Last Updated: November 5, 2026.

Effective Date: November 5, 2026.

Introduction

At Health4Heroes Inc., we respect your privacy. This Privacy Policy (“Policy”) is here to help you understand how we collect, process, protect, and use your Personal Data (as defined below). We also describe your rights & choices with respect to how we process that Personal Data. Please read this Policy carefully.

Who We Are

This is the Policy of Health4Heroes (“Health4Heroes”, “Company”, “us”, “our”, or “we”), a Colorado 501(c)(3) charitable organization with a mailing address at PO Box 270634, Fort Collins, CO 80527. You can contact us using the information below.

Scope & Acknowledgement

This Policy applies to information that relates to identified or identifiable individuals and households (“Personal Data”) collected through our “Services” which include:

• Our “Offline Services” such as when you attend an event or participate in one of our programs;

• Our “Digital Services” including:

• this website (“Website”), https://www.health4heroes.org/;

• emails, SMS text messages and other electronic messages between you and us; and

• interactions with our content or services through third-party websites and services, if those services link to this Policy or you use them to direct your Personal Data to us.

This Policy reflects only how we collect and process Personal Data pertaining to our members, participants, and visitors to our Services (collectively, “users,” “you” or “your”). This Policy does not apply to information processed by other third parties, for example, when you visit a third-party website, attend a third-party event, or use a third-party’s services, unless those parties collect or process information on our behalf. Please review any relevant third-party’s privacy policy for information regarding their privacy practices.

Please read this Policy carefully to understand our policies and practices regarding your Personal Data and how we will treat it. If you do not agree with our policies and practices, your choice is not to use our Services. Your use of our Services indicates your acknowledgement of the practices described in this Policy.

Contact Us/Controller

The controller of your Personal Data is Health4Heroes. You may contact our data privacy team as follows:

--

Mailing Address

Health4Heroes

PO Box 270634

Fort Collins, CO 80527

Rights Requests (where available under applicable law):

Email privacy@health4heroes.org, or call 970.661.3553.

--

Categories and Sources of Personal Data

• Categories of Personal Data We Process

The categories of Personal Data we process may include:

• Audio/Visual Data-Recordings and images collected at certain events or programs, as well as audio files and records, such as voicemails, call recordings, and the like.

• Biographical Data-Data relating to professional and employment history, qualifications, and similar biographic information.

• Contact Data-Identity Data we can use to contact you, such as email and physical addresses, phone numbers, social media or communications platform usernames/handles.

• Device / Network Data- Data regarding your device or interaction with a website, application, or advertisement (e.g. IP Address, MAC Address, SSIDs, application ID/AdID/IDFA, session navigation history and similar browsing metadata, and other data generated through applications and browsers, including cookies and similar technologies or other device identifiers or persistent identifiers), online user ID, device characteristics (such as browser/OS version), web server logs, application logs, first party cookies, third-party cookies, web beacons, clear gifs and pixel tags.

• General Location Data- Non-precise location data, e.g. information derived from the name of a business or related street address, or a city or region.

• Identity Data-Data such as your name, address, email address, telephone number, gender, date of birth, age and/or age range, account login details, e.g. username and password, avatar, or other account handles/usernames.

• Inference Data-Data reflecting your preferences, characteristics, predispositions, behavior, demographics, household characteristics, market segments, likes, favorites and other data or analytics.

• User Content-Unstructured/free-form data that may include any category of Personal Data, e.g. data that you give us in free text fields such as comment boxes.

• Sensitive Personal Data - Personal Data deemed “sensitive” under Colorado or other state laws, such as social security, driver’s license, state identification card, or passport number, account log-in and password, financial account, debit card, or credit card number; precise location data; racial or ethnic origin, religious or philosophical beliefs, etc. We collect the following categories of Sensitive Personal Data:

• “Government ID Data” Data relating to official government identification, such as driver’s license or passport numbers, including similar Identity Data protected as Sensitive Data under applicable law.

• “Payment Data” Information such as bank account details, payment card information, including similar data protected as Sensitive Data under applicable law.

