Privacy Policy

ProtocolRX (“ProtocolRX,” “we,” “us,” or “our”) provides a personalized longevity and supplement platform that includes a health-goals quiz, educational content, supplement and peptide sales, and physician-supervised prescription fulfillment through a licensed telehealth partner. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have.

By using protocolrx.com or any related service, you agree to this Privacy Policy. If you do not agree, please do not use the service.

Information we collect

Information you give us

• Account information: name, email address, password (hashed), and authentication identifiers.
• Quiz and intake responses: your health goals, age, sex, lifestyle, current medications, supplements, and conditions.
• Telehealth intake: medical history, symptoms, allergies, prescription history, photos of government-issued ID where required, and other information needed to evaluate a prescription request.
• Order and shipping information: billing and shipping addresses, phone number, products purchased.
• Payment information: we do not store full payment card numbers. Cards are tokenized and processed by Stripe; we retain the last four digits, brand, and expiration for receipts.
• Communications: messages you send to support and feedback you submit.

Information collected automatically

• Device and usage data: IP address, browser type, device identifiers, pages viewed, links clicked, and timestamps.
• Cookies and similar technologies: session cookies for authentication, preferences cookies, and limited analytics. We do not sell advertising data.

Information from third parties

• Telehealth partner: our licensed telehealth partner (currently Stealth Health) shares appointment status, prescription decisions, prescriber information, and pharmacy routing back to us so we can keep your order updated.
• Identity verification: if your order requires identity verification, we may receive a pass/fail result and reference identifiers from our verification provider.
• Payment processor: Stripe shares charge status, dispute information, and refund records.

How we use your information

• Operate the service, including the quiz, recommendations, shopping cart, and account features.
• Fulfill orders, including transmitting required information to our telehealth partner and pharmacies for prescription products.
• Process payments, refunds, and billing inquiries via Stripe.
• Communicate with you about your account, orders, prescriptions, shipments, and customer support.
• Comply with applicable laws, including the Health Insurance Portability and Accountability Act (HIPAA) where it applies, and respond to lawful requests.
• Detect, investigate, and prevent fraud, abuse, and security incidents.
• Improve the service, including measuring engagement and developing new features. We use aggregated or de-identified data wherever possible.

Health information and HIPAA

Some information you provide — including telehealth intake responses, prescription records, and pharmacy information — is Protected Health Information (PHI) under HIPAA when it is received, created, maintained, or transmitted by a covered entity or its business associate. Our licensed telehealth partner acts as the covered entity for the clinical encounter and is responsible for the medical record. ProtocolRX acts as a business associate where required and is bound by a Business Associate Agreement (BAA) with our telehealth and pharmacy partners. We will use and disclose PHI only as permitted by HIPAA, your authorizations, and the BAA.

How we share information

We do not sell your personal information. We share information only as follows:

• Telehealth partner: intake, identity, and shipping information necessary to evaluate and fulfill a prescription request.
• Licensed pharmacies: prescription, dosing, and shipping information for fulfillment.
• Payment processor: Stripe processes charges, refunds, and disputes.
• Service providers: hosting (AWS), database, email, customer-support tooling, identity verification, and analytics — each bound by confidentiality obligations and, where applicable, a BAA.
• Legal and safety: when required by law, subpoena, or court order, or to protect rights, property, or safety.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to the protections of this Policy.

Data retention

We retain account, order, and communication records for as long as your account is active and as needed to comply with our legal obligations, resolve disputes, and enforce our agreements. Clinical records held by our telehealth partner are retained per applicable medical record retention laws (typically a minimum of 7 years, and longer in certain states or for minors).

Your choices and rights

• Access, correction, deletion: you may request access to or correction of your account data, or deletion of your account, by emailing support@protocolrx.com. Some clinical records are subject to retention laws and may not be deletable.
• Marketing emails: you may unsubscribe from non-essential emails using the link in any such message. Transactional emails (order, shipping, prescription) cannot be opted out of while you have an active order.
• Cookies: you can configure your browser to refuse cookies; parts of the service may not work without them.
• California, Virginia, Colorado, Connecticut, Utah, and similar residents: you may have rights to access, correct, delete, or port your information, and to opt out of certain processing. Send requests to support@protocolrx.com.
• EEA/UK residents: our service is intended for U.S. residents. If you nevertheless use it from the EEA or UK, you may have rights under GDPR/UK GDPR. Contact us to exercise them.

Security

We use industry-standard administrative, technical, and physical safeguards to protect your information, including encryption in transit and at rest, role-based access controls, audit logging, and a HIPAA-compliant cloud environment. No system can be guaranteed perfectly secure. If we learn of a breach affecting your information, we will notify you as required by law.

Children

ProtocolRX is intended for adults 18 and older. We do not knowingly collect information from anyone under 18. If you believe a child has provided us with information, contact us at support@protocolrx.com and we will delete it.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide a more prominent notice (such as an email or in-app banner).

Contact us

Questions, complaints, or requests about your information: support@protocolrx.com.