Legal

uTransplant Consumer Health Data Privacy Policy

Effective date: March 30, 2026
Last updated: August 19, 2026

This Consumer Health Data Privacy Policy is a separate, health-data-specific notice provided by Bridge Clinical Care PLLC, which operates the uTransplant service and utransplant.com (“uTransplant,” “we,” “us,” or “our”). It explains how we collect, use, and disclose Consumer Health Data and how you may exercise health-data rights.

This notice applies to Consumer Health Data handled through utransplant.com, our private matching platform, accounts, messages, Navigator Services, travel-assistance requests, and related direct-to-consumer services. It supplements the uTransplant Privacy Policy and controls over an inconsistent general disclosure concerning Consumer Health Data. Unless a Navigator Agreement or HIPAA Notice of Privacy Practices presented at or before the relevant collection expressly names a different legal controller or covered provider, Bridge Clinical Care PLLC controls the Consumer Health Data for the services described here. Any service-specific notice that identifies another legal entity must provide its name and contact information, explain the respective roles and data flow, and govern the covered service to the extent of a direct conflict.

1. What “Consumer Health Data” means

“Consumer Health Data” means personal information that identifies or can reasonably be linked to a person and that identifies, reveals, or permits an inference about that person’s physical or mental health status, health conditions, treatment, reproductive or sexual health, medication, bodily functions, health services, precise location information reasonably indicating an attempt to receive health services, or other health-related information covered by applicable law.

For uTransplant, Consumer Health Data may include information about a recipient, potential donor, caregiver, or Navigator client, even if the information is not protected by HIPAA.

2. Categories of Consumer Health Data we collect

Depending on the service you request, we may collect:

• Transplant role and need: whether a person is a recipient, potential living donor, caregiver, support person, or Navigator client; for private matching, whether a kidney or liver is needed or offered, relationship to an intended recipient, and donation intent; and, for Navigator Services, the transplant type and stage information the client chooses to provide.
• Compatibility information: self-reported ABO blood type used for preliminary kidney or liver private matching and, if voluntarily supplied through secure Navigator intake or records, tissue-typing, genetic, laboratory, or other clinical information. Clinical information supplied for Navigator Services is not used by the private-matching engine.
• Transplant status and history: current transplant center, evaluation or waitlist status, stage in the process, prior donor or match history, general timeline, and willingness or need to travel.
• Health and care information: diagnoses, conditions, symptoms, medications, treatments, functional limitations, disability or accessibility needs, medical history, insurance or reimbursement information, clinician or transplant-center information, and records or documents voluntarily provided for Navigator Services.
• Profile and communication content: personal story, health-related preferences, match choices, messages, support requests, safety reports, and information disclosed during a Navigator session.
• Service-generated health information: potential-match results, match status, and limited compatibility inferences based only on selected kidney-or-liver type and self-reported ABO information; connection status; Navigator notes or summaries; and health-related service recommendations or educational topics.
• Travel-related health inferences: transplant destination or center, dates, length of stay, caregiver presence, accessibility needs, and other information revealing that a person may be seeking transplant-related services.
• Consent and disclosure records: health-data collection consent, sharing choices, identity-reveal decisions, withdrawals, authorizations, and privacy requests.
• Technical health inferences: page, feature, or message activity that, when linked to a person, reveals or permits an inference about transplant needs, donation interests, or other health services.

We do not require precise GPS location, Social Security numbers, complete payment-card numbers, or biometric identifiers for private matching. Do not place unnecessary sensitive information in free-text fields, ordinary email, or text messages.

Private matching does not cover bone marrow or blood stem cells, heart, lung, pancreas, deceased-donor organs, or other organs or tissues. Navigator Services may address other transplant types but do not provide donor matching.

3. Sources of Consumer Health Data

We may collect Consumer Health Data from:

• you, through profiles, intake, messages, documents, sessions, choices, and requests;
• a matching invitation, which lets another adult create their own kidney or liver matching account rather than a helper creating that matching profile;
• an adult’s caregiver, family member, helper, or authorized representative, including for Navigator Services;
• another Platform user, including a potential match, connected user, or person submitting a safety report;
• an assigned RN or authorized professional-service personnel, who may create intake, scheduling, session, safety, or summary records;
• a transplant center, clinician, care portal, or other healthcare organization, only when you direct or authorize the exchange or another lawful basis applies;
• travel, lodging, nonprofit, reimbursement, or partner organizations, when responding to a request you initiated;
• our operational providers, including providers supporting hosting, databases, authentication, communications, care portals, e-signatures, payments, support, and security, acting in the processor, service-provider, or other role described in Section 5.3; and
• your use of the Platform, including logs and feature activity that reveal a health-related interest or service.

