Introduction

Personal Information We Collect From You

We collect different types of information about you, including information that may directly identify you, information that is about you but individually does not personally identify you, and information that we combine with our other users. That includes information that we collect directly from you or through automated collection technologies. Data will be collected, stored and used in a manner that ensures it is relevant, timely, accurate, coherent, transparent and accessible. It is your responsibility to provide us with quality data when asked so we can appropriately serve you. 

Generally

We collect several types of information from and about users of our Website, specifically information:

• by which you may be personally identified, such as name, address, e-mail address, telephone numbers, date of birth, your medical history, health information, and health insurance coverage (“Personal Data”) when you submit a website form;
• that is about you but individually does not identify you, such as traffic data, logs, referring pages/links, date and time of your visit to our Website, error information, clickstream data (third-party tracking apps such as Google analytics), and other communication data and the resources that you access and use on the Website; or
• about your Internet connection, the equipment you use to access our Website, IP Address, location of where you access our Website, and other usage details.

We collect this information:

• directly from you when you provide it to us;
• from our partnered bariatric clinics when they enter information into our system;
• automatically as you navigate through the Website. Information collected automatically may include usage details, IP addresses, and information collected through cookies and other tracking technologies;
• through connected devices such as Withings-integrated smart scales used as part of the BariSuccess program; and
• from third parties, for example, our business partners and Providers.

Information You Provide to Us

The information we collect on or through our Website is:

• information that you provide by filling in forms on our Website. This includes information provided when you request an appointment, using our Provider consultation services, purchasing products, or requesting further services. We may also ask you for information when you report a problem with our Website;
• records and copies of your correspondence (including mobile phone for text messages and email addresses), if you contact us; and
• details of transactions you carry out through our Website via Stripe if purchasing a digital scale for RPM. You may be required to provide financial information before placing an order through our Website.

Information We Collect Through Automatic Data Collection Technologies

As you navigate through and interact with our Website, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, specifically:

• details of your visits to our Website, such as traffic data, location, logs, referring/exit pages, date and time of your visit to our Website, error information, clickstream data (third-party tracking apps such as Google analytics), and other communication data and the resources that you access and use on the Website; and
• information about your computer, Internet connection, specifically your IP address and browser type.

The information we collect automatically may include Personal Data or we may maintain it or associate it with Personal Data we collect in other ways or receive from third parties. It helps us to improve our Website and to deliver a better and more personalized service by enabling us to:

• estimate our audience size and usage patterns;
• store information about your preferences, allowing us to customize our Website according to your individual interests; and
• recognize you when you return to our Website.

The technologies we use for this automatic data collection may include:

• Cookies (or browser cookies). We and our service providers may use cookies, web beacons, pixels, and other technologies to receive and store certain types of information whenever you interact with our Website through your computer or mobile device. A “cookie” is a small file placed on the hard drive of your computer or mobile device. On your computer, you may refuse to accept browser cookies by activating the appropriate setting on your browser, and you may have similar capabilities on your mobile device in the preferences for your operating system or browser. However, if you select this setting you may be unable to access certain parts of our Website. Unless you have adjusted your browser or operating system setting so that it will refuse cookies, our system will issue cookies when you direct your browser to our Website.
• Google Analytics. We use Google Analytics, a web analytics service provided by Google, Inc. (“Google”) to collect certain information relating to your use of the Website. Google Analytics uses cookies to help the Website analyze how users use the site. You can find out more about how Google uses data when you visit our Website by visiting “How Google uses data when you use our partners’ sites or apps”, (located at google.com/policies/privacy/partners/ ). We may also use Google Analytics Advertising Features or other advertising networks to provide you with interest-based advertising based on your online activity. For more information regarding Google Analytics please visit Google’s website, and pages that describe Google Analytics, such as www.google.com/analytics/learn/privacy.html .

BariLead – AI Powered Patient Marketing Campaigns

Bariatric Centers of America offers BariLead, a patient engagement and marketing platform available to our partnered bariatric clinics. If your clinic uses BariLead, certain information about you may be used to deliver AI-powered marketing campaigns designed to support your care journey and inform you of relevant services and programs.

