Effective: September 25, 2022

Last Reviewed: August 20, 2024

Cityblock Health, Inc. (“Cityblock,” “we,” “us,” or “our”) developed this Privacy Policy (“Privacy Policy” or “Policy”) to provide Cityblock members and potential members, subcontractors and suppliers (and the individuals working for such subcontractors and suppliers), Cityblock job applicants, and individuals visiting our websites or using our applications with information concerning our Personal Information collection, usage, transfer, privacy and security practices.  This Policy also addresses our approach to addressing rights such individuals have with respect to such data.  For information concerning how we handle individuals’ health information (“Protected Health Information”), please see our Notices of Privacy Practices, which describes our usage and disclosure of Protected Health Information, and individuals’ rights with respect to such Protected Health Information.  

For purposes of this Privacy Policy, the term “Personal Information” means any information relating to an identified or identifiable natural person, or that could reasonably be linked, directly or indirectly, with a particular person or household.  The terms “you” and “your” refer to any person reading this Privacy Policy whose Personal Information is governed by this policy (i.e., Cityblock members and potential members; subcontractors and suppliers, and the individuals working for such subcontractors and suppliers).

I. Categories of Personal Information We Collect

In this section, we address the types of Personal Information we do or may collect, including categories of Personal Information we have collected in the past twelve (12) months:

• Identifiers.  Personal identifiers, such as name, mailing address, unique personal identifier, online identifier, internet protocol address, email address, account name, or other similar identifiers.
• Characteristics of Protected Classifications.  Characteristics of protected classifications covered by federal and other laws (e.g., California), such as race, religion, sexual orientation, gender identity, and age. 
• Internet Activity.  Internet or other similar network activity information, such as browsing history, search history, or information on your interaction with a website, application, or advertisement.
• Sensory Data.  Sensory data, such as audio, electronic, visual, or similar information.
• Professional or Employment-Related Information.  Professional or employment-related information, such as occupation or current or past job history.
• Geolocation Data. Geolocation data such as geographical location.
• Inferences Drawn from Personal Information. Inferences drawn from personal information to create a profile about an individual relating to the individual’s preferences, characteristics, predispositions, and behavior.
• Other Types of Personal Information.  Categories of personal information that are described in the California Customer Records Act, such as name, signature, physical characteristics, address, education, employment, employment history, bank account number, other financial information, or medical information. Some Personal Information included in this category may overlap with other categories.

II. Sources of Personal Information We Collect

We may collect the above-described categories of Personal Information from one or more of the following sources:

• Information Provided by You. We collect Personal Information that you provide to us, such as when you provide your information to us at a health plan fair or community outreach event, contact us by phone, email or webform; respond to a survey; register for an event; check in as a visitor at our offices or clinics; or apply for a job through our website.
• Automated Information Collection. We use automated data collection technologies for reporting and analysis purposes.  For example, we consider metrics such as how you and others interact with our website and applications, how easy our website is to navigate, and the performance of our connection efforts.  For additional information, see the Cookies & Similar Technologies section, below.
• Your Employer.  We may receive Personal Information about you from your current employer (e.g., under circumstances in which your employer is an insurer we work with, or your employer is our subcontractor or supplier).
• Security Cameras.  We collect Personal Information from cameras at exterior doors, in lobbies, and in hallways of the spaces we lease or own.
• Online Platforms that Make Personal Information Publicly Available.  We may collect information made publicly available by you or by other individuals about you from online platforms, such as LinkedIn. 
• Cityblock’s Third-Party Service Providers. We may receive information about you from our third-party service providers, including but not limited to our website hosts, website analytics service providers, and website content management service providers.

III. Purposes of Collecting Personal Information

We may collect the above-described categories of Personal Information for one or more of the following business, commercial, or other purposes:

• To respond to inquiries about our services and eligibility for our services, and to answer questions about the same.
• To fulfill Cityblock members’ requests, and provide services to members, including maintenance or servicing of member accounts, providing customer service, processing or fulfilling transactions, verifying member information, and processing payments.  
• To request and receive services and products from our suppliers and subcontractors; and to assess the business capabilities, privacy and security practices, regulatory compliance, and other important characteristics of our suppliers and subcontractors.
• To conduct other business activities, including but not limited to developing, improving, or modifying our services; storing information; assessing usage trends; and otherwise operating our business and expanding our business activities. 
• To advertise and market; and analyze our promotional advertising and marketing campaigns. 
• To provide interactive features of our websites, such job application web forms.
• To ensure features of our websites (e.g., our online webforms) are operative and functional.
• To conduct debugging activities to identify and repair errors that impair existing intended functionality.  
• To conduct analytics to help us understand how you and other users access and use our websites (“Sites”); and improve our websites.
• To audit current interactions with consumers and concurrent transactions, including but not limited to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
• To undertake internal research for technological development and demonstration.
• To undertake activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by Cityblock, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by Cityblock.
• To verify the identity of individuals.
• To help control access to and protect the security of Cityblock’s offices, clinics, and other physical spaces.
• To investigate any instances of property damage, theft, or other crimes in our offices, clinics and other physical spaces, and to assist law enforcement agencies in their investigations of the same.
• To detect and investigate security incidents; protect against malicious, deceptive, fraudulent, or illegal activity; and prosecute those responsible for such activity.
•  As necessary or appropriate to otherwise protect the rights, property, or safety of Cityblock, our members, our employees, and others.
• To evaluate potential candidates’ online professional profiles, including information about their qualifications and experience, and determine whether to recruit them for a position at Cityblock. 
• To receive job applications; communicate with job applicants about the status of their applications; verify job applicant identity; evaluate job applicant qualifications and experience; and determine whether applicants are a good fit for the position for which they are applying.
• To evaluate our success in pursuing our goal to be an equal opportunity employer, and to report required aggregated information to federal regulators. 
• To comply with our legal and regulatory obligations, including our regulatory reporting requirements. 
• To respond to law enforcement requests and meet our obligations in connection with any legal proceedings and government investigations. 
• To provide information pertinent to an actual or potential merger, acquisition, or other reorganization. 
• To protect our legal interests. 
• As otherwise described by Cityblock to an individual at or before the time that Cityblock collects the individual’s Personal Information.

IV. Categories of Third Parties to Whom Personal Information is Disclosed

In connection with the purposes set forth in this Privacy Policy, we may disclose your Personal Information to one or more of the following categories of third parties: 

• Third-party service providers and subcontractors that perform services on our behalf. We may share Personal Information with third-party service providers and subcontractors that perform services on our behalf, including services relating to data analysis and insight, website hosting, website analytics, website content management, advertising, customer relationship management, procurement management, talent management, recruitment, technical support, information technology development, customer service, data storage, technical security, physical security, fraud prevention, and legal services.
• Governmental entities and third parties in connection with legal matters. We may disclose Personal Information to governmental entities, such as regulatory agencies, law enforcement, and judicial authorities, as well as other third parties providing assistance to us or other parties in relevant legal matters (e.g., attorneys and e-discovery service providers), under any of the following conditions: (1) if we have your valid consent to do so; (2) to comply with a legitimate subpoena, legal order, court order, warrant, legal process, or other legal obligation; (3) to enforce or apply any of our terms and conditions, policies, or other agreements; (4) to exchange information with other companies and organizations for purposes of fraud detection and credit risk reduction (e.g., in connection with a data breach); (5) as necessary to pursue or defend legal claims.
• Third parties in connection with a potential reorganization. We may share Personal Information with a prospective seller, buyer, and any third-party service provider assisting Cityblock or a prospective seller or buyer in connection with the potential reorganization (e.g., a law firm assisting Cityblock) in the event of a potential reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of Cityblock’s assets or stock, including, without limitation, in connection with any bankruptcy or similar proceeding.

V. Disclosures of Personal Information in the Past Twelve Months

Cityblock has in the past twelve (12) months disclosed for a business purpose the following categories of Personal Information to the following categories of third parties:

A. Certain Identifiers

• Our third-party service providers and subcontractors

B. Other Types of Personal Information

• Our third-party service providers and subcontractors

C. Certain Internet or Other Similar Network Activity

• Our third-party service providers and subcontractors

D. Certain Sensory Data

• Our third-party service providers and subcontractors

E. Certain Professional or Employment-Related Information

• Our third-party service providers and subcontractors

F. Geolocation Data 

• Our third-party service providers and subcontractors

G. Inferences Drawn from Personal Information

• Our third-party service providers and subcontractors

H. Certain Characteristics of Protected Classifications under California Law

• Governmental entities
• Our third-party service providers and subcontractors

For additional information on the categories of Personal Information, see the Categories of Personal Information We Collect section, above.  For additional information on the categories of third parties, see the Categories of Third Parties to Whom Personal Information is Disclosed section, above.

