MDA Foundation logo

PRIVACY NOTICE

This Privacy Notice was last updated October 19, 2026.

For any questions or concerns relating to data privacy, please contact:

Michigan Dental Association Foundation
Attn: Data Privacy
3657 Okemos Road., Ste. 200
Okemos, MI 48864
[email protected]

Michigan Dental Association Foundation (“MDAF,” “we,” “us,” or “our”) respects the privacy of our users and all those who submit personal information to MDAF through this website or by other means. Accordingly, we have provided this privacy notice (“Notice”) to inform you, the user (“you” or “user”) of how we collect, use, share, store, and protect your personal information. A copy of this Notice can be further found at: Privacy Policy — Michigan Dental Association Foundation. By using or accessing MDAF’s website (“Website”) or otherwise submitting your personal information to us through webforms, hard copies, email, fax or any other medium, whether electronic, auditory, visual, or physical, you acknowledge that you have read this Notice. Your use of the Website is also subject to our Terms of Use. Capitalized terms used in this Notice but not defined here, including “HERM-E,” “BettyAI,” “Input,” and “Output” have the meanings given in the Terms of Use. If you do not agree to the terms of this Notice, do not continue to use the Website or any of MDAF’s services, and do not provide us with your personal information at any time.

Collection of Your Information

When you use the Website or MDAF’s services you may choose to provide MDAF with certain personal information (“PI”). Other PI may be automatically collected by your use of the Website and certain webforms and chatbots (including HERM-E) therein. Further, we may collect other information about your use of the Website that is not PI. Generally, PI means information about an individual who can be identified from use of that information (or from that information when combined with other information in our possession or likely to come into our possession), including information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Specific types of PI include names, social security numbers, unique identifiers (such as user names and account log-in credentials), physical addresses, mailing addresses, cookies, geolocation data, phone numbers, and IP addresses. PI does not include aggregated or anonymized data, or data that is otherwise specifically excluded from current data privacy laws.

In the interest of providing transparency to our users, we have provided the following list of the categories of PI that we collect, and some examples of the personal information that would fall into each category. We collect the categories of PI listed below when you use the Website, submit webforms, submit payment information, submit emails or faxes, submit hard copies of documents, or submit PI through any other medium, whether electronic, auditory, visual, or physical. Where applicable law requires your separate consent to the collection or use of particular PI (for example, certain sensitive information), we will request it separately, and you may decline. Except for our collection of your browser data through cookies and pixels when you visit our Website, we only collect PI you voluntarily provide to us, either through your submission of PI (i) through web forms, member account pages and chat widgets on our Website, (ii) via email or fax to one of MDAF’s employees or agents, (iii) by phone to one of MDAF’s employees or agents, (iv) via hardcopy to one of MDAF’s employees or agents, (v) through any means to our third-party marketing vendors, and/or (vi) to HERM-E, including Input processed by BettyAI:

  • Personal Identifiers — (Name, phone number, email, fax number, date of birth, MDA Number, Social Security Number, education, employment history, medical and health insurance status, medical and health information, and mailing address):
    • We may use Personal Identifiers to (i) improve our services and offerings, to inform you about our services or service updates, (ii) conduct recruitment and retention campaigns via phone, email, fax or hardcopy, (iii) provide individualized help and care to our members and other users, (iv) underwrite insurance applications and prepare insurance quotes, (v) comply with applicable laws, legal processes, or regulations, as well as law enforcement authorities, other government officials or other third parties pursuant to a subpoena, a court order or other legal process, and/or (vi) protect the vital interests of a person, to protect our property, services, and legal rights, and to support our audit, compliance, and governance functions.
    • Personal Identifiers may include Sensitive Personal Information (SPI), such as Social Security numbers, financial account information, and health-related information, which are given heightened protection as applicable under state and/or federal law. We implement enhanced protections for such information, including encryption and restricted access protocols.
  • Customer Records — (Name, mailing address, ACH, routing number, bank account number, and credit card numbers (credit card data is collected through third-party payment processors such as Authorize.net and Stripe; however, other than the physical storage of the last four digits of your credit card number in cases where credit card information is submitted by phone or physical copy, this data is not retained by MDAF, and the payment processors’ handling of that data is governed by their own privacy notices)):
    • We may use Customer Records to (i) process payments for membership dues, online orders, continuing education classes, insurance coverage, and other services or offerings (ii) improve our services and offerings, to inform you about our services or service updates, (iii) provide individualized help and care to our members and other users, (iv) comply with applicable laws, legal processes, or regulations, as well as law enforcement authorities, other government officials or other third parties pursuant to a subpoena, a court order or other legal process, and/or (v) protect the vital interests of a person, to protect our property, services, and legal rights, and to support our audit, compliance, and governance functions.
  • Usage Data — (IP address, pixels, unique device identifier cookies, location data, website interactions, and first party cookies which track: advertising conversions, website direction tracking, operating systems used to access website, browser types, and languages):
    • We may use Usage Data to (i) provide the services you have requested or authorized and to help us manage the availability and connectivity of the Website, (ii) improve our services and offerings, (iii) inform you about our services or service updates, and to provide individualized help and care to our clients, (iv) analyze your responses to certain web traffic and prompts, (v) and/or (vi) create targeted marketing based on your use of the Website and our services.
  • Geolocation Data — During your use of the Website, we collect your location information through your device’s IP address. We do not collect precise (street-level) geolocation data:
    • We may use Geolocation Data to (i) improve our services and offerings, to inform you about location-specific payment services or payment service updates, (ii) provide region-specific targeted advertisements, (iii) provide individualized help and care to our members and other users, (iv) comply with HIPAA and HIPAA-HITECH, and other laws, legal processes, or regulations, as well as law enforcement authorities, other government officials or other third parties pursuant to a subpoena, a court order or other legal process, and/or (v) protect the vital interests of a person, to protect our property, services, and legal rights, and to support our audit, compliance, and governance functions.
  • Commercial Data — (data relating to your inquiries about services, purchases, service requests):
    • We may use Commercial Data to (i) improve our Website, services and offerings, (ii) inform you about our services or service updates, and (iii) provide individualized help, care, and targeted services and advertisements to our clients.
  • Account Data — (member account user name, password, membership type and status, and account activity):
    • We may use Account Data to authenticate you, provide access to member-only content and services, administer your membership, and maintain the security of the Website and your account.
  • HERM-E Data — (Input you submit to HERM-E, Output generated, and related technical information such as date, time, device, and browser information):
    • We and the BettyAI may use HERM-E Data to operate, maintain, secure, improve, and train HERM-E, as described under “Use of HERM-E” below and in our Terms of Use.

MDAF’s Use and Sharing of PI

Other than as specifically outlined above, and excepting the broader use of aggregated data as discussed below, we also generally use the PI we collect in one or more of the following ways:

  • Website Administration;
  • Administering your membership and member account;
  • Marketing and Advertising;
  • Recruiting;
  • Underwriting;
  • To improve functionality and our service offerings;
  • Operating, securing, and improving HERM-E;
  • To coordinate with various government agencies and municipalities, as well as private security;
  • To comply with HIPAA and HIPAA-HITECH, as well as any applicable laws or regulations;
  • In response to a subpoena, a court order, or other legal process; and/or
  • As part of a sale, merger, reorganization, or restructuring.

As a general rule, we may share PI if we reasonably believe disclosure is necessary or appropriate to protect the rights, property, or safety of us, our clients, or others. Further, certain aspects and components of our services are performed through contracts with outside persons or organizations, such as website hosting and technology, member account and communications platforms, payment processing, marketing, analytics and advertising, insurance program administration, accreditation, legal and other professional services, and BettyAI. At times it may be necessary for us to provide your PI to one or more of these outside persons or organizations who assist us with our operations.

This Notice does not restrict our collection, use, or disclosure of any aggregated information or information that does not identify, or cannot be reasonably linked to, any individual. For example, we may choose to share aggregated data with unaffiliated third parties, in an anonymous form that does not allow the third party to associate the information we shared as being your PI.

To be clear, other than as described herein, we will not collect additional categories of PI or use the PI we collect for materially different, unrelated, or incompatible purposes without providing you notice. Except as described in this Notice, we do not sell your PI to any third parties. You have the right to opt-out of marketing communications and the sharing of your contact information with other organizations by contacting us, as explained below.

