Privacy Policy

1.Who we are and what this policy covers

This Privacy Policy explains how [COED RX legal entity name] (“COED RX,” “we,” “us,” or “our”) collects, uses, and discloses personal information through our website, online visit platform, and related services (the “Services”), and the choices you have. It is part of our Terms of Use.

Residents of Washington, Nevada, and Connecticut should also read our Consumer Health Data Privacy Policy, which describes how we handle health-related information under those states’ laws.

2.Health information and HIPAA

Medical care is provided by independent clinicians affiliated with [Medical group name] (the “Medical Group”) and filled by independent licensed pharmacies. Information you share for your care, such as your medical history, visit answers, and prescriptions, may be “protected health information” under the Health Insurance Portability and Accountability Act (“HIPAA”).

When it is, it’s governed by HIPAA and by the Notice of Privacy Practices of the Medical Group or pharmacy, which you’ll receive during your visit. Where we handle that information on their behalf, we do so as permitted by HIPAA and our agreements with them. If this policy conflicts with a Notice of Privacy Practices about protected health information, the Notice controls.

3.Information we collect

Information you give us

• Contact and account information, such as your name, email address, phone number, shipping address, date of birth, and login credentials.
• Identity verification, such as a photo of a government-issued ID and a photo of yourself.
• Health information, such as your symptoms, goals, medical history, medications, allergies, lab results, photos you upload, and messages with your care team.
• Payment information, such as your card details and billing address. Card numbers are processed by our payment processors.
• Communications, such as messages you send to support, survey responses, and reviews.

Information collected automatically

When you use the Services, we and our service providers automatically collect information such as your IP address, browser and device type, operating system, pages viewed, links clicked, the page that referred you, the time and length of your visit, and interactions with our emails. We collect it using cookies, pixels, tags, and similar technologies, described in Cookies, analytics, and advertising.

Information from others

• The Medical Group and its clinicians, about your visits, treatment plans, and prescriptions.
• Pharmacies, laboratories, and shipping carriers, about your orders, results, and deliveries.
• Payment processors and identity verification providers.
• Analytics and advertising partners, about how you interact with our ads and the Services.

4.How we use information

We use personal information to:

• provide the Services, including connecting you with the Medical Group, supporting your visits, and coordinating prescriptions, payments, and deliveries;
• create and secure your account, and verify your identity;
• communicate with you about your account, care, orders, and subscriptions, and respond to your requests;
• send marketing communications you’ve agreed to, and measure their effectiveness;
• understand how the Services are used, and maintain and improve them;
• detect, prevent, and investigate fraud, abuse, and security incidents; and
• comply with legal obligations, enforce our terms, and protect the rights and safety of our patients, others, and COED RX.

We may also create de-identified or aggregated information that no longer identifies you and use it for any lawful purpose. We won’t try to re-identify it.

5.How we disclose information

We disclose personal information to:

• The Medical Group and its clinicians, to provide your care.
• Pharmacies, laboratories, and shipping carriers, to fill prescriptions, process tests, and deliver orders.
• Service providers that work on our behalf, such as hosting, customer support, payment processing, identity verification, email and text delivery, and analytics providers. They may use personal information only to provide services to us.
• Advertising and analytics partners, as described below. We don’t disclose health information from your visits to them.
• Professional advisors, such as lawyers, auditors, and insurers.
• Authorities and others, when we believe in good faith that it’s required by law, legal process, or to protect the rights, property, or safety of anyone.
• Parties to a business transaction, such as a merger, financing, acquisition, or sale of assets, subject to appropriate confidentiality protections.
• Others with your consent or at your direction.

We do not sell health information, and we do not use or disclose health information from your visits for targeted advertising.

6.Cookies, analytics, and advertising

We use cookies, pixels, tags, and similar technologies to keep the Services working, remember your preferences, understand how the Services are used, and measure and improve our marketing.

• Tag management and analytics. We use Google Tag Manager to manage these technologies, and analytics tools such as Google Analytics to understand site traffic and usage. Learn how Google uses information at policies.google.com/technologies/partner-sites.
• Advertising. We may work with advertising partners that use these technologies to show you COED RX ads on other sites and measure how they perform. This can count as “sharing” or “targeted advertising” under some state laws. You can opt out as described in Your privacy choices.

