Woven Health Collective Privacy Policy

Last updated: July 27, 2026

WE ENCOURAGE YOU TO READ THIS PRIVACY POLICY CAREFULLY TO UNDERSTAND OUR DATA PRACTICES.

We at Woven Health Collective, LLC (“Woven” or “we”) respect your concerns about privacy and value the relationship that we have with you. This Privacy Policy (this “Policy”) explains what information we collect, how we intend to use that information, with whom we share it, how long we keep it and how to contact us if you have any queries or concerns about our use of your Personal Information (defined below). This Policy applies to Woven online and offline services and anywhere this Policy is posted including the Sites (defined below), (the “Service(s)”).

However, this Policy does not apply to our job applicants, current employees, former employees, or independent contractors (collectively, “Personnel”). Our Canadian and California-based Personnel may obtain a separate privacy notice that applies to them by contacting our human resources department at privacy@wovenhc.com.

Your use of the websites that Woven controls (collectively, the “Site(s)”) is also subject to our Terms and Conditions.  In the event of a conflict between any other Woven policy, notice, or statement and this Policy, this Policy will prevail as to our data practices unless stated otherwise.

In this Policy, the term “Personal Information” or “PI” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual, consumer or household, and includes personal data as described in Data Protection Laws (as defined below).

We will handle your Personal Information in accordance with applicable Data Protection Laws, if any. “Data Protection Laws” means any applicable law relating to the processing of Personal Information, including the California Consumer Privacy Act, as amended, the Colorado Privacy Act, the Iowa Consumer Data Protection Act, the Nebraska Data Privacy Act, the Tennessee Information Protection Act, the Texas Data Privacy and Security Act, the Utah Consumer Privacy Act, the Virginia Consumer Data Protection Act, applicable Canada federal and essentially similar provincial privacy laws, and all rules and regulations promulgated under the foregoing.  You may have certain privacy rights under such Data Protection Laws.

If you are a resident of California, Colorado, Iowa, Nebraska, Tennessee, Texas, Utah or Virginia, please see “Your US Privacy Rights” or if you are a resident of Canada please see “Your Canada Privacy Rights”, respectively, below for more information about your privacy rights under Data Protection Laws.

Note that although we are not a “data processor” for purposes of the European Union’s General Data Protection Regulation (the “GDPR”), we comply with the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework as set forth by the US Department of Commerce.  Our participation in this program allows for transfers of Personal Information from the European Union to us in the United States in compliance with the GDPR.   For further information, see “EU-U.S. Data Privacy Framework,” below. To learn more about the Data Privacy Framework (“DPF”) program, and to view our certification page, please visit https://www.dataprivacyframework.gov. 

To contact us with questions about this Policy, or any other privacy-related issues, see “How to Contact Us”, below.

Information We Collect, Disclose and Retain

We collect, disclose, and retain Personal Information as follows:

For Canada residents, we may decide to sell or transfer all or part of our business to a third party, merge with another entity, secure our assets or proceed with any other financing or other strategic capital transactions (including insolvency or bankruptcy proceedings), restructuring, share sale or other change in corporate control. We may share your personal information when required for the purposes of such a transaction in compliance with applicable Data Protection Laws.

As permitted by applicable law, we do not treat deidentified data, anonymized or aggregate consumer information as PI, in compliance with applicable Data Protection Laws. We will not attempt to reidentify data that we maintain as deidentified. 

Retention of Personal Information

The length of time for which we retain each category of Personal Information described above depends on the purposes for which we collected and use it and as required to comply with applicable laws. We keep your Personal Information for no longer than reasonably necessary to achieve the purposes for which it was collected or processed.  The criteria used to determine the period of time such Personal Information is retained includes the nature and sensitivity of the Personal Information, the potential risk of harm from unauthorized use or disclosure of the Personal Information, as well as on the basis of applicable legal requirements (such as applicable statutes of limitation).

Sources of Information

We may collect the Personal Information described above from the following sources:

• From You Directly. We may collect Personal Information from you directly, such as when you communicate with us, visit our Sites, or engage us for Services.

• From Our Clients. We may collect Personal Information about you from our clients in connection with the services we provide to our clients.

• Systems and Platforms. We may also collect Personal Information from your devices when you interact with our Sites using technologies such as cookies. Some of these technologies may be operated by third parties. For more information, please consult the section “Choices : Tracking and Communications Options” below.

• Vendors. We may utilize vendors that perform various services at our direction, including collecting Personal Information on our behalf to enable the Services.

