We do not sell personal information for money. We do not sell consumer health data, and we do not use consumer health data for targeted advertising. Medical records created by your Provider are governed by the Provider’s Notice of Privacy Practices and applicable health privacy law. You may request access, correction, deletion, or a portable copy of eligible Caliber data through the member portal or support.
1. Scope and the health-data boundary
This Privacy Policy (“Policy”) describes how NEXPANSE CORP., doing business as Caliber (“Caliber,” “we,” “us,” or “our”), collects, uses, discloses, and protects personal information when you use startcaliber.com, the Caliber member portal, assessments, administrative and support services, or other services that link to this Policy (collectively, the “Caliber Services”).
Caliber arranges access to independent clinical services furnished by MDI Medical Group PC, its affiliated professional entities, and their licensed Providers. M&D Integrations, Inc. supplies the clinical platform. Caliber’s Policy does not replace the medical practice’s Notice of Privacy Practices (“NPP”).
| Information context | Primary privacy terms |
|---|---|
| Medical records and PHI maintained by a Provider or medical practice | The applicable NPP, HIPAA where applicable, and other federal and state medical privacy laws. |
| Caliber account, program, support, billing, website, and non-clinical data | This Policy and applicable consumer privacy and consumer health data laws. |
| Information Caliber handles for a medical practice as its service provider | The practice’s NPP and Caliber’s contractual and legal duties as a business associate or service provider, where applicable. |
Review our Medical Privacy & HIPAA page for a plain-language explanation and links to the MDI privacy center and NPP.
2. Information we collect
The information we collect depends on how you use the Caliber Services and may include:
- Identity and contact data: name, date of birth, email, phone number, mailing and shipping address, state of location, and account identifiers.
- Identity-verification data: government identification, photographs, selfie or introductory video, and verification results when required for care, fraud prevention, or legal compliance.
- Health and care-request data: symptoms, conditions, allergies, medications, treatment history, height, weight, goals, sex-related information, photographs, answers to intake and follow-up questions, laboratory data, and messages you submit in connection with requested care.
- Program and transaction data: selected service, subscription, price, discounts, order and shipment status, billing history, refunds, and limited payment details such as card brand and last four digits. Stripe processes full card details.
- Account and communications data: login and verification status, support requests, portal messages, email and SMS preferences, survey responses, and records of consent.
- Device and usage data: IP address, browser and device type, operating system, referring page, pages viewed, clicks, approximate location derived from IP, timestamps, error and performance data, and cookie or similar identifiers.
- Inferences: basic inferences used to personalize navigation, recommend a care path, prevent fraud, or improve support. A Caliber recommendation is not a medical diagnosis or prescription decision.
We collect information directly from you; automatically from your browser or device; from Providers, MDI, pharmacies, laboratories, payment processors, identity-verification and authentication providers; and from other parties at your direction or as permitted by law.
3. How we use information
We use personal information as reasonably necessary to:
- provide, operate, personalize, troubleshoot, and secure the Caliber Services;
- create and authenticate accounts and verify identity, age, and location;
- route a care request and transmit information to MDI, a medical practice, a Provider, pharmacy, laboratory, or other service you request;
- coordinate support, orders, refills, shipping, billing, cancellation, and refunds;
- communicate about care coordination, safety, transactions, security, and support;
- send marketing only as permitted by law and your choices; we do not use consumer health data to target advertising;
- measure marketing-site performance and improve accessibility and user experience;
- detect, investigate, and prevent fraud, abuse, security incidents, and illegal activity;
- comply with law, professional obligations, audits, legal process, and recordkeeping;
- establish, exercise, or defend legal claims; and
- create aggregated or de-identified information that is not reasonably linkable to you. We will not attempt to re-identify data that applicable law requires us to maintain as de-identified.
4. How we disclose information
We may disclose relevant information to the following recipients for the purposes above:
- Clinical care parties:MDI Medical Group PC, affiliated professional entities, Providers, and M&D Integrations, Inc.
- Care-support parties: pharmacies, laboratories, identity-verification providers, fulfillment partners, carriers, and other services you request.
- Operational vendors: cloud hosting, security, communications, customer support, authentication, data storage, and software providers working for us.
- Payment providers: Stripe, financial institutions, and card networks involved in payment authorization, recurring billing, fraud prevention, and refunds.
- Analytics providers: PostHog receives limited marketing-site event and device data configured to exclude form answers and common sensitive fields. Caliber disables its PostHog integration on intake, patient portal, login, and password-reset routes and disables session recording.
- Professional advisors: auditors, insurers, accountants, and legal or compliance advisors subject to appropriate duties.
- Authorities and protected parties: courts, regulators, law enforcement, or others when reasonably necessary to comply with law, protect safety and rights, investigate fraud, or respond to valid legal process.
