Privacy Policy

Advocates for Community Health (“Advocates for Community Health”, the “Company”, “we”, “us”,
“our”) respects the privacy of users of its services and visitors to its website and is committed to the
protection of our users’ personal information.

This Advocates for Community Health privacy policy (the “Privacy Policy”) describes how your personal information is collected, used, and shared when you visit www.advocatesforcommunityhealth.org (the “Site”) and/or from Advocates for Community Health without going through the Site, and when you contact us (and provide information) either through the Site or otherwise. ACH will not sell, trade, rent or release your personal information (name, email address, postal address, telephone, etc.) to others without your consent. The Site is not intended for children and individuals under the age of eighteen and we do not knowingly collect data relating to children. Persons using the Site and submitting information to us certify that such persons are eighteen or over.

CONSENT
By giving your personal information (defined below) or other information to us and/or using our Site,
which includes information furnished to us by you, furnished during registration with the Site, furnished during registering for events, or furnished to us by other communication, you agree that we may collect, use, process, share, and transfer such personal information and other information in accordance with the terms and conditions of this Privacy Policy. By using our Site, and otherwise sharing personal information with us, you are consenting to the Privacy Policy and our collection, use, processing, sharing, and transfer of personal information in accordance with this Privacy Policy. If you are visiting the Site from a country other than the United States, your communications will inevitably result in the transfer of information across international boundaries. By visiting the Site, you also consent to these transfers, and you acknowledge and agree that such information may be transferred from your current location to the Site, Advocates for Community Health office, our affiliates and agents, and our service providers as set forth herein.

If you do not consent to the terms of the Privacy Policy and the collection, use, processing, sharing, or
transfer of the information as set forth herein, please do not proceed as we are unable to provide you
with our service, and you should not use our Site or otherwise provide personal information to us.

INFORMATION WE COLLECT
When you use or visit the Site or submit information to us, we automatically collect certain personal
information about your device, including information about your web browser, IP address, time zone,
and some of the cookies that are installed on your device. Additionally, as you browse the Site, we may
collect information about the individual web pages or products that you view, what websites or search
terms referred you to the Site, and information about how you interact with the Site.
When you visit or use the Site, we may collect information that identifies you (“Personal Data”),
including:

• Identity Data includes first name, last name, username or similar identifier.
• Contact Data includes billing address, email address and telephone numbers.
• Financial Data includes payment card details. All payment information is stored by EventBrite and HubSpot. Read EventBrite’s Privacy Policy here: Eventbrite Privacy Policy | Eventbrite Help Center and HubSpot’s here: HubSpot Privacy Policy
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this Site.
• Profile Data includes your email and password, purchases or orders made by you, your
• preferences, feedback and survey responses.
• Usage Data includes information about how you use our Site, products and services.
• Marketing and Communications Data includes your preferences in receiving marketing from use and our third parties and your communication preferences.

We receive Personal Data about you in a range of ways, including:

• Information You Give Us. We collect information you directly give us on our Site.
• Events. We collect information from you when you register for events on our Site.
• Information We Get From Others. We may get information about you from other sources. We
  may add this to information we get from this Site.
• Information Automatically Collected. We automatically log information about you and your computer. For example, when visiting our Site, we log your computer operating system type,
  browser type, browser language, the website you visited before browsing to our Site, pages you
  viewed, how long you spent on a page, access times, location and information about your use of
  and actions on our Site.
• Cookies. Advocates for Community Health and our third-party service providers may log
  information using “cookies.” Cookies are small data files stored on your hard drive by a website.
  We may use both session Cookies (which expire once you close your web browser) and
  persistent Cookies (which stay on your computer until you delete them) to provide you with a
  more personal and interactive experience on our Site. This type of information is collected to
  make the Site more useful to you and to tailor the experience with us to meet your special
  interests and needs. You can typically remove and reject cookies from our Site with your
  browser settings. Many browsers are set to accept cookies until you change your settings. If you
  remove or reject our cookies, it could affect how our Site works for you.

