DormHealth Privacy Policy

DormHealth.org LLC ("DormHealth," "we," "our," or "us") respects your privacy. This Privacy Policy explains how we collect, use, share, keep, and protect personal information when you use our websites, enrollment and checkout pages, portal, Exchange Locations and kiosks, support channels, and related services (the "Services").

This Privacy Policy is a notice. It is not part of our Terms of Service. Words with capital letters that are not defined here, such as Participant, Account Holder, Organization, Program, Program Items, and Exchange Location, have the meanings given in the Terms of Service. Other terms used here, such as clearing, temporary replacements, and outstanding items, also have the meanings in the Terms of Service.

1. Who this policy covers

This policy covers information that identifies, relates to, describes, or can reasonably be linked to a person ("personal information") that DormHealth collects through the Services. It applies to Participants, Account Holders (for example, parents who enroll a student), website visitors, and people who contact us. It does not cover information about DormHealth's own job applicants, employees, or contractors, which is described in separate notices.

It does not cover information handled by an Organization, such as a university or property manager, under its own policies, or by third-party websites and services we link to. Please review their privacy policies directly.

When we handle information on behalf of an Organization or program operator, we follow our agreement with it and its lawful instructions, and its privacy notice describes its own practices. We may also use information for our own purposes described in this policy where the law and those agreements allow.

2. Information we collect

Depending on how you use the Services, we may collect:

• Identifiers and contact information: name, email address, phone number (if you provide one), an identifier issued by us, a property, or an Organization (such as a student ID or resident credential), account identifiers, and communication preferences.
• Enrollment and program information: Program, Service Area, Site, Service Term, enrollment type, add-ons (such as Loss Protection or the Daily Towel Upgrade), eligibility status, whether a Participant is under 18 (if you tell us), and your role as Participant or Account Holder.
• Item and exchange records: pickups, returns, exchanges, temporary replacements, clearing, outstanding items, limits used, item-level identifiers (such as labels, tags, or barcodes), timestamps, the Exchange Location or kiosk used, and staff or kiosk confirmation of each transaction.
• Item photos and video: where used, images of Program Items (such as sheets, towels, blankets, or other textiles) taken at pickup, return, or processing to document an item and its condition. These are intended to show items only. We do not intend to photograph people, but a hand, face, or background may occasionally be captured by accident (see Section 4).
• Kiosk and equipment data: where kiosks or other equipment are used, information from their sensors, scanners, or cameras used to dispense, accept, identify, and record items, and to detect equipment faults or misuse. Not every kiosk has a camera; if one does, it captures video or images only and does not record audio.
• Billing and transaction information: payments, refunds, credits, fee records (such as Unreturned Item Fees and Damage Fees), fee notices, amounts owed, and collection history. Payments made directly to DormHealth are processed by our payment processor. We do not collect or store full card numbers or bank account numbers. We may receive limited payment details from our payment processor, such as card brand, the last four digits, expiration date, and billing ZIP code. Where an Organization bills for a Program or a particular charge, the Organization handles that billing.
• Terms and consent records: when you accepted our Terms of Service and which version, notices we sent and whether they were delivered, text message consent and opt-outs, agreements to change who pays for an enrollment, and cookie choices.
• Support and dispute information: messages, emails, dispute submissions, and any evidence you provide.
• Contact form information: name, email, organization, role, and message.
• Device and usage information: IP address, browser type, operating system, device identifiers, pages visited, timestamps, referral URLs, and similar log data.
• Security information: sign-in events, multi-factor authentication data, and signals used to detect fraud, abuse, or unauthorized access.
• Information from Organizations: eligibility, housing assignment, or roster information an Organization shares so we can run a Program.
• Business account information: for Organization, operator, and partner staff who use our tools, their name, work contact details, role, permissions, and actions taken in our tools.

We may also collect other information that you choose to provide or that we describe when we collect it. If we begin collecting a new category of personal information, we will update this policy as described in Section 15.

We apply data minimization. Please do not send us government ID numbers, full card numbers, medical records, or other sensitive information unless we specifically ask for it for a defined and lawful purpose. If you report a physical reaction to an item, such as skin irritation or an allergic reaction, you never need to share a medical diagnosis.