VI. No Sale of Personal Information

Cityblock does not sell Personal Information and has not sold Personal Information in the past twelve (12) months. Cityblock does not knowingly sell the Personal Information of children under the age of sixteen (16) years old.

VII. Cookie Policy

As you interact with our Sites, we, with assistance from third-party analytics service providers, collect Personal Information pertaining to your use of Cityblock’s Sites and the devices and programs from which you access our Sites (“Usage Data”) using cookies and similar technologies.

A. What are Cookies? 

Cookies are small computer files sent or accessed from your browser or our application on the hard drive of your computer, mobile device, or tablet that contain information about your device, such as your user ID, user settings, browsing history, and activities conducted while browsing websites (e.g., pages viewed; navigation around a website).  Cookies are used to “remember” when your computer or devices access our websites.

B. How Do We Use Cookies? 

Cookies are essential for the effective operation of our websites and applications and help you to navigate our websites and applications.  Cityblock and its third-party service providers use cookies to monitor your browsing behavior. 

The primary purposes for which cookies are used are: (1) For the effective operation of our websites and applications, especially in connection with website navigation and online communications; (2) To monitor and improve the quality and user-friendliness of our website and applications; (3) To monitor the success of our outreach initiatives and other brand awareness-related activities; and (4) To assist Cityblock in detecting and preventing fraud, denial of services attacks, and other malicious activity directed at our websites or through our applications.

C. How Can You Manage Cookies?

If you do not want Usage Data collected through the use of cookies and similar technologies, there is a procedure in most browsers that allows you to automatically decline many of these technologies, or to be given the choice of declining or accepting them.  Cookies that are required to enable core site functionality cannot be disabled.  To assist in controlling website-specific cookies, check the privacy and cookie setting in your preferred browser. 

VIII. Do Not Track

Do Not Track (“DNT”) is a privacy preference that users can set in their web browsers. When a user turns on DNT, the browser sends a message to websites requesting that they don’t track the visitor. At this time, we do not respond to DNT signals. Third parties may collect Personal Information relating to your online activities over time and across different sites and apps when you use our websites in order to provide you with content that is likely to be of interest to you.

IX. Third-Party Privacy Practices

Our Sites may provide links to third-party websites as a service to you. We are not responsible for the privacy practices of those third-party websites. If you connect to a third-party website through our Sites, you should review any privacy notice that is available to you through that website.

X. Children’s Privacy

Our Sites are not directed towards children under the age of thirteen (13) years old. We do not knowingly collect any Personal Information from users under the age of thirteen (13). No Personal Information should be submitted through our Sites by users under the age of 13. If we learn we have collected the Personal Information from a child under the age of thirteen (13), we will take reasonable steps to delete the Personal Information as soon as possible.

XI. Protecting Your Personal Information

We implement technical and organizational measures designed to assist in maintaining the security and confidentiality of Personal Information; safeguarding against anticipated threats to the confidentiality, integrity, and availability of Personal Information; and protecting your Personal Information against accidental or unlawful destruction, loss, alteration, and unauthorized access or disclosure. 

However, whenever Personal Information is processed, there is a risk that such data could be lost, misused, modified, hacked, breached, and/or otherwise accessed by an unauthorized third party.  No system or online transmission of data is completely secure.  In addition to the technical and organizational measures that Cityblock has in place to protect your Personal Information, you should use appropriate security measures to protect your Personal Information.  If you believe that any Personal Information you provided to us is no longer secure, please notify us immediately at privacy@cityblock.com.

XII. California Privacy Rights

California residents have certain rights under California privacy law, including but not limited to the California Consumer Privacy Act (“CCPA”), which gives California residents (“consumers” or “you”) certain rights and control over Personal Information.  This section of Cityblock’s Privacy Policy applies solely to our clients, subcontractors, suppliers, and their employees and officers; users of our website; job applicants; and job candidates whose Personal Information we collect who reside in the State of California. If you are a California resident, you have the following privacy rights under the CCPA.

