Privacy Policy

ElliotMeds LLC operates this website and holds the information you provide, including the medical intake you complete, the documents you upload, the record of your consents, and your order and payment history. The clinicians who review your intake and decide on your treatment access that information through these systems. Medical services are provided by Stotland Medical LLC, the provider organization responsible for your medical care and the custodian of your medical records. ElliotMeds LLC holds and safeguards those records on its behalf under a written agreement between the two companies. The Notice of Privacy Practices, issued by Stotland Medical LLC, describes how your health information is used and disclosed.

We collect the following types of information:

Personal Information

• Name, email, phone number, address
• Date of birth and demographic information
• Payment and billing information

Health Information (Protected Health Information — PHI)

• Medical history and current conditions
• Current medications and allergies
• Physical measurements and health metrics
• Treatment goals and lifestyle information
• Clinician chart reviews and prescription records

Technical Information

• IP address, browser type, device information
• Usage data and analytics
• Cookies and tracking technologies

We use your information to:

• Provide telemedicine chart review and treatment
• Process and fulfill prescriptions
• Communicate about your care and treatment
• Process payments and prevent fraud
• Comply with legal and regulatory requirements
• Improve our services and user experience
• Measure and improve our marketing and advertising
• Send administrative communications

We do not sell your personal information. We may share your information with:

• Healthcare Providers: Licensed clinicians who review your chart and prescribe treatment
• Pharmacy: A licensed United States pharmacy authorized to dispense in the state where you are located, which fills prescriptions issued through ElliotMeds.
• Service Providers: Third parties who assist with payment processing, shipping, and technology infrastructure
• Analytics and Advertising Providers: We use Google Analytics and Google Ads to understand how visitors use our site and to measure our marketing. These providers may receive certain device and usage information (such as IP address and pages viewed) through cookies and similar technologies. Advertising and advertising-measurement tags do not run on pages that identify a specific medication or treatment, on checkout pages, or on authenticated account pages. Analytics on those pages is limited to first-party operation of the site. General marketing pages (such as the homepage) may use advertising and analytics services as described in this policy. Under some state privacy laws this may be considered a 'sale' or 'share'; see 'Cookies, Analytics, and Advertising' and 'Your California Privacy Rights' below for how to opt out.
• Legal Requirements: When required by law, regulation, or court order

ElliotMeds maintains the following safeguards.

• Access to your information is limited to the clinician assigned to your care, the staff who administer the platform, and the service providers that operate it
• Our database enforces access rules on every record, so one account cannot read another account's information, and a clinician can open a chart only for an order assigned to that clinician
• Identification documents and laboratory files are held in private storage and are reachable only through links that expire
• Stotland Medical LLC and ElliotMeds LLC are each required to protect your information under the written agreement between them
• You can review your information and request corrections through your account
• We notify you of material changes to this policy

No website, electronic storage method, or electronic transmission method can be guaranteed completely secure.

Information you send to and receive from ElliotMeds travels over encrypted HTTPS connections. Your records are stored in a hosted PostgreSQL database that enforces per-account access rules at the database layer, and identification and laboratory uploads are held in private storage reachable only through links that expire. Despite these measures, no method of internet transmission or electronic storage is fully secure.

Do not submit personal health information through general contact forms or unsecured email. Use the secure intake process after creating an account when you need to share medical details.

We keep different categories of information for different periods. Some are deleted automatically on a fixed schedule. Others — medical records, prescription records, consent records, and transaction records — are subject to retention requirements under state and federal law and professional record-keeping rules, and are not deleted on request.

Deleted automatically

• Items left in a shopping cart — deleted 14 days after they were last updated.
• Rate-limiting and abuse-prevention records — deleted after 7 days.
• Contact details submitted before an account is created, where no account is created — date of birth and treatment interest removed after 30 days, and the record deleted after 90 days.
• Contact details from someone who has asked not to be contacted — deleted 30 days after that request is recorded.
• Consultation time slots that were never booked — deleted once the time has passed.

Retained

• Medical intake records, chart reviews, clinical notes, and prescription records — retained by Stotland Medical LLC for the period required by applicable state and federal law and professional record-keeping obligations.
• Consent records and signed documents — retained for the same period as the medical record they relate to, because they evidence what you agreed to and when.
• Order and payment records — retained for the period required by tax, accounting, and payment-network rules.
• Account records — retained while your account is open, and afterwards only as needed for the records above.

