Privacy Policy & Terms of Service

We collect information you provide directly to us, including:

Personal and Contact Information: Name, email address, phone number, date of birth, and mailing address when you create an account or contact us.

Health Information: Medical history, current medications, allergies, symptoms, weight, height, and other health-related information you provide through our health assessment or during consultations. This information is considered Protected Health Information (PHI) under HIPAA.

Payment Information: Billing address and payment card details, processed securely through our third-party payment processor. We do not store full payment card numbers.

Technical Information: IP address, browser type, device identifiers, operating system, pages visited, and other usage data collected automatically when you use our platform.

Communications: Records of your communications with us, including messages sent through the patient portal.

We use the information we collect to:

• Provide, operate, and improve our telehealth platform and services
• Connect you with licensed healthcare providers
• Facilitate your medical consultations and care
• Process payments and send billing communications
• Send appointment reminders, care instructions, and service-related notifications
• Respond to your questions and support requests
• Comply with applicable laws, regulations, and professional standards
• Protect the safety and security of our platform and users

We do not sell your personal information or Protected Health Information to third parties. We do not use your PHI for marketing purposes without your explicit authorization.

PlumMeds is committed to protecting your Protected Health Information (PHI) in accordance with the Health Insurance Portability and Accountability Act (HIPAA) and applicable state privacy laws.

Notice of Privacy Practices: Our full HIPAA Notice of Privacy Practices describes how we may use and disclose your PHI and your rights regarding that information. You will receive a copy of our Notice of Privacy Practices when you begin using our services.

Permitted Disclosures: We may use or disclose your PHI for treatment, payment, and healthcare operations purposes as permitted by HIPAA. We may also disclose PHI as required by law, including to public health authorities, law enforcement, or in response to a court order.

Business Associates: We may share your PHI with third-party service providers (Business Associates) who assist us in operating our platform, subject to Business Associate Agreements that require them to protect your PHI.

Your HIPAA Rights: You have the right to access, amend, and receive an accounting of disclosures of your PHI. To exercise these rights, contact us at privacy@plummeds.org.

We may share your information in the following circumstances:

With Your Providers: We share your health information with the licensed healthcare providers who treat you through our platform. This is necessary to provide your care.

With Service Providers: We share information with third-party vendors who help us operate our platform (e.g., payment processors, cloud hosting, video conferencing). These parties are contractually obligated to protect your information.

For Legal Compliance: We may disclose information when required by law, court order, or governmental authority, or to protect the rights, property, or safety of PlumMeds, our users, or others.

With Your Consent: We may share your information for other purposes with your explicit consent.

Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

We do not sell, rent, or trade your personal information or PHI to third parties for their marketing purposes.

We implement administrative, technical, and physical safeguards designed to protect your information from unauthorized access, use, or disclosure. These include:

• End-to-end encryption for all data transmitted through our platform
• Encryption of stored health information and personal data
• Access controls limiting employee access to PHI on a need-to-know basis
• Regular security assessments and vulnerability testing
• Secure, HIPAA-compliant video conferencing for all consultations

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at security@plummeds.org.

We use cookies and similar tracking technologies to operate and improve our platform. These include:

Essential Cookies: Required for the platform to function, including session management and security features. These cannot be disabled.

Analytics Cookies: Help us understand how users interact with our platform so we can improve it. We use anonymized, aggregated data for this purpose.

Preference Cookies: Remember your settings and preferences to improve your experience.

You can control non-essential cookies through your browser settings. Disabling certain cookies may affect the functionality of our platform. We do not use cookies to track your activity across third-party websites for advertising purposes.

Depending on your location, you may have the following rights regarding your personal information:

Access: Request a copy of the personal information we hold about you.

Correction: Request that we correct inaccurate or incomplete information.

Deletion: Request that we delete your personal information, subject to certain exceptions (e.g., information we are required to retain by law or for ongoing care).

Portability: Request that we provide your information in a portable format.

Opt-Out: Opt out of certain uses of your information, such as marketing communications.

HIPAA Rights: See Section 3 for your specific rights regarding Protected Health Information.

To exercise any of these rights, contact us at privacy@plummeds.org. We will respond to your request within 30 days. We may need to verify your identity before processing your request.

We retain your personal information and health records for as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. Medical records are retained in accordance with applicable state and federal laws, which typically require retention for a minimum of 7 years from the date of service (or longer for minors).

When your information is no longer needed, we securely delete or anonymize it in accordance with our data retention policy.

PlumMeds services are intended for adults 18 years of age and older. We do not knowingly collect personal information from individuals under 18. If you believe we have inadvertently collected information from a minor, please contact us at privacy@plummeds.org and we will promptly delete it.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website with a new "Last Updated" date, and by sending you an email notification if you have an account with us. Your continued use of our platform after the effective date of any changes constitutes your acceptance of the updated policy.