Onsavo
Get started

Privacy Policy

Effective Date: [EFFECTIVE DATE]

This Privacy Policy explains how [ONSAVO LEGAL ENTITY] ("Onsavo," "we," "us," or "our") collects, uses, shares, and protects information when you visit onsavo.com, create an account, complete a health questionnaire, or use our telemedicine platform and related services (collectively, the "Services").

Please read this Policy carefully. By using the Services, you agree to the practices described here. If you do not agree, please do not use the Services.

1. Who We Are and How This Policy Works

Onsavo is a self-pay telemedicine platform. We are not a medical practice or a pharmacy. We provide the technology and administrative support that connect you with independent, state-licensed healthcare providers and a partner compounding pharmacy.

Three different types of organizations may handle your information when you use the Services:

  • [ONSAVO LEGAL ENTITY] (the platform). We operate the website and the technology that powers your account, intake, scheduling, messaging, billing, and customer support.
  • [AFFILIATED MEDICAL GROUP] (the providers). Independent, state-licensed healthcare providers affiliated with [AFFILIATED MEDICAL GROUP] review your health questionnaire and other intake information through telemedicine and, if clinically appropriate, issue prescriptions. These providers make all clinical decisions independently.
  • [COMPOUNDING PHARMACY] (the pharmacy). A licensed partner compounding pharmacy (503A/503B; LegitScript-certified or NABP-accredited) prepares and dispenses any medication that a provider prescribes.

How your health information flows among these parties

When you complete intake, your health-questionnaire responses and related information are made available to the independent providers so they can evaluate your request. If a provider writes a prescription, the necessary prescription details are transmitted to [COMPOUNDING PHARMACY] so it can prepare and ship your medication. We share only the information each party needs to perform its role.

Some of the information you provide is protected health information ("PHI") that may be governed by the Health Insurance Portability and Accountability Act ("HIPAA"). In handling that information on behalf of the providers and the pharmacy, [ONSAVO LEGAL ENTITY] generally acts as a business associate under HIPAA. Where a provider–patient relationship is created, the independent providers and [AFFILIATED MEDICAL GROUP] act as covered entities and their own Notice of Privacy Practices may also apply to your care. Where this Policy and a provider's Notice of Privacy Practices both apply, the provider's notice governs the clinical treatment relationship.

Some products offered through the Services are compounded medications. Compounded medications are not FDA-approved and have not been reviewed by the FDA for safety, effectiveness, or quality. This Policy addresses privacy only; it does not describe the medications themselves.

2. Information We Collect

We collect the following categories of information, depending on how you use the Services.

Account and contact information. Name, email address, phone number, mailing/shipping address, date of birth, login credentials, and your communications with us.

Health-questionnaire and intake information. Responses to medical-intake questions, including your height, weight, and BMI, medical history, current medications, allergies, symptoms, and other health details you provide so an independent provider can evaluate your request.

Lab and diagnostic information. Where a program involves at-home or in-network testing (for example, CLIA lab testing performed through [CLIA LAB PARTNER]), we may receive and store lab results and related diagnostic information associated with your account.

Treatment and prescription information. Records of consultations facilitated through the platform, prescriptions issued by independent providers, dosing information, refills, subscription status, and fulfillment/shipping details.

Payment information. Billing name, billing address, and subscription details. Card and bank-account numbers are collected and processed directly by our third-party payment processor; we do not store full payment-card numbers on our own systems.

Device, usage, and cookie information. IP address, browser and device type, operating system, pages viewed, referring/exit pages, approximate location derived from IP, and information collected through cookies and similar technologies (see Section 6).

We collect this information directly from you, automatically through your use of the Services, and from the providers, the pharmacy, the lab partner, and service providers who help operate the Services.

3. How We Use Your Information

We use your information to:

  • Create and manage your account and verify your identity and eligibility (including age and state of residence).
  • Facilitate telemedicine consultations between you and independent providers, including making your intake responses, height/weight/BMI, and lab results available to those providers.
  • Support the fulfillment of prescriptions issued by providers, including transmitting prescription information to [COMPOUNDING PHARMACY] for preparation and shipping.
  • Process payments and manage your monthly subscription (subscriptions bill monthly).
  • Provide customer support and respond to your questions and requests.
  • Send service and transactional messages (for example, order confirmations, shipping updates, refill reminders, billing notices, and security alerts).
  • Maintain, troubleshoot, secure, and improve the Services, including analyzing usage to improve the website and our processes.
  • Comply with legal, regulatory, licensing, recordkeeping, and pharmacy obligations, and to detect and prevent fraud or misuse.

We use PHI only as permitted by HIPAA and applicable law and as needed to support your care, fulfill prescriptions, operate the platform, and meet legal requirements.

4. How We Share Your Information

We share information only as described below. We do not sell your PHI or other personal information, and we do not share it for cross-context behavioral advertising.