Your Rights and Responsibilities

If you wish to contact us, please use the means listed at the beginning of this Privacy Notice. While MDA and its affiliates take measures to protect PI, no security measure or network is entirely secure, as further explained below. Your password for your member account should be complex and should never be shared with anyone, and should be changed from time to time. After you access MDA or affiliate resources, you should log off and exit your browser and/or application so unauthorized persons cannot access the resources.

If you do not want to receive postal mail, telephone calls from us in the future, or if you do not want us to share your contact information in the manner described in this Privacy Notice, please provide us with your exact name and postal addresses, phone and fax numbers and, if appropriate, MDA membership information to [email protected]. It may take up to four weeks for your opt out to become effective. While we will continue to share information we maintain about you with our service providers, subsidiary and affiliates, and with state and local societies, we will take reasonable steps to ensure that any other specific contact information you so identify is removed from lists we share with other organizations. We have instituted opt-out capabilities to help you avoid receiving unwanted commercial email messages from the MDAF. MDAF will honor such requests within ten business days. On request, and after we verify your identity, we will make reasonable efforts to provide you with access to information that you submitted to MDAF, such as certain transaction information (e.g., dates on which you made purchases, amounts and types of purchases), communications that you have directed to our site (e.g., emails, user inquiries), and contact information (e.g., name, address, phone number). On request we will also make reasonable efforts to correct inaccuracies in contact information, financial information, unique identifiers, transaction information and certain other data. We will respond within a reasonable time. We may decline a request where permitted or required by law (for example, where we must retain records or where disclosure would reveal another person’s information). We extend these access, correction, and deletion options to all users voluntarily.

In addition to the other rights we note in this Privacy Notice, you also have the right to contact the MDAF to obtain the following information:

  1. What personal information about you the MDAF holds;
  2. For what purposes does MDAF process your information;
  3. To what third parties (and in what jurisdictions) has or may the MDAF disclose your personal information;
  4. How long will your data be maintained by the MDAF (and how that period of time has been calculated);
  5. How to request correction or deletion of specific portions of your personal data held by the MDAF that you believe are incorrect; and
  6. The source(s) from which the MDAF has obtained your personal data.

You may also contact us at [email protected] if you believe your information is being used improperly.

You may provide consent to additional uses and disclosures; for example, in connection with a product or service offered by the MDAF, an affiliated entity, or a third party.

Use of HERM-E

The Website may include an AI-powered knowledge assistant called HERM-E provided through a third-party service provider BettyAI, as described in our Terms of Use. When you use HERM-E, we and BettyAI receive the information you enter (“Input”) and the responses generated (“Output”), together with related technical information such as the date and time of use and your device and browser information. We and BettyAI may use Input to operate, maintain, secure, improve, and train HERM-E, and BettyAI may be able to view Input. Input is retained as described under “Retention of Information” below. Do not enter protected health information, patient-identifiable information, Social Security numbers, financial account numbers, passwords, or other confidential or sensitive information of any person into HERM-E; our Terms of Use prohibit it, and information you enter may lose its confidential status. Output may be inaccurate and is not professional, medical, dental, or legal advice. BettyAI’s own terms and privacy practices also apply to your use of HERM-E; as between you and MDAF, if they conflict with our Terms of Use, our Terms of Use control. MDAF is not responsible for the acts, omissions, or data practices of BettyAI.

Health and Other Sensitive Information

MDAF is not a “covered entity” under the Health Insurance Portability and Accountability Act (“HIPAA”), and this Notice is not a HIPAA notice of privacy practices. Health-related information that you provide to MDAF is handled as described in this Notice rather than under HIPAA. If you are a health care provider or other HIPAA-regulated entity, you remain responsible for your own HIPAA compliance, and you should not send us protected health information or patient information through the Website, webforms, chat widgets, email, or HERM-E. We collect Social Security numbers, financial account information, and other sensitive information only where reasonably needed for a specific purpose, such as processing payments or administering a membership program, and we protect it as described under “Security” below.

