Privacy policy

01. General Privacy Statement

Reckner Health (d/b/a Reckner Healthcare, hereinafter referred to as “Reckner”, “we”, “us”, and “our”) respects your privacy and is committed to protecting personal information. This Privacy Policy describes how we collect, use, disclose, and otherwise process personal information in connection with our website recknerhealth.com and its subdomains (“our website”) and related interactions.

02. Scope of This Privacy Policy

Some data protection laws in various jurisdictions distinguish between “controllers” (or “businesses”) and “processors” (or “service providers”) of personal information. A controller is the party who decides why and how to process personal information. A processor only processes information on behalf of a controller based on the controller’s instruction.

This Privacy Policy applies to personal information that we collect and process in our capacity as a data controller and explains how we collect, use, and share such information. For example, this Privacy Policy covers when you:

• Visit our website that links to this Privacy Policy
• Register to join our expert network
• Create a specialty profile within our expert network
• Receive invitations to market research studies as part of our expert network
• Complete market research studies as part of our expert network
• In connection with your account registration and administration of your account, including the payment of honoraria as part of our expert network
• Receive a sales or marketing communication from us, including emails, texts, or telephone calls
• Engage in any other contractual arrangement that references this Privacy Policy.

This Privacy Policy does not apply to information that our suppliers process on our behalf. Such processing is governed exclusively by applicable supplier agreements and is outside the scope of this Privacy Policy.

03. Information We Collect

We collect personal information from various sources, including directly from you, automatically from your interactions with our website, and from third parties.

Some jurisdictions, including the European Economic Area (“EEA”), the United Kingdom (“UK”), and Switzerland, require a legal basis, or reason, why Reckner is legally allowed to collect and use your personal information.

Below, we describe (1) information that may be provided by you, (2) information that may be collected automatically, and (3) our purposes and legal bases for collection. If we need to collect other personal information from you, we will explain which information we need and why at the time we collect it.

3.1 Website Visits

We collect the following personal data when you visit our website, whether as a visitor or a registrant of our expert network:

• IP address
• Device type and unique device identification numbers
• Operating system and browser type and version
• Broad geographic location (for example, country- or city-level location based on your local public IP address)
• Performance and technical data
• Referring web page, pages visited, and features used
• Email and content interactions, such as when you open a marketing email, click an embedded link, or interact with our chat functions
• Information collect by cookies, pixels, tags, and similar tracking technologies, as described in Section 9 (Cookies and Tracking Technologies)

3.2 Registration and Participation in Our Expert Network

In addition to the information in Section 3.1 of this Privacy Policy, we collect the following personal data when you register to join our network, create or modify your profile in our network, receive invitations to market research studies, complete market research studies to which we have invited you, and receive honorariums for your participation in market research studies to which you have you been invited and that you have completed:

• Full name, email address, phone number, full postal address (including country and region), and password
• Professional information, including specialty (as drawn from the NHS-recognized specialties in the UK), job title, place of practice, years in practice, and professional registration details as necessary to validate qualification for our expert network
• Demographic information, including perhaps sensitive information such as your gender, race, and ethnicity, to the extent necessary to assign appropriate invitations to appropriate market surveys
• Responses to market surveys

3.3 Information from Third Parties

We may receive personal information about you from third parties, including:

• Third parties you have directed to share information with us
• Respondent fraud and data-quality screening providers, such as Research Defender
• Data enrichment and identity verification providers, who provide additional business contact information, professional credentials, and payment information
• Advertising platforms and analytics providers
• Publicly available sources.

04. Purposes of Processing and Legal Bases

We process personal information for the purposes summarized in the chart below. Where we process personal information of individuals in the European Economic Area, the United Kingdom, or Switzerland, we rely on the legal bases under Article 6 of the GDPR (and Article 9 for special category data) identified for each purpose. Where we process personal information of California residents, the purposes below align with the categories of "business purpose" and "commercial purpose" set forth at California Civil Code section 1798.140.

We may also process personal information for purposes that are compatible with the purposes identified above, where permitted by applicable law. If we propose to process your personal information for a materially incompatible purpose, we will provide you with prior notice and, where required, obtain your consent.

Profiling, automated decision-making, and model training. We do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects concerning consumers. As described in Section 5, we do not use personal information collected through our website to train large language models. These disclosures are made pursuant to the Connecticut Data Privacy Act, as amended effective July 1, 2026, and analogous requirements of other state privacy laws.

