Effective Date: [MM/DD/YYYY]

This Privacy Policy explains how your information is collected, used, and protected when you use this website and related services offered by your physician.

Your physician is responsible for your medical care and maintains their own Notice of Privacy Practices (NPP), which applies to your medical information. This Privacy Policy describes how the systems supporting your physician’s site handle personal and health information in accordance with HIPAA and applicable law.

1. Information We Collect

When you use this site, we collect information needed to provide services, support your physician, and keep the site secure. This may include:

• Personal Information such as your name, email address, phone number, mailing address, and payment details.
• Health Information (PHI) provided by your physician, such as Letters of Medical Necessity (LMNs), diagnosis codes, or eligibility details. This health information is used only for your treatment, payment, and healthcare operations, and is not shared with merchants.
• Account & Usage Data including login credentials, device and browser type, IP address, and site activity.
• Support Interactions such as emails, phone calls, or chats with the support team.

2. How We Use Your Information

The information we collect is used to support your physician in delivering care and to make the site work as intended. Specifically, we use it to:

• Support your physician in providing care and managing eligibility for services.
• Process orders, payments, and deliveries.
• Provide customer support.
• Monitor performance, maintain security, and improve the platform.
  
   

Your health information (PHI) is used exclusively for treatment, payment, and healthcare operations, unless you provide written permission for another use. Your physician may also offer targeted health-related communications, such as educational resources or promotional content. These will only be sent if you explicitly opt in, and you may unsubscribe at any time.

3. Sharing Your Information

We share information only in limited circumstances that are necessary to support your care and operate the site. This may include:

• Your Physician and Their Staff, to support treatment and care.
• Service Providers that host, process payments, manage messaging, or provide analytics. These providers are bound by strict security obligations.
• Merchants (Food Providers), who receive only the information necessary to fulfill orders. They do not receive PHI.
• Legal Authorities, if disclosure is required by law.
• Business Transfers, if we are involved in a merger, acquisition, or similar transaction.

4. Your Choices and Rights

You have choices and rights with respect to your information:

• You may opt out of promotional emails at any time by clicking “unsubscribe.”
• You may request access to, or deletion of, your personal account information by contacting us.
• For medical records and other PHI, you have rights under HIPAA, including the ability to request access, amendments, or an accounting of disclosures through your physician’s office.
• If you are a California resident, you have rights under the California Consumer Privacy Rights Act (CPRA). These include the right to request access, deletion, and correction of personal information, as well as the right to limit its use or opt out of its sale or sharing. Links to exercise these rights will be available on this site.

5. How We Protect Your Information

We use technical, administrative, and physical safeguards to protect your information, including:

• Encryption at rest and in transit.
• Secure hosting on Microsoft Azure’s HIPAA-compliant environment.
• SOC 2 and HIPAA compliance programs, which are currently in progress.

6. Data Retention

We keep health-related records for at least ten years, or longer if required by law. For minors, records are kept until they reach adulthood plus the additional years required under state law.

7. Cookies and Tracking

This site uses cookies and similar technologies to maintain security and improve your experience. Advertising or retargeting cookies are not used by default. If a physician or merchant customizes their site to include such technologies, additional disclosures and opt-out options will be provided as required by law.

8. Children’s Privacy

Our Services are not directed to children under 13. We do not knowingly collect personal information from children under 13 without parental consent.

9. Changes to This Policy

We may update this Privacy Policy from time to time. If we make significant changes, we will update the effective date and post the revised version on this site.

10. Contact Us

If you have questions about this Privacy Policy, please contact us at:

• Email: privacy@[company].com
• HIPAA Privacy Officer: [Insert Name/Title/Email]
• Mailing Address: [Insert Address]
  
   

You may also contact your physician’s office directly for requests related to your medical records.