Your privacy is important to us so we have created this privacy policy (this “Privacy Policy”) to explain what Personal Data we collect and why we collect it. This Privacy Policy is solely about the HealthMetric PORTAL, our mobile application (“the HealthMetric PORTAL”).

You acknowledge that this Privacy Policy is part of the HealthMetric PORTAL Terms of Use, and by accessing or using the HealthMetric PORTAL, you agree to be bound by both this Privacy Policy and the Terms of Use. If you do not agree to abide by both this Privacy Policy and the Terms of Use, please do not use the HealthMetric PORTAL.

This Privacy Policy was written in English. To the extent a translated version conflicts with the English version, the English version controls. Unless otherwise indicated, this Privacy Policy does not apply to third party products or services or the practices of companies we do not own or control.

Management Science Associates, Inc. (“MSA”) controls and owns the HealthMetric PORTAL.

For more information, contact the HealthMetric PORTAL@msa.com.

If you live in the European Economic Area, United Kingdom, Switzerland or the state of California, Management Science Associates, Inc. controls your personal data and provides you with the HealthMetric PORTAL and related services. If you are seeking to exercise any of your statutory rights relating to the HealthMetric PORTAL, please contact our Data Protection Officer at MSADataProtectionOfficer@msa.com. You may also contact MSA at:

Management Science Associates, Inc.
Attn: the HealthMetric PORTAL
400 MSA Drive
Tarentum, PA 15084

If located in the United Kingdom, you may contact the following:

Management Science Associates, Inc.
Attn: the HealthMetric PORTAL
MSA Focus International Ltd Neptune Court, Vanguard Way
Ocean Park, Cardiff, United Kingdom CF245PJ

When a User accesses or uses the HealthMetric PORTAL, all data entered by the User, including, but not limited to, the following types of Personal Data, are collected:

• All data manually entered into the HealthMetric PORTAL
• All data that has been authorized to use (read and/or write)
• All data collected to establish your account such as:
  • your name
  • email address
  • cell phone number
  • the HealthMetric PORTAL username and password
  • IP addresses
  • browser type
  • phone type
  • internet service provider (ISP)
  • cookie

Information We Receive From Your Use of the HealthMetric PORTAL. Your device collects data to estimate a variety of metrics. The data collected varies depending upon which device you use. When your device syncs with our application or software, data recorded on your device is transferred from your device to our servers.

Location Services. the HealthMetric PORTAL includes features that use and collect location data. We collect this type of data if you grant us access to your location. You can always remove our access to your location using the HealthMetric PORTAL account settings.

Usage Data. When you access or use our services, we receive certain usage data. This includes information about your interaction with the HealthMetric PORTAL, for example, when you view or search content, install applications or software, create or log into your account, pair your device to your account, or otherwise open or interact with the HealthMetric PORTAL. We also collect data about the devices and computers you use to access the HealthMetric PORTAL, including IP addresses, browser type, language, operating system, mobile device information (including device and application identifiers), the referring web page, pages visited, location (depending on the permissions you have granted us), and cookie information.

Information We Receive From Third-Parties. If you choose to connect your account on our services to your account on another service, we may receive information from the other service. For example, we may receive information like your name, profile picture, age range, language, email address, and friend list. You may also choose to grant us access to your exercise or activity data from another service. You can stop sharing the information from the other service with us by removing our access to that other service.

Health and Other Special Categories of Personal Data. To the extent that information we collect is health data or another special category of Personal Data subject to the European Union's General Data Protection Regulation (“GDPR”) or the California Consumer Privacy Act of 2018 (“CCPA”) or the United Kingdom's Data Protection Act of 2018 (“DPA”), we ask for your explicit consent to process the data. We obtain this consent separately when you take actions leading to our obtaining the data, for example, when you pair your device to your account or grant us access to your exercise or activity data from another service. You can use your account settings and tools to withdraw your consent at any time, including by stopping use of a feature, removing our access to a third-party service, unpairing your device, or deleting your data or your account.

