Butterfly Network, Inc, on behalf of itself and its subsidiaries ("Company", "we", "our", or "us") respect your privacy and are committed to protecting it through our compliance with this policy. This policy describes how we collect, process, retain, and disclose personal data about you when providing services to you through our websites, applications, products, and services that link to this policy (our "Services") and our practices for using, maintaining, protecting, and disclosing that information.
This Notice applies to the processing of personal information collected by us in the usual course of business, including when you:
"You" may, depending on the context, be: a visitor to one of our Sites, offices or social media pages; a recipient of our communications; a patient whose personal information is being hosted in our Services; or a Service User of one or more of our Services.
This Notice does not apply to the personal information that we process as data processors on behalf of our customers in the course of providing our Services.
We may provide additional or different privacy policies that are specific to certain features, services, or activities.
Please read this policy carefully to understand our policies and practices regarding your information and how we treat it. By interacting with our Services or providing us with your information, you agree to the collection, use, and sharing of your information as described in this privacy policy. This policy may change from time to time (see Changes to Our Privacy Policy). Your continued use of the Services after we make changes as described here is deemed to be acceptance of those changes, so please check the policy periodically for updates.
Our Services are not intended for, and we do not knowingly collect any personal data from, children under the age of 18. If we learn we have collected or received personal data from a child under 18 years old without verification of parental consent, we will delete that information.
"Personal data" is information that identifies, relates to, or describes, directly or indirectly, you as an individual, including, without limitation your name, email address, telephone number or home address or any other identifier we may use to contact you online or offline.
The information we collect depends on the context of your interactions with Butterfly and the choices you make (including your privacy settings), the products and features you use, your location and applicable law.
In general, our Services are intended for use by Service Users. As a result, for much of the personal information (including patient personal information) we collect and process through the Services, we act as a data processor. This means, it is primarily our Service Users that control what personal information we collect through the Services and how we use it. Therefore, if you are a patient of one of our Service Users, and have privacy related questions or concerns about the privacy practices of or the choices the relevant Service User has made to share your information with us or any other third-party, you should contact the relevant Service User or review their or (where applicable) their organizations' privacy notices.
Butterfly is not responsible for the privacy or security practices of its Service Users, which may differ from those set out in this Notice.
If you are a Service User you (or your team administrator) may provide certain personal information to us through the Services, for example, when you sign up for a Butterfly account to access and use the Services, when you consult with customer support or send us an email or communicate with us in any way (e.g., to make a support request).
The personal information we collect may include:
If you ever communicate directly with us, we will maintain a record of those communications and responses.
When you use or interact with the Services, we automatically collect or receive certain information through our Services (e.g., in log files) and through other technologies (such as cookies) about your device and usage of the Services. In some (but not all) countries, including countries in the European Economic Area ("EEA"), UK and Switzerland, this information is considered 'personal data' under data protection laws. For further information please review our cookie notice.
The information we collect includes:
Some of the information identified above may be considered sensitive data under certain laws. If required under applicable law, we will collect and process sensitive personal data only with your consent. If you choose not to provide or allow us to collect some information, we may not be able to provide you with requested features, services, or information.
This information is used to:
Some of the data automatically collected within the Services, whether alone or in conjunction with other data, could be personally identifying. Please note that this data is primarily used for identifying the uniqueness of Service User logging on (as opposed to specific individuals), apart from where it is strictly required to identify an individual for security purposes or as required as part of our provision of the Services to our customers (where we act as a data processor.
Information we process about our Service Users' patients: We process certain personal information about our Service Users patients on behalf of our Service Users (where we act as a data processor). This personal information includes:
As described above, in most cases, we only process PHI on behalf of and as instructed by our Service Users (the data controllers of the personal information).
However, where permitted by the relevant Service User and applicable law, we may leverage certain patient data collected through the operation of the Services for our internal research and product development purposes to improve our Services (for which we will be a data controller). For these purposes, we only use PHI in a de-identified form that does not specifically identify any particular patient For example, we may leverage de-identified patient data to train our models and algorithms to improve the functionality of our Services. To the extent the de-identified patient data is considered personal information under applicable privacy and data protection law, we will ensure that such data is processed in compliance with such privacy and data protection laws.
We also collect:
If we combine or connect non-personal statistical or technical data with personal data so that it directly or indirectly identifies an individual, we treat the combined information as personal information.
We collect information about you when you interact with our Services, such as when you create or update an account, place an order, subscribe, or make a purchase request, participate in surveys, webinars, trainings or promotions, or create, upload, or post content to the Services, including reviews, media such as photos, videos, or audio recordings.
As you navigate through and interact with our Services, we may use automatic data collection technologies to collect information that may include personal data. Information collected automatically may include usage details, IP addresses, operating system, and browser type, and information collected through cookies and other tracking technologies including details of your interactions with our Services.
Please see the Cookie Notice for further information.
We may receive personal data about you from other sources and combine that with information we collect directly from you. For example, we may obtain information about you from service providers that we engage to perform services on our behalf. We may also obtain data, such as contact information, from publicly available sources and lists.
We use information that we collect about you or that you provide to us, including any personal data, to:
The usage information we collect, whether connected to your personal data or not, helps us improve our Services and deliver a better and more personalized experience by enabling us to:
We may also use your information to contact you about goods and services that may be of interest to you.
We may disclose aggregated information about our users, and information that does not identify any individual, without restriction.
We may also disclose personal data that we collect or you provide as described in this privacy policy:
We may also disclose your personal data:
This section describes mechanisms you can use to control certain uses and disclosures of your information and rights you may have under state law, depending on where you live.
Please refer to our cookie notice for information on cookies and other tracking technologies.
Depending on your state of residency, you may have certain rights related to your personal data, including:
Important: The exact scope of these rights vary by state. There are also several exceptions where we may not have an obligation to fulfill your request.
Some browsers and browser extensions support the Global Privacy Control (“GPC”) that can send a signal to process your request to opt out from certain types of data processing, including data "sales" as defined under certain laws. When we detect such a signal, we will make reasonable efforts to respect your choices indicated by a GPC setting as required by applicable law.
We use administrative, physical, and technical measures designed to protect your personal data from accidental loss or destruction and from unauthorized access, use, alteration, and disclosure. However, no website, mobile application, system, electronic storage, or online service is completely secure, and we cannot guarantee the security of your personal data transmitted to, through, using, or in connection with the Services. In particular, email, texts, and chats sent to or from the Services may not be secure, and you should carefully decide what information you send to us via such communications channels. Any transmission of personal data is at your own risk.
The safety and security of your information also depends on you. You are responsible for taking steps to protect your personal data against unauthorized use, disclosure, and access.
We keep the categories of personal data described in this policy for as long as reasonably necessary to fulfill the purposes described or for as otherwise legally permitted or required, such as maintaining the Services, operating our organization, complying with our legal obligations, resolving disputes, and for safety, security, and fraud prevention. This means that we consider our legal and business obligations, potential risks of harm, and nature of the information when deciding how long to retain personal data. At the end of the retention period, personal data will be deleted, destroyed, or deidentified.
We may update this policy from time to time. The date the privacy policy was last updated is identified at the top of the page. We will notify you of changes to this policy by updating the "last updated" date and posting the updated policy on the Services. We may email or otherwise communicate reminders about this policy, but you should check our Services periodically to see the current policy and any changes we have made to it.
To exercise your rights or ask questions or comment about this privacy policy or our privacy practices, contact us at: