Privacy Policy

This policy explains what personal information MyPetCerts, Inc. ("MyPetCerts," "we," "us") collects when you use mypetcerts.com, our live chat, our phone line and our emails, how we use and share it, and the choices and rights you have.

If you live in Washington, Nevada or Connecticut, our Consumer Health Data Privacy Policy also applies to you. Our Cookie Policy lists every cookie and tag on the site.

1. Information we collect

Information you give us

• Account and contact details: your name, email address, phone number and password. If you sign in with Google, Google gives us your name, email address and profile picture.
• Addresses: a billing address, and a shipping address when you order a physical product such as an ID card.
• Your pet: its name, type, breed and photo, if you add them.
• Pre-qualification and evaluation answers: your answers to our free pre-qualification quiz and to the ESA evaluation, which describe your mental and emotional health (see section 2).
• Payments: you pay through Stripe. Your card number goes straight to Stripe; we keep only Stripe's references to your payment and its status, never your full card number.
• Messages: what you write to us by email, the contact form or live chat, and phone calls or voicemails you leave on our phone line (including the caller's number, the recording and an automatic transcript).
• Reviews: if you agree to Google Customer Reviews after an order, Google asks you about your purchase (see section 4).

Information collected automatically

• Device and log data: your IP address, browser and device type, the pages you request, the page that referred you, and the date and time. Our web servers and our network provider, Cloudflare, record this.
• Approximate location: the country, region and city that your IP address points to. We don't collect precise GPS location.
• Usage data from cookies and pixels: the pages you view, the links and buttons you click, what you add to your cart, and whether you start checkout or buy. We collect this, and so do the analytics and advertising partners described in section 6.

Information from others

• Your licensed mental health professional (LMHP): their evaluation outcome and the letter they issue.
• A partner organization that set up your account, if you came to us that way: your name, contact details and the products you need.
• Google, when you sign in with Google; Stripe, about your payment and fraud checks; and Google reCAPTCHA, which tells us whether a form submission looks automated.

2. Your health information

To decide whether an emotional support animal letter is right for you, a licensed mental health professional needs to know about your mental and emotional health. All of these are health information: your pre-qualification and evaluation answers, the condition you're evaluated for, the professional's decision, and the fact that you hold an ESA letter. Privacy laws call it "sensitive" personal information or "consumer health data."

• Why we collect it: only to provide the pre-qualification result, evaluation and letter you ask for, and to handle renewals, support, refunds, required records and fraud prevention.
• Who sees it:
  • the LMHP who evaluates you;
  • a small number of MyPetCerts staff who support you and manage the service;
  • if your account was created through a partner organization, that organization, which can view and help with your account, evaluation and letter;
  • the service providers that host and run our systems, under contracts that let them use it only for us.
• What we never do: we never sell your evaluation or pre-qualification answers, never use them for advertising, and never let an advertising or analytics partner collect them. On the evaluation pages and in your account, no analytics or advertising tags run, and nothing is sent to Google, Meta or Microsoft. On the free pre-qualification pages, no advertising tags run, and Google Analytics records page views and how the page is used (such as scrolling, link clicks and that the quiz was submitted), never your answers, condition, result or email. Google signals and ad personalization are turned off for those pages, so that data isn't used to personalize ads or build ad audiences. The same quiz also appears on our home, pricing and FAQ pages, where our analytics and advertising tags do run. There, Google, Meta and Microsoft learn that you visited the page, and Google Analytics records how the page is used, including that the quiz was started and submitted. None of them receives your answers, condition or result. Meta's pixel can read the name and email you type into the quiz and send them to Meta in hashed form (see section 6). We also keep your condition, your answers and your email out of page addresses.
• One thing to know about purchases: when advertising cookies are on, Google, Meta and Microsoft learn that you started checkout or bought one of our products, and the order value (see section 6). Our products are ESA evaluations and letters, so that can suggest you sought an emotional support animal evaluation. Turn off Advertising in "Your Privacy Choices," or turn on Global Privacy Control, and it stops.