- Business transaction parties: parties involved in a financing, merger, acquisition, reorganization, bankruptcy, or sale, subject to applicable confidentiality and privacy requirements.
- At your direction: a caregiver, another provider, or another party when you ask us or validly consent.
We do not sell personal information for money. We do not sell consumer health data. We do not share personal information for cross-context behavioral advertising, and we do not use consumer health data for targeted advertising.
6. Consumer health data notice
This section supplements the rest of the Policy for information defined as “consumer health data” under laws such as Washington’s My Health My Data Act and Nevada’s consumer health data law, to the extent that information is not governed by HIPAA.
Categories we may collect
Health conditions, symptoms, diagnoses reported by you, medications and treatment interests, allergies, laboratory and biomarker information, height, weight, vital-sign information, reproductive or sexual health information, health goals, photographs and videos submitted for a care request, data identifying your attempt to obtain health services, and inferences drawn from these categories.
Sources and purposes
We collect this data from you, your authorized device or integration, MDI and Providers, pharmacies, laboratories, and other parties at your direction. We use it to provide and coordinate requested services, route information to a care team, fulfill orders, operate support and billing, maintain security, comply with law, and establish or defend legal claims.
Who may receive it
MDI, medical practices and Providers, pharmacies, laboratories, identity-verification and care-support vendors, and operational service providers that need the information to perform services for us or you. We may also disclose it as required by law, in a qualifying business transaction, or with your authorization.
We do not sell consumer health data. We do not use geofences around healthcare facilities to identify or track people seeking care or to collect consumer health data. Where consent is required for a collection or disclosure outside what is necessary to provide a requested service, we will request it separately.
7. Your privacy rights and choices
Depending on your state and subject to legal exceptions, you may have the right to request:
- confirmation of whether we process your personal or consumer health data;
- access to and a portable copy of eligible data;
- correction of inaccurate data;
- deletion of eligible data;
- withdrawal of consent for certain processing;
- an opt-out of sale, targeted advertising, or profiling where applicable; and
- an appeal if we deny a request.
Submit a Caliber privacy request through the privacy section of your member portal or email [email protected] with the subject “Privacy Request.” Describe the right you want to exercise and the state where you reside. We may verify your identity and authority. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and direct identity verification.
To appeal, reply to the decision within 45 days with the subject “Privacy Appeal” and explain why you believe the decision should change. We will not discriminate against you for exercising privacy rights.
For medical-record and PHI rights, use the MDI privacy center or contact [email protected]. Those requests are handled by the medical-record custodian under the applicable NPP.
8. State privacy disclosures
California
During the prior 12 months, we may have collected the categories described in Section 2: identifiers; customer-record information; protected-classification and demographic information you provide; commercial information; internet or electronic-network activity; approximate geolocation; audio, visual, and similar information; professional information if relevant; sensitive personal information such as account credentials, government ID, health, sex-related information, and precise location if specifically requested; and inferences. We collect them from the sources in Section 2, use them for the purposes in Section 3, and disclose them to the recipients in Section 4.
We do not sell personal information or share it for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes that trigger a right to limit under the California Consumer Privacy Act. We do not knowingly sell or share the personal information of anyone under 16.
Other U.S. states
Residents of Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, Virginia, and other states with applicable comprehensive privacy laws may exercise the rights available under their state law using the process in Section 7. Washington and Nevada consumer health data rights are also described in Section 6.
9. Retention and security
We retain information only as long as reasonably necessary for the purposes described in this Policy, including providing services, maintaining treatment and transaction context, meeting medical, tax, accounting, legal, fraud-prevention, and dispute-resolution obligations, and enforcing agreements. Retention varies by record type. A deletion request does not require a Provider to delete a medical record that law or professional obligations require the Provider to keep.
We use administrative, technical, and physical safeguards designed for the sensitivity of the information, including access controls, encryption in transit, vendor review, and monitoring. No system is completely secure. Protect your credentials, use a private device when possible, and contact us promptly if you suspect unauthorized access.
10. Children and U.S. processing
Caliber Services are intended for adults 18 and older. We do not knowingly offer the services to or collect personal information directly from children. If you believe a child provided information, contact us so we can investigate and take appropriate action.
Caliber operates in the United States, and information is processed and stored in the United States. If you access a public page from another country, U.S. law may provide different protections than your local law. Clinical services are offered only where expressly available.
11. Changes to this Policy
We may update this Policy as services or law change. The effective date at the top shows the latest revision. If a change materially affects how we use previously collected information, we will provide notice and request consent where required by law.
12. Contact us
Contact Caliber about this Policy, a privacy request, or a concern about Caliber’s handling of information:
Questions or complaints concerning a Provider’s medical records or NPP should be directed to MDI through its privacy center or at [email protected]. You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights. You will not be retaliated against for filing a complaint.