Consumer Health Data Privacy Policy

This policy applies to prescrybe.health only. It explains how PrescrYbe handles consumer health data in connection with that website and how to exercise applicable privacy rights. Consumer health data includes personal information linked or reasonably linkable to you that identifies your health status or efforts to seek health services, including qualifying inferences from online activity.

Information, sources and purposes

Our marketing website collects website-interaction information, including pages visited, full URLs and query strings, page titles, campaign information, landing pages, first referrers and session replay of interactions. When linked to you or your device, activity on health-related pages may reveal health interests or efforts to seek care, including weight management or men's or women's health services. A page visit does not establish that you have a condition.

We use this information for site analytics, user-experience improvement and the advertising purposes described below. Analytics collection differs from the limited information sent to advertising platforms.

The sources are your browser or device when you interact with our website, and information you provide directly when contacting us. If you include health information in a message or privacy request, we use that information to respond and handle your request. Please do not send medical records or health-intake answers by ordinary email.

We process website information electronically through our website and tracking systems to operate and understand the marketing website and measure advertising. We process correspondence to respond to you and administer privacy requests. Collection, use and sharing of consumer health data remain subject to applicable consent requirements; this policy is not a request for consent.

Sharing and recipients

On prescrybe.health, we use Google Tag Manager and the following advertising and analytics services. GPC suppresses advertising tags and advertising-event transmissions only. Google Analytics and Contentsquare continue operating with or without GPC.

• Meta — advertising measurement and targeted advertising: Through the Conversions API and pixel via Google Tag Manager, Meta receives generic page_view and intake_start events, a neutral URL (https://prescrybe.health/), event identifiers and times, click/browser identifiers (fbc and fbp), IP address and user agent. These are sent only when GPC is not present.

• TikTok — advertising measurement and targeted advertising: Through the Events API, TikTok receives the same generic events with a neutral URL, event identifiers and times, TikTok identifiers (ttclid and ttp), IP address and user agent. These are sent only when GPC is not present.

• Google Ads — advertising measurement and targeted advertising: Google Ads receives conversion events with gclid, gbraid or wbraid identifiers, event name, event identifier, event time, value, currency and order identifier. It does not receive a page URL, referrer, UTMs, IP address or user agent through these transmissions. Events are sent only when GPC is not present.

• Google Analytics (GA4) — website analytics: GA4 receives website-interaction events including the full page URL and query string, page title, UTMs, landing page and first referrer. GA4 continues when GPC is present.

• Contentsquare — site analytics and user-experience improvement: Contentsquare loads on every visit, receives full URLs, including paths and UTMs, and records interactions through session replay at a 100% recording rate. This includes visits to health-related pages such as /glp1 and /men-s-health. Contentsquare continues when GPC is present. Contentsquare is an analytics recipient, not an advertising platform; it does not receive the ad-platform data described above.

We do not send service line, condition, treatment, page path, UTMs, referrer, intake answers, hashed email, hashed phone, hashed name, city, state or ZIP code to advertising platforms. Our server-side tagging strips treatment and service-line fields before sending advertising events. These exclusions apply to advertising platforms, not to the full-URL and interaction information sent to GA4 and Contentsquare.

Removing those advertising fields does not make all website information anonymous or prevent health-related inferences. Advertising and analytics providers may combine identifiers and interactions with information collected over time and across other websites or services.

As of the effective date, no affiliates receive consumer health data from PrescrYbe.

Your choices and requests

To exercise applicable rights, email care@prescrybe.health with the subject Privacy Request. Tell us your request and enough information to locate the relevant records. Do not include medical records. We may request limited additional information to verify your identity securely; you do not need to create a new account.

Where applicable, you may request confirmation of collection, sharing or sale; access to your consumer health data; a list of recipients, including third parties and affiliates and their contact methods; deletion; and withdrawal of consent to collection or sharing. Nevada consumers may also request that collection, sharing or sale cease. You may use the same email address to review information and request corrections.

For Connecticut residents, applicable rights also include correction, a portable copy, access to inferences, a list of third parties to which personal data was sold, and opting out of targeted advertising, sale and qualifying automated profiling. Where applicable and feasible, you may question significant profiling decisions and request reasons and review of the underlying data. These rights do not mean that PrescrYbe conducts each listed activity.

We respond to Washington and Connecticut requests within 45 days after receipt and Nevada requests within 45 days after authentication, without undue delay. Where permitted and reasonably necessary, we may extend the response period by another 45 days and will explain the extension within the initial period. Connecticut consent withdrawals are implemented as soon as practicable and no later than 15 days after receipt. We explain any refusal and how to appeal. Rights remain subject to applicable legal exceptions.

When required, we notify recipients of deletion requests and require deletion of the relevant data. We do not discriminate against you for exercising applicable rights.

GPC suppresses advertising tags and advertising-event transmissions for the browser sending the signal. It does not stop GA4 analytics or Contentsquare session replay, including on health-related pages. You may email us to opt out or exercise applicable consumer health data rights. GPC does not itself request deletion of previously collected information or withdraw every consent you may have given.

Appeals and complaints

If we refuse your request, reply to our decision or email care@prescrybe.health, subject Privacy Request — Appeal, identifying the decision and why you seek reconsideration. We provide a written decision with reasons within 45 days after receiving a Washington or Nevada appeal and within 60 days for a Connecticut appeal.

If denied, you may complain to the relevant Attorney General. Our appeal response will provide the applicable complaint contact or online mechanism: Washington Attorney General, Nevada Attorney General, or Connecticut Attorney General.

Policy changes

We update the effective date when this policy changes. For material changes, we will place a prominent notice on our website and, where we have your contact details, notify you directly. Where required, we will disclose new categories, recipients or purposes and obtain consent before the changed processing begins.

Questions or requests: care@prescrybe.health, subject Privacy Request.