• Social Media. Our Sites may, from time to time, contain links to and from social media platforms. You may choose to connect to us through a social media platform, such as Facebook, LinkedIn or X, and when you send us a direct message, we may collect additional information from you, such as your screen names, profile picture, and contact information through the social media platform so that we can respond to your direct inquiry. Additionally, please be advised that social media platforms may also collect information from you. When you click on a social plug-in, such as Facebook’s and LinkedIn’s “Like” button or X’s “tweet” button, that particular social network plugin will be activated and your browser will directly connect to that provider’s servers. We do not have control over the collection, use and sharing practices of social media platforms and encourage you to review their usage and disclosure policies and practices, including the data security practices, before using the social media platforms.

How We Use Your Personal Information

Woven uses your Personal Information for the following business purposes (collectively referred to in this Policy as “Additional Business Purposes”):

• to provide and administer our services to you;

• to provide you with support and to respond to inquiries;

• to perform internal research for technological development to measure and improve our Sites and features;

• for auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards;

• for internal record-keeping;

• to provide updates about our Services;

• for advertising and marketing purposes. We may disclose your Personal Information for purposes of cross-contextual behavioral advertising, such as when Third-Party Digital Businesses (defined below) collect your Personal Information via third-party cookies;

• to help ensure the security and integrity of our Sites and Services;

• to notify you about a material change to this Policy, if necessary, or to contact you in response to sign-up forms;

• in connection with voluntary surveys or contests. Contact information will be used to notify winners and award prizes. Survey information will be used for purposes of monitoring or improving the use and satisfaction of our Sites;

• to protect the rights of Woven and others, to the extent permissible under applicable Data Protection Laws. There may be instances when we may disclose your Personal Information, including situations where we have a good faith belief that such processing is necessary, in order to:

  • protect, enforce, or defend the legal rights, privacy, safety or property of Woven, our affiliates or their employees, agents and contractors;

  • protect the safety, privacy and security of users of our Service(s) or members of the public; or

  • protect against fraud or for risk management purposes;

• to comply with applicable laws or legal process and respond to requests from public and government authorities;

• in connection with an acquisition, merger, asset sale, or other transaction where another party assumes control over all or part of our business;

• for additional purposes explained at the time of collection; and

• to disclose such Personal Information to other parties at your direction or through your actions.

YOUR US PRIVACY RIGHTS

As described more below, subject to our ability to verify your request and limitations permitted by applicable laws, Woven provides residents of California, Colorado,  Iowa, Nebraska, Tennessee, Texas, Utah or Virginia the privacy rights described in this section.  If you are not a resident of these states, you do not have the rights described below.

To submit a request to exercise your privacy rights, or to submit a request as an authorized agent, see “How to Exercise Your Consumer Privacy Rights,” below. The rights we accommodate are as follows:

(a) Right to Access

You may access your PI up to twice in a 12-month period.  

(1) Categories of Personal Information

You have a right to request the following:

• The categories of PI we have collected about you.

• The categories of sources from which we collected your PI.

• The business purposes or commercial purposes for our collecting, selling, or sharing your PI.

• The categories of third parties to whom we have disclosed your PI.

• A list of the categories of PI disclosed for a business purpose and, for each, the categories of recipients, or that no disclosure occurred.

• A list of the categories of PI Sold or Shared about you and, for each, the categories of recipients, or that no sale or sharing occurred.  

(2) Specific Personal Information

You may request to confirm if we are processing your PI and, if we are, to obtain a transportable copy of your PI that we have collected and are maintaining.

(b) Right to Opt-Out of Selling/Sharing

Residents of the states referred to above have the right to opt out of our selling their PI or sharing their PI for purposes of cross-context behavioral advertising or targeted advertising.

Third-party digital businesses, including social media platforms, analytics companies, data brokers, third-party advertisers, adtech providers and other tech companies that offer digital services (“Third-Party Digital Businesses”) may associate cookies and other tracking technologies that collect PI about you on our Sites, or otherwise collect and process PI that we make available about you, including digital activity information. We understand that giving access to your PI on our Sites, or otherwise, to Third-Party Digital Businesses could be deemed a sale or sharing under Data Protection Laws. We will not sell your PI or share your PI for cross-context behavioral advertising if you request to opt out.

Opt-out for non-cookie PI: If you want opt-out of our sale or sharing of your PI other than PI collected on our Sites by cookies and other tracking technologies, submit a request here.  

