Privacy Notice

1. Who we are and what this notice covers

Dr. Alo's website and products are operated by Z Media Group, LLC ("Dr. Alo," the "Company," "we," "our" or "us"). 

This Privacy Notice explains how we collect, use and share personal information when you:

• visit www.dralo.net, go.dralo.net or any page that links to this notice (the "Site");
• use the free Dr. Alo app for iPhone and Android (the "App");
• buy or use our courses, masterclasses, books, guides, bundles and memberships, including Healthy Heart Hacks, Actual Weight Loss: The 2027 Edition, the Obesity Medicine Masterclass and Certification for healthcare professionals, Live Replays, and Dr. Alo's Inner Circle community (together, the "Products");
• chat with "Alex," Dr. Alo's assistant, on the Site or at dralo.net/ask;
• join our live Zoom sessions, listen to The Dr. Alo Show podcast, request our media kit, sign up for free guides or our newsletter;
• text, WhatsApp, call or leave a voicemail at our business number, (419) 500-4882; or
• interact with Dr. Alo's social media accounts.

Together these are the "Services." This notice also applies to information collected in communications between you and us.

This notice does not cover information collected by other companies, including the companies whose websites we link to or whose tools you reach from our Services. DocFluence, the software platform we use to run our customer records and website analytics, is operated by our company and its own customers are covered by the separate DocFluence Privacy Policy at docfluence.ai/legal/privacy. When DocFluence processes information about our Site visitors and customers, it does so for us under this notice.

By using the Services you acknowledge that you have read this notice. If you do not agree with it, please do not use the Services.

2. Health information and our role

Our Services are educational. Dr. Alo is a board-certified cardiologist and internist, but using the Site, the App, the chat assistant, the Inner Circle, live sessions or our text line does not make you his patient and does not create a doctor-patient relationship.

Because of that, we are not acting as a health care provider when you use the Services, and the federal health privacy law known as HIPAA generally does not apply to the information you share with us here. Dr. Alo's clinical medical practice is a separate organization with its own privacy practices for its patients. Information you give us through the Services is not part of a medical record, and information in a medical record is not shared with us through the Services.

We know health information is personal. If you choose to tell us about your health (for example your cholesterol numbers, ApoB, Lp(a), calcium score, weight, medications or a diagnosis, or a photo of your lab results), we treat it as sensitive. We use it only to answer you and to provide the Services you asked for. We do not sell it, we do not send it to advertising platforms, and we do not use it to decide which ads to show you. Please share only what you are comfortable sharing, and never share someone else's health information without their permission.

3. Information we collect

Information you give us

• Contact and account details: name, email address, phone number, mailing address if you give one, username and password for your Kajabi account.
• Purchase details: the products you buy, prices, dates, order and subscription status. Payments are handled by Kajabi's checkout and our payment processors (Stripe and PayPal). We do not see or store your full card number.
• Questions and messages: what you send us by email, through forms, by text, WhatsApp or voicemail, through member messaging in the App, through the chat assistant, in community posts and comments, and in live sessions.
• Health information you choose to share: for example lab values, test results, symptoms, medications, weight and fitness details, and photos of lab reports you attach in the chat assistant or post in the community.
• Professional details: if you take a course for healthcare professionals, information such as your profession or credentials that you choose to give us.
• Media and partnership requests: your name, email and organization when you request our media kit or ask about speaking or partnerships.
• Reviews and testimonials: stories, photos and results you share with us.
• Live session participation: your name or display name, voice, video image (if your camera is on), and chat messages during recorded Zoom sessions.

Information collected automatically

• Device and usage information: pages and lessons viewed, links and buttons clicked, time on page, the page that sent you to us, advertising campaign tags in links, device type, browser type, operating system and language.
• Approximate location: country, region or city estimated from your IP address. We do not ask for precise GPS location on the Site. 
• Identifiers: IP address, cookie and pixel identifiers set by us and our partners (for example Google's "_ga" and ad click cookies and Meta's "_fbp" and "_fbc" cookies), and a random visitor number our own analytics tool stores in your browser.
• App information: when you use the App, Kajabi and the app stores may collect device identifiers, crash reports and push-notification tokens.

Our previous notice listed "geolocation including precise," "occupation history," "date of birth," "gender," and "financial and economic information" as categories we collect. We do not routinely collect these today, and we have removed them from this list.

