SureAdhere Privacy Policy

Effective Date: June 09, 2025  ·  Last Updated: April 07, 2026

This notice describes the Privacy Policy of SureAdhere ("SureAdhere" or "We") when Users ("You") use our websites, mobile application, web application, software, and services ("Services").

We define the following as our Services:

Here we describe how we collect, use, and handle your information when you use Services.

IF YOU OR THE ORGANIZATION YOU REPRESENT DON'T AGREE TO BE BOUND TO THIS PRIVACY POLICY, YOU SHOULD NOT USE OUR SERVICES

Owner

All Data submitted or shared by the User during the use of the Services is the exclusive property of the User. Hence the Users are the Owners of the Data. SureAdhere does not claim any ownership rights over the User Data.

The Company will collect and process User Data solely for the purpose of providing the Services to the User. The Company will take reasonable measures to protect the confidentiality and integrity of the User Data. The Company will implement and maintain appropriate technical and organizational measures to safeguard User Data against unauthorized access, alteration, disclosure, or destruction.

The User shall have the right to access, correct, amend, or delete their User Data at any time through the Service. The Company will promptly comply with any such request by the User, subject to applicable laws and regulations.

What We Collect

Types of Data Collected by Services

Personal Information

Our Services may collect Personal Information by itself or through third parties. Personal Information includes name, postal address, email address, phone number, fax number, username, password, demographic information (such as your gender and occupation). Complete details on each type of Personal Information collected are provided in the dedicated sections of this privacy policy or by specific explanation texts displayed prior to the Data collection. Personal Data may be freely provided by the User, or, in the case of Usage Data, collected automatically by our Information Website.

Cookies

Our Web and Mobile Application does not collect any cookies.

Our Informational Website (www.sureadhere.com) may log information using "cookies." Cookies are small data files stored on your hard drive by a website. We may use both session Cookies (which expire once you close your web browser) and persistent Cookies (which stay on your computer until you delete them) to provide you with a more personal and interactive experience on our Information Site. This type of information is collected to make the Information Website more useful to you and to tailor the experience with us to meet your special interests and needs.

Users are responsible for any third-party Personal Data obtained, published or shared through Services and confirm that they have the third party's consent to provide the Data to SureAdhere.

Mode and Place of Processing the Data

Methods of processing

SureAdhere takes appropriate security measures to prevent unauthorized access, disclosure, modification, or unauthorized destruction of the Data.

The Data processing is carried out using computers and/or IT enabled tools, following organizational procedures and modes strictly related to the purposes indicated. In addition to SureAdhere, in some cases, the Data may be accessible to certain types of persons in charge, involved with the operation of Services (administration, sales, marketing, legal, system administration) or external parties (such as third-party technical service providers, mail carriers, hosting providers, IT companies, communications agencies) appointed, if necessary, as Data Processors by SureAdhere. The updated list of these parties may be requested from SureAdhere at any time.

Legal basis of processing

SureAdhere may process Personal Data relating to Users if one of the following applies:

In any case, SureAdhere will gladly help to clarify the specific legal basis that applies to the processing, and in particular, whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract.

Place

The Data is processed at SureAdhere's operating offices and in any other places where the parties involved in the processing are located.

Depending on the User's location, data transfers may involve transferring the User's Data to a country other than their own. To find out more about the place of processing of such transferred Data, Users can check the section containing details about the processing of Personal Data.

Users are also entitled to learn about the legal basis of Data transfers to a country outside the European Union or to any international organization governed by public international law or set up by two or more countries, such as the UN, and about the security measures taken by SureAdhere to safeguard their Data.

If any such transfer takes place, Users can find out more by checking the relevant sections of this document or inquire with SureAdhere using the information provided in the contact section.

Retention time

Personal Data shall be processed and stored for as long as required by the purpose they have been collected for.

Therefore:

SureAdhere may be allowed to retain Personal Data for a longer period whenever the User has given consent to such processing, as long as such consent is not withdrawn. Furthermore, SureAdhere may be obliged to retain Personal Data for a longer period whenever required to do so for the performance of a legal obligation or upon order of an authority.

Once the retention period expires, Personal Data shall be deleted. Therefore, the right of access, the right to erasure, the right to rectification and the right to data portability cannot be enforced after the expiration of the retention period.

The Purpose of Processing

The Data concerning the User is collected to allow SureAdhere to provide its Service, comply with its legal obligations, respond to enforcement requests, protect its rights and interests (or those of its Users or third parties), detect any malicious or fraudulent activity, as well as the following: Data transfer outside the EU, Hosting, and backend infrastructure and Managing contacts and sending messages.

For specific information about the Personal Data used for each purpose, the User may refer to the section "Detailed information on the processing of Personal Data".

Services Used for Processing of Data

Personal Data is collected for the following purposes and using the following services:

Analytics

SureAdhere uses analytics partners, including Google Analytics and Hubspot to analyze some of the Usage information we collect.

