California Privacy Notice
Effective Date: September 4, 2026
This California Privacy Notice supplements the MyAshHealth Privacy Policy and provides additional information for California residents. It is intended to describe our California privacy practices and, to the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), applies to AshHEALTH, LLC d/b/a MyAshHealth, the rights available under that law.
Nothing in this Notice is intended as an admission that AshHEALTH, LLC is a “business” subject to the CCPA in every circumstance. Some health information may also be subject to HIPAA or other laws and may be exempt from particular CCPA provisions.
1. Categories of Personal Information
Depending on your interaction with MyAshHealth, we may collect the following categories of personal information:
| Category | Examples |
|---|---|
| Identifiers | Name, address, email, telephone number, date of birth, account or similar identifiers. |
| Customer and transaction information | Order records, billing status, payment-related records, customer-support history, and service information. |
| Protected classification information | Information such as age or other characteristics if voluntarily provided or relevant to services and permitted by law. |
| Commercial information | Records of services, programs, laboratory access, or transactions requested or obtained. |
| Internet or electronic activity | IP address, device/browser information, security logs, website interactions, and similar technical data. |
| Geolocation | General location derived from IP or information you choose to provide; precise geolocation is not intentionally collected unless needed for a disclosed service and permitted by law. |
| Professional or employment information | Information you provide in an inquiry or context where employment or professional status is relevant. |
| Sensitive personal information | Health information, account credentials, and other information treated as sensitive under applicable law. Some health information may be PHI governed by HIPAA and may be exempt from CCPA requirements. |
| Inferences | Limited inferences derived from information above for service administration, security, personalization, or support, where permitted by law. |
2. Sources of Personal Information
We may collect information directly from you; from your use of the Site; from healthcare professionals, pharmacies, laboratories, payment processors, service providers, or other parties involved in services you request; and from security, authentication, and technology systems used to operate MyAshHealth.
3. Business or Commercial Purposes
We use personal information to provide and administer services; facilitate healthcare, pharmacy, and laboratory workflows; process transactions and refunds; provide support; maintain accounts; secure and improve the Site; prevent fraud; comply with legal obligations; communicate with users; and conduct other activities described in the MyAshHealth Privacy Policy.
4. Disclosures to Service Providers and Other Parties
We may disclose personal information for business purposes to categories of recipients such as independently licensed healthcare professionals, licensed pharmacies, independent third-party laboratories, payment processors, hosting and technology vendors, communications and customer-support vendors, security providers, professional advisers, government agencies where required by law, and other parties you direct us to involve.
Mobile telephone numbers, SMS opt-in information, and SMS consent are not sold, rented, or shared with third parties or affiliates for their own marketing or promotional purposes.
5. Sale and Sharing for Cross-Context Behavioral Advertising
MyAshHealth does not currently sell personal information for monetary consideration. We also do not currently use social-media advertising or social-media analytics technologies to disclose health information from clinical intake, patient communications, prescription workflows, laboratory workflows, or authenticated patient experiences for third-party cross-context behavioral advertising.
If our practices change in a manner that constitutes “selling” or “sharing” under California law, we will update this Notice and implement any required opt-out mechanism, including recognition of legally required preference signals such as Global Privacy Control where applicable, before engaging in the covered practice.
6. Sensitive Personal Information
We use sensitive personal information only for purposes reasonably necessary to provide requested services, administer accounts and transactions, protect security and integrity, comply with law, and for other purposes permitted by applicable law. Health information subject to HIPAA is handled in accordance with our HIPAA Notice of Privacy Practices.
7. California Privacy Rights
To the extent the CCPA applies to MyAshHealth and to the information at issue, California residents may have the right to:
- Know the categories and specific pieces of personal information collected about them and related collection, use, and disclosure practices.
- Request deletion of personal information, subject to legal exceptions.
- Request correction of inaccurate personal information.
- Opt out of the sale or sharing of personal information if we engage in a practice that is legally defined as a sale or sharing.
- Limit certain uses and disclosures of sensitive personal information when the statutory right applies.
- Receive equal service and not be discriminated against for exercising applicable privacy rights.
8. How to Submit a Request
You may submit a California privacy request by contacting MyAshHealth at (585) 540-1353 or Supportteam@AshHealth.fit. We may need to verify your identity before completing a request. An authorized agent may submit a request on your behalf where permitted by law, but we may require proof of authority and/or direct verification with you.
9. Retention
We retain personal information only for as long as reasonably necessary for the purposes described in our Privacy Policy, including healthcare and business recordkeeping, legal and regulatory obligations, security, fraud prevention, tax and accounting, dispute resolution, and service administration. Retention periods vary by category and applicable law.
10. Children
MyAshHealth services are intended only for adults age 18 and older. We do not knowingly offer the Site or Services to minors. We therefore do not knowingly sell or share personal information of consumers under 16 through the MyAshHealth service.
11. Changes to This Notice
We may update this California Privacy Notice to reflect changes in law or our practices. We will post the revised notice with an updated effective date and provide additional notice when required.
12. Contact
AshHEALTH, LLC d/b/a MyAshHealth
1160 Pittsford Victor Road, Building M, Suite 12, Pittsford, NY 14534
Telephone: (585) 540-1353
Email: Supportteam@AshHealth.fit
Website: https://myashhealth.com