Privacy Policy

1. Introduction

This Privacy Policy describes how MDside ("we", "us", or "our") collects, uses, and discloses your personal information and your protected health information when you use MDside - this website, its checkout, and the patient account that comes with it (together, the "Services").

It also serves as our Notice of Privacy Practices under the Health Insurance Portability and Accountability Act ("HIPAA"): it explains how your protected health information ("PHI") may be used and disclosed, and how you can get access to it. PLEASE REVIEW IT CAREFULLY.

2. Who we are

MDside operates this store. Prescription products offered here require an evaluation by a licensed healthcare provider, who decides whether a prescription is appropriate for you.

We work with independent licensed healthcare providers who review each order, and with licensed pharmacies that fill approved prescriptions. Approved prescriptions are dispensed and shipped by licensed U.S. pharmacies in our fulfillment network.

We also rely on technology and hosting service providers that operate this site, our checkout, our patient records, our email and text messaging, and our payment processing on our behalf.

3. HIPAA compliance statement

MDside is committed to protecting your health information in accordance with HIPAA and applicable state law. The reviewing providers and pharmacies we work with are subject to the same obligations.

Service providers that handle your health information on our behalf do so as our business associates, under written Business Associate Agreements that require them to safeguard it and to use it only to provide services to us.

• We are required by law to maintain the privacy and security of your protected health information.
• We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.
• We must follow the duties and privacy practices described in this notice and give you a copy of it.
• We will not use or share your information other than as described here unless you tell us we can in writing. If you tell us we can, you may change your mind at any time by letting us know in writing.

4. Information we collect

Depending on how you use the Services, we collect:

• Personal information: name, date of birth, sex, email address, phone number, shipping address, and the U.S. state you are located in.
• Protected health information: your answers to the health questionnaire (reason for the request, height, weight, vital signs, medical history, current medications, allergies, lifestyle questions, and screening questions), the products and treatment plan you request, the reviewing provider's decision and clinical notes, prescriptions, and your messages with us.
• Verification photos: in states that require them, a photo of your government-issued ID and, for some treatments, a clinical photo. These are stored privately and viewed only by the people reviewing your request; every view is logged.
• Payment information: your card is collected and processed by our payment processor. We receive confirmation of payment, never your full card number.
• Account and order information: your order history, treatment plan status, shipping updates, and account settings.
• Partial checkout information: if you start checkout and enter your email, name, or phone number but do not finish, we keep that contact information so you can resume where you left off and so we can follow up about your order. Your questionnaire answers are not saved until you submit them.
• Communication preferences: whether you have agreed to receive text messages, calls, emails, or push notifications from us, and when and from which IP address you agreed.
• Usage and device information: IP address, browser and device type, sign-in times, pages viewed, and similar log data, kept for security and legally required audit records.

5. How we use and disclose your health information

We may use or disclose your PHI without your written authorization for the following purposes:

• Treatment: to provide and coordinate your care, including routing your request to a provider licensed in your state, supporting that provider's review, sending an approved prescription to the pharmacy that fills it, and answering your questions about your treatment.
• Payment: to authorize and collect payment for the services and products you order, and to manage any recurring treatment plan you chose.
• Healthcare operations: for quality review, training, customer support, security, legal and regulatory compliance, and improving the Services.

Before a licensed provider reviews your request, our system prepares it for review, including an automated preliminary safety screen and a draft clinical note. Before any automated processing, your case is de-identified: your name is removed, your date of birth is converted to an age, and identifying details are redacted. Automated tools never decide your request. A licensed provider personally reviews and decides every case.

6. Other permitted uses and disclosures

We may also use or share your health information, as permitted or required by law:

• To comply with public health and safety obligations, such as reporting adverse reactions to medications or product recalls.
• For health oversight activities such as audits, inspections, and licensing reviews.
• To report suspected abuse, neglect, or domestic violence when the law requires or permits it.
• To prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
• In response to a court or administrative order, subpoena, or other lawful process.
• To law enforcement, for national security, or to other government agencies when the law requires it.
• For workers' compensation claims, to a medical examiner or funeral director, or for organ and tissue donation, as permitted by law.
• For research that has been approved through a process that protects your privacy.
• To a successor if our practice is sold or merged, under the same protections described here.

We never sell your health information. We do not share it with data brokers, advertisers, or social media platforms.

7. Your rights

When it comes to your health information, you have the right to:

• Get a copy of your medical record: ask to see or get an electronic or paper copy of your record and other health information we have about you. We will provide it, usually within 30 days of your request, and may charge a reasonable cost-based fee.
• Ask us to correct your record: if you think information about you is incorrect or incomplete, ask us to correct it. We may say no, but we will tell you why in writing within 60 days.
• Request confidential communications: ask us to contact you in a specific way (for example, only by email) or at a specific address. We will say yes to all reasonable requests.
• Ask us to limit what we use or share: ask us not to use or share certain information for treatment, payment, or operations. We are not required to agree, and we may say no if it would affect your care. If you pay for a service or product out of pocket in full, you can ask us not to share that information with your health insurer for payment or operations purposes, and we will say yes unless the law requires us to share it.
• Get a list of those with whom we have shared information: ask for an accounting of the times we have shared your health information in the six years before your request, who we shared it with, and why. This excludes disclosures for treatment, payment, and healthcare operations and certain other disclosures, such as ones you asked us to make.
• Get a copy of this notice: ask for a paper copy at any time, even if you agreed to receive it electronically.
• Be notified of a breach: we will notify you if a breach compromises the privacy or security of your information.
• File a complaint: without any retaliation from us (see Section 14).

