Consumer Health Data Privacy Policy

This policy covers consumer health data collected by Vitality Testosterone Replacement Therapy, which operates Vitality Testosterone Replacement Therapy, and by its affiliated medical practices, our affiliated medical practices. It applies to residents of Washington, Nevada and Connecticut, and to anyone whose consumer health data is collected in Washington, and we follow it for all visitors.

It is written for the Washington My Health My Data Act (RCW 19.373), Nevada law on consumer health data (NRS 603A.400 to 603A.550), and the consumer health data provisions of the Connecticut Data Privacy Act. Information that is protected health information under HIPAA is governed by the affiliated medical practices' Notice of Privacy Practices instead, where HIPAA applies.

Consumer health data is personal information that is linked or reasonably linkable to you and identifies your past, present or future physical health status. That includes the fact that you are seeking care from a health clinic.

The categories we collect are:

• Your interest in or request for an evaluation, lab work or treatment, including which service you asked about.
• Symptoms, health conditions, goals and medical history you report in the assessment or to your care team.
• Medications, allergies and prior treatment.
• Lab orders and lab results.
• Measurements you share, such as blood pressure, height and weight.
• Provider notes, treatment plans and prescriptions.
• Records of appointments, orders and payments for health services.
• Recordings and notes of calls and messages with your coordinator or provider that mention your health.
• Information that could reveal you are seeking care, such as the office you booked at, and your state of residence.

We do not collect precise geolocation. The office finder uses a ZIP code you type, or your device location only when you tap "Use my location", and that location stays in your browser.

We collect consumer health data from you, from the licensed providers who treat you, and from the labs and pharmacies involved in your care.

• From you: the assessment, booking, intake forms, calls, texts and emails.
• From your care: provider visits, lab results returned by the lab that ran your panel, and prescription and shipping records from the dispensing pharmacy.
• From people you authorize: for example, records you ask another clinician to send us.

We collect and use consumer health data to provide the services you request and for the limited operational purposes below. We do not use it for advertising.

• To check whether we serve your state and which visit options apply.
• To arrange your lab work and your visit with a licensed provider.
• To let the provider evaluate you and decide, with your input, whether treatment is appropriate.
• To send prescriptions to a licensed pharmacy and arrange shipping.
• To schedule follow-up labs and provider reviews, and to handle orders and payments.
• To keep medical and billing records required by law.
• To keep our services secure and to meet legal duties.

If you live in Washington, Nevada or Connecticut, we ask for your consent before we collect consumer health data, unless the collection is necessary to provide a service you requested. We ask for separate consent before we disclose consumer health data beyond what is necessary to provide that service.

The assessment asks for your state before any health question. For residents of these states, a consent screen appears next. It is a separate, unchecked box. It is not bundled with the Terms of Use or this policy. It names the categories of data (your age range, sex assigned at birth, health conditions and medicines from a safety list, symptoms and goals, past lab tests and treatment, pregnancy or fertility plans where asked, and the service you ask about), the purpose, and who receives it, and the screen tells you how to withdraw consent. The same screen is shown to Maryland residents.

Consent to disclose is a second, separate box. Declining it does not stop you from getting care: your request still reaches a care coordinator, who asks for your consent on the call before anything is passed to the medical practice or the lab. You can still call (866) 744-0454 instead of using the online assessment.

Withdrawal stops future collection and disclosure. It does not affect records the affiliated medical practices must keep by law.

We disclose consumer health data only to the people and companies that help provide the services you requested, or as you direct. Each one may use it only for that purpose.

• The affiliated medical practices and the licensed providers who treat you.
• Our service providers (processors), under contracts that limit their use: our hosting provider, which stores online assessment requests encrypted for up to 90 days; our email provider, which delivers a request notice without your detailed answers to our care team; our electronic health record provider for clinical records; plus our payment and messaging providers.
• The lab that runs your panel.
• The licensed pharmacy that fills a prescription your provider writes.
• Government agencies or courts, where law requires it.
• A buyer or successor, if the business is sold or merged, subject to this policy.

Affiliates that receive consumer health data are the affiliated medical practices listed above.

We do not disclose consumer health data to advertising or social media platforms. For residents of Washington, Nevada and Connecticut, we send no data of any kind about you to an advertising platform unless you have given separate opt-in consent to that disclosure, and a Global Privacy Control signal from your browser is treated as a refusal.

We do not sell consumer health data. If that ever changed, we would first ask for a signed, written authorization that meets state law, including a one-year expiration.

We do not use geofencing around any health care facility. We do not set a virtual boundary around a clinic, lab or pharmacy to identify, track, collect data from or send messages or ads to people who enter it.

You have the right to know what consumer health data we hold about you, to see it, to have it deleted, and to withdraw consent. We do not treat you differently for using these rights.

• Confirm whether we collect, disclose or sell your consumer health data, and access that data.
• Get a list of all third parties and affiliates that received your consumer health data, with an active email address or other online contact for each.
• Withdraw consent to collection and to disclosure.
• Have your consumer health data deleted. We also tell our processors and the third parties that received it to delete it. Medical records the affiliated medical practices must keep by law are retained for the required period, and we tell you if that applies.

We respond within 45 days of receiving your request.

We verify your identity before acting, using information we already hold, and we do not ask you to create an account. If we need more time, we may extend once by up to 45 more days, and we tell you within the first 45 days with the reason. You can make two requests in a 12-month period without charge; for repeated or clearly unfounded requests, we may decline or charge a reasonable fee, and we explain why.

If we decline your request, in whole or in part, you can appeal.

We answer appeals in writing within 45 days, explaining what we did and why. If the appeal is denied, we tell you how to contact the attorney general of your state: Washington, Nevada or Connecticut.

(866) 744-0454