Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

• Contact details: name, email, phone, mailing address, state of residence
• Account credentials and authentication factors (including multi-factor authentication)
• Health information: medical history, symptoms, treatment preferences, labs, prescriptions, and visit notes
• Payment information: processed through third-party processors (we do not store full card numbers)
• Communications: messages, forms, surveys, feedback, and SMS preferences

1.2 Information Collected Automatically

• Device information: IP address, browser type, OS, device identifiers, user agent
• Usage data: pages visited and features used necessary to operate the Services
• Cookies and similar technologies: session cookies and local storage for core functionality and security

1.3 Information from Third Parties

• Service providers: hosting, email, SMS, payment processors, telehealth platforms
• Healthcare partners: clinicians, pharmacies, labs, and other entities involved in your care

2. How We Use Information

We do not sell your personal data to third parties.

• Provide and operate the Services, including account setup and identity verification
• Deliver telehealth, clinical care, memberships, and related offerings
• Communicate about appointments, programs, care coordination, billing, and account notices via email, phone, or SMS (where you have consented)
• Provide customer support and respond to inquiries
• Security monitoring, fraud prevention, and abuse detection
• Comply with legal, regulatory, and professional obligations

3. How We Share Information

• Service providers under contract who help us operate the Services (hosting, email, SMS, payments, security, telehealth platforms)
• Healthcare partners involved in your care (clinicians, pharmacies, labs)
• Legal and safety disclosures when required by law or to protect rights and safety
• Business transfers in connection with a merger, acquisition, or sale of assets, subject to confidentiality protections

4. SMS and Electronic Communications

If you provide a mobile number and consent during account setup, we may send SMS messages related to appointments, account security, care coordination, and service notices. Message and data rates may apply. Message frequency varies. You may opt out at any time by replying STOP or contacting us. Opting out of SMS does not affect your ability to receive care through other channels we support.

5. Cookies and Tracking Technologies

We use cookies and similar technologies to enable core site features, security, and basic performance. You can manage cookies through your browser settings. Disabling certain cookies may affect site functionality. See our Cookie Policy for more details.

6. Data Security

We use administrative, technical, and physical safeguards appropriate to the nature of the information we handle, including access controls, encryption in transit, and audit logging for certain clinical systems. No system can be guaranteed 100% secure. You use the Services at your own risk and must protect your account credentials.

7. Data Retention

We retain information only as long as necessary to provide the Services, comply with legal and professional obligations, resolve disputes, and enforce agreements. Health records are retained in accordance with applicable law and professional standards.

8. Your Rights and Choices

Depending on your jurisdiction, you may have the right to access, correct, or delete certain information, restrict processing, manage communication preferences, or withdraw consent to telehealth or other services without penalty. HIPAA rights for PHI are described in our Notice of Privacy Practices. Contact us below to exercise these rights.

9. Children's Privacy

Our Services are not directed to children under 18. We do not knowingly collect information from children under 18.

10. Changes to This Policy

We may update this Privacy Policy at any time. Material changes will be reflected by updating the “Last updated” date. Your continued use of the Services after changes constitutes acceptance of the updated policy where permitted by law.

11. Contact Us

Topp Health — privacy@topphealth.com