Privacy Policy

Effective date: September 15, 2026  ·  Last updated: October 19, 2026

PulmHealth Foundation, a Colorado nonprofit corporation (Foundation, we, us, or our), respects your privacy. This Privacy Policy explains the personal information we collect, why we use it, when we disclose it, how long we keep it, and the choices available to you.

1. Scope

This policy applies to the Foundation's website at pulmhealthfoundation.org, the public CLEAR platform at clear.pulmhealthfoundation.org, and related forms and communications controlled by the Foundation (collectively, the Services).

CLEAR technology is developed and owned by PulmHealth LLC and licensed to the Foundation for public, noncommercial use. The Foundation controls the personal information described in this policy for its operation of the public Services. This policy does not apply to PulmHealth LLC's separate commercial products or to third-party sites and services that have their own privacy notices.

The Foundation also maintains a Safeguarding and Protection of Vulnerable Persons Policy addressing protection of children, adults at increased risk, research participants, and individuals involved in Foundation programs. That policy supplements this Privacy Policy and does not expand the purposes for which the Foundation may collect or use personal information. Safeguarding reporting channels and their operational status are described on that page.

2. Environmental and public-source data

CLEAR displays and analyzes environmental, scientific, governmental, and other source data, including records about monitoring locations, facilities, and geographic areas. These datasets are generally not collected directly from users, but some public records may contain names, business contact information, addresses, or other information associated with individuals. CLEAR preserves source attribution and does not independently verify every public record. Requests concerning an originating record may need to be directed to the agency or provider that issued it.

The Data Sources and Methodology Notice explains important sources and limitations.

3. Personal information we collect

3.1 Information you provide

• Contact and collaboration information: name, email address, organization, title, telephone number if provided, inquiry type, and message contents.
• Donation information: name, contact information, donation amount, campaign, acknowledgement preferences, and transaction records. Zeffy and its payment providers process payment and billing information. The Foundation does not receive or store your full payment-card number.
• Account information: if CLEAR account registration is offered, name, email address, account identifier, authentication-related information, preferences, and account status. Passwords are not intended to be stored in readable form; they are handled in protected form by the applicable authentication system or provider.
• Communications and submissions: information included in emails, correction requests, survey responses, applications, event registrations, or other material you choose to send.
• Safeguarding and research-participant information: If the Foundation conducts direct participant research or receives a safeguarding concern, it may receive information necessary to assess the concern, protect affected individuals, meet legal reporting duties, or administer an authorized research activity. Such information may be sensitive. The Foundation will use designated restricted channels for these purposes and will not ask individuals to submit sensitive safeguarding details through general CLEAR search or AI features. Where new research collection requires a separate participant notice or consent, that notice will be provided before collection. The current status of safeguarding reporting channels is described in our Safeguarding Policy.

Please do not submit medical records, protected health information, government identification numbers, account credentials, or other sensitive personal information through a general form, search field, or message.

3.2 Information collected automatically

• Device and log information: IP address, browser and device type, operating system, referring page, requested URL, timestamps, error records, and security events.
• Usage information: pages and features used, interactions, approximate session duration, and general activity needed to operate, secure, diagnose, and improve the Services.
• Cookie and local-storage information: identifiers and settings described in Section 6.

3.3 Searches and location information

When you enter or select an address, place, hospital, school, facility, or point on the map, we process that query and associated coordinates to return relevant results. A location query can reveal or permit an inference about a home, workplace, health concern, or other interest. Do not enter a person's name or sensitive details into a location or analysis field.

We may transmit the location query or coordinates to a map, geocoding, hosting, or data-service provider to provide the requested feature. We do not collect precise device geolocation unless the feature is offered, your browser or device asks permission, and you grant it. You can deny or withdraw device-location permission through browser or device settings.

3.4 Information from other sources

We may receive information from service providers, public agencies and datasets, collaboration partners, event or donation platforms, and security services. We handle personal information received from them as described in this policy and any source-specific notice.