HIPAA

MyPetCerts is a technology and administrative platform, not a health care provider. We don't bill health insurance, and we are not a "covered entity" under HIPAA, the federal health-privacy law. The LMHPs who evaluate clients are independent licensed professionals. If one is a HIPAA covered entity, their own HIPAA obligations apply to the records they keep. Either way, we protect your health information as this policy and state health-data laws require.

3. How we use information

• To provide our services: run your account, match you with an LMHP, deliver your evaluation, letter, certificate and any shipped products, process payments and refunds, and send renewal reminders.
• To communicate with you: order and account emails, replies to your questions, and, unless you opt out, tips and offers by email.
• To keep the site safe: detect fraud, spam, bots and abuse, and investigate payment disputes.
• To understand and improve the site: see which pages and features people use and where they get stuck.
• To advertise: measure which ads bring customers to us and show our ads to people who may be interested. This uses browsing and purchase information as described in section 6, never your evaluation answers.
• To meet legal obligations and enforce our terms.

4. Who we share it with

Our service providers may use your information only to provide services to us. We may also disclose information when the law requires it, to protect anyone's safety or our rights, or as part of a merger, sale or reorganization of our business (and then only under this policy's protections).

5. Letter verification

Each letter has an MPC ID. Landlords and others you give your letter to can confirm it's genuine in two ways.

• Online at mypetcerts.com/esa/verification/search, with the MPC ID and the last name on the letter. It must match the last name on your account, so if you change it, contact us. We tell them only whether the letter is genuine and current, its type, when it was issued and expires, and the LMHP's name and license. A wrong name gets the same answer as an unknown ID.
• By phone, by calling the LMHP's office line printed on the letter, with the MPC ID. For a letter issued by that office, the line says whether it is current, its dates and the LMHP who issued it. If the letter was issued by a different office, or the number called isn't an LMHP's office line, it only asks the caller to call the number printed on the letter, without the letter's status or details.

Neither ever shows your name, your pet or anything about your health. We limit how many lookups anyone can make (and how many one office line or one letter can receive by phone), pause online lookups of a letter after repeated wrong names, and log each lookup so we can spot misuse: online with a scrambled form of the visitor's IP address (not the address itself), by phone with the caller's number.

When you buy a letter, you authorize us to confirm its status this way to anyone you give your MPC ID to.

6. Cookies, pixels and advertising

We use cookies and similar technologies, some of our own and some from partners. The Cookie Policy lists each one.

• Google Analytics records the pages you visit and what you do on them, with a random identifier stored in a cookie. We've also linked Analytics to Google Ads, so we can measure and advertise. When you're signed in to your MyPetCerts account, we send Analytics a pseudonymous identifier derived from your account number with a secret key (never your name or email), so visits on different devices count as one person. Google keeps the detailed, per-visitor data for 14 months.
• Google Ads records when someone who clicked one of our ads buys from us. To match a purchase to an ad, our site gives Google your email address, phone number, name and address, which Google's tag scrambles ("hashes") before sending. This is called Enhanced Conversions.
• How Google's tags load: Google Analytics and Google Ads load from our own domain (mypetcerts.com) instead of Google's, and send their measurements back through it. Our network provider, Cloudflare, passes them on to Google, along with the country and region your IP address points to. Google receives only its own cookies this way, never ours. This doesn't change what Google's tags collect, and the cookie banner, "Your Privacy Choices" and GPC work exactly the same.
• Meta (Facebook) Pixel and Microsoft (Bing) UET record the pages you visit, products you view, when you start checkout and when you buy (with the order value), so we can measure and target ads on Facebook, Instagram and Bing. Meta's pixel also reads contact details you type into forms on those pages (such as your email, name, phone, city, state, ZIP code, gender and date of birth) and sends them to Meta in hashed (scrambled) form, so Meta can match visits and purchases to its users. This is called advanced matching.

These partners may combine what they learn here with what they know about you from other sites and apps, and use it for their own purposes under their own privacy policies. That's why US state laws call it "selling" or "sharing" personal information for cross-context behavioral advertising. None of these advertising tags run on the pre-qualification or evaluation pages, in your account, or on our professional, partner and staff pages. On the pre-qualification pages only Google Analytics runs (see section 2), and no analytics or advertising tags run on the evaluation pages, in your account or on those staff pages. They do run on our home, pricing and FAQ pages, which also show the pre-qualification quiz; they never receive your answers there (see section 2). Advertising tags (Google Ads, Meta and Microsoft) also don't run on our sign-in and registration pages.