• Sources of Personal Data We Process

We collect Personal Data from various sources, which include:

• Data you provide us-We receive Personal Data when you provide them to us, such as when you use our Services or sign-up to participate in any of our programs.

• Data we collect automatically-We collect Personal Data about or generated by devices used to access our Digital Services.

• Partners-We receive Personal Data from other businesses or nonprofits who partner with us to provide our Services.

• Data we create or infer-We may create or infer preferences and aggregate analytics from information collected in connection with our Services for internal operations and service improvement. We do not provide identifiable consumer information to outside organizations for their independent marketing or promotional use.

Data Processing Contexts / Notice at Collection

• Membership Registration

We process Identity Data, Contact Data, Biographical Data, Government ID and Inference Data when you register, create an account, and/or subscribe to our Services. We process Payment Data if you associate payment information with that account. Government ID Data is processed to validate service and eligibility to participate in our program.

We use this Personal Data to create and maintain your account, to provide the products and services you request, and for our Business Purposes. We may use Identity Data, Inference Data, and Contact Data for our own communications and program outreach. We do not sell or provide this information to external organizations for their independent advertising or promotional purposes.

• Event Attendance/Participation

We process Identity Data, Contact Data, and General Location Data when you register for or attend an in-person event operated by or on behalf of Health4Heroes. We also process Payment Data if you attend one of our ticketed or paid events. We may collect Audio/Visual Data in the form of action shots, group photos, or testimonial videos in some cases, subject to your rights and choices.

We process this Personal Data to provide updates about the event, as well as for our Business Purposes. We may use Identity Data, Inference Data, and Contact Data to communicate about Health4Heroes events and services. We do not sell Payment Data or disclose event registration information for external marketing.

Digital Services

• General

We process Device/Network Data, Contact Data, Identity Data, General Location Data, and Inference Data. You may also be able to complete donations or purchases, register for an account, or register for an event through our Digital Services.

We use this Personal Data as necessary to operate our Digital Services, such as keeping you logged in, delivering pages, etc., for our Business Purposes, and our other legitimate interests, such as:

• ensuring the security of our Services and other technology systems; and

• analyzing the use of our Services, including navigation patterns, clicks, etc. to help understand and make improvements to the Services.

We may use this Personal Data for Health4Heroes communications and outreach, but not disclose it to external organizations for their independent marketing or promotional purposes.

• Cookies and Similar Tracking Technologies

We process Identity Data, Device/Network Data, Contact Data, Inference Data, and General Location Data, in connection with our use of cookies and similar technologies on our Digital Services. We may collect this data automatically.

We and authorized third parties may use cookies and similar technologies for the following purposes:

• for “essential” purposes necessary for our Digital Services to operate (such as maintaining user sessions, CDNs, and the like);

• for “functional” purposes, such as to enable certain features of our Digital Services (for example, to allow a member to maintain an online shopping cart);

• for “analytics” purposes and to improve our Digital Services, such as to analyze the traffic to and on our Digital Services (for example, we can count how many people have looked at a specific page, or see how visitors move around the website when they use it, to distinguish unique visits/visitors to our Digital Services, and what website they visited prior to visiting our website, and use this information to understand user behaviors and improve the design and functionality of the website);

• for internal measurement of the effectiveness of Health4Heroes communications, using information handled by authorized service providers acting on our behalf and subject to restrictions on independent use; and

• for social media features you choose to use, such as links to Health4Heroes social media pages. External platforms may collect information directly when you visit their sites, subject to their own privacy policies.

We do not provide mobile numbers, SMS consent records, or other identifiable consumer data to advertisers, sponsors, or social media platforms for their own marketing or promotional purposes. Any service providers supporting our website or analytics may use data only to perform services for Health4Heroes, subject to contractual restrictions and appropriate safeguards. We do not authorize third-party retargeting or cross-site advertising based on identifiable information collected through our Services.

