Online Privacy Policy

This Online Privacy Policy describes the information that Metabolic Health Advisors (“MedsRX,” “we,” or the “Company”) collects about you through our website, applications, and any other services we provide (collectively, the “Services”), how we use and share that information, and the privacy choices we offer. This policy applies to information we collect when you access or use our website (the “Platform”), when you use our Services, or when you otherwise interact with us. Your use of the Services is also governed by our Terms of Use.

We may change this Online Privacy Policy from time to time. If we make changes, we will notify you by posting the updated policy on our Platform and revising the “last updated” date above. We encourage you to review this policy whenever you use our Services to stay informed about our information practices and the ways you can help protect your privacy.

We understand that information about you and your health is personal. We support your privacy and work to ensure that the transmittal and use of your information complies with applicable law. Where applicable, we comply with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and relevant state laws and regulations, including by entering into Business Associate Agreements with the treatment providers for which we provide services, so that your health information is appropriately safeguarded. Our Notice of Privacy Practices is set forth in section 11 below and summarized in our HIPAA Notice.

4.1 Information you provide

We collect information you provide, such as when you email us, sign up through our Platform, complete an intake or assessment, or submit information through our Platform. This may include your name, gender, email address, mailing and shipping address, phone number, date of birth, payment and billing information, and the health information you submit for clinical review (such as height, weight, medical history, current medications, lab results, and photographs).

4.2 Children

We do not knowingly collect or maintain personally identifiable information from persons under 18 years of age. If you are under 18, please do not use the Services. If we learn that information from a person under 18 has been collected, we will take appropriate steps to delete it. To make such a request, contact us through our contact page.

4.3 Information we collect from your use of the Services

• Account information. When you register to create an account, you provide information used to contact or identify you, and in some cases payment or other billing information.
• Device information. We may automatically collect information about the computers or devices you use to access the Services, such as IP address, unique device identifiers, browser type and language, operating system, and the state or country from which you accessed the Services, as well as information about how you interact with the Services (referring and exit pages, pages and content viewed, time spent, frequency of use, and error logs).
• Location information. We may collect general location information (such as IP address or ZIP code) and, with your permission, more specific location information from your device, and use it to customize the Services — including to determine whether the Services and clinicians are available in your state. You can disable location functions on your device.
• Cookies and other electronic technologies. Cookies are small files transferred to your device that may contain a user ID, preferences, and records of pages visited. We use cookies to keep you signed in, improve and tailor the Services, and support analytics and fraud prevention. Some of our business partners may use cookies to display MedsRX ads on other sites based on your interests (interest-based advertising). We do not use interest-based advertising that relies on your protected health information. For more information on cookies, visit allaboutcookies.org.
• Web beacons. Tiny graphic files embedded in a web page or email that help us analyze how many people use the Services or open our emails, and for what purpose.
• Platform analytics. We may use third-party analytics services that register clicks, mouse movements, scrolling, and text entered into the Platform, to help make the Platform easier to use.
• Mobile device identifiers. Data stored on your mobile device that may track device data and activity, and that helps us learn more about our users’ demographics and behaviors.

4.4 Information from third parties

We may obtain additional information about you from third parties such as marketers, partners, pharmacies, laboratories, payment processors, and researchers, and may combine it with information we collect from you and use the combined information for the purposes described in this policy.

4.5 Aggregate or de-identified data

We may aggregate and/or de-identify information collected through the Services so that it is not intended to identify you. Our use and disclosure of aggregated or de-identified information — including information de-identified under HIPAA’s de-identification standard — is not subject to the restrictions in this policy, and we may disclose it for any purpose in accordance with applicable law.

We use the information we collect to:

• Fulfill the purposes for which you provided the information, including facilitating clinical review by independent clinicians and coordinating fulfillment of prescriptions, labs, and shipments.
• Contact you when necessary or requested, including care-related and administrative messages.
• Process your payments, communicate with you about your purchase, and provide customer service.
• Send mobile or email notifications (you may opt out of non-essential notifications).
• Provide, maintain, administer, improve, or expand the Services and perform business analyses.
• Customize and tailor your experience and inform you of products, programs, services, and promotions we believe may interest you, subject to the opt-in policy below.
• Track and analyze trends and usage, and better understand who uses the Services so we can deliver a better experience.
• Prevent, detect, and investigate security breaches, fraud, and other potentially illegal or prohibited activity.
• Enforce the legal terms that govern your use of the Services, protect our rights or property, and administer and troubleshoot the Services.
• Any other purpose disclosed to you in connection with the Services.

