Privacy Policy

This Privacy Policy explains what personal data UpstreamDigital, LLC (“UpstreamDigital,” “we,” “us,” or “our”) collects, how we collect and use that information, and to whom we disclose it. This Privacy Policy applies to information we collect from visitors our website freebc.org and any related websites (the “Sites”), and users of any other platforms, technologies, products, web applications, and on- and off-line services we offer (collectively with the Sites, the “Services”). This Privacy Policy incorporates our Terms of Use, which governs your use of our Services.

This Privacy Policy does not apply to information we collect from individuals in a business-to-business or employment context. This Privacy Policy also does not apply to third-party websites, applications, products, services, or other properties, even if our Services link to them or vice versa. We recommend that you review the privacy practices of those third parties before sharing personal data with them.

Although we are not a health care provider and are not a covered entity under HIPAA, in some cases we may be a “business associate” to covered entities under the Health Insurance Portability and Accountability Act (“HIPAA”), and as such we may have certain federal, state, and contractual restrictions on how we can use your health or medical information (collectively, your “Protected Health Information” or “PHI”). With respect to any PHI that we receive from covered entities, we will comply with our obligations under HIPAA as a business associate. This Privacy Policy is not intended to include information about how we handle HIPAA-regulated PHI. We encourage you to review the privacy policies and notices of privacy practices of your health care provider or other covered entity with which we may partner.

We may also collect, store, and use personal data (defined below) that is linked or reasonably linkable to you and that identifies your past, present, or future health status or mental health status, as may be applicable (“consumer health data”). If you are a resident of Connecticut, Nevada, or Washington, we provide more information about consumer health data collected about you, as well as the rights you may have related to this data, in our Consumer Health Data Privacy Notice.

Please note that we are providing the following disclosures and rights in this Privacy Policy in the interest of transparency. Such disclosures and rights are not intended to waive any applicable exemptions under state and federal law.

Table of Contents

This Privacy Policy is provided in a layered format. You can jump to a specific section by clicking on the section below.

* * * * * *

1. Personal Data We Collect

As used in this Privacy Policy, “personal data” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identifiable individual. Personal data includes “personal information” as that term is defined in applicable privacy laws.

Personal data does not include publicly available information; lawfully obtained, truthful information that is a matter of public concern; information that has been deidentified; or aggregate consumer information. “Publicly available information” includes information that is made available from federal, state, or local government records; information that a business has a reasonable basis to believe is lawfully available to the general public, either through widely distributed media, or by the individual; and information that is made available by a person to whom the individual has disclosed the information if the individual has not restricted the information to a specific audience.

We may create aggregated, deidentified, or anonymized information from personal data by removing certain data components (such as your name, email address, or linkable tracking identifier) that make the data identifiable, or through aggregation, obfuscation, or other means. Subject to applicable law, our use and disclosure of such aggregated, deidentified, and anonymized information is not personal data or subject to this Privacy Policy.

Because of the overlapping nature of certain of the categories of personal data identified above, some of the personal data we collect may be reasonably classified under multiple categories.

2. Sources of Personal Data

We may collect personal data about you from the following categories of sources: 

●       Directly from you through your interactions with us, such as when you register for or use our Services, complete electronic forms, or otherwise communicate with us.

●       Automatically through cookies and other tracking technologies, as discussed in more detail in “Cookies and Other Tracking Technologies” (Section 4).

●       From our affiliates, licensees, and joint venture partners.

●       From our service providers, including those providing hosting services, analytics services, cloud services, customer and technical support, email services, and other services. For example, we may collect personal data if you use a chatbot on our Services, which is provided by our third-party provider Anthropic on our behalf.

●       From our business partners (including healthcare providers and joint marketing campaign partners) (collectively, “Business Partners”), marketing partners, ad network providers, and advertisers.

●       From social media and other platforms, including Apple and Google, if you register for an account through these platforms or otherwise interact with us through these platforms.

3. Disclosure of Personal Data

We may disclose personal data to the following categories of third parties:

●       Affiliates. We disclose personal data to our affiliates, licensees, and joint venture partners.

●       Service providers.We may disclose personal data to our service providers to provide services on our behalf, such as order fulfillment, payment processing, analytics, advertising, hosting, marketing, customer and technical support, and other services. For example, if you use a chatbot or live chat on our Services, the information provided may be recorded and stored by our third-party provider Anthropic on our behalf.

●       Advertising partners.We may share your information with third-party platform providers, including advertising, social media, and analytics companies, who assist us in serving advertising regarding the Services to others who may be interested. We may also partner with third parties who use cookies to serve interest-based advertising and content on their respective third-party platforms that may be based on your preferences, location and/or interests.

●       Other Third Parties. We may disclose personal data to other third parties, such as our Business Partners. Please note that we do not disclose personal data to third parties for those third parties’ own marketing purposes.

●       Business transferees. If we or our affiliates are involved in a merger, acquisition, asset sale, or other corporate combination, your personal data may be transferred to the acquiring or surviving entity.

