Privacy Policy
This Policy explains how Heredity collects, uses, discloses, and protects your information when you use our website, application, and membership. Because we collect consumer health data, a separate Consumer Health Data Privacy Notice also applies where required by state law.
Information we collect
Identifiers (name, email, phone, U.S. state, account credentials); health/wellness information you provide at application and consultation (such as age range, wellness focus, whether you are managing a recovery or injury concern, and whether you are under a physician's care); membership and transaction information (plan, billing history — full card details are handled by our payment processor, not stored by us); communications; and device/usage data collected via cookies and analytics.
How we use and share information
We use information to evaluate applications, operate the membership, facilitate consultation with licensed clinicians and fulfillment by licensed pharmacy partners, process payments, communicate with you, maintain security and prevent fraud, and comply with law. We share information with those clinicians and pharmacy partners, our payment processor (Stripe), service providers acting on our behalf under contract, and as required by law or in a business transfer. We do not sell consumer health data, and we do not sell or share personal information for cross-context behavioral advertising as defined by California law.
Consumer health data and HIPAA
Because we collect consumer health data, state laws including the Washington My Health My Data Act, Nevada SB 370, and Connecticut's health-data law may apply; where they do, we provide a separate Consumer Health Data Privacy Notice and obtain the separate consent those laws require before collecting or sharing such data. [Whether HIPAA applies to Heredity, and which breach-notification regime governs (HIPAA vs. the FTC Health Breach Notification Rule), is being confirmed with counsel.]
Your rights
Depending on where you live, you may have rights to access, delete, correct, and obtain a portable copy of your information; to opt out of sale/sharing and targeted advertising; to limit use of sensitive personal information; and to withdraw consent (including for consumer health data). To exercise rights, contact [PRIVACY EMAIL]. We do not knowingly collect information from anyone under 18, and the service is intended for U.S. users only.
Retention, security, and contact
We retain information as long as needed to provide the service and meet legal, tax, and pharmacy recordkeeping obligations, then delete or de-identify it. We use administrative, technical, and physical safeguards, though no method is fully secure. Contact: [LEGAL ENTITY NAME] — Privacy, [ADDRESS], [PRIVACY EMAIL].
Working draft, under final review with counsel ahead of launch. Bracketed items are completed before launch. This is not the final binding agreement until an effective date is posted.