Privacy Policy for iPrepMD.com
I. Introduction: Who We Are and Why We Collect Your Information
II. What Does This Privacy Policy Cover?
III. What Information Does PrepMD Collect?
A. Information You Provide to Us
B. Information Collected Automatically
C. E-mail and Other Communications
D. Information Obtained from Third Parties
D. Special Categories of Personal Information and Sensitive Personal Information
E. Personal Information PrepMD Has Collected in the Last 12 Months
IV. What Does PrepMD Do With Personal Information?
V. Will PrepMD Share Any of the Personal Information it Collects?
A. Affiliated Businesses and Third Party Websites We Do Not Control
B. Agents and Service Providers
C. Customer Employers
D. Business Transfers
F. Protection of PrepMD and Others
E. With Your Consent
G. Personal Information PrepMD Has Sold in the Last 12 Months
H. Personal Information PrepMD Has Disclosed or Shared with Third Parties in the Last 12 Months
VI. What Is PrepMD’s Legal Basis for Collecting and Using Personal Information
VII. How Long Does PrepMD Retain Personal Information?
VIII. What Are Users’ Rights to Control Their Personal Information?
A. Requests to PrepMD
B. Making Foregoing Requests
C. Authorized Agent
D. Withdrawal of Consent
E. “Do Not Sell My Personal Information” and Opting Out of Sharing Personal Information
F. Object or Challenge
G. Filing a Complaint
H. Prohibit Automated Processing
I. Accessibility for Users with Disabilities
J. Non-Discrimination
IX. What Are PrepMD’s Service Differences?
X. Is Personal Information About Me Secure?
XI. Children’s Privacy
XII. Contractual or Statutory Requirement
XIII. Failure to Provide Personal Information
XIV. Automated Decision Making
XV. Changes to this Privacy Policy
XVI. Questions or Concerns; Contact Information
==
I. Introduction: Who We Are and Why We Collect Your Information
PrepMD, LLC (“PrepMD,” “we,” “us,” “our”) offers online learning resources and courses related to medical device management and related certifications on our website, iprepmd.com (collectively with its sub-websites at iprepmd.com, the “Website”). Additionally, PrepMD’s affiliates may offer services for purchase through the Website. We take privacy of personal information seriously. Please read the following to learn more about our privacy practices. By using the Website, enrolling in our online courses, and/or accessing or using any other functionalities, features, surveys, media, content, applications or services offered from time to time by PrepMD in connection with the Website (collectively, the “Services”) in any manner, you acknowledge that you accept the practices and policies outlined in this Privacy Policy, and you hereby consent to our collection, use, and sharing of your information in the following ways.
II. What Does This Privacy Policy Cover?
This Privacy Policy covers our collection and processing of (1) personally identifiable information (“PII”) protected by data security and breach notification laws in the United States (“PII Laws”), (2) protected health information (“PHI”) under the Health Insurance Portability and Accountability Act (“HIPAA”), if and to the extent we handle PHI as a business associate of a covered entity under HIPAA; (3) information protected by the California Consumer Privacy Act (“CCPA”), California Privacy Rights Act (“CPRA”), and California Online Privacy Protection Act (“CalOPPA”), if and to the extent those laws apply to information that we collect and process, (4) information protected by the New York Stop Hacks and Improve Electronic Data Security Act (“SHIELD Act”), if and to the extent that law applies to information that we collect and process; (5) information protected by the European Union General Data Protection Regulation (“GDPR”), Canadian Personal Information Protection and Electronics Documents Act, and Canadian Provincial corollaries of that Act (collectively, “PIPEDA”), and the Brazilian General Data Protection Law (“LGPD”), if and to the extent those laws apply to information that we collect and process, and (6) personal information the confidentiality, availability, or integrity of which is protected by applicable law (such laws collectively with the PII Laws, HIPAA, CCPA, CPRA, CalOPPA, the SHIELD Act, GDPR, PIPEDA, and LGPD, the “Privacy Laws”) (collectively, “Personal Information”), which we gather when you are accessing, viewing or using the Website and/or Services. Where noted, the terms of this Privacy Policy are limited by the Privacy Laws that govern an individual’s or user’s jurisdiction, such that requirements created by the Privacy Laws of one jurisdiction with regard to Personal Information are not incorporated herein and made to apply to the Personal Information of an individual or user of another jurisdiction if such Privacy Laws would not otherwise govern. This policy does not apply to the practices of companies that we do not own or control, or to individuals that we do not employ or otherwise control.
