Legal
Privacy Policy
How we collect, use, share, and protect your personal and health information — and the choices you have.
1. Scope of this policy
Puritas Telehealth, LLC ("Puritas," "we," "us," or "our") operates the website at puritasrx.com and the marketing, account, and support services offered through it (together, the "Services"). This Privacy Policy explains what information we collect, why we collect it, who we share it with, and the choices and rights you have.
Puritas is a technology and marketing platform. We do not practice medicine. Clinical care is provided by independent, US-licensed clinicians in our provider network, and medications are dispensed by our partner pharmacy. Those organizations are separate entities with their own privacy practices and their own notices. Where we handle protected health information on their behalf, we do so under written agreements described in Section 12.
This policy does not apply to information you provide directly to a third party — for example, the medical intake you complete on our intake partner's platform, a pharmacy portal, or a payment processor's hosted checkout. Those parties handle that information under their own policies. See Section 15.
2. Information we collect
Information you give us
- Identifiers and contact details — name, email address, postal address, telephone number, and date of birth.
- Account credentials — username and password, where you create an account.
- Health information — the medical history, symptoms, measurements, medications, allergies, photographs, and other clinical details you submit so a licensed provider can review whether treatment is appropriate for you. Much of this is protected health information ("PHI") under HIPAA and consumer health data under several state laws.
- Payment information — collected and processed by our payment provider through secure hosted fields. We receive confirmation of payment, the card brand, and the last four digits. We do not receive or store your full card number, CVV, or bank credentials.
- Communications — the content of emails, chat messages, text messages, support tickets, and call notes when you contact us, including adverse-event reports.
- Marketing preferences — the subscriptions, consents, and opt-outs you record with us.
Information we collect automatically
- Device and connection data — IP address, browser type and version, operating system, device identifiers, language, and referring URL.
- Usage data — pages viewed, links clicked, time on page, scroll depth, and the paths you take through the site.
- Approximate location — a general region derived from your IP address, used to tell you whether we operate in your state. We do not collect precise geolocation from your device.
- Cookie and pixel data — see Section 3.
Information we receive from others
- Our intake, provider, and pharmacy partners — order status, approval or denial of treatment, shipment status, and related account records.
- Payment and fraud-prevention providers — authorization results, chargeback notices, and risk signals.
- Advertising and analytics partners — aggregate campaign and attribution data, subject to the limits in Section 5.
4. How we use your information
We use the information described above to:
- route your intake to a licensed provider and support the provider's review;
- enable our partner pharmacy to dispense and ship any medication a provider prescribes;
- create and administer your account, and authenticate you;
- process payments, subscriptions, refunds, and chargebacks;
- send transactional messages — order confirmations, shipping notices, refill reminders, billing notices, and service announcements;
- provide customer and safety support, including responding to adverse-event reports and complaints;
- operate, secure, debug, and improve the Services, and measure the performance of our content and advertising;
- send marketing communications where you have consented or where the law otherwise permits, subject to Section 7;
- detect and prevent fraud, abuse, and security incidents, and enforce our Terms of Service;
- comply with legal, regulatory, accreditation, pharmacy, and recordkeeping obligations, and to establish, exercise, or defend legal claims.
We may create de-identified or aggregated data that cannot reasonably be used to identify you, and use it for any lawful purpose, including analytics and reporting. We will not attempt to re-identify that data except to test our de-identification methods.
5. We do not sell your health information
We do not sell your personal information or your health information, and we do not share it with third parties for their own independent marketing. We do not use protected health information or consumer health data to target advertising to you, and we do not disclose it to advertising networks.
Some state privacy laws define "sale" and "sharing" broadly enough to capture the use of analytics and advertising cookies on marketing pages. To the extent those definitions apply, you may opt out at any time using the methods in Section 3 and Section 9.
7. Email, telephone, and SMS communications
Transactional messages
We send messages that are necessary to deliver the Services — account, order, shipping, billing, safety, and legal notices. You cannot opt out of these while you have an active account or order, though you can close your account.
Marketing messages
We send marketing email only where permitted by law. Every marketing email includes an unsubscribe link, and we honor unsubscribe requests promptly. You can also email privacy@puritasrx.com to be removed from all marketing.
Text messages
If you provide your mobile number and consent, we may send text messages about your account, your order, and — separately, and only with your express consent — marketing. Consent to receive marketing texts is not a condition of purchase. Message and data rates may apply. Message frequency varies. Reply STOP to any message to opt out and HELP for help, or contact 1-800-000-0000. Carriers are not liable for delayed or undelivered messages.