3. Where we get information

• From you, when you or your Account Holder enroll, pay, use the portal, exchange items, contact support, or submit a dispute.
• Automatically, from your use of the Services, including logs, cookies, and, where used, kiosks, item scans, and item photos.
• From service providers, such as our payment processor, email and text providers, and hosting and security providers.
• From Organizations and operators, such as housing or property teams and program operators, where needed to run a Program.
• Other sources that we describe when we collect the information.

4. How we use information

We use personal information to:

• Run the Services, including enrollment, exchanges, returns, limits, temporary replacements, clearing, and support;
• Keep accurate records of pickups and returns, including transaction logs and any item photos, and use those records to determine what was issued and returned under our Terms of Service;
• Assess, notify you of, charge, and collect fees, including applying Loss Protection first, and resolve disputes and chargebacks;
• Enforce our Terms of Service, including suspending service or declining future enrollment where valid fees remain unpaid;
• Send service notices, fee notices, return-deadline and lost-item notices, reminders, and updates, and confirm whether they were delivered (our email provider may also record whether an email was opened or a link was clicked, which we configure to be anonymized where the provider allows);
• Maintain security, prevent fraud and misuse, and protect people, equipment, and inventory;
• Operate, troubleshoot, analyze, and improve the Services;
• Comply with law, legal process, and our agreements with Organizations;
• Prepare for or complete a financing, merger, acquisition, or sale of assets, as permitted by law. A transaction does not by itself allow materially different uses of your information or override your privacy choices.
• Other purposes we describe when we collect the information, or that are reasonably compatible with the purposes above.

Item photos. If we take item photos or video, we use them to document items and their condition, support records, and resolve disputes. If a person or personal detail is captured by accident, we do not use it to identify anyone except to investigate misuse, damage to equipment, or security incidents, or as the law requires, and we limit, blur, or delete it where practical.

Automated tools. Subject to applicable law and any applicable Organization agreement, we may use machine-learning or similar models to help identify items, match them to records, or assess condition. If we do, a person reviews any finding by such a model of damage or non-return before a fee is assessed. Ordinary scans, kiosk records, and transaction logs are records, not model findings. We do not currently use automated decision-making that produces legal or similarly significant effects on you (such as decisions about housing, education, employment, credit, or access to essential services), and we will update this policy before we do.

De-identified and aggregated data. Subject to applicable law and any applicable Organization agreement, we may create de-identified or aggregated data from item photos, transaction records, and other information and use it to analyze and improve the Services and to develop our own tools and models. When we develop our own tools and models, we may use information that relates to a person only in de-identified or aggregated form. "De-identified" means information that cannot reasonably be linked to a particular person, and "aggregated" means information combined across many people so it no longer relates to any one person. We treat information as de-identified only if it meets the standard in the California Consumer Privacy Act and other applicable law; replacing a name with an ID number is not enough. We take reasonable measures to keep it from being linked to a person, commit to keep and use it only in de-identified form, do not try to re-identify it (except to test our own de-identification methods), and require anyone we share it with to follow the same rules. We do not train models to recognize people. Information that an Organization shares with us is used only as its agreement with us allows.

5. How we share information

We do not sell personal information and do not share it for cross-context behavioral advertising (targeted ads based on your activity across other companies' websites and apps).

We may share personal information with:

• The Participant and the Account Holder. Service and fee notices, including which items are outstanding and any fees, may be sent to both the Participant and the Account Holder for the enrollment.
• Organizations and program operators, such as housing or property teams, when needed to deliver the Program, confirm eligibility, coordinate billing, or resolve issues.
• Item owners, when another party owns the items, as needed to account for those items and related fees.
• Service providers that work on our behalf under contracts limiting their use of the information, including:
  • a payment processor, for payment processing and billing where DormHealth bills directly;
  • an email provider, for sending messages and measuring delivery and engagement (see Section 6);
  • a text message provider, if you opt in to texts;
  • database, authentication, and hosting providers (primarily US-based infrastructure);
  • an error-monitoring provider, only with your cookie consent and with personal information filtered from reports; and
  • any automated-analysis provider we may use, under terms that do not allow it to train its own models on our data.
• Laundry and textile-care partners, who receive inventory counts and may handle item-level identifiers or photos of items during processing, but do not receive Participant personal information in standard operations.
• Collection partners, if valid fees remain unpaid, limited to what is needed to collect them lawfully.
• Professional advisors and transaction parties, such as lawyers, auditors, investors, or a buyer, in connection with a financing, merger, acquisition, or sale.
• Courts, law enforcement, and regulators, when required or permitted by law, or to protect the safety, rights, or property of any person, DormHealth, or others.
• Others at your direction or with your consent.