Our database is backed up daily and those backups are retained for seven days. Documents you upload, such as identification or laboratory results, are stored separately from the database and are not covered by that backup schedule. When we delete information from our live systems, copies held in a backup are removed as that backup ages out rather than immediately.

Your rights depend on which information is involved. Rights in your health information come from federal health privacy law and are described in full in the Notice of Privacy Practices, issued by Stotland Medical LLC as the provider organization responsible for your medical care. Rights in your other personal information come from state privacy laws.

Rights in your personal information

• Know what personal information we collect, use, and share
• Correct inaccurate personal information
• Delete personal information, subject to the retention requirements described above
• Opt out of the sale or sharing of personal information
• Limit the use and disclosure of sensitive personal information
• Not be treated differently for exercising a privacy right
• Request a copy of this Privacy Policy

Rights in your health information

• Access your health information
• Request corrections to inaccurate health information
• Request restrictions on how your health information is used
• Receive an accounting of disclosures

You may also file a complaint if you believe your rights were violated. The Notice of Privacy Practices explains how to complain about the handling of health information.

How to make a request

Email [email protected] and tell us which right you want to exercise. This is our designated method for requests to know, correct, or delete. You may also call (833) 701-2741. To opt out of the sale or sharing of personal information, or to limit the use of sensitive personal information, use our Your Privacy Choices page. You do not need an account to make a request, and we will not require you to create one.

How we verify your identity

Before acting on a request we need to confirm that you are the person the information belongs to. We do this by matching the details in your request against the information already in our records, and we may ask for more information if the request concerns health records. We cannot act on an unverified request for health information.

How long we take

We will acknowledge your request within 10 business days. We will respond substantively within 45 calendar days. If we need more time, we will tell you before the first 45 days end, and we may take up to 45 additional days.

Authorized agents

You may use an authorized agent to submit a request for you. We will ask for written permission signed by you, and we may still ask you to verify your identity with us directly.

What deletion means

Some information can be deleted on request and some cannot.

If you ask us to delete your information, we delete your marketing and contact records, support correspondence, your account profile, saved cart contents, and advertising and analytics identifiers.

We do not delete medical intake records, chart reviews, prescription records, consent records, signed documents, or order and payment records. These are subject to the retention requirements described above, and deleting them would breach state and federal record-keeping obligations. We will tell you which categories we kept and why.

We will not tell you information has been deleted when it has not.

No penalty for exercising your rights

We will not deny you service, charge you a different price, or give you a different level of service because you exercised a privacy right.

If there is a data breach

If a breach affects your personal or health information, we will notify you as required by law and without unreasonable delay. The notice will describe what happened, what information was involved, and what you can do.

We use cookies and similar technologies for three purposes: (1) essential cookies required for the site to function; (2) analytics cookies, including Google Analytics, that help us understand how the site is used; and (3) advertising cookies, including Google Ads and its measurement partners, used to measure our marketing. You can control cookies through your browser settings, opt out of Google Analytics using Google's opt-out browser add-on, and manage ad personalization through Google's Ads Settings. Disabling these cookies will not affect your ability to receive care.

If you are a California resident, you may have the right to know what personal information we collect, to request access, correction, or deletion, and to opt out of the 'sale' or 'sharing' of personal information for cross-context behavioral advertising. We do not sell your personal information. Our use of advertising technologies such as Google Ads may be considered 'sharing' under California law. To opt out, you can use our Your Privacy Choices page, disable advertising cookies in your browser, turn off ad personalization in Google's Ads Settings, install the Google Analytics opt-out browser add-on, or email [email protected] to request that we not share your personal information for advertising. We will not discriminate against you for exercising your privacy rights. For privacy requests, contact [email protected].

Residents of all states: We extend the privacy rights described in this section — including access, correction, deletion, and the right to opt out of targeted advertising — to residents of every U.S. state, regardless of whether your state's privacy law requires it. Requests follow the same process, verification steps, and response timelines described above.

Our services are not intended for individuals under 18 years of age. We do not knowingly collect information from minors.

We may update this Privacy Policy periodically. We will notify you of material changes via email or website notice.

For privacy questions or to exercise your rights, contact:

Mitchell Brandon Stotland, HIPAA Privacy Officer

[email protected]

(833) 701-2741