Ellume COVID-19 Home Test Privacy Policy

Ellume Ltd and Ellume USA LLC. (“Ellume” “we,” “our,” and/or “us”) values the privacy of individuals who use our platform and related services specifically related to our COVID-19 Home Test Services (collectively, our “Services”). This privacy policy (the “COVID-19 Privacy Policy”) explains how we collect, use, and share information from users of our Services (“Users”). By using our Services, you agree to the collection, use, disclosure, and procedures this COVID-19 Privacy Policy describes. Beyond this COVID-19 Privacy Policy, your use of our Services is also subject to our general Privacy Policy (www.ellumehealth.com/privacy-policy) and our Terms of Use (www.ellumecovidtest.com/terms).

1. Information We Collect

We may collect a variety of information from or about you or your devices from various sources, as described below.

A. Information You Provide to Us.

Registration Information. If you register to take the COVID-19 Home Test, we ask you for your full name, e-mail address, physical address, phone number, age, date of birth, gender, and COVID-19 vaccination status.

Communications. If you contact us directly, we may receive additional information about you. For example, when you contact our Customer Support Team, we may receive your name, e-mail address, phone number, the contents of a message or attachments that you may send to us, and other information you choose to provide. If you choose to receive a result report via e-mail, an e-mail containing your name, date and time of test, result, and information about your result will be e-mailed to you. If you respond to one of our surveys, we may receive information about you relating to the subject matter of the survey. If you subscribe to our newsletter or e-mail marketing communications, then we will collect certain information from you, such as your e-mail address. When we send you e-mails, we may track whether you open them to learn how to deliver a better customer experience and improve our Services.

Payment Information. If you make a payment through our Services, your payment-related information, such as credit card or other financial information, will be collected by our third-party payment processor on our behalf.

Public Health Authority Required Information. Due to the need to respond to the COVID-19 public health emergency, we are required to collect and share certain information about you with public health authorities after you take a test. We will share the following information solely with public health authorities in compliance with applicable law:

Test result
Test result date
Residential Zip Code
State of Residence
Age
Date of birth

In addition to the information above that we are required to collect and share, we may also ask you that we share your name, phone number, and e-mail address with the Federal Department of Health and Human Services (HHS) and the applicable public health authority based on the residential zip code you provide to us.

Follow Up Questions for Certain Test Results. If you contact our customer service team about your test result, we may ask you one or more of the following questions in order to provide you with care and/or to meet our reporting requirements. We will share the following information solely with public health authorities in compliance with applicable law:

Whether this is your first test
The date and type of your last test (if this was not your first test)
Whether you are employed in the health care field
Whether you are symptomatic
Whether you are a resident in a congregate care or living setting
Whether you are pregnant

B. Information We Collect When You Use Our Services.

Location Information. When you use our Services on your mobile device, we may receive your precise location information (Android devices) or your reduced accuracy location (iOS devices). However, we only use your precise/reduced accuracy location to identify the zip code in which you are located. We will aggregate this information to generate a COVID-19 heatmap, which we may share publicly and with public health authorities.

Device Information.We receive information about the device and software you use to access our Services, including IP address (which may provide us with your general location information), operating system version, phone carrier and manufacturer, application version and diagnostic device identifiers.

Usage Information. To help us understand how you use our Services and to help us improve them, we automatically receive information about your interactions with our Services, like the pages or other content you view, the searches you conduct, and the dates and times of your visits.

Bluetooth Information. When you connect the test kit with our Application via Bluetooth, we identify your phone's identifier name so that we can isolate and pair the phone that is connecting to the test kit. Once this connection is established, we maintain connection until the test result is known. We then transmit the result from the test kit back to your phone via the Bluetooth connection so that it can be shown to you in the Application. We don't use or share any other data via the Bluetooth connection. After this, we do not store or keep this Bluetooth identifier.

2. How We Use the Information We Collect

If we are providing the Services on behalf of a third-party partner (such as your employer, health care provider or school) who has paid (in whole or in part) for you to use the Services, we will abide by the terms of our agreement with that third-party partner related to the use of the information we collect. Otherwise, we use the information we collect:

To provide, maintain, improve, and enhance our Services;
For public health reporting purposes;
To share information you direct us to share with another User of the Services, such as an event organizer or venue;
To personalize your experience on our Services;
To understand and analyze how you use our Services and develop new products, services, features, and functionality;
To communicate with you, provide you with updates and other information relating to our Services, provide information that you request, respond to comments and questions, and otherwise provide customer support;
To facilitate the connection of third-party services or applications for authentication purposes;
For marketing purposes, such as developing and providing promotional materials that may be relevant, valuable or otherwise of interest to you;
To generate a COVID-19 heatmap from aggregated location information of Users, which we may share publicly and with public health authorities;
To generate anonymized, aggregate data containing only de-identified, non-personal information that we may use for internal research, development and product improvement;
To find and prevent fraud, and respond to trust and safety issues that may arise;
For compliance purposes, including enforcing our Terms of Use or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency; and
For other purposes for which we provide specific notice at the time the information is collected.

