Privacy Policy

Effective date: [Effective date]

This Privacy Policy explains what information StackRx collects, why we collect it, who we share it with, and the choices you have. It covers joinstackrx.com and the StackRx account, intake, checkout, and messaging features that link to this policy (together, the "Platform").

StackRx is operated by [Legal entity name] ("StackRx," "we," "us," or "our").

Who does what

StackRx is a technology platform. We are not a pharmacy and not a medical practice. We don't compound medications, and we don't make clinical decisions. Three kinds of organizations may handle your information when you use StackRx:

StackRx runs the website, your account, checkout, subscriptions, and customer support.
Independent providers. US-licensed healthcare providers with [Medical group name], an independent medical group, review your intake and decide whether a treatment is right for you.
Independent pharmacies. State-licensed pharmacies ([Partner pharmacy names]) compound, dispense, and ship the medications your provider prescribes.

The medical group and the pharmacies are separate companies. They keep their own patient records and have their own legal duties for them, including under HIPAA where it applies. Their Notices of Privacy Practices explain how they use and share your medical information: [Links to the medical group's and pharmacies' Notices of Privacy Practices].

Consumer Health Data Privacy Policy — extra detail and rights for health data under state laws such as Washington's My Health My Data Act and Nevada's consumer health data law.
Your Privacy Choices — how to opt out, manage cookies, and make privacy requests.
Telehealth Consent — what you agree to when you receive care through the Platform.

Information we collect

Information you give us

Waitlist. If you ask to be told when StackRx reaches your state, we collect your email address and the state you selected.
Account details. Information such as your name, email address, phone number, date of birth, and login details.
Intake and health information. Your answers to the online questionnaire, such as health history, current medications, allergies, symptoms, and goals.
Photos. Photos you upload when a provider needs them to assess your request.
Messages. Messages you exchange with providers and with our support team.
Order and shipping details. Your shipping address, the treatments you order, and your subscription status.
Payment details. Card details go directly to our payment processor, [Payment processor]. We receive limited details, such as card type, the last four digits, and the expiration date. [Confirm what the processor shares with StackRx]
Mobile number for texts. If you choose to receive text messages, we collect your mobile number and a record of your consent.

Information collected automatically

When you visit the Platform, our systems record basic technical information, such as your IP address, browser and device type, the pages you view, the page that referred you, and the date and time of your visit.

We use cookies and similar technologies that the Platform needs to work, such as keeping you signed in and remembering your cart. As of the effective date above, we have not installed analytics or advertising tools. See Cookies and similar technologies for what happens before we add any.

Information from other sources

The medical group and your provider, such as whether a prescription was issued and the status of your care.
Pharmacies, such as when your order was filled and shipped.
Our payment processor, such as whether a payment went through, and signals that help prevent fraud.
Shipping carriers, such as tracking and delivery status.

How we use information

We use information to:

Create and run your account, and show you treatments available in your state.
Confirm that you're eligible, including your age and location.
Send your intake, photos, and messages to the medical group so a provider can review them.
Send prescriptions and order details to the pharmacy that fills them, and track delivery.
Process payments, manage subscriptions and refills, and send receipts and renewal reminders.
Answer your questions and provide support.
Send service messages, such as order updates and account notices.
Send marketing, where you've agreed to it or the law otherwise allows it. You can opt out at any time.
Keep the Platform secure, and detect and prevent fraud and misuse.
Understand and improve the Platform, using aggregated or de-identified information where we can.
Meet our legal obligations and enforce our Terms of Use.

Your health information

Your intake answers, photos, and messages with providers are sensitive. We use them to deliver your care through the Platform and for the other limited purposes the law allows. We do not sell health information, and we do not use it for advertising. [Confirm this commitment before publishing]

How HIPAA applies

[HIPAA role: explain whether StackRx acts as a business associate of the medical group and/or pharmacies, which information that covers, and when StackRx is not subject to HIPAA]

Where HIPAA applies, protected health information is handled under HIPAA and the relevant Notice of Privacy Practices. Information that HIPAA does not cover, such as a waitlist email or website usage data, is covered by this policy and, where it applies, our Consumer Health Data Privacy Policy.

Photos

Photos you upload are used by your provider, and the people who support them, to assess your request. We will not use your photos in marketing without your separate written permission.

