Privacy Policy
DrLullaby, LLC
1101 Davis Street #5767
Evanston, IL 60201
844-475-3379
support@drlullaby.com
Thank you for choosing DrLullaby! We are committed to providing you with quality services. Your clear understanding of our Webapp Privacy Policies is important to our professional relationship. Please understand that agreeing to these policies is a part of that relationship. Please contact us if you have any questions about our privacy policies.
DrLullaby’s Webapp Privacy Policy
Revised Date: February 1, 2023
DrLullaby LLC (“DrLullaby,” “we,” “us,” or “our”) is committed to protecting and respecting your privacy. This Privacy Policy (“Policy”) sets out the basis on which we collect, use, process, share, or protect information related to your use of the Technology, how you can get access to this information, and your choices with respect to this information. Capitalized terms used but not defined herein have the meanings set forth in our Terms and Conditions of Use. The primary governing law of this Policy is that of the State of Illinois, United States.
DrLullaby’s Webapp (“Digital Membership”, or “Webapp”) is accessible to individuals over the age of 18 or parents or legal guardians signing up on behalf of individuals who are under the age of 18. We believe in the importance of taking additional measures to protect children’s privacy. We do not knowingly collect personal data from individuals under the age of 18 unless a parent or legal guardian has registered on the individual’s behalf. If we learn that we have collected the personal information of an individual under the age of 18 without consent from a parent or legal guardian, we will take steps to delete such information as soon as possible. Parents or legal guardians who believe that their child who is under the age of 18 has submitted personal information to us and would like to have it deleted may contact us at support@drlullaby.com.
Please note that you must read and agree to the terms and conditions of this Webapp Policy before you use the Technology. If you do not agree to the terms and conditions of this Policy, then you may NOT use any part of the Technology or engage with the DrLullaby Webapp, or the Telehealth Service. The Telehealth Service is further subject to our HIPAA Notice of Privacy Practices.
1. When does this Privacy Policy apply?
This Privacy Policy applies to the information shared and generated while interacting with our platform as a visitor and while using or accessing all or any part of the Technology, other than when engaging with a Telehealth Provider providing clinical care on the Telehealth Service. Details of your Telehealth Services are outlined in the Telehealth Terms.
This Privacy Policy does not apply to any PHI shared while a patient is using the Telehealth Service to obtain healthcare. Such information is governed by applicable state and federal laws, such as HIPAA. For more information on how DrLullaby may use and share your PHI and to learn more about your rights with respect to your PHI, please see our Terms and Conditions of Use and HIPAA Notice of Privacy Practices.
To the extent that there is a conflict between this Privacy Policy and the HIPAA Notice of Privacy Practices with respect to PHI, the HIPAA Notice of Privacy Practices will prevail.
2. What data do we collect from our DrLullaby website?
Personal information
To create your DrLullaby account, we collect and use information like your name, age, username, password, email and payment details for setting up your access to the DrLullaby Webapp. The personal information collected for DrLullaby Webapp allows us to personalize your experience on the Technology, give you access to the Technology, and communicate with you. If you are using the Technology as a parent seeking services on behalf of a child, we also collect information such as the child’s first name, gender, and age group. We use information such as your or your child’s age and gender to assist our interpretation of your or their sleep patterns, as sleep patterns can vary based on these variables. You provide this information to us. During your on-boarding process to create a DrLullaby account, we also collect your phone number, date of birth, gender, address, insurance information, scheduling preference and payment details for the purpose of setting up your Telehealth Service. The personal information collected for Telehealth Service allows us to verify insurance coverage and add you to our secure Electronic Health Record System (“AdvancedMD”).
Appointment and purchase history
We retain information about your history of appointments with Telehealth Providers, if any, as well as information about subscriptions you may have purchased in the past. We collect this information from you, or we generate this information based on your subscriptions or meetings with Telehealth Providers. We also keep a record of your communications with the Technology, which is information that either you generate or we collect.
User Content
The Technology may contain functionality that allows you to upload User Content, as further described in our Terms and Conditions of Use. You provide this information.
Information from third parties
Information you provide to or through third parties (as described below) when using the Technology may be provided to DrLullaby by the third party, including login information for the third-party services. See below as well as our Terms and Conditions of Use for more information about how the Technology interacts with third parties.
