Privacy Policy

1. Introduction and Scope of This Policy

1.1 Our Commitment to Your Privacy

Oriah Wellness Solutions LLC (“Oriah,” “we,” “us,” or “our”) is a consumer health brand through which patients in the United States can request telehealth care. That care is furnished by the affiliated professional medical groups LFG Medical of CA, P.C., LFG Medical of KS, P.A., LFG Medical of TX, P.C., and LFG Medical of NJ, P.C. through clinicians licensed in the patient’s state, and the technology platform behind it is provided by Medstra Inc DBA Cuvo Health. Safeguarding your personal data is fundamental to how we operate. This Privacy Policy explains the collection, use, processing, disclosure, and protection of your personal information, consistent with the Delaware Personal Data Privacy Act (DPDPA), the Health Insurance Portability and Accountability Act (HIPAA), and other applicable state and federal regulations.

1.2 Applicability of This Policy

This policy applies to information we handle in connection with:

• Our website and online properties (including oriahwellness.com);
• The individuals who inquire about, apply for, or use our wellness and telehealth services; and
• Information processed to support care delivered through our affiliated, independently licensed clinicians.

Our services are intended for residents of the United States only and are not directed to individuals under the age of 18. Our Consumer Health Data Privacy Policy applies to consumer health data covered by Washington, Nevada, Connecticut, and similar state laws.

2. Understanding Our Roles: Data Controller and Data Processor

2.1 Oriah as a Data Controller

We act as a Data Controller — determining the purposes and means of processing — when, for example:

• You visit our website and we collect analytics, marketing, and device information;
• You provide contact, account, or billing information to inquire about or use our services; and
• You communicate with our support or member-experience teams.

In this role, Oriah bears direct responsibility for complying with applicable privacy laws.

2.2 Independent Clinicians and HIPAA

Clinical care is provided by independent, state-licensed clinicians and affiliated professional medical groups, who make all medical decisions. The affiliated professional medical groups (LFG Medical of CA, P.C., LFG Medical of KS, P.A., LFG Medical of TX, P.C., and LFG Medical of NJ, P.C.) act as the controllers of the Protected Health Information (PHI) created in your care. Oriah and its platform provider, Medstra Inc DBA Cuvo Health, handle PHI on their behalf only to operate the platform and provide non-clinical support, and only as HIPAA permits, applying HIPAA-mandated privacy and security safeguards. The Notice of Privacy Practices issued by the medical group that treats you governs how your PHI is used and disclosed in the clinical relationship; it is provided to you as part of your care, and you can request a copy from us at any time.

3. The Personal Information We Collect and Process

3.1 Information We Collect as a Data Controller

Account and Contact Information. Identity and contact details such as your first and last name, email address, phone number, and mailing address.

Financial and Transactional Information. Payment card information, billing address, and transaction history. Payments are processed by PCI DSS-compliant payment processors; we do not store full payment card numbers.

Communications. Records of your email, phone, and website contact-form interactions, including support and sales inquiries.

Website Usage and Marketing Data. Technical and device data (IP address, browser type and version, operating system, device identifiers, time zone, and language preferences via server logs); usage and interaction data on the patient platform (pages viewed, steps completed, and session recordings via product-analytics and error-monitoring tools such as PostHog and Sentry, configured so that passwords and payment card details are not captured); and the referral source of your visit. We also use advertising and analytics tools from Google (the Meta Pixel and Conversions API and Google Analytics, as applicable) on our website and intake. They record the pages you visit, and a page’s address can indicate the type of treatment you are considering. When you submit your details or complete checkout, they also receive a hashed (one-way encrypted) form of your name, email address, phone number, and address, your IP address and browser details, and the order value. They do not receive your intake answers, diagnoses, medications, or prescriptions.

3.2 Health and Sensitive Information

To facilitate care with our licensed clinicians, the following categories of sensitive personal information and PHI may be collected and processed:

• Profile data: name, date of birth, gender, physical address, email, and phone number, along with account credentials (usernames and hashed, salted passwords).
• Health and medical information: patient-reported symptoms, medical history, diagnoses, mental-health information, treatment plans, prescriptions, lab results, and clinician notes.
• Telehealth session data: chat logs, consultation transcripts, and (where applicable) video or audio recordings.
• Other sensitive data: precise geolocation and racial or ethnic origin data, as defined under the DPDPA.

3.3 Transactional and Scheduling Data

• Appointment data: scheduled, past, and upcoming dates and times, and your assigned clinician.
• Payment data: service fees and medication charges, processed by our PCI DSS-compliant payment processors.

4. How and Why We Use Your Personal Information

We use the personal information we control for the following purposes, each supported by a lawful basis such as performance of a contract, our legitimate interests, your consent, or compliance with a legal obligation:

• Provide, manage, and deliver our wellness and telehealth services;
• Process payments and manage your account;
• Communicate with you about your care, applications, and inquiries;
• Send you marketing emails and, where you have separately opted in, marketing text messages, which you can stop at any time;
• Measure and improve our advertising using the Google tools described above;
• Analyze and improve our website and services;
• Secure our systems and prevent fraud; and
• Comply with our legal and regulatory obligations.

We do not use sensitive health information collected to facilitate your care for our own marketing or advertising. The purposes for which your clinical information is used in the treatment relationship are determined by your licensed clinician.