We limit what each recipient receives to what its role and purpose reasonably require, including what Organization and operator staff can see in our tools. Payment providers may also use information for their own purposes, such as fraud prevention and payment security, under their own privacy notices.

Text messages. If you opt in to text messages, message and data rates may apply. You can opt out at any time by replying STOP or by telling us through any other reasonable means, and we will honor your request within 10 business days. We do not share your mobile number or text message consent with third parties for their marketing.

6. Cookies and similar technologies

We use cookies and similar technologies for sign-in, security, remembering your choices, and, with your consent, error monitoring. Our emails may contain similar technologies, such as tracking pixels or tracked links, that our email provider uses to measure delivery and engagement; we configure these to be anonymized where the provider allows, and we do not use them for advertising. We may add cookies for these or similar purposes; any optional cookies will be subject to your choice in our cookie settings.

• Essential cookies keep you signed in and secure. They cannot be turned off in our cookie settings; if you block them in your browser, some features will not work.
• Your cookie choice is stored in an essential cookie for up to one year.
• Accessibility settings are currently stored in your browser only and are not sent to us.
• Optional error monitoring on the public website and portal runs only if you choose "Accept All." We filter personal information from these reports, and we do not currently record sessions. Security monitoring and diagnostics for staff tools and our servers are part of operating the Services and are not controlled by this cookie choice.

You can change your cookie choice at any time using "Manage your cookie preferences." We do not use cookies to sell personal information or for cross-context behavioral advertising. We do not respond to legacy browser "Do Not Track" signals. Because we do not sell or share personal information, a Global Privacy Control signal (a browser or device setting that tells websites you want to opt out of sale and sharing) does not change our practices, but we honor it wherever the law requires. Payment pages run by our payment provider may use their own cookies and device information to process payments and prevent fraud, as described in their privacy notices.

7. How long we keep information

We keep personal information only as long as reasonably needed for the purposes in this policy. Our general retention periods are:

We may keep information longer where required or permitted by law, an Organization agreement, a legal hold, fraud prevention, or to establish or defend legal claims. Business account information for Organization, operator, and partner staff is kept while the account is active and up to 12 months after, or longer while a related matter is open. When information is no longer needed, we delete or de-identify it. De-identified or aggregated data is not personal information and may be kept. Information waiting to be deleted from backups is restricted from ordinary use and removed on the backup schedule, and we take reasonable steps to reapply pending deletions if a backup is restored. For information we handle on behalf of an Organization, or where an Organization agreement sets shorter retention periods or other limits, retention, use, return, and deletion follow that agreement, even if that means keeping information for less time than shown above. For a Program without a set Service Term, we will state its retention periods, or how we decide them, where the law requires.

8. How we protect information

We use reasonable administrative, technical, and physical safeguards, such as encryption, access controls, and authentication safeguards. No system is completely secure. We investigate security incidents and provide notices required by law.

We store and process personal information mainly in the United States. Some service providers may process data outside the United States, such as in the European Union, as part of their standard operations.

9. Your rights and choices

Depending on where you live and which laws apply, you may have the right to:

• know what personal information we have about you and how we use and share it;
• get a copy of your personal information;
• correct inaccurate information;
• delete your information, subject to legal exceptions;
• opt out of text messages or marketing emails; and
• withdraw consent where we rely on it.

To make a request, email privacy@dormhealth.org with enough detail for us to verify your identity and find your records. We verify identity and authority before disclosing, correcting, or deleting information, and we may deny a request we cannot verify. To verify your identity, we ask you to confirm information we already have, such as your enrollment email and recent account details, and may send a confirmation to the email on file. For requests for specific information or deletion, we may ask for more. We may withhold or redact information about other people, security-sensitive information, and other information the law allows us to withhold. You do not need an account to make a request. You may use an authorized agent with written permission, and a parent or legal guardian may act for a minor, subject to verification. If you need an accessible way to make a request, contact us. We will not discriminate against you for exercising your rights.