Testimonials/Public Posts

We process Identity Data, Inference Data, Contact Data, and User Content you post content (e.g. comments, forum and social media posts, etc.) on or through our Digital Services. We also process Identity Data, Contact Data, User Content, and Audio/Visual Data if you provide a testimonial or consent to inclusion of similar content in our marketing materials.

We process this Personal Data for Health4Heroes operations and, where you have authorized it, to publish your submitted testimonial or content in Health4Heroes communications.

Posts and testimonials may be public, or reposted on our Services. Content you provide may be publicly-available when you post it on our Services, or in some cases, if you reference, engage, or tag our official social media accounts or communications platforms.

Donations and Purchases

We process Payment Data, Identity Data, Inference Data, and Contact Data when you complete a purchase or donation. We do not permanently store your Payment Data, except at your request.

We process this Personal Data as necessary to perform or initiate a transaction with you, process your order, payment, or refund, carry out fulfillment and delivery, document transactions, and for our Business Purposes.

We may use Identity Data and Contact Data for Health4Heroes donation receipts and communications. We do not sell Payment Data or disclose donor information for external marketing.

Marketing Communications

We process Device/Network Data, Contact Data, Identity Data, and Inference Data in connection with marketing emails, our newsletter, or similar communications, and when you open or interact with those communications. You may receive marketing communications if you consent and, in some jurisdictions, as a result of account registration or a purchase.

We process this Personal Data to contact you about relevant products or services and for our Business Purposes. We may use this data for Health4Heroes communications only. We do not provide contact lists or engagement data to external organizations for their marketing or promotional purposes. See Your Rights & Choices to limit or opt out of communications.

Contact Us; Support

We collect and process Identity Data, Contact Data, and User Content when you contact us, e.g. through a contact us form, for support, or when you report a problem with our Services. If you call us via phone, we may collect Audio/Visual data from the call recording.

We process this Personal Data to respond to your request, and communicate with you, as appropriate, and for our Business Purposes. If you consent or if permitted by law, we may use Identity Data and Contact Data for Health4Heroes communications. We do not disclose this information for third-party marketing.

Feedback and Surveys

We process Identity Data, Contact Data, Inference Data, and User Content collected in connection with feedback surveys or questionnaires.

We process this Personal Data as necessary to respond to your requests/concerns, for our Business Purposes, and other legitimate interests, such as:

• analyzing users’ satisfaction; and

• to improve our programs and respond to participant needs.

We may use this Personal Data for Health4Heroes communications and outreach, but not disclose it to external organizations for their independent marketing or promotional purposes. We do not share identifiable feedback or survey responses with external organizations for their independent purposes. We may publish a testimonial only with appropriate authorization or share de-identified, aggregated findings that do not identify individuals.

Processing Purposes

Business Purposes

• Service Provision

We process any Personal Data as is necessary to provide the Services, and as otherwise necessary to fulfil our obligations to you, such as to provide you with the information and services you request, or to allow you to participate in interactive features on our Services. For example, if you give us an e-mail address to use the "e-mail a friend" feature of our Services, we will transmit the contents of that e-mail and your e-mail address to the recipients.

• Internal Processing and Service Improvement

We may use Personal Data for our Business Purposes related to improving our Services, understanding how our Services are used, for member service purposes, in connection with logs and metadata relating to service use, and for debugging, and similar purposes. Additionally, we may use Personal Data as necessary to as necessary to understand the performance of our Services, what products our members view or purchase, for internal purposes such as auditing or data analysis, use of the Services and performance improvement, or for troubleshooting.

• Security and Incident Detection

We may process Personal Data legitimate interests in/business purposes related to improving the security of our Websites, identifying and preventing crime or fraud, and detecting potential personal data breaches or incidents. We may analyze network traffic, device patterns and characteristics, maintain and analyze logs and process similar Personal Data in connection with our information security and anti-fraud activities.

• Aggregate Analytics

We process Personal Data as necessary in connection with our creation of aggregate analytics relating to how members, and users use our Services, such as the products and services used, service delivery metrics, member trends, and to create other reports regarding the use of our Services and other similar information and metrics. The resulting aggregate data will not contain information from which and user or member may be readily identified.