What Information Is Used

For patients whose clinics have enrolled in BariLead, we may use the following categories of your information in connection with AI marketing campaigns:

• Contact and identification information: your name, email address, phone number, and similar contact details.
• Behavioral and engagement data: information about how you interact with communications, our Website, and related digital touchpoints (e.g., whether you have opened an email, clicked a link, or scheduled a consultation).

We do not use your medical records, diagnoses, clinical notes, or detailed health information for AI marketing campaign targeting within BariLead.

How This Information Is Used

The information described above may be processed by AI-driven tools to:

• personalize outreach communications about bariatric care services relevant to your stage of the patient journey;
• determine the timing, channel (e.g., email or SMS), and content of marketing messages sent on behalf of your clinic; and
• analyze engagement patterns to improve the effectiveness of patient communications.

Marketing campaigns sent through BariLead are conducted on behalf of your partnered bariatric clinic, not by Bariatric Centers of America for its own commercial benefit. Your contact information is not sold to third parties, and your opt-in consent is not shared with any third-party organizations.

Your Choices Regarding BariLead Communications

You may opt out of AI-powered marketing communications at any time by:

• clicking the unsubscribe link at the bottom of any email communication;
• replying STOP to any SMS message; or
• contacting us directly at care@bcofa.com.

Opting out of marketing communications will not affect your receipt of appointment reminders, care notifications, or other service-related messages necessary to your care.

BariSuccess – Remote Patient Monitoring and Withings Integration

BariSuccess is our remote patient monitoring (RPM) program, which may include a connected smart scale (currently provided through an integration with Withings, a third-party digital health platform). If you or your clinic participates in BariSuccess, the following applies to how your data is collected, used, and shared.

How Data Flows Through the BariSuccess Integration

When you use a BariSuccess-connected smart scale, body weight and related biometric measurements are collected by the device. That data flows as follows:

• From the scale, your biometric data is transmitted to Withings’ platform and mobile application, where it is stored and displayed in accordance with Withings’ own privacy policy.
• Withings then transmits your biometric data (such as weight measurements) into the Bariatric Centers of America system, where it becomes part of your patient record accessible to your care team.

Bariatric Centers of America does not control Withings’ collection, storage, or use of your data on the Withings platform. We encourage you to review Withings’ Privacy Policy at withings.com/us/en/legal/privacy-policy to understand how they handle your information.

What Biometric Data Is Collected

Through the BariSuccess Withings integration, we may collect and store the following types of data in our system:

• body weight and weight trend data;
• date and time of each measurement; and
• device identifiers associated with the connected scale.

This data is used by your care team to monitor your progress, provide clinical support, and improve your care outcomes.

Withings as a Third-Party Service Provider

Withings operates as a third-party technology provider in connection with BariSuccess. Data shared with Withings is subject to a data processing arrangement consistent with applicable privacy and health data regulations, including HIPAA where applicable. Withings is required to maintain appropriate security standards for any health-related data processed on our behalf.

If you do not wish your scale data to be transmitted into the Bariatric Centers of America system, please contact your care team or reach us at care@bcofa.com to discuss alternative monitoring arrangements.

Disclosures Related To Communications With You Or Your Family

Your Rights and Choices About How We Use and Disclose Your Information

You can review and change your Personal Data by emailing us at care@bcofa.com and we will make any changes to any Personal Data we have about you to ensure that it is complete, accurate, and as current as possible. We cannot delete certain types of personal information (such as your email or name) except by also deleting your account within our system. We may also not be able to accommodate your request if we believe it would violate any law or legal requirement or our agreement with your bariatric provider.

We offer you choices on how you can opt-out of our use of tracking technology, disclosure of your Personal Data for our advertising to you, and other targeted advertising.

We do not control the collection and use of your information collected by third parties described above in Disclosure of Your Information. These third parties may aggregate the information they collect with information from their other customers for their own purposes.

