Consumer Health Data Privacy Policy

Consumer health data we collect, and why

Health questionnaire answers

What it includes: The answers you give in our online questionnaires. Depending on the treatment, these include your age or age range and gender; your height, weight and BMI; whether you take prescription weight-loss medication, and which GLP-1 medication you use now, what you pay for it and how satisfied you are; medical conditions you have, such as pregnancy or trying to conceive, breastfeeding, kidney disease, diabetes, an eating disorder, suicidal thoughts, cancer, an organ transplant or a serious stomach or bowel condition; and, for NAD+ and sermorelin, your energy and activity levels, your goals, what you have tried, and cancer or pregnancy questions.

Why we collect it and how we use it: To check whether a treatment may suit you before you pay, show you the options that fit your answers, and follow up with you about your consultation.

GLP-1 price check (Switch & Save)

What it includes: If you use our GLP-1 price check: your current GLP-1 provider, medication, dose, monthly price and how long you have been on it, with your first name, email address and phone number, and a reminder date if you ask for one.

Why we collect it and how we use it: To show you what switching to us would cost, send you your quote and reminder, and follow up about it.

Medical intake

What it includes: Your answers to the medical intake your provider reviews, and the photos you upload with it. After checkout you complete it on www.coreagerx.com, on WhiteLabel MD, the medical platform CoreAge Rx runs it on.

Why we collect it and how we use it: So a licensed provider can evaluate you, decide whether a treatment is appropriate, prescribe it and care for you.

Treatments and orders

What it includes: The treatments you look at, choose and buy, such as compounded semaglutide or tirzepatide (including microdosing), sermorelin, NAD+, GLP-1 support capsules or prescription skin creams; your dose, plan and add-ons; and the status of your order, payment, refunds, subscription and shipment.

Why we collect it and how we use it: To take, bill, fill, ship and renew your order, handle refunds, and answer your questions.

Contact and shipping details

What it includes: Your name, email address, phone number, state, and shipping and billing address, which are linked to your answers and orders, and whether your email address and phone number can receive messages.

Why we collect it and how we use it: To create your consultation and order, ship your treatment, and contact you by email, phone and text message.

Your activity on our sites

What it includes: The pages you visit and the steps you reach (a page’s address can name the treatment, and some show why a questionnaire ended); the link or advertisement that brought you here, with its campaign and click identifiers; our own identifiers for your browser and visit (see Our own measurement); your IP address and approximate location; and your browser and device.

Why we collect it and how we use it: To run our sites, keep your answers and checkout together, prevent fraud, learn which links and advertisements bring us patients, find pages that confuse people, and for analytics and advertising (see below).

Reviews, feedback and messages

What it includes: The ratings and comments you send us about your treatment, and the emails and text messages you exchange with us.

Why we collect it and how we use it: To answer you and improve our service.

Consent records

What it includes: Your choices on our cookie banner (with the page, your browser, part of your IP address and the state or country it places you in), whether you agreed to emails and text messages, and when you agreed to our terms, with the IP address and browser you used.

Why we collect it and how we use it: To keep a record of what you agreed to and honor your choices.

Where we get it

From you, when you answer our questionnaires or price check, complete the medical intake, place an order, or write, text or call us.
From your browser and device, automatically, through cookies and similar technologies, as you use our sites.
From the link that brought you to us, which can carry the name of an advertising campaign and an advertising platform’s click identifier.
From CoreAge Rx, WhiteLabel MD and the providers and pharmacies who treat you: your order numbers, your earlier orders, and the status of your order and its shipment.
From Stripe and Chargeblast: your payments, refunds, subscriptions and payment disputes.
From our customer record and verification services: whether you are already a customer, and whether your email address and phone number can receive messages.

Consumer health data we share, and with whom

We share consumer health data with our affiliate CoreAge Rx and with these categories of third parties.

Our affiliate CoreAge Rx

Who: DSO Fine Shrimp LLC d/b/a CoreAge Rx, under common ownership with us, which operates systems we use and helps support our customers.

What they receive: The information this policy describes, as needed to run those systems and support your orders.

Why: To run our sites and checkout and support your order.

Our medical platform, the providers who treat you and the pharmacies that fill your prescriptions

Who: WhiteLabel MD, which runs the medical intake (with its form builder, Jotform), our order and pharmacy system (with Sticky.io, the order system behind it) and the workflow service that sends your sign-up to our customer record system; the independent medical groups that treat patients through that intake, M & D Integrations Inc d/b/a MD Integrations, MDI Medical Group P.C., and MD Integrations & Wellness Provider Group P.A.; and the licensed pharmacies, including compounding pharmacies, that fill and ship your prescription.

What they receive: Your name, contact, shipping and billing details and state; the treatment and plan you ordered and your order details; your medical intake answers and photos; and what we send our customer record system (below).

Why: To evaluate you, prescribe, fill and ship your treatment, and support your care.

Customer record, messaging and verification services

Who: GoHighLevel (LeadConnector), our customer record system; Miss Blue, which sends our text messages; Klaviyo, which sends the emails for our GLP-1 price check; NeverBounce and a phone-number check, which tell us whether we can reach you; and ReferralCandy, our refer-a-friend program.

