Platform Privacy Policy

Effective Date: May 13, 2026
Last Updated: October 17, 2026

1. Introduction and Scope

Pine Lake Media, LLC (“Pine Lake,” “we,” “us,” or “our”) operates a programmatic advertising platform focused on healthcare-endemic digital media. This Platform Privacy Policy (this “Policy”) explains how we collect, use, disclose, and retain information through our supply-side platform, prebid adapter, ad exchange, deal management, and reporting services (collectively, the “Platform”), and the choices available to you.

This Policy applies only to information processed through the Platform. It does not govern the privacy practices of the websites, applications, and other digital properties on which ads are shown (each, a “Supply Partner”), or of the advertisers, agencies, and demand-side platforms that purchase advertising through the Platform (each, a “Demand Partner”). Each of those parties maintains its own privacy notice, which we encourage you to review.

The Platform is offered for use in the United States only. Pine Lake does not knowingly process bid requests originating outside the United States for advertising purposes.

2. Who We Are and What We Do

Pine Lake is a business-to-business intermediary in the digital advertising supply chain. When a person visits a website or application operated by one of our Supply Partners, that Supply Partner may send an ad request (a “Bid Request”) to the Platform. We make the advertising opportunity available to Demand Partners, which may bid to show an ad. The winning ad is delivered to the Supply Partner’s property.

Our Platform specializes in reaching healthcare professionals (“HCPs”), such as physicians, nurse practitioners, and pharmacists, in their professional capacity. We do not offer consumer-facing products or services, and we do not have a direct relationship with the individuals who view ads delivered through the Platform.

Pine Lake does not place cookies, pixels, software development kits, or other tracking technologies on users’ browsers or devices. We receive information on a server-to-server basis from Supply Partners and, where described below, from identity and data partners.

3. Information We Receive

3.1 Bid Request Data

Supply Partners send us Bid Requests that are formatted under industry standards such as the IAB Tech Lab OpenRTB specification. Depending on the Supply Partner, a Bid Request may include:

• Device and browser information, such as IP address, user agent, device type, operating system, browser type, screen size, and language settings;
• General location information, such as country, state, city, ZIP code, or designated market area, as derived from IP address or provided by the Supply Partner;
• Content and placement information, such as the domain, page URL, application identifier, general site category, ad slot size and position, and ad format;
• Technical and auction information, such as timestamps, bid request identifiers, deal identifiers, and floor prices; and
• Privacy signals, such as IAB Global Privacy Platform (GPP) strings, U.S. Privacy strings, Global Privacy Control (GPC) signals, and child-directed treatment flags.

3.2 Healthcare Professional Data

For certain advertising opportunities, a Bid Request may include a hashed National Provider Identifier (“NPI”). An NPI is a unique ten-digit identifier issued to healthcare providers by the U.S. Centers for Medicare & Medicaid Services and published in the public National Plan and Provider Enumeration System (NPPES). We transmit NPIs only in hashed form, using SHA-256 or a comparable one-way hashing standard.

A hashed NPI may be associated with a Bid Request in one of two ways:

• Authenticated environments. Some Supply Partners operate professional platforms, such as clinical, reference, or electronic health record environments, on which HCPs sign in. Those Supply Partners may pass a hashed NPI associated with the signed-in professional.
• Identity resolution. For other Supply Partners, Pine Lake or its technology and identity resolution partners may associate device or browser signals in the Bid Request with an HCP’s hashed NPI, using professional identity data that those partners have lawfully obtained.

We and our Demand Partners may associate a hashed NPI with professional attributes about the HCP, such as medical specialty, credentials, practice affiliation and location, and professional clinical or prescribing activity. This information is obtained from public sources such as NPPES and from licensed healthcare data providers. These attributes describe the HCP’s professional practice. They are not information about the HCP’s own health.

3.3 Information We Do Not Collect

Pine Lake does not collect, receive, or use through the Platform:

• the names, email addresses, telephone numbers, or postal addresses of consumers or patients;
• protected health information (PHI) as defined under the Health Insurance Portability and Accountability Act (HIPAA);
• “consumer health data” as defined under Washington’s My Health My Data Act or similar laws, including health-condition audience segments or health-related inferences about consumers or patients; or
• government identifiers, financial account information, or precise geolocation for targeting purposes.