Health information
We collect information about your sleep (including, and related to, the time you spend in bed and the time you spend asleep, the number of interruptions in your sleep, factors impacting sleep, and self-reported sleep distress) in order to deliver our sleep improvement program. We may collect information about current medication, medical or mental health symptoms to inform your Telehealth Services or suggest when a referral is appropriate, as the DrLullaby Webapp (“Digital Membership) technology itself, is not able to diagnose or treat directly. We also collect general information about your sleep and wellbeing in order to evaluate progress towards your self-defined goals. You may also choose to email or message with your Telehealth Provider if you have questions between sessions, using G Suite or Google Workspace, or Messaging through the DrLullaby Webapp, and the Telehealth Provider will respond to those questions, which communications may contain information about your health. This is information that you provide to us or that the Telehealth Providers provide to you and to us. Any information emailed or messaged to a Telehealth Provider in between sessions may be considered PHI. If you choose to send your PHI by email or messaging, you acknowledge and agree that email and messaging is an insecure means of communication. DrLullaby and the Telehealth Providers will take every reasonable step to ensure they do not communicate PHI via unsecure platforms.
User behavior and electronic identifiers
We may collect information about your behavior while using the Technology and the devices you use to access the Technology, including mobile device UDID and IMEI numbers, operating Technology, browser type, screen size, or similar types of data. Our servers generate this information automatically when you use our WebApp, or Website. DrLullaby will use this information to provide you with customer support, to enhance system administration, to tailor your experience with the Technology, and to assist communication (e.g., push notifications). In addition, we store any metadata and user analytics associated with your account. Metadata you may create on the Technology can include your geolocation, the type of content you consumed while using the Technology, time you spent using the Technology or any component thereof, and when you accessed the Technology. You provide this information, and/or we collect this information about your behavior using the above stated electronic identifiers and similar technologies.
Cookies
We may store cookies (small text files managed by your web browser) on your computer or mobile device in order to improve your experience with the Technology. Examples include: recognizing you when you return to the Technology, maintaining data you have entered across multiple sessions, and storing information about your personal preferences. Cookies may include pixel tags, web beacons, local storage, and similar tracking technologies.
If you don’t want our Technology to collect information using cookies, you can change your web browser settings to reject cookies from the site or to alert you before a cookie is placed on your computer. Each browser is different, so you should check your browser’s “Help” menu to learn how to change your cookie preferences. Unless you have adjusted your browser setting so that it will refuse cookies, the Technology may issue cookies when you visit the Technology. Please note that cookie-based opt-outs only apply to the specific computer and browser on which the opt-out cookie is applied. If you accept a cookie, you can delete it at any time through your web browser. If you choose not to accept cookies, though, you may not be able to enjoy all the features available on the Technology.
3. How do we use your data?
In order to minimize any required disclosures of your identifiable information, we limit the data we collect to that which is necessary to deliver and improve our services. We have policies, procedures, and other safeguards in place to help protect it from improper use and disclosure. The following categories describe the ways in which we may use your identifiable information.
Disclosure at your request
We may disclose information relating to your use of the Technology as and when requested by you. This disclosure at your request may require your written authorization.
Services and operations
We may use your identifiable information in connection with providing services for our internal operations, which include administration, eligibility determinations, planning your sleep program, user account maintenance, customer service, analytics, and various activities that assess and improve the quality and efficacy of the service that we deliver to you. Your data may be used to develop new features, update the Technology on your devices, diagnose and fix technological problems, personalize your experience while using the Technology, help you efficiently access your information after you log in, and remember your information so you will not have to re-enter it during your visit or the next time you visit the Technology. If you choose to use DrLullaby’s Telehealth Service, we may also use your data to match you and schedule an appointment with a Telehealth Provider.
Emails
We may receive a confirmation when you open an email from us or click on a link in an email, if your computer supports this type of program. We use this confirmation to help us make emails more interesting and engaging. We may also use email communications from you to a Telehealth Provider using G Suite or Google Workspace to provide you with responsive communications from a Telehealth Provider. When you receive an email from us, you can opt out of receiving further emails by following the included instructions to unsubscribe. However, by opting out of further email communications after you sign up, you may limit program reminders and other valuable program content and components.