If you do not consent to our analytics partners having access to your information, please let us know at privacy-sureadhere@dimagi.com.

Hosting and backend infrastructure

This type of service has the purpose of hosting Data and files that enable Services to run and be distributed as well as to provide a ready-made infrastructure to run specific features or parts of Services.

Some services among those listed below, if any, may work through geographically distributed servers, making it difficult to determine the actual location where the Personal Data are stored.

Microsoft Azure (Microsoft Corporation)

Microsoft Azure is a hosting service provided by Microsoft Corporation.

Personal Data processed: various types of Data as specified in the privacy policy of the service. Place of processing: United States. Privacy Policy.

Category of personal information collected according to the CPRA (CCPA amendment): internet information.

Managing contacts and sending messages

This type of service makes it possible to manage a database of email contacts, phone contacts or any other contact information to communicate with the User.

These services may also collect data concerning the date and time when the message was viewed by the User, as well as when the User interacted with it, such as by clicking on links included in the message.

Twilio (Twilio, Inc.)

Twilio is a phone numbers management and communication service provided by Twilio, Inc. Personal Data processed: phone number.

Place of processing: United States. Privacy Policy.

Category of personal information collected according to the CPRA (CCPA amendment): identifiers.

This processing constitutes:

Sendgrid (Sendgrid)

Sendgrid is an email address management and message sending service provided by Sendgrid Inc. Personal Data processed: email address.

Place of processing: United States. Privacy Policy.

Category of personal information collected according to the CPRA (CCPA amendment): identifiers.

This processing constitutes:

The Rights of the User

Users may exercise certain rights regarding their Data processed by the Owner.

In particular, Users have the right to do the following:

Details about the right to object to processing

Where Personal Data is processed for a public interest, in the exercise of an official authority vested in the Owner or for the purposes of the legitimate interests pursued by the Owner, Users may object to such processing by providing a ground related to their particular situation to justify the objection.

Users must know that, however, should their Personal Data be processed for direct marketing purposes, they can object to that processing at any time without providing any justification. To learn whether the Owner is processing Personal Data for direct marketing purposes, Users may refer to the relevant sections of this document.

How to exercise your rights

To exercise the rights described above, you need to submit your verifiable request to us by contacting us via the details provided in this document.

For us to respond to your request, it's necessary that we know who you are. Therefore, you can only exercise the above rights by making a verifiable request which must:

Making a verifiable consumer request does not require you to create an account with us. We will use any personal information collected from you in connection with the verification of your request solely for the purposes of verification and shall not further disclose the personal information, retain it longer than necessary for purposes of verification, or use it for unrelated purposes.

If you cannot personally submit a verifiable request, you can authorize a person registered with the California Secretary of State to act on your behalf.

If you are an adult, you can make a verifiable request on behalf of a minor under your parental authority. You can submit a maximum number of 2 requests over a period of 12 months.

How and when we are expected to handle your request

We will confirm receipt of your verifiable request within 10 days and provide information about how we will process your request.

We will respond to your request within 45 days of its receipt. Should we need more time, we will explain to you the reasons why, and how much more time we need. In this regard, please note that we may take up to 90 days to fulfill your request.

Our disclosure(s) will cover the preceding 12-month period. Only with regard to personal information collected on or after January 1, 2022, you have the right to request that we disclose information beyond the 12-month period, and we will provide them to you unless doing so proves impossible or would involve a disproportionate effort.

Should we deny your request, we will explain to you the reasons behind our denial.

We do not charge a fee to process or respond to your verifiable request unless such request is manifestly unfounded or excessive. In such cases, we may charge a reasonable fee, or refuse to act on the request. In either case, we will communicate our choices and explain the reasons behind it.

Additional Information for California Consumers

This part of the document integrates with and supplements the information contained in the rest of the privacy policy and is provided by SureAdhere and, if the case may be, its parent, subsidiaries and affiliates.

The provisions in this section apply to all Users who are consumers residing in the State of California, United States of America, according to the "California Consumer Privacy Act of 1798.100 et seq" (the "CCPA"), as amended by the "California Privacy Rights Act" (the "CPRA") and for such consumers, these provisions supersede any other possibly divergent or conflicting provisions contained in the privacy policy. This part of the document uses the term "personal information" as defined in the California Consumer Privacy Act (CCPA).

Categories of personal information collected, used, sold, or shared

We have collected the following categories of personal information about consumers in the 12 months prior to the publication of this privacy policy:

We will not collect additional categories of personal information without notifying you.

To find out more about the categories of personal information collected, the purposes for which such information is used, and the rights of consumers, please read the "Detailed information on the processing of Personal Data" section of this document.

Your right to opt out of the sale or sharing of your personal information and how to exercise it

We sell or share your personal information with the following categories of third parties: Analytics services, Advertising networks, Social networks, and Data brokers. We will not sell or share any additional categories of personal information without notifying you.

You have the right to opt out of the sale or sharing of your personal information. This means that whenever you request us to stop selling or sharing your personal information, we will abide by your request. To fully exercise your right to opt out you can contact us at any time using the contact details provided in this document.

