Privacy Policy

STURDY HEALTH WEBSITE PRIVACY POLICY

Effective Date: October 1, 2026

Last Updated: October 1, 2026

Sturdy Health (which for purposes of this Policy includes Sturdy Memorial Hospital Inc., Sturdy Health, Inc. and Sturdy Health Foundation, Inc.) (hereinafter “Sturdy,” “we,” “us,” or “our”) is committed to safeguarding the privacy and security of visitors to Sturdy’s public-facing website (sturdyhealth.org) and its online services available through that URL (collectively, the “Site”).

This Privacy Policy (“Policy”) describes the types of information we collect when you visit Sturdy’s Site, how we use and share that information, and the choices available to you regarding your information and use of the Site.

PLEASE READ THIS POLICY CAREFULLY.

YOUR CONSENT: BY ACCESSING OR USING OUR SITE, YOU AGREE AND CONSENT TO THE COLLECTION, USE, RETENTION, AND DISCLOSURE OF YOUR INFORMATION BY STURDY AS DESCRIBED IN THIS POLICY AND ANY ADDITIONAL TERMS OF USE, INCLUDING STURDY HEALTH’S TERMS OF USE AVAILABLE HERE:
https://www.sturdyhealth.org/terms-of-use/

IF YOU DO NOT AGREE, YOU MUST DISCONTINUE USE OF THE SITE IMMEDIATELY.

1. SCOPE AND SEPARATE NOTICE OF PRIVACY PRACTICES (HIPAA)

This Policy applies strictly to information collected through Sturdy’s public-facing, informational Site. This Policy applies to Sturdy and all of its affiliates under common ownership or control, including Sturdy Health.

NOTICE REGARDING HIPAA PROTECTED HEALTH INFORMATION:

Information that you provide (or that is provided on your behalf) to Sturdy as a patient receiving medical treatment, information related to payment for treatment or items/services from Sturdy, information accessed through Sturdy’s secure online Patient Portal (MySturdyHealth), and any other information that constitutes “Protected Health Information” (PHI) under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (HIPAA) and applicable Massachusetts laws, is governed by Sturdy’s Notice of Privacy Practices.

Sturdy’s Notice of Privacy Practices describes how Sturdy collects, uses, and shares your medical records and health information in accordance with HIPAA and other applicable laws.

To review our HIPAA Notice of Privacy Practices, please visit HERE:
https://www.sturdyhealth.org/app/files/public/cfa36fba-2fc6-4d84-b07e-e98526ea476d/SH%20Notice%20of%20Privacy%20Practices%20Update%202_16_2026.pdf

2. INFORMATION STURDY COLLECTS FROM THE SITE

Sturdy collects information you voluntarily provide through the Site, as well as certain information that is automatically collected based on your interactions with the Site.

A. Information You Provide Voluntarily

• Contact Information: Your name, email address, phone number, mailing address, or similar information when you submit a contact form, register for a community event, sign up for newsletters, request information from Sturdy, or provide information to Sturdy.

• Feedback & Inquiries: This may include information that you provide through surveys, customer service inquiries, or job applications submitted through our career portal, as well as other feedback you provide or inquiries you submit.

If you submit through the Site any identifiable information relating to you or to other people, you represent that you have the authority to submit such identifiable information to Sturdy and to grant Sturdy the right to transmit, monitor, retrieve, store and use your information in accordance with this Policy in connection with the operation of the Site or the service requested by you through the Site and/or the services that Sturdy provides.

SECURITY REMINDER: You are not allowed to, so please do not, submit confidential medical information, symptoms, diagnostic details, or Social Security numbers through public web forms on the Site or ordinary email. Public web forms and ordinary email are not intended for clinical communications and may not be secure. If you mistakenly or inadvertently submit confidential medical information to our Site and would like assistance please let us know.

