Privacy Policy

This Privacy Policy explains what personal data UpstreamDigital, LLC (“UpstreamDigital,” “we,” “us,” or “our”) collects, how we collect and use that information, and to whom we disclose it. This Privacy Policy applies to information we collect from visitors to our website, freebc.org, and any related websites (the “Sites”), and users of any other platforms, technologies, products, web applications, and on- and off-line services we offer (collectively with the Sites, the “Services”). This Privacy Policy incorporates our Terms of Use, which governs your use of our Services.

This Privacy Policy does not apply to information we collect from individuals in a business-to-business or employment context. This Privacy Policy also does not apply to third-party websites, applications, products, services, or other properties, even if our Services link to them or vice versa. We recommend that you review the privacy practices of those third parties before sharing personal data with them.

Although we are not a health care provider and are not a covered entity under HIPAA, in some cases we may be a “business associate” to covered entities under the Health Insurance Portability and Accountability Act (“HIPAA”), and as such we may have certain federal, state, and contractual restrictions on how we can use your health or medical information (collectively, your “Protected Health Information” or “PHI”). With respect to any PHI that we receive from covered entities, we will comply with our obligations under HIPAA as a business associate. This Privacy Policy is not intended to include information about how we handle HIPAA-regulated PHI. We encourage you to review the privacy policies and notices of privacy practices of your health care provider or other covered entity with which we may partner.

We may also collect, store, and use personal data (defined below) that is linked or reasonably linkable to you and that identifies your past, present, or future health status or mental health status, as may be applicable (“consumer health data”). If you are a resident of Connecticut, Nevada, or Washington, we provide more information about consumer health data collected about you, as well as the rights you may have related to this data, in our Consumer Health Data Privacy Notice.

Please note that we are providing the following disclosures and rights in this Privacy Policy in the interest of transparency. Such disclosures and rights are not intended to waive any applicable exemptions under state and federal law.

Table of Contents

1. Personal Data We Collect

As used in this Privacy Policy, “personal data” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identifiable individual. Personal data includes “personal information” as that term is defined in applicable privacy laws.

Personal data does not include publicly available information; lawfully obtained, truthful information that is a matter of public concern; information that has been deidentified; or aggregate consumer information. “Publicly available information” includes information that is made available from federal, state, or local government records; information that a business has a reasonable basis to believe is lawfully available to the general public, either through widely distributed media, or by the individual; and information that is made available by a person to whom the individual has disclosed the information if the individual has not restricted the information to a specific audience.

We may create aggregated, deidentified, or anonymized information from personal data by removing certain data components (such as your name, email address, or linkable tracking identifier) that make the data identifiable, or through aggregation, obfuscation, or other means. Subject to applicable law, our use and disclosure of such aggregated, deidentified, and anonymized information is not personal data or subject to this Privacy Policy.

Because of the overlapping nature of certain of the categories of personal data identified above, some of the personal data we collect may be reasonably classified under multiple categories.

2. Sources of Personal Data

We may collect personal data about you from the following categories of sources:

• Directly from you through your interactions with us, such as when you register for or use our Services, complete electronic forms, or otherwise communicate with us.
• Automatically through cookies and other tracking technologies, as discussed in more detail in “Cookies and Other Tracking Technologies” (Section 4).
• From our affiliates, licensees, and joint venture partners.
• From our service providers, including those providing hosting services, analytics services, cloud services, customer and technical support, email services, and other services.
• From our business partners (including healthcare providers and joint marketing campaign partners) (collectively, “Business Partners”), marketing partners, ad network providers, and advertisers.
• From social media and other platforms, including Apple and Google, if you register for an account through these platforms or otherwise interact with us through these platforms.
• Through artificial features we offer, which may include our chatbot Connie. For example, we may collect personal data you include in your prompts and other inputs when interacting with Connie, as well as personal data that is automatically generated from your interactions with Connie. We may use third-party providers in connection with our provision of Connie, which is provided on Anthropic on our behalf.