• Personalization

We process certain Personal Data in connection with our legitimate business interest in personalizing our Services. For example, aspects of the Services may be customized to you based on your interactions with our Services and other content. This processing may involve the creation and use of Inference Data relating to your preferences.

• Transactional Communications

We process certain Personal Data as appropriate in connection with our legitimate interests in/business purposes related to communicating with users about our Services. For example, we may reach out to you about your donation, account, or subscription, including expiration and renewal notices. Similarly, we may use your Personal Data to send important notices, such as communications about purchases and changes to our terms, conditions, and policies, or other information that relating to the products you have purchased or your use of our Service.

• Compliance Safety, and Public Interest

We may also process any Personal Data as necessary to comply with our legal obligations, such as where you exercise your rights under data protection law and make requests, to ensure content or advertising is directed to users eligible to participate in advertised Websites or view such content/advertisements, for the establishment and defense of legal claims, or where we must comply with our legal obligations, lawful requests from government or law enforcement officials, and as may be required to meet national security or law enforcement requirements or prevent illegal activity. We may also process data to protect the vital interests of individuals, or on certain public interest grounds, each to the extent allowed under applicable law.

Health4Heroes Communications and Outreach

We may use information we collect to inform you about Health4Heroes programs, events, volunteering, fundraising opportunities, and organizational updates, subject to applicable law and your communication preferences. We do not disclose identifiable consumer information to outside advertisers, sponsors, or social media platforms for their independent marketing, promotional, retargeting, or audience-building activities.

SMS Text Messaging and Mobile Information Privacy

If you provide your mobile phone number and opt in to receive SMS messages from Health4Heroes, we may send membership and account notifications, responses to inquiries, Take Command! program updates, appointment reminders, event information, and other informational messages consistent with your consent. Message frequency may vary. Message and data rates may apply. You may reply STOP to opt out of SMS messages or HELP for assistance, or contact us at privacy@health4heroes.org or (970) 661-3553.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. SMS opt-in data and consent will not be sold or shared with any third parties, except vendors performing services on our behalf that are necessary to provide messaging and are contractually restricted from using the information for their own purposes.

We do not sell, share, rent, or transfer SMS consent or consumer data to external organizations for their independent use, even with user consent, except as required by law. Limited access by authorized service providers is permitted only as necessary to perform services on our behalf under appropriate restrictions. SMS consent is not a condition of membership, donation, or participation in our programs unless a particular messaging service is expressly necessary for a requested feature.

Disclosure/Sharing of Personal Data

We do not sell, rent, or transfer consumer Personal Data to external organizations for their independent use, advertising, or promotional purposes. We do not share mobile information or SMS consent with third parties or affiliates for marketing or promotional purposes. We permit only limited processing by authorized vendors on our behalf as needed to operate our Services, or disclosure where required by law.

• Authorized Service Providers-We may allow vetted vendors, such as hosting, CRM, payment processing, and SMS delivery providers, to access the minimum Personal Data needed to provide services on our behalf. These vendors must follow contractual restrictions prohibiting independent use, sale, or disclosure of the information, including for marketing or promotional purposes.

• Advertisers, Sponsors, Social Media Platforms, and Partners-We do not provide identifiable consumer information, mobile numbers, or SMS consent records to advertisers, sponsors, social media platforms, affiliates, or other outside organizations for their independent marketing or promotional use. If you independently interact with an external organization, information you provide directly to that organization is subject to its own policies.

• Legally Required Disclosures-We may disclose Personal Data when required by applicable law, a valid legal process, or a binding government request. We limit such disclosures to what is legally required.

We do not sell, share, rent, or transfer SMS consent or consumer data to external organizations under any circumstances for their independent purposes, even with user consent, except as required by law. Access by service providers performing services solely on our behalf is restricted as described above and does not authorize independent use or transfer.

Your Rights & Choices

• Your Rights - Generally

Residents of Colorado and other states may have rights in their Personal Data under applicable laws. You may send us an e-mail via our contact link to request access to, correct or delete any Personal Data that you have provided to us. Requests to delete certain data may require you to delete accounts or terminate your membership. We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect.