In addition, we strive to provide you with choices regarding the Personal Data you provide to us. We have created mechanisms to provide you with control over your Personal Data:

• Tracking Technologies and Advertising. You can set your browser or operating to refuse all or some cookies or to alert you when cookies are being sent. If you disable or refuse cookies, please note that some parts of our Website may then be inaccessible or not function properly
• Promotional Offers from Bariatric Centers of America. If you do not wish to have your email address used by Bariatric Centers of America to promote our own products and services, you can opt-out at any time by clicking the unsubscribe link at the bottom of any email or other marketing communications you receive from us. This opt-out does not apply to information provided to Bariatric Centers of America as a result of a product purchase, or your use of our services.
• BariLead Marketing Campaigns. You may opt out of AI-powered marketing communications from BariLead at any time by clicking unsubscribe in any email, replying STOP to any SMS, or contacting care@bcofa.com.
• BariSuccess Biometric Data. If you wish to discontinue transmitting scale data to our system through the Withings integration, please contact your care team or email care@bcofa.com.
• Targeted Advertising. To learn more about interest-based advertisements and your opt-out rights and options, visit the Digital Advertising Alliance and the Network Advertising Initiative websites (aboutads.info and www.networkadvertising.org ). Please note that if you choose to opt-out, you will continue to see ads, but they will not be based on your online activity. We do not control the third-party collection or use of your information to serve interest-based advertising. However, these third parties may provide you with ways to choose not to have your information collected or used in this way. You can also opt-out of receiving targeted ads from members of the NAI on its website.

Retention and Disposal of Records

For Patients

Patient data is retained for as long as the account is in active status. Data enters an “expired” state when the account is voluntarily closed by the patient. Expired account data will be retained for 30 days. After this period, the account and related data will be removed.

If a patient account is involuntarily suspended, then there is a 30-day grace period during which the account will be inaccessible but can be reopened if the patient meets their payment obligations and resolves any terms of service violations.

For Clients

Client’s patient data is retained for as long as their account is in active status. Data enters an “expired” state when the client’s account is voluntarily closed by the client. Expired account data will be retained for 45 days. After this period, the account and related data will be removed. A client that wishes to voluntarily close an account can download their data manually prior to closing the account. Bariatric Centers of America will notify the client of the status of their account prior to the 45 days so the client can retrieve all necessary data.

If a client account is involuntarily suspended, then there is a 30-day grace period during which the account will be inaccessible but can be reopened if the client meets their payment obligations and resolves any terms of service violations.

If a client wishes to manually back up their data in a suspended account, then they must ensure that their account is brought back to good standing so that the user interface will be available for their use. After 90 days, the suspended account will be closed, and the data will enter the “expired” state. It will be permanently removed 45 days thereafter (except when required by law to retain).

Withings and BariSuccess Data

Biometric data transmitted from a Withings-connected scale into our system is subject to the same retention schedule as other patient data described above. Data that resides on the Withings platform is governed by Withings’ own data retention policies; please refer to their privacy policy for details.

Data Quality and Security

We have implemented administrative, technical, and physical safeguards designed to protect against the risk of accidental, intentional, unlawful, or unauthorized access, alteration, destruction, disclosure, or misuse. We also require third-party service providers, including cloud storage vendors, AI platform providers, and remote monitoring integrations, to maintain security certifications such as SOC 2 Type II or ISO 27001.

We have taken steps and implemented administrative, technical, and physical safeguards designed to protect against the risk of accidental, intentional, unlawful, or unauthorized access, alteration, destruction, disclosure, or unauthorized  use or misuse. We also require third-party service providers, including cloud storage vendors, to maintain security certifications such as SOC 2 Type II or ISO 27001.

The Internet is not 100% secure and we cannot guarantee the security of information transmitted through the Internet; however all personal information is accessed and stored via a third-party cloud infrastructure. Where you have been given or you have chosen a password, it is your responsibility to keep this password confidential.

The sharing and disclosing of information via the internet is not completely secure. We strive to use best practices, maintaining compliance with governmental HIPAA regulations and other industry standard security measures and tools to protect your data. However, we cannot guarantee the security of Personal Information transmitted to, on, or through our systems. Any transmission of Personal Information is at your own risk. We are not responsible for the circumvention of any privacy settings or security measures contained on our Platform, in your operating system, or mobile device.