4. Where the information comes from

• From you, when you buy, sign up, post, chat, text, call or join a live session.
• From your browser or device, through cookies, pixels and similar tools (Section 10).
• From Kajabi, which runs our checkout, member area, email, community and App. Kajabi notifies our customer records system when someone buys, and our system then retrieves the purchase details (name of the product, price, date and the buyer's email) from Kajabi.
• From payment processors, which confirm whether a payment went through.
• From social media platforms, when you comment on, message or tag Dr. Alo's accounts (for example your public profile name and what you wrote).
• From advertising and analytics partners, which give us reports about how our ads and pages perform, usually in combined form.

5. How we use information

We use personal information to:

• provide the Services: deliver products, run your account, give you access in the member area and App, host the community and live sessions, and answer your questions;
• process payments, subscriptions, refunds and renewals, and keep business and tax records;
• send you service messages (receipts, access details, session links and replay notices) and, if you signed up, emails about new videos, courses and offers;
• reply to texts, WhatsApp messages and voicemails, and let our team know quickly when someone asks to be contacted;
• operate and improve the chat assistant and our educational content, including reviewing which questions people ask;
• understand how people find and use the Site, which pages help, and which ads lead to sign-ups and purchases;
• show our ads to people who have visited our Site and to people the ad platforms consider similar;
• keep the Services safe, prevent fraud, spam and abuse, and enforce our Terms of Use;
• comply with law, respond to legal requests, and defend legal claims; and
• for any other purpose we describe when you give us the information, or with your consent.

We use automated tools to sort and prioritize messages, for example to flag a message from someone asking us to call them back so a person on our team sees it quickly. We do not use automated tools to make decisions that have legal or similarly significant effects on you.

6. Our chat assistant "Alex"

Alex, Dr. Alo's assistant, appears as a chat bubble on many pages of the Site and as a full page at dralo.net/ask. It is turned off on checkout pages, thank-you pages and the book sales pages.

• It is automated. Alex is an automated assistant powered by a third-party large language model. Our current provider is Anthropic, PBC. Alex is not Dr. Alo, is not a doctor, and does not give medical advice. Its answers are based on Dr. Alo's published educational material and may be incomplete or wrong.
• What we keep. We save the text of each conversation (your messages and Alex's replies), the date and time, and basic technical details such as the visitor number our analytics tool assigned to your browser. If you type your name or email address into the chat, we save them as a contact request so our team can follow up with you.
• Photos you attach. You can attach a photo, for example of a lab report. The photo is sent to our language model provider so Alex can read it and answer. We do not keep a copy of the photo in our chat records; we record only that a photo was attached. Please crop out your name, date of birth, account numbers and anything you do not need to share.
• Voice input. If you use the microphone button, your browser's built-in speech recognition turns your voice into text before it reaches us. Depending on your browser, that service may be provided by your browser's maker (for example Google or Apple) under its own privacy terms. We receive only the text.
• Who sees chats. Our team may read conversations to answer follow-up requests, correct mistakes and improve Alex's answers. Our language model provider processes chats only to provide the service to us. 
• Do not use Alex for emergencies. If you think you are having a medical emergency, call 911 or go to the nearest emergency room.

7. Text messages, WhatsApp, voicemail and phone calls

Our business number, (419) 500-4882, receives text messages (SMS), WhatsApp messages, calls and voicemails. These are delivered through Twilio and, for WhatsApp, through Meta. This number is a general contact line for anyone. It is not how Inner Circle members message Dr. Alo; member messaging happens inside the App (Section 9).

• What we collect: your phone number, the content and time of your messages, voicemail recordings (callers are asked to leave a message of up to two minutes), and a record of your consent to receive messages.
• How we use it: to reply to you, give support, and send service messages about your purchase or account. Messages are saved in our customer records and forwarded to our team so a person can answer. You may receive one short automatic acknowledgment when you first write in.
• No marketing texts today: we currently use text messaging for customer care only, not for advertising. If we ever start a marketing text program, we will ask for your separate written consent first.
• No sharing of mobile information: No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. This does not stop us from using service providers (such as Twilio) that deliver messages for us.
• Your choices: reply STOP to stop receiving text messages, or HELP for help. Message and data rates may apply.

8. Live sessions on Zoom and recordings

Inner Circle live sessions are held on Zoom (currently every Monday at 9:00 p.m. Eastern). They are recorded. Recordings are transcribed and summarized, and the replays, transcripts and summaries are posted for members in the member area and the App. Replays of past sessions are also included in some of our products, such as the "Live Replay Access" included with Healthy Heart Hacks and the "Live Replays" product.

