Consumer Health Data Privacy Policy

Effective Date: January 1, 2025

Last Updated: July 16, 2025

1. Purpose

This policy explains how Outfront Health (“Outfront,” “we,” “us,” or “our”) collects, uses, protects, and shares consumer health data (CHD), including lab results, biometric measurements, and other health indicators obtained through:

At-home blood testing kits
In-home or event-based physical screening
Self-reported health information

This Policy complements our general Privacy Policy and provides additional protections specific to sensitive health information.

2. Key Definitions

Consumer Health Data (CHD): Health-related data including lab results, vitals, body composition, heart rhythm, grip strength, balance metrics, and other measurements.
Personal Health Information (PHI): Data that identifies you and relates to your health, covered by HIPAA when applicable.
De-Identified Data: CHD stripped of identifiers, used for research, analytics, or aggregated reporting.
Authorized Personnel: Labs, clinicians, certified technicians, or other trained professionals who collect, process, or interpret CHD.

3. Collection of Health Data

At-Home Blood Testing: Users provide samples via kits. We collect results from third-party CLIA-certified labs.
In-Home or Event-Based Screenings: Trained personnel collect biometric data. All personnel are bound by confidentiality agreements.
Self-Reported Health Information: Voluntarily provided by users through forms, surveys, or app inputs.

4. Use of Health Data

Service Delivery: Processing lab results, generating reports, providing optional follow-up consultation as required by law.
Health Insights & Recommendations: Offering educational resources, wellness insights, and non-diagnostic suggestions.
Research & Analytics: Aggregate or de-identified data may be used to improve services, develop health studies, or for internal analytics.
Regulatory Compliance: Meeting legal, regulatory, or public health reporting requirements.

5. Sharing Health Data

CHD is only shared as necessary to provide Services:

Labs & Clinicians: For testing, interpretation, and legally mandated counseling for certain positive results.
Mobile Screening Personnel: Trained and licensed professionals bound by confidentiality and applicable laws.
Business Associates: Payment processors, analytics providers, or support platforms that need access to deliver services, under confidentiality agreements.
Legal & Public Health Authorities: As required by law or court order.

No Sale for Monetary Gain: We do not sell CHD. Certain state laws may treat cross-site tracking or research sharing as a “sale,” allowing opt-out rights.

6. Data Retention & Security

Retention: CHD is retained only as long as necessary to provide services or comply with laws. De-identified data may be stored indefinitely.
Security Measures: Encryption, secure servers, role-based access, and firewalls protect CHD. Users are responsible for safeguarding account access.
Destruction of Samples: Physical samples are discarded or returned according to lab and regulatory requirements.

7. User Rights Regarding Health Data

Depending on your state, you may have:

Access & Portability: Right to view or obtain a copy of your CHD
Correction: Right to request corrections for inaccurate data
Deletion: Right to request deletion of CHD (subject to legal retention requirements)
Limit Use/Sharing: Right to restrict use of CHD for research or marketing
Non-Discrimination: You will not be penalized for exercising your rights

Exercise your rights: privacy@outfronthealth.com

8. HIPAA & Protected Health Information

Outfront Health is not a HIPAA-covered entity, but labs, clinicians, and certain telehealth partners may be.
CHD provided to these partners may be protected under HIPAA.
De-identified CHD is not considered PHI.

9. Consent & Authorization

By using Outfront Health Services, you provide explicit consent to:

Collection, processing, and storage of CHD
Sharing CHD with labs, clinicians, and authorized personnel for service delivery or legal compliance
Optional use of de-identified CHD for research, analytics, and service improvement

For certain services, you may also sign informed consent or liability waivers detailing data use.

10. Changes to this CHD Privacy Policy

We may update this Policy to reflect changes in law, practice, or services:

“Last Updated” date will reflect changes
Major updates may be communicated via email or website notice
Continued use constitutes acceptance of updated terms

11. Contact

Questions or to exercise your CHD rights:

Email: privacy@outfronthealth.com

Mail: Outfront Health, 15169 N Scottsdale Rd., Scottsdale, AZ 85254

Consumer Health Data Privacy Policy