What they receive: GoHighLevel receives your name, email address, phone number and state; the email and text choices you made on our forms, or, if you left a checkout, whether your number can receive texts; and your BMI, current weight, whether you take weight-loss medication, the treatment you asked about and the page you started on. Miss Blue receives your name, phone number and the treatment you were ordering or your price-check answers, and the texts we exchange, and, whenever you pay for an order, your phone number, so that any reminder texts stop. Klaviyo receives your price-check answers, first name, email address and phone number. NeverBounce and the phone check receive only your email address or phone number. ReferralCandy receives, when you buy with advertising allowed, your name, email address, order number and amount.

Why: To follow up about your consultation, order or price check, make sure we can reach you, and run referrals.

Payment processors and fraud prevention

Who: Stripe, and the payment method you choose through it, such as Klarna, Affirm, Afterpay, Zip or Amazon Pay; WhiteLabel MD’s order system, if you re-enter your card in our backup payment form after a card is declined; and Chargeblast.

What they receive: Your name, email address, phone number and address; the products you buy and the amounts; your IP address and browser. Chargeblast receives your email address when you buy, and the details of any payment dispute.

Why: To take payments and renewals, issue refunds, and prevent fraud and chargebacks.

Analytics partners, only if you allow analytics

Who: Google Analytics, Microsoft Clarity and PostHog, on app., pay. and try.superhealthyrx.com.

What they receive: The pages you visit and what you do on them. Microsoft Clarity records your visit, including what you click and the answers you select. Some of our PostHog events include your answers about medical conditions, pregnancy, cancer and your gender, and your name and email address; when you buy, PostHog receives your email address and the product.

Why: To understand how our sites are used and fix pages that confuse people.

Advertising partners, only if you allow advertising

Who: Meta (Facebook and Instagram), Google (Google Ads and Google Tag Manager) and Microsoft Advertising (Bing).

What they receive: The pages you visit, whose addresses can name the treatment, and what you do on them. Once you have entered them, your email address and phone number (Microsoft), and when you buy, your name, email address, phone number and address, in most cases hashed by the partner’s own code in your browser, with the product codes (which name the treatment) and the amount. Our server may also send Meta your purchase with its product codes, Meta’s cookies, your IP address and your browser.

Why: To measure our advertising and show our ads to people likely to be interested in them.

Service providers that run our systems

Who: Vercel (hosting), Supabase (the database, in CoreAge Rx’s account), Slack (order alerts that our team and CoreAge Rx’s team receive) and Google Maps Platform (address suggestions).

What they receive: Hosting and the database hold everything this policy describes. Slack alerts can include your name, email address, phone number, address and state, the treatment you ordered or asked about, your price-check answers, the link to your intake, the last four digits of your card, and your feedback. Google Maps receives the address you type.

Why: To run our sites and keep our records, and so our team can follow up with you.

Authorities, and a buyer of our business

Who: Courts, regulators and others when the law requires it, and a company that buys or merges with ours.

What they receive: What the legal request or the transaction requires.

Why: To comply with the law, protect rights and safety, or complete a merger or sale of our business, as our Privacy Policy describes.

Every analytics and advertising tag sees the address of the page it runs on. Our page addresses can name the treatment, and on some pages after payment the address has included your name, email address, phone number, state and treatment, so the tags you allowed on those pages could see them. The link to the medical intake on www.coreagerx.com carries the same details; the intake pages there load no advertising tags.

Our own measurement

Outside Washington and Nevada, from your first page view and before you make any cookie choice, we record for our own use which link or advertisement brought you to us and the pages and steps you visit. In Washington and Nevada, or if we can’t tell where you are, we record which link or advertisement brought you, and connect your visits to it, only if you allow our own measurement (see Washington and Nevada). We do this with our own cookies (coreage_bid, a random identifier for your browser, kept for one year; superhealthy_track and superhealthy_click, the campaign and ad-click details of the link you arrived on, kept for 90 days; and, on our landing pages, lp_vid, kept for one year), a session identifier, and the ad-click details we record with your visit.

We use these records only for our own attribution: to learn which links and advertisements bring us patients. We do not sell them, and we do not send them to advertising platforms. If you allow advertising cookies, an advertising tag can see the address of the page you are on, which may include the campaign details that were in the link.

Tracking across other websites

Third parties can collect consumer health data about you over time and across other websites and apps: if you allow them, our analytics and advertising partners above can combine what their tags record on our sites with your activity elsewhere. Our payment and fraud-prevention services use their own cookies to recognize devices across the websites that use them.

How we ask for your consent

None of the analytics or advertising partners above receive anything from our pages until you allow them on our cookie banner. Outside Washington and Nevada, analytics and advertising are separate choices there, so you can allow one without the other; in Washington and Nevada the banner asks the questions described below instead. You can change or withdraw your choice at any time from Your Privacy Choices in the footer of our app., pay. and try.superhealthyrx.com pages, and we treat a Global Privacy Control signal from your browser as an opt-out of advertising. The medical intake runs on CoreAge Rx’s website, www.coreagerx.com, which uses a separate cookie tool (Cookiebot), which loads Meta’s pixel only after you accept; see its cookie settings there. Its intake pages load no advertising tags. Reply STOP to any of our text messages to stop them.

