IN RE CITYMD DATA PRIVACY LITIGATION

CourtDistrict Court, D. New Jersey
DecidedSeptember 2, 2025
Docket2:24-cv-06972
StatusUnknown

This text of IN RE CITYMD DATA PRIVACY LITIGATION (IN RE CITYMD DATA PRIVACY LITIGATION) is published on Counsel Stack Legal Research, covering District Court, D. New Jersey primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook
IN RE CITYMD DATA PRIVACY LITIGATION, (D.N.J. 2025).

Opinion

UNITED STATES DISTRICT COURT DISTRICT OF NEW JERSEY

IN RE CITYMD DATA. PRIVACY Civil Action No. 24-6972 (JXN) (CLW) LITIGATION OPINION

NEALS, District Judge: This matter comes before the Court on Defendant Summit Health Management, LLC’s d/b/a CityMD (“Summit Health” or “Defendant”) motion to transfer venue to the Eastern District of New York (“E.D.N.Y.") under 18 U.S.C. 1404{a) pursuant to Federal Rule of Civil Procedure 12(b)\(3). (ECF No. 69), Plaintiffs opposed the motion (ECF No, 72); and Defendant replied (ECF No. 73). This Court has subject matter jurisdiction pursuant to the Class Action Fairness Act of 2005 (““CAFA”), 28 U.S.C. § 1332(d). Venue is proper in this Court pursuant to 28 U.S.C. § 1391(b). The Court has carefully considered the parties’ submissions and decides this matter without oral argument pursuant to Federal Rule of Civil Procedure 78(b) and Local Ctvil Rule 78.1(b). For the reasons set forth below, Defendants’ motion to transfer venue is DENIED. I. BACKGROUND' Plaintiffs V.A, and T.G., both New York residents, bring this class action against Summit Health, a company headquartered and incorporated in New Jersey, alleging that Defendant disclosed its patients’ confidential personal identifiable information and protected health information (collectively “Private Information”) collected through its website www.citymd.com

' The following factual allegations are taken from the Consolidated Class Action Complaint, which are accepted as true, Sheridan v. NGK Metals Corp., 609 F.3d 239, 262 n.27 (3d Cir. 2010).

(the “Website”? to unauthorized third party advertisers including Meta Platforms, Inc, (“Facebook”), Alphabet Inc. (“Google”), and Linkedin Corporation (“LinkedIn”), (Consolidated Class Action Complaint (“CCAC”) {ff 4-7, 32-24, ECF No. 66). Plaintiffs allege Summit Health discloses patients’ and prospective patients’ Private Information despite the Website’s privacy policy which states, “[w]hen you browse [the CityMD] website, you do so anonymously . . . We do not collect personal information for the purpose of reselling or distributing that information.” (CCAC §f 6, 149). The third party advertisers use this Private Information to target Website users with advertisements related to the “users’ medical conditions [or] treatments sought from CityMD ... Ud. at § 7). Plaintiffs further allege these purported privacy violations occurred and continue to occur because of tracking technologies Defendant installed on the Website, including infer alia: “the Meta Pixel, Google Analytics, Google DoubleClick, LinkedIn Insight Tag, and [other] related tracking tools.” (“Trackers”) (/d. at § 8)./ These Trackers “allowed unauthorized third parties to intercept the contents of patient communications, view patients’ Private Information, mine that information for purposes unrelated to the provision of healthcare and further monetize it to deliver targeted advertisements to specific individuals.” Ud. at 102). According to the Consolidated Class Action Complaint, “[t]he process of adding third- party Track[ers] [] to webpages is a multi-step process that must be undertaken by the website

2 Additionally, Plaintiffs allege Defendant installed third-party Trackers on its mobile app. (CCAC { 16). 3 Defendant’s Privacy Policy further represents that “[y]our personal information is never shared outside CityMD without your permission, except under conditions explained below” which are limited to sharing updates on new products, software updates, and when required by law. (CCAC {| 151). Additionally, “Defendants Notice of Privacy Practices... maintains that “[u]ses and disclosures [of PH1] for marketing purposes” are to “be made only with your authorization,” (fd at 157). 4 Plaintiffs also allege Defendant “installed and implemented Conversions API on its servers[,]” which “serves the same purpose” as the Trackers, however, unlike Trackers, Conversions API functions from Suminit Health’s servers, thus, Conversions API cannot be thwarted through the use of anti-pixel software, (CCAC {if 14-15).