Opt-out for cookie PI: If you want to opt-out of our sale or sharing of your PI collected on our Sites by cookies and other tracking technologies, you need to exercise a separate opt-out request on our cookie management tool here.

You must exercise your preferences on each of our websites you visit, from each browser you use, and on each device that you use.  Since your browser opt-out is designated by a cookie, if you clear or block cookies, your preferences will no longer be effective and you will need to enable them again via our cookie management tool.  Beware that if you use ad blocking software, our cookie banner may not appear when you visit our services and you may have to use the link above to access the tool.

Global privacy control (“GPC”):

Our Sites process the GPC signal, which is a signal sent by a platform, technology, or mechanism that when enabled, communicates an individual’s choice to opt-out of the sale and sharing of Personal Information for cross-context behavioral advertising. To use the GPC, you can download an internet browser or a plugin to use on your current internet browser and follow the settings to enable the GPC.  We have configured the settings of our consent management platform to receive and process GPC signals on our Sites. We process the GPC with respect to sales and sharing that may occur in the context of collection of PI by tracking technologies online and apply it to the specific browser on which you enable the GPC. We currently do not, due to technical limitations, process the GPC for opt-outs of sales and sharing in other contexts.  

We do not knowingly sell or share the PI of individuals under 16. If you think we may have unknowingly collected PI of a consumer under 16 years old, please contact us (see “How to Contact Us”, below).

(c) Right to Delete

California residents may request that we delete PI that we have collected from the consumer directly.  Residents of Colorado, Iowa, Nebraska, Tennessee, Texas, Utah or Virginia may request that we delete PI that we have collected from or about the consumer.

(d) Right to Correct Your PI

Residents of the states referred to above may request that we correct inaccuracies in your PI that we maintain and we will correct such PI in accordance with and to the extent required by Data Protection Laws.

(e) How to Exercise Your Consumer Privacy Rights

To submit a request to exercise your privacy rights, or to submit a request as an authorized agent, use our Consumer Rights Request Portal, call us at 833-613-3613 or email us at privacy@wovenhc.com, and respond to any follow-up inquiries we make. Please be aware that we do not accept or process requests through other means (eg, via fax, chats, social media etc.).  

(1) We Must Verify Your Request

When you request to exercise your privacy rights, we may ask you to provide verifying information, such as your name, email, phone number or account information. We will review the information provided and may request additional information via email or other means to ensure we are interacting with the correct individual.  We will not fulfill your request unless you have provided sufficient information for us to reasonably verify you are the consumer about whom we collected PI.  

We verify each request as follows:

• Right to Access:  We verify your request to know the categories of personal information we have collected about you by matching at least two data points you provide with data points we maintain.  We verify your request to know the specific personal information we have collected about you by matching at least three data points you provide with data points we maintain, together with a signed declaration under penalty of perjury that you are the individual whose personal information is the subject of the request. If you fail to provide the requested information, we will be unable to verify you sufficiently to honor your request.

• Right to Delete:  We verify your request to delete personal information by matching at least two data points you provide with data points we maintain.

• Right to Correct:  We verify your request to correct personal information by matching at least two data points you provide with data points we maintain.

• Right to Opt-Out of Selling/Sharing:  We confirm the Personal Information subject to your request by matching at least two data points you provide with data points we maintain.

If we are unable to verify you sufficiently, we will be unable to honor your request. We will use Personal Information that you provide in connection with a request only to verify your identity or authority to make the request and to track and document request responses, unless you also gave it to us for another purpose.

(2) Agent Requests

You may use an authorized agent to make a request for you, subject to our verification of the agent, the agent’s authority to submit requests on your behalf, and of you.  You can learn how to do this by visiting the agent section of our Consumer Rights Request Portal. Once your agent’s authority is confirmed, they may exercise rights on your behalf subject to the verification requirements described above.

Non-Discrimination/Non-Retaliation

We will not discriminate or retaliate against you in a manner prohibited by Data Protection Laws in response to your exercise of your privacy rights.

YOUR CANADA PRIVACY RIGHTS

This section generally applies to Canada residents, subject to certain exceptions.  If you are not a Canada resident, the rights described in this section do not apply to you.

(a) Your Consent to Our Collection, Use and Disclosure of Personal Information

By submitting information to us, you are providing your consent to the collection, use and disclosure of Personal Information as set out in this Policy. In some cases, your consent may be “implied”; ie, your permission is assumed based on your action or inaction at the point of collection, use or sharing of your Personal Information. We will generally obtain consent when we want to use Personal Information for a new purpose or for a purpose other than those stated at the time of collection in this Policy or for a specific service you signed up for or have agreed to participate in, in compliance with Data Protection Laws.