A. Right to Request Access 

You have the right to request that a business disclose the Personal Information about you that it has collected, used, disclosed and/or sold, as applicable, including the specific pieces of Personal Information that the business has collected about you, in the twelve (12) months prior to the date on which the business receives your request.

B. Right to Request Deletion 

You have the right to request deletion of Personal Information about you that a business has collected, subject to certain exceptions.

C. Right to Opt-Out of Sale 

You have the right to direct a business that sells your Personal Information not to sell your Personal Information.  We do not sell your Personal Information.

D. Right to Non-Discrimination 

You have the right to not receive discriminatory treatment by a business for exercising your rights under the CCPA. 

XIII. Other Privacy Rights

It is our intent to provide individuals with all privacy rights to which they are entitled by law.  If you are interested in information about your privacy rights with respect to Protected Health Information governed by HIPAA, including how to exercise such rights, please see our Notices of Privacy Practices.  If you believe that you are entitled to exercise privacy rights under any other law, you may seek to exercise such rights utilizing the information we provide in the following section on Exercising Your Privacy Rights.

XIV. Exercising Your Privacy Rights

In this section, we provide an explanation of our process for individuals to exercise any privacy rights to which they are entitled by law, for designating an authorized agent, and for verifying the identity of individuals who submit privacy rights requests.

A. Submitting Requests

i. Submission Methods. To exercise rights, you may be entitled to as described in this Privacy Policy, please submit a verifiable consumer request to us via one of the following methods:

• Emailing us at privacy@cityblock.com; or
• Calling us at 833-904-2273

ii. Submission Contents. Requests to exercise your privacy rights should include the following information:

• Your name;
• The U.S. state in which you currently reside; 
• Which privacy right(s) you seek to exercise; 
• Details that may assist us in responding to your request, such as:
  – If you are exercising access rights, the information to which you are requesting access; 
  – If you are exercising deletion rights, the information for which you are requesting deletion; and/or
  – Any other relevant information about your Personal Information and/or the right you are exercising; and
• Phone number and/or email address at which we can reach you.

B. Designating an Authorized Agent

Only you or a person that you authorize to act on your behalf may make a consumer request related to your Personal Information. You may designate an authorized agent to make a consumer request on your behalf by submitting such request to Cityblock via email at privacy@cityblock.com with “Request for Authorized Agent” in the subject line. Before acting in response to such a request, we will require your authorized agent to verify the representative’s authority and identity.

C. Identity Verification

Before responding to your request to exercise your rights, we must verify your identity through reasonable verification measures.  If you have a password-protected account with us, we may verify your identity through our existing authentication practices for your account.  If you are requesting the disclosure or deletion of Personal Information, we may require you to re-authenticate yourself before disclosing or deleting your Personal Information.

Our verification processes also may include requiring you to provide answers to questions pertaining to the Personal Information we have on file concerning you; to provide confirmation of your request using the email address we have on file for you; or to confirm your request when we call you using the phone number we have on file for you.

If we cannot verify your identity based on information we already have, we may request additional information from you.  If this is necessary, we will only use such additional information for purposes of verifying your identity and for fraud-prevention.  If we are unable to reasonably verify your identity (and thus unable to comply with your request), we will advise you why that is the case.

XV. Changes to Privacy Policy

We may update this Privacy Policy from time to time as we add new services or offerings; as we improve our current services and offerings; and as technologies and laws change.  It is our policy to post any changes we make to our Privacy Policy on our websites.  Any changes will become effective thirty (30) days after our posting of the revised Privacy Policy on our websites.  The date this Privacy Policy was updated and the date it became effective are identified at the top of the first page.

XVI. Accessibility Assistance

We are committed to ensuring that this Privacy Policy is accessible to everyone.  Individuals with difficulty accessing information in this Privacy Policy are encouraged to contact us by email at privacy@cityblock.com or by calling us at 833-904-2273 (TTY 711).

XVII. Contact Us

If you have any questions about this Privacy Policy, or our privacy practices, or need for assistance relating to your Personal Information, you may contact our Privacy Officer by email at privacy@cityblock.com, by phone at 833-904-2273 (TTY 711), or by writing to us at the following address:

Cityblock Health, Inc.,
Attention: Privacy Officer
495 Flatbush Ave., #C5
Brooklyn, NY 11225