4. Why we use personal information

We use personal information to:

• provide, maintain, personalize, troubleshoot, secure, and improve the Services;
• return location-based environmental information and requested analyses;
• create, authenticate, administer, and support accounts;
• respond to inquiries, collaboration proposals, correction requests, and other communications;
• process and acknowledge donations and maintain tax, accounting, and organizational records;
• measure aggregate use and understand which public resources are useful;
• detect abuse, enforce our Terms of Use, and protect users, the public, and our systems;
• comply with law and establish, exercise, or defend legal claims; and
• carry out other purposes disclosed when information is collected, with consent where required.

Where applicable to Foundation activities, we may also process information to assess and respond to safeguarding concerns, protect individuals, coordinate lawful reports or investigations, administer appropriately authorized research participation, and maintain related confidential organizational records. We will apply additional restrictions to safeguarding and identifiable participant records, as described in our Safeguarding Policy.

We do not use personal information to make decisions about eligibility for healthcare, employment, housing, credit, insurance, education, or another legal or similarly significant opportunity.

5. AI processing

CLEAR may use AI systems to generate environmental and public-health explanations from source-linked evidence. A search location, selected point, prompt, related context, and technical metadata may be processed by infrastructure or AI service providers solely to provide, secure, evaluate, and improve the public feature as permitted by our agreements with them.

Do not submit personal medical information or other sensitive personal information to an AI-assisted feature. We do not intentionally use users' personal information to train general-purpose AI models. If our practice changes materially, we will update this policy and provide any notice or choice required by law.

Confidential safeguarding reports and identifiable research-participant records are not intended for processing through public CLEAR AI features. Please do not include information about a child's identity, private medical history, abuse allegations, or other sensitive personal details in public AI prompts. The Foundation will keep public environmental intelligence separate from restricted safeguarding records.

6. Cookies and similar technologies

The Services may use:

• Essential technologies to maintain sessions, authenticate accounts, remember security or privacy settings, prevent cross-site request forgery, balance traffic, and detect abuse.
• Limited measurement technologies to understand aggregate use and diagnose performance. These may process truncated or full IP addresses and device or usage information, depending on the provider and configuration.

The Foundation does not itself use third-party advertising cookies or use personal information for cross-context behavioral or targeted advertising. We do not sell personal information for money or other valuable consideration.

Browser settings can block or delete cookies, but blocking essential technologies may prevent parts of the Services from working. Where a consent control is presented, you can change nonessential choices through that control.

Donation provider technologies. Online donations are processed by Zeffy, an independent donation platform. Zeffy's donation form is not loaded on Foundation web pages until you choose to open it, and you can instead donate on Zeffy's website or contact us to give another way. When you open the form or visit Zeffy's website, your browser connects directly to Zeffy, and Zeffy and its providers may set cookies and collect device, usage, and form information. In our October 2026 review, Zeffy's form loaded payment and security services (such as Stripe and CAPTCHA services) and Zeffy's own analytics and advertising technologies, including Google Tag Manager, Google Ads, Meta (Facebook) Pixel, LinkedIn Insight, HubSpot, and Amplitude; Zeffy's website uses additional analytics and advertising technologies. Zeffy's privacy policy states that it uses advertising services such as Google Ads and Facebook Custom Audience, which may involve matching information submitted to Zeffy, such as an email address, and that it treats use of its services as consent to that advertising, with instructions for opting out. These technologies report to Zeffy's own accounts. The Foundation does not operate or control them or direct their advertising, and it does not treat your opening the donation form as agreement to them. You can limit them through your browser's cookie and tracking settings and the opt-out choices described in Zeffy's privacy policy.

