Consumer Health Data Privacy Policy

Last Updated: April 17, 2026

This Consumer Health Data Privacy Policy (“CHDPP”) supplements the Ivy Rx, PLLC (“Ivy”, “us”, or “we”) Privacy Policy and is effective March 31, 2024. The Privacy Policy describes personal information that we collect and the sources from which we collect it. Capitalized terms used but not defined in this CHDPP shall have the meaning in the Privacy Policy.

This CHDPP is required by consumer health data laws enacted in Washington and Nevada and applies only to personal information that is considered “Consumer Health Data” under those laws. This CHDPP does not address or apply to information or practices that are not subject to these laws. This CHDPP provides additional terms that apply to residents of Washington and Nevada. In the event of a conflict between this CHDPP and our Privacy Policy, this CHDPP shall take precedence for Washington and Nevada residents with regard to Consumer Health Data. 

Certain information you provide through our Website or Services may relate to your health. However, not all health-related information is regulated under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). HIPAA only applies to specific types of organizations. Ivy is not an entity subject to HIPAA, and information you submit through our Website or Service is not “protected health information” under HIPAA. As a result, health-related information you submit through the Website or Service is not subject to HIPAA privacy and security requirements, even if that same type of information would be protected if provided directly to a HIPAA covered health care provider or health plan.

Collection and Use of Consumer Health Data

The Consumer Health Data we collect depends on the context of your interactions with us and, in most cases, the information that you decide to share with us. Depending on applicable law and how you interact with Ivy Rx we may collect the following categories of Consumer Health Data: 

• Individual health conditions, treatment, diseases, diagnosis, medical interventions, health-related surgeries or procedures, e.g., medical history you provide on our telehealth form.
• Use or purchase of prescribed medication, e.g., GLP-1s.
• Bodily functions, vital signs, symptoms, or measurements of health information, e.g., your weight.
• Diagnoses or diagnostic testing, treatment, or medication, e.g., prescriptions and supplements you take.
• Precise location information that could reasonably indicate your attempt to acquire or receive health services or supplies or data that identifies a consumer seeking health care services, e.g., information about prescription medications you search, which may reveal that you have a specific health condition, that you are seeking treatment for a specific condition, or are seeking treatment for someone else with a specific condition.
• Other information that may be used to infer, derive, or extrapolate data related to the above or other health information.

[Internal examples:

This Consumer Health Data may be collected through your purchase of medication through our Website or Services or in connection with you seeking healthcare services accessible through our Website or Services (e.g., through collection of your medical history). 

This Consumer Health Data may be combined with identifiable information that we passively and automatically collect about you when you visit our Website such as your IP address, device ID, or unique advertising IDs, and personal information that you may actively provide to us when requesting a prescription or product.

As further described in our Privacy Policy and subject to applicable law, we may collect and use Consumer Health Data for the following purposes:

• Providing and managing our services, including our Website and Services. (e.g., processing and delivering an order you place).
• Administrative purposes, e.g., providing customer service (including online service and virtual chats), analytic services, auditing, security or troubleshooting, improving our Website and Services, and other related actions to provide and maintain our Website and Services and inform our business strategies.
• Research activities, e.g., for technological and product development.
• Activities to provide and enhance our Website and Services, e.g., verifying, maintaining, or enhancing quality or safety of our Website and Services. 
• Communicating with you.
• Complying with legal and regulatory obligations.
• Commercial purposes, e.g., business transactions.
• For short-term, transient use including, but not limited to, non-personalized advertising shown as part of your current interaction with us.
• Providing advertising and marketing services, including for cross-context behavioral advertising where certain limitations are met.
• Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
• For other purposes at your direction or with your consent.

We will process Consumer Health Data in accordance with our policies and procedures. 

Sources of Consumer Health Data

The Consumer Health Data we collect depends on the context of your interactions with our Website and Services and, in most cases, is information that you directly decide to share with us. 

As described further in our Privacy Policy, these sources further include: 

• You and sources authorized to provide Consumer Health Data on your behalf.
• Your interactions with our Website and Services.
• Your personal devices.
• Third parties that provide access to information you make available, e.g., social media.
• Our business and marketing partners, who provide us with information about consumers who are viewing our content across Websites or selecting our Services.
• From third-party sources, e.g., market research companies conducting non-clinical research.
• From publicly available sources.

We also may collect and use additional categories of Consumer Health Data that are not in this CHDPP as consented by you.

How Consumer Health Data May be Shared

As described in our Privacy Policy, and consistent with applicable law, we may share the categories of Consumer Health Data described above as follows:

• To our service providers and partners, including companies essential to providing you with the Services and completing transactions initiated by you and providing us with business or operational services, e.g., threat detection, data hosting, payment processing, billing and collections, text and email delivery, fulfillment, infrastructure provisioning, IT services, and other administrative services.
• To our professional advisors, e.g., accountants and attorneys, for the purpose of seeking professional services or advice.
• To parties with whom you have a direct relationship for the purpose of providing Services and completing transactions initiated by you.
• For business transactions, including as part of the negotiation of or in connection with a business transaction, e.g., acquisition, merger, or bankruptcy.
• For legal obligations, including to government or regulatory agencies or third parties in connection with establishing, exercising, or defending a legal action; to comply with laws or respond to lawful process; to protect our rights and the rights of others, to protect the health or safety of us or others; including to enforce agreements and policies; to detect or prevent fraud; or as otherwise required by law.
• To third parties at your direction or with your consent, e.g., disclosures for certain advertising or promotional efforts, including allowing third parties to collect Consumer Health Data across our Websites.

• To the following affiliates for business and operational purposes: [list or link to separate page that can be updated without updating the policy]

In the event we process deidentified data, we agree to maintain and using deidentified data without attempting to reidentify a consumer except as permitted by law, and we will contractually obligate any recipients of such data to satisfy these criteria.

How to Exercise Your Rights Regarding Consumer Health Data

You may have certain rights to your Consumer Health Data under applicable state law (e.g., access or delete Consumer Health Data). These rights may vary depending on your state of residence. If you would like to exercise these rights, please visit [insert link] or contact [insert link]. [Some/Many/Certain of our Services also include settings that provide you with options as to how your information is being used. You can learn more about these options in our Privacy Policy.]

We may need to verify your identity in order to process your request. To confirm your identity, we may ask you to verify personal information we already have on file for you. If we cannot verify your identity based on the information we have on file, we may request additional information from you (such as government identification) in accordance with applicable law. We will only use such additional information to verify your identity and for security or fraud-prevention purposes.

You may also have the right to appeal the denial of any of these rights by submitting a form [here/that will be provided to you if we deny a data request.] Depending on your data choices, certain Services may be limited or unavailable. For example, we need to collect certain Consumer Health Data in order to provide the Service to you. If you request that any required Consumer Health Data be deleted or withdraw your consent for future collection or sharing of any required Consumer Health Data, we may not be able to provide the Service or certain features of the Service to you.

Updates

As our business changes, we may also update this CHDPP. You should check our Website frequently to see recent changes. If we make changes, we will notify you by updating the date at the top of this CHDPP and posting it on the Website or other appropriate means. To the maximum extent permitted by applicable law, any modifications to this CHDPP will be effective upon our posting the modified version (or as otherwise indicated at the time of posting), and your use of our Services following these changes means you accept the updated CHDPP.

If you have questions about this CHDPP, please contact us by email at hello@ivyrx.com

‍