Outside Washington and Nevada, the cookie banner does not control our own measurement (above). It never controls the services that run our sites and handle your consultation, order and messages: CoreAge Rx, the medical platform, providers and pharmacies, our payment processors, our customer record and messaging services, and the service providers that run our systems.

Washington and Nevada

If we locate you in Washington or Nevada, or can’t tell where you are, the cookie banner on app.superhealthyrx.com, pay.superhealthyrx.com and try.superhealthyrx.com asks for your consent to two things separately, and both stay off until you choose:

Our own measurement: the coreage_bid cookie, and the advertisement, campaign and link details we record about how you reached us (see Our own measurement).
Sharing with our analytics and advertising partners: the partners listed above and what those entries say they receive, including your contact details where they say so.

You can choose Allow both, Decline both, or tick one and choose Save my choices. Until you choose, and if you decline, we keep only what we need to serve you: your session and the steps you reach in it, your questionnaire answers, the treatment, plan and price you choose, your checkout, your state, and the technical details of each page view (your browser and approximate location). If you said OK on our standard cookie banner, for example in another state, that doesn’t count in Washington or Nevada, and we ask you again. You can withdraw or change your consent at any time from Your Privacy Choices.

Until you choose, and if you decline our own measurement, we may still keep de-identified, aggregate campaign totals (weekly counts of visits, checkout page visits, sign-ups and orders, and order revenue, per advertising campaign, for Washington and Nevada combined, including visitors whose location we can’t determine) that contain nothing identifying you, your device or any single order; we keep and use these totals only in de-identified form, we will not attempt to re-identify them, and we do not share them.

We tell where you are from your IP address, which can be wrong, for example when you use a VPN. Wherever we place you, you can decline sharing with our partners from Your Privacy Choices. These choices don’t cover the medical intake on www.coreagerx.com (see above). You may also withdraw consent or ask us to delete your consumer health data at any time; see Your rights.

How we process it

We collect consumer health data through the pages and forms described above, store it in our database, use it for the purposes in this policy, and send it to the recipients listed above. It travels between your browser, our servers and those recipients over encrypted (HTTPS) connections.

Your rights

Washington and Nevada consumers have the right to:

Confirm whether we collect, share or sell consumer health data about you, and get a copy of it.
Get a list of all third parties and affiliates with which we have shared or sold your consumer health data, with an email address or other online way to contact each of them.
Withdraw your consent to our collection and sharing of your consumer health data, and ask us to stop collecting, sharing or selling it.
Have your consumer health data deleted. We delete it from our records, including archived and backup systems, and tell CoreAge Rx and the processors and third parties we shared it with to delete it too. Deleting it from backups can take longer, as those laws allow: up to six months for a Washington request and up to two years for a Nevada request.
Review the consumer health data we hold about you and ask us to correct it.

If you withdraw consent or ask us to stop sharing, we cannot keep providing a treatment that depends on that sharing: a provider cannot evaluate you without your intake, and a pharmacy cannot fill a prescription without your details.

How to make a request

Email support@superhealthyrx.com with “Consumer health data request” in the subject line, or write to us at the address below, and tell us which right you want to use. To protect your information we confirm that a request comes from you: send it from the email address you used with us, or include the name, email address and phone number you gave us. If we cannot confirm it, we may ask for more information. You do not need an account.

We respond within 45 days of receiving your request. If we need more time, we may extend that once by another 45 days, and we will tell you why within the first 45 days. For a Nevada consumer, we delete consumer health data within 30 days of confirming the request. Responses are free of charge for at least two requests a year.

Appeals

If we decline to act on your request, you can appeal by replying to our decision or by emailing support@superhealthyrx.com with “Consumer health data appeal” in the subject line. Within 45 days of receiving your appeal, we will tell you in writing what we did or decided not to do, and why. If we deny your appeal, you can contact your state’s Attorney General:

Washington: the Office of the Attorney General, at atg.wa.gov/file-complaint or 1-800-551-4636 (206-464-6684 from outside Washington).
Nevada: the Office of the Attorney General, at ag.nv.gov/Complaints, or its Bureau of Consumer Protection at 702-486-3132.

No discrimination

We will not discriminate against you for using these rights. We will not deny you service, charge you a different price or give you a different level of service because you made a request, apart from the limits on treatment described under “Your rights.”

Changes to this policy

When we change this policy, we post the new version on this page and update the effective date at the top. We will not collect, use or share consumer health data in a new category, for a new purpose or with a new kind of recipient without first telling you and getting your consent.

Contact us

Email support@superhealthyrx.com or call +1 (737) 387-1140 (Monday to Friday, 9 AM to 6 PM Eastern). You may also write to us at:

Natural Smart Health LLC DBA SuperHealthy Rx
Attn: Privacy Team/Regulatory Compliance
1314 W McDermott Dr, Ste 106-971
Allen, TX 75013