Get a demo

Data Product Privacy Policy 

Updated: October 17, 2025 

About PurpleLab

PurpleLab® (“PurpleLab,” “we,” or “us”) is a health-tech company driven by one clear philosophy: outcomes matter most. As a trusted partner for real-world data and analytics, we help healthcare and life sciences organizations and the technology and consulting companies that serve them drive decisive action based on precise insights—with the ultimate goal of giving everyone a fighting chance at the best possible health outcome — because data drives better outcomes. 

This Data Product Privacy Policy describes how PurpleLab collects, uses, discloses, and protects information used in our data products and analytics services including our Healthcare Provider Audiences (“HCP Audience”) and Direct-to-Consumer Audiences (“DTC Audience”) products (collectively, the “Data Products”).

Scope of this Policy

This Data Product Privacy Policy describes how PurpleLab collects, uses, and discloses information in connection with our Data Products. 

This policy does NOT cover:

  • Information collected through our website or as part of our business practices (covered by our Corporate Privacy Policy)
  • Information we process on behalf of PurpleLab customers as a service provider (covered by separate agreements)
  • Employee or job applicant information

The Information We Collect and How We Use It

We’ve designed our Data Products with data minimization principles in mind. Our Data Products are sourced from data that’s been de-identified under strict HIPAA standards. As further explained below, the information underlying our Data Products and any DTC Audiences generated do not include information that is identifiable to PurpleLab. Certain advertising partners we work with may be able to combine the “modeled” data we disclose to them with other data to re-identify such disclosed data.  (This does not involve re-identification of data subject to HIPAA.)  We offer consumers tools to communicate their preferences to our advertising partners, such as a desire to opt out of advertising. Below, we explain the types of data in our Data Products.

De-Identified PurpleLab CLEAR Claims Data 

While this Privacy Policy does not apply to de-identified data, the foundation of our Data Products is built from de-Identified data. In the interest of transparency, we provide this information on how we source the de-identified data that we use to generate our Data Products. This data may include de-identified: 

  • Prescription claims data such as National Drug Codes (“NDC”), date filled, day’s supply and quantity, prescriber and pharmacy NPI (as defined below), and information related to payment.
  • Medical claims data such as diagnoses, procedures, provider NPI, and service dates, 
  • Laboratory and clinical data such as vital signs, lab results, and clinical notes, 
  • Demographic information such as gender, geographic region, and other social determinants of health (SDOH)

We harmonize this data using PurpleLab’s proprietary CLEAR (Comprehensive Layout for Exploration, Analysis & Research) methodology which results in a de-identified data set.

PurpleLab’s CLEAR Claims Data has been certified by qualified expert statisticians to meet HIPAA’s de-identification standards under the Expert Determination method (45 CFR § 164.514(b)(1)). We commit to maintain and use the CLEAR Claims Data in de-identified form and not to attempt to reidentify the information, except we may attempt to reidentify the information solely for the purpose of determining whether our de-identification processes satisfy applicable law.

Because CLEAR Claims Data is de-identified, we may process and disclose such data without restriction, and this Privacy Policy does not apply to CLEAR Claims Data.

Identifiable Healthcare Provider (HCP) Information 

Our Data Products include our HCP Audience product. While CLEAR Claims Data has been de-identified subject to HIPAA standards, such de-identified data may be associated with healthcare provider identifiers.  For example, de-identified medical claims data may contain provider identifiers associated with the medical claim, such as the National Provider Identifier (NPI) Number, which is made publicly available by the U.S. Centers for Medicare & Medicaid Services (CMS).  

PurpleLab also may either receive from publicly available resources or license additional information (“Additional HCP Data”) about healthcare providers to support or enhance some of our Data Products. This information may include data such as provider email addresses.  

We may collect data about HCPs to link the HCP with data sets, insights, and reports or to reach the HCP with advertising or other messaging (such as information relating to a clinical trial) or to provide reporting about healthcare outcomes.  

If you are a healthcare provider and wish to exercise your data subject rights with respect to the Additional HCP Data, please click here. 

Healthcare Advertising

Our Data Products also include our DTC Audience product. Using insights gathered from our CLEAR Claims Data, PurpleLab creates audiences of tokenized records to support healthcare and life sciences organizations’ outreach and marketing efforts. 

DTC Audiences are created by applying proprietary and patent-pending data modeling techniques to CLEAR Claims Data. The tokenized audiences generated from CLEAR Claims Data (“DTC Audiences”) are not individually identifiable to PurpleLab.

DTC Audiences are distributed through technology and consulting companies that provide services to healthcare and life sciences organizations (“Partners”).  Partners may maintain information that enables them to associate pseudonymous identifiers in DTC Audiences with identifiable information for advertising purposes.  Our DTC Audiences consist of tokens and do not reveal specific diagnoses or health conditions of any individual, or any information subject to HIPAA.  Instead, our DTC Audiences provide Partners with modeled audiences with potential interests in certain health topics, including conditions and treatments. The DTC Audiences allow healthcare and life sciences organizations to reach individuals who may be interested in relevant healthcare information.

As part of our data minimization efforts, PurpleLab’s tokenization process results in DTC Audiences that are not re-identifiable to PurpleLab.  Because of this technical limitation, we cannot process data subject requests, including requests to opt out of the “sale,” “sharing,” or processing of personal information for “targeted advertising” directly.  However, data subjects have the ability to opt-out of our Audience Products through our Partners.

