Consumer Health Data Privacy Policy

Effective date: [Effective date]

Some state laws give extra protection to information about your health. This policy explains how [Legal entity name] ("StackRx," "we," or "us") collects, uses, and shares that kind of information through joinstackrx.com and the StackRx account, intake, and checkout features (the "Platform"), and the rights you have over it.

It applies to "consumer health data" as defined by Washington's My Health My Data Act, Nevada's consumer health data privacy law, and similar state laws [Confirm list of state laws this policy is written to cover]. It adds to our Privacy Policy, which still applies.

What counts as consumer health data

Consumer health data is personal information that is linked, or reasonably linkable, to you and that identifies your past, present, or future physical or mental health. It can include things you tell us directly, and things that can be inferred, such as the fact that you looked for or bought a particular treatment.

This policy does not cover protected health information that is governed by HIPAA. That information is covered by the Notice of Privacy Practices of the medical group or pharmacy involved: [Links to Notices of Privacy Practices].

Consumer health data we collect

Intake answers, such as health history, symptoms, conditions, current medications, allergies, and health goals.
Photos you upload for your provider to review.
Messages with providers, and any health details you share with our support team.
Treatment information, such as the treatments you ask about, are prescribed, order, or subscribe to. Some treatments can reveal information about hormonal, sexual, or reproductive health.
Eligibility and care status, such as whether a provider approved or declined a request.
Browsing information that relates to health, such as the treatment pages you view while signed in to your account.

We do not collect precise geolocation, and we do not use geofencing around places where health care is provided. [Confirm before publishing]

Why we collect and use it

To give you the service you ask for, including sending your intake to a provider and your prescription to a pharmacy.
To confirm that treatments are available where you live.
To process orders, subscriptions, and shipping.
To answer your questions and provide support.
To keep the Platform secure and prevent fraud.
To meet our legal obligations.

We collect and use consumer health data only with your consent, or when it's necessary to provide a service you've asked for. We don't use it for advertising. [Confirm this commitment]

Where it comes from

You, when you complete your intake, upload photos, send messages, or place an order.
The medical group and your provider, about the status of your care.
Pharmacies, about when your order was filled and shipped.
Your device, when you use the Platform while signed in.

We share consumer health data with these categories of third parties:

The independent medical group ([Medical group name]) and its providers, to review your request and provide care.
Independent pharmacies ([Partner pharmacy names]), to compound, dispense, and ship your medication.
Service providers that process data only on our instructions, such as hosting, secure messaging, payment processing, customer support, and shipping. [List of processor categories]
Government authorities or others, when the law requires it.

Affiliates we share consumer health data with: [List of affiliates, or "None"]

Beyond what's needed to provide the service you asked for, we'll ask for your separate consent before sharing consumer health data. We do not sell consumer health data. [Confirm this commitment]

Your rights

Depending on where you live, you have the right to:

Confirm and access. Find out whether we collect, share, or sell your consumer health data, and get a copy of it. This includes a list of the third parties and affiliates we've shared it with, and how to contact them.
Withdraw consent. Take back your consent for us to collect or share your consumer health data.
Delete. Ask us to delete your consumer health data. We'll also tell the service providers and third parties we've shared it with to delete it, subject to legal exceptions.
Appeal. Ask us to reconsider if we decline your request.

We won't treat you differently for using these rights. Some information may need to be kept by the medical group or pharmacy to meet medical and pharmacy recordkeeping laws.

How to use your rights

Email [Privacy email] or use [Privacy request form URL]. We'll ask you to confirm your identity so we don't give your information to someone else. You can also use an authorized agent where the law allows.

We'll respond within [Response timeframe required by applicable law]. If we need more time, we'll tell you why.

If we decline your request, we'll explain why. You can appeal by replying to our decision or emailing [Privacy email] with "Appeal" in the subject line. We'll respond to your appeal in writing within [Appeal response timeframe]. If you're not satisfied, you can contact your state's attorney general.

Changes to this policy

If we update this policy, we'll change the effective date at the top. Before we collect, use, or share consumer health data in a new way, we'll ask for your consent where the law requires it.

Contact us

[Legal entity name]
[Mailing address]
Email: [Privacy email]