; (G) the first and last name of an individual, or first initial and last name, or other unique identifier in combination with— (i) the month, day, and year of birth of the individual; (ii) the maiden name of the mother of the individual; or (iii) the past or present precise geolocation of the individual; (H) information that relates to— (i) the past, present, or future physical or mental health or condition of an individual; or (ii) the provision of health care to an individual; and (I) the nonpublic communications or other nonpublic user-created content of an individual. 3. Provider duties (a) In general An online service provider shall fulfill the duties of care, loyalty, and confidentiality under paragraphs (1), (2), and (3), respectively, of subsection (b). (b) Duties (1) Duty of care An online service provider shall— (A) reasonably secure individual identifying data from unauthorized access; and (B) subject to subsection (c), promptly inform an end user of any breach of the duty described in subparagraph (A) of this paragraph with respect to sensitive data of that end user. (2) Duty of loyalty An online service provider may not use individual identifying data, or data derived from individual identifying data, in any way that— (A) will benefit the online service provider to the detriment of an end user; and (B) (i) will result in reasonably foreseeable and material physical or financial harm to an end user; or (ii) would be unexpected and highly offensive to a reasonable end user. (3) Duty of confidentiality An online service provider— (A) may not disclose or sell individual identifying data to, or share individual identifying data with, any other person except as consistent with the duties of care and loyalty under paragraphs (1) and (2), respectively