For information we handle on behalf of an Organization, we may forward your request to it or direct you to its process, as our agreement and the law require. Paying for an enrollment does not by itself give an Account Holder the right to access all of a Participant's personal information through a privacy request, though service and fee notices are sent as described in Section 5.

Some requests are limited by law or by our need to keep records. For example, deleting information does not cancel a valid fee, and we may keep records needed to resolve fees, disputes, and chargebacks, enforce our Terms of Service, prevent fraud, or comply with law. Service, security, and fee notices are not marketing. Opting out of marketing emails or of texts does not stop those notices by email or other channels while you are enrolled or owe fees.

10. California privacy rights

If you are a California resident and the California Consumer Privacy Act applies to our handling of your information, you have the rights described in Section 9, including the rights to know, delete, and correct, and the right not to be discriminated against for using them.

• Categories and purposes. The categories of information we collect, where we get it, why we use it, and who we share it with are described in Sections 2 through 5. We keep each category for the periods in Section 7.
• Sale and sharing. We do not sell personal information or share it for cross-context behavioral advertising, including information about people under 16.
• Sensitive personal information. We use account sign-in credentials, and any other sensitive personal information we receive (such as information you choose to include in a support request), only to provide and secure the Services, as the law permits, and not to infer characteristics about you.
• Direct marketing. We do not share personal information with third parties for their own direct marketing.

Categories under California law. The table below groups the information described in Sections 2 through 5 into the categories California law uses. It covers the past 12 months, and each category is kept for the periods in Section 7.

We do not create profiles or inferences about you, and we have not sold or shared personal information for cross-context behavioral advertising in the past 12 months.

If the law gives you rights about a covered automated decision, those rights apply in addition to our review process.

To make a California privacy request, email privacy@dormhealth.org with the subject "California Privacy Request." Where the California Consumer Privacy Act applies, we respond to requests to know, delete, or correct within 45 days of receiving them, or tell you if we need an extension the law allows, and verifying your identity does not restart that period.

11. Minors

The Services are designed for people 18 and older. A parent or legal guardian may enroll a Participant under 18 where the Program allows it, and becomes the Account Holder. In Programs where an Organization handles enrollment, the Organization's policies govern how Participants under 18 are enrolled. If our records show that a Participant is under 18, we also send service and fee notices to the Account Holder. If a Participant turns 18 during an enrollment, the parent or legal guardian remains the Account Holder unless they both agree otherwise, and service and fee notices may continue to go to both as described in Section 5. We use a minor's information for the purposes in Section 4, and we do not sell or share it. We do not knowingly collect information from children under 13.

If we learn that a Participant is under 18 and was enrolled without the involvement the law or the Program requires, we will take the steps the law requires, which may include asking for consent, suspending the enrollment, or deleting information, unless we must keep it by law. Parents and legal guardians may contact privacy@dormhealth.org about a minor's information, subject to verification.

12. Organization programs

For Programs run with an Organization, some information is also governed by that Organization's policies and our agreement with it. We use information shared by an Organization only as that agreement and the law allow. Where student education records from an Organization are involved, we handle them as the applicable law and agreement require.

13. Other websites

The Services may link to other websites and services. We are not responsible for their privacy practices.

14. Users outside the United States

DormHealth is based in the United States. If you use the Services from outside the United States, your information will be processed mainly in the United States, as described in Section 8.

15. Changes to this policy

We may update this policy. We review it periodically, and at least once a year where the law requires. When we update it, we will change the dates at the top. For material changes, such as new categories of information or new uses or sharing of it, we will give additional notice where the law requires, such as by email or in the portal. Changes apply from their effective date.

16. How this policy relates to our Terms

Our Terms of Service govern the Services, fees, records, and disputes. This Privacy Policy describes how we handle personal information. It is a separate notice and is not part of the Terms of Service.

17. Contact us

DormHealth.org LLC

611 Wilshire Blvd, Suite 900, PMB #707, Los Angeles, CA 90017

Email: privacy@dormhealth.org

Phone: (424) 291-2012