You have choices about the way we handle your Personal Information.

For instance, you can always choose not to receive marketing or promotional messages from us by email by clicking on “unsubscribe” in any email you receive. Please note that even if you have indicated your choice not to receive commercial messages from us, we may still communicate with you in connection with a service, in accordance with Data Protection Laws. In addition, it may take up to ten (10) business days to register a change of preference across all our records.

In addition, you may withdraw your consent to the collection, use and disclosure of Personal Information in accordance with this Policy at any time upon reasonable notice to us in writing, subject to legal or contractual restrictions. To withdraw your consent, please contact us in writing using the relevant contact information listed in the “How to Exercise Your Rights” section below. In certain situations, we may be entitled to retain your Personal Information in order to comply with applicable legal requirements, to establish, exercise or defend our rights or legal claims, and for other necessary business purposes described in this Policy.

(b) Your Privacy Rights

Subject to certain legal limitations and applicable exceptions, Canada residents may exercise the following rights:

• Right to Access. You have the right to request that we disclose to you the categories of Personal Information we have collected about you, the categories of sources from which we collected the Personal Information, the purposes for collecting the Personal Information, the retention period Personal Information will be kept for, the contact information of Woven’s Privacy Officer and the categories of third parties to whom we have disclosed your Personal Information.  You may also request information about the specific Personal Information we have collected about you.

• Right to Rectify. You have the right to request the rectification of Personal Information that is inaccurate, incomplete or no longer up to date. Depending on the jurisdiction where you reside, you may also be entitled to request the rectification of your Personal Information if our collection, disclosure or retention of such information is not authorized by law.

(c) How to Exercise Your Rights

Canada residents may exercise their privacy rights by either:

•    emailing us at privacy@wovenhc.com;

•    calling us at 833-613-3613; or

•    using our Consumer Rights Request Portal and following the instructions.

(d)    Cross-Border Transfers of Personal Information

Some of our service providers may access, process or store your Personal Information outside of the country, province or territory, where we are located and where you reside, including in Canada and the United States. As a result, when your Personal Information is used or stored in a jurisdiction other than where you are residing, it may be subject to the law of this foreign jurisdiction, including any law permitting or requiring disclosure of the information to the government, government agencies, courts and law enforcement in that jurisdiction.

Links to Other Websites

Occasionally we may provide links to third-party websites for your convenience and information. The fact that we include links to other websites does not mean that Woven approves of or endorses any other third-party website or the content of that website. These services operate independently from Woven and are not under our control. These services may have their own privacy notices in place, which we strongly suggest that you review if you choose to visit any linked websites. With the exception of any service(s) to which we refer you to apply for a job with Woven or to receive other Woven specific services, we are not responsible for the content of these websites, any products or services that may be offered through these services, or any other use of these websites. We accept no liability for any statements, information, products, or services that are published on or are accessible through any websites owned or operated by third parties.

Security

Woven maintains reasonable physical, administrative, and technical safeguards to protect your Personal Information against loss and unauthorized disclosure, use, alteration, or destruction. Depending on the volume and sensitivity of the information, the purposes for which it is used and the format in which it is stored, we implement a combination of measures to protect your personal information. However, no data transmissions over the Internet can be guaranteed to be 100% secure. Although we will comply with our data security obligations under applicable Data Protection Laws, we cannot warrant the security of any information you transmit to us and you understand that any information you transfer to Woven involves some risk.

By using the Sites or providing Personal Information to us, you agree that we can communicate with you electronically regarding security, privacy and administrative issues relating to your use of the Sites or Services.

EU-U.S. DATA PRIVACY FRAMEWORK

Woven complies with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, as set forth by the U.S. Department of Commerce.  We have certified to the U.S. Department of Commerce that we adhere to the DPF Principles with regard to the processing of Personal Information received from the European Union in reliance on the EU-U.S. DPF, from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF, and from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between this Policy and the DPF Principles, the DPF Principles shall govern.  Additionally, Woven’s U.S. subsidiaries also adhere to DPF principles. These subsidiaries are: CM Canada Acquisitions, Inc.; MedVal Scientific Information Services, LLC; IC Axon US, Inc.; PharmaWrite, LLC; Innovation Hub Enterprises, LLC; ClinicalMind, LLC; MedVal Holdings, LLC; Sensified Operations, LLC; Boundless Life, LLC; Boundless Life Sciences Group, LLC; Boundless Commercial Consulting, LLC; Boundless AI, LLC; and Boundless Medical Communications, LLC.

