amount, nature, and sensitivity of the personal information; the potential risk of harm from unauthorized use or disclosure of your personal information; the purposes for which we process your personal information and whether we can achieve those purposes through other means; whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them); whether retention is advisable in light of our legal position, such as in regard to applicable statutes of limitations, litigation or regulatory investigations; and applicable legal requirements. For example, we will retain your personal information for as long as you have an account with us or keep using our services, and the length of time thereafter during which we may have a legitimate need to reference your personal information to address issues that may arise.
Sharing & Disclosure · Company commitment
Provider sharing is subject to use limits
Delivering the service may require sharing certain information with labs and other provider partners. Function says it limits how those recipients may use personal information and how it shares test results; this does not promise that no test results are disclosed.
Supporting quotations
We limit the manners in which we share your test results with third parties. In order to deliver our product and Services to you, it may be necessary for us to provide certain information to our lab and other provider partners. We limit how such recipients may use your personal information.
Cross-references
qualifies (model-proposed): Labs and medical providers may receive information — qualifies: The opening principles say Function limits provider uses when information is shared to deliver the service; the later provider-recipient list should be read with that qualification.
Sharing & Disclosure · Company practice
Advertising sharing excludes health and genetic data
Advertising partners may track interactions across the service, communications and other online services to show interest-based ads. Function may share user information to reach users or similar audiences on other platforms, but says it does not use health-related or genetic information for this advertising or provide it to advertising partners.
Supporting quotations
Interest-based advertising. Our third-party advertising partners may use cookies, pixels and other technologies to collect information about your interaction (including the data described in the automatic data collection section above) with the Service, our communications and other third-party online services over time, and use that information to serve online ads that they think will interest you. This is called interest-based advertising. We may also share information about our users with these companies to facilitate interest-based advertising to those or similar users on other online platforms. We do not use health-related information or genetic data for interest-based advertising.
Advertising partners and ad networks. Third-party advertising companies for the interest-based advertising purposes described above. We do not provide health-related information or genetic data to such advertising partners.
Sharing & Disclosure · Company practice
Feedback may become a public testimonial
Function may use your feedback to post comments about your service experience on its website and in marketing or promotional materials.
Supporting quotations
Testimonials. We may use your feedback to post comments about your experience with any Service on the website, in our marketing and promotional materials.
Use & Processing · Company practice
Information supports contests, promotions and events
Function may use personal information to administer promotions, contests and events and communicate with you about those in which you participate.
Supporting quotations
We may use your personal information to administer promotions and contests and to communicate with you about any such promotions or contests in which you participate.
We may use your personal information to administer events and communicate with you about events in which you participate.
Legal Rights & Agreement Rules · Company practice
Legal compliance, protection and enforcement uses
Function may use personal information for applicable laws, lawful requests and legal process; protecting rights, privacy, health, safety or property; legal claims; compliance audits; enforcing service terms; and detecting or deterring harmful, fraudulent, unauthorized, unethical or illegal conduct.
Supporting quotations
Compliance and protection. We may use your personal information to:
comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas, court orders, investigations or requests from government authorities;
protect our, your or others’ rights, privacy, health, safety or property (including by making and defending legal claims);
audit our internal processes for compliance with legal and contractual requirements or our internal policies;
enforce the terms and conditions that govern the Service; and
prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft.
Not stated here
The service terms and conditions referenced here are not supplied; this card cannot describe the underlying duties or remedies they contain.
Sharing & Disclosure · Company practice
Corporate events may involve data sharing
Function may share certain personal information for actual or prospective corporate events with its advisers, actual or prospective counterparties and their advisers. This includes prospective events, not only completed transactions.
Supporting quotations
Data sharing in the context of corporate events, we may share certain personal information in the context of actual or prospective corporate events with our advisors, the prospective or actual counterparties to the corporate event and their advisors.
Legal Rights & Agreement Rules · Company practice
Specific consent may be requested
Function may specifically ask for consent to collect, use or share personal information in some cases, such as when law requires it. This does not promise a separate consent request for every activity described in the policy.
