EBO.com
Menu

Consumer health data privacy policy

Effective September 25, 2026. Last updated October 3, 2026.

Who this policy covers

This policy explains how EBO2.com ("we," "us," or "our") collects, uses, and shares consumer health data through ebo2.com and app.ebo2.com. It is written for Washington's My Health My Data Act, Nevada's Senate Bill 370, and the consumer health data provisions of Connecticut's data privacy law, and it covers the people those laws protect, including residents of those states and people whose information is collected there.

Consumer health data is personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. This policy adds to our privacy policy, which covers all the personal information we handle. Where the two differ on consumer health data, this policy controls.

What counts as consumer health data here

The sites are about a health procedure, so we look closely at what could reveal something about your health. No form that sends anything to us asks for health information, and most readers give us none. These are the situations on our sites where consumer health data can arise, including two tools that handle what you enter only in your browser:

We never receive your precise location, and we do not infer anything about your health from the pages you read or the questions you build. Vercel Web Analytics, which counts visits for us on every page, including the tool pages, sets no cookies and never receives what you enter in a tool. For each page view it records the page address, the page that sent you there, an approximate location down to the city, and your browser, operating system, and device type. It tells visitors apart with a hash created from the incoming request, not with a cookie, and Vercel discards each visitor's session after 24 hours.

Categories of consumer health data we collect

Comments, and clinic claims and listing edits made from an account, are coming to app.ebo2.com. This policy will cover them from the day they launch.

Where it comes from

Consumer health data reaches us only from you, directly: when you write a comment, send us a message, or submit a clinic claim or listing edit. What you check in the questions for your doctor, and a location you share with the clinic finder, also come from you, but they stay in your browser and never reach us, and a ZIP code search shows us only the first digit of the ZIP code, in the address of the table your browser downloads. If we connect Google Analytics, browsing data would come from your browser through Google's tags, and only after you accept analytics cookies where our banner appears. We do not buy consumer health data, and we do not receive it from data brokers, advertisers, clinics, or anyone else.

A clinic that contacts us about its listing gives us business details, such as its services and prices. Clinics should never send us information about their patients.

Why we collect and use it

We collect and use consumer health data only to:

We collect only what the feature you asked for needs. Any other collection or use of consumer health data happens only with your separate consent, which you can withdraw at any time.

Approved comments are public, so anyone who reads the page can see what you wrote, including any health details. Please do not post health details that you want to keep private.

Who receives it and why

We share consumer health data with the processors that work for us, which handle it on our behalf:

Each processor receives only what it needs to provide its service to us. Apart from these processors, publishing approved comments at your request, a transfer to a successor that remains bound by this policy if the sites or their operator are sold or merged, and disclosures the law requires, we do not share consumer health data with anyone. We have no affiliates that receive it. We do not sell it.

What we never do

Your rights

You have the right to:

If you ask us to delete your consumer health data, we delete it from our inbox and our app database and ask our processors to delete any copy they hold for us. Copies in our database backups are overwritten within 30 days. If you ask us to close your account, we delete its account data along with the comments, clinic claims, and listing edits linked to it. We cannot delete copies that other people or services made of a comment while it was public. We will not discriminate against you for using these rights.

How to use your rights

Send a request through the contact form, choosing "Privacy or data request," or write to us at EBO2.com, 1968 S. Coast Hwy, #1921, Laguna Beach, CA 92651, United States. Tell us which right you want to use, and give the email address you used with us so we can find your information. Requests are free.

Before we act, we may need to confirm your identity, for example by checking that you control the email address involved. We use information you give us for that check only to verify your request. If someone else makes a request for you, we may ask for your written permission and ask you to confirm your identity with us directly.

We respond within 45 days of receiving your request. If we need more time, we may extend that once, by up to 45 more days, and we will tell you before the first 45 days end.

If you ask for access, we send you a copy of the consumer health data we hold about you in a form you can read, with the list of processors that received it and how to reach them. If you ask for deletion, we tell you when it is done and what, if anything, we had to keep and why.

Appeals and complaints

If we decline your request, in whole or in part, we will tell you why. You can appeal by replying to our decision. We answer appeals in writing within 45 days. If we deny your appeal, we will tell you how to submit a complaint to your state attorney general.

In your appeal, tell us which request it concerns and why you think our decision was wrong. We look at the whole request again, not only the point you raise, and our written answer says what we decided and why.

You can also contact the attorney general of your state directly, at any time:

Most consumer health data reaches us because you chose to send it: you decide whether to mention your health in a message or a comment, and we use it only to provide what you asked for. For anything beyond that, we ask for your separate consent first and say what it covers. In Washington, Nevada, and Connecticut, the cookie banner asks for your consent before Google's analytics or marketing tags can load; Vercel Web Analytics, which sets no cookies, runs on every page without it. The clinic finder uses your location only when you press "Use my location", and only if you allow it when your browser asks for your permission.

You can withdraw consent at any time:

Withdrawing consent stops any further use based on it. It does not undo what happened before, such as a comment that others read while it was public.

How long we keep it

We keep consumer health data only as long as the feature it belongs to needs it:

We keep information longer only when the law requires it, and we tell you if that applies to your request.

How we protect it

The sites use encrypted HTTPS connections. The tools work in your browser, so what you enter in them never reaches our servers, apart from the first digit of a ZIP code, which the clinic finder's table request shows. Contact-form messages are delivered by email and are not stored in a database. In the app database, access rules limit each account to its own records, only staff accounts can see moderation queues, and the public can read only approved comments. Passwords are stored only as hashes, and commenters' IP addresses will be stored only as keyed hashes, made with a secret key so the address itself is never kept. Browsers are told to use only HTTPS for ebo2.com and its subdomains, and pages on ebo2.com cannot be framed by other websites. No website is completely secure; if a breach affects your consumer health data, we will notify you, and the authorities where the law requires, and tell you what happened and what you can do.

Changes

We may update this policy from time to time. When we do, we will post the new version on this page and change the date at the top. If a change is material, it takes effect no sooner than 30 days after we post it, and we will post a notice on the sites and email account holders before then. We will not collect, use, or share consumer health data in a new way without the consent the law requires.

For this policy, a material change includes collecting a new kind of consumer health data, using it for a new purpose, or sharing it with a new kind of recipient. We will send you any earlier version of this policy on request.

Children

The sites are written for adults and are not directed to children under 16, and you must be 18 or older to create an account on app.ebo2.com. We do not knowingly collect consumer health data from children. If you are a parent or guardian and think a child has sent us health information, for example in a message through the contact form, tell us through the contact form and we will delete it. We do not need the child's details beyond what lets us find the message. If we learn that an account belongs to someone under 18, we close it and delete its account data and everything linked to it.

Contact

For questions about this policy or to make a request, use the contact form and choose "Privacy or data request," or write to EBO2.com, 1968 S. Coast Hwy, #1921, Laguna Beach, CA 92651, United States.

Change history