Our contracts prohibit Supply Partners from sending us, and Demand Partners from deriving through the Platform, personal information of consumers or patients beyond the standard Bid Request data described in Section 3.1.

3.4 Business Contact Information

We collect business contact information, such as name, title, company, business email, and telephone number, from representatives of Supply Partners, Demand Partners, and vendors in order to manage our business relationships.

4. How We Use Information

We use the information described above to:

• operate the Platform, including running auctions, applying deal terms and floor prices, and delivering ads;
• enable Demand Partners to deliver advertising to HCP audiences in their professional capacity;
• provide reporting, measurement, and analytics to Supply Partners and Demand Partners, including reporting on advertising delivery to HCP audiences;
• detect, prevent, and investigate invalid traffic, fraud, malware, and security incidents;
• enforce brand safety, creative quality, and advertising policies;
• invoice, reconcile, and manage our business relationships;
• maintain, troubleshoot, and improve the Platform; and
• comply with legal obligations, honor privacy choices, and enforce our agreements.

We do not use information processed through the Platform to make eligibility decisions about any individual regarding employment, credit, insurance, housing, education, or healthcare treatment.

5. How We Disclose Information

We disclose information as follows:

• Demand Partners. We send Bid Request data, including hashed NPIs where applicable, to Demand Partners so that they can decide whether to bid and deliver ads. Our contracts limit Demand Partners’ use of this data to advertising, measurement, and reporting purposes. They also prohibit Demand Partners from using hashed NPIs to identify, target, or re-identify consumers or patients, or from combining them with consumer or patient personal information.
• Supply Partners. We provide Supply Partners with reporting on the advertising delivered to their properties.
• Service providers. We use vendors that provide technology infrastructure, hosting, ad serving, invalid traffic detection, and similar services on our behalf. These vendors may process information only as needed to provide those services.
• Identity and data partners. We work with identity resolution and healthcare professional data providers to associate Bid Requests with HCP professional identities and attributes, as described in Section 3.2.
• Legal and safety. We may disclose information when we believe in good faith that it is required by law, subpoena, or court order, or that it is needed to protect the rights, property, or safety of Pine Lake, our partners, or others.
• Corporate transactions. Information may be transferred in connection with a merger, acquisition, financing, or sale of all or part of our business, subject to this Policy.

6. Healthcare Professional Information

The Platform is designed to support advertising to HCPs in their professional capacity, such as communications about therapies, medical devices, and clinical resources relevant to their practice. An NPI identifies a provider, not a patient, and it is publicly available through NPPES. Even so, we handle NPI-associated data with care:

• NPIs are transmitted only in hashed form;
• NPI-associated data is used only for professional advertising, measurement, and reporting, and is never used to target, profile, or re-identify consumers or patients;
• Demand Partners may share NPI-level reporting only with their advertiser and agency clients, on a need-to-know basis and under confidentiality and use restrictions; and
• Demand Partners must comply with applicable healthcare advertising laws, including state laws governing the use of prescriber data.

NPI Suppression Requests

If you are a healthcare professional and do not want your NPI used for advertising through the Platform, you may ask us to suppress it. Email privacy@pinelake.media with the subject line “NPI Suppression Request” and include your full name and NPI. We will verify the request and add your NPI to a suppression list. Once added, your hashed NPI will no longer be associated with Bid Requests or sent to Demand Partners through the Platform. Suppression does not stop you from seeing ads, but those ads will not be selected based on your professional identity through the Platform.

7. Sale, Sharing, and Targeted Advertising

Under certain U.S. state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (the “CCPA”), making Bid Request data and hashed NPIs available to Demand Partners for targeted advertising may be considered a “sale” or “sharing” of personal information, or processing for “targeted advertising.”

Pine Lake honors opt-out choices as follows:

• Opt-out preference signals. We honor GPC signals and opt-out signals communicated through the IAB Global Privacy Platform or U.S. Privacy strings in Bid Requests. When a Bid Request carries a valid opt-out signal, we do not use or disclose the associated data for targeted advertising. This includes not associating a hashed NPI with that request.
• Direct requests. You may also submit an opt-out request to privacy@pinelake.media. Because we do not set cookies or maintain consumer accounts, we may ask for information such as an IP address, mobile advertising identifier, or, for HCPs, an NPI, so that we can apply your request.

