Consumer Health Data Privacy Policy

Operator

The operator is Pharma Coa S.L., 4354 collins avenue, Miami Beach , [email protected]. Exosome Therapy USA is an information site and not a clinic, and no HIPAA rules govern it as a covered entity. The notice is written for three statutes: Washington's My Health My Data Act, the consumer health data provisions of Nevada law (NRS 603A.400 to 603A.550) and the Connecticut Data Privacy Act.

Data and purposes

Categories. The name, email address, phone number and ZIP code you type, the cosmetic treatment you pick from the list, and a log of your consent (time, wording versions, shortened network address). Choosing a treatment can hint at a health concern or at a health service you are weighing, so each item is handled as consumer health data.

Purposes. Placing you on the waitlist and emailing you when a verified clinic covers your ZIP code; calling or texting you, as the one consent box on the form says; and keeping proof of consent. Nothing else.

Retention. An automated daily job erases each entry once 12 months have passed since sign-up, or sooner on request. After erasure we keep for 3 years a coded fingerprint of the phone number and email, plus consent dates and wording versions, with no name, ZIP code or treatment.

Storage. A database managed by our hosting provider, located in the European Union and opened only by the staff who run the waitlist.

Origin of the data

You are the only source. The data arrives through the waitlist form. It is not bought, not read off your browsing and not pulled from other places.

Recipients

Categories of third parties and affiliates that receive consumer health data: none. Our hosting and database provider, Cloudflare, Inc., operates as our processor and is bound by contract to follow our instructions.

Should a partner clinic be added, you would be asked first for a separate consent naming that clinic. If the clinic pays for your contact, a separate signed authorization to sell would follow, and we would keep a copy.

Outside tracking

No outside party gathers consumer health data about you through this site, whether over time or across other sites and online services. We use no cookies, ad pixels or third-party scripts.

Exercising your rights

Write to [email protected] with "Consumer health data request" as the subject. You may ask for confirmation of whether we collect, share or sell your data, with a copy and a list of the third parties that received it (currently none). You may also withdraw consent, correct the data or have it deleted. To match a request to your entry we may ask you to write from your sign-up email or quote the phone number you gave.

You get an answer within 45 days (one 45-day extension, with reasons). Deletion follows within 30 days after we confirm the request, and our processors are told to delete as well; backups may outlast that, within legal limits. Two requests a year are free, and making them has no effect on how we treat you.

If we say no

Reply to the refusal with "Appeal" in the subject line. A written decision, with reasons, follows within 45 days. Still unsatisfied? Complain to your state's Attorney General: Washington, Nevada, Connecticut.

Updates

A change to the data we collect, the purposes or the recipients leads to a revised policy with a new effective date, an email to you if we hold one, and a fresh request for consent before the change reaches your data.