Legal

Privacy Notice

Effective Date: June 10, 2026 | Last Updated: June 10, 2026

This Privacy Notice describes how Quantum Leap Healthcare Collaborative ("QLHC," "we," "us," or "our") collects, uses, and shares personal information when you visit www.quantumleaphealth.org or any website operated by QLHC that links to this Notice (collectively, the "Site"), and when you engage with us through related channels such as email, events, or donation platforms.QLHC is a California nonprofit public benefit corporation and 501(c)(3) organization headquartered at 580 California Street, Suite 1200, San Francisco, CA 94104. QLHC serves as the sponsor of the I-SPY adaptive clinical trial platform and related cancer research programs.If you have questions or concerns after reviewing this Notice, please contact us at the address in Section 13.

IMPORTANT: QLHC IS NOT A HIPAA COVERED ENTITY.

This Site does not collect or process Protected Health Information (PHI) as defined under the Health Insurance Portability and Accountability Act (HIPAA). If you are a patient or research participant, your medical and health information is governed by the privacy practices of your treating institution and your informed consent agreement for any clinical trial, not by this Notice. This Site does not create a treatment relationship between you and QLHC.

1. What Information Do We Collect?

1.1 Information You Provide

  • contact us by email or through a web form;
  • subscribe to our newsletter or mailing list;
  • register for or attend an event;
  • make a donation or financial contribution; or
  • apply for employment or submit a vendor inquiry.

The types of information collected in these contexts may include your name, email address, mailing address, phone number, professional affiliation, and payment information for donations (processed by our third-party payment processor; QLHC does not store full payment card numbers).

We do not collect sensitive personal information as defined under applicable law, including racial or ethnic origin, health or medical data, genetic or biometric data, sexual orientation, or religious beliefs, through this Site.

1.2 Information Collected Automatically

When you visit the Site, certain technical and usage information is collected automatically by our web servers and analytics tools, including:

  • Internet Protocol (IP) address and approximate geolocation derived from IP;
  • browser type, version, and operating system;
  • device type and hardware identifiers;
  • referring URLs and pages visited;
  • time stamps, session duration, and page interaction data; and
  • crash and error logs.

This automatically collected information does not, on its own, identify you by name but may constitute personal data under some privacy laws. We use it to maintain Site security, diagnose technical issues, and analyze aggregate usage patterns.

1.3 SMS Communications

If you consent to receive SMS communications from QLHC, we collect your mobile phone number for that purpose only. Your phone number will not be shared with third parties or affiliates for marketing purposes. You may opt out at any time by replying STOP to any SMS message. For assistance, reply HELP. Message frequency is approximately 1 to 2 messages per year.

1.4 Information We Do Not Collect

QLHC does not collect, through this Site, any of the following:

  • Protected Health Information (PHI) as defined under HIPAA;
  • clinical trial participation data or research subject identifiers;
  • patient medical records, diagnoses, or treatment information; or
  • information from children under the age of 18 (see Section 7).

If you believe you have inadvertently submitted PHI or sensitive health information through the Site, please contact us immediately at info@qlhc.org so we can take appropriate steps.

2. How Do We Process Your Information?

We process your personal information only when we have a lawful basis to do so under applicable law. We use the information we collect for the following purposes:

  • To respond to inquiries and fulfill service requests you submit to us.
  • To send newsletters, event invitations, and organizational updates, where you have opted in.
  • To process donations and send acknowledgment communications.
  • To maintain Site security, detect fraud, and prevent misuse.
  • To analyze aggregate Site usage and improve the user experience.
  • To comply with our legal obligations and respond to lawful requests from governmental authorities.

We do not use your personal information to make automated decisions that produce legal or similarly significant effects about you without human review. We do not use Site visitor data to evaluate or make decisions about research participant eligibility; clinical trial enrollment is governed by separate protocols and institutional processes.

We previously described "targeted advertising" as a use of personal information. After review, QLHC does not conduct targeted advertising to Site visitors using personal data collected on this Site. Our Site may use third-party analytics tools that set cookies or tracking technologies for their own measurement purposes; see Section 4 for your options.

3. When and With Whom Do We Share Your Information?

3.1 Service Providers

We share personal information with vendors, contractors, and service providers who perform services on our behalf, including website hosting, email delivery, event management, donation processing, and analytics. These parties are permitted to use your information only to provide services to QLHC and are subject to written data processing agreements.

3.2 Research Collaborators and Partners

QLHC collaborates with academic medical centers, pharmaceutical company partners, and research institutions in connection with the I-SPY clinical trial platform. We do not share general Site visitor information with these partners. Any sharing of information related to a specific research collaboration is governed by a separate data use agreement or collaboration agreement, not this Notice.

