Privacy Policy

Effective Date: [Date of publication] Last Updated: [Date of publication]

1. Who We Are

This Privacy Policy describes how the American Association of Gynecologic Laparoscopists, Inc. ("AAGL," "we," "us," or "our"), a Florida nonprofit corporation with its principal office at [AAGL HQ street address], operates Gynawareness (the "Site," accessible at gynawareness.com and app.gynawareness.com). For purposes of the European Union General Data Protection Regulation ("GDPR"), AAGL is the data controller for personal information collected through the Site.

Questions about this Policy may be directed to:

• Email: [designated privacy contact email, e.g., privacy@aagl.org]
• Mail: AAGL, Attn: Privacy Officer, [AAGL HQ address]
• Phone: [AAGL phone]

2. Scope of This Policy

This Policy applies to information we collect through the Site. It does not apply to information collected by third parties whose services may be linked from the Site (including but not limited to surgeon practice websites, podcast hosting platforms, or social media). This Policy does not apply to AAGL's main professional association website (aagl.org), which is governed by a separate policy.

HIPAA Notice: AAGL is not a "covered entity" or "business associate" under the Health Insurance Portability and Accountability Act ("HIPAA") with respect to the Site. The Site provides general health education and a surgeon directory; it does not collect protected health information ("PHI"). Communications with surgeons listed in our directory are between you and that surgeon, and may be subject to that surgeon's own HIPAA obligations.

3. Information We Collect

3.1 Information You Provide Directly

• Newsletter signup: email address, and optionally your first name.
• Find a Surgeon search: ZIP code, city, country, condition or procedure interest, and any optional filters you select. We do not require an account to perform a search.
• Contact form / general inquiries: name, email address, and the content of your message.
• Surgeon and staff member accounts (limited audience): name, email address, professional credentials, practice address, practice contact information, profile content, and other directory information provided through the Join flow or through MemberClicks single sign-on.
• Podcast guest releases (if applicable): name, professional affiliation, and the content of recorded interviews. Patient guests provide consent and identifying details through a separate signed release.

3.2 Information Collected Automatically

• Device and usage data: IP address, browser type and version, operating system, referring URL, pages viewed, time and date of visit, clickstream data, and approximate geolocation derived from IP.
• Cookies and similar technologies: see Section 7 (Cookies).
• reCAPTCHA signals: when you submit certain forms, Google reCAPTCHA collects hardware and software information (e.g., device data, browser data, IP, and interaction signals) and sends this to Google for analysis to distinguish humans from bots. See Section 4.

3.3 Information from Third Parties

• MemberClicks single sign-on: when surgeons or AAGL staff log in via MemberClicks, we receive identity verification and basic profile attributes (e.g., membership status, name, email).
• Newsletter platform engagement data: if you receive our newsletter, our email service provider may report opens, clicks, bounces, and unsubscribes back to us.

4. Third-Party Services and Data Flows

The Site uses the following third-party services. Each has its own privacy practices, and we encourage you to review them.

If we add, remove, or change a vendor in a way that materially affects this list, we will update this Policy.

5. How We Use Information

We use information for the following purposes:

1. Operating the Site, including delivering pages, running the Find a Surgeon directory, and authenticating surgeon/staff accounts.
2. Communicating with you, including responding to inquiries and sending the newsletter you have requested.
3. Maintaining the directory, including verifying surgeon credentials and keeping listings current.
4. Improving the Site, including measuring traffic, diagnosing technical issues, and refining content.
5. Protecting the Site, including detecting and preventing spam, fraud, abuse, and security incidents.
6. Complying with law, including responding to lawful requests, enforcing our Terms of Use, and protecting AAGL's legal rights.

We do not use information from the Site to make automated decisions that produce legal or similarly significant effects about you.

6. Legal Bases (GDPR / UK GDPR)

For visitors in the European Economic Area, United Kingdom, or Switzerland, our legal bases for processing are:

• Consent for the newsletter and for non-essential cookies/analytics.
• Performance of a contract for surgeon and staff account services.
• Legitimate interests for site security, fraud prevention, basic site analytics, and protecting AAGL's mission and assets, where those interests are not overridden by your rights.
• Legal obligation where we must process information to comply with law.

You may withdraw consent at any time without affecting the lawfulness of prior processing.

7. Cookies and Similar Technologies

The Site uses cookies and similar technologies in two categories:

• Strictly necessary cookies, which are required for the Site to function (e.g., session, security, load balancing, MemberClicks SSO session).
• Optional cookies, including analytics (GA4) and certain functional cookies. We request your consent before setting optional cookies where required by law.

You can control cookies through your browser settings. If you disable strictly necessary cookies, parts of the Site may not function.

A categorized cookie list will be maintained at [link to cookie list, or "in our cookie banner preference center"].

