Privacy policy

(a) Policy required A regulated entity shall maintain a privacy policy relating to the practices of such regulated entity regarding the collecting, retaining, using, and disclosing of personal reproductive or sexual health information. (b) Publication required A regulated entity shall prominently publish the privacy policy required by subsection (a) on the website of such regulated entity. (c) Contents The privacy policy required by subsection (a) shall be clear and conspicuous and shall contain, at a minimum, the following: (1) A description of the practices of the regulated entity regarding the collecting, retaining, using, and disclosing of personal reproductive or sexual health information. (2) A concise statement of the categories of such information collected, retained, used, or disclosed by the regulated entity. (3) A concise statement, for each such category, of the purposes of such regulated entity for the collecting, retaining, using, or disclosing of such information. (4) A list of the specific third parties to which such regulated entity discloses such information, and a concise statement of the purposes for which such regulated entity discloses such information, including how such information may be used by each such third party. (5) A list of the specific third parties from which such regulated entity has collected such information, and a concise statement of the purposes for which such regulated entity collects such information. (6) A concise statement describing the extent to which individuals may exercise control over the collecting, retaining, using, and disclosing of personal reproductive or sexual health information by such regulated entity, the steps an individual is required to take to implement such controls, and direct links to such controls. (7) A concise statement describing the efforts of the regulated entity to protect personal reproductive or sexual health information from unauthorized disclosure.