If you join a session, your name or display name, your voice, your video (if your camera is on) and anything you type in the Zoom chat may appear in the recording, transcript and summary. You can keep your camera off, use your first name only, and ask your question in the chat. If you would like something you said removed from a replay, email us and we will make reasonable efforts to edit or remove it. Zoom processes session information under its own privacy policy.

9. Community posts, reviews and testimonials

Posts, comments, photos and lab results you share in the Inner Circle community can be seen by other members. Please do not post anything you want to keep private. We may remove content at any time.

Inner Circle members message Dr. Alo through the member messaging inside the App (provided by Kajabi). Those messages are stored on Kajabi's platform and read by Dr. Alo and, where needed, our team. They are used to answer you and to run the membership, and they are not sent to advertising platforms.

Testimonials are submitted voluntarily by the people who give them, with their permission to share them. When you submit a review, testimonial or success story, you agree that we may publish it on the Site, in emails, ads and social media, as described in our Terms of Use. We may correct spelling and grammar or shorten a testimonial for length or clarity without changing its meaning. Results vary from person to person.

10. Cookies, pixels, analytics and advertising

We and our partners use cookies, pixels and similar technologies on the Site. As of the date of this notice, the Site loads:

• Google Analytics and Google Tag Manager (Google LLC): record the pages you view, how you arrived (for example a search, a social post or an ad), your general location estimated from your IP address, and your device and browser type.
• Google Ads (Google LLC): tells Google when someone who clicked one of our ads visits the Site or makes a purchase.
• Meta Pixel (Meta Platforms, Inc., which operates Facebook and Instagram).
• TikTok Pixel (TikTok Inc.).
• Kajabi's own analytics, which Kajabi uses to run and measure the platform.
• Site Pulse, our own first-party analytics tool (part of DocFluence): stores a random visitor number in your browser so we can count visits and sessions, and turns your IP address into a one-way code that changes every day (we do not store the IP address itself). When you type your email address into a form on the Site, Site Pulse links a coded (hashed) version of that email to your visitor number, so we can see which pages and ads lead to sign-ups and purchases. Site Pulse does not set advertising cookies.
• Embedded videos (for example YouTube and Wistia), which may set their own cookies when you play a video.

A pixel is a small piece of code that tells the advertising platform when someone visits our Site or takes an action, such as viewing a page, signing up or buying. Pixels can see the address of the page you are viewing, which may show the topic of the article or course you are looking at. These tools may set cookies or similar identifiers, including identifiers the platforms use to recognize the same browser across different websites.

We use these tools to measure whether our advertising works, to understand which content is useful, and to show our ads to people who have visited our Site and to people the platforms consider similar to them.

You can block or delete cookies in your browser settings, and the Site will still work. You can also manage how each platform uses this information: Meta (facebook.com/adpreferences), Google (myadcenter.google.com, and the Google Analytics opt-out add-on at tools.google.com/dlpage/gaoptout), and TikTok (Settings and privacy, then Ads). Industry opt-outs are available at optout.aboutads.info and optout.networkadvertising.org. Each platform uses the information it receives under its own privacy policy, which we do not control.

11. Server-side purchase reporting

When you make a purchase on dralo.net, our servers may also report that purchase directly to advertising and analytics platforms, so we can measure whether our ads work. This happens even if an ad blocker stopped the pixel in your browser.

• Meta (Conversions API). For a first purchase (not renewals), we may send: that a purchase happened, its value, currency and order number; the page address; the identifiers that the Meta Pixel placed in your browser and any ad click identifier; your browser's user agent; and your email address and our customer number for you in hashed form. We do not send your name, address, payment card details, or the name of a health topic.
• Google Analytics (Measurement Protocol). For a first purchase, we may send Google Analytics the purchase value, order number and product name, linked to the Google Analytics identifier already stored in your browser. Google Ads may then count the purchase as a result of an ad you clicked.

Hashing (SHA-256) replaces your email address with a scrambled code before it leaves our servers. The platform cannot read the original, but it can compare the code with the codes for its own users to learn whether one of its users responded to our ad. Because that match is possible, we treat hashed identifiers as personal information, not as anonymous data.

You can ask us not to include your purchases in this reporting. See Section 13.

