Privacy Policy

1. Who We Are

TeloLife ("TeloLife," "we," "our," or "us") is a telehealth platform that connects patients with licensed physician groups for clinician-guided GLP-1 weight loss therapy. We operate at www.telolife.com.

TeloLife is a HIPAA-covered entity and Business Associate, as applicable. Our licensed physician group partners are independent medical practices that provide clinical care through our platform.

Questions about this Policy may be directed to our Privacy Officer at privacy@telolife.com.

2. Information We Collect

Information You Provide Directly

• Identity & Contact: Full name, date of birth, email address, phone number, billing and shipping address.
• Health & Medical Information: Current medications, medical history, height, weight, BMI, health conditions, allergies, and other information submitted through our health intake questionnaire.
• Payment Information: Credit/debit card details, billing address. Payment data is processed by Stripe and is never stored on TeloLife's servers.
• Account Credentials: Username and password for your patient portal account.
• Communications: Messages sent to our care team, support requests, and feedback.

Information Collected Automatically

• Device & Usage Data: IP address, browser type and version, operating system, pages visited, time spent on pages, referring URLs.
• Cookies & Similar Technologies: Session cookies, preference cookies, and analytics identifiers. See Section 8 for details.

Information from Third Parties

• Laboratory results from Quest Diagnostics, LabCorp, or other partner labs when you order lab services through TeloLife.
• Pharmacy dispensing records from our licensed pharmacy network partners.
• Identity verification data from third-party verification services.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Providing Services: Facilitating your telehealth consultation, prescription review, medication ordering, and ongoing care coordination.
• Clinical Care: Sharing relevant health information with the licensed physician groups and pharmacies involved in your care.
• Account Management: Creating and managing your patient portal account, processing payments, and fulfilling medication orders.
• Communications: Sending appointment reminders, prescription updates, care team messages, and service notifications.
• Safety & Compliance: Monitoring for adverse events, ensuring regulatory compliance, and maintaining accurate medical records.
• Platform Improvement: Analyzing usage patterns to improve our platform, services, and patient experience (using de-identified data where possible).
• Legal Obligations: Complying with applicable law, responding to lawful requests, and protecting our legal rights.

We do not sell your personal information or Protected Health Information to third parties. We do not use your health information for advertising purposes.

4. HIPAA & Protected Health Information

Your HIPAA Rights

As a patient, you have the following rights regarding your Protected Health Information (PHI):

• Right to Access: Request a copy of your medical records and health information.
• Right to Amend: Request corrections to inaccurate or incomplete PHI.
• Right to an Accounting: Receive a list of certain disclosures we have made of your PHI.
• Right to Restrict: Request restrictions on how we use or disclose your PHI.
• Right to Confidential Communications: Request that we communicate with you through alternative means or at alternative locations.
• Right to a Paper Copy: Receive a paper copy of our Notice of Privacy Practices upon request.

To exercise any HIPAA right, contact our Privacy Officer at privacy@telolife.com or in writing at our mailing address. We will respond within 30 days as required by law.

Permitted Uses and Disclosures

We may use and disclose your PHI without your authorization for treatment, payment, and healthcare operations (TPO) as permitted by HIPAA. All other disclosures require your written authorization, which you may revoke at any time.

5. How We Share Your Information

We share your information only as described in this Policy and as permitted by law:

• Licensed Physician Groups: Your health information is shared with the independent physician groups that review and manage your care on our platform.
• Licensed Pharmacies: Prescription and shipping information is shared with our partner pharmacies to fulfill your medication orders.
• Laboratory Partners: Your information is shared with Quest, LabCorp, or other labs when you order diagnostic testing.
• Payment Processors: Stripe processes payment transactions. TeloLife does not store full payment card data.
• Technology Service Providers: Cloud hosting, email delivery, secure messaging, and analytics vendors operating under Business Associate Agreements (BAAs) where required.
• Legal Requirements: We may disclose information when required by law, court order, or governmental authority, or to protect the rights, property, or safety of TeloLife, our patients, or the public.
• Business Transfers: In the event of a merger, acquisition, or sale of all or substantially all assets, your information may be transferred subject to the same protections described in this Policy.

We require all third-party service providers who access PHI to sign Business Associate Agreements and maintain appropriate safeguards consistent with HIPAA.

6. Data Security

We implement administrative, physical, and technical safeguards to protect your information, including:

• 256-bit TLS/SSL encryption for all data transmitted between your browser and our servers.
• Encryption of PHI at rest using AES-256 encryption.
• Role-based access controls limiting employee access to PHI on a need-to-know basis.
• Regular security risk assessments and penetration testing.
• Audit logs for all access to PHI.
• Multi-factor authentication for administrative systems.
• Workforce HIPAA training and confidentiality agreements.

In the event of a breach involving your PHI, we will notify you as required by the HIPAA Breach Notification Rule and applicable state law.

7. Your Rights & Choices

Marketing Communications

You may opt out of non-essential marketing emails at any time by clicking "Unsubscribe" in any marketing email or contacting us at support@telolife.com. Note that you will continue to receive transactional and care-related communications necessary for your treatment.

Account Deletion

You may request deletion of your TeloLife account and non-PHI personal data at any time. PHI is retained for the periods required by applicable law and medical records regulations (typically a minimum of 7 years from the date of service, or longer for minors).

Data Portability

You may request a copy of your health records and personal data in a commonly used electronic format by contacting our care team or Privacy Officer.

8. Cookies & Tracking Technologies

We use cookies and similar technologies on our website. These include:

• Essential Cookies: Required for the website and patient portal to function. Cannot be disabled.
• Analytics Cookies: Help us understand how visitors use our site (e.g., Google Analytics). IP addresses are anonymized.
• Preference Cookies: Remember your settings and preferences across visits.

You may control cookie preferences through your browser settings. Disabling certain cookies may affect website functionality. We do not engage in cross-site behavioral advertising using your health information.

9. Children's Privacy

TeloLife's services are intended for adults 18 years of age and older. We do not knowingly collect personal information from individuals under the age of 18. If we become aware that we have collected information from a minor without parental consent, we will promptly delete such information. If you believe we have inadvertently collected information from a minor, please contact us at privacy@telolife.com.

SMS / Text Messaging

TeloLife offers text message (SMS) communications about your account, treatment, and promotions. Message frequency varies. Msg & data rates may apply. Reply STOP to opt out, HELP for help. Mobile opt-in information and consent are NOT shared with or sold to any third parties or affiliates for their marketing or promotional purposes. We may share data with service providers who help us deliver SMS messages solely for that purpose.

10. State-Specific Privacy Rights

California Residents (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including the right to know, delete, correct, and opt out of the sale or sharing of personal information. TeloLife does not sell personal information. For a full explanation of your California privacy rights and how to exercise them, please see our California Privacy Notice. To submit a request, contact privacy@telolife.com.

Texas Residents

Texas residents may have rights under the Texas Data Privacy and Security Act (TDPSA). Contact us to exercise applicable rights.

Other States

Residents of Virginia, Colorado, Connecticut, Utah, and other states with comprehensive privacy laws may have similar rights. We honor legally required requests from residents of all U.S. states.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. We will notify you of material changes by posting the updated Policy on our website with a new effective date, and where required by law, by email notification. Your continued use of our services after the effective date of any changes constitutes your acceptance of the updated Policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

• Privacy Officer, TeloLife
• Email: privacy@telolife.com