Reminders and notifications
We may use your identifiable information to send you notifications to interact with or complete tasks relating to your use of the Technology. You may make changes to the format and frequency of these reminders, or cancel these reminders and/or notifications, by logging into your DrLullaby account on the Website or WebApp and/or by notifying our team of this request at support@drlullaby.com. These push notifications may include promotional communications regarding the Technology. Opting out of push notifications will not affect other communications you receive from DrLullaby, such as email communications. You also may receive alerts and updates within our DrLullaby Webapp regarding services or your account. To opt out of receiving these alerts and updates, you may discontinue use of the Technology.
SMS notifications
We may offer you the ability to sign into WebApp via your mobile number. If you elect to provide us a mobile number and consent to receive certain messaging, we may use SMS messaging to contact you when you make account updates, to provide you updates on your customer support tickets, for other Technology-related reminders, and for account recovery purposes. You may opt out of such messages by replying “STOP" or opt out via SMS instructions provided.
4. Who has access to your data and when do we share it with third parties?
DrLullaby understands that your identifiable information is private and personal and is dedicated to maintaining its confidentiality and integrity. While DrLullaby will never sell or rent your data without your prior consent other than as described in this Policy, we may disclose your data to persons and entities outside of DrLullaby, as described below.
Third-party service providers
We may disclose your information to third-party service providers that contract with us. Each of these contracts will safeguard your identifiable information. Examples of third-party service providers include accounting services, server and email delivery providers, vendors, financial and payment process providers, and other business partners and reputable companies in the industry who subcontract with us.
If you choose to buy products through the Technology, you acknowledge and agree that we may use certain third-party vendors and service providers to process payments, manage debit and credit card information and detect and prevent fraud, and may also collect ourselves information about that specific purchase such as the purchase date, purchase totals, and product types, as well as your postal address. You provide this information. DrLullaby is a service provider. We are not a bank, credit union, payment processor or other financial institution. Bundles, subscriptions, and products are purchased via a third-party payment vendor, which is Stripe. Transactions processed via the Technology may be subject to the terms and conditions and privacy policies of the applicable payment vendor. We may share your information with payment vendors to the extent necessary to allow them to process the appropriate payments.
If you access third-party services, such as Facebook, Google, or Twitter, through the Technology or to share information about your experience on the Technology with others, these third-party services may be able to collect information about you from us, including information about your activity on the Technology, and they may notify your connections on the third-party services about your use of the Technology, in accordance with their own privacy policies. We do not control and are not responsible for the privacy practices of these third parties, and the information practices of these third parties are not covered by this Policy. We encourage you to read the privacy policies of all third parties associated with DrLullaby or that you wish to use to discuss your experience on the Technology.
If you decide to sign up for the Telehealth Service, we will connect you with a Telehealth Provider, and we will provide that Telehealth Provider with your name, the time and date the electronic meeting will take place, and other relevant health information that you have provided to us. The Telehealth Service are provided online through a secure platform. The information you share orally during your session with the Telehealth Provider is confidential between you and the Telehealth Provider. Such details are included in your Telehealth Terms.
Threat to health or safety
We may disclose your identifiable information when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent the threat. Such details are included in your Telehealth Terms.
As required by law
Certain laws permit or require certain uses and disclosures of identifiable information in order to facilitate, for example, public health activities, health oversight activities, and compliance with law enforcement. In these instances, DrLullaby will only disclose your identifiable information to the extent the law requires. DrLullaby may also disclose your information in order to enforce terms included in this Policy or in our Terms and Conditions of Use.
