Daavlin Distributing Co. d/b/a Phothera Privacy Policy
Last Updated: October 1, 2024
Effective Date: October 1, 2026
Phothera (“Phothera,” “Daavlin Distributing Co. d/b/a Phothera,” “we,” “our,” or “us”) respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information when you visit our websites, interact with our products and services, contact us, or otherwise engage with us.
This Privacy Policy applies to all websites, applications, communications, and services that link to or reference this Privacy Policy, including Phothera.com, PhotheraHCP.com, and any related customer service, support, marketing, and communication channels (collectively, the “Services”).
By using our Services, you acknowledge that you have read and understood this Privacy Policy.
1. Information We Collect
We may collect the following categories of information:
Information You Provide Directly
We collect information you voluntarily provide, including:
- Name
- Email address
- Phone number
- Mailing address
- Healthcare provider information
- Company or practice information
- Product registration information
- Customer service inquiries
- Survey responses
- Marketing preferences
- Any other information you submit through forms, email, phone calls, chat tools, or other communications
Health-Related Information
Depending on your interactions with us, you may voluntarily provide information related to medical conditions, treatment experiences, product usage, or therapy outcomes. Where required by applicable law, we treat such information as sensitive personal information, obtain your consent before processing it, and apply additional safeguards. We do not sell sensitive personal information, and we do not process it for targeted advertising.
SMS Communications (Text Messages)
Phothera may collect and use your mobile phone number in connection with providing:
- Customer support updates
- Service notifications
- Product support information
- Device support communications
- Refill unlock codes
- Appointment or treatment-related communications
- Promotional information
Message frequency varies. Message and data rates may apply. You may opt out of SMS communications at any time by replying STOP. After opting out, you will no longer receive SMS communications, though we may continue to contact you through other methods as permitted by law. For assistance, reply HELP or contact: [email protected]. We do not sell, rent, or share SMS consent information or mobile numbers with third parties for their own marketing purposes.
Automatically Collected Information
When you use our Services, we may automatically collect:
- IP address
- Device identifiers
- Browser type
- Operating system
- Referring websites
- Pages viewed
- Time spent on pages
- Clickstream data
- Date and time of visits
- Search terms
- Geolocation information derived from IP address
- Advertising interaction data
2. Cookies and Similar Technologies
We and our service providers use cookies, pixels, web beacons, local storage objects, software development kits (SDKs), and similar technologies to collect information regarding the use of our Services.
Types of Cookies We Use
Strictly Necessary Cookies
These cookies are required for the operation of our Services and cannot be disabled in our systems.
Examples include:
- Security controls
- Authentication functions
- Load balancing
- Form submission support
- Session management
Analytics Cookies
These cookies help us understand:
- Website traffic
- Visitor behavior
- Device usage
- User engagement
- Website performance
Analytics data helps us improve our websites and services.
Functional Cookies
These cookies remember:
- User preferences
- Language settings
- Regional settings
- Saved website preferences
Advertising and Marketing Cookies
These cookies help:
- Measure advertising effectiveness
- Determine campaign attribution
- Build custom audiences
- Deliver more relevant advertising
- Limit repetitive advertising
Cookie Choices
Most browsers allow users to:
- Block cookies
- Delete cookies
- Control cookie preferences
Some functionality of our Services may not operate properly if cookies are disabled. Where required by law, we will request your consent before placing non-essential cookies on your device, and you may change or withdraw your consent at any time using the cookie preferences tool available through the “Cookie Preferences” popup in the footer of our websites.
3. Third-Party Analytics and Advertising Partners
We use third-party tools and service providers to help us understand how visitors interact with our Services, improve website performance, communicate with users, and measure the effectiveness of marketing campaigns. We may remove parts of data that can identify you and share anonymized data with other parties. We may also combine your information with other information in a way that it is no longer associated with you and share that aggregated information. We do not attempt to re-identify de-identified or aggregated information, and we contractually require recipients not to do so.
Depending on the Services you use, these providers may collect information such as:
- IP address
- Device identifiers
- Browser type
- Referral URLs
- Website activity and interactions
- Advertising engagement data
- Approximate geographic location
- Form submission activity
- Campaign attribution information
These providers fall into the following categories:
Analytics Providers
Analytics providers help us understand website traffic, user behavior, and website performance, and may collect information about your device, browser, pages visited, and interactions with our Services. We use Google Analytics for this purpose. To learn how Google uses this information, visit https://policies.google.com/technologies/partner-sites. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout.
Advertising Partners
Advertising partners, including search engines and professional and social media networks, use cookies, pixels, and similar technologies to measure campaign effectiveness, create audience segments, and deliver more relevant advertising on other websites and platforms. You can manage Google ad personalization at https://myadcenter.google.com and opt out of interest-based advertising from participating companies at https://optout.aboutads.info. You can also opt out of targeted advertising and “sharing” as described in Section 10.
We do not deploy advertising technologies on pages where consumer health data or protected health information is collected, and we do not transmit health-related information to advertising partners.
Communications and Marketing Platforms
Email marketing and link-management providers help us distribute email communications, manage subscriber lists, shorten links, and measure engagement with our communications, such as email opens and clicks.
Other Service Providers
We may work with other service providers that perform analytics, website hosting, customer relationship management, security monitoring, survey administration, communication delivery, and business operations support.
These service providers may collect or process information on our behalf and are contractually required to use personal information only for authorized purposes.
A current list of the cookies and similar technologies used on our websites, and the providers that place them, is available through the “Cookie Preferences” popup in the footer of our websites.
4. How We Use Your Information
We may use personal information to:
- Provide products and services
- Process transactions
- Manage customer relationships
- Respond to inquiries and support requests
- Send administrative communications
- Deliver product support and refill services
- Improve our websites and services
- Measure website performance
- Conduct analytics and reporting
- Develop and improve products
- Communicate with customers and healthcare professionals
- Send marketing communications where permitted by law
- Comply with legal obligations
- Protect against fraud, misuse, and security threats
- Enforce our policies and agreements
Legal Bases for Processing (GDPR)
For individuals located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process personal information on one or more of the following legal bases:
- Your consent
- Performance of a contract
- Compliance with legal obligations
- Protection of vital interests
- Legitimate business interests that do not override your rights and freedoms
Where processing is based on consent, you may withdraw consent at any time.
The data controller for personal information processed under this Privacy Policy is Daavlin Distributing Co. d/b/a Phothera, 205 W. Bement St., Bryan, OH 43506 USA. Our Data Protection Officer can be reached at [email protected]. Individuals in the European Economic Area, United Kingdom, or Switzerland also have the right to lodge a complaint with their local data protection supervisory authority.
5. How We Share Information
We do not sell personal information for monetary consideration. Certain advertising technologies on our websites may be considered a “sale” or “sharing” of personal information under some state laws; see Section 10 for how to opt out.
We may disclose information to:
Service Providers
Third-party vendors who assist us with:
- Website hosting
- Customer service
- Marketing automation
- Email delivery
- SMS communications
- Analytics
- Security services
- CRM platforms
- Cloud storage
- Payment processing
These providers may access personal information only as necessary to perform services on our behalf.
Affiliates
We may share information with current or future affiliated entities for legitimate business purposes consistent with this Privacy Policy.
Legal Compliance
We may disclose information when necessary to:
- Comply with applicable laws
- Respond to lawful requests
- Protect rights and property
- Investigate fraud or security incidents
- Protect health and safety
Business Transactions
Information may be transferred in connection with:
- Mergers
- Acquisitions
- Financing transactions
- Asset transfers
- Bankruptcy proceedings
6. Data Retention
We retain personal information only as long as reasonably necessary for:
- Providing services
- Maintaining business records
- Legal compliance
- Resolving disputes
- Enforcing agreements
Retention periods vary depending on the information involved, applicable laws, contractual obligations, and legitimate business needs.
When information is no longer required, we securely delete or anonymize it.
7. International Data Transfers
Personal information may be transferred to and processed in the United States and other countries where we or our service providers operate.
Where personal information is transferred out of the European Economic Area, United Kingdom, or Switzerland, we rely on an approved transfer mechanism, such as the European Commission’s Standard Contractual Clauses together with the UK International Data Transfer Addendum, and we conduct a transfer impact assessment where required. You may request a copy of the relevant safeguards by contacting [email protected]. Safeguards we implement include:
- Standard Contractual Clauses
- Contractual privacy protections
- Technical and organizational security measures
8. Your Privacy Rights
Depending on your jurisdiction, you may have the right to:
- Know what personal information we collect
- Access your personal information
- Correct inaccurate information
- Delete personal information
- Restrict certain processing activities
- Object to processing
- Receive a portable copy of your information
- Withdraw consent
- Opt out of targeted advertising
- Opt out of certain data sharing activities
- Appeal a privacy rights decision where applicable
To exercise your rights, you may contact us by email at [email protected] or by mail at Phothera, Attn: Privacy Officer, 205 W. Bement St., Bryan, OH 43506 USA.
We may verify your identity before processing requests. We will respond within 30 days of receiving your request and may extend that period by an additional 60 days where reasonably necessary, in which case we will notify you of the extension and the reason for it. You may designate an authorized agent to submit a request on your behalf; we may require the agent to provide proof of written authorization and may require you to verify your identity directly with us.
9. U.S. State Privacy Rights
Residents of certain U.S. states may have additional privacy rights under applicable law, including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, and other states that enact privacy legislation.
Depending on your state of residence and subject to applicable legal limitations, you may have the right to:
Right to Know
Request information regarding:
- Categories of personal information collected
- Sources of personal information
- Purposes for collection and use
- Categories of third parties receiving information
Right to Access
Request a copy of personal information we maintain about you.
Right to Correct
Request correction of inaccurate personal information.
Right to Delete
Request deletion of personal information, subject to legal exceptions.
Right to Data Portability
Request a copy of personal information in a portable format.
Right to Opt Out
Where applicable, you may opt out of:
- Targeted advertising
- Profiling in furtherance of significant decisions
- Sales of personal information as defined by applicable law
Right to Limit Use of Sensitive Personal Information
Where required by law, residents may request limitations on certain uses of sensitive personal information.
Right Against Discrimination
We will not discriminate against you for exercising any privacy rights available under applicable law.
Additional Rights in Certain States
Oregon and Minnesota residents may request a list of the specific third parties to which we have disclosed their personal information. Minnesota residents also have the right to question the result of profiling, to be informed of the reason the profiling resulted in a particular decision, and to be informed of the actions they might take to secure a different decision in the future.
Appeals
If we decline to act on your request, you may appeal that decision. We will respond to your appeal in writing within 45 days and will explain the reasons for our decision. If your appeal is denied, you may submit a complaint to the Attorney General of your state. To submit an appeal, contact:
10. California Privacy Supplement
For California residents, we provide the following additional disclosures.
Categories of Personal Information Collected
During the previous twelve (12) months, we may have collected:
- Identifiers
- Contact information
- Internet and network activity information
- Device information
- Geolocation information
- Commercial information
- Communications data
- Professional or employment-related information
- Sensitive personal information voluntarily provided by users
Purposes for Collection
We collect personal information to:
- Provide products and services
- Process transactions
- Communicate with customers
- Deliver customer support
- Improve website functionality
- Conduct analytics
- Measure advertising effectiveness
- Comply with legal obligations
- Protect security and prevent fraud
Sale and Sharing of Personal Information
Phothera does not sell personal information for monetary consideration.
However, certain advertising technologies may be considered “sharing” under California law, or “sale” under other state laws, when information is disclosed for cross-context behavioral advertising purposes.
California residents, and residents of other states with applicable opt-out rights, may opt out of targeted advertising and “sharing” by using the “Cookie Preferences” popup in the footer of our websites, by enabling a Global Privacy Control signal in your browser, or by contacting us at [email protected].
Global Privacy Control (GPC)
We recognize and process qualifying browser-based opt-out preference signals, including Global Privacy Control (GPC) signals, and we treat a valid signal as an opt-out request regardless of whether the jurisdiction in which you are located requires us to do so.