Some Cookies used by the HealthMetric PORTAL serve only to identify Users, keep you signed in, and remember your preferences. These are strictly necessary to provide the service you requested and cannot be switched off.

Analytics. On our web pages we also use Google Analytics 4, a third-party analytics service provided by Google LLC, to understand how the service is used so that we can improve it. We have switched off Google’s advertising features on our web pages — Google Signals and advertising personalization are both disabled in the tag itself — so the information Google receives is used to measure how the service is used, not to build an advertising profile of you. Analytics is never loaded until you accept it. We show every visitor the same banner, wherever in the world you are, and nothing is sent to Google unless you choose “Accept analytics” on it. If you decline, if you have not answered yet, or if your browser sends a Global Privacy Control signal, no analytics is loaded at all.

The consent banner is shown on our websites only. The screens displayed inside our mobile applications do not load any third-party analytics, so no banner appears there.

The Cookie that stores your choice. Your choice is stored in a single Cookie named hm_privacy. Its value has the form <version>:<choice> — for example 2:g, where 2 is the format version and g records that you accepted analytics (d that you declined it). The Cookie holds no other information about you.

How long your choice lasts, and how to change it. The Cookie expires 15 days after you make your choice. When it expires you are simply asked again, using the same banner and the same two buttons — so changing your mind never requires finding a settings page, and withdrawing your permission is exactly as easy as giving it. You can also change your choice immediately by clearing your Cookies for this site, which erases the record and brings the banner straight back. The Cookie is the only place your choice is stored: it applies to the browser you made it in, so if you use more than one browser or device you will be asked in each of them. If you would rather answer once for every site you visit, send the Global Privacy Control signal — we honor it on every request, from every browser, and we never show you the banner when you do.

Failure to provide certain Personal Data may make it impossible for the HealthMetric PORTAL to provide its services.

Some of our pages utilize framing techniques to serve content to and from our partners while preserving the look and feel of our site.

MSA uses the information it collects from you for the following purposes:

Provide and Maintain the HealthMetric PORTAL. Using the information MSA collects, it is able to deliver and operate the HealthMetric PORTAL and honor its Terms of Use with you. For instance, MSA requires your information to provide you with your the HealthMetric PORTAL score; to enable community features; and to provide customer support. For the HealthMetric PORTAL's community features, we may use your information to help you find and connect with other users and allow other users to find and connect with you.

Improve, Personalize and Develop the HealthMetric PORTAL. MSA uses the information it collects to improve and personalize the HealthMetric PORTAL and to develop additional features. For example, MSA uses the information to troubleshoot and protect against errors, perform data analysis and testing, conduct research and surveys, and develop new features and services.

Communicate With You. MSA uses your information when needed to send you service notifications and respond to you. MSA also uses your information to promote new features and/or products it thinks you would be interested in. You can control marketing communications and most service notifications by using your notification preferences in account settings or via the “unsubscribe” link in an email.

Promote Safety and Security. MSA uses the information it collects to promote the safety and security of the HealthMetric PORTAL, its users, and other parties. For example, it may use information to authenticate users, protect against fraud and abuse, respond to a legal request or claim, conduct audits, and enforce its terms and policies.

Personal Data concerning the User is collected for the following additional purposes:

• Analytics within the HealthMetric PORTAL app;
• Analytics of Health Information collected and/or entered into other health and fitness applications;
• Displaying content from external platforms;
• Integrating such Personal Data (in de-identified form) with additional laboratory and other data for use in analytics and related contexts; and
• Providing third parties with information and services in its sole and absolute discretion but in any event, MSA shall do so with my Personal Data only: (i) after my Personal Data has been de-identified; and (ii) for the purposes of health management and/or health research, and I hereby grant MSA complete permission to receive, use, and disclose my Personal Data in de-identified form to such third parties as contemplated under this paragraph.

MSA uses cookies and similar technologies for the purposes described above.