4. Why and how we collect and use Consumer Health Data

We collect and use Consumer Health Data only for purposes reasonably necessary to provide a service you requested, for another purpose with the legally required consent, or as otherwise permitted by law. Those purposes and processing methods include:

1. Creating and operating private profiles. We receive information through forms and account controls, store it in access-restricted systems, allow authorized edits, and maintain profile status.
2. Performing preliminary kidney and liver private matching. The Platform compares a user-selected kidney-or-liver need or offer with self-reported ABO blood type. This is a limited informational screen, not HLA or tissue typing, crossmatching, medical-suitability review, transplant-program approval, or a clinical decision.
3. Providing staged disclosures and messaging. We display the limited fields described in Section 5 according to product rules and each person’s choices and transmit messages between connected users.
4. Providing Navigator Services. Authorized RNs and contracted processors may review intake, records, messages, and public center information; conduct sessions; coordinate administrative tasks; and prepare summaries within the scope of the Navigator engagement.
5. Responding to travel and lodging requests. We use destination, dates, budget, accessibility, and other request information to identify resources or, at your direction, contact a provider.
6. Providing support and safety functions. We investigate reports, enforce anti-commerce and anti-coercion rules, prevent fraud, secure accounts, and protect users.
7. Communicating about requested services. We send match, message, scheduling, account, billing, support, and legally permitted reminder communications.
8. Complying with law and professional obligations. We maintain required professional, consent, transaction, audit, safety, incident, and legal records; respond to valid legal process; and provide legally required notices.
9. Improving reliability and accessibility. We troubleshoot and measure service performance, using deidentified or aggregated information when reasonably feasible.

We do not use Consumer Health Data to determine medical eligibility, transplant priority, donor approval, insurance, employment, housing, or credit. We do not use Consumer Health Data to create targeted-advertising audiences.

5. Categories of Consumer Health Data we share

“Share” in this notice includes making Consumer Health Data available to another person or organization, except where applicable law treats a contracted processor differently.

5.1 Potential and connected matches

We may share the following categories through the private matching flow:

• Potential match: after any legally required Consumer Health Data sharing consent has been obtained, the selected organ—kidney or liver—and self-reported ABO blood type may be visible to another user identified as a potential match before either person mutually opts in to connect.
• Mutual opt-in: story and general location may become visible only after both parties separately choose to connect.
• Identity reveal: real name, direct contact information, and other identifying details remain private unless and until the individual affirmatively chooses to reveal them.

The Platform will identify the information covered by an identity-reveal action. A recipient may be a consumer receiving Consumer Health Data under applicable law and is contractually prohibited from using it for an unrelated purpose.

5.2 RNs and professional-service personnel

We share Consumer Health Data with the assigned licensed RN and authorized coverage or support personnel as needed to provide a Navigator engagement. These individuals are bound by confidentiality and professional or contractual restrictions appropriate to their role.

5.3 Processors and other operational providers

We use operational providers for the functions listed below. A provider is treated as a processor only when it processes Consumer Health Data on our behalf under binding instructions that satisfy applicable law. Before permitting that processing, we require the applicable purpose limitations, confidentiality, security, rights-assistance, deletion, and other contractual protections. If a provider determines independent purposes or means or otherwise does not qualify as a processor, we treat it as a third party and apply the notice, consent, and disclosure rules required for that role.

Operational functions may include:

• secure hosting, databases, storage, backups, and authentication;
• matching, account, and messaging infrastructure;
• care-portal, scheduling, intake, e-signature, and secure communication services;
• email, text messaging, customer support, and service notices;
• payment processing and fraud prevention, including Stripe; purchase descriptions, contact information, and transaction metadata may reveal or permit an inference that a person requested a transplant-related service, so we limit the information supplied to what is reasonably necessary for payment, fraud prevention, and legal compliance;
• security monitoring, incident response, technical support, and compliance operations.

Stripe or another payment provider may act as our processor or service provider for some functions and independently for other functions described in its own privacy notice. We do not treat a provider as a processor merely because it supports the Platform.

Employees and contracted personnel may access Consumer Health Data only on a role-based, need-to-know basis for a purpose described in this notice and subject to confidentiality, security, training, and other duties appropriate to their role.

We do not authorize a third party to collect Consumer Health Data through the uTransplant-controlled Platform over time and across unrelated websites or online services for that third party’s own advertising, profiling, or other independent purpose.

5.4 Third parties at your direction

At your request or with the required direction, consent, or authorization, we may share relevant Consumer Health Data with:

• a transplant center, clinician, organ procurement organization, donor program, or reimbursement program;
• a lodging, travel, transportation, nonprofit, or accessibility provider; or
• another person or organization you identify.

Before sending information, we will identify the disclosure method and limit the information to what is reasonably necessary. Do not use ordinary email or text for medical records or other highly sensitive documents.