III. What Information Does PrepMD Collect?
PrepMD endeavors to limit the type and amount of Personal Information that we collect and process to only information necessary to fulfill the purposes identified in this Privacy Policy. With that in mind, we collect and process the following types of information:
A. Information You Provide to Us
We may collect and process Personal Information from and about you when you visit the Website, register for or subscribe to any Services, communicate with us, post information or content to message boards in the Services, answer test questions in the courses, and otherwise interact with the Website or Services. For example, when you create an account on the Website or enroll in a course, we may collect your name, date of birth, contact information (including email address, work or home address, and phone number), payment information (including credit or debit card number, bank account information, or information regarding your loan(s), including the provider and amount), user name or e-mail address in combination with a password or security question, employer, job title and duties, educational background, education and career goals, picture or likeness, social media accounts, and the course you enroll in. Similarly, some courses require users to submit videos as part of the coursework or course evaluations. Additionally, if you communicate with other users through the Services, we may collect the contents of those communications. You can choose not to provide us with certain information, although that may affect the functionality of the Website and Services.
B. Video Recordings of Courses
When you participate in the courses available through the Services, PrepMD may record video of your interaction with the Services, our faculty, or other students. You may also be recorded when you take an exam through the Website and Services.
C. Information Collected Automatically
When you use our Services, certain information is passively collected (that is, gathered without you actively providing the information) using various technologies and means, such as Internet Protocol (IP) addresses and cookies. These are described in more detail below:
• IP Addresses. The Services use IP addresses. An IP address is a number assigned to your device by your internet service provider to access the internet. In most consumer cases an IP address is dynamic (changing each time you connect to the internet), and not static (unique to a particular user’s device).
• Cookies are small text files that are placed on your device by websites that you visit. They are widely used to make websites work, or work more efficiently, and to provide information to the owners of the site. Most web browsers allow some control of cookies through browser settings. We may collect the following information via cookies when you visit the Website or interact with the Services: aggregate statistical information, information related to your use of our Services (including your password, the links you click on, your movement around the Website and Services, the pages you visit, the number of times you open a page, and which information is consulted), period of use, your geographic location, your IP address, your device, your operating system, and your browser type. You may be able to change the preferences on your browser or mobile device to send “do not track” signals or to prevent or limit your computer or device’s acceptance of cookies, but this may affect the functionality of the Services or prevent you from using parts of the Services. If you click on a link to a third-party website or portal, such third party may also transmit cookies to you. This Privacy Policy does not cover the use of cookies by any third parties.
D. E-mail and Other Communications
We may communicate with you by email or other means. When we do this, in addition to the information contained in the email, we may collect a confirmation when you open email or click on links in the email. This confirmation helps us improve our service. If you do not want to receive email or other mail from us, please indicate your preference by visiting our email preference page. Please note that, if you do not want to receive legal notices from us, those legal notices will still govern your use of the websites, and you are responsible for reviewing such legal notices for changes.
E. Information Obtained from Third Parties
In some situations, you may use the Services as part of a contract PrepMD has with your employer (each a “Customer Employer”) to provide the Services to its employees. When that occurs, we may receive the following Personal Information about users from the Customer Employer: name, contact information (including phone number, work address, and email address), job title and duties, and courses to enroll in. PrepMD may purchase marketing and business development leads from direct marketing lead generation services. This information may include names, contact information, and professional bakground.