We do not share mobile telephone numbers, SMS opt-in data, or consent records with third parties or affiliates for their marketing purposes. We share them only with the messaging vendors that deliver messages on our behalf. The full mobile messaging terms are in Section 12 of our Terms of Service.
Calls
We may call you about your account or order. Where we record calls for quality or training, we tell you at the start of the call.
8. How long we keep your information
We keep information for as long as needed for the purposes described in this policy, and then for as long as we are required to keep it. In practice:
- Medical records and prescription records are retained by the provider group and the dispensing pharmacy for the period required by the law of the state in which the provider is licensed or the pharmacy operates — commonly between five and ten years, and longer for records of minors.
- Account and transaction records are retained for the life of the account and then for the period required by tax, accounting, and consumer-protection law.
- Support and safety correspondence, including adverse-event reports, is retained for as long as required by applicable pharmacovigilance and recordkeeping rules.
- Marketing and analytics data is retained for no longer than needed for the purpose it was collected, and consent and opt-out records are retained as evidence of your choices.
When information is no longer needed, we delete it or de-identify it. Deleting your account does not require us to delete records we are legally obliged to keep.
9. Your choices and how to exercise them
Regardless of where you live, you can:
- Access or correct the account information you have given us, by contacting privacy@puritasrx.com.
- Ask us to delete information we are not required to retain.
- Unsubscribe from marketing email and text messages, as described in Section 7.
- Control cookies and send a Global Privacy Control signal, as described in Section 3.
- Close your account and cancel any subscription — see our Shipping, Cancellation & Refunds policy.
Requests about your medical record — access, amendment, restrictions, and an accounting of disclosures — are handled under HIPAA. See our Notice of Privacy Practices.
How to submit a request. Email privacy@puritasrx.com or call 1-800-000-0000. We will verify your identity before acting, usually by confirming details already associated with your account. We respond within the time the applicable law allows — generally 45 days, with one extension where permitted. You may use an authorized agent where state law allows; we may ask the agent for proof of authority and ask you to confirm the request directly.
No retaliation. We will not deny you goods or services, charge you a different price, or provide a different level of service because you exercised a privacy right.
10. State privacy rights
Depending on your state of residence, you may have some or all of the following rights, subject to exceptions in the applicable law. Note that information regulated by HIPAA is generally exempt from these state statutes and is instead governed by our Notice of Privacy Practices.
- Right to know / access — to confirm whether we process your personal information and to obtain a copy, including the categories collected, the sources, the purposes, and the categories of recipients.
- Right to correct inaccurate personal information.
- Right to delete personal information we hold about you.
- Right to portability — to receive your information in a portable, readily usable format.
- Right to opt out of targeted advertising, of the sale or sharing of personal information, and of profiling that produces legal or similarly significant effects.
- Right to limit the use and disclosure of sensitive personal information.
- Right to appeal a decision we make about your request, where your state provides one. To appeal, reply to our decision or email privacy@puritasrx.com with "Privacy Appeal" in the subject line. If we deny your appeal, your state attorney general's office can receive a complaint.
- Right to non-discrimination for exercising any of these rights.
California
California residents have the rights above under the California Consumer Privacy Act, as amended by the CPRA. The categories of personal information we have collected in the preceding twelve months are:
| CCPA category | Examples we collect | Disclosed for a business purpose to |
|---|---|---|
| Identifiers | Name, postal address, email, phone number, IP address, account ID | Providers, pharmacy, service providers |
| Customer records (Cal. Civ. Code § 1798.80) | Name, address, telephone number, payment card last four digits | Payment processor, service providers |
| Protected classifications | Age, sex, and other characteristics relevant to clinical eligibility | Providers, pharmacy |
| Commercial information | Orders, subscriptions, and transaction history | Payment processor, pharmacy, service providers |
| Internet or network activity | Pages viewed, referring URL, session and interaction data | Analytics providers |
| Geolocation data | Approximate region derived from IP address | Analytics providers |
| Sensitive personal information | Health and medical information; account credentials. Used only to provide the Services — never to infer characteristics about you. | Providers, pharmacy |
| Inferences | Product interest derived from the pages you view | Analytics providers |
We do not knowingly sell or share the personal information of consumers under 16 years of age. California residents may also designate an authorized agent, and — under the "Shine the Light" law — request information about disclosures to third parties for their direct marketing purposes. As stated in Section 5, we make no such disclosures.