5.5 Safety, legal, and corporate events

We may share relevant Consumer Health Data when reasonably necessary and legally permitted to investigate organ commerce, coercion, threats, fraud, abuse, unauthorized access, or another safety concern; comply with law or valid legal process; establish, exercise, or defend legal claims; or protect rights and safety. We may disclose the minimum necessary information to attorneys, auditors, accountants, insurers, and other professional advisers only for a relevant professional function, under appropriate confidentiality restrictions, and only where applicable law permits the disclosure without separate sharing consent or after obtaining the required consent or authorization.

Consumer Health Data may be disclosed during transaction planning, diligence, a merger, acquisition, financing, reorganization, bankruptcy, or sale of the Platform only where the disclosure qualifies for an applicable statutory transaction exception or the recipient acts in a legally compliant processor or professional-adviser role. Otherwise, we will obtain the separate sharing consent or authorization required before disclosure. A financing or proposed transaction does not by itself authorize disclosure. A successor may not use the data for a materially different purpose without the notice and consent or authorization required by law.

5.6 Affiliates

Specific corporate affiliates with which uTransplant currently shares Consumer Health Data: None. Affiliate status depends on the applicable ownership and control relationships, not on a label. No employee, RN, contractor, processor, adviser, vendor, owner, or other person or entity is authorized to access or receive Consumer Health Data merely because of a relationship with Bridge Clinical Care PLLC or uTransplant. Any access or disclosure must fit a recipient category and purpose already described in this notice and satisfy the applicable role-based access, confidentiality, processor, consent, authorization, and legal requirements. If a separate corporate affiliate will receive Consumer Health Data in the future, we will specifically name that affiliate, update this notice, and obtain any required affirmative sharing consent or authorization before sharing.

6. We do not sell Consumer Health Data

We do not sell Consumer Health Data for money or other valuable consideration. We do not exchange it for sponsorship, directory placement, patient referrals, discounts, advertising, or partner benefits.

If we ever propose a transaction that applicable law defines as a sale of Consumer Health Data, we will first update this notice and obtain the separate, signed authorization required by law. A general acceptance of Terms or this Policy would not be that authorization.

We do not share Consumer Health Data for cross-context behavioral or targeted advertising.

7. Consent and your choices

This notice is not itself consent.

Before collecting or sharing Consumer Health Data, we obtain the separate, affirmative consent required by applicable law unless the processing is strictly necessary to provide a product or service you specifically requested or another legal exception applies. Collection consent and sharing consent are presented separately where required and are not bundled into general Terms acceptance. Where sharing consent is required for matching, it is obtained before the profile enters the potential-match queue or organ and ABO information is shown to another user.

Where and when Virginia law applies to personally identifiable reproductive or sexual health information, we obtain the consumer’s consent before obtaining, disclosing, selling, or disseminating that information, unless the information or transaction falls within an applicable statutory exclusion. This Virginia consent protection is separate from the Consumer Health Data rights listed in Section 8.

For private matching, the interface describes the fields involved and captures choices at the relevant stage. Identity reveal is optional. Declining an optional disclosure does not make your profile public and does not authorize us to reveal it for you.

If one adult seeks to create a profile for another adult, we may first collect only the minimum information needed to send the person an invitation or verify the requester’s authority. We will not collect other Consumer Health Data about that person, activate matching, or share the data until the person directly confirms and gives the required consent, or the requester provides proof of legal authority to act for them.

You may withdraw consent prospectively by using account controls or submitting a request under Section 8. Withdrawal does not make prior lawful processing unlawful. If the withdrawn processing is necessary to provide a requested service, we will explain that the service may need to be limited, paused, or closed.

8. Consumer Health Data rights

Depending on applicable law, you may have the right to:

• confirm whether we collect, share, or sell your Consumer Health Data;
• access the Consumer Health Data we hold about you;
• correct inaccurate Consumer Health Data where applicable law grants that right;
• obtain a portable copy of Consumer Health Data where applicable law grants that right;
• receive a list of third parties and affiliates with which we shared or sold your Consumer Health Data, including an email address or other online contact method for those recipients where required;
• withdraw consent and request that we stop collecting or sharing Consumer Health Data;
• delete Consumer Health Data; and
• appeal our refusal to act on a request.

We provide these rights to Washington, Nevada, and Connecticut consumers as required by their consumer-health laws and to other consumers where applicable law grants equivalent rights.

8.1 How to submit a request

Submit our secure Privacy and Consumer Health Data Request Form. The form is available without creating a new account and supports the applicable access, correction, portability, third-party-list, withdrawal, cessation, and deletion requests. You may also email privacy@utransplant.com with the subject “Consumer Health Data Request” to initiate a request; do not attach medical records or identity documents to ordinary email. State the right you want to exercise and identify the account or service involved.

Where account controls are available, you may review and change editable profile and account information there. If a field or record is not editable through the account, use the secure request form.

