Last updated on October 3, 2026

This Privacy Statement describes how Christiana Care Health System, Inc. and its affiliates and subsidiaries (“ChristianaCare”, “we”, “our”, or “us”) collects, uses, retains and shares personal information when you interact with us through our websites, (the “Website[s]”), our mobile applications, and online or mobile-enabled technology and digital tools that display or link to this Privacy Statement (collectively, the “Platforms”), and when you otherwise interact with us (the “Services”).

For information on how we use individually identifiable information that you provide to us for purposes of obtaining medical care through the Platforms and Services (which is also referred to as “Protected Health Information” or “PHI”), which are subject to the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”) see our HIPAA Notice of Privacy Practices (“HIPAA Notice”). Our HIPAA Notice describes how we can use and disclose your PHI and your rights with respect to your PHI. If there is a conflict between this Privacy Statement and the HIPAA Notice, the HIPAA Notice will apply. The HIPAA Notice does not apply to information that is not PHI.

When you interact with our Platforms and Services, we collect your Personal Information. “Personal Information” is information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household.

We collect personal information when you:

• Contact us. When you email or call us, for example, to ask questions regarding our products and services, we collect from you, your personal identifiers (name, email address, or telephone number) and anything else you choose to include in your message. We use this information to respond to your questions or inquiries, troubleshoot where necessary, or address any issues you have with the Platforms and Services. We may record and retain your phone calls and use them for quality assurance purposes.
• Create a MyChart account. When you create an account with ChristianaCare MyChart, our patient portal, we collect from you your personal identifiers (name, home address, email address, telephone number(s), and date of birth), and your sensitive data (last four digits of your Social Security number). We use this information to create and manage your patient account. We use this information to create and manage your patient account. We use your email address and password to authenticate you for subsequent logins and to communicate with you about your appointments. We use your insurance information to submit the payment to insurance. We use your payment information to facilitate payments not covered by insurance. Your patient portal login information is PHI and is used and disclosed as permitted under HIPAA as described in our HIPAA Notice.
• Book an appointment. When you book an appointment, we collect from you, your personal identifiers (name, email address, date of birth, telephone number, digital signature, and physical address) through our Patient Portal. We use this information to schedule and fulfill your appointment request, and to communicate with you about your appointment. This information is PHI and is used and disclosed as permitted under HIPAA as described in our HIPAA Notice.
• Submit a payment. When you submit a payment, our payment processor collects from you, your personal identifiers (name, email address, telephone number, and physical address) and sensitive financial information (payment card number, CVV, and expiration date) through our third-party payment processors. The information is used to process your payment for the requested product or treatment, fulfill and manage purchases, orders, and payments. This information is PHI and is used and disclosed as permitted by HIPAA as described in our HIPAA Notice.
• Participate in surveys or questionnaires. If you choose to complete a survey or questionnaire, we collect from you, your personal identifiers (e.g., name, date of birth, mailing address, email address, phone number, administrative sex, primary language, race, ethnicity, and marital status) through our third-party vendors who collect your answers to the survey. We use this information to help us improve the quality of our products, Platforms, and Services. If you participate in a survey that collects PHI, the PHI is used and disclosed as permitted under HIPAA as described in our HIPAA Notice.
• Visit our facilities. When you visit our facilities, we collect from you, your visual information (video recording) through our video surveillance cameras. We do not collect audio through surveillance cameras. We use this information to maintain the security of our facility, as well as the safety of our patrons and personnel. We retain this information for 90 days or in accordance with ChristianaCare policies and applicable law by evaluating: (i) whether there is a retention period required by statute or regulations; (ii) the existence of actual or threatened litigation for which we are required to preserve the information; (iii) the statutes of limitations for potential legal claims; and (iv) generally accepted best practices in our industry, including related to the safety and security of our properties, assets, employees, patients, and visitors.
• Participate in telehealth. When you schedule or participate in a telehealth appointment, we collect from you, your personal identifiers (name), your audiovisual information (video and audio of you) and any medical information you provide when scheduling or participating in your telehealth session. We use your name and geolocation information to identify you for the telehealth visit and to ensure that we comply with state requirements to connect you with a medical practitioner in the state where you are currently located. Your audiovisual information is used to communicate with the medical practitioner. Your medical information is PHI, which is used and disclosed as permitted under HIPAA as described in our HIPAA Notice.
• Added to our newsletter. When you are added to our newsletter, we collect, from you, your personal identifiers (name, email address). We use this information to send you our newsletter. You may revoke your consent at any time with effect moving forward by clicking the “unsubscribe” link included within each email we send to you. However, we will continue to send you service-related messages.
  