7. When we disclose personal information

We may disclose personal information to the following categories of recipients for the stated purposes:

• Infrastructure and security providers: website, application, database, network, backup, monitoring, content-delivery, fraud-prevention, and security vendors.
• Feature providers: map, geocoding, data, authentication, email, and AI service providers used to return or support a requested feature.
• Donation and transaction providers: Zeffy and its payment, receipt, fraud-prevention, and transaction-service providers.
• Professional advisers and nonprofit support providers: auditors, accountants, attorneys, insurers, and consultants under appropriate duties of confidentiality.
• PulmHealth LLC: only information reasonably necessary for separately agreed technical support, security, or maintenance, and de-identified or aggregated operational information that cannot reasonably identify a person, consistent with the license relationship.
• Authorities and affected parties: when we reasonably believe disclosure is required by law or legal process, or is necessary to investigate fraud or security incidents, protect rights or safety, or establish or defend legal claims.
• A lawful successor: in connection with a merger, restructuring, dissolution, or transfer of a program or assets, subject to applicable nonprofit and privacy obligations.
• A recipient you direct: when you request or consent to the disclosure.

Safeguarding information may also be disclosed to appropriate protective authorities, emergency responders, authorized investigators, professional advisers, or other recipients when legally required or reasonably necessary to protect individuals or meet legal obligations. Access will be limited according to role and legitimate need. Routine technical support does not automatically authorize access to confidential safeguarding records.

Service providers may process information for us under contractual and legal restrictions, but their independent services and websites are governed by their own notices.

If you open Zeffy's donation form or visit Zeffy's website, Zeffy and the analytics and advertising providers it uses collect information directly from your browser for Zeffy's own purposes under Zeffy's privacy policy, as described in Section 6. Zeffy collects this information directly; the Foundation does not send information to Zeffy's analytics or advertising providers.

8. Sale, targeted advertising, and profiling

We do not sell personal information, process it for targeted advertising, or profile users to make decisions that produce legal or similarly significant effects. Because we do not engage in those activities, there is currently no opt-out required for them. If this changes, we will update this policy and provide legally required opt-out methods, including recognition of a qualifying universal opt-out mechanism where applicable.

This section describes processing by or for the Foundation. Advertising technologies that Zeffy operates when you choose to open its donation form or visit its website, described in Section 6, are controlled by Zeffy under its own privacy policy and are not used by the Foundation for targeted advertising. Choices for that processing are described in Zeffy's privacy policy.

9. Retention

We retain personal information only for as long as reasonably necessary for the disclosed purpose, taking account of legal, accounting, security, dispute, and recordkeeping needs. Our general retention approach is:

• account information, while the account is active and for a limited period afterward for security, recovery, and legal needs;
• contact messages and routine correspondence, for the time needed to respond and maintain appropriate organizational records;
• donation, tax, accounting, corporate, grant, and governance records, for the period required by law and the Foundation's record-retention policy;
• security and server logs, for a limited operational and security period unless an event requires longer preservation;
• location searches and usage events, only for the period needed to provide the feature, secure the Services, troubleshoot, and create de-identified or aggregated statistics; and
• safeguarding incident records and identifiable research-participant records, for the period reasonably necessary for their lawful purpose, taking account of applicable reporting, research, safety, recordkeeping, investigation, and legal-hold requirements under restricted retention procedures to be adopted by the Foundation.

At the end of the applicable period, we delete, de-identify, or securely dispose of information unless preservation is required by law or a litigation hold. Backup copies may remain until overwritten through the ordinary backup cycle.

10. Security

We use reasonable administrative, technical, and physical safeguards appropriate to the nature of the information and the systems we control. No transmission, storage, or security method is completely secure, and we cannot guarantee absolute security. If you believe your account or information has been compromised, contact us promptly.

Confidential safeguarding records are intended to be maintained separately from public environmental datasets, general website analytics, public AI prompts, and ordinary contact submissions, with role-based access and additional safeguards proportionate to their sensitivity. The Foundation will establish and document the required operational controls before accepting reports through a dedicated confidential intake channel.

11. Your privacy choices and rights

You may opt out of nonessential email by using an unsubscribe link or contacting us. You may change browser cookie and device-location permissions in your browser or device settings.

Depending on where you live and whether an applicable law covers our processing, you may have rights to confirm whether we process your personal information; access, correct, delete, or obtain a portable copy of it; opt out of certain processing; withdraw consent; and appeal our response. Legal exceptions may apply.