3. Disclosure of Personal Data

We may disclose personal data to the following categories of third parties:

• Affiliates. We disclose personal data to our affiliates, licensees, and joint venture partners.
• Service providers. We may disclose personal data to our service providers to provide services on our behalf, such as order fulfillment, payment processing, analytics, advertising, hosting, marketing, customer and technical support, and other services. For example, if you useour chatbot (Connie) or live chat on our Services, the information provided may be recorded and stored by our third-party provider Anthropic on our behalf.
• Other Third Parties. We may disclose personal data to other third parties, such as our Business Partners. Please note that we do not disclose personal data to third parties for those third parties’ own marketing purposes.
• Business transferees. If we or our affiliates are involved in a merger, acquisition, asset sale, or other corporate combination, your personal data may be transferred to the acquiring or surviving entity.
• Professional advisors. We may disclose personal data to our professional advisors, including lawyers, auditors, bankers, and insurers, where necessary in the course of the professional services they render to us.
• Authorities for compliance and harm prevention. Under certain circumstances, we may be required to disclose your personal data if required to do so by law or in response to valid requests by public authorities, and/or in response to a threat of harm involving an individual’s health and/or safety.
• Other parties with your consent. We may disclose personal data to other parties with your consent.

4. Cookies and Other Tracking Technologies

We use cookies and similar tracking technologies to track the activity on the Sites and we hold certain information. Cookies are files with a small amount of data which may include a unique identifier, and are sent to your browser from a website and stored on your device. We also use other tracking technologies, such as beacons, tags, and scripts to collect and track information and to improve and analyze our Sites. In this Privacy Policy, we collectively refer to these technologies as “cookies.”

Cookies on the Sites generally fall into the following categories:

• Essential cookies: These cookies are necessary for the Sites to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in, or filling in forms.
• Functional cookies: These cookies enable the Sites to provide enhanced functionality and personalization. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies, then some or all of these services may not function properly.
• Performance cookies: These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our Sites. They help us to know which pages are the most and least popular and see how visitors move around the Sites.
• Analytics cookies: These cookies track information about visits to the Sites so we can make improvements and report our performance. For example, we may analyze visitor behavior to provide more relevant content or suggest certain activities. These cookies collect information about how visitors use the Sites, which website the visitor came from, the number of each user’s visits, and how long a user stays on the Sites.

You can modify your browser settings to decline or accept certain cookies. However, if you decline certain cookies, some of our Sites’ features may not function as designed.

5. Children’s Data

Although our Services are not generally directed at children, we may collect personal data from children ages 13 to 18 in limited circumstances, such as when communicating or otherwise providing Services to minors. We do not knowingly collect any personal data from anyone under the age of 13.

If you are a parent or guardian and think that your child provided this kind of information through our Services, or if you are a child, and you would like us to remove such information from our records, we strongly encourage you to contact us immediately by emailing us at hello@freebc.org, and we will do our best to promptly process your request.

6. Data Security and Retention

The security of your personal data is important to us, but remember that no method of transmission over the Internet, or method of electronic storage, is 100% secure. We maintain appropriate technical, administrative, and physical safeguards to help protect the security of your personal data against unauthorized access, destruction, loss, alteration, disclosure, or misuse, but we cannot guarantee its absolute security.

We will retain your personal data for as long as necessary for the purposes outlined in this Privacy Policy. This information will be used and retained to the extent necessary to comply with any legal obligations or policies, to resolve disputes, and/or enforce legal agreements. Personal data may also be retained for internal analytics purposes. This information is retained for a shorter period, unless it is used to enhance security features or improve the functionality of our Services. Our determination of precise retention periods will be based on (a) the length of time we have an ongoing relationship with you; (b) whether there is a legal obligation to which we are subject; and (c) whether retention is advisable in light of our legal position, including regard to applicable statutes of limitations, litigation, or regulatory investigations.

