How we protect your data.

We only collect information we need to provide care and operate the clinic. That includes:

• Account basics — name, date of birth, email, phone, and mailing address
• Health information you provide — intake questionnaire answers, medications, medical history, wearable data (if you choose to sync)
• Clinical data we generate — visit notes, lab results, prescriptions, care plans
• Payment information — processed by our payment provider; we store only the last 4 digits and expiration
• Technical data — IP address, device type, browser, portal activity logs (for security and audit)

We share information only when necessary and only with entities under a Business Associate Agreement (BAA) or equivalent contract:

• Labs we order for you (Labcorp, Access Medical Labs, and specialty panels)
• Pharmacies you direct us to send prescriptions to
• Payment processor (Stripe) — for charge authorization only
• Infrastructure providers (Cloudflare, Vercel, Supabase, Sentry, Postmark, Twilio)
• Communication platforms (Healthie, Slack) for internal care coordination
• Government agencies when required by law or to report public-health data

We do not share your information with advertisers, analytics brokers, or unrelated third parties.

You can:

• See what we have on file for you — a full export downloads from the portal in PDF/JSON
• Correct inaccuracies in your chart (some clinical records require a documented amendment; we'll explain)
• Delete your account and have non-record data erased — we retain clinical records for the minimum period required by state law
• Revoke authorizations for information sharing — some may limit our ability to continue care

Residents of California, Colorado, Virginia, and other states with consumer-privacy statutes have additional rights. We honor those rights for all members regardless of state.