For Personal Data subject to the GDPR, the DPA and the CCPA, we rely on several legal bases to process the data. These include when you have given your consent, which you may withdraw at any time using your account settings and other tools; when the processing is necessary to perform a contract with you, like the Terms of Use; and our legitimate business interests, such as in improving, personalizing, and developing the services, marketing new features or products that may be of interest, and promoting safety and security as described above. For more information, please see the “Legal Bases” section below.

MSA processes the Personal Data of Users in a proper manner and takes appropriate security measures to prevent unauthorized access, disclosure, modification, or destruction of the Personal Data.

The Personal Data processing is carried out using computers and/or IT enabled tools, following organizational procedures and modes strictly related to the purposes indicated. In addition to MSA, in some cases, the Personal Data may be accessible to certain types of persons in charge, involved with the operation of the site (administration, sales, marketing, legal, system administration) or external parties (such as third party technical service providers, mail carriers, hosting providers, IT companies, communications agencies) appointed, if necessary, as data processors by MSA. The updated list of these parties may be requested from MSA at any time.

The Personal Data is processed at MSA's operating offices and in any other places where the parties involved with the processing are located. For further information, please contact MSA.

The Personal Data is kept for the time necessary to provide the service requested by the User, or stated by the purposes outlined in this Privacy Policy, and the User can always request MSA for their suspension or removal. In the event that you terminate your the HealthMetric PORTAL account, MSA will continue to adhere to the policies and practices described in this Privacy Policy.

We may disclose aggregated information about our Users, and information that does not identify any individual, without restriction.

We do not sell your Personal Data. We do not sell the Personal Data that you provide freely or that we collect in connection with your use of the HealthMetric PORTAL, and we do not receive money or any other valuable consideration for it from anyone.

We do, however, disclose a limited amount of information to third parties who process it on our behalf. Google’s advertising features are switched off, so the analytics information described below is used to measure how the service is used and not to advertise to you across other websites, and it is disclosed only if you have accepted analytics. The recipients are:

• Google LLC (Google Analytics 4) — receives, from our web pages only and only after you have accepted analytics on the banner, the pages you view, your device and browser characteristics, and an approximate location derived from your IP address. Google’s advertising features are disabled for this data, so it is not used to personalize advertising to you.
• ipstack (apilayer) — receives your IP address so that we can determine the country you are connecting from, which we use to detect suspicious sign-ins on your account. It plays no part in your privacy choice, and it is not used for advertising.

To stop the analytics disclosure, decline analytics on the banner, or clear your Cookies for this site to bring the banner back and change an answer you have already given.

We may disclose Personal Data that you provide freely or that we collect automatically:

• To our subsidiaries and affiliates to provide support to you in connection with the HealthMetric PORTAL.
• To contractors, service providers, websites linked to the HealthMetric PORTAL, and other third parties we use to support the HealthMetric PORTAL and who are bound by contractual obligations to keep Personal Data confidential and use it only for the purposes for which we disclose it to them.
• To fulfill the purpose for which you provide it.
• To third parties in our sole and absolute discretion but in any event, MSA shall do so with my Personal Data only: (i) after my Personal Data has been de-identified; and (ii) for the purposes of health management and/or health research, and I hereby grant MSA complete permission to receive, use, and disclose my Personal Data in de-identified form to such third parties as contemplated under this paragraph.
• For any other purpose disclosed by us when: (i) you provide the information; or (ii) we might subsequently revise the express provisions of this Privacy Policy, our Terms of Use, and/or our Patient Authorization and Opt-In to Use/Disclose Personal Health Information or Personal Data to disclose such other purpose and in such latter case, you shall consent to such other use through your continued use of the HealthMetric PORTAL.
• With your consent.

We may also disclose your Personal Data and information:

• To the extent that it is required to do so by law, in legal proceedings or in the stages leading to possible legal action arising from improper use of the HealthMetric PORTAL or the related services or to establish, exercise or defend its legal rights.
• To enforce or apply our Terms of Use and other agreements.
• If we believe in good faith that disclosure is necessary or appropriate to protect the rights, property, or safety of MSA, our customers or others, or to investigate fraud.