7. Transfers of Personal Data

Your personal data may be transferred to and maintained on computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those of your jurisdiction. If you are located outside of the United States and choose to provide information to us, please note that we transfer personal data to the United States and process it there. For such transfers, we take the necessary measures to ensure that your personal data receives an adequate level of protection.

8. Opting Out of Promotional Communications

We may use your personal data to send you email updates regarding our Services, other announcements, inquiries, and upon your request, content from, or content that you upload to, the Sites (including videos and transcripts of your conversations with our chatbot, Connie. If you no longer wish to receive promotional email communications from us, you may opt out via the unsubscribe link included in such emails or email us at hello@freebc.org. We will comply with your request as soon as reasonably practicable. Please note that if you opt out of receiving promotional emails from us, we may still send you important administrative messages that are required to provide you with the Services or for other reasons disclosed in this Privacy Policy.

Additionally, you may consent to receive ongoing or recurring informational and/or marketing text messages (such as SMS, MMS, RCS, or successor protocols or technologies) (collectively, “Messages”) from us and service providers acting our behalf. You can opt out of receiving these messages at any time by texting “STOP” to any message you receive or by contacting us at hello@freebc.org. After you opt out of these messages, we will send you a final message to confirm that you have unsubscribed and/or clarify the scope of your opt-out. If you are experiencing issues with the messaging program you can text “HELP” for more assistance, or contact us at hello@freebc.org.

9. Supplemental State Notices

We are providing the following disclosures and rights in the interest of transparency and in furtherance of our privacy commitment to you. Such disclosures and rights are not intended to waive any applicable exemptions under state and federal law.

A. Privacy Notice for Residents of Nevada

We do not “sell” personal data as that term is defined under Nevada law. However, Nevada residents have the right to opt out of any future sale of their personal data under Nevada SB 220. If you are a Nevada resident and would like to make such a request, please email us at hello@freebc.org. You must include your full name, email address, and postal address in your email or mail request so that we can verify your Nevada residence and respond. In the event we sell your personal data after receipt of your request, we will make reasonable efforts to comply with your request.

B. Privacy Notice for Residents of Other States

This Privacy Notice contains additional information for residents of Alabama (beginning May 1, 2027), Colorado, Delaware, Maryland, Minnesota, New Jersey, and Oregon about personal data that we collect, how we use it, what sources it is derived from, and who we disclose it to, and provides information regarding your rights, and our responsibilities, under applicable laws and regulations. The provisions contained within this section, in addition to the disclosures throughout the rest of this Privacy Policy, are intended to provide notices in compliance with the Alabama Personal Data Protection Act (beginning May 1, 2027), the Colorado Privacy Act, the Delaware Personal Data Privacy Act, the Maryland Online Data Privacy Act, the Minnesota Consumer Data Privacy Act, the New Jersey Privacy Act, and the Oregon Consumer Data Privacy Act (collectively, the “State Privacy Laws”). This section does not apply to certain personal data that is collected from an individual in a business-to-business or employment context.

For purposes of this section, “personal data” means any information that is linked or reasonably linkable to an identified or identifiable natural person. Personal data does not include de-identified data or publicly available information.

i. Our personal data practices

The State Privacy Laws provide rights to residents of those states to receive certain disclosures and access regarding collection, use, sale, and sharing of personal data. More detail about what kinds of personal data we may collect or have collected, how we collect it, why we collect it, and who we may disclose it to is found in the Personal Data We Collect; Sources of Personal Data; and Disclosure of Personal Data sections of this Privacy Policy.

ii. Your privacy rights

If you are an Alabama, Colorado, Delaware, Maryland, Minnesota, New Jersey, or Oregon resident, you have the following rights under applicable law in relation to your personal data, subject to certain exceptions:

• Right to know and access. You have the right to know what personal data we collect, use, disclose, and/or sell or share as those terms are defined under applicable law. You may ask us to provide you a portable copy of this information up to two times in a rolling twelve-month period. If you are a Delaware, Minnesota, or Oregon resident, you also have the right to obtain a list of the specific third parties to which we have disclosed your personal data or, at our option, any personal data.
• Right to delete and erase. You have the right to request under certain circumstances that we, as well as our service providers and contractors, delete the personal data that we collect about you.
• Right to correct inaccurate personal data. You have the right to request the correction of inaccurate personal data.
• Right to non-discrimination. You have the right not to receive discriminatory treatment for the exercise of the privacy rights described above.
• Right to opt out. You have the right to opt out of targeted advertising, our sale of your personal data, and profiling decisions that could produce legal or similarly significant effects concerning the consumer.
• Rights concerning sensitive personal data. If you are an Alabama, Colorado, Delaware, Maryland, Minnesota, New Jersey, or Oregon resident, we cannot process your sensitive data or your sensitive data inferences, or use your personal data for certain purposes without your affirmative consent.

iii. How to exercise your rights

You may exercise any of the rights described in this section by emailing us at hello@freebc.org.

All requests are subject to certain exceptions under applicable law. Consistent with applicable law, you may designate an authorized agent to submit a request on your behalf, and if so, we may require proof of your authorization of the agent and/or verification of the agent’s own identity. Please note that any request submitted to us is subject to an identification and residency verification process, to the extent permitted under applicable law. We will only use personal data provided in a request to verify your (or your authorized agent’s as applicable) identity or authority to make the request.

We will respond and process requests consistent with applicable law. Except where otherwise noted, we will respond to your request within forty-five (45) calendar days after receipt and we reserve the right to extend the response time by an additional forty-five (45) days when reasonably necessary, provided that the extension is made within the first forty-five (45) days.

We do not charge a fee to process or respond to a request unless it is excessive, repetitive, or manifestly unfounded. If we determine that a request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request. You may be limited in how many requests you make within a twelve (12) month period.

iv. How to appeal decisions about your rights

Colorado, Delaware, Maryland, Minnesota, New Jersey, and Oregon residents can appeal our decisions concerning privacy rights requests, as follows:

• Colorado residents. If you are a Colorado resident and want to appeal our decision about a request that you have made, please email us at hello@freebc.org. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If the appeal is denied, you may contact Colorado’s Office of the Attorney General by phone at (720) 508-6000 or by submitting a form here.
• Delaware residents. If you are a Delaware resident and want to appeal our decision about a request that you have made, please email us at hello@freebc.org. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If the appeal is denied, you may contact Delaware’s Department of Justice by phone at (302) 683-8800 or by submitting a form here.
• Maryland residents. If you are a Maryland resident and want to appeal our decision about a request that you have made, please email us at hello@freebc.org. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If the appeal is denied, you may contact Maryland’s Office of the Attorney General by phone at (888) 743-0023 or by submitting a form here.
• Minnesota residents. If you are a Minnesota resident and want to appeal our decision about a request that you have made, please email us at hello@freebc.org. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If the appeal is denied, you may contact Minnesota’s Office of the Attorney General by phone at (800) 657-3787 or by submitting a form here.
• New Jersey residents. If you are a New Jersey resident and want to appeal our decision about a request that you have made, please email us at hello@freebc.org. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If the appeal is denied, you may contact New Jersey’s Office of the Attorney General by phone at (800) 242-5846 or by submitting a form here.
• Oregon residents. If you are an Oregon resident and want to appeal our decision about a request that you have made, please email us at hello@freebc.org. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If the appeal is denied, you may contact Oregon’s Office of the Attorney General by phone at (877) 877-9392 or by submitting a form here.

10. Updates to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes consistent with applicable law, including by posting the new Privacy Policy on this page and updating the “effective date” at the top of this Privacy Policy. We recommend reviewing this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

11. Contact Us

If you have questions or concerns regarding this Privacy Policy, please email us at hello@freebc.org.