Pine Lake does not sell personal information of individuals we know to be under 16 years of age.

8. Consumer Health Data

Pine Lake does not collect, create, infer, or share consumer health data, as that term is defined under Washington’s My Health My Data Act, Nevada SB 370, and similar state laws. We do not build or pass health-condition or health-interest audience segments about consumers or patients, and we do not use geofencing around healthcare facilities. Professional attributes associated with HCPs, as described in Section 3.2, relate to the HCP’s professional practice and not to the HCP’s own health.

9. Children’s Information

The Platform is designed for professional healthcare audiences and is not directed to children. Pine Lake does not knowingly collect personal information from children under 13 or use information from child-directed properties for targeted advertising. Bid Requests flagged as child-directed under the Children’s Online Privacy Protection Act (COPPA) are not used for targeted advertising and are not associated with hashed NPIs.

10. Data Retention

We keep information only as long as reasonably necessary for the purposes described in this Policy, in line with the following schedule:

11. Data Security

We use administrative, technical, and physical safeguards designed to protect information processed through the Platform. These include encryption in transit, hashing of NPIs, access controls limited to authorized personnel, and contractual security obligations on our service providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Your Privacy Rights

Depending on your state of residence, including California, Colorado, Connecticut, Delaware, Indiana, Kentucky, Montana, New Jersey, Oregon, Rhode Island, Texas, Virginia, and other states with comprehensive privacy laws, you may have the right to:

• Know and access the personal information we have processed about you;
• Correct inaccurate personal information;
• Delete personal information;
• Obtain a copy of your personal information in a portable format;
• Opt out of the sale or sharing of personal information, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects; and
• Appeal our decision on a request you have made.

How to Submit a Request

To exercise these rights, email privacy@pinelake.media or write to us at the address in Section 17. You may use an authorized agent where state law allows, and we may ask for proof of the agent’s authority.

Verification

The information we process is pseudonymous: it is linked to device, browser, or hashed professional identifiers rather than to names or contact details. To find and act on your information, we may ask for an IP address, a mobile advertising identifier, or, for HCPs, an NPI. If we cannot reasonably link your request to information we hold, we will tell you. We will respond within the time required by applicable law, generally within 45 days, which may be extended where permitted.

Appeals and Non-Discrimination

If we deny your request, you may appeal by replying to our decision with the subject line “Privacy Request Appeal.” We will respond within the time required by law. If your appeal is denied, you may contact your state Attorney General. We will not discriminate against you for exercising any of your privacy rights.

13. Additional Disclosures for California Residents

In the preceding 12 months, we have collected the following categories of personal information, as defined under the CCPA, from the sources and for the purposes described in this Policy:

We do not collect sensitive personal information, as defined under the CCPA, for the purpose of inferring characteristics about consumers. We have not knowingly sold or shared personal information of consumers under 16 years of age.

14. Supply Partner Responsibilities

Supply Partners that integrate with the Platform agree to:

• provide legally required notices and obtain any legally required consents from users of their properties, including notice that data is shared with advertising technology partners such as Pine Lake;
• pass accurate privacy signals, including GPP strings, GPC signals, and child-directed flags, in each Bid Request;
• send hashed NPIs only where they have the right to do so, and only for HCPs acting in their professional capacity; and
• not send consumer or patient contact information, PHI, consumer health data, or data from properties directed to children for targeted advertising.

15. Industry Standards

Pine Lake aligns its practices with the principles of the Network Advertising Initiative (NAI) and the Digital Advertising Alliance (DAA), and supports IAB Tech Lab standards, including OpenRTB, ads.txt, sellers.json, and the Global Privacy Platform.

16. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will post the updated Policy on our website and revise the “Last Updated” date above. If we make material changes, we will provide additional notice to Supply Partners and Demand Partners as appropriate.

17. Contact Us

If you have questions about this Policy or our privacy practices, or wish to exercise your rights, please contact us:

Pine Lake Media, LLC
Attn: Privacy
8 The Green, STE B
Dover, DE 19901
Email: privacy@pinelake.media