To learn more about the EU-U.S. DPF, UK Extension to the EU-U.S. DPF or the Swiss U.S. DPF, please visit https://www.dataprivacyframework.gov/. The U.S. Department of Commerce maintains an authoritative list of U.S. organizations that have self-certified to the DPF (the “DPF List”). The DPF List can be found at https://www.dataprivacyframework.gov/list.

Definitions

In this Section:

“Data Subject” means an identified or identifiable individual whose Personal Information is subject to the GDPR, UK GDPR, or FADP.

“DPF Principles” means the set of requirements governing Woven’s use and treatment of Personal Information received from the European Union, the United Kingdom (and Gibraltar) and Switzerland, as well as the access and recourse mechanisms that Woven must provide to Data Subjects, as described in more detail herein.

“EU-U.S. DPF” means the EU-U.S. Data Privacy Framework.

“FADP” means Switzerland’s Federal Act on Data Protection.

“GDPR” means the Regulation (EU) 2016/679 (General Data Protection Regulation).

“Personal Information” means data about an identified or identifiable individual that are within the scope of the GDPR, UK GDPR, or FADP, received by Woven in the United States from the European Economic Area, United Kingdom and Gibraltar, or Switzerland, and recorded in any form.

“Sensitive Personal Information” means Personal Information regarding an individual's racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, physical or mental health, or sexual life.

“Swiss-U.S. DPF” means the Swiss-U.S. Data Privacy Framework.

“UK Extension to the EU-U.S. DPF” means the UK Extension to the EU-U.S. Data Privacy Framework.

“UK GDPR” has the meaning in section 3 of the UK Data Protection Act 2018.

Scope

This Section applies to our processing of Personal Information transferred to the United States from the European Union, Switzerland, and the United Kingdom in reliance upon the EU-U.S. DPF, Swiss-U.S. DPF and UK Extension to the EU-U.S. DPF, respectively.  Notwithstanding the foregoing, this Section does not apply to Personal Information transferred under Standard Contractual Clauses or any approved derogation under European Union data protection law. This Section also does not apply to Personal Information about our applicants or employees (past or present) collected in the context of the employment relationship (collectively, “HR Personal Information”).

DPF Principles

Woven commits to processing Personal Information in accordance with the DPF Principles as follows:

(a) Notice

This Policy notifies Data Subjects about the categories of Personal Information that Woven receives in reliance on the DPF Principles, the purposes for which it collects and uses their Personal Information, the type of third parties to which we disclose Personal Information, and the purposes for which we do so. Woven will only process Personal Information in ways that are compatible with the purpose for which Woven collected it or for purposes later authorized.

Woven helps biopharmaceutical clients navigate complexity, accelerate the launch of new products and therapeutics, and forge impactful partnerships that shape the future of healthcare. In doing so, we may receive personal information from or concerning individuals in the European Economic Area (EEA), the United Kingdom, and Switzerland regarding our clients’: (1) clinical research subjects; (2) clinical investigators and staff conducting clinical and medical research; (3) potential clinical trial and post‐market patients and their family members/caregivers; (3) adverse event reporters and subjects; (4) consumers; (5) medical and healthcare professionals; (6) customers; (7) vendors, suppliers, contractors, and business partners; and (8) government officials.   The specific types of Personal Information that Woven collects from these types of Data Subjects are described in “Information We Collect, Disclose and Retain,” above.  The purposes for which we process your Personal Information are described in “How We Use Your Personal Information,” above.

(b) Choice

When Woven collects Personal Information received in reliance on the DPF Principles, we will give Data Subjects the ability to opt-out whenever the DPF Principles require, including before we disclose Personal Information to third parties or use Personal Information for a different purpose than that purpose for which it was collected or subsequently authorized by the Data Subject.  However, in the event that we disclose Personal Information to a third party acting as our agent to perform tasks on our behalf and under our instruction, we may not provide Data Subjects an opportunity to opt-out. In such cases, we will enter into a contract with the third party to ensure that Personal Information processing is compliant with the DPF Principles.

