Privacy Policy

1. How this policy relates to your medical information

Medical care offered through the Service is provided by independent medical practices and their licensed clinicians (the "Medical Group" and "Providers"). Prescriptions are filled by independent pharmacies, and lab tests are processed by independent laboratories.

Health information created or maintained by a HIPAA-covered provider, or handled on that provider's behalf, may be protected health information ("PHI") under HIPAA. The Medical Group's Notice of Privacy Practices explains how it uses and discloses PHI and how you can exercise your medical-record rights. That notice is separate from this website Privacy Policy and is provided in the clinical care process.

Where Purvue handles PHI on behalf of the Medical Group, that processing is governed by HIPAA and applicable business associate agreements. We do not sell PHI or use medical records or patient-portal information for advertising.

Not every piece of information about health is covered by HIPAA. Public-page activity or a general support inquiry may be governed by other privacy laws. Our Consumer Health Data Privacy Policy explains how we handle covered consumer health data outside HIPAA.

2. Information we collect

Information you give us

• Contact and account details, such as your name, email, phone number, date of birth, mailing address, and information needed to administer your account
• Information you send to customer support or submit through a service you choose to use
• Your communication and marketing preferences
• Health information you provide through the clinical platform, subject to the Medical Group's privacy notices and the applicable protections described in Section 1

The public marketing website does not include a health-history form or payment form. Please use the patient portal for medical questions and avoid sending health records, passwords, or full payment-card details by ordinary email.

Payment information

Payment-card information is entered in the hosted checkout and handled by its payment providers. It is not collected by the public marketing website. Purvue may receive limited billing, order, and transaction information needed to administer a purchase, refund, or support request. The applicable payment provider is identified in the checkout process, and its own privacy notice also applies.

Information collected automatically

Our hosting and security providers may process technical request information, including your IP address, browser and device details, requested pages, timestamps, and referring information where available, to deliver and protect the website. Product searches and filters on the public website are processed in your browser and are not sent to an analytics or advertising service.

Information from other sources

We may receive account, order, and service information from the clinical platform, payment providers, pharmacies, laboratories, and other service providers when needed to administer the service you requested. We do not currently receive public-website data from advertising pixels or session-replay tools.

3. Cookies and your privacy choices

Essential technologies. The website and hosted account services may use cookies or similar technologies needed for page delivery, security, authentication, and preferences. The patient portal is operated through a separate hosted platform.

Optional tracking. The public website currently does not load Google Analytics, Google Tag Manager, advertising pixels, retargeting tags, or session-replay tools. There is therefore no optional advertising or analytics cookie setting to turn off on this website. We do not send your product-search terms or health information to those tools.

If we introduce optional tracking, we will update this policy, identify the relevant purposes and providers, and offer the choices or obtain the consent required by applicable law before deploying it. We do not use patient-portal or medical-record information for advertising.

Your choices

• Use the "Your privacy choices" footer link to return to this section at any time
• Contact support@purvuehealth.com to request access, correction, deletion, or another applicable privacy right; include the type of request, but do not send medical records or payment-card details
• Use your browser settings to block or delete cookies; disabling essential cookies in the hosted portal may affect login or account features
• A Global Privacy Control signal expresses an opt-out of sale or sharing for advertising. We do not currently sell or share public-website information for cross-context behavioral advertising or targeted advertising, so no additional advertising opt-out is needed for our current website practices

We do not treat a "Do Not Track" browser signal as a separate preference mechanism. The privacy rights and choices described here remain available regardless of that setting.

4. How we use information

We use information to:

• operate the Service, create and manage your account, and connect you with Providers, pharmacies, and labs
• process payments, orders, shipments, refunds, and cancellations
• provide customer support and send service messages about your account, care, and orders
• send marketing emails and texts if you have opted in
• maintain and improve the performance, reliability, and usability of the Service
• protect the Service, prevent fraud, and keep information secure
• comply with the law and enforce our Terms and Conditions

5. How we share information

We share information with:

• The Medical Group, Providers, pharmacies, and labs, so they can evaluate you, fill prescriptions, and process lab tests
• Service providers that work on our behalf, including our telehealth technology platform, website hosting, payment processing, customer support, email and text messaging, shipping, and security vendors. Vendors that handle PHI sign agreements requiring them to protect it as HIPAA requires.
• Authorities and others when required, to comply with the law or legal process, or to protect the rights and safety of our users, Purvue, or others
• A successor business, if Purvue is involved in a merger, sale, or reorganization, subject to this Privacy Policy and applicable law

We do not sell personal information or consumer health data, and we do not share personal information for cross-context behavioral advertising or targeted advertising. We do not use medical records or patient-portal information for advertising. Necessary disclosures to service providers and clinical partners are described above; a service-provider disclosure is not permission for that provider to use the information for its own unrelated marketing.

6. Marketing emails and text messages

We send marketing emails and texts only if you opt in. Consent is not a condition of purchase. Message frequency varies, and message and data rates may apply. Reply STOP to any text to unsubscribe or HELP for help, or use the unsubscribe link in any email. We do not share mobile opt-in information with third parties for their own marketing. We will still send service messages about your account, care, and orders.

7. How we protect information

We use safeguards appropriate to the information and the Service, including encrypted connections and controls intended to limit access to authorized people and service providers. No system is completely secure, so we cannot guarantee absolute security. Keep your password private, use available account-security features, and tell us promptly if you suspect unauthorized access. Please do not send sensitive medical or payment information by ordinary email.

8. How long we keep information

We keep information for as long as needed to provide the Service, meet legal, tax, and accounting requirements, resolve disputes, and enforce our agreements. Medical records are kept by the Medical Group for the period required by law, which is typically several years after your last visit.

9. Your privacy rights

Depending on the state where you live, you may have the right to:

• know what personal information we have collected about you and how we use and share it
• get a copy of your personal information
• correct inaccurate information
• delete your personal information, subject to legal exceptions
• opt out of the sale or sharing of personal information and of targeted advertising
• limit the use of sensitive personal information
• not be treated differently for exercising these rights
• appeal if we deny your request

To make a request, email support@purvuehealth.com, call (617) 893-0460, or write to our mailing address below. You do not need to open a new account. We use only the information reasonably needed to authenticate and respond to your request. We respond within the period required by applicable law; that period and any permitted extension depend on the right and the state involved. If we need additional time or cannot honor a request, we explain why and provide any applicable appeal instructions. You may use an authorized agent as permitted by law.

Medical-record rights under HIPAA are handled by the Medical Group. To request access to, amendment of, or a copy of your PHI, use the Medical Group's Notice of Privacy Practices or contact us so we can route your request. Non-PHI consumer health data may have separate protections under our Consumer Health Data Privacy Policy.

California residents. Depending on your use of the Service, the categories described in Section 2 may include identifiers and customer records, account credentials, commercial or order information, internet activity, general location from IP address, and health information. The purposes and recipients are described in Sections 4 and 5, and retention is described in Section 8. We do not sell or share this information for cross-context behavioral advertising, use sensitive personal information for unrelated purposes, or knowingly sell or share the personal information of minors. Where California law applies, you may exercise applicable access, portability, correction, deletion, opt-out, and sensitive-information rights without discriminatory treatment. You may also request information about disclosures for third parties' own direct marketing under California's "Shine the Light" law; we do not make such disclosures.

Washington and Nevada residents, and other individuals covered by those states' consumer-health privacy laws. Our separate Consumer Health Data Privacy Policy explains the relevant data categories, sources, purposes, disclosures, and procedures for access, withdrawal of consent, deletion, and appeals. Whether a particular law applies depends on its scope and exemptions.

10. Children

The Service is for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us information, contact us and we will delete it.

11. Third-party links and services

The Service may link to websites or services we do not control. Their privacy practices are governed by their own policies.

12. United States only

The Service is intended for individuals in the United States. Our service providers may process information where they operate, subject to applicable law and required safeguards. The Medical Group's privacy notices govern its handling of clinical records. Please contact us if you have questions about the service provider handling your information.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last updated" date and provide additional notice for material changes where required, including by email or through the Service. When a new use or disclosure requires your consent, an update to this policy alone does not replace that consent.

14. Contact us