Non-Personally Identifiable Information
Advocates for Community Health also collects non-personally identifiable information in aggregate form to track data such as the total number of visits to our website, the number of visitors to each page of our website, and the domain names of our visitors’ internet service providers. We use this information, which remains in aggregate, non-personally identifiable form, to understand how our visitors use our website so that we may improve our website and the services we offer.

USE & SHARING OF PERSONAL DATA
We use your Personal Data as follows:

• To operate, maintain, and improve our sites, products, and services, to improve and optimize
  our Site (for example, by generating analytics about how our visitors browse and interact with
  the Site, and to assess the success of our marketing and advertising campaigns).
• To respond to comments and questions and provide customer service.
• To send information including confirmations, invoices, technical notices, notifications, updates,
  security alerts, and support and administrative messages.
• To provide targeted advertisements or marketing communications we believe may be of interest
  to you and to communicate about promotions, upcoming events, and other news about
  products and services offered by us and our selected partners.
• To link or combine user information with other Personal Data.
• To protect, investigate, and deter against fraudulent, unauthorized, or illegal activity.
• To provide and deliver services and process registrations placed through the Site (including
  processing your payment information and providing you with invoices and/or order
  confirmations).

We may share Personal Data with third parties as follows:

• With your consent; for example, you may let us share Personal Data with our members for their
  own marketing uses. Those uses will be subject to their privacy policies.
• In the event of the sale or transfer of all or a part of our business or assets; including any
  merger, financing, acquisition, or bankruptcy transaction or proceeding, in which case we would
  require the parties involved to treat Personal Data in accordance with this Privacy Policy.
• For legal, protection, and safety purposes, including, in an emergency, protecting the safety of
  our employees and agents, our members, or any person, complying with laws, responding to
  lawful requests and legal processes, and protecting the rights and property of Advocates for
  Community Health, our agents, customers, and others (including enforcing our agreements,
  policies, and terms of use).

We may share Personal Data with third parties who need it to do work for us. For example, we use:

• “WordPress” as a web platform -you can read more about how WordPress/Automatic use your
  Personal Data here: https://wordpress.org/about/privacy and https://automattic.com/privacy.
• “HubSpot” as a customer relationship management tool, defining, filtering, and storing member
  data – you can read more about how HubSpot uses your Personal Data here:
  https://www.hubspot.com/privacy-policy.
• “HubSpot” as an email marketing and analytics tool – enabling targeted contact, further
  customer data collecting and syncing with HubSpot CRM.
• “Google” including “Google Analytics”, “Google Email”, “Google Plus”, “Google Drive”,
  “Google Forms” “YouTube” as a tool to help communicate, understand, and learn from
  customer interactions and visible (blog-style) dialog – you can read more about how Google
  uses your Personal Data here: https://policies.google.com/privacy?hl=en&gl=us. You can also
  opt-out of Google Analytics here: https://tools.google.com/dlpage/gaoptout.
• “Facebook” as a tool to interact and share company developments with members and those following activity – you can read more about how Facebook uses your Personal Data here: https://www.facebook.com/privacy/explanation.
• “LinkedIn” as a tool to interact and share company developments with members, industry leaders, and those following activity – you can read more about how LinkedIn uses your Personal Data here: https://www.linkedin.com/legal/privacy-policy.
• “X” as a tool to interact and share organizational developments and updates with members, industry leaders, and those following activity – you can read more about how X uses your Personal Data here: https://twitter.com/en/privacy.

DATA SECURITY
The security of your personal information is important to us. We will not sell, share, or otherwise
distribute your personal information to third parties, except as provided in this Privacy Policy. We follow generally accepted industry standards to protect the Personal Data submitted to us, both during
transmission and once we receive it. We have put in place appropriate security measures to prevent
your Personal Data from being accidentally lost, used, or accessed in an unauthorized way, altered, or
disclosed. We may disclose your Personal Data to other Advocates for Community Health affiliates that
agree to treat it in accordance with this Privacy Policy. We limit access to your Personal Data to those
employees, agents, contractors, and other third parties who have a business need to know. We take
reasonable technical and organizational steps to safeguard the Personal Data you provide to us and
protect it from unauthorized access, loss, destruction, or alteration. We have put in place reasonable
procedures to deal with any suspected Personal Data breach and will notify you and any applicable
regulator of a breach where we are legally required to do so.