When a valid GPC signal is detected, we will treat it as a request to opt out of activities covered under applicable privacy laws, including certain forms of data sharing related to advertising technologies.
Sources of Personal Information. We collect personal information directly from you, automatically from your browser or device when you use our Services, from healthcare providers and their practices, and from our service providers, analytics providers, and advertising partners.
Disclosures for a Business Purpose. During the previous twelve (12) months, we may have disclosed each category of personal information listed above to service providers, healthcare providers, and professional advisors for business purposes. We may have disclosed identifiers, internet and network activity information, device information, and geolocation information derived from IP address to analytics providers and advertising partners. We do not disclose sensitive personal information to advertising partners.
Use of Sensitive Personal Information. We use sensitive personal information only to provide the products and services you request and for the other purposes described in this Privacy Policy, and not to infer characteristics about you. California residents may request that we limit our use of sensitive personal information by contacting us at [email protected].
Retention. We retain each category of personal information listed above for as long as reasonably necessary for the purposes described in this Privacy Policy, using the criteria described in Section 6, including the nature of the information, our relationship with you, and our legal, regulatory, and recordkeeping obligations. Health-related and device support records may be retained for longer periods where required by product safety and regulatory recordkeeping obligations.
11. Health Information and Sensitive Data
Certain interactions with our Services may involve information related to medical conditions, treatment experiences, physician relationships, phototherapy treatment activities, or product support requests.
We collect such information only as necessary to:
- Provide products and services
- Respond to customer inquiries
- Deliver technical support
- Process refill requests
- Improve our offerings
- Meet regulatory obligations
We do not use health-related information for targeted advertising, and we do not sell health-related information.
We implement administrative, technical, and organizational safeguards designed to protect sensitive information from unauthorized access, disclosure, alteration, and misuse.
When we provide products and services to patients, including when we bill health plans for those products, Phothera acts as a health care provider covered by HIPAA. Protected health information we collect in that capacity is governed by HIPAA and our Notice of Privacy Practices, available on our website, rather than by this Privacy Policy.
Consumer Health Data (Washington, Nevada, and Other Applicable States)
Where state consumer health data laws apply, including the Washington My Health My Data Act and Nevada SB 370, we collect consumer health data only with your consent or as necessary to provide a product or service you have requested, and we share consumer health data only with your separate consent. We do not sell consumer health data and will not do so without your valid written authorization. You may withdraw your consent, request access to the consumer health data we maintain about you and request its deletion by contacting [email protected]. Washington residents should also review our Consumer Health Data Privacy Policy, available through the link on our website homepage.
12. Security
We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction.
While we use reasonable measures to protect information, no method of transmission or storage can be guaranteed to be completely secure.
13. Children’s Privacy
Our Services are not directed to children under 13 years of age, and we do not knowingly collect personal information from children under 13. We do not knowingly sell or share the personal information of consumers under 16 years of age, and we do not use the personal information of consumers we know to be under 18 for targeted advertising.
If we learn that information from a child has been collected without appropriate authorization, we will take steps to delete it promptly.
14. Third-Party Websites
Our Services may contain links to third-party websites and services.
We are not responsible for the privacy practices, security, or content of third parties. Users should review those organizations’ privacy policies before providing any information.
15. Automated Decision-Making
Phothera does not use personal information to make solely automated decisions that produce legal or similarly significant effects concerning individuals.
16. Changes to This Privacy Policy
We may update this Privacy Policy from time to time.
Any updates will be posted on this page with a revised “Last Updated” date. Material changes may also be communicated through additional means where required by applicable law.
17. Contact Us
If you have questions regarding this Privacy Policy or wish to exercise your privacy rights, please contact:
Phothera
Privacy Officer/Data Protection Officer
205 W. Bement St.
Bryan, OH 43506 USA
Email: [email protected]
Phone number: 800-338-5045
C) Amendments
This Privacy Statement may be amended from time to time. We will post any revised policy on this website.
D) Information Subject to Other Policies
We are committed to following the Principles for all EU or Swiss Personal Data transferred to the United States pursuant to GDPR.