owner” which were intentionally placed on the Website by Summit Health “to collect and monetize patients’ data.” Ud. at {fj 12, 22) (emphasis omitted), Plaintiffs allege Summit Health disclosed patients’ Private Information despite the Department of Health and Human Services’ “Standards for Privacy of Individually Identifiable Health Information” (known as the “Privacy Rule”) which regulates “how healthcare provider must safeguard and protect Private Information,” (/d. at { 19). Additionally, according to Plaintiffs, “fulnder the HIPAA Privacy Rule, no health care provider may disclose a person’s personally identifiable protected health information to a third party without express written authorization.” (id; see also JJ 161-63). However, “[nJeither Plaintiffs nor any other Class Members signed a written authorization permitting Defendant to send their Private Information to [third-party advertisers].” Ud. at § 20; see alse J 158). Additionally, Plaintiffs allege that Summit Health did not inform users of “the unauthorized disclosure of their Private Information.” Ud. at {| 23). A. PROCEDURAL HISTORY On June 12, 2024, T.G. filed a complaint in this District against Defendant arising from these facts and claims. (ECF No. 1). On June 14, 2024, V.A. filed a related complaint against Defendant in the Southern District of New York; on August 28, 2024, V.A. voluntarily dismissed the complaint. (See Andretta ¥. Summit Health Management, LLC, No. 24-04557 (S.D.N.Y.) (ECE Nos. 1, 16)). On September 9, 2024, V.A. filed a new complaint in this District. (See Andretta v. Summit Health Management, LLC, No, 24-09039 (D.N.J.) (ECF No. 1)). On October 2, 2024, Plaintiffs moved to consolidate their actions, (ECF No. 53), On December 17, 2024, the Court granted Plaintiffs’ motion to consolidate. (ECF No. 63).

On January 17, 2025, Plaintiffs filed the Consolidated Class Action Complaint asserting nine causes of action, including: (1) a violation of the Electronic Communications Privacy Act (““ECPA”), 18 USC. § 2511(1), ef seq.; (2) breach of implied contract; (3) negligence; (4) breach of confidence; (5) constructive bailment; (7) violation of Section 349 of New York’s General Business Law (“NY GBL”) on behalf of a Nationwide Class of individuals who used CityMD.com and whose Private Information was shared with third parties through tracking technologies on CityMD.com as well as a New York subclass; (8) an invasion of privacy; and (9) unjust enrichment. (ECF No. 66). On February 18, 2025, Defendant moved to transfer venue to the E.D.N.Y. (“Def.’s Br.”) (ECF No. 69). On March 20, 2025, Plaintiffs opposed. (Pls.’ Br.”) (ECF No. 72). On April 4, 2025, Defendant replied. (“Def.’s Rep. Br.”) (ECF No, 73). This matter is now ripe for consideration. Il. LEGALSTANDARD Section 1404(a) provides that “[f]or the convenience of parties and witnesses, in the interest of justice, a district court may transfer any civil action to any other district or division where it might have been brought. .. .” 28 U.S.C. § 1404(a). “The purpose of section 1404(a) is to protect litigants, witnesses, and the public against unnecessary inconvenience and expense.” Teva Pharms. USA, Ine. v.

Free access — add to your briefcase to read the full text and ask questions with AI

Related

Hertz Corp. v. Friend
559 U.S. 77 (Supreme Court, 2010)
Koster v. (American) Lumbermens Mutual Casualty Co.
330 U.S. 518 (Supreme Court, 1947)
Continental Grain Co. v. Barge FBL-585
364 U.S. 19 (Supreme Court, 1960)
Van Dusen v. Barrack
376 U.S. 612 (Supreme Court, 1964)
Stewart Organization, Inc. v. Ricoh Corp.
487 U.S. 22 (Supreme Court, 1988)
Sheridan v. NGK Metals Corp.
609 F.3d 239 (Third Circuit, 2010)
Goodyear Dunlop Tires Operations, S. A. v. Brown
131 S. Ct. 2846 (Supreme Court, 2011)
In Re Link_A_Media Devices Corp.
662 F.3d 1221 (Federal Circuit, 2011)
Yocham v. Novartis Pharmaceuticals Corp.
565 F. Supp. 2d 554 (D. New Jersey, 2008)
Ricoh Co., Ltd. v. Honeywell, Inc.
817 F. Supp. 473 (D. New Jersey, 1993)
Job Haines Home for the Aged v. Young
936 F. Supp. 223 (D. New Jersey, 1996)
Eason v. Linden Avionics, Inc.
706 F. Supp. 311 (D. New Jersey, 1989)
Impervious Paint Industries, Ltd. v. Ashland Oil, Inc.
444 F. Supp. 465 (E.D. Pennsylvania, 1978)
Park Inn International, L.L.C. v. Mody Enterprises, Inc.
105 F. Supp. 2d 370 (D. New Jersey, 2000)
Wm. H. McGee & Co., Inc. v. UNITED ARAB SHIPPING
6 F. Supp. 2d 283 (D. New Jersey, 1997)
Yang v. Odom
409 F. Supp. 2d 599 (D. New Jersey, 2006)

Cite This Page — Counsel Stack

Bluebook (online)
IN RE CITYMD DATA PRIVACY LITIGATION, Counsel Stack Legal Research, https://law.counselstack.com/opinion/in-re-citymd-data-privacy-litigation-njd-2025.