Privacy Policy & Notice of Privacy Practices

Last updated: September 29, 2026

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

1. Who we are

MyRxProvider (“MyRxProvider,” “we,” “us”) is operated by [LEGAL ENTITY NAME], [MAILING ADDRESS]. We run a telehealth platform that connects adults with independent, U.S.-licensed clinicians and, if a clinician prescribes medication, with independent, licensed U.S. pharmacies. MyRxProvider does not practice medicine or dispense medication itself.

This policy covers the website at myrxprovider.com and the information you give us through it. We handle your health information in line with the Health Insurance Portability and Accountability Act (HIPAA) and applicable state law.

2. Your employer’s role, and its limits

Your employer may refer you to MyRxProvider, and you can also use it without an employer code. Either way, your employer never receives your individual health information. Employers that take part receive only de-identified, aggregate program statistics (for example, total enrollment counts). Your intake answers, diagnoses, visit notes, prescriptions and messages are never shared with your employer, and entering an employer access code does not tell your employer that you applied.

3. What we collect

Through this website:

• Your intake (the eligibility quiz): first and last name, date of birth, email, mobile phone, state of residence and sex assigned at birth; height, weight, the BMI calculated from them, and goal weight (optional); whether you have tried to lose weight before; your answers to the safety screening (for example thyroid cancer history, pancreatitis, pregnancy); your health history and any notes you add; whether you take prescription medications and which ones; prior GLP-1 use and dose; whether you take insulin or a sulfonylurea; drug allergies; your employer access code if you have one; and a record of the consents you gave (which documents, the version, and the date and time).
• Employer registrations: company name, website, industry, size, expected participants, headquarters state, the name, title, email and phone of the person registering, and any notes. The partner invite code used to register is checked and never stored. No employee health information is collected.
• Privacy requests: your name, email, the type of request and any details you add.
• Technical data: your IP address, browser type and the pages you request, recorded by our hosting provider for security and to keep the site running. We also store the IP address a form was sent from, together with that submission, to detect fraud and abuse.

Later in your care (not through this website): if you continue after your intake, your care team and our service providers may collect your shipping address, payment details, visit notes, messages, lab results you share and prescription records. Card details are handled by our payment processor; we do not store full card numbers.

Why we collect it: a licensed clinician needs every intake answer to decide safely whether treatment is appropriate for you, so we ask only for what that clinical review requires. Contact details let your care team reach you. Technical data keeps the site secure.

4. How we use and disclose your health information

• Treatment: sharing information with your clinician, care team and the dispensing pharmacy (an independent, licensed U.S. pharmacy) to provide and coordinate your care.
• Payment: billing and collecting payment for your program.
• Healthcare operations: quality review, licensing, audits, customer support and running the platform.
• As required by law: public health reporting, abuse reporting, health oversight, judicial proceedings and law enforcement, in each case only as the law requires or permits.
• With your written authorization: any other use or disclosure. You may revoke an authorization at any time in writing.

5. Who receives your information

These are the only categories of organizations that receive information from or about this website, and what each one gets:

• Vercel Inc. — website hosting and encrypted storage. Vercel hosts this website and runs the server programs that receive your forms. It stores intakes, employer registrations and privacy requests in private storage, encrypted before they are saved. Like any web host, it processes the IP address and browser details of every visit.
• Cloudflare, Inc. — bot protection (Cloudflare Turnstile). When you fill in a form, a security check from Cloudflare may run to tell people from automated bots. It processes your IP address and browser signals for that purpose only. It does not receive your intake answers. Ordinary page views do not contact Cloudflare.
• Telehealth/clinical platform — clinician review. After you submit, your intake is transferred to the clinical platform your care team uses to review it, keep your medical record and message you.
• Independent licensed clinicians — medical review. A U.S.-licensed clinician in your state reviews your intake, may contact you with questions or arrange a video visit, and decides whether to prescribe.
• Independent, licensed U.S. pharmacies — prescription fulfilment and shipping. If a clinician prescribes medication, an independent, licensed U.S. pharmacy receives what it needs to dispense and ship it: your name, date of birth, contact details, shipping address, the prescription, and relevant allergies and medications.
• Payment processor — billing. Once a clinician approves treatment and you choose a plan, a payment processor handles your card and recurring charges. It receives your name, email, billing details and payment amounts, not your health answers.
• Email and text-message providers — communications. When your care team or support emails or texts you, or you email support@ or privacy@myrxprovider.com, the message passes through our email or messaging provider. We keep health details out of email subject lines.

