Privacy Policy

BioPeakRx Privacy Policy

This Privacy Policy explains how BioPeakRx (“BioPeakRx,” “we,” “our,” or “us”) collects, uses, shares, and protects your information when you visit our website, communicate with us, or receive care via telehealth. It applies to our operations in Arizona, Nevada, Utah, Florida, Texas, Washington, Colorado, and New Mexico (with California coming soon).

This website Privacy Policy is separate from our Notice of Privacy Practices (NPP), which describes in detail how we use and disclose protected health information (PHI) for treatment, payment, and healthcare operations as required by HIPAA.

1. Information We Collect

We may collect the following categories of information when you interact with BioPeakRx online or offline:

• Identification and contact information — Name, email, phone, address
• Account and scheduling information — Appointment details, login credentials
• Health and medical information (PHI) — Medical history, diagnoses, medications
• Billing and payment information — Payment methods
• Device and usage information — IP address, browser type, pages visited
• Demographic and marketing information — Age, location, preferences

We collect information when you:

• Request an appointment or consultation
• Complete intake or consent forms online
• Create a member account or use our patient portal
• Use telehealth or secure messaging tools
• Subscribe to emails or SMS updates
• Participate in promotions, surveys, or events
• Contact our team by phone, text, email, chat, or social media

2. How We Use Your Information

• Provide telehealth services and coordinate your care
• Operate and improve our practice and internal processes
• Communicate with you about appointments, treatment, and support
• Personalize and improve our website and digital services
• Conduct permitted marketing and outreach where allowed by law
• Comply with legal obligations and protect health and safety

3. Telehealth, Multi-State Care, and Consent

BioPeakRx provides telehealth services to patients located in Arizona, Nevada, Utah, Florida, Texas, Washington, Colorado, and New Mexico (with California coming soon), subject to each state's laws. We obtain informed consent for telehealth in accordance with state requirements. Telehealth visits receive the same confidentiality and record protections as in-person visits.

4. How We Protect Your Information

BioPeakRx uses reasonable administrative, technical, and physical safeguards to protect your information, including PHI. These include:

• Encrypted data transmission (SSL/TLS) on websites and portals
• Role-based access controls and secure systems
• HIPAA-aligned vendors and Business Associate Agreements where required
• Workforce policies and training to reduce unauthorized use or disclosure

5. Cookies, Analytics, and Advertising

Our sites may use cookies, pixels, and similar technologies, along with tools such as Google Analytics and advertising platforms, to understand usage and improve services. You can manage cookies and some tracking through browser settings, Google Ads Settings, and the Google Analytics Opt-out Browser Add-on.

6. Sharing and “Selling” of Information

BioPeakRx does not sell your personal information or PHI for money. We may share information with:

• Service providers and business associates
• Licensed pharmacy and laboratory partners involved in your care
• Regulators or others when legally required
• Successors in a merger or asset transfer, under appropriate safeguards

Some state laws may treat certain analytics or ad uses as a “sale” or “share,” in which case you may have opt-out rights described below.

7. Children's Privacy

We do not knowingly market to or collect information online from children under 13 without parent or guardian involvement, consistent with COPPA and applicable state laws. Our services are intended for adults 18 and older.

8. Data Retention

Medical records and PHI are retained and destroyed according to HIPAA, state medical-record rules, and professional standards. Non-medical website and marketing data is retained as needed for the purposes described in this Policy or as required by law.

9. Data Breach Notification

If a breach of unsecured PHI occurs, we will notify affected individuals in accordance with HIPAA and applicable state laws. For other personal information, we follow applicable state breach-notification requirements.

10. Email, SMS, and CAN-SPAM Compliance

Marketing emails will avoid misleading headers or subject lines, include a clear unsubscribe or preference-management option, and be processed promptly when you opt out, consistent with CAN-SPAM and similar laws. Service-related messages (for example, appointment or portal notices) may still be sent where permitted even if you opt out of marketing.

11. State-Specific Privacy Rights

Depending on your state of residence, you may have additional rights such as the right to know, access, delete, correct, or limit certain uses of your personal information, and to opt out of certain data sharing or targeted advertising. To exercise these rights, contact us using the information below. We may need to verify your identity and, where allowed, an authorized agent may act on your behalf. Your HIPAA rights to access, amend, or receive an accounting of disclosures of PHI are described in our Notice of Privacy Practices.

12. Do Not Track

Because there is no standard for browser “Do Not Track” (DNT) signals, our sites may not respond to all such signals. You can limit some tracking by adjusting browser and cookie settings and using available opt-out tools.

13. Your HIPAA Rights and Notice of Privacy Practices

Under HIPAA, you generally have the right to access, request correction of, and in some cases restrict or obtain an accounting of certain uses and disclosures of your PHI. These rights are detailed in our Notice of Privacy Practices, available upon request.

14. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. When we do, we will revise the Effective Date above and may provide additional notice where required.