F. Special Categories of Personal Information and Sensitive Personal Information
Except as otherwise stated in this Privacy Policy, we do not knowingly collect sensitive Personal Information or special categories of Personal Information, including (1) Personal Information revealing racial or ethnic origin, political opinion, religious or philosophical beliefs, or trade union membership, (2) genetic data, biometric data, data concerning health, and data concerning a natural person’s sex life or sexual orientation, and (3) government identifiers (such as Social Security numbers and driver’s licenses), financial account and login information (such as credit or debit card number together with login credentials), precise geolocation, or content of nonpublic communications (mail, email and text messages). As applicable under the relevant Privacy Laws, where we collect and use such information as a processor, contractor, service provider, or similar type of entity, we rely on the controller, business, or similar type of entity to obtain your informed consent.
G. Personal Information PrepMD Has Collected in the Last 12 Months
PrepMD has collected the following categories of Personal Information in the 12 months immediately preceding the Effective Date of this Privacy Policy: names; contact information; payment information; user names and e-mail addresses in combination with passwords and security questions needed to access accounts; employers; job titles and duties; pictures; likenesses; social media accounts; courses enrolled in; content of communications; test answers and scores; IP addresses; information related to the use of the Services; users’ browser types; users’ devices; users’ operating systems; and confirmation when users have read our emails. Please see the other portions of Section III above for an explanation of the categories of sources from which we collect the information described here. The business purposes for the collection and processing of this information are described in Section IV. The categories of third parties we share this information with are described in Section V.
IV. What Does PrepMD Do With Personal Information?
PrepMD collects and uses Personal Information:
• To evaluate your completion of the courses offered through the Website and Services;
• To respond to inquiries and comments;
• To fulfill your requests concerning the Website and the Services;
• To contact you with administrative communications and changes to this Privacy Policy, the Terms of Use, Terms of Access, and our other policies;
• To provide you with information about products or services that we believe will interest you;
• To satisfy our contractual obligations with Customer Employers;
• To tailor content, recommendations, and advertisements we and third parties display to you on the Website, through the Services, and elsewhere online;
• To operate, maintain, develop, and grow PrepMD;
• To operate, develop, maintain, and improve the Website and Services;
• To conduct market research;
• To analyze how visitors use the Website and Services;
• To investigate and resolve disputes and security issues;
• To comply with regulatory and legal obligations; and
• For any other lawful, legitimate business purpose.
PrepMD may anonymize or aggregate Personal Information it collects. It may also use that information and other non-Personal Information it collects when you use or interact with the Website or Services to better understand our users and their behaviour and to improve the user experience of the Website and Services.
We may also share certain Personal Information with third parties, including Customer Employers as applicable (as described in this Section and in Section V below).
V. Will PrepMD Share Any of the Personal Information it Collects?
We share Personal Information with third parties as described below.
A. Agents and Service Providers
We employ other companies and people to perform tasks on our behalf and may need to share Personal Information with them to provide products and services to you. Unless we tell you differently, our agents and service providers do not have any right to use the Personal Information we share with them beyond what is necessary to assist us.
B. Customer Employers
If you have received access to the Website and/or Services pursuant to a contractual relationship we have with your employer, we may share Personal Information with your employer to fulfill our contractual obligations and continue to provide access to you.
C. Business Transfers
We may choose to buy or sell assets. In these types of transactions, Personal Information is typically one of the business assets that is transferred. Also, if we (or all of our assets) are acquired, or if we go out of business, enter bankruptcy, or go through some other change of control, Personal Information would be one of the assets transferred or acquired.
D. Protection of PrepMD and Others
We reserve the right to access, read, preserve, and disclose any information that we reasonably believe necessary to comply with law or court order, enforce or apply our Terms of Use, Terms of Access, or other agreements, or protect the rights, property, or safety of PrepMD, our employees, our users, or others, including exchanging information with other organizations for fraud protection and credit risk reduction.
E. With Your Consent
Except as set forth above, you will be notified when your Personal Information may be shared with third parties, and will be able to prevent the sharing of this information.
F. Personal Information PrepMD Has Sold in the Last 12 Months:
PrepMD does not sell Personal Information, however, we share Personal Information with Customer Employers as part of the Services provided to those clients, as described in Section V.G below, which may qualify as a sale of Personal Information under applicable Privacy Laws, including the CCPA and CPRA.