Patients of Sturdy may elect to create a MySturdyHealth Patient Portal account through the MySturdyHealth login page. MySturdyHealth may enable patients to access certain health information and communicate with their care team. Information accessed through or submitted using MySturdyHealth is not governed by this Policy. Use of MySturdyHealth is subject to the separate terms, conditions, and privacy notices available through the MySturdyHealth login page. Please be aware that we will never request your MySturdyHealth Patient Portal login credentials, Social Security number, or financial information via ordinary email.

B. Information Collected Automatically (Online Activity Data)

When you browse our Site, we and our authorized service providers may automatically collect technical data from your browser or device, including:

• IP address, domain name, and location (may be precise or inferred).

• Device attributes and identifiers (operating system, browser type, hardware type).

• Usage data (pages viewed, time spent on pages, links clicked, page title(s) and URL(s), referring URL).

• Search terms entered on our public site search functionality.

• Form-field metadata.

• Video or media interactions and other interaction events, such as form-interaction data or inquiries.

• Chat transcripts.

• Email engagement data.

• Information from social media platforms or advertising partners.

C. Information Collected From Third Parties

In connection with your use of our Site, we may receive information about you from our affiliates, public sources, social media networks, referring web pages, and our service providers (including without limitation advertising and analytics providers).

3. TRACKING TECHNOLOGIES, COOKIES, AND ANALYTICS

Sturdy uses cookies, web beacons, pixels, software development kits (SDKs), and script technology to ensure Site functionality, enhance user experience, and analyze Site performance.

A. Types of Technologies Used:

• Essential/Strictly Necessary Cookies: Required for core site navigation, security, and accessibility.

• Analytics & Performance Cookies (e.g., Google Analytics): These help Sturdy to understand how visitors interact with the Site in an aggregated manner to improve layout and resource allocation, as well as Site functionality.

• Functional Cookies: Remember your preferences (e.g., font size, language).

• Marketing & Media Pixels: Used to evaluate the reach and effectiveness of certain Site content, such as Sturdy’s public health awareness campaigns and community outreach initiatives, as well as performance metrics.

B. Data Minimization & Safeguards

Sturdy utilizes technical and administrative safeguards to limit data collected by third-party tracking tools.

For example:

• Non-essential third-party pixels are restricted or disabled on web pages that handle clinical searches, financial transactions, or MySturdyHealth Patient Portal access.

• Sturdy does not sell, rent, or transfer identifiable personal information, PHI or online activity logs to data brokers or unauthorized third parties.

• All third-party service providers acting on Sturdy’s behalf are bound by contractual obligations to maintain confidentiality and security.

C. ARTIFICIAL INTELLIGENCE

We may utilize certain artificial intelligence (“AI”) tools and programs to support the Site’s functionality, your use of the Site, and our operation of the Site and our business. Where practicable, we will notify you and give you the opportunity to decline use of AI tools. Our AI tools are intended to support and provide assistance for your informational purposes only, and Sturdy will never utilize an AI tool as a primary decision-maker in connection with your care. We may also use AI tools to support our analysis of the Site’s performance, your use of or interactions with the Site, and opportunities to enhance our programs and services for our community. We do not allow our AI tools to use identifiable data to train publicly available AI systems, and humans oversee the implementation and utilization of our AI tools.

USE OF AI TOOLS IS NOT INTENDED TO BE A SUBSTITUTE FOR PROFESSIONAL MEDICAL ADVICE OR TREATMENT. STURDY CANNOT AND DOES NOT GUARANTEE THE ACCURACY, COMPLETENESS, OR TIMELINESS OF INFORMATION PROVIDED TO YOU BY OR THROUGH AN AI TOOL ON THE SITE.

4. HOW STURDY MAY USE YOUR INFORMATION

Sturdy may use information collected through the Site that is not PHI for legitimate operational purposes, including, without limitation, to:

• Operate, maintain, and improve the quality, navigation, and features of the Site.

• Respond to your inquiries, event registrations, or employment applications.

