Last Updated and Effective Date:  [___July 17, 2023__]

This Privacy Policy describes how MFP Agency, LLC DBA Total Health, and our subsidiaries and affiliated companies (collectively, “MFP Agency, LLC DBA Total Health,” “we,” or “us”) collect, use, and disclose personal information about you and your data privacy rights. Personal information is sometimes also referred to as personal data, personally identifiable information or other like terms to mean any information that directly or indirectly identifies you or is reasonably capable of being associated with you or your household. This Privacy Policy applies to personal information we collect online and offline, such as when you use our website or interact with us to conduct business dealings, including the personal information we obtain from business partners and service providers and contractors who provide us certain business services (“B2B Dealings”) (collectively, our “Services”).

Please note that this Privacy Policy does not apply to any information we collect from consumers or customers that is covered by the federal Gramm-Leach-Bliley Act. For Financial Privacy-Covered Data, please see our privacy policies here. To the extent any MFP Agency, LLC DBA Total Health parent, subsidiary or affiliate has different privacy practices, such entity shall have their own privacy statement posted as applicable.

We may provide different or additional notices of our privacy practices with respect to other personal information collection practices not within the scope of this Privacy Policy, in which case this Privacy Policy will not apply.

We may change this Privacy Policy from time to time. If we make changes, we will notify you by revising the date at the top of this policy. We may also provide you with an additional notice (such as by adding a statement to the Services or sending you a notification), in connection with making material changes to this Privacy Policy. We encourage you to review this Privacy Policy regularly to stay informed about our information practices and the choices available to you.

Please note that our Services and this Privacy Policy are directed only to users in the United States.

Contents

1. NOTICE AT COLLECTION
1. Collection of Personal Information
1. Personal Information You Provide to Us
2. Personal Information We Collect Automatically
3. Personal Information We Collect from Other Sources
4. Personal Information We Derive
2. Purpose and Use of Personal Information
3. Disclosure of Personal Information
4. Retention of Personal Information
2. ADVERTISING AND ANALYTICS
3. TRANSFER OF INFORMATION TO THE UNITED STATES AND OTHER COUNTRIES
4. YOUR CHOICES
1. Cookies
2. Communications Preferences
5. CHILDREN
6. YOUR CALIFORNIA RIGHTS
1. Summary of Categories of Personal Information Collected and Disclosed
2. Selling or Sharing of Personal Information
3. Opt-Out Preference Signals and “Do Not Track” Requests
1. We Honor Opt-Out Preference Signals
2. “Do Not Track” Requests
4. Sensitive Personal Information
5. Your Privacy Rights
6. Instructions on How to Exercise Your Privacy Rights
7. Authorized Agents
8. Additional Disclosure for California Residents
7. CONTACT US

I. NOTICE AT COLLECTION

This Notice at Collection describes how we handle personal information collected about you when you engage our Services.

A. Collection of Personal Information

1. Personal Information You Provide to Us

We may collect personal information you provide directly to us. For example, we may collect information directly from you when you provide your personal information on our website or conduct B2B Dealings with us. The types of personal information that we may collect directly from you include the following:

• Contact Information: We collect certain identifiers and contact information from you, such as name, phone number, business name, your title, email address, geolocation/postal address, and other similar identifiers.

2. Personal Information We Collect Automatically

We may automatically collect certain personal information about your interactions with us or our Services, including:

• Activity Information: We may collect information about your activity on our Services, such as your use of our website or other online Services.

• Device and Usage Information: We may collect information about how you access our Services, including data about the device and network you use, such as your hardware model, operating system version, mobile network, IP address, unique device identifiers, and browser type. We also collect information about your activity on our Services, such as access times, pages viewed, links clicked, and the page you visited before navigating to our Services.
• Information Collected by Cookies and Similar Tracking Technologies: We and others that control collection of personal information may use tracking technologies, such as cookies and web beacons, to collect information about you. Cookies are small data files stored on your hard drive or in device memory that help us improve our Services and your experience, see which areas and features of our Services are popular, and count visits. Web beacons (also known as “pixel tags” or “clear GIFs”) are electronic images that we use on our Services and in our emails to help deliver cookies, count visits, and understand usage and campaign effectiveness. For more information about cookies and how to disable them, see Your Choices below in Section IV.