G. Personal Information PrepMD Has Disclosed to or Shared with Third Parties in the Last 12 Months
PrepMD has disclosed the following categories of Personal Information to Customer Employer clients in the 12 months immediately preceding the Effective Date: names; contact information; employers; job titles and duties; pictures; likenesses; social media accounts; courses enrolled in; and test answers and scores. PrepMD relies on third party vendors to support the Services, including, but not limited to, cloud hosting platforms for all data storage. As a result, all Personal Information collected and described in Section III.G has been disclosed to third party vendors in the 12 months immediately preceding the Effective Date.
VI. What Is PrepMD’s Legal Basis for Collecting and Using Personal Information?
PrepMD collects and uses Personal Information for the following purposes: (1) pursuant to informed consent, which you have granted by confirming the prompts produced by the Website and by continuing to use the Website and Service, consistent with the Privacy Policy and PrepMD’s Terms of Use and Terms of Access, (2) to pursue PrepMD’s legitimate business interests in providing the Services and maintaining the Website, and (3) to perform a service to which you or your employer are a party. Any one or more of the foregoing are the legal basis for PrepMD’s collection and processing of Personal Information. Please note that without your consent to collect and use the Personal Information required in any particular transaction, PrepMD may disqualify you from using the Services. For further information about the specific bases permitting PrepMD to collect and use Personal Information, please contact PrepMD at hello@prepmd.com, (888) 633-7737, or as follows:
Director of Global Marketing and Admissions
PrepMD, LLC
50 Braintree Hill Park Suite 102
Braintree, MA 02184
To the extent that you provide PrepMD with the Personal Information of other people, you warrant and represent that each such person who is required under the Privacy Laws to give consent, or the person who is required to give consent, if the Privacy Laws require the consent of another person, has granted his or her consent to you sharing his or her Personal Information with PrepMD for the use described in this Privacy Policy.
VII. How Long Does PrepMD Retain Personal Information?
Except upon the request of an individual, as explained in Section VIII below, and except as the law permits and requires, PrepMD will determine the retention period for Personal Information based on the following criteria:
A. The nature of our relationship with the relevant individual and the Customer Employer, if applicable;
B. The existence of other ongoing or expected projects with the relevant Customer Employer;
C. The nature of the Personal Information in question; and
D. Our business needs.
VIII. What Are Users’ Rights to Control Their Personal Information?
To the extent required by the Privacy Laws, except where permitted or required by law (including, but not limited to, compliance with a legal obligation, to further a public interest, and establishing and/or exercising a legal claim or defense), you have the following rights regarding PreMD’s collection and use of your Personal Information.
A. Requests to PrepMD
You may request the following from PrepMD with respect to your Personal Information:
1. Correction, updating, deletion, or restriction of collection and processing of your Personal Information;
2. The categories of your Personal Information that PrepMD collects or processes;
3. The categories of sources from which PrepMD collects or processes your Personal Information;
4. The expected period for which PrepMD will store your Personal Information, or if not possible, the criteria used to determine that period;
5. The business or commercial purpose(s) that PrepMD collects and disclosing your Personal Information;
6. A description of how PrepMD has used or is using your Personal Information;
7. A copy of your Personal Information, including the specific pieces of Personal Information, in a format that is easily understandable to the average consumer, and to the extent technically feasible, in a structured, commonly used, machine-readable format, which also may be transmitted to another entity at your request without hindrance;
8. Categories of third parties with whom PrepMD shares your Personal Information, and list of third parties with whom PrepMD has shared your Personal Information;
9. Categories of your Personal Information that we have shared with third parties, including Customer Employers, and the categories of third parties to which we have shared each particular category of Personal Information;
10. Your specific Personal Information PrepMD has collected, used, or disclosed.
If you request that your Personal Information be erased or deleted or that PrepMD otherwise restrict its collection and processing of Personal Information, PrepMD may terminate or limit your access to the website and service. If PrepMD has not collected or processed your Personal Information, or has not shared your Personal Information with another party, PrepMD will inform you of that in response to any of the above requests. Some information may remain in PrepMD’s backup media after erasure or deletion for a period of time. When you request that PrepMD update information, PrepMD may retain a copy of the unrevised information in PrepMD’s records. PrepMD also may use any anonymized aggregated statistical data derived from or incorporating Personal Information after it is updated, erased, or deleted, but not in a manner that would identify you.
