Consumer Health Data Privacy Policy

Consumer Health Data Privacy Policy

Effective date: [EFFECTIVE DATE] | Version: [VERSION] | Last updated: [LAST UPDATED]

1. About this policy

1.1 Who we are

WellPeps, a Wyoming corporation (“WellPeps,” “we,” “us”), runs wellpeps.com. We are a brand and service company. We are not a medical practice or a pharmacy, and we do not prescribe, compound or dispense medication. Independent licensed clinicians of [PRACTICE NAME] (the “Practice”) decide whether to prescribe. A prescription is not guaranteed. State-licensed pharmacies prepare and ship medication. Our contact details are in Section 11.

1.2 What consumer health data is

Consumer health data is personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health. It includes information about health conditions, treatments, diagnoses, medications and symptoms; tests, vital signs and body measurements; reproductive or sexual health; gender-affirming care; biometric and genetic data; precise location that could show you are seeking health care; and any information that shows you are seeking health care. It also includes health facts we work out from other information.

For example, your email address together with the health topic of a free guide you asked for can show that you are interested in a health condition or treatment. We treat that as consumer health data.

1.3 Laws this policy is written to meet

We wrote this policy to meet the Washington My Health My Data Act, Nevada SB 370 and the consumer health data provisions of the Connecticut Data Privacy Act. We also considered the Maryland Online Data Privacy Act [VERIFY: applicability, effective dates and strict-necessity rule]. These laws are not identical. We give everyone in the United States the protections in this policy, whatever state you live in. That is a choice, and it does not admit that any law applies to us [DECISION: nationwide approach, counsel to confirm].

1.4 Where to find this policy

A link to this policy is in the footer of every page of wellpeps.com, including the homepage. We also link it at every form that collects your information and in the patient intake.

2. How this policy fits with HIPAA and our other policies

2.1 PHI is covered by the Notice of Privacy Practices

HIPAA protects protected health information (PHI) that the Practice, a pharmacy or another covered entity creates or receives in connection with your care, and that their service providers handle for them. The consumer health data laws generally do not apply to PHI. The Notice of Privacy Practices covers PHI and explains your HIPAA rights, such as access to your medical record.

2.2 The Practice and WellPeps

The Practice is a HIPAA covered entity. When we handle health information for the Practice, we do so as a service provider that HIPAA calls a “business associate.” [PENDING COUNSEL, H1: confirm WellPeps’ HIPAA role before publishing this sentence.]

2.3 What this policy covers

This policy covers consumer health data that is not PHI. Today that means:

• the health topic tied to your email address when you sign up on wellpeps.com for a free guide, a program notice or a waitlist;
• records that show you are seeking or receiving health care and that WellPeps keeps for its own business, such as your order and plan history, support requests and marketing preferences;
• health details you send to WellPeps outside the patient portal, for example in a support email;
• pages-visited records in our web server logs that show you looked at a health-related page; and
• any other information that the law treats as consumer health data and not as PHI.

[COUNSEL: confirm the line between PHI and non-PHI with the HIPAA role decision, item H1.]

2.4 Our other documents

This policy works with the Privacy Policy, the Notice of Privacy Practices, the Cookie and Tracking Technologies Notice, Your Privacy Choices and the Informed Consent to Telehealth Services and Treatment. If two of them differ on consumer health data, the one that protects you more applies.

3. What we collect, why and where it comes from

3.1 What we collect

3.2 Where it comes from

It comes from you (when you fill in a form, use the platform or write to us); from your browser, automatically; and from the Practice, pharmacies, laboratories and our payment processor about your order, for example whether an order shipped.

3.3 Why we collect it

• To give you the product or service you asked for, such as a guide, a waitlist spot, an order or support.
• To run and secure wellpeps.com and our systems, prevent fraud and fix errors.
• To meet legal duties and defend legal claims.
• With your consent only: to send emails about the topic you chose.

We do not use consumer health data for advertising. We collect only what we need. We will not collect more kinds of consumer health data, or use it for a new reason, until we update this policy and, where the law requires, get your consent.

4. Your consent

4.1 When we ask

The laws let us collect and share consumer health data without your consent when it is necessary to give you a product or service you asked for. For anything else, we ask first. We ask separately for collecting and for sharing.

4.2 How we ask

• A separate box that is not part of any terms, any policy or any other agreement.
• Not checked in advance. You must make a clear choice.
• Plain words that say what we collect or share, why, with which kinds of recipients, and how to withdraw.
• No tricks. Saying no is as easy as saying yes, and we will not refuse you a service because you said no, unless we truly need the information to provide it.

4.3 What we ask for today

• On wellpeps.com sign-ups (guides, waitlists and program notices): your consent to collect your email address and the health topic you chose so we can send what you asked for, and a separate, optional consent for follow-up emails about that topic (Appendix A.1).
• In the patient intake: an optional consent to use your email and the program you chose to send you program emails (Appendix A.2). Declining does not affect your care or your order.
• Sharing: today we share consumer health data only as needed to provide the service you asked for (see Section 5). If we ever want to share it for another reason, such as advertising, we will ask first with a separate consent (Appendix B.2). We do not do this today.