  We, through our service provider, use tracking pixels to determine whether you open emails, the time of opening, information about the device you use (including IP address), whether you interacted with the email, the topic of the email, whether it was delivered, sender and recipient addresses. We use this information to:
  • (1)    measure the effectiveness of our communications and make them more attractive, particularly by improving email subject lines
  • (2)    limit the frequency of sending or stop it, ensuring emails continue to reach their recipients
  • (3)    detect and analyze suspected fraud
  • (4)    personalize communications based on your interest in received emails and interaction with them. This personalization includes adapting message content, adjusting sending frequency or communication channel, and optimizing campaigns based on reactions (e.g., adjusting email subject lines)
  • (5)    offer tailored content or advertisements on other websites, applications, or communication channels
    
    You can avoid downloading the pixel by rejecting the download of images in the email.
• Make a donation. When you donate, we collect from you, your personal identifiers (name, email address, telephone number, physical address, and tribute information, if you choose to provide them), and your sensitive financial information (bank account information, payment card number, CVV, and expiration date). We use this information for tax purposes, to process your donation to ChristianaCare, and we use your identifiers to communicate our appreciation for your donation. Upon donating, your information is added to our donor communications list where you may receive additional information about how your donation helps ChristianaCare and other causes you may consider supporting at ChristianaCare. You may opt out of these communications at any time by clicking the “Unsubscribe” link at the bottom of each email we send you. For more information on the use and processing of your information for these communications, please see the “Added to our newsletter” section above.
• Interact with us on social media. When you interact with our web pages on social networking websites, such as Meta (Facebook), Instagram, X (formerly Twitter), Pinterest, Issuu, TikTok, YouTube, Vimeo, and LinkedIn (each, a “Social Media Page”) (collectively, “Social Media Pages”), we collect basic engagement metrics and use it to tailor content and marketing as set forth in this section. Please note that we do not control the use or storage of the information that you have posted on any Social Media Page. This information is collected and processed by the social networking websites for their own purposes, including marketing. For more information on how Meta, Instagram, X, TikTok, Pinterest, Issuu, YouTube, and LinkedIn use your personal information, please see Meta’s Privacy Policy, Instagram’s Privacy Policy, X’s Privacy Policy, TikTok’s Privacy Policy, Pinterest’s Privacy Policy, Issuu’s Privacy Policy,  YouTube’s Privacy Policy, Vimeo’s Privacy Policy, and LinkedIn’s Privacy Policy. We also use a social marketing tool to collect information about the activity on our Social Media Pages and identify the most active users in our community. We receive this information in aggregated form only.
  • Social Media Pages. When interacting with our Social Media Pages, we may collect from you, your personal identifiers (first and last name, social media handle, and profile picture) as well as any information that you provide when interacting with our Social Media Pages (e.g. commenting, sharing and rating). We may use this information to communicate with users.
    
    Because our Social Media Pages are publicly accessible, when you use them to interact with other users, for example by posting, leaving comments or liking or sharing posts, any personal information that you post in them or provide when registering can be viewed by others or used by them as they see fit.
    
    The content posted on our Social Media Pages or other public areas of social networking websites can be deleted in the same way as other content that you have created.
  • Community Management. With the help of a third party, we collect from you, your interactions, including "likes", shares, messages, and other interactions with the content, to analyze and evaluate how our content is perceived, to learn from it, and to improve our social media and marketing efforts.
  • Direct Messages. When using direct message capabilities on Social Media Pages, the applicable Social Media Page collects from you, automatically, your internet or other electronic network activity information (IP address, date and time of the server request, time zone, specific browser or app function, access status, amount of data transferred, browser or app from which the Request comes, device type, operating system used, and its interface (e.g. Android or iOS), language, version of the operating system, and device identifiers). We do not use this information; its use is governed by the applicable Social Media Page’s Privacy Policy, a hyperlink to which is available above.
  • Page Insights. When you visit our Social Media Pages, those sites record your IP address and other information about your usage behavior on our Social Media Page. The pages collect, through trackers in the browser of your device or via the advertising ID (IDFA from Apple or GAID from Google), when you open their app through your mobile device (e.g. smartphone or tablet). Social Media Pages use this information to create statistical evaluations for us of the use of the Social Media Page. We receive this information, from Social Media Pages, in the form of aggregated data and anonymous statistics regarding things like: age, gender, city/country, device, inquiries from fans about other fan pages, region and language settings of the users, proportion of men and women, the number of people reached, clicks on posts, "Likes” and reactions, comments and shared content, and total video views. We do not collect or process any other personal information in connection with the page insights.
    