If Woven collects Sensitive Personal Information, we will obtain opt-in consent whenever the DPF Principles require, including before we disclose Sensitive Personal Information to a third party or use Sensitive Personal Information for a purpose other than that for which it was originally collected or later authorized. However, we may not obtain opt-in consent with respect to Sensitive Personal Information where:

• the processing is in the vital interests of the Data Subject or another person;

• it is necessary for the establishment of legal claims or defenses;

• it is carried out in the course of legitimate activities by a foundation, association or any other non-profit body provided that the processing relates solely to the members of the body or to persons who are regularly in contact with it in connection to its purposes;

• it is related to Personal Information that are made public by the Data Subject;

• it is required to provide medical care or diagnosis; and

• it is necessary to carry out the organization’s obligations in the field of employment law.

(c) Accountability for Onward Transfer

Woven is committed to complying with the DPF Principles for all onward transfers of Personal Information from the European Union, United Kingdom, and Switzerland, including the onward transfer liability provisions.

Woven may share the types of Personal Information received in reliance on the DPF Principles and described in “(a) Notice” above with data analytics providers, payment processors, and other service providers; other members of our corporate group; governmental entities; data brokers; and social media platforms, analytics companies, third-party advertisers, adtech providers and other tech companies that offer digital marketing services. We may also disclose your personal information to other third parties for the purposes described in “How We Use Your Personal Information,” above..

Such third parties have access to Personal Information received in reliance on the DPF Principles solely for the purposes of performing the services specified in the applicable service contract, and not for any other purpose. Woven requires such third parties to adhere, at minimum, to the same level of privacy protection as required by the DPF Principles. Woven also takes reasonable and appropriate steps to ensure such third parties effectively process personal information in a manner consistent with Woven’s obligations under the DPF Principles. Woven further requires the third parties to notify Woven if such third party determines that it can no longer meet its obligation to provide the same level of protection as required by the DPF Principles. In the event Woven receives notice of  a third party’s unauthorized processing, Woven will take reasonable and appropriate steps to stop and remediate the unauthorized processing. Woven further requires these third parties to undertake security measures consistent with the protections specified in this Section.

In the event we transfer Personal Information received in reliance on the DPF Principles to a third party acting as a controller, we will do so consistent with any notice provided to Data Subjects and any consent they have given (where applicable), and only if the third party has given us contractual assurances that it will (i) process the Personal Information for limited and specified purposes consistent with any consent provided, (ii) provide at least the same level of protection as is required by the DPF Principles and notify us if it makes a determination that it cannot do so; and (iii) cease processing of the Personal Information or take other reasonable and appropriate steps to remediate if it makes such a determination. If Woven has knowledge that a third party acting as a controller is processing Personal Information covered by this Section in a way that is contrary to the DPF Principles, Woven will take reasonable steps to prevent or stop such processing.

We remain responsible for the processing of Personal Information received under the EU-U.S. DPF, UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF and subsequently transferred to a third party acting as an agent if the agent processes such Personal Information in a manner inconsistent with the DPF Principles, unless we prove that we are not responsible for the event giving rise to the damage.

(d) Security

Woven takes reasonable and appropriate measures to protect Personal Information received in reliance on the DPF Principles from loss, misuse and unauthorized access, disclosure, alteration, unavailability, and destruction. In determining these measures, Woven considers the risks involved in the processing and the nature of such Personal Information.

(e) Data Integrity and Purpose Limitation

We may use Personal Information we receive in reliance on the DPF Principles for the purposes indicated in “How We Use Your Personal Information,” above, or as otherwise notified to you. We will not process such Personal Information in a way that is incompatible with these purposes unless subsequently authorized by you.

We take reasonable steps to limit the collection and usage of such Personal Information to that which is relevant for the purposes for which it was collected, and to ensure that such Personal Information is reliable, accurate, complete, and current. Individuals are encouraged to keep their Personal Information with Woven up to date and may contact Woven as indicated below to request that their Personal Information be updated or corrected.

We will retain Personal Information received in reliance on the DPF Principles in an identifiable form only for the period necessary to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by law or by the DPF Principles. We will adhere to the DPF Principles for as long as we retain the Personal Information collected under the EU-U.S. DPF, UK Extension to the EU-U.S. DPF, or Swiss-U.S. DPF, as applicable.

(f) Access

Where appropriate, individuals have reasonable access to their Personal Information and may request corrections, deletions, or additions where the Personal Information is inaccurate or has been processed in violation of the DPF Principles. We may limit or deny access to Personal Information where providing such access is unreasonably burdensome or expensive under the circumstances, or as otherwise permitted by the DPF Principles. You may request access to your Personal Information by contacting us as described below.