3. Personal Information We Collect from Other Sources

We may obtain personal information from other sources. For example, we may collect information from advertising networks, data analytics providers, operating systems and platforms, mailing list providers, social networks, and other advertising partners. This information includes your contact information and usage data collected through cookies and other trackers described in Advertising and Analytics in Section II below.

4. Personal Information We Derive

We may derive personal information or draw inferences about you based on the information we collect. For example, we may make inferences about your approximate location based on your IP address or infer that you are interested in certain services based on your use of our website.

B. Purpose and Use of Personal Information

We may use the categories of personal information identified in Collection of Personal Information in Section I.A above for the following purposes:

• Provide, maintain, and improve our Services;
• Conduct business dealings with our partners, service providers or contractors;
• Process transactions and send you related information, including confirmations, receipts, invoices, and customer experience surveys;
• Personalize and improve your experience on our Services;
• Send you technical notices, security alerts, and support and administrative messages;
• Respond to your comments and questions and provide customer service;
• Communicate with you about products, services, and events offered by MFP Agency, LLC DBA Total Health and others and provide news and information that we think will interest you (see Your Choices in Section IV below for information about how to opt out of these communications at any time);
• Monitor and analyze trends, usage, and activities in connection with our Services;
• Personalize the advertisements you see on third-party platforms and websites (for more information, see Advertising and Analytics in Section II below);
• Personalize the advertisements you see when you use our Services based on information provided by our advertising partners;
• Detect, investigate, and prevent security incidents and other malicious, deceptive, fraudulent, or illegal activity and protect the rights and property of MFP Agency, LLC DBA Total Health and others;
• Debug to identify and repair errors in our Services;
• Comply with our legal and financial obligations; and
• Carry out any other purpose described to you at the time the information was collected.

C. Disclosure of Personal Information

We disclose personal information in the following circumstances or as otherwise described in this policy:

• Our Service Providers and Contractors: We may disclose personal information to service providers and contractors who provide us services, such as IT, cloud computing, call center, managed hosting and similar services.
• Sold or Shared: We may sell or share personal information, as described in Selling or Sharing of Personal Information in Section VI.B below.
• Legal Disclosures: We may disclose personal information if we believe that disclosure is in accordance with, or required by, any applicable law or legal process, including lawful requests by public authorities to meet national security or law enforcement requirements. We may also  disclose personal information if we believe that your actions are inconsistent with our user agreements or policies, if we believe that you have violated the law, or if we believe it is necessary to protect the rights, property, and safety of MFP Agency, LLC DBA Total Health, our users, the public, or others.
• Disclosed to Advisors and Lawyers: We may disclose personal information with our lawyers and other professional advisors where necessary to obtain advice or otherwise protect and manage our business interests.
• Disclosed During Change of Ownership: We may disclose personal information in connection with, or during negotiations concerning, any merger, sale of company assets, financing, or acquisition of all or a portion of our business by another company.
• Among Our Family of Companies: Personal information may be disclosed between and among MFP Agency, LLC DBA Total Health and our current and future parents, affiliates, and subsidiaries and other companies under common control and ownership.
• With Your Consent: We may disclose personal information with your consent or at your direction.
• Disclosure of Non-Personal Information: We may also disclose aggregated or de-identified information that cannot reasonably be used to identify you. When doing so, we publicly commit to maintain and use the information in an aggregated or de-identified form and not attempt to re-identify the information, unless permitted or required by law.
• All above exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties

D. Retention of Personal Information

We store personal information for as long as necessary to carry out the purposes for which we originally collected it and for other legitimate business purposes, including to meet our legal, regulatory, or other compliance obligations.

II. ADVERTISING AND ANALYTICS

We may allow others to provide analytics services and serve advertisements on our behalf across the web. These entities may use cookies, web beacons, device identifiers, and other technologies to collect information about your use of our Services and other websites and applications, including your IP address, web browser, mobile network information, pages viewed, time spent on pages, links clicked, and conversion information. This information may be used by usand others to, among other things, analyze and track data, determine the popularity of certain content, deliver advertising and content targeted to your interests on our Services and other websites, and better understand your online activity. For more information about interest-based ads, or to opt out of having your web browsing information used for behavioral advertising purposes, please visit www.aboutads.info/choices.