We will confirm receipt of all such requests, provide information about how PrepMD will process the request, and substantively respond to all such requests consistent with the Privacy Laws. There may be a delay in processing a request while we verify that the request is valid and originates from you as opposed to an unauthorized third party.
Our verification process varies based on the source and nature of the request, but may include: comparing data in the request against Personal Information we retain; contacting you using other contact information; requesting further information, although we will avoid doing so to the extent possible; and the consideration of certain factors, including the type, sensitivity, and value of your Personal Information, the risk of harm to you posed by an unauthorized request, the likelihood that fraudulent or malicious actors would seek your Personal Information, the manner in which we interact with you, the available technology, and whether the information you have provided to verify your identity is sufficiently robust to protect against fraudulent requests. To the extent permitted by the Privacy Laws, PrepMD retains the right to deny any request if we cannot verify that it originated from you.
PrepMD retains records of all of the above requests and our responses as required by the Privacy Laws.
When you update information, we may maintain a copy of the unrevised information in our records. Please note that some information may remain in our private records after your deletion of such information from your account.
PrepMD may use any anonymized aggregated statistical data derived from or incorporating Personal Information after it is updated, erased, or deleted, but not in a manner that would identify you.
B. Making Foregoing Requests
The foregoing requests may be made by (1) email: hello@prepmd.com, (2) phone: (888) 633-7737, or (3) mail: Director of Global Marketing and Admissions, 50 Braintree Hill Park Suite 102, Braintree, MA 02184.
C. Authorized Agent
You may authorize an agent to take any of the acts permitted in this Section VIII on your behalf. To do so, you must provide written and signed authority to the agent, and written and signed notice to PrepMD that PrepMD may act on such requests by that agent.
D. Withdrawal of Consent
You may withdraw your consent for PrepMD to collect or process your Personal Information in any of the following manners: (1) contact us at hello@prepmd.com; contact us at (888) 633-7737; or (3) contact us at Director of Global Marketing and Admissions, 50 Braintree Hill Park Suite 102, Braintree, MA 02184. Please be aware that such withdrawal does not affect the lawfulness of PrepMD’s collection or processing of your Personal Information before such withdrawal. We reserve the right to terminate or limit your access to the Website and Services in the event that you withdraw your consent.
E. “Do Not Sell My Personal Information” and Opting Out of Sharing Personal Information
Other than providing Personal Information to Customer Employers as described in Section V.B above, PrepMD does not “sell” Personal Information, as that term is defined by the CCPA and CPRA. You may opt out of PrepMD’s disclosure of your Personal Information in any of the following manners: (1) contact us at hello@prepmd.com; contact us at (888) 633-7737; (3) contact us at Director of Global Marketing and Admissions, 50 Braintree Hill Park Suite 102, Braintree, MA 02184; or (4) completing the form at the following link:
https://www.prepmd.com/request-info-online-learning
We will act upon any request to opt out of all disclosure and sharing of your Personal Information, including notifying all third parties to whom we have disclosed or shared your Personal Information and ceasing to disclose or share your Personal Information, consistent with the requirements of the Privacy Laws.
If you exercise your right to opt out of the disclosure of your Personal Information to third parties, PrepMD will cease disclosing your Personal Information as of the date we receive notice in a manner provided above. PrepMD will not contact you about opting in to disclosing your Personal Information for at least 12 months following the date that it receives your notice.
F. Object or Challenge
You may object to, or otherwise challenge, PrepMD’s collection and processing of your Personal Information in any of the following manners: (1) contact us at hello@prepmd.com; contact us at (888) 633-7737; or (3) contact us at Director of Global Marketing and Admissions, 50 Braintree Hill Park Suite 102, Braintree, MA 02184. PrepMD will respond consistent with the requirements of the Privacy Laws.