Supporting quotations
With your consent. In some cases, we may specifically ask for your consent to collect, use or share your personal information, such as when required by law.
Use & Processing · Company practice
De-identified data may be used and shared for business purposes
Function may aggregate, de-identify or anonymize information by removing identifying information and use or share the resulting data for lawful business purposes, including improvement, promotion and research. It promises not to attempt re-identification except as required or permitted by applicable law.
Supporting quotations
To create aggregated, de-identified and/or anonymized data. We may create aggregated, de-identified and/or anonymized data from your personal information and other individuals whose personal information we collect. We make personal information into de-identified and/or anonymized data by removing information that makes the data identifiable to you. Except as required or permitted by applicable law, we will not attempt to re-identify any data that has been aggregated, de-identified and/or anonymized. We may use this aggregated, de-identified and/or anonymized data and share it with third parties for our lawful business purposes, including to analyze and improve the Service, promote our business, and for research purposes.
Use & Processing · Company practice
Cookies support operation, functionality and analytics
In addition to other described uses, cookies and similar technologies may remember selections or login status, enhance performance and functionality, and analyze navigation and email interactions. Function may use Google Analytics and links to Google's opt-out resource; this analysis does not supply that linked resource's instructions.
Supporting quotations
Cookies and similar technologies. In addition to the other uses included in this section, we may use the Cookies and similar technologies described above for the following purposes:
Technical operation. To allow the technical operation of the Service, such as by remembering your selections and preferences as you navigate the site, and whether you are logged in when you visit password protected areas of the Service.
Functionality. To enhance the performance and functionality of our services.
Analytics. To help us understand user activity on the Service, including which pages are most and least visited and how visitors move around the Service, as well as user interactions with our emails. For example, we may use Google Analytics for this purpose. You can learn more about Google Analytics and how to prevent the use of Google Analytics relating to your use of our sites here: https://tools.google.com/dlpage/gaoptout?hl=en.
Not stated here
The linked Google Analytics opt-out page is not supplied here; its detailed instructions and effectiveness cannot be assessed from this source.
Sharing & Disclosure · Company practice
Affiliates and service providers may receive information
Function may share personal information with its parent, subsidiaries and affiliates and with providers supporting its business or service, including hosting, IT, support, research, marketing, analytics and online chat providers using generative AI. Sharing can also be described in other applicable notices or at collection; this passage does not itself establish AI training rights.
Supporting quotations
We may share your personal information with the following parties and as otherwise described in this Privacy Policy, in other applicable notices, or at the time of collection.
Affiliates. Such as our corporate parent, subsidiaries and affiliates, including certain members of the Function Health group of companies.
Service providers. Third parties that provide services on our behalf or help us operate the Service or our business (such as online chat functionality providers (including those that leverage generative AI technologies), hosting, information technology, customer support, email delivery, marketing, consumer research and website analytics).
Charges & Financial Obligations · Company practice
Payment processors collect card details directly
Payment processors such as Stripe directly collect and process payment-card information used for purchases. Stripe may use payment data under its own privacy policy; that policy is not included here.
Supporting quotations
Payment processors. Any payment card information you use to make a purchase on the Service is collected and processed directly by our payment processors, such as Stripe. Stripe may use your payment data in accordance with its privacy policy, https://stripe.com/privacy.
Not stated here
Stripe's linked privacy policy is not supplied, so this card cannot describe Stripe's additional uses or rights.
Sharing & Disclosure · Company practice
Research partners may receive personal information
Function may share personal information with research partners to conduct research. This permission is not expressly limited here to aggregated or de-identified information; the separate de-identification provision does not impose that limit on this sentence.
Supporting quotations
Research partners. We may share personal information with research partners to conduct research.
Sharing & Disclosure · Company practice
Labs and medical providers may receive information
Function may share personal information with healthcare, laboratory and other medical or medical-adjacent providers. The policy's opening principles say it limits recipients' uses when sharing information needed to deliver the service.
Supporting quotations
Lab and provider partners. We may share your personal information with healthcare services providers, laboratory services providers, and other providers of medical and medical-adjacent services.