Other states
Residents of states with comprehensive privacy statutes — including Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia — may exercise the rights listed above to the extent their law provides them. Use the same contact methods in Section 9.
11. Consumer health data
This section is our consumer health data privacy notice for the purposes of the Washington My Health My Data Act, Nevada SB 370, and the consumer health data provisions of the Connecticut Data Privacy Act. It applies to health data that is not already regulated by HIPAA.
- What we collect. Information you provide about your health conditions, symptoms, treatments, medications, measurements, and the treatment categories you browse or express interest in.
- Where it comes from. Directly from you, and from your interactions with our website.
- Why we collect it. To determine whether we can serve you, to route your request to a licensed provider, to fulfill and support your order, and to operate and secure the Services.
- Who we share it with. The licensed providers who review your intake, our partner pharmacy, and the service providers and processors described in Section 6. We do not sell consumer health data, and we do not disclose it to advertising networks.
- Your rights. You may confirm whether we collect, share, or sell your consumer health data; obtain a list of the third parties with which we have shared it; withdraw consent to its collection and sharing; and request its deletion, including deletion by our processors. Email privacy@puritasrx.com with "Consumer Health Data" in the subject line.
- Appeals. If we decline a request, we will explain why and how to appeal. Washington residents may also file a complaint with the Washington Attorney General.
We do not use a geofence around any facility that provides health care services to identify, track, or send advertisements to consumers about their health data.
12. HIPAA and protected health information
The clinicians and the pharmacy that treat you and dispense your medication are covered entities under the Health Insurance Portability and Accountability Act. Where Puritas creates, receives, maintains, or transmits protected health information on their behalf, we act as a business associate and are bound by a written business associate agreement that limits how we may use and disclose that information.
As a business associate we maintain administrative, physical, and technical safeguards required by the HIPAA Security Rule, restrict access to PHI to workforce members who need it, train our workforce, require the same protections from our subcontractors, and notify the covered entity of any breach of unsecured PHI without unreasonable delay.
Your rights in your medical record — to inspect and copy it, to request an amendment, to request restrictions and confidential communications, and to receive an accounting of certain disclosures — are described in our HIPAA Notice of Privacy Practices.
13. How we protect your information
We use safeguards designed to protect personal and health information against unauthorized access, use, alteration, and loss. These include encryption of data in transit over TLS, encryption of sensitive data at rest, role-based access controls and least-privilege provisioning, multi-factor authentication for administrative access, logging and monitoring, vendor security review, and workforce privacy and security training.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Protect your account by using a unique password and not sharing it. If you believe your account has been compromised, contact us immediately at support@puritasrx.com or 1-800-000-0000.
Where a breach of your information occurs, we will notify you and the applicable regulators as and when required by state breach-notification law and, for protected health information, by the HIPAA Breach Notification Rule.
14. Children’s privacy
The Services are intended for adults 18 years of age and older. We do not knowingly collect personal information from children under 13, and we do not knowingly sell or share the personal information of anyone under 16. If you believe a child has provided us information, contact privacy@puritasrx.com and we will delete it.
15. Third-party websites and services
The Services link to websites we do not control — our intake partner, our provider network, our partner pharmacy, payment providers, and informational resources. This policy does not apply to them. Read the privacy notice of any site you visit before providing information. We are not responsible for the content or privacy practices of third-party sites.
16. Where we operate
The Services are intended for people located in the United States, and specifically in the states we serve. Information we collect is processed and stored in the United States. If you access the Services from outside the United States, you do so on your own initiative and are responsible for compliance with local law, and you understand that United States privacy law may differ from the law of your jurisdiction.
17. Changes to this policy
We may update this policy to reflect changes in our practices or in the law. When we do, we will revise the "Last updated" date at the top of this page, and if the change is material we will provide additional notice — by email or a prominent notice on the site — before it takes effect. Continued use of the Services after the effective date of a revision means you accept it.
18. How to contact us
Questions, requests, or complaints about privacy:
Puritas Telehealth, LLC
Attention: Privacy Official
000 Example Street, Suite 000
City, ST 00000
Email: privacy@puritasrx.com
Telephone: 1-800-000-0000
If you are not satisfied with our response, you may contact your state attorney general. For complaints about protected health information, you may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr/complaints. We will not retaliate against you for filing a complaint.