5. How We Disclose or “Share” Your Personal Information

We do not sell your personal information for money. We may disclose information as described below.

5.1 To Service Providers (Sub-processors)

We share information with trusted vendors who are contractually bound by Data Processing Agreements to protect your data and use it only to perform services for us, including cloud hosting and infrastructure (e.g., AWS, Vercel), payment processing, identity verification, email and text-message delivery, product analytics and error monitoring (e.g., PostHog, Sentry), and authentication and commerce tooling. Vendors that handle PHI do so under a Business Associate Agreement.

5.2 To Advertising Partners

We share the website and checkout information described above with Google through their advertising tools, to measure and improve our advertising. Under some state laws, including California’s, this can be “sharing” of personal information for cross-context behavioral advertising; you can opt out as described below. We do not sell personal information, and we do not send your intake answers, diagnoses, medications, or prescriptions to advertising platforms.

5.3 In Connection with a Business Transaction

If we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred subject to standard confidentiality protections.

5.4 As Required by Law

We may disclose information where necessary to comply with a legal obligation, subpoena, court order, or lawful request by a public authority.

5.5 To Your Care Team

Information you provide to obtain care is made available to the medical group and the licensed clinician responsible for your treatment and, if a prescription is issued, to the partner pharmacy that fills it and any laboratory that runs an ordered test, only as needed for your care. Clinical data is stored within HIPAA-compliant, BAA-secured infrastructure.

5.6 Mobile Information

We do not share your mobile information with third parties or affiliates for their marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third party for any purpose.

6. Your Privacy Rights and How to Exercise Them

6.1 Your Rights

Depending on where you live, you may have the right to:

• Know and access the personal information we have collected, including categories, sources, purposes, and the recipients of any disclosures;
• Correct inaccurate personal information;
• Delete personal information, subject to legal exceptions (for example, completing a transaction, complying with law, or maintaining security);
• Port your data by receiving it in a portable, readily usable format;
• Opt out of the sale or sharing of personal information and of targeted (cross-context behavioral) advertising;
• Limit the use of sensitive personal information to what is reasonably expected to provide our services (in certain jurisdictions, such as California); and
• Non-discrimination for exercising your privacy rights.

6.2 How to Exercise Your Rights

To submit a request regarding information we control, email us at privacy@oriahwellness.com. To opt out of the sharing of your personal information with Google for advertising, contact us using the details below with the subject “Do Not Share”; you can also block these tools with your browser’s tracking-protection or ad-blocking settings. For requests concerning health information held in your clinical relationship, please contact your licensed clinician, whom we will assist as needed.

Verification. To protect your privacy, we verify your identity before fulfilling a request by matching information you provide (such as your name and email) against our records.

7. Our Commitment to Data Security and Integrity

We maintain administrative, technical, and physical safeguards designed to protect your information:

• Administrative: a formal information security program led by a designated Data Protection Officer, mandatory employee privacy and security training, regular risk assessments, and a tested incident-response plan.
• Technical: encryption in transit (strong TLS) and at rest (AES-256 or equivalent), strict role-based access controls under the principle of least privilege with access logging, and network protections including firewalls, intrusion detection/prevention, vulnerability scanning, and penetration testing.
• Physical: data is hosted in facilities (such as AWS data centers) that provide world-class physical security, including biometric access controls, 24/7 surveillance, and environmental controls.

8. Data Retention and Deletion

We retain personal information only as long as necessary for the purposes for which it was collected or as required for legal, accounting, or reporting obligations. Account, contract, and financial records are generally retained for the duration of the relationship plus the period required by tax and corporate law (typically up to seven years). Marketing data is retained until you opt out or become inactive. Medical records are retained by the treating medical group for at least ten years from the last date of service, or longer where state law requires. When information is no longer needed, it is securely returned, deleted, or destroyed.

9. International Data Transfers

While our services are directed to the United States, some of our service providers operate globally, which may result in cross-border transfers of data. Where this occurs, we rely on appropriate legal mechanisms to protect your information, such as the EU-U.S. Data Privacy Framework (where applicable) and Standard Contractual Clauses approved by the European Commission.

10. Children’s Privacy

Our services are not directed to, or intended for, individuals under the age of 18, and we do not knowingly collect personal information from anyone under 18. If we learn that we have inadvertently collected such information without verifiable parental consent, we will take steps to delete it promptly.

11. Cookies, Tracking Technologies, and Analytics

Cookies are small text files placed on your device. The patient platform uses strictly necessary cookies for sign-in, security, and checkout, and first-party analytics and error-monitoring cookies to understand how the intake and portal are used and to fix problems. It also uses the advertising and analytics cookies and pixels from Google described above. You can block or delete cookies through your browser settings; blocking strictly necessary cookies may stop the patient platform from working. Our website and patient platform are served only over encrypted HTTPS connections (TLS, the successor to Secure Sockets Layer (SSL)), so information you submit is encrypted in transit.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for operational, legal, or regulatory reasons. When we make material changes, we will post the updated policy here with a revised “Last updated” date, and we may provide additional notice (for example, by email) where appropriate.

13. How to Contact Us

For questions, concerns, complaints, or to exercise your rights, please contact:

Oriah Wellness Solutions LLC Attn: Data Protection Officer 901 N Market Street, Suite 100, Wilmington, DE 19801 Email: privacy@oriahwellness.com