8. How We Share Information

We do not sell your personal information in the conventional sense. We share information only as follows:

• Service providers, under contract, to operate the Site (e.g., hosting, email delivery, analytics, anti-spam).
• Surgeons you contact, when you use directory contact methods that route a message to a surgeon. Once delivered, the surgeon is an independent controller of that information.
• Authorities, when required by subpoena, court order, or other lawful process, or to protect rights, safety, and property.
• Successors, in connection with a merger, restructuring, or other organizational change of AAGL, subject to confidentiality safeguards.

We do not share information with advertising networks for cross-context behavioral advertising. To the extent California, Colorado, Connecticut, or Virginia law treats analytics cookies or similar disclosures as a "sale" or "sharing," we treat such disclosures as subject to your opt-out rights under Section 11.

9. Categories of Personal Information (CCPA / CPRA)

For California residents, the following table describes the categories of personal information we have collected in the prior 12 months, the business or commercial purpose, sources, and disclosures.

We do not knowingly collect or sell personal information of consumers under 16.

10. Notice at Collection (CCPA)

At or before the point of collection, the categories of personal information we collect, the purposes for which they are used, the retention period, and whether they are sold or shared are described in this Policy. We do not sell personal information for monetary consideration. We disclose information to service providers and, in limited contexts described in Section 8, in ways that may be deemed "sharing" under California law; you may opt out as described in Section 11.

11. Your Rights and Choices

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your information, subject to legal exceptions.
• Receive a copy of your information in a portable format.
• Opt out of "sale" or "sharing" of personal information and of targeted advertising (we do not engage in these for monetary consideration; the link below covers any analytics-based "sharing").
• Limit the use of sensitive personal information (we do not use it beyond what is reasonably expected).
• Object to or restrict certain processing (GDPR/UK GDPR).
• Withdraw consent at any time.
• Appeal a denial of a rights request (Colorado, Connecticut, Virginia).
• Lodge a complaint with a supervisory authority (GDPR/UK GDPR) or with the California Privacy Protection Agency.

To exercise these rights:

• Email: [designated DSAR contact, e.g., privacy@aagl.org]
• Web form: [DSAR web form URL, if available]
• Mail: AAGL, Attn: Privacy Officer, [AAGL HQ address]

"Do Not Sell or Share My Personal Information": [link to DSAR web form or dedicated opt-out page]

We will verify your request using information reasonably necessary to confirm your identity. Authorized agents may submit requests with written authorization and verification. We do not discriminate against consumers for exercising their rights.

Response timelines: 45 days under CCPA/CPRA (extendable by 45); 60 days under Virginia/Colorado/Connecticut (extendable by 45/60 depending on state); 30 days under GDPR/UK GDPR (extendable by 60 where complex).

12. Children's Privacy (COPPA)

The Site is intended for adults. We do not knowingly collect personal information from children under 13, and the Site is not directed to children under 13 within the meaning of the Children's Online Privacy Protection Act. If you believe a child has provided personal information, please contact us at [privacy contact email] and we will delete it.

13. Data Retention

We retain personal information only as long as necessary for the purposes described in this Policy and to satisfy legal, accounting, or reporting requirements. Typical retention periods:

• Newsletter subscriber records: until you unsubscribe, plus [retention period for suppression list, e.g., 3 years]
• Find a Surgeon search logs: [retention period, e.g., 13 months for analytics]
• Surgeon account records: duration of AAGL membership plus [retention period, e.g., 7 years] for legal/recordkeeping purposes
• Contact form submissions: [retention period, e.g., 24 months]
• Server logs: [retention period, e.g., 90 days]

Specific periods may be adjusted by AAGL based on operational and legal needs.

14. International Transfers

AAGL is based in the United States, and the Site is hosted in the United States. If you access the Site from outside the United States, your information will be transferred to, stored, and processed in the United States and other countries where our service providers operate. For transfers of personal data from the European Economic Area, United Kingdom, or Switzerland to the United States, we rely on appropriate safeguards such as Standard Contractual Clauses or applicable adequacy mechanisms. You can request a copy of the safeguards by contacting us.

15. Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you as required by applicable law.

16. Third-Party Links

The Site links to third-party websites, including surgeon practice sites and external resources. We are not responsible for the privacy practices or content of those sites.

17. California "Shine the Light"

California residents may request information about disclosures of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.

18. Changes to This Policy

We may update this Policy from time to time. Changes will be posted on this page with a new "Last Updated" date. Material changes will be highlighted through a banner notice or other reasonable means.

19. Contact

Questions, requests, or complaints regarding this Policy may be sent to:

AAGL, Attn: Privacy Officer [AAGL HQ address] Email: [privacy contact email] Phone: [AAGL phone]

For EU/UK residents: [EU/UK representative name and contact, if appointed under GDPR Art. 27 / UK GDPR, counsel to advise whether one is required]