12. Who we share information with

We never sell your data. We share it only as described here:

• Service providers that work for us under contract and may use the information only to provide services to us:
  • Kajabi (website hosting, checkout, member area, courses, community, email and the App);
  • Stripe and PayPal (payment processing);
  • Twilio (text messages, calls and voicemail) and Meta (WhatsApp delivery);
  • Zoom (live sessions);
  • Anthropic (the language model behind the chat assistant and tools that help our team sort and draft replies to messages);
  • email delivery, video hosting, cloud storage and security providers; and
  • our own DocFluence platform, which stores our customer records, website analytics and message inbox.
• Advertising and analytics partners (Google, Meta and TikTok), through the cookies, pixels and purchase reporting described in Sections 10 and 11. These partners may also use the information for their own purposes under their own policies, which is why some state laws treat this as a "sale" or "sharing."
• Customer lists for advertising. We offer courses and educational content. We share hashed (encrypted) email addresses of customers with advertising partners such as Meta and Google so they can measure our ads and show relevant ads, including finding people similar to our customers. Where we have them, the list may also include the customer's name, ZIP code and country, hashed the same way. We never sell your data. To be excluded, email zmedia.co@gmail.com.
• Other members, for content you choose to post in the community or say in a live session.
• Professional advisers such as lawyers, accountants and consultants, when reasonably necessary.
• Successors, if all or part of our business is sold, merged, reorganized, or transferred, including in a bankruptcy or similar proceeding. Information about our users may be among the transferred assets.
• Legal and safety reasons: to comply with a subpoena, court order or other legal requirement; to protect our rights or the rights, property or safety of others; to fight fraud; and to enforce our Terms of Use and other agreements, including for billing and collection.
• With your consent or at your direction.

We may share information that has been combined or de-identified so that it no longer identifies you, for example total visitor numbers when describing our audience to partners.

13. "Sale," "sharing" and targeted advertising: your choices

Some U.S. state privacy laws treat letting an advertising platform collect information through a pixel, or receive purchase reports, for targeted advertising as a "sale" or "sharing" of personal information, even when no money changes hands. In the past 12 months we have disclosed the following categories in that way to Google, Meta and TikTok: identifiers (cookie and pixel identifiers, IP address, hashed email address), internet and website activity, approximate location, and commercial information (that you made a purchase and its value). We do not knowingly sell or share the personal information of anyone under 16. We do not sell or share health information you send us.

How to opt out today:

• Email zmedia.co@gmail.com with the subject "Do Not Sell or Share" and the email address you use with us. We will stop including your purchases in our server-side purchase reporting to advertising platforms and leave you out of the customer lists we share with advertising partners.
• To stop pixels in your browser, block third-party cookies or use a browser or extension that blocks trackers, and use the platform settings listed in Section 10.

You may also use an authorized agent to make this request.

14. Do Not Track and Global Privacy Control

Because there is no common standard for browser "Do Not Track" (DNT) signals, we do not respond to them. For more on DNT, see allaboutdnt.com.

Our Site does not yet automatically respond to Global Privacy Control (GPC) signals. Until it does, please use the email opt-out in Section 13, and we will honor it.

We treat a Global Privacy Control (GPC) signal from your browser as a request to opt out of the sale or sharing of your personal information and of targeted advertising on this Site, and we do not load advertising pixels for that browser.

15. Email and marketing choices

If you sign up for free guides, the newsletter or a product, we may send you emails about new videos, podcast episodes, courses, events and offers. Every marketing email includes an unsubscribe link at the bottom. You can also email us to unsubscribe. Even if you unsubscribe from marketing, we may still send service messages about your purchases, membership or account.

16. How long we keep information

We keep personal information only as long as we need it for the purposes in this notice, unless the law requires or allows us to keep it longer. As a guide:

• Account, purchase and membership records: for as long as you have an account, and afterward for as long as needed for tax, accounting, refund and legal purposes.
• Site Pulse analytics records: deleted after about 13 months.
• Chat assistant conversations: 24 hours
• Text, WhatsApp and voicemail records: as long as needed to help you and to meet legal requirements.
• Live session recordings, transcripts and summaries: for as long as we offer them as part of our Products.
• Opt-out requests: we keep a hashed (coded) copy of your email address on our suppression list so we can keep honoring your request.

Advertising and analytics partners keep the information they receive for as long as their own policies allow.