We may use third-party service providers to process and store personal information in the United States and other countries. We do not sell your personal information, and we do not use or disclose your protected health information for marketing purposes without your authorization.

We may share personal information about you as follows:

• With independent clinicians and their affiliated professional entities so that they can evaluate and treat you.
• With licensed pharmacies (which may include 503A or 503B compounding pharmacies), laboratories, and shipping carriers to fulfill prescriptions, testing, and delivery.
• With third-party service providers who access information to perform services on our behalf, including hosting, payment processing, email and SMS delivery, and analytics, under contractual confidentiality and security obligations.
• With our affiliates and partners for the purposes described in this policy, and — where you have opted in — so they may contact you about products, programs, services, and promotions.
• In connection with, or during the negotiation of, any merger, sale of stock or assets, financing, acquisition, divestiture, or dissolution of all or a portion of our business, under non-disclosure and confidentiality protections.
• If we believe disclosure is reasonably necessary to comply with applicable law, regulation, legal process, or governmental request; to enforce user agreements or policies; to protect the security or integrity of the Services; or to protect us, our users, or the public from harm or illegal activity.
• With your consent, or in the case of protected health information, pursuant to your written authorization or as otherwise permitted by HIPAA.

We may also share aggregated, non-personally identifiable information with third parties.

When you supply personally identifiable information, you may be asked whether you wish to receive information about our products and services and whether we may share information about you with our affiliates, partners, or other third parties for their marketing purposes. If you opt in, you will receive such communications and we will share your information in accordance with your consent.

You may opt out at any time by following the unsubscribe link in our marketing emails (excluding order confirmations and administrative emails), replying STOP to marketing texts, or contacting us through our contact page. When contacting us, please specify whether you are opting out of (a) marketing communications from us, (b) sharing with our affiliates and partners for their marketing purposes, and/or (c) sharing with other third parties for their marketing purposes. We will implement your request as soon as reasonably practicable; your change is not effective until implemented. We are not responsible for removing your information from the databases of third parties with which we shared information before your request took effect. Even if you opt out of marketing, we may still send important administrative and care-related messages, which you cannot opt out of while you hold an account.

Certain features may permit you to share information on third-party social media sites or platforms. We do not own or control those platforms, and posting your information there is subject to that third party’s privacy policy and legal terms, which may not provide privacy protections you agree with. We are not responsible for any act or omission of a social media platform or for the consequences of your choosing to share information there. We strongly discourage sharing your health information on social media.

We take reasonable measures, including administrative, technical, and physical safeguards such as encryption in transit and at rest, access controls, and audit logging, to help protect personal information from loss, theft, misuse, unauthorized access, disclosure, alteration, and destruction. Unfortunately, no data transmission over the internet can be guaranteed to be 100% secure. As a result, while we strive to protect your personal information, we cannot ensure or warrant the security of any information you transmit to us, and you do so at your own risk.

10.1 How you can access and update your information

You may update or correct information about yourself at any time in your account settings or by contacting us through our contact page.

10.2 Cookies

Most web browsers accept cookies by default. If you prefer, you can usually set your browser to remove or reject cookies; however, the Services may not function properly if you do so.

10.3 Opting out of interest-based advertising

To learn more about interest-based advertising and how to control cookies used to deliver tailored advertising, you may visit the Network Advertising Initiative’s Consumer Opt-Out page or the Digital Advertising Alliance’s Consumer Opt-Out page. Even after opting out, you may still see our advertisements that are not interest-based, and we may still collect information about your use of the Services.

10.4 Browser “Do Not Track” signals

We provide the opt-out resources described above, but we do not currently recognize or respond to browser-initiated Do Not Track signals, as industry standards for those signals are still developing.