MSA keeps your account information, including, but not limited to, your name, email address, and password, for as long as your account is in existence because we need it to operate your account. In some cases, when you give us information for a feature of the HealthMetric PORTAL, we delete the data after it is no longer needed for the feature. We keep other information, like your exercise or activity data, until you use your account settings or tools to delete the data or your account because we use this data to provide you with your personal statistics and other aspects of the services. We also keep information about you and your use of the services for as long as necessary for our legitimate business interests, for legal reasons, and to prevent harm, including as described in the “How We Use Information” section of this Privacy Policy.

Records of your privacy choices and requests. When you accept or decline analytics, opt out, opt back in, or make any other privacy request, we record that event so that we are able to show we honored it. The record contains what you asked for, when you asked, how you asked (the banner, the privacy choices link, or a Global Privacy Control signal), your account and company identifiers if you were signed in, your email address, an anonymized version of your IP address, and your browser's user-agent string. We keep these records for twenty-four (24) months, the record-keeping period the CCPA prescribes for consumer requests. If you afterwards exercise your right to have your data erased, we do not delete these records — we redact them: your email address is replaced with a one-way hash and the free-text and user-agent fields are cleared, leaving only the type of request, its dates, how it was made, and its outcome. Retaining that minimum is permitted by Article 17(3) of the GDPR, which allows retention where it is necessary for compliance with a legal obligation or for the establishment or defense of legal claims.

MSA provides account settings and tools to access and control your Personal Data, as described below, regardless of where you live. If you live in the European Union, European Economic Area, United Kingdom, Switzerland (“the Designated Countries”) or the state of California, you have a number of legal rights with respect to your information, which your account settings and tools allow you to exercise, as outlined below.

Right to Opt-Out of the Sale or Sharing of Personal Data. Under the CCPA and the CPRA you have the right to opt out of the sale or the sharing of your Personal Data by a business. MSA does not sell your Personal Data, and does not share it for cross-context behavioral advertising: Google’s advertising features are switched off in the analytics tag itself, so the only disclosure we make to Google Analytics is for measurement, and it happens only if you have accepted analytics on the banner. Because you must opt in before anything is disclosed at all, there is nothing you need to opt out of — but you may withdraw your permission whenever you like by declining on the banner the next time it appears, or immediately by clearing your Cookies for this site. We will never require you to create an account, sign in, or verify your identity in order to make or change that choice.

Accessing and Exporting Data. By logging into your account, you can access much of your Personal Data, including your dashboard with your daily exercise and activity statistics. To receive the entirety of your Personal Data collected by the HealthMetric PORTAL in a commonly used file format, please contact MSA's Data Protection Officer at MSADataProtectionOfficer@msa.com. Before your Personal Data that has been collected by the HealthMetric PORTAL is produced, you will be asked to verify your request and your identity. A request for the production of your Personal Data may be made by your authorized agent if your authorized agent provides your written permission to MSA.

Editing and Deleting Data. Your account settings let you change, correct and delete your Personal Data. For example, you may edit or delete the profile data you inputted in the HealthMetric PORTAL through your account settings. You may request the entirety of your Personal Data be deleted through the “Help: Privacy Question” section in account settings and submitting a request to MSA. Before your Personal Data is deleted, you will be asked to verify your request and your identity. A request to delete your Personal Data may be made by your authorized agent if your authorized agent provides your written permission to MSA. If you choose to delete your account, please note that while most of your information will be deleted within thirty (30) days, it may take up to ninety (90) days to delete the entirety of your information. We may also preserve data for legal reasons to prevent harm. Please note that deleting and/or removing the HealthMetric PORTAL from your device(s) does not delete, or request a delete, of your account and Personal Data.

