®Privacy Notice for California Residents
Last updated: August 27, 2026
MedsRX is operated by Metabolic Health Advisors, formed in California.
This notice applies to California residents (“consumers” or “you”) only and supplements the information in our Privacy Policy. We adopt this notice to comply with the California Consumer Privacy Act of 2018 (“CCPA”), the California Privacy Rights Act (“CPRA”), and other California privacy laws. Terms defined in the CCPA or CPRA have the same meaning when used here.
Information we collect
We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device (“Personal Information”). We have collected the following categories of Personal Information from California consumers in the preceding twelve months.
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | Name, email address, postal address, phone number, date of birth, account name, customer or order reference number, IP address, driver's license or state ID number where required for identity verification. | Yes |
| B. California Customer Records categories (Cal. Civ. Code § 1798.80(e)) | Name, signature, address, telephone number, insurance information, payment card or bank account information, medical information, or health insurance information. Some information in this category overlaps with others. | Yes |
| C. Characteristics of protected classifications | Gender, age, marital status, disability, pregnancy status, citizenship status where relevant to eligibility. | Yes |
| D. Commercial information | Products and services purchased, plan selected, payment and billing history, shipping records. | Yes |
| E. Biometric information | Health information such as weight, height, blood pressure, lab or diagnostic results, and medical conditions submitted during intake or assessments. | Yes |
| F. Internet or other similar network activity | Browser and device type, cookies, IP address, pages viewed, chat and message transcripts, email interaction data, account activity logs. | Yes |
| G. Geolocation data | Precise location such as latitude and longitude or rate of travel. | No |
| H. Sensory data | Audio recordings of clinical or support calls, and voice recordings you submit to coaching or dictation features. | Yes |
| I. Professional or employment-related information | Occupation or employment status where you provide it in an intake or assessment. | Yes |
| J. Non-public education information (FERPA) | Education records directly related to a student maintained by an educational institution. | No |
| K. Inferences drawn from other personal information | Communication and delivery preferences, program preferences, risk or eligibility inferences derived from assessment answers. | Yes |
Sources of Personal Information
- Directly from you — intake forms, assessments, account registration, messages, and support requests.
- Indirectly from your use of our platform — activity on the website, patient portal, and coaching features.
- From third parties that interact with us in connection with the services we provide, such as clinicians, pharmacies, laboratories, and payment processors.
Personal Information does not include
- Information lawfully made available from federal, state, or local government records (publicly available information).
- De-identified or aggregate consumer information, as those terms are defined in the CCPA.
- Information excluded from the CCPA's scope, including health or medical information covered by HIPAA and the California Confidentiality of Medical Information Act (CMIA), and clinical trial data.
- Personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act or California Financial Information Privacy Act, and the Driver's Privacy Protection Act of 1994.
Because MedsRX facilitates care delivered by independent clinicians, much of the health information you provide is protected health information governed by HIPAA and our Notice of Privacy Practices rather than by the CCPA.
Sensitive Personal Information
Sensitive Personal Information means information that reveals:
- Your Social Security, driver's license, or passport number.
- Your account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to the account.
- Your precise geolocation.
- Your racial or ethnic origin, religious or philosophical beliefs, or union membership.
- The contents of your mail, email, and text messages, unless MedsRX is the intended recipient.
- Your genetic data.
Unless the information is publicly available, Sensitive Personal Information also includes the processing of biometric information for the purpose of uniquely identifying you, and personal information collected and analyzed concerning your health or your sex life or sexual orientation.
How we use Personal Information
- To fulfill or meet the reason for which the information was provided, including facilitating your consultation, prescription, and shipment.
- To provide you with information, products, or services you request.
- To send service notices, appointment or refill reminders, and program communications.
- To carry out our obligations and enforce our rights arising from any contract between you and us, including billing and collections.
- To improve our website and platform and present their contents to you.
- For testing, research, analysis, and product development.
- As reasonably necessary and proportionate to protect the rights, property, or safety of us, our patients, or others.