  • Independent providers and [AFFILIATED MEDICAL GROUP]. We make your intake responses, height/weight/BMI, lab results, and related information available to the independent, state-licensed providers so they can evaluate your request and provide care.
  • [COMPOUNDING PHARMACY] (partner/compounding pharmacy). When a provider issues a prescription, we transmit the prescription and fulfillment details needed to prepare and ship your medication.
  • [CLIA LAB PARTNER] (lab partner). Where testing is part of a program, we exchange the information needed to order tests and associate results with your account.
  • Payment processors. Our third-party payment processor handles card and bank-account data to process your payments and subscription billing.
  • Telehealth, IT, and other service vendors (business associates). Vendors that host our platform, provide telehealth/messaging technology, store data, send communications, provide analytics, or support customer service. Vendors that handle PHI on our behalf are bound by HIPAA business associate agreements and may use the information only to provide services to us.
  • Legal, safety, and compliance. We may disclose information when required by law, subpoena, court order, or regulatory request; to cooperate with licensing or pharmacy authorities; to protect the rights, safety, or property of you, us, or others; or to prevent fraud or harm.
  • Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy and applicable law.

5. HIPAA Note and Safeguards

Much of the information you share through the Services is PHI protected by HIPAA. We handle PHI consistent with HIPAA's Privacy and Security Rules and our agreements with the providers and the pharmacy.

This includes:

  • Limiting access to PHI to workforce members and vendors who need it to perform their roles ("minimum necessary").
  • Entering into business associate agreements with vendors who handle PHI on our behalf.
  • Maintaining administrative, physical, and technical safeguards designed to protect PHI (see Section 9).

Your care relationship with the independent providers is also governed by their own Notice of Privacy Practices, which describes your rights with respect to clinical records. If those notices and this Policy differ, the provider's notice controls the treatment relationship.

6. Cookies, Tracking, and Advertising

We and our service providers use cookies, pixels, and similar technologies to operate the website, remember your preferences, keep you signed in, measure performance, and understand how the Services are used.

You can manage cookies through your browser settings and, where available, through cookie controls on our website. Some features may not function properly if you disable certain cookies. Where required, we honor recognized opt-out preference signals (such as Global Privacy Control) for applicable tracking.

We do not use your PHI or other health information for third-party advertising or to target ads to you. We do not permit third-party advertising networks to use your protected health information for ad targeting.

7. Your Privacy Rights and Choices

Depending on where you live and the nature of the information, you may have rights to:

  • Access the personal information we hold about you.
  • Correct inaccurate personal information.
  • Delete personal information, subject to legal, medical-recordkeeping, and pharmacy retention requirements.
  • Portability — receive a copy of certain information in a usable format.
  • Opt out of certain processing and, where applicable, withdraw consent.

California residents (CCPA/CPRA) and residents of other states with comprehensive privacy laws may have additional rights, including the right to know the categories of personal information collected and shared, the right to non-discrimination for exercising your rights, and the right to opt out of "sale" or "sharing." As noted above, we do not sell personal information or share it for cross-context behavioral advertising. Medical information governed by HIPAA may be exempt from some state-law rights, and those rights are instead addressed through HIPAA and the providers' Notice of Privacy Practices.

To exercise any right, email [PRIVACY EMAIL]. We will verify your request before acting on it and will respond within the time required by applicable law. You may use an authorized agent where permitted. Requests involving clinical records held by the independent providers may be directed to those providers under their Notice of Privacy Practices.

8. Data Retention

We retain personal information and PHI for as long as needed to provide the Services, maintain your account, and meet our legal, regulatory, medical-recordkeeping, pharmacy, tax, and accounting obligations. Medical and prescription records are subject to retention periods set by law and professional requirements and may be retained even after you close your account. When information is no longer needed, we delete or de-identify it in accordance with applicable law.

9. Security

We maintain administrative, physical, and technical safeguards designed to protect your information, including encryption in transit, access controls, authentication, and monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please protect your account credentials and notify us promptly at [PRIVACY EMAIL] if you believe your account has been compromised.

10. Children's Privacy

The Services are intended for adults 18 years of age or older. The Services are not directed to children, and we do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from someone under 18, we will delete it. If you believe a minor has provided us information, contact us at [PRIVACY EMAIL].

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the Effective Date above and, where appropriate, provide additional notice. Your continued use of the Services after an update means you accept the revised Policy.

12. Contact Us

If you have questions about this Privacy Policy or our privacy practices, contact us:

  • Email: [PRIVACY EMAIL]
  • Mailing address: [BUSINESS MAILING ADDRESS]

13. Effective Date

This Privacy Policy is effective as of [EFFECTIVE DATE].

This is a template for [ONSAVO LEGAL ENTITY]; have qualified counsel review before publishing.