4.4 Withdrawing consent

You can withdraw any consent at any time on the Your Privacy Choices page or by emailing [PRIVACY EMAIL]. We will stop the collection or sharing the consent covered within [15 business days]. Withdrawing does not undo what happened before. If we need the information to provide a service you asked for, withdrawing may mean we can no longer provide it, and we will tell you. To take back permission you gave the Practice for PHI, follow the Notice of Privacy Practices and the HIPAA Authorization Forms.

5. Who we share consumer health data with

5.1 Who receives it

“Sharing” here means giving consumer health data to another company. Companies that process it for us under contract (called processors) are not “sharing” under these laws, but we list them so you can see the whole picture.

Affiliates. [VERIFY: None. Confirm whether any related company counts as an affiliate (shares common branding and common control), for example because of the ownership interest of [PEPRITE, INC.]’s principal in WellPeps. If so, list it here.]

Lists on request. You can ask for a list of every third party and affiliate that received your consumer health data, with an email address or online way to contact each. See Section 7.

5.2 Processor contracts

We give consumer health data to processors only under a written contract that limits what they may do with it. [VERIFY: written data protection terms are in place with each processor before this section is published, items B12 and H4.]

5.3 Legal requests

We give consumer health data to a court or agency only when the law requires it. We review each request, and where the law allows we tell you first so you can object. We review any request about reproductive health care or gender-affirming care with counsel before we respond [COUNSEL: confirm this commitment matches WellPeps’ legal-process procedure].

5.4 Other companies tracking you online

Other companies do not collect consumer health data about your online activities over time and across different websites when you use wellpeps.com. Google receives your IP address and browser details when your browser loads our fonts, and we do not authorize it to track you; we plan to host the fonts ourselves [VERIFY: confirm after the tag inventory, including portal.wellpeps.com]. If this changes, we will update this policy first.

6. No sale without your signed authorization

We do not sell consumer health data. [VERIFY BEFORE PUBLISHING: supported for wellpeps.com today; confirm for portal.wellpeps.com, Open item 6.] We will not sell it unless you first sign a separate written authorization that is valid under the law. A consent to collect or share is not an authorization to sell.

A valid authorization is separate from any other document and says, in plain words:

• which consumer health data would be sold;
• who is selling it and who is buying it, with contact details for both;
• why it is being sold and how the buyer will use it;
• that you do not have to sign it to get any product or service;
• that you can revoke it at any time, and how;
• that the buyer may pass the data on and it may no longer be protected by these laws;
• that it expires one year after you sign it; and
• your signature and the date.

We will give you a copy and keep a record for six years. [VERIFY: element lists and record period for Washington and Nevada.] For Maryland residents, we will not sell sensitive data at all [VERIFY: Maryland].

7. Your rights and how to use them

7.1 Your rights

• Confirm. Ask whether we are collecting, sharing or selling consumer health data about you.
• Access. Get a copy of the consumer health data we hold about you, in a portable format where feasible, and a list of all third parties and affiliates that received it, with an email address or online way to contact each.
• Withdraw consent. Take back a consent, as described in Section 4.4.
• Delete. Ask us to delete consumer health data about you.
• Correct. Ask us to fix information that is wrong. This is a right we give you by policy.
• Appeal. Appeal if we say no to a request.

7.2 What happens when you ask us to delete

After we verify your request, we delete the data from our active systems, tell our processors, affiliates and third parties that received it to delete it, and delete it from backups within [6 months] of verifying your request [VERIFY: backup rule per state]. PHI held by the Practice and pharmacies is kept as medical record and pharmacy law requires. We may keep the minimum we need to follow the law, stop fraud or defend legal claims, and we will tell you what we kept and why. Deleting information we need to provide a service may end that service.

7.3 How to make a request or an appeal

• Use the Your Privacy Choices page on wellpeps.com.
• Email [PRIVACY EMAIL].
• Use our web form: [PRIVACY REQUEST WEBFORM].
• Write to WellPeps, Attn: Privacy, [BUSINESS ADDRESS].
• By phone: [SUPPORT PHONE AND HOURS, ONLY IF LIVE] (delete this line unless a staffed line exists; no phone line is live today).

Say which right you want to use and the email address you used with us. Please do not put health details in a request. We check that the request is from you by matching what you tell us with what we hold and, where needed, by sending a link to your email address. You can use an authorized agent with your signed permission. We do not need an account to take your request.

7.4 When we respond

We respond within [45 days]. If we need more time, we may extend once by up to [45 days] and will tell you why [VERIFY: periods per state]. Requests are free. If a request is clearly unfounded or excessive, we may decline it or charge a reasonable fee as the law allows, and we will explain.