05. How We Share or Disclose Your Personal Information

We may share or disclose personal information in the following circumstances:

• Reckner Affiliates. We may disclose any of the categories of personal information described above to our affiliates, including TestSet, LLC, where necessary to provision and operate studies, to fulfill a request you have submitted, or for customer support, marketing, technical operations, and account management purposes.
• Service Providers and Processors. We may disclose the categories of personal information described above to third-party service providers or vendors contracted to provide services on our behalf, for example, IT and hosting, data analytics, customer support, call recording, chatbot technology, data enrichment, email fulfillment, and payment services. These service providers may use personal information we provide to them only as instructed by us.
• AI and Large Language Model Providers. We engage third-party large language model ("LLM") providers – currently including Anthropic (Claude) – to process certain personal information for the purpose of generating AI outputs in connection with our website and internal operations. Personal information is not used to train these providers' models.
• Our Partners. We may share your personal information with certain partners that offer supplementary services to those provided by us to the extent you consent to such sharing (where required by applicable law) or direct us to intentionally interact with such third parties.
• Legal and Protective Disclosures. We may disclose personal information if we have a good-faith belief that disclosure is necessary to (a) conform to legal requirements or comply with legal process; (b) protect and defend our rights or property; (c) enforce our website terms of service; or (d) act to protect the interests of others.
• Business Transitions. If we goes through a corporate transaction — such as a merger, acquisition, financing, or sale of all or a portion of our assets — your personal information may be among the assets transferred, provided that we inform the actual or potential acquirer (or its agents and advisors) that it must use your personal information only for the purposes disclosed in this Privacy Policy.
• Additional Disclosures. We may also ask for your consent to disclose your information to other unaffiliated third parties that are not described elsewhere in this Privacy Policy.

06. Sale and Sharing of Personal Information

Under the CCPA/CPRA and certain other U.S. state privacy laws, the terms "sale" and "share" have specific statutory meanings. "Sale" generally means the exchange of personal information for monetary or other valuable consideration. "Share" generally refers to the disclosure of personal information to a third party for cross-context behavioral advertising, whether or not for consideration. See California Civil Code section 1798.140(ad) and (ah).

We do not sell personal information for monetary consideration. However, our use of advertising and analytics cookies, pixels, tags, and similar tracking technologies on our website constitutes a "sale" or "share" of personal information under the CCPA/CPRA and analogous state privacy laws, by transferring online identifiers, IP address, device information, and browsing activity to third parties for cross-context behavioral advertising and lead-generation purposes.

6.1 Categories of Personal Information Sold or Shared

The categories of personal information involved in such sale or sharing are: identifiers (including online identifiers, IP address, and device identifiers); internet or other electronic network activity information; commercial information; and inferences drawn from the foregoing. We do not sell, rent, or share your mobile number or text messaging consent with third parties or affiliates for their marketing purposes. Information collected through our messaging program is used solely for us to provide the messaging services to which you have consented.

6.2 Categories of Third Parties to Whom We Sell or Share

The categories of third parties to whom we sell or share are those listed in Section 5.

6.3 Sensitive Personal Information

We do not sell or share sensitive personal information except as expressly stated in Section 3.2.

6.4 Children

We do not knowingly sell or share the personal information of persona under sixteen (16) years of age. Where we obtain actual knowledge that a person is between thirteen (13) and sixteen (16) years of age, we will not sell or share that person’s personal information without their affirmative opt-in consent. For persons under thirteen (13) years of age, we will not sell or share without the affirmative opt-in consent of a parent or guardian. In addition, we do not knowingly sell the personal information of, share the personal information of, or process for targeted advertising the personal information of, any person under eighteen (18) years of age, consistent with the heightened protections for minors under the Connecticut Data Privacy Act (as amended by Public Act 25-113, effective July 1, 2026), the Maryland Online Data Privacy Act, and analogous state laws.