Our cookie banner

When you first visit, a banner lets you accept all cookies, reject all optional ones, or choose by category (Functional, Analytics, Advertising). Until you choose, optional cookies are on. Change your choice at any time with "Your Privacy Choices" at the bottom of the page. When you turn off Analytics or Advertising, Google's tags stop setting cookies for it. They may still send Google a basic signal that a page was viewed, with no cookie or identifier, which Google uses to estimate totals. Meta and Microsoft tags don't load at all.

Global Privacy Control

If your browser sends a Global Privacy Control (GPC) signal, we treat it as your request to opt out of selling and sharing. Advertising cookies and pixels stay off in that browser, and we tell you so in "Your Privacy Choices." If you turn Advertising back on there while GPC is on, we follow that specific choice. We don't respond to the older "Do Not Track" signal, which has no agreed meaning, but GPC covers the same ground.

7. Your choices

• Opt out of selling, sharing and targeted advertising: open "Your Privacy Choices" at the bottom of the page and turn off Advertising, turn on GPC in your browser, or email us. A choice made in the banner applies to that browser. If you email us, we'll also record the opt-out against your account.
• Cookies: "Your Privacy Choices," or your browser's settings.
• Marketing emails: use the unsubscribe link in any marketing email. We'll still send emails you need about your orders, letters and account.
• Ad settings at our partners: Google My Ad Center, Meta ad preferences, Microsoft ad settings, and the industry opt-outs at aboutads.info and networkadvertising.org.

8. How long we keep it

When we delete information, backups roll off on their normal schedule.

9. Security

We use encryption in transit (HTTPS), access controls, and other safeguards suited to health information. Personal details we store in cookies on your device are encrypted. No system is perfectly secure. If a breach affects your information, we'll notify you as the law requires.

10. Children

Our services are for adults 18 and over. We don't knowingly collect information from anyone under 18. If you believe a minor has given us information, email [email protected] and we'll delete it.

11. Your rights under US state laws

Depending on where you live (including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia), you have some or all of these rights. We give them to everyone in the United States, wherever you live.

• Know and access: what we've collected about you, where it came from, why, and who we've disclosed it to, plus a copy in a portable format.
• Correct inaccurate information.
• Delete your information, subject to records we must keep by law.
• Opt out of selling, sharing and targeted advertising, and of profiling that produces legal or similarly significant effects (we don't do that kind of profiling).
• Sensitive information: we use it only to provide the service you asked for, so there's nothing further to limit. You can withdraw your consent at any time.
• Get a list of the specific third parties we've disclosed your information to.
• No discrimination: using these rights won't change your price or service.

How to use your rights

Email [email protected] or call 1-650-560-4372. We'll confirm it's you by matching details we already hold (for example, a code sent to your account email). We respond within 45 days, and tell you if we need up to 45 more. An authorized agent can make a request for you with your signed permission, though we may still ask you to confirm your identity. Opt-out requests don't need verification.

Appeals: if we turn down your request, you can appeal by replying to our decision or emailing [email protected] with "Appeal" in the subject. We'll answer in writing within 45 days (60 in some states). If we deny your appeal, you can contact your state attorney general.

California notice at collection

In the past 12 months, we collected these categories of personal information:

Sources, purposes and retention are in sections 1, 3 and 8. We don't knowingly sell or share the personal information of anyone under 16. "Shine the Light": we don't disclose personal information to third parties for their own direct marketing.

12. Washington, Nevada and Connecticut

These states protect "consumer health data" with extra rules, including consent and the right to know who received it and to have it deleted. Our Consumer Health Data Privacy Policy explains how we handle them.

13. Changes to this policy

We'll update the date at the top when we change this policy. For significant changes we'll also post a notice on the site or email you, and we'll ask for your consent where the law requires it. We use information only under the policy that applied when we collected it, unless you agree otherwise.

14. Contact us

MyPetCerts, Inc., Attn: Privacy
4312 Eureka Ave, Yorba Linda, CA 92886
Email: [email protected]
Phone: 1-650-560-4372