(g) Recourse, Enforcement, and Liability

Woven has established procedures to periodically verify implementation of and compliance with the DPF Principles. Woven conducts an annual self-assessment of its practices regarding Personal Information intended to verify that the assertions Woven makes about its practices are true and that such practices have been implemented as represented.

In compliance with the DPF Principles, Woven commits to resolve DPF Principles-related complaints about our collection and use of your Personal Information. Data Subjects with inquiries or complaints regarding our handling of Personal Information received in reliance on the EU-U.S. DPF, UK Extension to the EU-U.S. DPF, or Swiss-U.S. DPF, respectively, should first contact Woven at: insights@wovenhc.com.

In compliance with the EU-U.S. DPF, UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF, Woven commits to refer unresolved complaints concerning our handling of Personal Information received in reliance on the EU-U.S. DPF, UK Extension to the EU-U.S. DPF, or Swiss-U.S. DPF to BBB National Programs, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your Data Privacy Framework Principles-related complaint from us, or if we have not addressed your Data Privacy Framework Principles-related complaint to your satisfaction, please visit https://bbbprograms.org/programs/all-programs/dpf-consumers/ProcessForConsumers for more information or to file a complaint. These dispute resolution services are provided at no cost to you.

If your Data Privacy Framework Principles-related complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See  https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction for more information on this process.

The Federal Trade Commission has jurisdiction over Woven’s compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Changes to this Section

Woven may amend this Section consistent with the requirements of the EU-U.S. DPF, UK Extension to the EU-U.S. DPF, or Swiss-U.S. DPF, including providing notice about any amendment.

How to Contact Woven

If you have any questions about Woven’s participation in the EU-U.S. DPF, UK Extension to the EU-U.S. DPF, or Swiss-U.S. DPF or would like to submit requests for access, correction, amendment, or deletion, please contact us as at privacy@wovenhc.com.

Contact information for relevant EU, UK, and Swiss (if applicable) establishment that can respond to inquiries/complaints:

Email: privacy@wovenhc.com
Woven Health Collective, LLC
123 Lafayette Street, FL 5
New York, NY 10013

CHOICES: TRACKING AND COMMUNICATIONS OPTIONS

Tracking Technologies Generally. Regular cookies may generally be disabled or removed by tools available as part of most commercial browsers, and in some instances blocked in the future by selecting certain settings.  Browsers offer different functionalities and options, so you may need to set them separately.  Also, tools from commercial browsers may not be effective with regard to Flash cookies (also known as locally shared objects), HTML5 cookies, or other tracking technologies.  For information on disabling Flash cookies, go to Adobe’s website http://helpx.adobe.com/flash-player/kb/disable-third-party-local-shared.html.  Please be aware that if you disable or remove these technologies, some parts of the Sites may not work and that when you revisit the Sites your ability to limit browser-based tracking technologies is subject to your browser settings and limitations.

Your browser settings may allow you to automatically transmit a “Do Not Track” signal to online services you visit. Note, however, there is no consensus among industry participants as to what “Do Not Track” means in this context. Like many online services, Woven currently does not alter Woven’s practices when Woven receives a “Do Not Track” signal from a visitor’s browser. To find out more about “Do Not Track,” you can visit http://www.allaboutdnt.com, but Woven is not responsible for the completeness or accuracy of this third party information. Some third parties, however, may offer you choices regarding their tracking technologies. One way to potentially identify cookies on our web site is to add the free Ghostery plug-in to your browser (www.ghostery.com), which according to Ghostery will display for you traditional, browser-based cookies associated with the web sites (but not mobile apps) you visit and privacy and opt-out policies and options of the parties operating those cookies. Woven is not responsible for the completeness or accuracy of this tool or third-party choice notices or mechanisms. For specific information on some of the choice options offered by third party analytics and advertising providers, see the next section. We may, from time-to-time, and in certain jurisdictions, offer or point you to tools that allow you to exercise certain preferences regarding cookies and other tracking technologies associated with the Sites, but such tools rely on third parties and third party information so we do not guaranty that the tools will provide complete and accurate information or be completely effective. For instance, here is where you can find cookie controls for popular browsers:

•    Google Chrome

•    Firefox

•    Edge

•    Safari 

We do not represent that these third-party tools, programs or statements are complete or accurate. You will need to do this on each browser that you use to access our Sites, and clearing cookies on your browser(s) may disable your preference settings. Also, our Sites may not function properly or as intended if you block all or even certain cookies. Accordingly, you may want to consider the more limited opt-out choices noted in the next section.