    We do not retain this information independently. For information on data protection and the storage period on Social Media Pages in relation to the "Page Insights" function see their Privacy Policies. It has been contractually agreed with Social Media Pages that they are responsible for providing you with information about the processing for Page Insights.
  • Information Processed Solely by Social Media Pages. We do not know how Social Media Pages use personal information for its own purposes, how long the personal information is stored on their sites or whether the Social Media Pages data is passed on to third parties.
    
    For example, if you are currently logged in to Facebook as a user, Facebook automatically collects, through trackers on your device, your Facebook ID or a link between the Facebook ID and the advertising ID (IDFA from Apple or GAID from Google) when you open the Facebook app through your mobile device (e.g. smartphone or tablet). This enables Facebook to understand that you have visited our Facebook Fan Page along with other Facebook pages that you have clicked on, whether you clicked on Facebook buttons integrated into websites that partner with Facebook, and other online interactions that report user data to Facebook. Based on this data, content or advertising tailored to you can be offered.
    
    You can find more information about the personal information collected by Facebook, how it is used and how long it is stored by visiting Facebook’s Privacy Policy.
• Interact with the Platforms. When you use our Platforms, we automatically collect personal information from you through cookies, pixels, web beacons, and similar tracking technologies. This includes your internet or other electronic network activity information. Please see our Cookie Policy [hyperlink] for additional information on our use of cookies and other website technologies.
  
  We use essential trackers to make sure the Platforms work properly. If you give us your consent, we will also set performance, marketing, and analytics cookies and trackers. These trackers collect and share your personal information with our third-party analytics and advertising providers your internet or other electronic network activity information (including IP Address and device identifiers). Some of this information may be considered sensitive personal information, such as health data.
  
  We use this information to: (i) enhance your browsing experience, (ii) track you within the Platforms to maintain your browsing preferences, (iii) conduct analytics and improve the Platforms, (iv) prevent fraudulent use of the Platforms, (v) diagnose and repair Platform errors, and in cases of abuse, track and mitigate the abuse, (vi) provide targeted advertising, (vii) analyzing the performance of our advertising campaigns, and (viii) capture and aggregate viewing and engagement metrics. If you do not consent to our use of performance, marketing, and analytics cookies and trackers, we will only collect or use your data through necessary cookies for website functionality. You may also modify or revoke your consent by visiting Do Not Sell or Share My Personal Information. Our use of third-party marketing and analytics cookies may be considered a sale under the Maryland Online Data Privacy Act and New Jersey Data Privacy Act. If you accepted non-essential cookies and are a Maryland or New Jersey resident who wishes to opt out of the sale of your personal information and the processing of your personal information for purposes of targeted advertising, please visit Do Not Sell or Share My Personal Information.
  
  If we detect an opt-out preference signal (such as the Global Privacy Control signal) communicated from your (or your authorized agent’s) browser or device, we will treat the opt-out preference signal as a valid request to opt out of the sale/sharing of your personal information as it pertains to that browser or device (including any associated profile information). If we can associate the opt-out signal with you (for example, if the signal is sent when you are logged-in to your account), we will also treat the signal as an opt-out request pertaining to other browsers or devices that you use to access the Platforms, including any offline sale or sharing of personal information.
  
  For a list of third-party cookies on our Websites, what information they collect, and what the collected information is used for, please see our Cookie Policy [hyperlink]. To opt out of any of our cookies or other collection of your personal information through the Website, please visit Do Not Sell or Share My Personal Information.
• Aggregate data. We aggregate the data we collect for benchmarking purposes and for internal analytics. We maintain and use this data in deidentified form. We will not attempt to reidentify the data unless it is necessary to determine whether our deidentification processes satisfy applicable data protection laws.

ChristianaCare will also use the personal information we collect as described in this section to comply with the law, to efficiently maintain our business, and for other limited circumstances as described in HOW WE SHARE YOUR PERSONAL INFORMATION.

Unless otherwise stated in this Privacy Notice, we retain your non-PHI, personal information as long as reasonably necessary to retain it for the purpose for which it was collected or until we receive a valid request to delete the information, in which case we will delete or anonymize the information after receiving the request (unless there is a reason to retain the information for longer as explained below). This includes maintaining a user account with us (if applicable) or until the information is no longer needed for a service provider or contractor’s operational purpose(s). Subscription, billing, tax, audit, and transaction-related records may also be retained for longer where reasonably necessary for accounting, dispute resolution, chargeback management, tax, audit, and legal compliance purposes. Additionally, much of your data is considered PHI and the retention period will be subject to our HIPAA Notice.