Because no system is 100% secure or error-free despite taking commercially reasonable steps,
Advocates for Community Health and its affiliates do not guarantee, and you should not expect, that
information you provide shall remain private under all circumstances. It is your responsibility to
safeguard any passwords, ID numbers, or other special access features associated with your use of the
Site.

DATA RETENTION
We will only retain your Personal Data for as long as necessary to fulfill the purposes we collected it for,
including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine
the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of
the Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data,
the purposes for which we process your Personal Data and whether we can achieve those purposes
through other means, and the applicable legal requirements. In some circumstances, you can ask us to
delete your data. In some circumstances, we may anonymize your Personal Data (so that it can no
longer be associated with you) for research or statistical purposes in which case we may use this
information indefinitely without further notice to you. If you wish to cancel your account or request that we no longer use your information to provide you services or products, please contact us at the contact information set forth at the end of this Privacy Policy. We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

FOR NATURAL PERSONS OF THE EUROPEAN UNION (“EU”) – GENERAL DATA PROTECTION REGULATION
(“GDPR”)
If you are a natural person and a resident of the EU, you are subject to the GDPR, and the following
terms also apply to you in addition to the other provisions of this Privacy Policy. The Company is the
Controller and responsible for your Personal Data.
Purposes and Lawful Bases to Process Your Personal Data
This Privacy Policy describes the Personal Data we collect from you and how we use it. We will only use
your Personal Data when the law allows us to. Most commonly, we will use your Personal Data in the
following circumstances:

• Where we need to perform the contract that we are about to enter into or have entered into
  with you (for example, if you place an order through the Site).
• Where it is necessary for our legitimate business interests (or those of a third party) listed above
  and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal or regulatory obligation.
• Where you have consented to the processing of the Personal Data.
• Where processing is necessary to protect the vital interests of you or other natural persons.
• Where processing is necessary for the performance of a task carried out in the public interests.

We have a purpose and lawful basis for collecting and processing each type of Personal Data described
in this Privacy Policy, as follows:

• Identity and Contact Data is to register you as a new customer, and the lawful basis is the
  performance of a contract with you.
• Identity, Contact, Financial, Transaction and Marketing and Communications Data is to process
  and deliver your purchases, and the lawful bases are (a) the performance of a contract with you
  and (b) it is necessary for our legitimate interests.
• Identity, Contact, Profile, and Marketing and Communications Data is to manage a relationship
  with you, and the lawful bases are (a) the performance of a contract with you and (b) it is
  necessary for our legitimate interests (to keep our records updated and to study how customers
  use our products/services).
• Identity, Contact, and Technical Data is to administer and protect our business and the Site, and
  the lawful basis is that it is necessary for our legitimate interests (for running our business,
  provision of administration and IT services, network security, to prevent fraud and in the context
  of a business reorganization or group restructuring exercise).
• Identity, Contact, Profile, Usage, Marketing and Communications, and Technical Data is to
  deliver relevant Site content to you and measure or understand the effectiveness of the
  advertising we serve to you, and the lawful basis is that it is necessary for our legitimate
  interests (to study how customers use our products/services, to develop them, to grow our
  business and to inform our marketing strategy).

Technical and Usage Data is to use data analytics to improve our Site, marketing, customer
relationships and experiences, and the lawful basis is that it is necessary for our legitimate
interests (to define types of customers for our products and services, to keep our Site updated
and relevant, to develop our business and to inform our marketing strategy).

Identity, Contact, Profile, Usage, and Technical Data is to make suggestions and
recommendations to you about goods or services that may be of interest to you, and the lawful
basis is that it is necessary for legitimate interests (to develop our products/services and grow
our business).
Sharing of Personal Data
We may share your Personal Data as set forth above under Use and Sharing of Personal Data for the
purposes described in this Privacy Policy.

