Privacy Policy

1.1 Information You Provide

We collect information you voluntarily provide when you create an account, complete a health assessment, communicate with us via email, text, chat, or telephone, subscribe to our mailing list or waitlist, or make a purchase.

This may include:

• Personal identifiers: name, email address, phone number, mailing address, date of birth, account information
• Health information: medical history, current medications, clinical conditions, health-related clinical information communicated through emails, texts, chats, and calls, and responses to health questionnaires
• Payment information: credit card details, billing address (processed through our third-party payment processor via an encrypted connection; we do not store full payment card numbers)
• Government-issued identification: when required for identity verification
• Demographic information: gender, age, and other demographic data relevant to the Services

1.2 Information Collected Automatically

When you access our Platform, we may automatically collect:

• Device and connection data: IP address, browser type, operating system, internet connection details, device type and identifiers, and equipment information
• Usage data: referring URLs, pages visited, time spent on pages, click patterns, and other interactions with the Platform
• Geolocation data: approximate location derived from your IP address or device settings
• Cookies and tracking technologies: We use cookies, web beacons, and similar technologies to enhance your experience, gather analytics, and understand Platform usage patterns

1.3 Information from Third Parties

We may receive information from:

• Independently licensed healthcare providers (clinicians, NPs, MDs) and medical professionals who deliver services through our Platform
• Compounding pharmacies that fulfill prescriptions
• Analytics and advertising partners
• Identity verification services

We use the information we collect for the following purposes:

• Treatment, payment, and healthcare operations: Facilitating health assessments, connecting you with licensed healthcare providers, processing prescriptions, and coordinating care through our Provider Network
• Account administration: Managing your account, processing transactions, and fulfilling prescription orders
• Communications: Contacting you about your account, orders, Services, and platform updates
• Marketing: Sending promotional communications with your consent; you may opt out at any time
• Platform improvement: Improving our Platform, Services, user experience, and developing new features
• Security and fraud prevention: Detecting and preventing fraud, unauthorized access, identity verification, and other illegal activities
• Technical support: Diagnosing technical issues and providing customer support
• Legal compliance: Complying with applicable laws, regulations, and legal processes, and enforcing our Terms and Conditions

We may disclose your information to the following categories of recipients:

3.1 Healthcare Providers

We share necessary information with licensed healthcare providers through OpenLoop Health and its affiliated medical professional corporations who deliver medical consultations and treatment through our Platform.

3.2 Compounding Pharmacies

We share prescription and shipping information with our independently licensed compounding pharmacy partners to fulfill your medication orders.

3.3 Service Providers

We engage third-party vendors to perform functions on our behalf, including payment processing (e.g., Stripe), email communications, website hosting and analytics, customer support tools, identity verification, and marketing and advertising assistance. These service providers access your information only as necessary to perform their functions.

3.4 Affiliated Entities

We may share information with our affiliated professional entities, employees, and contractors as necessary to provide and improve the Services.

3.5 Legal and Safety Disclosures

We may disclose your information when we believe in good faith that disclosure is necessary to comply with applicable law, regulation, or legal process; enforce our Terms and Conditions; protect the rights, property, or safety of Blue Oak Services LLC dba Prescriva, our users, or others; or detect and address fraud or security issues.

3.6 Business Transfers

In the event of a merger, acquisition, reorganization, sale of assets, or similar transaction, your information, including customer relationship information, may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

We do not sell your personal information to third parties for their direct marketing purposes.

We use cookies and similar tracking technologies to collect and use personal information about you. Cookies are small data files placed on your device that help us improve the Platform and your experience, understand which areas and features are popular, and count visits.

Most web browsers are set to accept cookies by default. You may set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, some parts of the Platform may become inaccessible or not function properly.

Do Not Track

Some browsers include a “Do Not Track” (“DNT”) feature that signals to websites that you do not want your online activity tracked. At this time, the Platform does not respond to DNT signals. We will update this policy if we adopt a DNT standard in the future.

We implement administrative, technical, and physical safeguards designed to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit and at rest, access controls, and regular security assessments.

You are responsible for maintaining the confidentiality of your account credentials and for restricting access to your device. Please notify us immediately of any unauthorized use of your account.

However, no method of transmission over the Internet or electronic storage is completely secure. While we strive to protect your personal information, the transmission of information via the Internet carries inherent risks. Any transmission of personal information to us is at your own risk. We cannot guarantee the absolute security of your information.

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law (including medical record retention requirements). When we no longer need your information, we will securely delete or anonymize it in accordance with our internal data retention policies.

7.1 Account Information

You may update or correct your account information at any time by contacting us at help@prescriva.com.

7.2 Marketing Communications

You may opt out of promotional emails by clicking the “unsubscribe” link in any marketing email or by contacting us directly. Please note that you may still receive transactional or account-related communications.

7.3 Cookies

Most web browsers allow you to manage cookie preferences. You may set your browser to refuse all or some cookies. Disabling cookies may affect the functionality of our Platform.

7.4 HIPAA Rights

If your information includes protected health information (“PHI”), you have additional rights under HIPAA as described in our Notice of Privacy Practices.

If you are a California resident, you have additional rights under the California Consumer Privacy Act (“CCPA”) as amended by the California Privacy Rights Act (“CPRA”). For full details, see our Privacy Statement for California Residents.

Categories of Personal Information Collected

We may collect the following categories of personal information as defined by the CCPA:

• Identifiers: name, email address, mailing address, IP address, account name, cookies
• Protected classification characteristics: age, gender, and medical conditions
• Internet or network activity: browsing history, search history, and information about your interactions with the Platform
• Geolocation data: approximate location derived from IP address
• Professional or employment information: if provided during intake
• Audio information: recordings from customer service calls, if applicable
• Inferences: inferences drawn from the above information to create a profile about you

Your California Rights

• Right to Know: Request disclosure of personal information collected about you
• Right to Delete: Request deletion of your personal information
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt Out: We do not sell your personal information
• Right to Non-Discrimination: We do not discriminate against you for exercising any of your privacy rights

Exercising Your Rights

To exercise your California privacy rights, contact our Privacy Officer at privacy@prescriva.com. You may also designate an authorized agent to make a request on your behalf. If you use an authorized agent, we may require proof that you have provided the agent written permission and may require the agent to verify their identity.

Our Services are not directed to individuals under the age of 18. Prescriva does not knowingly collect personal information from or provide services to minors under 18. If we learn that we have collected information from a person under 18, we will take steps to delete that information promptly. If you believe we may have collected information from a minor, please contact us at help@prescriva.com.

Our Platform may contain links to third-party websites or services that are not owned or controlled by Prescriva. We are not responsible for the privacy practices, content, or availability of those third parties.

PRESCRIVA DOES NOT CONTROL AND IS NOT RESPONSIBLE FOR WHAT THIRD PARTIES DO IN CONNECTION WITH THEIR WEBSITES OR ONLINE SERVICES. We encourage you to review the privacy policies of any third-party sites you visit. Your interactions with third-party platforms are governed solely by those parties' privacy policies and terms.

We reserve the right to update this Privacy Policy at any time. We will notify you of material changes by posting the updated policy on our Platform with a new effective date. Your continued use of our Services after any changes constitutes your acceptance of the updated policy. We encourage you to review this policy periodically.

If you have any questions about this Privacy Policy or our privacy practices, please contact us:

• Privacy & HIPAA matters: privacy@prescriva.com (Sarkis Arutiunian, Designated HIPAA Privacy Officer)
• General inquiries: help@prescriva.com
• Entity: Blue Oak Services LLC dba Prescriva