We will authenticate the request using information reasonably related to the account and sensitivity of the request. We will not ask for more information than reasonably necessary. An authorized agent may submit a request, but we may require proof of authority and direct confirmation from the consumer unless law provides otherwise.

8.2 Timing and appeals

We will respond without undue delay and within the period required by applicable law. Washington generally requires action within 45 days, subject to one permitted 45-day extension. Nevada generally requires authenticated deletion from active systems within 30 days, subject to statutory exceptions. Requests are ordinarily free; applicable law may allow a fee or refusal for manifestly unfounded, excessive, or repetitive requests.

If we deny a request, you may appeal by emailing privacy@utransplant.com with the subject “Consumer Health Data Appeal” and explaining why the decision should be reconsidered. We will decide the appeal within the period required by applicable law and will explain any further complaint option available to you.

We will not discriminate against you for exercising a Consumer Health Data right. Some features may be unavailable if the information is necessary to provide the service you request.

8.3 Deletion propagation

When a verified deletion right applies, we will delete the covered Consumer Health Data from active records and notify applicable processors, contractors, affiliates, and third parties to delete it as required. Where Washington law applies, Consumer Health Data retained in archived or backup systems will be deleted within the legally permitted period, which may be up to six months after authentication of the request. Where Nevada law applies, deletion from archived or backup systems must be completed within the legally permitted period, which may be up to two years. If more than one deletion deadline applies to the same data, and no applicable exception or conflicting legal duty controls, we follow the shortest applicable deadline.

Deletion is subject to lawful exceptions, including information necessary to complete a requested transaction, maintain security, prevent fraud, preserve another person’s rights, comply with professional or legal recordkeeping, or establish or defend legal claims. Information another user copied or that you voluntarily disclosed outside the Platform may remain outside our control, but we will send legally required deletion notices to recipients we can identify.

9. Retention and minimization

We restrict Consumer Health Data to what is reasonably necessary and proportionate for the service and disclosed purpose. We retain it only for the shortest period reasonably compatible with:

• an active profile, paid matching period, mutual connection, message, request, or Navigator engagement;
• professional, consent, authorization, safety, incident, contract, or legal recordkeeping duties;
• dispute, fraud, organ-commerce, and security investigations; and
• backup roll-off and continuity, subject to applicable statutory deletion deadlines.

We determine retention by record type and purpose, including profile stories, unmatched and connected messages, abandoned enrollment information, travel health details, professional records, transaction evidence, consent logs, safety records, and backups. When retention is no longer justified under the disclosed purpose, applicable legal or professional requirements, limitation periods, security needs, and backup cycles, we delete or deidentify the data.

Government-identification images and signed authority documents submitted to authenticate a Consumer Health Data request follow the specific retention schedule in Section 11 of the Privacy Policy. We do not use those materials for matching, Navigator care, marketing, profiling, or any purpose unrelated to verification, request security, fraud prevention, legal compliance, or documenting authority.

We publicly commit to maintain deidentified Consumer Health Data in deidentified form and not attempt to reidentify it, except solely, under controlled conditions and where law permits, to test whether the deidentification method is effective.

10. Security and access controls

We use reasonable administrative, technical, and physical safeguards proportionate to the sensitivity of Consumer Health Data and applicable law, and restrict access to personnel and processors that need the data for an authorized purpose. No policy or safeguard can guarantee perfect security.

No system is completely secure. If a breach affects Consumer Health Data, we will investigate and notify consumers, regulators, or others when and as required by applicable law, including the FTC Health Breach Notification Rule if it applies.

11. Geofencing

We do not use or authorize geofences around healthcare facilities to identify or track people seeking healthcare, collect Consumer Health Data from them, or send health-related messages or advertisements. We do not require precise GPS location for matching.

12. Adults only

The Platform is intended for adults age 18 or older. We do not knowingly collect Consumer Health Data through the Platform from minors or create matching profiles for minors. Age confirmation must occur before health-data collection. If we learn that a minor’s Consumer Health Data was submitted in violation of this notice, we will take appropriate steps to delete or restrict it and may close the associated account.

13. Changes to this notice

We may update this notice prospectively. The effective date at the top is the original effective date of this notice; the Last updated date identifies this text. We will provide legally required notice before a material change and obtain new consent or authorization before collecting, using, sharing, or selling Consumer Health Data in a materially different way where law requires it. A revision does not become retroactive merely because the original effective date remains unchanged.

We will not treat continued use alone as consent where affirmative consent is required.

14. Contact and requests

Consumer Health Data questions, requests, and withdrawals: privacy@utransplant.com
Appeals: privacy@utransplant.com, subject “Consumer Health Data Appeal”
Security and safety reports: trust@utransplant.com

Bridge Clinical Care PLLC
Attn: uTransplant Privacy
4513 Lincoln Ave, Suite 203C
Lisle, IL 60532
United States