8. Your choices

For certain health information, you can tell us your choices about what we share. Tell us what you want us to do, and we will follow your instructions, about sharing information:

• With your family, close friends, or others involved in your care.
• In a disaster relief situation.

If you are not able to tell us your preference, for example if you are unconscious, we may share your information if we believe it is in your best interest, or when needed to lessen a serious and imminent threat to health or safety.

We will never share your information without your written authorization for marketing purposes, for the sale of your information, or for most sharing of psychotherapy notes.

9. Exercising your rights

To exercise any of the rights above, or to ask a question about this policy, contact our privacy contact:

• Email: privacy@mdside.com
• Contact form: the contact page on this site (/contact)
• Account messaging: sign in to your account on this site and send us a message

We may need to verify your identity before acting on a request. We will respond within the time federal and state law allow.

10. Someone acting on your behalf

If you have given someone medical power of attorney, or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will confirm the person has this authority and can act for you before we take any action.

11. State privacy rights

Health information we hold as a healthcare provider is governed by HIPAA and the state medical-privacy laws that apply to your care. For other personal information, depending on where you live, you may have additional rights:

• California (CCPA/CPRA): the right to know what personal information we collect and how we use and disclose it, the right to request deletion or correction, the right to opt out of any sale or sharing of personal information (we do not sell personal information; see Section 12 for any third-party tools), the right to limit use of sensitive personal information, and the right not to be discriminated against for exercising these rights.
• Washington (My Health My Data Act): the right to confirm whether we collect, share, or sell consumer health data, to access and delete it, to withdraw consent, and to receive a list of the third parties with whom it has been shared. We do not sell consumer health data.
• Other states: residents of states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others, may have similar rights of access, correction, deletion, portability, and opt-out. Contact us and we will explain how they apply to you.

We honor these rights subject to the record-keeping requirements described in Section 13. Requests can be submitted using any method in Section 9.

12. Cookies and tracking

Essential cookies: we use the cookies needed to keep you signed in, keep your checkout session, and remember choices such as your cookie preference. These are required for the site to work.

Site measurement: we count visits to this site ourselves, on our own systems, without cookies and without sharing the data with an analytics vendor. We keep the page viewed, the referring site, campaign tags in the link you followed, your country, and your device type. Your IP address is used only to tell visitors apart for a day and is not stored.

We do not load third-party advertising or analytics tools on this site.

Do Not Track: browsers do not agree on a standard Do Not Track signal, so we do not respond to one.

13. Text messages, email, and notifications

• Transactional messages: we email you about your order, your provider's review, your shipments, and your account. Only if you separately opt in at checkout, we may also send automated text messages and calls about those same things. Consent to texts is not a condition of purchase. Message frequency varies. Message and data rates may apply. Reply STOP to any text to stop receiving texts, or HELP for help.
• Marketing messages: only if you separately opt in, we may send marketing texts, calls, and emails about offers and promotions. Consent is not a condition of purchase. Reply STOP to any marketing text, or use the unsubscribe link in any marketing email, to opt out at any time.
• Push notifications: if you turn them on in your account, we send push notifications about your orders and messages to that device. You can turn them off in your account or your device settings.
• Minimum necessary: our messages are written to include the minimum information needed, for example "your order has an update" with a link to sign in, rather than medical details.

We keep a record of when and how you gave or withdrew each consent.

14. How long we keep your information

• Medical records (questionnaire answers, review notes, decisions, prescriptions, messages with your care team): retained for at least 7 years, or longer where state law requires, to meet medical record-keeping requirements. Records removed from active view are archived, not erased, during this period.
• Audit logs (who accessed a record, when, and from which IP address): retained as append-only records for HIPAA compliance.
• Account, order, and payment records: kept while your account is active and as needed for the retention above, for tax and accounting purposes, and to resolve disputes.
• Partial checkout contact information: kept until you complete an order or ask us to delete it.

Because these retention periods are legal requirements, we cannot delete medical records on request during the retention window. They remain access-restricted and are used for no other purpose.

15. Information security

We use administrative, technical, and physical safeguards to protect your information, including:

• Encryption of data in transit and at rest.
• Role-based access: staff, reviewing providers, and pharmacies see only the information they need for their role in your care.
• Secure sign-in using one-time codes sent to your email; we never store a password you chose.
• An append-only audit log of every access to a health record.
• Private storage for verification photos and prescription documents, never reachable by public link.
• Written Business Associate Agreements with every service provider that handles your health information.

No system is perfectly secure. If a breach affects your information, we will notify you and any regulators as HIPAA and state law require.

16. Children

The Services are for adults 18 and older. We do not knowingly collect information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

17. Changes to this policy

We may change this policy, and the changes will apply to all information we hold. The current version is always posted on this site with its "Last updated" date. For material changes to how we handle your health information, we will notify you by email or in your account. You may request a paper copy at any time.

18. Complaints

If you believe your privacy rights have been violated, you can file a complaint with us using any method in Section 9. You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights:

• Online: www.hhs.gov/ocr/privacy/hipaa/complaints/
• Mail: Office for Civil Rights, 200 Independence Avenue, S.W., Washington, D.C. 20201
• Phone: 1-877-696-6775

We will not retaliate against you for filing a complaint.

19. Contact

For questions, requests, or complaints about this policy or your health information, contact MDside:

• Email: privacy@mdside.com
• Contact form: the contact page on this site (/contact)
• Account messaging: sign in to your account on this site and send us a message