We use the following criteria to determine whether it remains reasonably necessary to retain your non-PHI, personal information for such purposes or a service provider or contractor’s operational purpose(s): (i) whether there is a retention period required by statute or regulations; (ii) the existence of actual or threatened or reasonably anticipated litigation for which we are required to preserve the information; (iii) the statutes of limitations for potential legal claims; and (iv) generally accepted best practices in our industry, including in relation to the safety and security of our properties and assets. When we determine that it is no longer reasonably necessary to retain your personal information based on the above criteria, we will delete or anonymize your personal information.

You have the following choices with respect to your personal information:

• Correct or View Your Information. You may access your account to correct or view certain personal information you have provided to us.
• Opt Out of Adobe Analytics. To prevent your personal information from being used by Adobe Analytics, you may opt out here.
• Opt Out of Email Tracking and Marketing Communications. You can disable tracking in emails by unsubscribing from our marketing emails. You may opt out of receiving marketing emails and text messages from us by clicking the “unsubscribe” link provided at the bottom of each email we send. Please note that we may continue to send you notifications related to your medical care.
• Opt Out of Advertising Cookies. You can opt out of certain cookies by declining non-essential cookies when visiting our Platforms or by clicking the Do Not Sell or Share My Information link. All session cookies are temporary and expire after you close your web browser. Persistent cookies can be removed by following your web browser’s directions. To find out how to see what cookies have been set on your computer or device, and how to reject and delete the cookies, please visit: https://www.aboutcookies.org/. Please note that each web browser is different. To find information relating to your browser, visit the browser developer’s website and mobile application. If you reset your web browser to refuse all cookies or to indicate when a cookie is being sent, some features of our website may not function properly. If you choose to opt out, we will place an "opt-out cookie" on your device. The "opt-out cookie" is browser specific and device specific and only lasts until cookies are cleared from your browser or device. The opt-out cookie will not work for essential cookies. If the cookie is removed or deleted, if you upgrade your browser or if you visit us from a different computer, you will need to return and update your preferences. By clicking on the “Opt-Out” links below, you will be directed to the respective third-party website where your computer will be scanned to determine who maintains cookies on you. At that time, you can either choose to opt out of all targeted advertising or you can choose to opt out of targeted advertising by selecting individual companies who maintain a cookie on your machine.
  • Network Advertising Initiative (NAI) Opt-Out: https://www.networkadvertising.org/managing/opt_out.asp
  • Digital Advertising Alliance (DAA) Opt-Out: https://optout.aboutads.info
  • European Union (EU) /European Economic Area (EEA) Opt-Out: http://www.youronlinechoices.eu
  • In general, you can also disable cookies by setting your browser to refuse cookies or indicate when a cookie is being sent.

The laws of certain states give their residents privacy rights, including the Delaware Personal Data Privacy Act (“DPDPA”), Maryland Online Data Privacy Act (“MODPA”) and the New Jersey Data Privacy Act (“NJDPA”). To the extent the DPDPA, MODPA, NJDPA, or other state laws apply to our processing of your personal information, you are entitled to the following rights:

• Right to Access/Know. You have the right to request what personal information we have collected and processed about you, unless doing so reveals a trade secret as well as a list of the categories or types of third parties with whom we have shared your personal information. Delaware residents may request a list of third parties we have disclosed your personal data to (in certain circumstances, we may provide a list of all third parties we disclose personal information to). Delaware and Maryland residents may only make a request for access once within a 12-month period while New Jersey residents may request access twice during a 12-month period.

• Right to Deletion. You have the right to request the deletion of your personal information that we collect or maintain, subject to certain exceptions. For example, if we are required by law to retain the information that you are asking to be deleted, we would not be able to delete the information until we are legally permitted to delete it.

• Right to Correct. You have the right to correct inaccurate personal information that we collect or maintain.

• Right to Opt Out. You have the right to opt out of our processing of your personal information for the following purposes: (i) targeted advertising; (ii) profiling through automated decision making that produces legal or similarly significant effects; and (iii) the sale of your personal information to third parties. ChristianaCare does not have actual knowledge that it processes the personal information of minors under the age of seventeen (17) years for targeted advertising, profiling, or sale to third parties.

• Right to Data Portability. You have the right to request that we transfer your personal information to another organization or give it to you.

• Right to Non-Discrimination. You have the right to not receive discriminatory treatment in the processing of your personal information as well as if and when you exercise your rights, including to access, delete, correct, opt out, list types of third parties, or limit use of sensitive data.