To submit a request, email info@pulmhealthfoundation.org or use our contact form. Describe your request and provide enough information for us to identify the relevant records. We may take proportionate steps to verify your identity and authority. An authorized agent may submit a request where permitted by law, subject to verification.

We will respond within the period required by applicable law. For a verified request governed by the Colorado Privacy Act, that period is generally 45 days and may be extended once by an additional 45 days when reasonably necessary, with notice. If we deny a Colorado request, you may appeal by replying to the decision or emailing the address above with Privacy Appeal in the subject line. We will respond to a covered appeal within the period required by law and explain any further complaint option. We will not unlawfully discriminate against you for exercising a privacy right.

12. Colorado residents

The Colorado Privacy Act applies only when its statutory coverage thresholds and other requirements are met. When it applies, Colorado residents may exercise the rights described in Section 11. The Foundation will also endeavor to honor reasonable access, correction, and deletion requests when the Act does not require it, subject to verification, operational feasibility, and legal exceptions.

Global Privacy Control and other recognized universal opt-out mechanisms relate to sale, targeted advertising, or covered profiling. As explained in Section 8, we do not currently engage in those activities.

13. Children's and minors' privacy

The Services are intended for a general, professional, and research audience and are not directed to children under 13. We do not knowingly collect personal information online from a child under 13 without legally required parental consent. If you believe a child under 13 has provided personal information, contact us so we can investigate and take appropriate action.

Users who are 13 through 17 should use the Services with the involvement of a parent or legal guardian and should not submit personal or sensitive information. We do not knowingly use a minor's personal information for targeted advertising, sale, or profiling in furtherance of decisions producing legal or similarly significant effects.

Where the Foundation directly engages minors in a research or educational activity, it will assess whether parental permission, child assent, appropriate supervision, separate participant notices, and research ethics review are required. Public display of school locations or aggregate environmental conditions does not by itself mean the Foundation has collected a student's personal information. For concerns about children's information, use the contact details in Section 17.

14. United States operation and external links

The Services are operated from the United States, and information may be processed and stored in the United States and other locations where our providers operate. If you access the Services from another country, its privacy rules may differ. The Services may link to third-party sites or services. Their privacy practices are governed by their own notices, not this policy.

15. Privacy and regulatory compliance

The Foundation assesses its obligations under applicable federal and state privacy, children's online privacy, security, breach notification, research, and electronic communications laws. Depending on the activity and applicable statutory coverage, these may include the Colorado Privacy Act (CPA), California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), Children's Online Privacy Protection Act (COPPA), applicable state data-breach notification laws, and the CAN-SPAM Act for covered commercial electronic messages.

These references do not mean that every law applies to every Foundation activity. Some laws have thresholds, exemptions, or definitions that require a specific applicability analysis. In particular, CCPA/CPRA does not automatically apply to an independent nonprofit solely because it serves California residents, and the CPA has coverage thresholds. COPPA applicability depends on online service audience and knowledge/collection circumstances. CAN-SPAM coverage depends on the message's primary purpose and other statutory criteria, not solely on the sender's nonprofit status.

The Foundation will provide legally required privacy rights, notices, consents, opt-outs, and breach notifications when applicable. It may also voluntarily offer additional privacy protections. Where the Foundation sends covered commercial electronic messages, it will use accurate header and subject information, identify messages as required, include a valid postal address when required, and provide a working opt-out mechanism within applicable deadlines. The Foundation's general nonessential-email unsubscribe option remains described in Section 11.

16. Changes to this policy

We may update this policy to reflect changes in law, technology, or our practices. We will post the updated policy and revise the date above. If a change is material, we will provide additional notice where appropriate and obtain consent if required by law. A prior version governs processing that occurred before the revised policy's effective date unless law permits otherwise.

17. Contact us

For privacy questions, requests, or appeals:

• Email: info@pulmhealthfoundation.org
• Contact form: pulmhealthfoundation.org/contact

PulmHealth Foundation, a Colorado nonprofit corporation.