Objecting to Data Use. We give you account settings and tools to control our data use. For example, through your account settings, you can limit how your information is visible to other users of the HealthMetric PORTAL; using your notification settings, you can limit the notifications you receive from MSA; and under your application settings, you can revoke access of third-party applications that you previously connected to your the HealthMetric PORTAL account.

If you live in a Designated Country, in certain circumstances, you can object to our processing of your information based on our legitimate interests, including as described in the “How We Use Information” section of this Privacy Policy. You have a general right to object to the use of your information for direct marketing purposes. Please see your notification settings to control our marketing communications to you.

Restricting or Limiting Data Use. In addition to the various controls that we offer, if you reside in a Designated Country, you can seek to restrict our processing of your data in certain circumstances. Please note that you can always delete your account at any time.

If you need further assistance regarding your rights, please contact our Data Protection Officer at MSADataProtectionOfficer@msa.com, and we will consider your request in accordance with applicable laws. If you reside in a Designated Country, you also have a right to lodge a complaint with your local data protection authority.

Users have the right, at any time, to know whether their Personal Data has been stored and can consult MSA to learn about their contents and origin, to verify their accuracy or to ask for them to be supplemented, canceled, updated or corrected, or for their transformation into anonymous format or to block any Personal Data held in violation of the law, as well as to oppose their treatment for any and all legitimate reasons. Requests should be sent to MSA's Data Protection Officer at MSADataProtectionOfficer@msa.com.

Global Privacy Control. The HealthMetric PORTAL honors the Global Privacy Control (“GPC”) signal. If your browser, or an extension you have installed, sends a GPC signal, we treat it as your answer: no analytics is loaded, and we do not show you the consent banner at all, because you have already told us. We store nothing in order to do this — the signal arrives with every request you make, so it takes effect immediately, needs no Cookie, and applies for exactly as long as your browser keeps sending it. If you stop sending GPC, you will simply be shown the banner the next time you visit.

We do not act on the older, unstandardized “do not track” browser header. To understand whether the third party services we use honor “do not track” requests, please read their privacy policies.

Right to Non-Discrimination. If you choose to exercise your rights as a user of the HealthMetric PORTAL as outlined above, we will not discriminate against you or otherwise treat you differently than other users.

MSA works hard and takes precautions to keep your data safe. We utilize a combination of technical, administrative, and physical controls to maintain the security of your data. This includes the measures to encrypt much of the data submitted to and collected by the HealthMetric PORTAL. However, no method of transmitting or storing data is completely secure. If you have a security-related concern, please contact MSA's Data Protection Officer at MSADataProtectionOfficer@msa.com.

In the case of breach of Personal Data, MSA shall without undue delay notify affected Users by describing the nature of the breach, providing contact information of its Data Protection Officer, and advising of the likely consequences of the breach.

In support of MSA's efforts to keep your data safe, we recommend Users employ their devices' password features and ensure that the settings on such devices allow Users to encrypt data.

MSA is committed to providing our members with meaningful information and choices about the information they share through the HealthMetric PORTAL and the services. The GDPR and DPA requires organizations to have legal bases to collect, use, share, and otherwise process information about users residing in the European Union or the United Kingdom, respectively. If you habitually reside in the European Union or the United Kingdom, there are particular rights available to you. While some of these rights apply generally, certain rights only apply depending on the legal bases we rely on to process data. We have explained these legal bases and your rights below.

As described in the Terms of Use, the HealthMetric PORTAL cannot be provided, and the Terms of Use cannot be performed, without MSA processing your Personal Data. Since we process data you provide to us which is necessary to perform our contract with you, you have the right to port or transfer that data if you habitually reside in the European Union or the United Kingdom.

We ask for your permission to process your Personal Data for certain purposes and you have the right to withdraw your consent at any time. We ask for your consent to:

• Collect or infer health information which is used to provide helpful statistics and visualizations.
• Send you marketing communications.
• Collect and process information from third-party products, services, devices, and apps which are connected to the HealthMetric PORTAL.
• Load third-party analytics on our web pages, where the law requires your permission before we may do so.