• Send newsletters and updates or other communications you request and administer your communication preferences.

• Detect, prevent, and mitigate security threats, fraud, or technical bugs.

• Monitor aggregate demographic patterns and web traffic trends, and compile statistical information regarding the use and users of the Site.

• Comply with applicable state and federal legal obligations, court orders, and administrative requests.

5. HOW STURDY MAY SHARE YOUR INFORMATION

Sturdy does not monetize your personal information collected through the Site.

Sturdy may share information about you obtained through the Site for permitted purposes under this Policy and applicable law, including in the following circumstances:

• Service Providers: Contracted vendors, IT contractors, and hosting partners who assist us in maintaining the Site and providing our services, provided that they are subject to contractual restrictions on use, retention and re-disclosure of user information.

• Affiliates: Sturdy affiliates or related entities where reasonably necessary to provide services, respond to requests, administer operations, or comply with law.

• Legal & Regulatory Requirements: When required by law, subpoena, warrant, or regulatory inquiry, or to protect the rights, safety, and security of Sturdy, our patients, or the public.

• Insurers and Professional Advisers: Our insurance providers, legal, tax and accounting providers, and consultants who support our business operations.

• Corporate Reorganization: In the event of a merger, acquisition, or similar corporate restructuring or reorganization, subject to this Policy.

6. YOUR CHOICES AND OPT-OUT MECHANISMS

You have choices regarding how your online information is collected through the Site and used by Sturdy:

• Cookie Preference Center: You can manage or disable non-essential cookies and pixels at any time by modifying the “Cookie Settings” for our Site.

• Browser Controls: Most web browsers allow you to block or delete cookies via browser settings. Please note that blocking essential cookies may impact site functionality, and if you use multiple browsers or devices you will need to opt out on each browser or device.

• Google Analytics Opt-Out: You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on.

• “Do Not Track” / Global Privacy Control: Certain modern browsers offer “Do Not Track” (DNT) or Global Privacy Control (GPC) signals. Our Site responds to recognized universal opt-out mechanisms where required by applicable law.

7. DATA SECURITY AND RETENTION

A. In accordance with the Standards for the Protection of Personal Information of Residents of the Commonwealth of Massachusetts (201 CMR 17.00) and HIPAA, Sturdy maintains a Written Information Security Program as part of our privacy and security practices. Sturdy implements administrative, technical, and physical safeguards—including encryption, firewalls, audits, and access limitations—to protect user information against unauthorized access, loss, or alteration. However, no method of electronic transmission or storage is completely secure. Sturdy will provide you with notice of security incidents affecting your information when required by applicable law.

B. We retain your information collected through the Site for only as long as reasonably necessary for the disclosed purpose, legal requirements, dispute resolution, security, and recordkeeping.

8. THIRD-PARTY LINKS

The Site may contain links to external third-party websites for user convenience. Sturdy does not control and is not responsible for the privacy practices, security, or content of third-party sites that Sturdy does not own or operate. This Policy does not apply to those third-party services, sites, applications, or platforms. Sturdy encourages users to review the privacy statements and terms of use of any external site visited.

9. CHILDREN’S PRIVACY

The Site is not directed to children under the age of 13, and we do not knowingly collect personal information online from children under 13. If Sturdy learns that it has collected personal information online from a child under 13 without verifiable parental consent, Sturdy will take reasonable steps to delete that information.

10. UPDATES TO THIS POLICY

Sturdy reserves the right to modify or update this Policy at any time. Any changes will be posted on this page with an updated “Last Updated” date.

Your continued use of the Site following the posting of changes constitutes your acknowledgment and acceptance of those changes.

11. CONTACT STURDY

If you have questions, concerns, or requests regarding this Policy, please contact our Privacy Officer:

Sturdy Privacy Office

Attn: Corporate Integrity and Risk Officer

211 Park Street

Attleboro, MA 02703

Email: DBouwmeester@sturdyhealth.org

Phone: 508-236-7157