Personal representatives or persons involved with your care
We must disclose your identifiable information to anyone who has the legal right to act for you (your personal representative) in order to administer your rights. We may also disclose your identifiable information to a person involved in your care or who helps pay for your care, such as a family member, when you are incapacitated or in an emergency, or when you agree or fail to object when given the opportunity. If you are unavailable or unable to object, we will use our best judgment to decide if the disclosure is in your best interests. Special rules apply regarding when we may disclose information to family members and others involved in a deceased individual’s care. We may disclose information to any persons involved, prior to the death, in the care or payment for care of a deceased individual, unless we are aware that doing so would be inconsistent with a preference previously expressed by the deceased. We may also share your information amongst various service providers within the Technology, such as all Telehealth Providers you work with. We also share your information with clinical researchers, referring physicians, and other physicians for whom you have provided appropriate consents and who provide the correct CPT code, subject to our HIPAA Notice of Privacy Practices with respect to PHI.
For research and publicity purposes
DrLullaby reserves the ability to include your data in aggregated data sets shared with or sold to our research partners and readers of our published research. In these sets, your data will not be personally identifiable and would be used for supporting generalized statements (e.g., “children aged 13-18 have the worst sleeping habits in the US”).
Transfer of business assets
In the event that we sell or buy any business or assets, we may disclose your personal data to the prospective seller or buyer of such business or assets. If DrLullaby or substantially all of its assets are acquired by a third party, personal data held by it about its customers will be one of the transferred assets. This Policy would continue in effect following the effective date of such transaction, until such time as the prospective buyer changes it, in which case the prospective buyer would be required to notify you of any changes.
To protect the security and integrity of our Technology
Improving and monitoring the security of our Technology may involve analyzing our users’ data and how the data interacts with our Technology. Such use may be conducted by DrLullaby personnel or expert third-party service providers. Protecting the security and integrity of the Technology includes detection of violations of our Terms and Conditions of Use, detecting fraud or illegal activity, diagnosing or fixing technology problems, or monitoring or improving the overall effectiveness of our Technology.
5. How do we store your data?
Information you provide to us is stored in encrypted form on secure servers located in the U.S., which are owned and operated by Amazon Web Services (“AWS”). AWS is an industry leader in the provision of hosting services and cloud security. You can learn more about AWS by visiting their webpage.
All passwords are stored in encrypted form. Your data may be transferred to, and stored at, other destinations by staff who work for DrLullaby. Such staff may be engaged in the provision of support services, among other things. By submitting your personal data, you agree to this transfer, storing, or processing. DrLullaby stores the data collected from you for up to seven years.
6. Your rights
Users of the Technology have certain specific privacy rights with regard to their information. You make choices with respect to those rights through your settings in your account on the WebApp, or Website or by contacting us as directed in this Policy.
There may be times when we are unable to fulfill your request – for example, if providing access to your personal information would reveal confidential commercial or proprietary information or personal information about someone else (and we cannot separate your data), if we are prohibited by law from disclosing the information, or if we have a legal obligation to retain certain data. We may require additional personal information from you for the purposes of verifying your identity and rights.
If you are a resident of California, please see Section 7 below.
Right to access
You have the right to view all personal information that DrLullaby has collected about you. You can view this information through your dashboard at any time while you access DrLullaby.
Right to accuracy
You have the right to ensure that the data we have stored is accurate. In most cases, the Technology allows you to directly modify your own information. However, if there is incorrect data within the Technology that you are not able to change, please contact DrLullaby at support@drlullaby.com and we will work with you to update this information.
Right to deletion
You have the right to request deletion of all data within the Technology. While you control how long your account remains active, canceling a subscription, terminating an account, or deleting the DrLullaby WebApp will not automatically delete your information. We will not delete your data unless we elect to in our sole discretion or you affirmatively request that we do so in writing. To request your data be deleted, please contact DrLullaby at support@drlullaby.com. In most cases, this request will be completed within 30 days. If circumstances require a delay in this deletion, DrLullaby will notify you and explain the reason for the delay. When you delete your account it will no longer be accessible by you. Note that in some cases, there may be a legal requirement to hold on to your data. DrLullaby will notify you directly if this is the case.
Right to withdraw consent
A user of the Technology has the right to withdraw their consent at any time by contacting DrLullaby at support@drlullaby.com. Please note that without consent to process your data, we will be unable to successfully deliver DrLullaby services to you. As described above, you may also withdraw your consent to receive DrLullaby communications, such as emails, SMS messages, or push notifications.
Right to notification of disclosure and breach
In addition to the right to request notification about disclosures of your data, specified in the “right to access” section above, we will notify you as required by law if there has been a breach of the security of your identifiable information.
