Privacy Policy

This Privacy Policy explains how DirectRxCare ("DirectRxCare," "we," "us," or "our") collects, uses, discloses, stores, and protects information when you visit directrxcare.com (the "Site"), create an account, complete a medical intake, or receive telehealth or pharmacy fulfillment services (collectively, the "Services"). It applies to all visitors and patients in every jurisdiction we serve.

Health information created or received in the course of treatment is also governed by the U.S. Health Insurance Portability and Accountability Act ("HIPAA") and described in our HIPAA Notice of Privacy Practices. Where the HIPAA Notice and this Policy conflict with respect to protected health information ("PHI"), the HIPAA Notice controls.

1. Information We Collect

Information you provide

• Identity and contact data: name, date of birth, sex assigned at birth, email address, phone number, billing and shipping address.
• Health information: medical intake answers, height and weight, medical and surgical history, current medications, allergies, lab results, photographs you choose to upload, and messages exchanged with clinicians.
• Government identification: a photo ID or selfie where required to verify identity before a prescription is issued.
• Payment data: processed by our PCI-DSS compliant payment processors. We do not store full card numbers on our systems.
• Communications: support requests, survey responses, and consent records.

Information collected automatically

• Device and browser type, operating system, IP address, and approximate location derived from IP.
• Pages viewed, referring URLs, session timestamps, and interactions with the Site.
• Cookies, local storage, and similar technologies (see Section 8).

Information from third parties

• Prescribing clinicians and licensed compounding pharmacies involved in your care.
• Laboratories, where lab work is part of your treatment plan.
• Shipping carriers, identity verification vendors, and fraud prevention providers.

We do not knowingly collect information from children under 18. The Services are intended only for adults 18 years of age or older.

2. How We Use Information

• To provide telehealth evaluation, prescribing, and pharmacy fulfillment services.
• To verify your identity and confirm eligibility for treatment in your state or country.
• To process payments, subscriptions, refunds, and shipping.
• To communicate with you about your care, orders, refills, and account.
• To provide customer support and respond to your requests.
• To operate, secure, troubleshoot, and improve the Services, including aggregated and de-identified analytics.
• To send marketing communications where permitted by law and with your consent where consent is required. You may opt out at any time.
• To comply with legal, regulatory, pharmacy, licensing, adverse event reporting, and recordkeeping obligations.

We do not sell your personal information, and we do not sell or share your health information for advertising or cross-context behavioral advertising purposes. We do not use PHI for marketing without your prior written authorization.

3. Legal Bases for Processing (EEA/UK)

Where the EU or UK GDPR applies, we rely on:

• Contract — to deliver the Services you request.
• Explicit consent — for processing health data and for optional marketing.
• Legal obligation — for medical recordkeeping and regulatory reporting.
• Legitimate interests — for security, fraud prevention, and service improvement, balanced against your rights.
• Vital interests — in a medical emergency.

4. How We Disclose Information

We disclose information only as described below:

• Treating clinicians and pharmacies — to evaluate you, issue prescriptions, and dispense and ship medication.
• Service providers (business associates): hosting, database, email and SMS delivery, telehealth platform, payment processing, shipping, analytics, and customer support vendors. Each is bound by a written contract — and, where PHI is involved, a HIPAA Business Associate Agreement — limiting use of your information to the services they perform for us.
• Legal and safety disclosures: when required by law, subpoena, court order, or regulator, or to prevent serious harm.
• Business transfers: in a merger, acquisition, or asset sale, subject to this Policy and applicable law.
• With your direction or authorization: including disclosures to family members or other providers you designate.

We never disclose your health information to data brokers.

5. Data Security

• Encryption of data in transit (TLS 1.2+) and at rest.
• Role-based access controls, unique credentials, and least-privilege access.
• Audit logging of access to health records.
• Annual HIPAA Security Rule risk assessments and workforce privacy and security training.
• Written incident response procedures, including breach notification as required by law.

No method of transmission or storage is completely secure. If we discover a breach of unsecured PHI or personal information, we will notify affected individuals and regulators within the timeframes required by HIPAA, state breach laws, and GDPR Articles 33–34, as applicable.

6. Data Retention

We retain medical records for the period required by the law of the state or country in which care was provided — generally a minimum of seven (7) years after the last date of service, and longer where state law or a legal hold requires. Non-medical account, billing, and marketing records are retained only as long as needed for the purposes described above, then deleted or de-identified.

7. Your Privacy Rights

All patients (HIPAA)

You have the right to access, obtain a copy of, request amendment of, and receive an accounting of disclosures of your health record; to request restrictions and confidential communications; and to receive a paper copy of our HIPAA Notice. See the HIPAA Notice of Privacy Practices for details and how to exercise them.

California residents (CCPA/CPRA)

• Right to know the categories and specific pieces of personal information we collect and disclose.
• Right to delete and right to correct personal information.
• Right to opt out of sale or sharing — we do not sell or share personal information.
• Right to limit use of sensitive personal information.
• Right to non-discrimination for exercising these rights.

Medical information governed by HIPAA or the California Confidentiality of Medical Information Act is exempt from CCPA but remains protected under those laws.

Other U.S. states

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have rights to access, correct, delete, and port personal data, to opt out of targeted advertising and profiling, and to appeal a denied request. Washington and Nevada residents also have rights under the My Health My Data Act and NRS 603A regarding consumer health data; we obtain separate consent before collecting or sharing consumer health data where those laws require it.

EEA, UK, and Switzerland (GDPR)

You have rights of access, rectification, erasure, restriction, portability, objection, and withdrawal of consent, and the right to lodge a complaint with your supervisory authority. International transfers of personal data out of the EEA/UK are made under the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, with supplementary safeguards.

Canada (PIPEDA) and other jurisdictions

Where local law grants broader rights than this Policy describes, we honor the law that provides the greatest protection to you.

How to submit a request

Email privacy@directrxcare.com or call 1-866-937-0442. We verify your identity before fulfilling a request and respond within 45 days (CCPA/state laws, extendable by 45 days), 30 days (GDPR/UK, extendable by 60 days), or 30 days (HIPAA access requests, extendable once by 30 days). An authorized agent may submit a request with written permission. We do not charge a fee except as permitted by law for excessive or repetitive requests.

8. Cookies and Tracking

We use strictly necessary cookies for authentication, session management, and security; functional cookies to remember preferences; and limited analytics cookies to understand aggregate Site usage. We do not place advertising or third-party marketing pixels on pages where health information is collected, and we do not transmit intake responses to advertising networks. You may control cookies through your browser settings and may signal opt-out through Global Privacy Control (GPC), which we honor as a valid opt-out request.

9. SMS and Email Communications

With your consent, we may send treatment, order, shipping, and refill messages by email or SMS. Message and data rates may apply. Reply STOP to unsubscribe from SMS or use the unsubscribe link in any marketing email. Transactional and clinical messages related to active treatment may continue as necessary for your care.

10. Third-Party Links

The Site may link to third-party websites we do not control. Their privacy practices are governed by their own policies.

11. Changes to This Policy

We may update this Policy. Material changes will be posted here with a revised "Last updated" date and, where required, communicated to you directly. Continued use of the Services after the effective date constitutes acceptance of the updated Policy.

12. Contact and Complaints

Contact our Privacy Officer at privacy@directrxcare.com or 1-866-937-0442. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr, with your state attorney general, or with your data protection authority. We will never retaliate against you for filing a complaint.