When we process data you provide to us based on your consent, you have the right to withdraw your consent at any time via your account settings. You also have the right to port or transfer the data.

We process data where we have a legal obligation to do so, for example, where we're responding to valid and binding legal process from law enforcement agencies for certain data. In addition, processing may be needed for us to establish, exercise or defend civil or criminal claims in connection with actual or potential litigation including to protect the HealthMetric PORTAL and related services, our property or other legal rights, including those of our members or partners.

We process data where it is necessary to protect an interest which is essential to someone's life or protect any person from serious bodily injury. This includes processing information to combat harmful conduct both on and off of our Services.

Where set forth by the law of the European Union or a member state thereof or the United Kingdom, we may process users' data to perform processing in the public interest. This may include protecting against harm and undertaking research for social good. You have the right to object to, and seek restriction of, our processing of your Personal Data when we process data using this legal basis.

We process your information for our legitimate interests, and those of third parties, while applying appropriate safeguards that protect your privacy, rights and interests. We do this to:

• Market the HealthMetric PORTAL and other commercial products or services. For example, our partners may pay us to promote their products, services, events, gear or devices on the HealthMetric PORTAL. This is one of the ways we are able to provide the Services on a sustainable basis. We provide controls and safeguards for our members, including the ability to object.

• Maintain our business by conducting research and continuously improving the services so as to offer innovative and customized offerings to our members and partners.
• Convert it into aggregated form (by removing certain information, such as your name, and combining the resulting information with similar information from other members) for use by us and our partners. Our partners may use this information to improve infrastructure or for other commercial purposes, including developing useful insights.
• Keep the services safe and secure by using information to prevent or detect violations of our Terms of Use, fraud or abuse, and other harmful or illegal conduct. We may also share information with third parties, including law enforcement agencies for this purpose.
• Promote the services, including email and in-product marketing campaigns to inform members about our services.
• Encourage users to find new ways to interact, including activities, followers, clubs, or events. We rely on our legitimate interest in retaining members when ensuring that we offer new opportunities of interest to our users.

You have the right to object to, and seek restriction of, our processing of your Personal Data based on legitimate interests. Please contact MSA's Data Protection Officer at MSADataProtectionOfficer@msa.com if you object to us using your information.

MSA reserves the right to make changes to this Privacy Policy at any time by giving notice to the HealthMetric PORTAL Users on this page. It is strongly recommended to check this page often, referring to the date of the last modification listed at the bottom. If a User objects to any of the changes to this Privacy Policy, the User must cease using the HealthMetric PORTAL and can request MSA to erase their Personal Data. Unless stated otherwise, the then-current Privacy Policy applies to all Personal Data MSA has about Users.

MSA is responsible for this Privacy Policy.

More details concerning the collection or processing of Personal Data may be requested from MSA at any time at its contact information.

Cookie. Small piece of data stored in the User's/your device.

Personal Data. Any information regarding a natural person, a legal person, an institution or an association, which is, or can be, identified, even indirectly, by reference to any other information, including a personal identification number when a User/you access or use the HealthMetric PORTAL. MSA will collect and use your Personal Data consistent with applicable law and as more particularly outlined in this Privacy Policy and in the applicable provisions of the Terms of Use of the HealthMetric PORTAL and the Patient Authorization and Opt-In to Use/Disclose Health Information as to the HealthMetric PORTAL, concerning both of which you/the User are simultaneously agreeing to abide by downloading and using the HealthMetric PORTAL.

Usage Data. When you access and use the HealthMetric PORTAL, we may automatically collect certain details of your access to and use of the app or website, including traffic data, logs, and other communication data. We may collect information about your mobile device or computer and internet connection, including the device's unique device identifier, IP address, operating system, browser type, and phone type.

User. The individual using the HealthMetric PORTAL, which must coincide with or be authorized by the Personal Data subject, to whom the Personal Data refers.