You may have the following rights, subject to regional requirements, exceptions, and limitations.

• Confirm - Right to confirm whether we process your Personal Data.

• Access - Right to access the Personal Data we have collected about you.

• Portability - Right to request that we provide certain Personal Data in a common, portable format.

• Deletion - Right to delete certain Personal Data that we hold about you.

• Correction - Right to correct certain Personal Data that we hold about you.

• Opt-out or Limit Use and Disclosure of Sensitive Personal Data - Right to opt-out of the processing of certain Sensitive Data, or request that we limit certain uses of Sensitive Personal Data. This right does not apply in cases where we only use Sensitive Personal Data where necessary, or for certain business purposes authorized by applicable law.

• Publicity – If we post images where you can be identified, or if you’ve agreed to provide a testimonial or use your Personal Data for promotional or marketing purposes, you can request that we limit use of your Personal Data for those purposes on a going forward basis. We may not be able to limit uses by third parties, in printed or physical materials, or where uses are permitted by applicable law.

• Submission of Requests

You may exercise your right to opt-out as set forth in the “Your Choices” section below. You or your agent may also submit requests to access, confirm, export delete, correct, or limit use of Personal Data by contacting us at privacy@health4heroes.org. We will verify whether and to what extent you have rights under applicable law, as well as your identity. If you have any questions or wish to appeal any refusal to take action in response to a rights request, contact us at privacy@health4heroes.org. We will respond to any request to appeal within the time period required by law.

• Verification of Rights Requests

If you submit a request, we typically must verify your identity to ensure that you have the right to make that request, reduce fraud, and to ensure the security of Personal Data. If an agent is submitting the request on your behalf, we reserve the right to validate the agent’s authority to act on your behalf.

We may require that you match personal information we have on file in order to adequately verify your identity. If you have an account, we may require that you log into the account to submit the request as part of the verification process. We may not grant access to certain Personal Data to you if prohibited by law or if we cannot appropriately verify.

Your Choices

• Marketing Communications

You can withdraw your consent to receive marketing communications by clicking on the unsubscribe link in an email (for email), by responding with “OPT-OUT,” STOP, or other supported unsubscribe message (for SMS), by adjusting the push message settings for our mobile apps using your device operating system (for push notifications), or for other communications, by contacting us using the information below. To opt-out of the collection of information relating to email opens, configure your email so that it does not load images in our emails.

• Withdrawing Your Consent/Opt-Out

You may withdraw any consent you have provided at any time. The consequence of you withdrawing consent might be that we cannot perform certain services for you, such as locationbased services, personalizing or making relevant certain types of advertising, or other services conditioned on your consent or choice not to opt-out.

• Cookies and Similar Technologies

You may manage or block cookies through your browser settings. Some parts of our website may not function properly if cookies are disabled. We use cookies for essential functionality and internal service analytics, subject to the restrictions described above. We do not authorize external organizations to use identifiable consumer data collected through our Services for independent targeted advertising.

• SMS Communications

If you receive SMS messages from Health4Heroes, reply STOP at any time to opt out or HELP for assistance. You may also contact privacy@health4heroes.org. We will honor opt-out requests in accordance with applicable requirements.

• Do-Not-Track

Our Services do not currently respond to browser do-not-track signals. We do not authorize independent third-party targeted advertising using identifiable consumer data collected through our Services.

Data Security

We implement and maintain commercially reasonable security measures to protect Personal Data against unauthorized access, use, processing, disclosure, and transfer. We maintain strict internal access controls, vendor restrictions, and data handling policies designed to prevent unauthorized sharing of user data. Access is limited to authorized personnel and service providers with a legitimate operational need. Vendors are restricted from selling, disclosing, or using Personal Data for their own marketing or promotional purposes. We may pseudonymize, de-identify, or anonymize data where appropriate. No system can be guaranteed absolutely secure.