6.5 How to Opt-Out

You have the right to opt out of the sale or sharing of your personal information. To exercise this right, you may:

• click the "Do Not Sell or Share My Personal Information" link in the footer of our website, which opens our "Do Not Sell or Share My Personal Information" page. That page effectuates the opt-out directly through our consent management platform’s preference controls; you are not required to create an account, and we request no more information than is necessary to effectuate your request.
• enable a recognized opt-out preference signal, such as the Global Privacy Control (GPC), in your browser
• submit a request via the methods described in Section 12 (Our Contact Details), including by emailing privacy@reckner.com or, for California residents, calling +1 (212) 257-0505.

Consistent with California Civil Code section 1798.135(b)(1) and 11 California Code of Regulations section 7025, we process Global Privacy Control signals and other recognized opt-out preference signals as a valid request to opt out of sale and sharing.

07. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, subject to legal and contractual requirements. Our general retention practices are as follows:

• Account Data: account profile and identifier information, integration data, and other content stored as part of a registrant account (where we act as the controller or business in regard to such content) are retained for the duration of the registrant’s active relationship with us.
• Operational Logs, System Logs, and Backups: retained not more than thirty-six (36) months from the date of creation, unless a longer retention period is required for security investigation, legal hold, or regulatory compliance.
• Website Analytics, Prospect Data, and Lead Records: retained for as long as is reasonably necessary for sales and marketing follow-up, and in any event not more than thirty-six (36) months from the last point of engagement, after which time records are anonymized or deleted.
• Cookie Data: retained for up to thirteen (13) months; session cookies expire on session close, and persistent cookies expire as described in our cookie preferences tool.

When personal information is no longer required, we will delete, anonymize, or otherwise securely dispose of it, except as required or permitted by applicable law. To request deletion of personal information, please contact privacy@reckner.com.

08. Security

We implement reasonable technical and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, and destruction.

These measures may include:

• Encryption of data at rest and in transit where appropriate.
• Access controls and authentication mechanisms.
• Monitoring and logging of system activity.
• Security testing and vulnerability management processes.

We maintain policies and procedures designed to ensure appropriate access controls and data protection practices. However, the security of information transmitted through the internet can never be guaranteed. You are responsible for maintaining the security of your password or other forms of authentication involved in accessing password-protected or secured resources.

09. Cookies and Tracking Technologies

We and our service providers and advertising partners use cookies, pixels, tags, web beacons, local storage, and similar tracking technologies on our website to operate and improve our services, to support analytics and functionality, and to enable targeted advertising.

As described in Section 6 (Sale and Sharing of Personal Information), certain of these technologies result in a "sale" or "share" of personal information under the CCPA/CPRA and analogous state privacy laws.

9.1 Consent Management Platform. Our website uses a consent management platform with region-based configurations: visitors located in the European Economic Area, the United Kingdom, or Switzerland are shown a cookie consent banner, and non-strictly-necessary cookies and tracking technologies are not deployed for those visitors unless and until they affirmatively consent; visitors located elsewhere, including in the United States, may opt out at any time as described in Section 6.5. Consent choices are logged and may be changed or withdrawn at any time through the preference center available in the website footer.

9.2 Do Not Track and Global Privacy Control. Our website treats an enabled Global Privacy Control (GPC) browser signal as a valid request to opt out of the sale and sharing of personal information, effectuated automatically through our consent management platform, as described in Section 6 (Sale and Sharing of Personal Information). Our website does not currently respond to "Do Not Track" (DNT) signals. This disclosure is made pursuant to California Business and Professions Code section 22575(b)(5).

10. International Data Transfers

10.1 Recipient Jurisdictions

Personal information that we collect, including personal information of data subjects located in the European Economic Area ("EEA"), the United Kingdom, and Switzerland, is processed and stored in the United States. The processing and storage of personal information in the United States may involve transfers to vendors and service providers identified in this Privacy Policy.

Our use of identity-resolution services involves transfers to U.S. recipients.

10.2 Adequacy Status of Recipient Jurisdictions

The United States is not the subject of a current European Commission adequacy decision under Article 45 of the GDPR covering all categories of U.S. data importers, although the EU–U.S. Data Privacy Framework provides a partial adequacy mechanism for U.S. organizations that have self-certified and remain in good standing, as confirmed by European Commission Implementing Decision (EU) 2023/1795 of July 10, 2023. The United Kingdom extension to the EU–U.S. Data Privacy Framework provides analogous adequacy under the UK GDPR for participating U.S. recipients, as confirmed by the UK Secretary of State's Data Protection (Adequacy) (United States of America) Regulations 2023 (SI 2023/1028), effective October 12, 2023. Switzerland has issued an analogous adequacy decision recognizing the Swiss–U.S. Data Privacy Framework for participating U.S. recipients, effective September 15, 2024.

