Table of Contents

• Introduction — and how this Policy relates to our Notice of Privacy Practices
• What This Policy Covers
• Personal Information We Collect
• Cookies, Pixels, and Similar Technologies
• How We Use Your Personal Information
• How We Share Your Personal Information
• Your Privacy Choices and Rights
• Other Important Information
• How to Contact Us
• Changes to This Policy
• Quick-Reference Link List

Introduction

Harbor Health knows that trust is earned, and that trust starts with being honest about how we handle your information. This Website Privacy Policy explains, in plain language, how Harbor Health Enterprise — Harbor Health Medical Group, Harbor Health Insurance Company, The Harbor Health Team, Inc., Harbor Health Services, Inc., and their affiliates, subsidiaries, and related entities (together, "Harbor Health," "we," "us," or "our") — collects, uses, shares, and protects the personal information we gather when you visit our website, use our mobile app, use our online tools, or otherwise interact with us outside of the medical record.

This Policy is a companion to, not a replacement for, our Notice of Privacy Practices ("NPP"). The NPP is our HIPAA/Texas Medical Records Privacy Act notice, and it governs your Protected Health Information ("PHI") — the information in your medical record. This Policy governs everything else: the information collected through harborhealth.com, our online scheduling and ProviderMatch tools, and marketing technologies such as cookies and pixels, under the Texas Data Privacy and Security Act ("TDPSA"), the FTC Act, and other consumer-privacy laws.

We keep these two documents separate on purpose. Our NPP has its own legally required content, translation, and posting rules under HIPAA and Texas law, and needs to stay stable; this Policy covers marketing technology that changes far more often, and needs to stay current. If personal information described in this Policy is later combined with your PHI — for example, once you become a patient — we treat the combined information as PHI and handle it under our NPP. You can read our current Notice of Privacy Practices at https://harborhealth.com/notice-of-privacy-practices.

If anything in this Policy conflicts with a requirement of HIPAA, the TMPA, or other applicable law, the law controls. If you have questions after reading this Policy, contact our Privacy Officer using the information in Section 9 (How to Contact Us).

1. What This Policy Covers

This Policy describes how we handle information that is not part of your medical record — for example, information collected through harborhealth.com and related pages (including our booking flow, Locations pages, and ProviderMatch tool), through the Harbor Health mobile app, through HealthSherpa or similar third-party enrollment tools we link to, and through our marketing communications. We call this information "personal information" to distinguish it from the PHI described in our Notice of Privacy Practices. If personal information is later combined with your PHI (for example, once you become a patient), we treat the combined information as PHI and handle it under our Notice of Privacy Practices and related HIPAA safeguards.

2. Personal Information We Collect

• Contact and identity information: name, address, phone number, email address, and similar identifiers you provide through forms, chat, AI-assisted interactions, or calls.
• Appointment and provider-matching information: information you enter into our online scheduling tool, ProviderMatch, or similar features, such as location preference, insurance plan, or the type of care you are seeking.
• Communications: records of your calls, emails, texts, or chat messages (including AI-assisted interactions) with us.
• Device and browsing information: IP address, browser and device type, operating system, referring/exit pages, and clickstream data, collected automatically as described in Section 3.
• Approximate location: general location inferred from your IP address or device settings, if permitted by your device.
• Information from third parties: information from our marketing and advertising partners, analytics providers, and enrollment platforms such as HealthSherpa, and, if you interact with our content on a social media platform, information that platform shares with us.

We do not knowingly collect Social Security numbers, government ID numbers, or detailed clinical information through our public marketing website. If you submit clinical details through a secure patient portal or intake form, that information is handled under our Notice of Privacy Practices, not this Policy.

If you use the Harbor Health mobile app, we may collect additional, app-specific information beyond what is listed above, such as device tokens, device permissions, and app usage data. That information is described in Section 7.4 (Our Mobile App).

Certain personal information and protected health information must be provided in order to seek healthcare services, coverage, or enrollment, or for Harbor Health to meet its legal and regulatory obligations. In these circumstances, providing the requested information is mandatory, and failure to provide required information may result in an inability to receive services, coverage, or enrollment.

Other information may be requested on a voluntary basis. You may choose not to provide optional information; however, doing so may limit our ability to fully respond to requests or provide certain services.

3. Cookies, Pixels, and Similar Technologies

We use our own and third-party cookies, pixels, and similar technologies on our public website to analyze site traffic, support our advertising and marketing, and improve your experience — which includes sharing some information with third-party partners such as Google and Meta. We load these optional technologies only after you consent. Here is what we use, where, and why:

3.1 What these technologies are

A cookie is a small file placed on your browser or device. A pixel (or "tag") is a small piece of code, often invisible, that reports when a page loads or a button is clicked. We manage these tools through Google Tag Manager ("GTM"), a tag-management system, and our marketing agency partners TrueMedia and Coegi help configure and operate them on our behalf. 0

3.2 Categories of tags we use

• Essential/functional cookies: needed for the site to work correctly (for example, remembering your progress through a multi-step booking form).
• Analytics: Google Analytics 4 ("GA4"), which helps us understand how visitors use the site so we can improve it.
• Advertising and attribution: Meta Pixel, Google Ads tracking, and Google Campaign Manager/DoubleClick, which help us measure the effectiveness of our advertising and show more relevant ads to people who may be interested in Harbor Health.

  
  

3.3 Where these tags fire

The advertising and attribution tags listed above are currently active on our public acquisition pages — the homepage, /book, our Locations pages, ProviderMatch, and HealthSherpa-linked pages — and fire when those pages load and when you click key buttons such as "Book a Visit" or "Get Care."

3.4 What information is shared, and with whom

We use these advertising and analytics technologies only after you accept them in our cookie banner. When you accept, page-visit and button-click signals — together with identifiers such as browser or advertising cookie IDs — are shared with our analytics and advertising partners, currently Google (Google Analytics 4, Google Ads, and Google Campaign Manager / DoubleClick) and Meta (Meta Pixel). They use this to measure and improve our advertising — for example, to understand which ads lead people to book a visit. These partners act as independent controllers of the data they receive and apply their own privacy policies; we do not control how they otherwise use it. Harbor Health's IT partners, TrueMedia and Coegi, configure these technologies on our behalf and do not use the data for their own marketing. If you do not accept, these technologies do not load and none of this data is shared. We maintain a current list of the specific technologies we use and update it as our partners change.

3.5 Your current cookie and ad choices

We present a cookie-consent banner the first time you visit. Optional analytics and advertising technologies do not load until you select "Accept all." If you select "Reject optional" — or close the banner — we use only the cookies that are strictly necessary for the site to work. To change your choice, you can clear cookies for our site in your browser settings, which will cause the consent banner to appear again on your next visit. In addition, you can use the controls below:

• Adjust your browser settings to block or delete cookies (this may affect how some parts of our site work).
• Opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on: tools.google.com/dlpage/gaoptout
• Manage Google ad personalization at Google Ads Settings: adssettings.google.com
• Manage Meta ad preferences at: facebook.com/adpreferences/ad_settings
• Opt out of participating networks through the Digital Advertising Alliance's YourAdChoices tool: aboutads.info/choices and the Network Advertising Initiative: networkadvertising.org/managing/opt_out.asp
• Review Meta's Privacy Policy (facebook.com/privacy/policy), Google's Privacy Policy (policies.google.com/privacy), and LinkedIn's Privacy Policy (linkedin.com/legal/privacy-policy) to learn more about how each company uses this data.