Data Retention

We retain Personal Data for so long as it is reasonably necessary to achieve the relevant processing purposes described in this Privacy Policy, or for so long as is required by law. What is necessary may vary depending on the context and purpose of processing. We generally consider the following factors when we determine how long to retain data (without limitation):

• Retention periods established under applicable law;

• Industry best practices;

• Whether the purpose of processing is reasonably likely to justify further processing;

• Risks to individual privacy in continued processing;

• IT systems design considerations/limitations; and

• The costs associated with continued processing, retention, and deletion.

We will review retention periods periodically and may pseudonymize or anonymize data held for longer periods.

Children Under the Age of 13

Our Services are not intended for children under 13 years of age. We do not knowingly collect Personal Data from children under 13. Further, we do not knowingly collect Personal Data from minors. If we learn that we have inadvertently done so, we will promptly delete it. Do not access or use the Services if you are not of the age of majority in your jurisdiction unless you have the consent of your parent or guardian.

Changes to Our Privacy Policy

We may change this Policy from time to time. We will post changes on this page. We will notify you of any material changes, if required, via email or notices on our Services. Your continued use of our Services constitutes your acknowledgement of any revised Policy.

International Transfers

We operate in and use service providers located in the United States. If you are located outside the U.S., your Personal Data may be transferred to the U.S. The U.S. may not provide the same legal protections guaranteed to Personal Data in foreign countries. Contact us for more information regarding transfers of data to the U.S.

SMS Messaging Terms and Conditions

Health4Heroes SMS Communications

By opting in to receive SMS messages from Health4Heroes, you agree to receive text messages related to your membership, program participation, appointments, upcoming events, volunteer opportunities, and other organizational communications.

Types of Messages

Health4Heroes may send SMS messages for the following purposes:

• Membership updates and account notifications

• Take Command! program information and reminders

• Health coaching and personal training appointment confirmations

• Event registration confirmations, reminders, and updates

• Volunteer coordination and scheduling

• Responses to inquiries and customer support requests

• General organizational updates and informational communications

Consent to Receive SMS Messages

By providing your mobile phone number and explicitly opting in to SMS communications, you consent to receive text messages from Health4Heroes.

Consent to receive SMS messages is not a condition of membership, program participation, donations, or any other services provided by Health4Heroes.

Message Frequency

Message frequency varies based on your interactions with Health4Heroes, your membership status, program participation, and communication preferences.

Message and Data Rates

Message and data rates may apply depending on your mobile carrier and wireless service plan. Health4Heroes is not responsible for charges incurred from your mobile carrier.

Opt-Out Instructions

You may opt out of receiving SMS communications at any time by replying STOP to any text message from Health4Heroes.

After opting out, you will no longer receive SMS communications unless you choose to opt in again. You may receive a final confirmation message acknowledging your opt-out request.

Help and Support

For assistance with SMS communications, reply HELP to any message or contact Health4Heroes directly:

Health4Heroes

Phone: (970) 661-3553

Email: info@health4heroes.org

Website: www.health4heroes.org

Mailing Address: PO Box 270634, Fort Collins, CO 80527

SMS Privacy and Data Protection

Health4Heroes respects your privacy and is committed to protecting your personal information.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. SMS opt-in data and consent will not be sold or shared with third parties, except with service providers performing services on our behalf that are necessary to deliver SMS communications.

We do not sell, rent, or transfer SMS consent information to external organizations for their own use. Information may be disclosed when required by law.

We maintain internal access controls, vendor restrictions, and data handling policies designed to prevent unauthorized access, disclosure, or sharing of personal information.

For additional information about how we collect, use, and protect your information, please refer to the Health4Heroes Privacy Policy above.

Carrier Disclaimer

Mobile carriers are not liable for delayed or undelivered messages. SMS delivery is subject to carrier availability and network conditions.

Changes to SMS Terms and Conditions

Health4Heroes reserves the right to update these SMS Terms and Conditions as necessary. Any changes will be posted on our website. Continued participation in SMS communications following an update constitutes acknowledgment of the revised terms, subject to applicable consent requirements.