We share information only as described here:

With the medical group and your provider, so they can review your request, message you, and decide on treatment.
With pharmacies, so they can compound, dispense, and ship a prescribed medication and answer your medication questions.
With service providers who work on our behalf, such as hosting, payment processing, email and text delivery, customer support tools, and shipping. They may use the information only to provide services to us. [List of service provider categories]
For legal and safety reasons, such as to follow the law or a valid legal process, to protect the rights, safety, or property of our users or others, or to investigate fraud.
In a business change, such as a merger, acquisition, or sale of assets. We'll tell you if your information becomes subject to a different privacy policy.
With your permission, or at your direction.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. [Confirm this commitment before publishing]

Cookies and similar technologies

Cookies are small files a website stores in your browser. We use cookies and similar tools that the Platform needs to work, such as keeping you signed in, remembering your cart, and protecting against fraud.

As of the effective date, we do not use analytics or advertising cookies, pixels, or tags. Before we add any, we will update this policy and, where the law requires it, ask for your consent first. We will not place advertising or analytics tools on the pages where you enter health information. [Confirm this commitment before publishing]

You can block or delete cookies in your browser settings. If you do, some parts of the Platform may not work. We treat a Global Privacy Control signal from your browser as a request to opt out of any sale or sharing of your information. [Confirm GPC handling] See Your Privacy Choices for more.

Text messages

If you give us your mobile number and agree to receive texts, we may send messages about your account, orders, and refills. We'll send marketing texts only if you've separately agreed to them. Agreeing to marketing texts is never a condition of buying anything.

Message frequency varies. Message and data rates may apply.
Reply STOP to stop receiving texts, or HELP for help.
We don't share your mobile number or text consent with third parties for their own marketing.

[SMS program details: program name, short code or number, message types, frequency]

Your choices

Account details. Update them in your account at any time.
Marketing emails. Use the unsubscribe link in any marketing email. We'll still send messages about your account and orders.
Text messages. Reply STOP.
Cookies. Use your browser settings or a Global Privacy Control signal.
Closing your account. Contact us at [Privacy email]. The medical group and pharmacies may be required by law to keep medical and pharmacy records even after you close your account.

Your privacy rights

Depending on where you live, you may have the right to:

Know what personal information we have about you, and get a copy of it.
Correct information that's inaccurate.
Delete your information, subject to legal exceptions.
Opt out of the sale of your information, targeted advertising, and certain types of profiling.
Withdraw consent you gave for us to process sensitive information, including health information.
Appeal if we decline your request.

To make a request, email [Privacy email] or use [Privacy request form URL]. We'll need to confirm your identity before acting on a request. You can use an authorized agent where the law allows; we may ask the agent for proof that you gave them permission. We'll respond within [Response timeframe], and we won't treat you differently for using your rights.

If we decline your request, you can appeal by replying to our decision. If you're not satisfied with the result of your appeal, you can contact your state's attorney general.

To get a copy of your medical or pharmacy records, contact the medical group or the pharmacy that filled your order. We're glad to help you reach them.

How we protect information

We use administrative, technical, and physical safeguards designed to protect your information. No system is perfectly secure, so we can't promise that information will never be accessed without permission. Please keep your password private, and contact us right away if you think someone has accessed your account. If a security incident affects your information, we'll notify you as the law requires.

How long we keep information

We keep information for as long as we need it for the purposes described in this policy, including to meet legal, tax, and accounting obligations and to resolve disputes. [Retention periods by category: waitlist, account, intake answers, photos, messages, order and payment records, device data]

The medical group and pharmacies keep medical and pharmacy records for the periods their own laws require.

Children

StackRx is only for adults 18 and older. We don't knowingly collect information from anyone under 18. If we learn that we have, we'll delete it.

Links to other sites

The Platform may link to websites or services we don't control. Their own privacy policies apply, not this one.

Changes to this policy

We may update this policy from time to time. When we do, we'll change the effective date at the top. If a change is significant, we'll let you know by email or through the Platform before it takes effect. If we want to use health information you've already given us in a new way, we'll ask for your consent where the law requires it.

Contact us

Questions about this policy or your information? Reach us at:

[Legal entity name]
[Mailing address]
Email: [Privacy email]
Phone: [Support phone]