17. How we protect information

We use reasonable administrative, technical and physical safeguards, such as encrypted connections, access controls and reputable service providers. Your Kajabi account is protected by your password. Please choose a strong password, keep it private, and sign out on shared devices.

No internet, email or text transmission is ever fully secure or error free. Email, texts and forms sent to or from the Services may not be secure, so please take special care in deciding what information you send us. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures on the Services.

18. Children

The Services are for adults. You must be at least 18 years old to create an account, make a purchase, post in the community, use the chat assistant or text us. The Services are not directed to children under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a child under 18 has given us personal information, please contact us and we will delete it.

19. Your U.S. state privacy rights

Depending on where you live (for example California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia or another state with a consumer privacy law), you may have the right to:

• know what personal information we collect, use and disclose, and get a copy of it in a portable format;
• correct inaccurate information;
• delete your information;
• opt out of the sale or sharing of your personal information and of targeted advertising (Section 13);
• limit the use of sensitive personal information (we already use health information you share only to provide the Services you ask for); and
• appeal our decision if we deny your request.

To make a request, email zmedia.co@gmail.com with the subject "Privacy Request" and tell us what you would like us to do. We will verify your identity by confirming information we already have, usually your email address. You may use an authorized agent, and we may ask the agent for proof of authority. We will not treat you differently, charge you more, or give you a lower quality of service for using these rights. If we deny your request, you may appeal by replying to our decision with the subject "Privacy Appeal."

California "Shine the Light." California Civil Code Section 1798.83 lets California residents ask for information about our disclosure of personal information to third parties for their own direct marketing purposes. To ask, email us at the address above.

Categories of personal information (California notice at collection). In the past 12 months we collected identifiers; customer records (name, contact and payment details handled by our processors); commercial information; internet and website activity; approximate location; audio and visual information (voicemails, live session recordings); professional information (for healthcare professional courses); and sensitive personal information that you choose to share (health information). The sources, purposes, recipients and retention periods are described in Sections 4, 5, 12 and 16.

20. Your rights if you are in the EEA, UK or Switzerland

Our Services are run from the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, data protection law gives you the right to be informed about how we use your information, to access it, to correct it, to have it erased in certain situations, to restrict or object to its use (including for direct marketing), to data portability, and to withdraw consent at any time where we rely on consent.

We rely on these legal bases: to perform our contract with you (for example delivering a product you bought); our legitimate interests (for example running, securing and improving the Services and measuring our marketing, balanced against your rights); your consent (for example for marketing emails, and where required for cookies and pixels); and compliance with legal obligations.

To exercise your rights, contact us as described in Section 24. You also have the right to lodge a complaint with a supervisory authority, in particular in the country where you live or work, or where you believe a violation occurred. For guidance, see the UK Information Commissioner's Office guide to individual rights.

21. International transfers

We primarily store and process information in the United States, and our service providers may process it in other countries. Those countries may not have the same data protection laws as your country. Where the law requires, we rely on appropriate safeguards for transfers, such as standard contractual clauses offered by our providers. To ask for a copy of those safeguards, contact us.

22. Links to other websites and social media

The Services link to websites and apps we do not operate, such as YouTube, Facebook, Instagram, TikTok, X, LinkedIn, the Apple App Store and Google Play. Their privacy policies, not this notice, apply to them, and a link does not mean we endorse them.

When you comment on, message or tag Dr. Alo's social media accounts, we receive the information the platform makes available, such as your profile name and what you wrote. Replies to comments and messages on our accounts may be drafted or sent with the help of automated tools and reviewed by our team, and we may keep a record of the conversation in our customer records. Anything you post publicly on social media is governed by that platform's privacy policy.

23. Changes to this notice

We may update this notice from time to time. When we do, we will change the "Last updated" date at the top. If we make a material change, we will also let you know by email or with a notice on the Site before the change takes effect. Your continued use of the Services after an update means you accept the updated notice, so please check this page from time to time.

24. Contact us

If you have any questions about this notice or our privacy practices, or you want to make a privacy request, please contact us:

• Email: zmedia.co@gmail.com (subject "Privacy Request," "Do Not Sell or Share" or "Privacy Appeal")
• Phone, text or WhatsApp: (419) 500-4882
• Phone: 419-500-4882 
• Mail: Z Media Group, LLC, 2324 Street, Toledo, OH 43617
• Web: www.dralo.net/contact

We will make every effort to resolve your concerns.