Legal Rights Under the GDPR
Under certain circumstances, EU natural persons have rights under data protection laws in relation to
their personal data. If you are an EU natural person you have the right to access Personal Data we hold
about you and to ask that your Personal Data be corrected, updated, or deleted, you have the right to
withdraw consent to processing of Personal Data, you have the right to object to or restrict the
processing of your Personal Data, provided that any legitimate interests of you or us is preserved, and
you have the right to request transfer of your Personal Data to third parties.
If you have any questions about this Privacy Policy or would like to exercise any of these rights, please
contact us through the contact information set forth at the end of this Privacy Policy. You will not have
to pay a fee to access your Personal Data (or to exercise any of the other rights). However, we may
charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we
may refuse to comply with your request in these circumstances. We may need to request specific
information from you to help us confirm your identity and ensure your right to access your Personal
Data (or to exercise any of your other rights). This is a security measure to ensure that Personal Data is
not disclosed to any person who has no right to receive it. We may also contact you to ask you for
further information in relation to your request to speed up our response. We try to respond to all
legitimate requests within one month. Occasionally, it may take us longer than a month. In this case, we
will notify you and keep you updated.

SOCIAL MEDIA WIDGETS
Our Web site includes Social Media Features, such as X Facebook, LinkedIn, Flickr, and YouTube buttons [and Widgets, such as interactive mini programs that run on our site]. These Features may collect your IP address, which page you are visiting on our site, and may set a cookie to enable the Feature to function properly. Social Media Features and Widgets are either hosted by a third party or hosted directly on our Site. Your interactions with these Features are governed by the privacy policy of the company providing it.

LINKS TO OTHER WEBSITES

This Privacy Policy applies only to this Site, and not to websites owned by third parties. The Site includes links to other Web sites whose privacy practices may differ from those of Advocates for Community Health. If you submit personal information to any of those sites, your information is governed by their privacy statements. We may provide links to other websites which we believe may be of interest to our visitors. The Links do not imply Advocates for Community Health review or endorsement of the third- party sites. We aim to ensure that such websites are of the highest standard. However, due to the nature of the internet, we cannot guarantee the privacy standards of websites to which we link or be responsible for the contents of sites other than this one, and this Privacy Policy is not intended to be applicable to any linked, non-Advocates for Community Health site. We encourage you to contact those sites directly for information on their privacy, security, data collection, and distribution policies.

INFORMATION CHOICES/OPTING OUT
You have the right to withdraw consent to marketing at any time by contacting us. Our marketing
emails tell you how to “opt-out.” If you opt-out, we may still send you non-marketing emails. Non-
marketing emails include emails about your accounts and our business dealings with you. If you do not
wish to receive certain communications from us, or our affiliates or representatives, or the third parties
that we share information in accordance with this Privacy Policy, you may opt-out by: (1) declining the
service or products offered when registering with our Site, or at other information collection points on
the Site, or (2) informing us that you no longer wish to receive such communications by contacting us at the contact information set forth at the end of this Privacy Policy. We will comply with such requests
unless such communications from us are required by law or contract or do not require your consent
under applicable laws. If you opt out of certain communications, you may not be able to access certain
of our products or services. If you would like to opt-out of receiving communications from affiliates or
other third parties with whom you shared data, please contact such third parties directly.

UPDATING/ACCESSING/CORRECTING PERSONAL DATA
If your Personal Data (including your email address) changes, or if you no longer desire our service or
products, you may correct, update, amend, delete/remove, or deactivate it by contacting us at the
contact information set forth at the end of this Privacy Policy.

NOTIFICATION OF PRIVACY POLICY CHANGES
We may update or change this Privacy Policy to reflect changes to our information practices or for other
operational, legal, or regulatory reasons. If we make any change in the Privacy Policy, we will issue a
change notification, and we will post the updated policy to the Site. We encourage you to periodically
review this page for the latest information on our privacy practices.

CONTACT INFORMATION

For more information about our privacy practices, if you have questions, if you would like to exercise
any of your rights under this Privacy Policy, or if you would like to make a complaint related to this
policy, please contact us by e-mail at membership@advocatesforcommunityhealth.org or by mail at the
following address:

Advocates for Community Health
1575 I St. NW, Suite 300
Washington, DC 20005