Concerns or complaints
If you believe that any of your rights with respect to your or others’ identifiable information have been violated by DrLullaby, our employees, or our agents, please contact DrLullaby at support@drlullaby.com.
7. California resident privacy rights
This Section 7 applies only to California residents. Section 2 sets forth the categories of personal information that we collect and process about you, a description of each category, and the sources from which we obtain each category. Under the California Consumer Privacy Act (“CCPA”) and California Privacy Rights Act (“CPRA”), you have a right to request information about our collection, use, disclosure, and sale of your personal information over the prior 12 months or, with respect to information collected after January 1, 2022, such other period as you specify. You can make this request twice within a 12-month period, and DrLullaby will respond within 45 days of receiving your request. You can ask that we provide you with the following information with respect to the applicable time period:
Categories of and specific pieces of personal, including sensitive personal information (as defined under the CPRA), we have collected about you;
Categories of sources from which we collect personal information or sensitive personal information;
Purposes or use for collecting, using, or selling personal information or sensitive personal information;
Categories of third parties with which we share personal information or sensitive personal information;
The length of time we intend to retain such personal information or sensitive personal information;
Categories of personal information or sensitive personal information disclosed about you for a business purpose;
If applicable, categories of personal information or sensitive personal information sold or disclosed about you and the categories of third parties to which the personal information was sold or disclosed, by category or categories of personal information for each third party to which the personal information was sold or disclosed;
The categories of information we have disclosed to any third party for any third-party direct marketing purposes during the preceding year; and
The names and addresses of third parties that received such information, or if the nature of their business cannot be determined from the name, then examples of the products or services marketed.
You have the right to request that DrLullaby delete any personal information we have collected from you or maintain about you, subject to certain exceptions, and request that any third parties with whom we have shared that information to do the same. If you request that we delete your personal information, we will do so except to the extent we determine that we need the information for a business purpose and have a legal right to maintain it, in which case we will inform you of that legal exception. You also have the right to request that we correct inaccurate personal information about you, and to cause us to use commercially reasonable efforts to do so. You also have the right, in some circumstances, to opt out of any sharing of your personal information. Finally, you have the right to request that we use your sensitive personal information (as defined under the CPRA) solely as necessary to provide our services to you.
We will not discriminate against you for exercising any of your CCPA or CPRA rights. Unless otherwise permitted by the CCPA or CPRA, we will not do any of the following because you request to know, access, or delete your information or opt out of its sale:
deny you goods or services;
charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;
provide you a different level or quality of goods or services; or
suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.
We are not currently subject to CPRA, however, it is our intent to respect California residents’ rights under CPRA as if we were subject to it. In furtherance thereof, our collection, use, retention, and sharing of your personal information is reasonably necessary and proportionate to achieve the purposes for which we collect and process that information, or for other purposes not incompatible with those purposes. We intend to enter into agreements with third parties to ensure that their use of your information, when we share it with them, complies with Section 1798.100(d) of the California Civil Code when required thereunder. We implement reasonable security measures to ensure that your personal information is protected from unauthorized or illegal access, destruction, use, modification or disclosure, however, as further described in our Terms and Conditions of Use, there is no guarantee that these measures will be effective at all times.
You may make such a request by contacting us in writing by email to help@drlullaby.com. At this time, DrLullaby does not currently take actions to respond to Do Not Track signals because a uniform technological standard has not yet been developed. We continue to monitor and review new technologies and will modify this policy accordingly in the event of a change.
8. Amending this policy
We reserve the right to revise this Policy at any time. The revised Policy will be effective immediately upon posting to www.drlullaby.com. The posted terms will always have the Last Revision date included with the hyperlink. Your continued use of the Technology constitutes your agreement to abide by the Policy as changed. Under certain circumstances (for example, if we expand the ways in which we use your personal information beyond the uses stated in our Policy at the time of collection), we may also elect to notify you of changes or updates to our Policy by additional means, such as by sending you an email.
Questions relating to revisions to this Policy may be addressed to DrLullaby.
9. Contact information
Customer Service
1440 W Taylor Street #556
Chicago IL 60607