10.3 Safeguards

Where required by applicable law, we implement appropriate safeguards under Article 46 of the GDPR (and analogous provisions of the UK GDPR and Swiss Federal Act on Data Protection) to protect the personal information of EEA, UK, and Swiss data subjects when it is transferred to recipients in jurisdictions not covered by an adequacy decision. These safeguards include:

• The European Commission's Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 of June 4, 2021, executed in the appropriate module (controller-to-controller, controller-to-processor, processor-to-processor, or processor-to-controller) with each non-adequate data importer
• The United Kingdom International Data Transfer Agreement and the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, issued by the Information Commissioner's Office under section 119A of the Data Protection Act 2018 and effective March 21, 2022, for transfers from the United Kingdom
• Where applicable and where the U.S. recipient has self-certified and remains in good standing, reliance on the EU–U.S. Data Privacy Framework, its UK extension, and its Swiss extension, as listed at www.dataprivacyframework.gov
• Supplementary technical and organizational measures consistent with the European Data Protection Board's Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (adopted in final form June 18, 2021), including encryption in transit and at rest, role-based access controls, access logging, and contractual restrictions on government-access disclosures

10.4 Particular Notes Regarding Identity-Resolution Vendors

Our use of identity-resolution services for EEA, UK, and Swiss visitors is conditional on consent and on the transfer safeguards described in Section 10.3 above. EEA, UK, and Swiss visitors who wish to limit cookie-related transfers may use the controls described in our consent management platform.

10.5 Obtaining a Copy of the Applicable Safeguards

You may request a copy of the safeguards applicable to a transfer of your personal information – redacted as necessary to protect commercial confidentiality – by contacting us at privacy@reckner.com.

11. Your Privacy Rights

Depending on where you are located and how you interact with us, you may have certain legal rights with respect to the personal information we hold about you. Many of these rights are subject to verification of your identity, statutory exceptions, and our ability to comply consistently with our legal obligations.

11.1 Rights Generally Available across Applicable Jurisdictions

• Right to know and to access the categories and specific pieces of personal information we have collected about you.
• Right to correct inaccurate personal information.
• Right to delete personal information we have collected, subject to statutory exceptions.
• Right to obtain a copy of your personal information in a portable and (where technically feasible) machine-readable format.
• Right to opt out of the sale or sharing of your personal information (see Section 6.5).
• Right to opt out of targeted advertising.
• Right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, where applicable. We do not currently engage in such profiling except in connection with failed identity checks and fraud rejections, which are reviewed by our panel team before they take effect.
• Right to limit the use and disclosure of sensitive personal information, where applicable.
• Right to non-discrimination for exercising your privacy rights. We will not discriminate against you for exercising any of these rights.
• Right to appeal a denial of a privacy rights request.
• Object to the processing of your personal information carried out based on our legitimate interests in the EEA, UK, and Switzerland, and ask us to restrict the processing of your personal information.
• Withdraw your consent at any time, if we have collected and processed your personal information with your consent. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.
• Opt-out of marketing communications sent by us.

11.2 United States State-Specific Rights and Provisions

In addition to the rights above, residents of certain U.S. states have rights specific to their state of residence, including:

• California (CCPA/CPRA). California residents have the rights set forth in the California Consumer Privacy Act, as amended by the California Privacy Rights Act (California Civil Code section 1798.100 et seq.). These include the right to limit the use and disclosure of sensitive personal information, the right to opt out of sale and sharing, and the right to receive metrics regarding consumer requests where applicable. We honor recognized opt-out preference signals such as the Global Privacy Control.
• Virginia (VCDPA). Virginia residents have the rights set forth in the Virginia Consumer Data Protection Act (Va. Code section 59.1-575 et seq.), including the right to appeal a denied request within sixty (60) days.
• Colorado (CPA). Colorado residents have the rights set forth in the Colorado Privacy Act (Colo. Rev. Stat. section 6-1-1301 et seq.). Colorado residents may also opt out of targeted advertising and profiling through a universal opt-out mechanism approved by the Colorado Attorney General.
• Connecticut (CTDPA). Connecticut residents have the rights set forth in the Connecticut Data Privacy Act (Conn. Gen. Stat. section 42-515 et seq.). Effective July 1, 2026, amendments to the Connecticut Data Privacy Act (Public Act 25-113) additionally provide Connecticut residents the right to obtain a list of the specific third parties to which the controller has sold personal data and the right to contest certain profiling decisions, and extend that law to controllers that sell personal data regardless of processing volume.
• Utah (UCPA). Utah residents have the rights set forth in the Utah Consumer Privacy Act (Utah Code section 13-61-101 et seq.).
• Other U.S. states. Residents of Texas, Tennessee, Iowa, Indiana, Montana, Oregon, New Hampshire, New Jersey, Delaware, Minnesota, Maryland, Nebraska, Kentucky, and Rhode Island have analogous rights under their respective state privacy laws, including, where applicable: the Texas Data Privacy and Security Act (Tex. Bus. & Com. Code Chapter 541); the Tennessee Information Protection Act (Tenn. Code section 47-18-3201 et seq.); the Iowa Consumer Data Protection Act (Iowa Code Chapter 715D); the Indiana Consumer Data Protection Act (Ind. Code section 24-15-1 et seq.); the Montana Consumer Data Privacy Act (Mont. Code section 30-14-2801 et seq.); the Oregon Consumer Privacy Act (Or. Rev. Stat. section 646A.570 et seq.); the New Hampshire Privacy Act (RSA Chapter 507-H); the New Jersey Data Privacy Act (N.J.S.A. 56:8-166.4 et seq.); the Delaware Personal Data Privacy Act (Del. Code Tit. 6, Chapter 12D); the Minnesota Consumer Data Privacy Act (Minn. Stat. section 325O.01 et seq.); the Maryland Online Data Privacy Act (Md. Code Ann., Com. Law section 14-4601 et seq.); the Nebraska Data Privacy Act (Neb. Rev. Stat. section 87-1101 et seq.); the Kentucky Consumer Data Protection Act (KRS Chapter 367); and the Rhode Island Data Transparency and Privacy Protection Act (R.I. Gen. Laws section 6-48.1-1 et seq.). Oregon and Minnesota residents may additionally request a list of the specific third parties to which their personal data has been disclosed.
• Washington (My Health My Data Act). Washington residents have rights under the My Health My Data Act (RCW Chapter 19.373) with respect to consumer health data.
• Nevada (NRS Chapter 603A). Nevada residents have rights regarding consumer health data under Nevada Revised Statutes Chapter 603A (sections 603A.500–603A.525).

You may exercise your rights by contacting us as described below. We will respond in accordance with applicable law.

We will not discriminate against you for exercising your rights.

11.3 EEA, UK, and Swiss Specific Provisions

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the following supplemental provisions apply.

11.3.1 Controller.

Reckner Health, having its principal place of business at 1600 Manor Dr., Chalfont, PA 18914, is the controller of personal information collected through our website and other direct-marketing channels.

11.3.2 Legal Bases.

We process personal information on the legal bases set forth in Section 4.

11.3.3 International Transfers.

As described in Section 10, personal information collected in the EEA, UK, or Switzerland is transferred to the United States and may be accessed from other jurisdictions. We rely on standard contractual clauses and other appropriate safeguards as required.

11.3.4 GDPR Rights.

In addition to the rights listed in Section 11.1, you have the right under Articles 15–22 of the GDPR (and the corresponding provisions of UK and Swiss law) to access, rectify, erase, restrict the processing of, and port your personal information, and to object to processing carried out on the basis of our legitimate interests.

11.3.5 Right to Lodge a Complaint.

You have the right under Article 77 of the GDPR to lodge a complaint with the data protection supervisory authority of your habitual residence, place of work, or place of the alleged infringement. We would, however, appreciate the opportunity to address your concerns first, and you may contact us at privacy@reckner.com.

12. Our Contact Details

This website is owned and operated by:

Reckner Health 400 Clematis Street #207 West Palm Beach, FL 33401 United States of America privacy@reckner.com

13. Changes to This Privacy Policy

We may update this policy from time to time by publishing a new version on our website. You should check this page occasionally to ensure you are happy with any changes to this policy. We may notify you of significant changes to this policy by email.