Your health data belongs to you. This policy explains what we collect, why we collect it, who we share it with, and the choices you have.
1. Overview
This Privacy Policy describes how the Black Heart Association (“BHA,” “we,” “us”) collects, uses, and shares information through the Deployed Hearts website, mobile applications, and services (the “Services”). It applies to customers, event attendees, hiring organizations, and healthcare workers.
We do not sell your personal information or your health data. Ever.
2. Information we collect
Information you provide
- Account and contact details: name, email, phone number, date of birth, shipping and service addresses.
- Health information: test orders, sample details, lab results, health history and screening answers, and blood pressure or other measurements taken at a visit or event.
- Payment information: processed directly by Stripe. We receive a confirmation and limited details (such as card brand and last four digits) but never your full card number.
- Healthcare worker information: licenses, certifications, insurance, background-check results, and payout details.
- Communications: messages you send us by email, text, phone, or contact form.
Information collected automatically
- Device and usage data: browser type, device type, IP address, pages viewed, and app activity, used to operate and secure the Services.
- Location (healthcare workers only): when you check in to a job, the mobile app collects your precise GPS location to verify arrival. Photos you take of kits or supplies are uploaded as part of the job record.
- Cookies and local storage: used to keep you signed in, remember your cart, and store preferences. See Cookies below.
3. How we use information
- Provide, ship, schedule, and fulfill tests, home visits, and events;
- Send samples to partner laboratories and deliver results to you;
- Enable physician review and follow-up on results, including critical values;
- Process payments, refunds, and healthcare worker payouts;
- Verify healthcare worker credentials and job completion;
- Send transactional emails and texts about your orders, appointments, and results;
- Provide customer support and respond to your requests;
- Measure the community impact of our programs using de-identified or aggregated data;
- Protect against fraud and misuse, and comply with legal obligations.
4. Health information and HIPAA
Health information we handle in connection with testing is treated as protected health information. We protect it using the administrative, physical, and technical safeguards required by the Health Insurance Portability and Accountability Act (HIPAA), and we share it only as needed to provide your care and services, as permitted or required by law, or with your authorization.
We may use health information that has been de-identified in accordance with HIPAA, or combined into aggregate statistics, to study and report on heart-health disparities. This data cannot reasonably be used to identify you.
7. Your rights and choices
Depending on where you live, you may have the right to:
- Access and receive a copy of your personal and health information;
- Request correction of inaccurate information;
- Request deletion of your account and personal information, subject to legal retention requirements;
- Withdraw consent or opt out of non-essential communications;
- Request an accounting of certain disclosures of your health information.
To make a request, email info@blackheartassociation.org. We will verify your identity before responding. You can opt out of text messages at any time by replying STOP, and out of marketing emails using the unsubscribe link. Healthcare workers can turn off location access in their device settings, although GPS check-in is required to accept and complete jobs.
8. Data retention
We keep information for as long as your account is active and as needed to provide the Services. Laboratory results and related medical records are retained for the periods required by federal and state law. When information is no longer needed, we securely delete or de-identify it.
9. Security
We protect information using encryption in transit and at rest, access controls, audit logging, and staff training. No system is completely secure, so we cannot guarantee absolute security. If a breach affects your information, we will notify you as required by law.
10. Children
The Services are intended for adults 18 and older. We do not knowingly collect personal information from children under 13. Tests for minors may only be ordered by a parent or legal guardian where permitted. If you believe a child has provided us information, contact us and we will delete it.
11. Changes to this policy
We may update this policy from time to time. If we make material changes, we will notify you by email or through the Services before they take effect. The “Last updated” date above shows when this policy was last revised.
12. Contact us
For privacy questions or requests, contact our privacy team:
Black Heart Association — Deployed Hearts
Phone: (972) 646-0031
Email: info@blackheartassociation.org
See also our Terms of Service.