Privacy Policy

This policy describes how Tully RX collects, uses, and protects your information when you use this website, complete a health assessment, or receive care through the service.

Counsel to confirm: HIPAA applicability and whether a separate Notice of Privacy Practices is required alongside this policy.

We collect information you provide directly, and a limited amount collected automatically:

• Identity and contact details — name, email, phone, shipping address.
• Health information — your assessment answers, provider notes, prescriptions, and care messages.
• Payment information — handled by our payment processor; we never see or store your full card number.
• Technical data — device, browser, and usage information needed to run and secure the site.

• To provide care: sharing your intake with the licensed provider who reviews it, and your prescription with the pharmacy that fills it.
• To run the service: processing payments, shipping orders, and sending service notifications about your care.
• To meet legal obligations: record-keeping, audit, and safety requirements.

We do not sell your personal or health information. Marketing communications, if any, are separate and opt-out.

Your health information is stored encrypted and access is restricted to your care team and the systems needed to deliver your care. Operational messages (like shipping notifications) reference your order — not your medical details.

We hold our infrastructure and vendors to HIPAA-grade safeguards regardless of whether HIPAA formally applies to a given data flow. Counsel to confirm the exact regulatory framing.

• Licensed providers who review your assessment and manage your care.
• Licensed pharmacies that fill and ship your prescription.
• Service vendors (payment processing, secure hosting, communications) bound by contractual safeguards.
• Authorities, where the law requires it.

Counsel to confirm: full vendor list, business-associate agreements, and any state-specific disclosure requirements.

Medical records are retained for the period required by applicable medical-records law; account and transaction data for as long as needed to run the service and meet legal obligations. Counsel to confirm retention schedules per state.

Depending on where you live, you may have the right to access, correct, download, or request deletion of your information, and to opt out of marketing. Contact support to exercise these rights.

Counsel to confirm: state privacy-law coverage (e.g. California, Washington My Health My Data) and the required response process.

We use the cookies necessary to keep you signed in and the site secure. Placeholder: counsel and engineering to document any analytics or advertising technologies before launch — none should receive health information.

We will post updates here with a new “Last updated” date and notify you of material changes before they take effect.

Privacy questions or requests? Contact the Tully RX support team through your patient portal or the support email listed on this site.