G. Filing a Complaint
Regulatory authorities that oversee the Privacy Laws typically advise individuals to file an objection or challenge with the company before lodging a formal complaint with a regulatory authority. If an individual is dissatisfied with PrepMD’s response to an objection or challenge filed under Section VIII.F, or wishes to file a complaint with a regulatory authority first, the individual may do so, including as follows:
PIPEDA: Office of the Privacy Commissioner of Canada
GDPR: Supervisory authority in the relevant European Union member state
CCPA and CPRA: California Attorney General
PII Laws: Relevant state Attorney General
H. Prohibit Automated Processing
PrepMD does not use any automated decision making or profiling at this time. If and to the extent we do so in the future, at your request, PrepMD will terminate any automated decision making, including profiling, that is the sole source of decisions that produce a legal effect concerning or similarly significantly affecting you.
I. Accessibility for Users with Disabilities
If you are unable to review this Privacy Policy or any portion of it, please use the following information to contact us and request an alternative format: (1) email us at hello@prepmd.com, (2) call us at (888) 633-7737, or (3) send us mail at Director of Global Marketing and Admissions, 50 Braintree Hill Park Suite 102, Braintree, MA 02184.
J. Non-Discrimination
PrepMD will not discriminate against you because you have exercised any of the rights above or any other rights you retain pursuant to Privacy Laws, including, but not limited to by:
1. Not denying goods or services to you;
2. Not charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties;
3. Not providing a different level or quality of goods or services to you; and
4. Not suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services.
Consistent with Privacy Laws, PrepMD: (a) retains the right to charge you a different price or rate, or provide a different level or quality of goods or services to you, if that difference is reasonably related to the value provided to PrepMD by your Personal Information; (b) may offer financial incentives, including payments to you as compensation, for the collection, disclosure, or deletion of your Personal Information; (c) may enter you into a financial incentive program only if PrepMD clearly describes the material terms of the financial incentive program, so long as you give PrepMD prior opt-in consent, which you may revoke at any time; and (d) shall not use financial incentive practices that are unjust, unreasonable, coercive, or usurious in nature.
IX. What Are PrepMD Service Differences?
PrepMD does not offer any financial incentives for providing your Personal Information.
X. Is Personal Information About Me Secure?
We employ appropriate administrative, organizational, technical, and physical measures designed to protect the confidentiality, integrity, and availability of your Personal Information, which we regularly review and update as necessary.
PrepMD’s website may contain links to other sites. We are not responsible for the privacy or security practices of those other sites. When following a link to another site, you should read that site’s privacy policy.
XI. Children’s Privacy
We do not knowingly collect or solicit, and expressly instruct you not to provide, any Personal Information from anyone under the age of 18. If and to the extent we learn that we have collected Personal Information from a child under age 18 without verified parental consent, we will delete that information, except as provided below. If you believe that we might have any information from or about a child under age 18 without verified parental consent, please contact us immediately us at hello@prepmd.com, (888) 633-7737, or Director of Global Marketing and Admissions, 50 Braintree Hill Park Suite 102, Braintree, MA 02184.
XII. Contractual or Statutory Requirement
Except as noted in this Privacy Policy or in contractual documents, PrepMD’s collection and use of Personal Information is not a contractual or statutory requirement or a requirement necessary to enter into a contract.
XIII. Failure to Provide Personal Information
You can always opt not to disclose information to us. Please keep in mind, some information may be needed to register with us or to take advantage of some or most of our features.
XIV. Automated Decision Making
PrepMD does not currently rely on automated decision making, including profiling, and will not subject you to decisions based solely on automated processing which will produce legal effects concerning you or similarly significantly affecting you.
XV. Changes to this Privacy Policy
We may amend this Privacy Policy from time to time. Collection and processing of information we collect now is subject to the Privacy Policy in effect at the time such information is processed. If we make changes in the way we use Personal Information, we will notify you by posting an announcement on the Website or sending you an email. You are bound by any changes to the Privacy Policy when you use the Website or Services after such changes have been first posted.
XVI. Questions or Concerns; Contact Information
If you have any questions or concerns regarding our privacy policies, please contact us at hello@prepmd.com, (888) 633-7737, or Director of Global Marketing and Admissions, 50 Braintree Hill Park Suite 102, Braintree, MA 02184.
Effective Date: April 7, 2021