3.3 Required Disclosures

We may disclose your information when required to do so by law, court order, or governmental or regulatory authority, or when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of QLHC, our users, or others.

3.4 Organizational Transfers

If QLHC undergoes a merger, restructuring, asset transfer, or similar transaction, personal information held by QLHC may be transferred as part of that transaction, subject to the privacy commitments described in this Notice.

3.5 What We Do Not Do

QLHC does not sell your personal information to third parties. QLHC does not share your personal information with pharmaceutical company partners or other commercial entities for marketing or advertising purposes. QLHC has not sold or shared personal information to third parties for commercial purposes in the preceding twelve months.

4. Cookies and Tracking Technologies

The Site uses cookies and similar tracking technologies, including web beacons and tracking pixels, to support basic site functions, security, and analytics. Cookies are small text files stored on your device.

Categories of cookies we use:

  • Strictly necessary cookies: required for the Site to function and cannot be disabled.Strictly necessary cookies: required for the Site to function and cannot be disabled.
  • Analytics cookies: help us understand how visitors use the Site in aggregate, so we can improve content and navigation.
  • Preference cookies: remember your settings and choices.

We use Google Analytics to measure Site usage. Google Analytics may set its own cookies. You can opt out of Google Analytics measurement by installing the Google Analytics Opt-out Browser Add-on available at https://tools.google.com/dlpage/gaoptout. You may also adjust your preferences through Google's Ad Settings.

You can control or disable cookies through your browser settings. Note that disabling certain cookies may affect the functionality of some Site features. For a full description of the cookies used and your options, see our Cookie Notice.

QLHC does not use advertising retargeting pixels or behavioral advertising networks to serve targeted advertisements to Site visitors based on their browsing history on this Site.

5. How Long Do We Retain Your Information?

We retain personal information for as long as necessary to fulfill the purposes described in this Notice, or as required or permitted by applicable law. The following general principles apply:

Categories of cookies we use:

  • Contact and inquiry data: retained for the duration of the business relationship and for a reasonable period thereafter to respond to follow-up inquiries.
  • Newsletter and mailing list data: retained until you unsubscribe or request deletion.
  • Donation records: retained for the period required by applicable tax and accounting law, typically seven years under federal and California law.
  • Analytics and log data: retained for up to 26 months in aggregate form; raw log files are typically retained for 90 days.

When personal information is no longer required, we will either securely delete or anonymize it. Where deletion is not immediately feasible (for example, information in backup archives), we will isolate the data from further processing pending deletion.

6. How Do We Protect Your Information?

QLHC implements technical and organizational security measures appropriate to the nature of the personal information we process, including encryption of data in transit (TLS), access controls, and vendor security reviews.

However, no method of internet transmission or electronic storage is completely secure. We cannot guarantee absolute security and encourage you to use secure networks when accessing the Site and to contact us promptly if you believe your information has been compromised.

7. Children and Minors

The Site is not directed at individuals under the age of 18. We do not knowingly collect personal information from minors. If you are a parent or guardian and believe that a minor has provided us with personal information without consent, please contact us immediately at info@qlhc.org. If we learn that we have collected personal information from a minor, we will take prompt steps to delete it.

Note: Clinical trial participation by minors is governed separately by applicable federal and state research regulations, including 21 CFR Part 50 Subpart D, and by the informed consent and assent processes at each participating clinical site. This Site does not facilitate or govern such participation.

8. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights with respect to your personal information:

  • Right to access: request a copy of the personal information we hold about you.
  • Right to correction: request that we correct inaccurate or incomplete information.
  • Right to deletion: request that we delete your personal information, subject to legal exceptions.
  • Right to portability: receive your personal information in a structured, commonly used, machine-readable format.
  • Right to withdraw consent: where we process information on the basis of consent, withdraw that consent at any time without affecting the lawfulness of prior processing.
  • Right to object or restrict: object to certain types of processing or request that we restrict processing in certain circumstances.

To exercise any of these rights, please contact us at info@qlhc.org or by mail at the address in Section 13. We will respond to verified requests in accordance with applicable law. We will not discriminate against you for exercising your privacy rights.

To verify your identity before processing a rights request, we may ask you to provide information we already hold about you. We will use that information only for verification purposes.