Security

In compliance with applicable law and industry standards, we have put in place reasonable physical, electronic, and administrative procedures to safeguard the PI we collect. The PI we directly collect is stored on our cloud-based network, unless stored on third-party servers or third-party cloud-based networks. We take reasonable steps and regularly assess our privacy and security policies and procedures and comply with laws designed to protect the privacy and security of your PI, including (i) encryption during transfer through the Secure Transport Layer Security (TLS) protocol, and (ii) encryption at rest. We also (i) conduct annual security audits in an effort to further protect PI from breach, loss, or unauthorized access, and (ii) mandate that our employees undergo annual privacy and security training. Unfortunately, transmission of information via electronic or physical means is not completely secure; accordingly, we cannot guarantee the security of any such information. Please take care when sending PI to us, particularly by email or fax, which are not secure methods of transmission. If a security breach affects your PI, we will notify you as required by applicable law, including Michigan’s Identity Theft Protection Act.

Retention of Information

We will retain your PI only for as long as is necessary for the purposes set forth herein, which shall be at least as long, but in no way limited to, the time that you use the Website or our services. Specific retention schedules vary by data type and category. If you would like us to delete your data before our internally designated purge date, you may request that we do so. However, we may retain and use your PI to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

Cookies

Our Website uses cookies and pixels to track your activity on the Website and to hold certain information. Cookies are small files placed on your device. Cookies help analyze Website traffic, provide information about your use of the Website, and help the Website work more efficiently by responding to you as an individual (such as tailoring operations to your needs, likes and dislikes by gathering and remembering your preferences). Pixels collect information about your activity, browser, and device, as well as information about when you interact with services we offer through one of our Linked Websites, such as advertising and commerce features. You can manage your cookie preferences through your browser settings and opt-out of tracking by contacting us. Third-party advertising and analytics providers may collect information about your activity through these technologies and may use it in accordance with their own privacy notices.

Do Not Track Signals and Requests

“Do not track” signals and requests are sent from your browser to websites you visit indicating you do not want to be tracked or monitored. In most circumstances you need to affirmatively elect to turn on the “do not track” signals or requests. Websites are not required to accept these signals or requests, and many do not. At this time, neither our Website nor the widgets existing therein honor “do not track” signals or requests.

Information About Other People

Please submit another person’s PI to us only if you are authorized to do so. Additional terms governing the information you submit are in our Terms of Use.

Linked Websites

We provide links to other websites for informational purposes and for your convenience (collectively “Linked Websites”). Linked Websites are independent from our Website and are not governed by this Notice. We do not review, maintain, endorse, or control the Linked Websites or the information, software, products, or services available on the Linked Websites. We also have no control over the Linked Websites’ privacy policies or posted privacy notices. Access or use of any of the Linked Websites is entirely at your own risk. If you have any questions about a Linked Website’s privacy policies or notices, you should contact them directly.

Separately, we use third-party service providers and embedded technologies on the Website that collect or receive PI on our behalf or through the Website. These include providers of website hosting and security; member account and customer-relationship management; email and marketing communications; payment processing; analytics and advertising (including cookies and pixels); continuing education and event services; and AI TOOL. The providers may include but are not limited to: Sharpspring, Novi, American Dental Association, BettyAI, Marketing General Incorporated, Web Ascender, Hubspot, Google Analytics, Google Tag Manager, Facebook Pixels, Google Adsense, Cloudflare, Authorize.net., and Stripe. These providers are not Linked Websites, and our description of how PI is collected, used, and shared in this Notice applies to PI they collect through the Website. Their own privacy notices may also apply.

International Transfers and Processing of PI

We store information received through or by our Website in our cloud server hosted in the United States. If you are providing the information from another country, you understand that the information will be transferred, stored and used in the United States. The Website is directed to users in the United States, and we do not intend to offer our services to individuals in the European Economic Area, the United Kingdom, or Switzerland.

Protection for Children (Minors)

The Website is not directed to children, and we do not knowingly collect PI from children under the age of 13, in compliance with the Children’s Online Privacy Protection Act (COPPA). If we become aware that PI from a minor under 13 has been collected, we will use all reasonable efforts to delete such information. We also retain the right to limit or preclude access to persons under the age of 18 and to delete the data of persons under the age of 18.

Changes to the Notice

We reserve the right, at our sole discretion, to amend this Notice at any time. If at any time in the future we plan to use PI in a way that differs from what is described in this Notice or choose to amend this Notice, we will post those changes on the Website. We may notify you of changes to this Notice via email. Your continued use of the Website or MDAF’s services following the posting of any changes to this Notice constitutes affirmative acceptance of those changes.