- To respond to regulatory or law enforcement requests and as required by applicable law, court order, or governmental regulation.
- To service providers who perform services on our behalf, and to our affiliates.
- As otherwise described to you at collection, or as otherwise required or permitted by law.
We will not collect additional categories of Personal Information, or use the Personal Information we collected for materially different, unrelated, or incompatible purposes, without providing you notice.
Sharing Personal Information
We may disclose your Personal Information to a third party for a business purpose. We disclose Personal Information for a business purpose to the following categories of third parties:
- Our affiliates and affiliated professional entities.
- Independent licensed clinicians who evaluate and treat you.
- Licensed pharmacies, including compounding pharmacies, and laboratories.
- Service providers and vendors, including payment processors, hosting, communications, and analytics providers.
- Third parties to whom you authorize disclosure in connection with products or services we provide to you.
- Other third parties as required or permitted by law.
Selling or sharing Personal Information
We do not sell your Personal Information, and we do not share it for cross-context behavioral advertising as those terms are defined by the CCPA and CPRA. We do not sell or share the Personal Information of consumers we know to be under 16 years of age.
Your rights and choices
Right to know and data portability
You have the right to request that we disclose information about our collection and use of your Personal Information. Once we receive and verify your request, we will disclose, as applicable: the categories of Personal Information we collected about you; the categories of sources; our business or commercial purpose for collecting it; the categories of third parties with whom we share it; and the specific pieces of Personal Information we hold about you, if you specifically request them.
Right to correct
You have the right to request that we correct inaccurate Personal Information about you. After we receive and verify your request, we will evaluate the requested correction against information we receive from other sources and will tell you what action we took.
Right to limit use of Sensitive Personal Information
You have the right to request that we limit the use and disclosure of your Sensitive Personal Information, subject to certain exceptions. We use Sensitive Personal Information to perform the services you reasonably expect, to ensure security and integrity, to conduct non-personalized advertising, to perform services on behalf of our business, and to improve or enhance our services.
Right to delete
You have the right to request that we delete, and direct our service providers to delete, your Personal Information from our records, subject to the exceptions below.
Deletion request exceptions
We and our service providers do not have to comply with a deletion request for Personal Information we maintain in order to:
- Complete the transaction for which we collected the information, provide a good or service you requested, take actions reasonably anticipated within our ongoing relationship with you, or otherwise perform our contract with you.
- Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible.
- Debug products to identify and repair errors that impair existing intended functionality.
- Exercise free speech, ensure another consumer's right to exercise free speech rights, or exercise another right provided for by law.
- Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et seq.).
- Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to applicable ethics and privacy laws, where deletion would likely render the research impossible or seriously impair it, if you previously provided informed consent.
- Enable solely internal uses reasonably aligned with consumer expectations based on your relationship with us.
- Comply with a legal obligation, including medical record retention requirements.
- Make other internal and lawful uses of the information that are compatible with the context in which you provided it.
Right to non-discrimination
We will not discriminate against you for exercising any of your CCPA or CPRA rights, including by denying goods or services, charging different prices, or providing a different level or quality of service.
Exercising your rights
To exercise any of the rights described above, submit a verifiable consumer request through our contact form. Only you, or a person registered with the California Secretary of State whom you authorize to act on your behalf, may make a request related to your Personal Information.
We must verify that you are the person about whom we collected Personal Information, so your request should provide enough information for us to reasonably verify your identity and describe your request with enough detail for us to understand, evaluate, and respond. We cannot respond or provide Personal Information if we cannot verify your identity.
We endeavor to respond to a verifiable consumer request within 45 days of receipt. If we require more time, up to 90 days total, we will inform you of the reason and the extension period in writing. You may make a request for information twice within a twelve-month period, and requests are free unless excessive or repetitive.
Shine the Light
California Civil Code § 1798.83 permits California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.
Changes to this notice
We may update this notice from time to time. When we do, we will revise the “last updated” date at the top of this page and post the updated notice on medsrxnow.com. See also our Terms of Use and Notice of Privacy Practices.