We do not use advertising pixels, analytics tools or third-party trackers on this website. Our fonts and images are served from our own website, so loading a page does not send your IP address to a font or image provider.

6. What we never do

• We never sell your personal information or your health information, and we do not “share” it for cross-context behavioral advertising.
• We never use your health information for advertising, and we never share it with advertisers or data brokers.
• We never give your employer your individual health information.

7. Cookies and browser storage (cookie policy)

This website does not set cookies. It keeps a few non-personal preferences in your browser’s local storage, and none of them contain health information:

• whether you have already seen the welcome pop-up on the home page;
• the treatment, program length and price you last picked on the pricing page;
• for employers, the company code they just generated.

Your intake answers are never stored in your browser. They go straight to our encrypted storage when you press submit; if an older version of the site left a copy of an intake in your browser, the quiz page now deletes it. If the Cloudflare security check runs, Cloudflare may use strictly necessary technical data for that check only, never for advertising. Because we use no advertising or analytics cookies, there is nothing to opt in or out of. You can clear local storage at any time in your browser settings.

8. Security

We protect your information with administrative, technical and physical safeguards, including:

• encryption in transit (HTTPS only, with HSTS);
• encryption at rest: every form submission is encrypted with AES-256-GCM before it is stored, and the key is kept separately from the storage;
• private storage with no website page or web address that lists or downloads submissions;
• access limited to authorized people who need it for your care or to run the service;
• security checks, rate limits and bot protection on every form, and server logs that never record what you typed.

No system is perfectly secure. If a breach affects your information, we will notify you, and where required the U.S. Department of Health and Human Services, without unreasonable delay and no later than 60 days after we discover it.

9. How long we keep information

• Medical records (intakes a clinician has reviewed, visit notes and prescriptions): for the period your state’s medical-records law requires, often 7 to 10 years.
• Intakes that never reach a clinician and employer registrations: only as long as needed to run the program, then deleted. You can ask us to delete them sooner.
• Privacy requests and our responses: 6 years, as HIPAA requires for this documentation.
• Hosting logs: for the limited period set by our hosting provider.

10. Your rights and how to use them

• Access: get a copy of your information and medical records.
• Correction (amendment): ask us to correct information you believe is inaccurate or incomplete.
• Deletion: ask us to delete your information. Once a clinician has reviewed your intake it is a medical record that the law requires us to keep for a set period. For those records we delete everything else we hold about you, restrict the record to legally required uses, and tell you what we kept and why. Anything that is not a medical record is deleted in full, including copies held by our service providers.
• Accounting of disclosures: a list of certain disclosures we have made.
• Restrictions: ask us to limit how we use or disclose your health information.
• Confidential communications: ask us to contact you in a specific way or at a specific place.
• Breach notification: be told if a breach compromises the privacy of your health information.
• Paper copy: receive a paper copy of this notice on request.

How to make a request: use our privacy request form or email privacy@myrxprovider.com. We confirm your identity before releasing or deleting anything, usually by asking you to reply from the email address on your intake, and we respond within 30 days. Residents of states with their own privacy laws have these rights too, and we will not treat you differently for using them.

If you believe your privacy rights have been violated, you may complain to us at privacy@myrxprovider.com or to the U.S. Department of Health and Human Services Office for Civil Rights. You will not be retaliated against for filing a complaint.

11. Emails and text messages

• Care and account messages (for example about your intake, prescription, shipment or billing) are sent because they are part of your care. They are not marketing.
• Marketing emails, if we send them, always include a working unsubscribe link and our mailing address. We honor unsubscribe requests within 10 business days and apply them across every list we use.
• Text messages: by submitting the intake you agree that your care team may text you about your care. Message and data rates may apply. Reply STOP to opt out of texts at any time; reply HELP for help. Consent to texts is not a condition of buying anything.

12. Age requirement

MyRxProvider is only for adults aged 18 and over. The intake checks your date of birth, and our server rejects any intake from someone younger than 18. We do not knowingly collect information from children.

13. Changes to this notice

We may update this notice from time to time. The current version is always posted at this address with its effective date, and the version you accepted is recorded with your intake. If we make a material change to how we use health information you already gave us, we will tell you before the change applies to you.

14. Contact

Privacy Officer, [LEGAL ENTITY NAME], [MAILING ADDRESS] · privacy@myrxprovider.com