3. How We Share the Information We Collect

Vendors and Service Providers. We may share any information we receive with vendors and service providers retained in connection with the provision of our Services.

Customer Partners. If we are providing the Services on behalf of a third-party partner (such as your employer, health care provider or school) who has paid (in whole or in part) for you to use the Services, you acknowledge and agree that your information, including your COVID-19 test result, may be shared with the third-party customer or its designee.

As Directed by You. At your direction, we will share your information, such as your name and evidence of your COVID-19 test result, with another designated User of the Services, such as an event organizer or venue.

Marketing. We do not rent, sell, or share information about you with non-affiliated companies for their direct marketing purposes, unless we have your permission.

Analytics Partners. We use analytics services such as Google Analytics and Microsoft App Center Analytics to collect and process certain analytics data. You can learn more about Google’s practices by visiting https://www.google.com/policies/privacy/partners/ and Microsoft’s practices by visiting https://privacy.microsoft.com/en-ca/privacystatement. To help us understand how you use our Services and to help us improve them, we automatically receive information about your interactions with our Services, like the pages or other content you view, and the dates and times of your visits.

As Required By Law and Similar Disclosures. We disclose information about you as described in Section 1 in compliance with our public health authority reporting requirements. We may access, preserve, and disclose your information if we believe doing so is required or appropriate to: (a) comply with law enforcement requests and legal process, such as a court order or subpoena; (b) respond to your requests; or (c) protect your, our, or others’ rights, property, or safety. For the avoidance of doubt, the disclosure of your information may occur if you post any objectionable content on or through the Services.

Merger, Sale, or Other Asset Transfers. We may transfer your information to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our assets. The use of your information following any of these events will be governed by the provisions of this COVID-19 Privacy Policy in effect at the time the applicable information was collected.

Consent. We may also disclose your information with your permission.

4. Your Choices

Location Information. There is currently no way to prevent certain devices from sharing precise or reduced accuracy location information. However, if your device shares precise location data, we will not store, share or otherwise use this precise location data except in aggregated form.

Marketing Communications. If you subscribe to our promotional e-mails, you can unsubscribe via the link provided in the e-mails. Even if you opt-out of receiving promotional messages from us, you will continue to receive administrative messages from us.

Do Not Track. There is no accepted standard on how to respond to Do Not Track signals, and we do not respond to such signals.

5. Third Parties

Our Services may contain links to other websites, products, or services that we do not own or operate. We are not responsible for the privacy practices of these third parties. Please be aware that this COVID-19 Privacy Policy does not apply to your activities on these third-party services or any information you disclose to these third parties. We encourage you to read their privacy policies before providing any information to them.

6. Security

We make reasonable efforts to protect your information by using physical and electronic safeguards designed to improve the security of the information we maintain. However, as no electronic transmission or storage of information can be entirely secure, we can make no guarantees as to the security or privacy of your information.

7. Children’s Privacy

We do not knowingly collect, maintain, or use personal information from children under 13 years of age, and no part of our Services is directed to children. If you learn that a child has provided us with personal information in violation of this COVID-19 Privacy Policy, then you may alert us at privacy@ellumehealth.com.

8. International Visitors

Our Services are hosted in the United States and intended for Users located within the United States. If you choose to use Services from the European Union or other regions of the world with laws governing data collection and use that may differ from U.S. law, then please note that you are transferring your personal information outside of those regions to the United States for storage and processing. Also, we may transfer your data from the U.S. to other countries or regions in connection with storage and processing of data, fulfilling your requests, and operating the Services. By providing any information, including personal information, on or to the Services, you consent to such transfer, storage, and processing.

9. Update Your Information or Pose a Question

If you have questions about your privacy on the Services or this COVID-19 Privacy Policy, please contact us at privacy@ellumehealth.com.

10. Changes to this Privacy Policy

We will post any adjustments to the COVID-19 Privacy Policy on this page, and the revised version will be effective when it is posted. If we materially change the ways in which we use or share personal information previously collected from you through Services, we will notify you through Services, by e-mail, or other communication.

11. Contact Information

If you have any questions, comments, or concerns about our processing activities, please e-mail us at privacy@ellumehealth.com or write to us at:

4930 Executive Court, Frederick, Maryland, MD, 21703

Last Updated: November 25, 2022