We may also work with third parties to serve ads to you as part of customized campaigns on third-party platforms. As part of these ad campaigns, we or the third-party platforms may convert information about you into a unique value that can be matched with a user account on these platforms to allow us to learn about your interests and serve you advertising that is customized to your interests. Note that the third-party platforms may offer you choices about whether you see these types of customized ads.

III. TRANSFER OF INFORMATION TO THE UNITED STATES AND OTHER COUNTRIES

MFP Agency, LLC DBA Total Health is headquartered in the United States, and we have operations and service providers in the United States and other countries. Therefore, we and our service providers may transfer your personal information to, or store or access it in, jurisdictions that may not provide levels of data protection that are equivalent to those of your home jurisdiction. We will take steps to ensure that your personal information receives an adequate level of protection in the jurisdictions in which we process it.

IV. YOUR CHOICES

A. Cookies

Most web browsers are set to accept cookies by default. If you prefer, you can usually adjust your browser settings to remove or reject browser cookies. Please note that removing or rejecting cookies could affect the availability and functionality of our Services.

B. Communications Preferences

You may opt out of receiving text messages or promotional emails from MFP Agency, LLC DBA Total Health by following the instructions in those communications or by by opting out here. If you opt out, we may still send you non-promotional emails, such as those about our ongoing business relations.

V. CHILDREN

This website is not intended for or directed at children under the age of 18. In addition, we do not knowingly collect personal information from children under the age of 18. We also do not knowingly sell, share, use for targeted advertising or disclose the personal information of children under the age of 18.

VI. YOUR CALIFORNIA RIGHTS

The California Privacy Rights Act or “CPRA” (Cal. Civ. Code § 1798.100 et seq.) and the Shine the Light law (Cal. Civ. Code § 1798.83) afford consumers residing in California certain rights with respect to their personal information. If you are a California resident, this section applies to you.

A. Summary of Categories of Personal Information Collected and Disclosed

In the preceding 12 months, we have collected the categories of personal information set forth in the table below. For details about the precise data points we collect and the categories of sources of such collection, please see Collection of Personal Information in Section I.A above. We collect personal information for the business and commercial purposes described in Purpose and Use of Personal Information in Section I.B above. In the preceding 12 months, we have disclosed the following categories of personal information for business purposes to the following categories of recipients, which we also describe in greater detail in Disclosure of Personal Information in Section I.C above:

Category of Personal Information We Collect	Business Purpose for Disclosure	Category of Recipients
Identifiers, such as your name, alias, postal address, unique personal identifier, online identifier, Internet Protocol (IP) address, and email address.	To provide, maintain and improve our Services and conduct business dealings; To communicate with you; For advertising and analytics purposes; For security and technical reasons; For other purposes described to you at or before the time we provide you notice, including those listed in the Notice at Collection in Section I; and To fulfill our compliance or legal obligations or as otherwise permitted by applicable laws.	Third party advertising and marketing providers; Service providers and/or contractors, such as IT, cloud computing, call center, managed hosting and similar services providers; and We may also have used or disclosed this category of personal information to other parties, as described in greater detail in the Purpose and Use of Personal Information and Disclosure of Personal Information sections.
Any personal information described in the California Customer Records Act (Cal. Civ. Code § 1798.80(e)), such as your signature, telephone number, and the company you work for.	To provide, maintain and improve our Services and conduct business dealings; To communicate with you; For advertising and analytics purposes; For security and technical reasons; For other purposes described to you at or before the time we provide you notice, including those listed in the Notice at Collection in Section I; and To fulfill our compliance or legal obligations or as otherwise permitted by applicable laws.	Third party advertising and marketing providers; Service providers and/or contractors, such as IT, cloud computing, call center, managed hosting and similar services providers; and We may also have used or disclosed this category of personal information to other parties, as described in greater detail in the Purpose and Use of Personal Information and Disclosure of Personal Information sections.
Internet or other electronic network activity information, such as browsing history, search history, and information regarding a consumer’s interaction with an internet website application, or advertisement.	To provide, maintain and improve our Services and conduct business dealings; To communicate with you; For advertising and analytics purposes; For security and technical reasons; For other purposes described to you at or before the time we provide you notice, including those listed in the Notice at Collection in Section I; and To fulfill our compliance or legal obligations or as otherwise permitted by applicable laws.	Third party advertising and marketing providers; Service providers and/or contractors, such as IT, cloud computing, call center, managed hosting and similar services providers; and We may also have used or disclosed this category of personal information to other parties, as described in greater detail in the Purpose and Use of Personal Information and Disclosure of Personal Information sections.
Geolocation data.	To provide, maintain and improve our Services and conduct business dealings; To communicate with you; For advertising and analytics purposes; For security and technical reasons; For other purposes described to you at or before the time we provide you notice, including those listed in the Notice at Collection in Section I; and To fulfill our compliance or legal obligations or as otherwise permitted by applicable laws.	Third party advertising and marketing providers; Service providers and/or contractors, such as IT, cloud computing, call center, managed hosting and similar services providers; and We may also have used or disclosed this category of personal information to other parties, as described in greater detail in the Purpose and Use of Personal Information and Disclosure of Personal Information sections.
[Audio, electronic, visual, or similar information, such as recorded calls if you contact our customer service center.	To provide, maintain and improve our Services and conduct business dealings; To communicate with you; For advertising and analytics purposes; For security and technical reasons; For other purposes described to you at or before the time we provide you notice, including those listed in the Notice at Collection in Section I; and To fulfill our compliance or legal obligations or as otherwise permitted by applicable laws.	Third party advertising and marketing providers; Service providers and/or contractors, such as IT, cloud computing, call center, managed hosting and similar services providers; and We may also have used or disclosed this category of personal information to other parties, as described in greater detail in the Purpose and Use of Personal Information and Disclosure of Personal Information sections.
Professional or employment-related information, such as employer name and title or position.	To provide, maintain and improve our Services and conduct business dealings; To communicate with you; For advertising and analytics purposes; For security and technical reasons; For other purposes described to you at or before the time we provide you notice, including those listed in the Notice at Collection in Section I; and To fulfill our compliance or legal obligations or as otherwise permitted by applicable laws.	Third party advertising and marketing providers; Service providers and/or contractors, such as IT, cloud computing, call center, managed hosting and similar services providers; and We may also have used or disclosed this category of personal information to other parties, as described in greater detail in the Purpose and Use of Personal Information and Disclosure of Personal Information sections.
Inferences, such as preferences, characteristics, predispositions, and behavior based on your use of our Services.	To provide, maintain and improve our Services and conduct business dealings; To communicate with you; For advertising and analytics purposes; For security and technical reasons; For other purposes described to you at or before the time we provide you notice, including those listed in the Notice at Collection in Section I; and To fulfill our compliance or legal obligations or as otherwise permitted by applicable laws.	Third party advertising and marketing providers; Service providers and/or contractors, such as IT, cloud computing, call center, managed hosting and similar services providers; and We may also have used or disclosed this category of personal information to other parties, as described in greater detail in the Purpose and Use of Personal Information and Disclosure of Personal Information sections.

Our prior 12-month personal information handling practices are consistent with our current personal information handling practices described in Notice at Collection in Section I.

B. Selling or Sharing of Personal Information

Below, we describe the categories of personal information we may sell or share for cross-context behavioral advertising currently and in the preceding 12 months. We also describe the third parties who received or may receive the personal information and the business or commercial purpose for the sale or sharing. We do not knowingly sell or share the personal information of children under the age of 16, and have not done so in the prior 12 months.

Category of Personal Information	Sold or Shared	Category of Third Party	Business or Commercial Purpose for Sale or Sharing
Identifiers, such as IP address and unique personal identifier.	We may have sold or shared this category of personal information.	We may have sold or shared this category of personal information to third parties who provide us advertising, marketing and analytics services, such as cookie and tracker providers.	Advertising, marketing and analytics purposes.
Internet or other electronic network activity information, such as browsing history, search history, and information regarding a consumer’s interaction with an internet website application, or advertisement.	We may have sold or shared this category of personal information.	We may have sold or shared this category of personal information to third parties who provide us advertising, marketing and analytics services, such as cookie and tracker providers.	Advertising, marketing and analytics purposes.
Inferences, such as preferences, characteristics, predispositions, and behavior based on your use of our Services.	We may have sold or shared this category of personal information.	We may have sold or shared this category of personal information to third parties who provide us advertising, marketing and analytics services, such as cookie and tracker providers.	Advertising, marketing and analytics purposes.
Geolocation data.	We may have sold or shared this category of personal information.	We may have sold or shared this category of personal information to third parties who provide us advertising, marketing and analytics services, such as cookie and tracker providers.	Advertising, marketing and analytics purposes.