●       Professional advisors. We may disclose personal data to our professional advisors, including lawyers, auditors, bankers, and insurers, where necessary in the course of the professional services they render to us.

●       Authorities for compliance and harm prevention. Under certain circumstances, we may be required to disclose your personal data if required to do so by law or in response to valid requests by public authorities, and/or in response to a threat of harm involving an individual’s health and/or safety.

●       Other parties with your consent. We may disclose personal data to other parties with your consent.

4. Cookies and Other Tracking Technologies

We use cookies and similar tracking technologies to track the activity on the Sites and we hold certain information. Cookies are files with a small amount of data which may include unique identifier, and are sent to your browser from a website and stored on your device. We also use other tracking technologies, such as beacons, tags, and scripts to collect and track information and to improve and analyze our Sites. In this Privacy Policy, we collectively refer to these technologies as “cookies.”

Cookies on the Sites generally fall into the following categories:

●       Essential cookies: These cookies are necessary for the Sites to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in, or filling in forms.

●       Functional cookies:These cookies enable the Sites to provide enhanced functionality and personalization. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies, then some or all of these services may not function properly.

●       Performance cookies:These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our Sites. They help us to know which pages are the most and least popular and see how visitors move around the Sites.

●       Analytics cookies: These cookies track information about visits to the Sites so we can make improvements and report our performance. For example, we may analyze visitor behavior to provide more relevant content or suggest certain activities. These cookies collect information about how visitors use the Sites, which website the visitor came from, the number of each user’s visits, and how long a user stays on the Sites.

●       Advertising/Targeting cookies.  These third-party cookies are placed by third-party advertising platforms or networks to deliver ads and track ad performance, enabling advertising networks to deliver ads that may be relevant to you based upon your activities (sometimes called “targeted advertising”) on the Sites.

You can modify your browser settings to decline or accept certain cookies. However, if you decline certain cookies, some of our Sites’ features may not function as designed.

5. Children’s Data

Our Services are not intended for children. We do not knowingly collect any personal data from anyone under the age of 18. If you think that your child provided this kind of information through our Services, we strongly encourage you to contact us immediately, and we will do our best to promptly remove such information from our records.

6. Data Security and Retention

The security of your personal data is important to us, but remember that no method of transmission over the Internet, or method of electronic storage, is 100% secure. We maintain appropriate technical, administrative, and physical safeguards to help protect the security of your personal data against unauthorized access, destruction, loss, alteration, disclosure, or misuse, but we cannot guarantee its absolute security.

We will retain your personal data for as long as necessary for the purposes outlined in this Privacy Policy. This information will be used and retained to the extent necessary to comply with any legal obligations or policies, to resolve disputes, and/or enforce legal agreements. Personal data may also be retained for internal analytics purposes. This information is retained for a shorter period, unless it used to enhance security features or improve the functionality of our Services. Our determination of precise retention periods will be based on (a) the length of time we have an ongoing relationship with you; (b) whether there is a legal obligation to which we are subject; and (c) whether retention is advisable in light of our legal position, including regard to applicable statutes of limitations, litigation, or regulatory investigations.

7. Transfers of Personal Data

Your personal data may be transferred to and maintained on computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those of your jurisdiction. If you are located outside of the United States and choose to provide information to us, please note that we transfer personal data to the United States and process it there. For such transfers, we take the necessary measures to ensure that your personal data receives an adequate level of protection.

8. Opting Out of Promotional Communications

We may use your personal data to send you email updates regarding our Services, other announcements, and inquiries. If you no longer wish to receive promotional email communications from us, you may opt out via the unsubscribe link included in such emails or email us at hello@upstream.org. We will comply with your request as soon as reasonably practicable. Please note that if you opt out of receiving promotional emails from us, we may still send you important administrative messages that are required to provide you with the Services or for other reasons disclosed in this Privacy Policy.

Additionally, you may consent to receive ongoing or recurring informational and/or marketing text messages (such as SMS, MMS, RCS, or successor protocols or technologies) (collectively, “Messages”) from us and service providers acting our behalf. You can opt out of receiving these messages at any time by texting “STOP” to any message you receive or by contacting us at hello@upstream.org. After you opt out of these messages, we will send you a final message to confirm that you have unsubscribed and/or clarify the scope of your opt-out. If you are experiencing issues with the messaging program you can text “HELP” for more assistance, or contact us at hello@upstream.org.

9. Privacy Notice for Residents of Nevada

We do not “sell” personal data as that term is defined under Nevada law. However, Nevada residents have the right to opt out of any future sale of their personal data under Nevada SB 220. If you are a Nevada resident and would like to make such a request, please email us at hello@upstream.org. You must include your full name, email address, and postal address in your email or mail request so that we can verify your Nevada residence and respond. In the event we sell your personal data after receipt of your request, we will make reasonable efforts to comply with your request.

10. Updates to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes consistent with applicable law, including by posting the new Privacy Policy on this page and updating the “effective date” at the top of this Privacy Policy. We recommend reviewing this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

11. Contact Us

If you have questions or concerns regarding this Privacy Policy, please email us at hello@upstream.org.