We currently use the following types of cookies on our Sites:

Performance and Analytics Cookies. With your consent, these cookies are used to understand how visitors interact with the Sites. These cookies help provide information on metrics such as the number of visitors, bounce rate, traffic source, etc. You may exercise choices regarding the use of cookies from Google Analytics by going to https://tools.google.com/dlpage/gaoptout or downloading the Google Analytics Opt-out Browser Add-on. You may exercise choices regarding the use of cookies from Adobe Analytics by going to http://www.adobe.com/privacy/opt-out.html under the section labeled “Tell our customers not to measure your use of their web sites or tailor their online ads for you.”

Advertising Cookies. With your consent, we may also use these cookies, provided by advertising companies, to serve ads that are relevant to your interests. We may use Microsoft Advertising Services. To learn about the data Microsoft collects and how your data is used by it and to opt-out of certain Microsoft browser Interest-based Advertising, please visit here.

With your consent, we may also use Google Ad Services for the same purposes. To learn more about the data Google collects and how your data is used by it and to optout of certain Google browser Interest-Based Advertising, please visit here.

In addition, we may, with your consent, serve ads on other online services that are targeted to reach people on those services that are also identified on one of more of our data bases. This is done by using tracking technologies or by matching common factors between our data bases and the data bases of the other online services. For instance, we may use such ad services offered by Meta, LinkedIn, or X and other third-party services.  We are not responsible for these third-party services, including without limitation their security of the data. You will need to visit each service and change your personal account settings to opt-out of these activities. We are not responsible for such third parties’ failure to comply with your or our opt-out instructions, they may not give us notice of opt-outs to our ads that you give to them, and they may change their options without notice to us or you.

Woven is not responsible for effectiveness of, or compliance with, any third parties’ opt-out options or programs or the accuracy of their statements regarding their programs.

Communications. You can opt out of receiving certain promotional communications (emails or text messaging) from Woven at any time by (i) for promotional emails, following the instructions provided in emails to click on the unsubscribe link, or if available by changing your communication preferences by logging onto your account; and (ii) for text messages, following the instructions provided in text messages from Woven to text the words, “stop,” “quit,” “end,” “revoke,” “opt out,” “cancel,” “unsubscribe,” or similar indications that you wish to stop receiving text messages. Please note that your opt-out is limited to the email address or phone number used and will not affect subsequent subscriptions. If you opt-out of only certain communications, other subscription communications may continue. Even if you opt out of receiving promotional communications, Woven may, subject to applicable law, continue to send you non-promotional communications, such as those about your account, transactions, servicing, or Woven’s ongoing business relations.

International Transfer

Not applicable to Canada residents: Woven is based in the US and the information Woven and its service providers collect is governed by US law. If you are located in the European Union (EU), European Economic Area (EEA), United Kingdom, or Switzerland, please note that Woven does not intend to offer goods and services to EU, EEA, UK, or Swiss individuals. If you are accessing the Sites from outside of the US, please be aware that information collected through the Sites may be transferred to, processed, stored, and used in the US Data protection laws in the US may be different from those of your country of residence.

Woven Health Collective adheres to the EU-U.S. DPF Principles with regard to personal data transferred from the European Union and the United Kingdom and the Swiss-U.S. DPF Principles with regard to personal data transferred from Switzerland.

Changes or Updates to this Policy

We may update or change this Policy from time to time. We will post a notice on our Sites to notify you of any significant changes to our Policy, or contact you to inform you when required by applicable Data Protection Laws, and indicate at the top of the Policy when it was most recently updated. By continuing to interact with us after the modified version of the Policy has been posted, you are accepting the changes to the Policy, subject to any additional requirements that may apply. It is your responsibility to ensure that you read, understand and accept the latest version of the Policy. The “Last Updated” at the top of this Policy indicates when it was last updated.

How to Contact Us

If you have any questions, comments or concerns regarding our privacy practices or this Policy, please contact us at the postal and email addresses below.

US: ATTN: Privacy
Woven Health Collective, LLC
123 Lafayette Street, FL 5
New York, NY  10013
insights@wovenhc.com
646-979-5444

Canada: ATTN: Privacy Officer
123 Lafayette Street, FL 5
New York, NY  10013
security@wovenhc.com
646-979-5444