We will comply with your opt out request within 15 business days from its receipt.

Your privacy rights under the California Consumer Privacy Act and how to exercise them

You may exercise certain rights regarding your personal information subject to your eligibility, including the right to:

To exercise the rights described above, you need to submit your verifiable request to us by contacting us via the contact details provided in this document.

Financial incentives

To the extent permitted by the law, we may offer you promotions, discounts, and other deals in exchange for collecting, keeping, or selling your personal information, provided that the financial incentive offered is reasonably related to the value of your personal information.

Information for Virginia Consumers

This part of the document integrates with and supplements the information contained in the rest of the privacy policy and is provided by the controller running this Application and, if the case may be, its parent, subsidiaries and affiliates. The provisions contained in this section apply to all Users who are consumers residing in the Commonwealth of Virginia, according to the "Virginia Consumer Data Protection Act" (the "VCDPA").

Categories of personal data processed

We have collected the following categories of personal data: identifiers.

We do not collect sensitive data. We will not collect additional categories of personal data without notifying you.

How we use the data we collect: sharing of your personal data with third parties

We share your personal data with the third parties listed in detail in the section titled "Detailed information on the processing of Personal Data" within this document. For our purposes, the word "third party" means "a natural or legal person, public authority, agency, or body other than the consumer, controller, processor, or an affiliate of the processor or the controller" as defined by the VCDPA.

Sale of your personal data

For our purposes, the word "sale" means any "exchange of personal data for monetary consideration by us to a third party" as defined by the VCDPA. As specified in the "Detailed information on the processing of Personal Data" section of this document, our use of your personal information may be considered a sale under VCDPA.

Your right to opt out of the sale of your personal data and how you can exercise it

You have the right to opt out of the sale of your personal data. This means that whenever you request us to stop selling your data, we will abide by your request. To fully exercise your right to opt out you can contact us at any time using the contact details provided in this document.

Your right to opt out of the processing of your personal data for targeted advertising

You have the right to opt out of the processing of your personal data for targeted advertising. To fully exercise your right to opt out you can contact us at any time, using the contact details provided in this document.

Your privacy rights under the Virginia Consumer Data Protection Act and how to exercise them

You may exercise certain rights regarding your data processed by us. In particular, you have the right to do the following:

How and when we are expected to handle your request

We will respond to your request without undue delay, but in all cases and at the latest within 45 days of its receipt. Should we need more time, we will explain to you the reasons why, and how much more time we need. In this regard, please note that we may take up to 90 days to fulfill your request.

Should we deny your request, we will explain to you the reasons behind our denial without undue delay, but in all cases and at the latest within 45 days of receipt of the request. It is your right to appeal such a decision by submitting a request to us via the details provided in this document. Within 60 days of receipt of the appeal, we will inform you in writing of any action taken or not taken in response to the appeal. If the appeal is denied you may contact the Attorney General to submit a complaint.

We do not charge a fee to respond to your request, for up to two requests per year.

Definitions and Legal References

Personal Data (or Data)

Any information that directly, indirectly, or in connection with other information:including a personal identification number:allows for the identification or identifiability of a natural person.

Usage Data

Information collected automatically through Services (or third-party services employed in Services), which can include: the IP addresses or domain names of the computers utilized by the Users who use Services, the URI addresses (Uniform Resource Identifier), the time of the request, the method utilized to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server's answer (successful outcome, error, etc.), the country of origin, the features of the browser and the operating system utilized by the User, the various time details per visit (e.g., the time spent on each page within the Application) and the details about the path followed within the Application with special reference to the sequence of pages visited, and other parameters about the device operating system and/or the User's IT environment.

User

The natural or legal person, public authority, agency, or other body who accesses, uses, or interacts with the Services who, unless otherwise specified, coincides with the Data Subject.

Data Subject

The natural person to whom the Personal Data refers.

Data Processor (or Data Supervisor)

The natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of the Controller, as described in this privacy policy.

Owner

The natural or legal person, public authority, agency, or other body who shares or submits all the Data submitted during the use of the Service.

Data Controller

The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data, including the security measures concerning the operation and use of Services. Unless specified otherwise, the Owner of the Data is also the Data Controller.

Services (or this Application)

The means by which the Personal Data of the User is collected and processed.

European Union (or EU)

Unless otherwise specified, all references made within this document to the European Union include all current member states to the European Union and the European Economic Area.

Legal information

This privacy statement has been prepared based on provisions of multiple legislations, including Art. 13/14 of Regulation (EU) 2016/679 (General Data Protection Regulation).

This privacy policy relates solely to Services, if not stated otherwise within this document.

Contact Information

We welcome your comments or questions about this privacy policy. You may also contact us at our address:

245 Main Street, 2nd Floor
Cambridge, MA 02142
t: +1.617.649.2214
f: +1.617.274.8393
privacy-sureadhere@dimagi.com