We configure these technologies so that health information you enter during a visit is not sent to advertising partners.

7.Your privacy choices

• Opt out of targeted advertising, sharing, and sales. Email [privacy email address] with the subject line “Your privacy choices” and we’ll stop using and disclosing your information for targeted advertising. We also treat a Global Privacy Control signal from your browser as a valid opt-out request for that browser, where required by law.
• Cookies. Most browsers let you block or delete cookies. Some parts of the Services may not work properly without them. Our Services don’t respond to “Do Not Track” browser signals.
• Marketing emails. Use the unsubscribe link in any marketing email.
• Text messages. Reply STOP to any message.

We’ll still send messages about your account, care, and orders after you opt out of marketing.

8.Your state privacy rights

Depending on where you live, you may have the right to:

• know whether we process your personal information, and access it;
• correct inaccurate personal information;
• delete your personal information;
• receive a portable copy of your personal information;
• opt out of targeted advertising, sales, and certain profiling;
• limit our use of sensitive personal information, or withdraw consent you’ve given for it; and
• in some states, get a list of the specific third parties to which we’ve disclosed personal information.

To make a request, email [privacy email address]. We’ll verify your identity before responding, usually by confirming information associated with your account. We will never ask for your password. An authorized agent may submit a request for you with proof of authorization. We won’t discriminate against you for exercising your rights.

If we deny your request, you may appeal by replying to our decision. If your appeal is denied, you may contact your state attorney general.

Some information is subject to other laws, such as HIPAA, and may be exempt from these rights. We may also need to keep some information to meet legal obligations, such as medical record and pharmacy record retention requirements.

9.Additional information for California residents

In the past 12 months, we have collected the following categories of personal information, from the sources and for the purposes described above:

• Identifiers, such as name, email address, phone number, mailing address, account username, IP address, and device identifiers.
• Customer records, such as payment and billing information, and the information you give us to verify your identity.
• Characteristics of protected classifications, such as age, date of birth, and sex.
• Commercial information, such as products and services you’ve purchased or considered, and your order history.
• Internet or other network activity, such as pages viewed, links clicked, referring websites, and interactions with our emails.
• Geolocation data, such as approximate location inferred from your IP address.
• Sensitive personal information, such as health information (including sexual health), government ID numbers, account login credentials, and payment card details.
• Inferences, such as preferences and characteristics we infer from the information above.

We disclose each category to service providers and the Medical Group for the business purposes described in this policy. We do not sell personal information for money. We may “share” identifiers, internet activity, and inferences with advertising partners for cross-context behavioral advertising, and you can opt out as described in Your privacy choices. We do not sell or share sensitive personal information, and we use it only for purposes permitted by California law. We don’t knowingly sell or share the personal information of consumers under 16.

We keep each category for as long as described in Data retention.

Under California’s “Shine the Light” law, you may ask once a year whether we disclosed personal information to third parties for their own direct marketing. We don’t. Requests can be sent to [privacy email address].

10.Additional information for Nevada residents

We don’t sell covered information as defined by Nevada law. You may still submit an opt-out request to [privacy email address], and we’ll honor it if our practices change.

11.How we protect information

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and access controls. No system is completely secure, so we can’t guarantee absolute security. Please keep your login credentials confidential and contact us if you think your account has been compromised.

12.Data retention

We keep personal information for as long as needed for the purposes described in this policy, including to provide the Services, meet legal and regulatory requirements (such as medical and pharmacy record retention laws), resolve disputes, and enforce our agreements. When we no longer need it, we delete or de-identify it.

13.Children

The Services are for adults 18 and older. We don’t knowingly collect personal information from anyone under 18. If you believe a minor has given us personal information, contact us at [privacy email address] and we’ll delete it.

14.Changes to this policy

We may update this policy from time to time. If we make material changes, we’ll notify you before they take effect, for example by email or a notice in the Services. The “Last updated” date shows when it last changed.

15.Contact us

Questions or requests about privacy? Email [privacy email address] or write to [COED RX legal entity name], Attn: Privacy, [Mailing address].