Privacy Policy

This Privacy Policy explains how Onvytal ("we", "us") collects, uses and shares information when you use our website and services, and describes your rights. It includes a section on protected health information under the Health Insurance Portability and Accountability Act (HIPAA).

1. Information we collect

• Information you give us: name, contact details, date of birth, shipping address, and messages you send to support.
• Health information: medical history, medications, height, weight and other information you provide in your intake, and information from your providers and pharmacy.
• Payment information: processed by our payment processor. We do not store full card numbers.
• Technical information: basic device and browser data and pages visited on our marketing website, used to operate and protect the site.

The BMI checker on our website runs only in your browser. The height and weight you enter are not stored or sent to us or anyone else.

2. How we use information

• To provide the services: connecting you with licensed providers, coordinating pharmacy fulfillment and shipping, and supporting your account.
• To process payments and communicate with you about your account and orders.
• To comply with law and protect the safety and integrity of our services.

We do not sell your personal information. We do not use or share health information for advertising, and we do not place advertising pixels or tracking tools that send health information to third parties.

3. How we share information

We share information only as needed to provide the services or as required by law: with the independent licensed providers who review your care, the licensed pharmacies that fill your prescriptions, our telehealth technology and payment service providers under written agreements, and government authorities when legally required.

4. HIPAA and protected health information

Protected health information (PHI)

Health information you provide for your care, and information created by your providers and pharmacies, is protected health information. Your providers and pharmacies are covered by HIPAA, and their vendors that handle PHI, including the telehealth platform, act as business associates under written business associate agreements. PHI is used and disclosed only for treatment, payment, health care operations, or as otherwise permitted or required by HIPAA, or with your written authorization.

Safeguards

PHI is protected with administrative, physical and technical safeguards, including encryption in transit, access controls limited to people who need the information, and audit logging.

Breach notification

If there is a breach of your unsecured PHI, you will be notified without unreasonable delay and no later than 60 days after the breach is discovered, as required by the HIPAA Breach Notification Rule. Notices will describe what happened, the information involved, steps you can take to protect yourself, and what is being done in response. Breaches are also reported to the U.S. Department of Health and Human Services and, where required, to the media.

Your rights under HIPAA

• Access: you can see or get a copy of your health records.
• Amendment: you can ask to correct health information you believe is wrong or incomplete.
• Accounting of disclosures: you can ask for a list of certain disclosures of your PHI.
• Restrictions: you can ask to limit how your PHI is used or shared.
• Confidential communications: you can ask to be contacted in a specific way or at a specific address.
• Notice of privacy practices: you can get a copy of the Notice of Privacy Practices from your provider group.
• Complaints: you can file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights. You will not be retaliated against for filing a complaint.

5. Data retention

We keep information for as long as needed to provide the services and as required by law, including medical record retention laws that apply to your providers and pharmacies.

6. Your choices and state privacy rights

Depending on where you live, you may have rights to access, delete or correct personal information, and to opt out of certain processing. Washington, Nevada and other states give additional rights over consumer health data. To make a request, contact us using the details below. We will verify your identity before responding.

7. Children

Our services are for adults 18 and older. We do not knowingly collect information from children.

8. Changes

We may update this policy and will post the new version here with an updated date.

9. Contact

For privacy questions or to exercise your rights, email contact@onvytal.com or call (844) 668-9825.

Onvytal LLC, 1408 N West St, Naperville, IL 60563