10.5 State privacy rights

Depending on where you live, you may have the right to request access to, correction of, deletion of, or a copy of the personal information we hold about you, to opt out of certain sharing, and to be free from discrimination for exercising those rights. Information that constitutes protected health information under HIPAA is handled under HIPAA rather than state consumer privacy laws. To submit a request, contact us through our contact page; we will verify your identity before responding.

10.6 Links to other websites

Our Services may contain links to other websites that may not follow the same privacy practices. We are not responsible for the privacy practices of third-party websites and encourage you to read their privacy policies.

10.7 No rights of third parties

This Online Privacy Policy does not create rights enforceable by third parties.

10.8 How to contact us

Please contact us with any questions or concerns regarding this policy through our contact page.

We are dedicated to maintaining the privacy of your protected health information (“PHI”). PHI is information about you that may be used to identify you (such as your name, address, or identification numbers) and that relates to (a) your past, present, or future physical or mental health or condition, (b) the provision of health care to you, or (c) past, present, or future payment for the provision of health care. In conducting our business, we may receive and create records containing your PHI.

This Notice is in effect from the date noted above until we replace it. We reserve the right to change the terms of this Notice at any time, as long as the changes comply with applicable law. New terms will apply to all PHI we maintain, including PHI created or received before the changes were made. If we change this Notice, we will post the new Notice on our Platform and make it available upon request.

11.1 Uses and disclosures of PHI

• Treatment, payment, and health care operations. We may disclose your PHI to a clinician or pharmacy in connection with your treatment; use and disclose it in connection with processing and payment of charges; and use and disclose it for health care operations such as customer service and quality review. Where a third party requires access to PHI to perform services for us, we require that third party to enter an agreement binding it to the restrictions in this Notice.
• Authorization. We may use and disclose your PHI upon your written authorization, to the extent consistent with that authorization. You may revoke an authorization at any time.
• As required by law. We may use and disclose your PHI to the extent required by law.
• Special circumstances. We may use or disclose PHI for public health activities; workers’ compensation programs; health oversight activities such as audits and investigations; judicial and administrative proceedings, including in response to a court order or subpoena; law enforcement purposes; disclosures to coroners, medical examiners, and funeral directors; organ procurement; research, under applicable safeguards; to prevent or lessen a serious and imminent threat to health or safety; and specialized government functions such as military and national security purposes.

11.2 Your rights regarding your PHI

• Confidential communication. You may request that we communicate with you through alternate means or at an alternate location, and we will accommodate reasonable written requests.
• Restrictions. You may request restrictions on certain uses and disclosures of PHI for treatment, payment, or health care operations, or that we limit disclosures to certain individuals involved in your care. We are not required to agree, but if we do we will be bound by that agreement except as required by law or in an emergency.
• Inspection and copies. You have the right to inspect and copy your PHI upon written request. We may charge a reasonable fee for copying, mailing, labor, and supplies. In limited circumstances we may deny your request, in which case we will explain the reason and you may request a review of the denial.
• Amendment. You may request in writing that we amend your PHI if you believe it is incorrect or incomplete, and provide a reason supporting the request. We may deny the request by written notice, and you may submit a statement of disagreement for inclusion in your records.
• Accounting of disclosures. You have the right to receive an accounting of disclosures of your PHI, excluding disclosures for treatment, payment, or health care operations, disclosures to you, disclosures made pursuant to an authorization, and certain others. Requests must be in writing and specify a period of less than six years. Your first accounting in a 12-month period is free; we may charge for additional requests and will inform you of the cost in advance.
• Breach notification. You have the right to be notified if we (or one of our business associates) discover a breach of unsecured PHI.
• Paper copy. You have the right to obtain a paper copy of this Notice at any time upon request.
• Complaint. You may complain to us or to the Secretary of the U.S. Department of Health and Human Services if you believe your privacy rights have been violated. To file a complaint with us, submit a written statement through our contact page. We will not retaliate against you for filing a complaint.
• Further information. For more information about your privacy rights, contact us and ask to speak with our Privacy and Security Officer. Written requests to exercise any right described in this Notice should be submitted through our contact page.

Questions about this Online Privacy Policy or our Notice of Privacy Practices? Reach us through the contact page. MedsRX is operated by Metabolic Health Advisors, formed in California.