If you wish to opt-out of Audience Products through our Partners, please click here. 

In addition to the uses described above, we may also use Healthcare Provider Audience data and DTC Audience Data for the following purposes:

  • Analyze, maintain, and improve our products and services;
  • Secure our products and services;
  • Comply with legal obligations, legal process, and protect the rights, safety, or property of us, our affiliates, or any other party;
  • Prevent fraud and criminal activity; and
  • As otherwise authorized under applicable law.

Aggregated & De-Identified Data: The above uses relate to identifiable data. We may also de-identify (i.e. anonymize) and/or aggregate data such that it can no longer be associated with an individual, including by any of our Partners. We may use and disclose the aggregated information for our legitimate business purposes without any restrictions.

When We Disclose Information We Collect

We may disclose all information subject to this Privacy Policy in the following circumstances:

  • Vendors and Service Providers: We may disclose data to service providers, who provide services or functions on our behalf, such as data hosting providers. 
  • Business Transfers: If we are involved in a merger, acquisition, financing due diligence, reorganization, dissolution, bankruptcy, receivership, sale of all or a portion of our assets, or transition of service to another provider (collectively a “Transaction”), data may be disclosed in the diligence process with counterparties and others assisting with the Transaction and transferred to a successor or affiliate as part of that Transaction along with other assets.
  • Legal Requirements: If required or permitted to do so by law or in the good faith belief that such action is necessary to (i) comply with a legal obligation, including to meet national security or law enforcement requirements (which may include lawful access by U.S., Canadian or foreign courts, law enforcement or other government authorities), (ii) protect and defend our rights or property, (iii) prevent fraud, (iv) act in urgent circumstances to protect the personal safety of the public, or (v) protect against legal liability.
  • Affiliates: We may disclose data to our affiliates, meaning an entity that controls, is controlled by, or is under common control with PurpleLab. Our affiliates may use the data we disclose in a manner consistent with this Privacy Policy.
  • Your Consent: If you have consented to our disclosure of your information for other purposes not listed above, we will also disclose your information consistent with your consent. 

Security

We use safeguards designed to preserve the integrity and security of the information subject to this Privacy Policy. However, no security measures are perfect, so we cannot ensure or warrant the security of any information you transmit to us or guarantee that information subject to this Privacy Policy may not be accessed, disclosed, altered, or destroyed.

Data Retention

We keep data subject to this Privacy Policy for as long as reasonably necessary for the purposes described in this Privacy Policy, while we have a business need to do so, or as required by law (e.g. for tax, legal, accounting, or other purposes), whichever is longer.

Your Privacy Rights and Choices

Depending on your jurisdiction, you may have the right, in accordance with applicable data protection laws, to make requests related to your “personal information” or “personal data” (as such terms are defined under applicable law, and collectively referred to in this section as “personal information”). We are unable to honor requests where we do not maintain information for which we can identify you. Below, we explain the rights that may be available to you, along with 

Specifically, you may have the right to ask us to:

  • Inform you about the categories of personal information we collect or disclose about you; the categories of sources of such information; the business or commercial purpose for collecting your personal information; and the categories of unaffiliated parties with whom we disclose personal information.
  • Provide you access to and/or a copy of certain personal information we hold about you.
  • Correct or update personal information we hold about you.
  • Delete certain personal information we have about you.
  • Opt you out of the processing of your personal information for purposes of profiling in furtherance of decisions that produce legal or similarly significant effects, if applicable.
  • Revoke your consent for the processing of your information.

Please note that certain information may be exempt from such requests under applicable law. We may need to take reasonable steps to verify your identity before responding to a request, which may include, depending on the sensitivity of the information you are requesting and the type of request you are making, verifying your name and email address. If we are unable to verify your identity, we may be unable to respond to your requests.

As provided in applicable law, you also have the right to not be discriminated against for exercising your rights. You may be able to designate an authorized agent to make requests on your behalf. In order for an authorized agent to be verified, you must provide the authorized agent with signed, written permission to make such requests or a power of attorney. We may also follow up with you to verify your identity before processing the authorized agent’s request as permitted by applicable law. 

Depending on applicable law, you may have the right to appeal our decision to deny your request, if applicable.  You may do so through the email address privacy @purplelab.com.

As explained above, PurpleLab’s data minimization practices result in data that is not identifiable to PurpleLab. CLEAR Claims Data and DTC Audience data are not re-identifiable to PurpleLab. PurpleLab is able to identify Healthcare Providers and personal information associated with Healthcare Providers. If you are a Healthcare Provider, you may exercise your rights Here.

Laws of your jurisdiction may also allow you to opt out of the “sale,” “sharing,” or processing of your personal data for targeted advertising. We may provide identifiable information about Healthcare Providers (such as a name, email address, and potential interests) to other parties for purposes of advertising. We may also provide DTC Audiences to Partners for advertising purposes. These DTC Audiences may include information about potential interests, including in healthcare information and treatments. As explained above, PurpleLab does not maintain information that allows it to identify any consumer in a DTC Audience. If you are a Healthcare Provider, you may opt out of the “sale,” “sharing,” or processing of your personal data for targeted advertising Here.