• Right to Appeal. You have the right to appeal our refusal to act on your request to exercise your rights. To request an appeal, please email us at PrivacyOffice@ChristianaCare.org, subject line: “Appeal My Consumer Request.” We will review the appeal and notify you of our response.
  • For Delaware residents: If you are concerned with our response as a result of your appeal, you may submit a complaint to the Delaware Attorney General here.
  • For Maryland residents: If you are concerned with our response as a result of your appeal, you may submit a complaint to the Maryland Attorney General here.
  • For New Jersey residents: If you are a concerned with our response as a result of your appeal, you may submit a complaint to the New Jersey Attorney General here.

If you are a Delaware, Maryland, or New Jersey resident and wish to exercise your privacy rights, you may submit a request by emailing us at PrivacyOffice@ChristianaCare.org. To exercise your right to opt out of targeted advertising or the sale of your personal information via third-party marketing/analytics cookies, please visit Do Not Sell or Share My Personal Information.

If we detect an opt-out preference signal (such as the Global Privacy Control signal) communicated from your (or your authorized agent’s) browser or device, we will treat the opt-out preference signal as a valid request to opt out of the sale/sharing of your personal information as it pertains to that browser or device (including any associated profile information). If we can associate the opt-out signal with you (for example, if the signal is sent when you are logged-in to your account), we will also treat the signal as an opt-out request pertaining to other browsers or devices that you use to access the Services, including any offline sale or sharing of personal information.

You must provide us with sufficient information that allows us to reasonably verify you are the person about whom we collected the personal information. This may include items like your name, date of birth, phone number, address, and email address and describe your request with sufficient detail to allow us to properly evaluate and respond to it. We will verify your request by matching the information provided by you with the information we have in our records. If we are not able to verify your identity for access and deletion requests with the information provided, we may ask you for additional pieces of information.

Only you, or a person that you authorize to act on your behalf may make a request related to your personal information. If you are an authorized agent making a request on behalf of another individual, you must provide us with signed documentation that you are authorized to act on behalf of that individual.

Our Platforms contain links to third-party websites, services, or resources that we do not operate or control. We are not responsible for the privacy or security practices of those third-party websites. Because third-party websites likely have different privacy practices from ChristianaCare, we encourage you to review the privacy notice of any third-party website you visit to understand how it collects, uses, and discloses your personal information.

We do not respond to Do Not Track requests. Do Not Track is a preference you can set in your web browser to inform websites and mobile applications that you do not want to be tracked. You can enable or disable Do Not Track by visiting the Preferences or Settings page of your web browser.

We implement and maintain appropriate technical and organizational security measures, such as software- and hardware-based monitoring and protection, access controls, firewalls, and encryption (i.e., SSL and HTTPS) to protect the personal information that we collect and maintain from unauthorized access, destruction, use, modification, or disclosure. However, no security measure or modality of data transmission is 100% secure, and we are unable to guarantee the absolute security of the personal information we have collected from you.

The Platforms and Services are not directed to or intended for individuals under the age of fourteen (14) years, without parental or guardian supervision. We do not allow registration by, nor do we directly collect personal information from any person we know to be under the age of fourteen (14). ChristianaCare does not use personal information for targeted advertising or profiling without consent.

ChristianaCare MyChart may interact with your sensitive data to provide certain features, such as video visits or mobile appointment check-in.  The first time you try to use any of these features such as your camera or microphone, we will ask for your consent within the app and will allow you to use these features only if you have given consent.  You are not required to provide such consent. ChristianaCare MyChart is developed by Epic Systems Corporation; please refer to Epic’s Mobile Application Privacy Policy for Patients for more detailed information about the limited ways they may interact with your information to make your use of ChristianaCare MyChart possible.

ChristianaCare MyChart may offer location-based check-in for in-person appointments or allow you to find healthcare providers near you.  The first time you try to use any features that use your location, we will ask for your consent within the app and will access your location only if you give consent.  You are not required to provide such consent. We do not store your location data.

Information collected through ChristianaCare MyChart will be used and shared with third parties only as permitted by the Health Insurance Portability and Accountability Act (“HIPAA”) and other applicable laws protecting the privacy of health information.  

We may amend this Privacy Statement in our sole discretion at any time. If we do, we will post the changes to this page and will indicate the date the changes go into effect. We encourage you to review our Privacy Statement to stay informed. If we make changes that materially affect your privacy rights, we will notify you by prominent posting on our Websites and/or via email, and obtain your consent, if required.

If you have any questions or concerns regarding this Privacy Statement, please contact us at:

ChristianaCare Office of Compliance and Privacy
P.O. Box 6001
Newark, DE 19714
PrivacyOffice@ChristianaCare.org
(302) 623-4468