C. Opt-Out Preference Signals and “Do Not Track” Requests

1. We Honor Opt-Out Preference Signals

We honor opt-out preference signals. An opt-out preference signal is a signal that is sent by a platform, technology or mechanism on your behalf that communicates your choice to opt-out of the sharing for targeted advertisements or sale of your personal information.  You can learn more about implementing opt-out preference signals here or by exploring other developing technologies and services that offer this tool. 

We treat opt-out preference signals as valid requests to opt-out of the sale or sharing of your personal information under privacy laws. Ordinarily, your opt-out preference signal is sufficient for us to honor your request, but in some instances we may request additional information to help facilitate your request for offline sales or sharing.  We will not use, disclose or retain this additional information for any purpose other than to facilitate the request.

Please note that you can also opt-out of the sale or sharing of your personal information through our other methods described in the Instructions on How to Exercise Your Privacy Rights section.

2. “Do Not Track” Requests

Some browsers have incorporated “Do Not Track” features. Most of these features, when turned on, send a signal or preference to the websites you visit indicating that you do not wish to be tracked. Because there is not yet a common understanding of how to interpret the do not track signal, we currently do not respond to the browser do not track signals. However, as noted above, we do honor opt-out preference signals.

D. Sensitive Personal Information

Under the CPRA, certain types of personal information are considered “sensitive” personal information and require additional data privacy rights and obligations. MFP Agency, LLC DBA Total Health does not collect sensitive personal information as part of the Services. For this reason, we do not provide a Limit Use and Disclosure of Sensitive Personal Information right under the CPRA.

E. Your Privacy Rights

The CPRA affords consumers residing in California the following rights with respect to their personal information, subject to certain exceptions:

• (1) Right to Delete. You have the right to request us to delete the personal information we have collected about you.
• (2) Right to Correct. You have the right to request us to correct inaccurate personal information we maintain about you.
• (3) Right to Know and Access. You have the right to know and access the personal information we have collected about you, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about you.
• (4) Right to Data Portability. You have the right to receive the information under right (3) in a format, to the extent technically feasible, that is portable, usable, and allows you to transmit the personal information to a person without impediment.
• (5) Rights Related to Sharing for Cross-Context Behavioral Advertising or Sale. You have the right to opt out of the sharing of your personal information for cross-context behavioral advertising or the sale of your personal information.
• (6) Rights Related to Sensitive Personal Information or Data. The CPRA provides additional protection for sensitive personal information. As explained in Sensitive Personal Information above under Section VI.D we do not collect sensitive personal information.
• (7) Right to No Discrimination. You have the right not to be discriminated against for exercising any of your privacy rights. This includes us not: (a) denying you goods or services; (b) charging you different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; (c) providing you a different level or quality of goods or services; (d) suggesting to you that you will receive a different price or rate for goods or services or a different level or quality of goods or services; and (e) retaliating against you for exercising your privacy rights.

F. Instructions on How to Exercise Your Privacy Rights

You may exercise your privacy rights by calling our toll-free phone number at 877-470-0304 or emailing us at support@acaplans.com. You may also exercise the right to opt-out of sale or sharing by clicking on the Do Not Sell or Share My Personal Information link here. In some instances, we will need to verify your identity before honoring your privacy right request. We will verify your identity by asking you to provide personal information related to your recent interactions with us, such as the personal information you may have provided on this website or when conducting B2B Dealings with us. We will honor your privacy rights request within 45 calendar days of receipt, unless we request an extension under the CPRA. However, we will honor opt-out of sale and sharing within 15 business days.

G. Authorized Agents

You may exercise your privacy rights through an authorized agent. If we receive your request from an authorized agent, we may ask for evidence that you have provided such agent with a power of attorney or that the agent otherwise has valid written authority to submit requests to exercise rights on your behalf. If you are an authorized agent seeking to make a request, please Contact Us below in Section VII.

H. Additional Disclosure for California Residents

California law permits residents of California to request certain details about how their information is shared with third parties for direct marketing purposes. If you are a California resident and would like to make such a request, please contact us at support@acaplans.com.

VII. CONTACT US

If you have any questions about this Privacy Policy, please contact us at support@acaplans.com.