7.5 Appeals

If we deny your request in whole or in part, you can appeal within [60 days] of our answer. Email [PRIVACY EMAIL] with “Appeal” in the subject line and say why you disagree. A person who did not decide the first request will review it, and we will answer in writing within [45 days] and give our reasons [VERIFY: appeal timing per state].

7.6 Complaints to your state

If we deny your appeal, you can contact your state attorney general. [VERIFY: current complaint addresses.]

We will not treat you worse for using any of these rights.

8. No location fences

We do not use, and we do not allow anyone working for us to use, a location fence (a virtual boundary based on GPS, cell tower, Wi-Fi or similar data) around any place that provides in-person health care. We do not use one to identify or track people seeking care, to collect health data, or to send messages or ads about health care. The laws set the distance at 1,750 or 2,000 feet depending on the state [VERIFY]. We apply the larger distance everywhere. Our website does not read your device location today.

[VERIFY: when advertising starts, add this rule to every advertising agency and platform contract.]

9. Keeping consumer health data safe

We limit access to consumer health data to the employees, contractors and processors who need it to give you the service you asked for, and each is bound to keep it confidential. We use administrative, technical and physical safeguards that fit the sensitivity of the data. We keep consumer health data only as long as we need it, on the schedule in Section 7 of the Privacy Policy, and then delete it or remove what identifies you. If a security breach affects consumer health data, we will tell you and the regulators as the law requires, including state breach laws and, where it applies, the FTC Health Breach Notification Rule. [VERIFY: safeguards, training and vendor contracts are in place, items H5, H6, H10.]

10. Other promises, children and changes

• Children. Our services are for adults, 18 or older (19 in Alabama and Nebraska, 21 in Mississippi). We do not knowingly collect consumer health data from anyone under 18. If we learn we did, we will delete it.
• De-identified data. If we keep de-identified data, we keep it only in that form and do not try to re-identify it.
• Changes. We will post changes here and update the date. If a change adds a kind of data or a new use, we will ask for your consent first, and we will not apply a change to data we already collected without your consent.

11. Contact

Appendix A. Consent to collect (form wording)

A.1 wellpeps.com sign-up forms (guides, waitlists, program notices)

Two separate boxes, directly above the submit button, neither checked in advance. The form does not submit without the first box. The second box is optional.

☐ I agree that WellPeps may collect and keep my email address, my first name (if I give it) and the health topic I chose ([FORM TOPIC]) so it can send me what I asked for. I can withdraw this consent at any time through Your Privacy Choices or by emailing [PRIVACY EMAIL]. Read the Consumer Health Data Privacy Policy.

☐ Optional: I also agree that WellPeps may use them to send me emails about [FORM TOPIC] and related wellness tips. If I leave this box unchecked, I still get what I asked for. I can withdraw this consent at any time through Your Privacy Choices or by emailing [PRIVACY EMAIL].

A.2 Patient intake: optional program emails (GEN Health form)

Optional. The patient can continue without checking it. The signature block below applies here and to B.1 if it is used.

☐ I agree that WellPeps may use my email address and the health program I chose to send me educational emails and updates about that program. This is optional. If I say no, my care and my order are not affected. I can withdraw this consent at any time through Your Privacy Choices or by emailing [PRIVACY EMAIL].

Electronic signature

By typing my name, I agree that my electronic signature is the legal equivalent of my handwritten signature, and that I have already agreed to receive and sign documents electronically under the Electronic Records, Signatures and Communications Consent.

Appendix B. Sharing (form wording)

B.1 Optional acknowledgment of necessary sharing [DECISION: counsel to confirm whether to use]

Not a consent: sharing that is necessary to provide the service does not need one. Use only if counsel wants the patient to see the sharing before intake. If used, do not call it a consent and do not let declining it look like a free choice.

☐ I understand that WellPeps will give the consumer health information I enter to the Practice, to the pharmacy that fills my prescription and, if I order labs, to the laboratory, only so they can provide the service I asked for. I have read the Consumer Health Data Privacy Policy.

Show as its own box, separate from any collection consent, and not before a clear description is on screen. Do not pre-check it. Name the recipients or their categories from the tag inventory.

☐ I agree that WellPeps may share [CATEGORIES OF DATA] about me with [NAMES OR CATEGORIES OF RECIPIENTS] so that they can [PURPOSE]. This is optional and does not affect my care or my order. I can withdraw this consent at any time through Your Privacy Choices or by emailing [PRIVACY EMAIL].

Technical and drafting notes

Held wording and when it takes effect

Build notes

From: Appendix A. Consent to collect (form wording)

Build notes: each consent is a separate, unchecked box. It must not be combined with any other agreement or with acceptance of any policy. Log each consent (who, when, which version and which text) as set out in Your Privacy Choices, Part 2, Section 2.3, and keep the log for the period in Privacy Policy Section 7. [COUNSEL: confirm wording.]