9. California Residents

9.1 California Consumer Privacy Act (CCPA) and CPRA

California residents have specific rights under the California Consumer Privacy Act of 2018 and the California Privacy Rights Act of 2020 (collectively, "CCPA/CPRA"). The following table summarizes the categories of personal information QLHC has collected from Site visitors in the preceding 12 months:

Category
Examples
Collected
A. Identifiers
Name, email, IP address, online identifier
Yes (contact form, newsletter, analytics)
B. Customer Records
Name, contact information
Yes (donation, contact form)
C. Protected Classifications
None
No
D. Commercial Information
Donation transaction data
Yes (donations only)
E. Biometric Information
None
No
F. Internet/Network Activity
Browsing data, page interactions
Yes (analytics cookies)
G. Geolocation Data
Approximate location from IP
Yes (analytics only)
H. Audio/Visual/Electronic
None
No
I. Professional/Employment
Affiliation (if volunteered)
Limited
J. Education Information
None
No
K. Inferences
None drawn
No
L. Sensitive Personal Information
None
No

QLHC does not sell personal information and does not share personal information with third parties for cross-context behavioral advertising. California residents who wish to exercise their CCPA/CPRA rights (access, correction, deletion, portability, opt-out of sale/sharing) may submit a request to info@qlhc.org.

Authorized agents may submit requests on a California resident's behalf with written, signed authorization from the resident.

If we deny your request, you may appeal by emailing info@qlhc.org. If your appeal is denied, you may submit a complaint to the California Privacy Protection Agency (CPPA) or the California Attorney General.

9.3 Other US State Privacy Laws

Residents of Colorado, Connecticut, Delaware, Florida, Minnesota, Montana, New Hampshire, New Jersey, Oregon, Texas, Utah, Virginia, and other states with comprehensive privacy laws may also have rights similar to those described in Section 8. We will honor verified requests consistent with applicable state law.

10. EEA, UK, and International Users

If you are located in the European Economic Area (EEA) or the United Kingdom (UK), the following applies to our processing of your personal data under the General Data Protection Regulation (GDPR) and UK GDPR.

10.1 Data Controller

QLHC is the data controller for personal data collected through this Site. Our contact information is in Section 13.

10.2 Legal Basis for Processing

We process personal data on the following legal bases:

  • Legitimate interests (Article 6(1)(f) GDPR): Site security, analytics, and fraud prevention, where those interests are not overridden by your rights.
  • Contract performance (Article 6(1)(b) GDPR): processing necessary to respond to your inquiry or fulfill a service you requested.
  • Consent (Article 6(1)(a) GDPR): newsletter subscriptions, non-essential cookies, and SMS communications.
  • Legal obligation (Article 6(1)(c) GDPR): compliance with applicable law.

This automatically collected information does not, on its own, identify you by name but may constitute personal data under some privacy laws. We use it to maintain Site security, diagnose technical issues, and analyze aggregate usage patterns.

10.3 International Data Transfers

QLHC is based in the United States. If you are located in the EEA or UK, your personal data will be transferred to and processed in the United States, which may not provide a level of data protection equivalent to that in your jurisdiction. Where required, we rely on standard contractual clauses approved by the European Commission (or UK equivalent) or other appropriate transfer mechanisms to lawfully transfer personal data.

10.4 Data Subject Rights

EEA and UK data subjects have the rights described in Section 8, plus the right to lodge a complaint with your local supervisory authority (in the EEA, the relevant national Data Protection Authority; in the UK, the Information Commissioner's Office at ico.org.uk).

11. Do-Not-Track Signals

Most browsers include a Do-Not-Track (DNT) feature that signals to websites that you prefer not to have your browsing activity tracked. There is currently no legally binding industry standard for responding to DNT signals, and we do not alter our data practices in response to DNT browser signals at this time. California law requires us to disclose this practice.

If a legally recognized standard for DNT signals is adopted in the future, we will update this Notice accordingly.

12. Updates to This Notice

We may update this Privacy Notice from time to time to reflect changes in our practices, applicable law, or Site functionality. The updated Notice will be posted to this page with a revised effective date. We will provide more prominent notice (such as an email notification or a banner on the Site) for material changes that affect how we use previously collected information, to the extent required by applicable law.

We encourage you to review this Notice periodically. Your continued use of the Site after any update constitutes your acceptance of the revised Notice.

13. How to Contact Us

If you have questions about this Privacy Notice, wish to exercise your privacy rights, or have a concern about our data practices, please contact:

Quantum Leap Healthcare Collaborative
Attn: Privacy
580 California Street, Suite 1200
San Francisco, California 94104
Email: info@qlhc.org
Website: www.quantumleaphealth.org

© 2026 Quantum Leap Healthcare Collaborative. All rights reserved.
California Nonprofit Public Benefit Corporation | 501(c)(3)