Privacy Policy

Last updated: May 15, 2026

1. Who this policy covers

This Privacy Policy explains how MaxLife MD ("MaxLife MD," "we," "our," or "us") collects, uses, and shares information when you visit our website, use our platform, or purchase our products and services (together, the "Services"). It applies to information collected directly by MaxLife MD.

Healthcare you receive through the platform is provided by independent licensed providers ("Providers") affiliated with a contracted medical group ("Medical Group"). The Medical Group is responsible for its own use and disclosure of your protected health information under its Notice of Privacy Practices, which the Medical Group will provide to you.

2. Information we collect

Information you provide

• Account & identity: name, date of birth, email, phone number, mailing and shipping address, government ID where required.
• Health intake: medical history, current medications, allergies, symptoms, treatment goals, photographs you upload, and any other clinical information you share with us or a Provider.
• Payment: card information and billing address (processed by our PCI-compliant payment processors — we do not store full card numbers on our servers).
• Communications: messages you send us through forms, email, chat, or SMS, including support tickets and feedback.

Information collected automatically

• Device & usage: IP address, browser type, device type, operating system, pages viewed, referring URLs, and approximate location derived from IP.
• Cookies & pixels: identifiers placed by us or our partners to remember preferences, analyze traffic, and measure marketing performance (see Section 5).

Information from third parties

• Providers, Medical Group, and Pharmacies: we receive prescription, fulfillment, and shipping information needed to deliver your order.
• Payment processors and verification services: we may receive fraud-check, address-verification, or ID-verification results.
• Marketing partners: we may receive engagement data (e.g., that you clicked an ad) from advertising platforms.

3. How we use information

We use the information we collect to:

• Provide, operate, and improve the Services, including processing orders and supporting subscriptions;
• Connect you with a Provider, route prescriptions to a Pharmacy, and coordinate shipping;
• Authenticate accounts, prevent fraud, and protect the security of the Services;
• Respond to your questions, complaints, and support requests;
• Send appointment reminders, shipping notices, refill prompts, and other transactional messages;
• Send marketing communications where you have consented (you can opt out at any time);
• Conduct analytics, research, and product development on aggregated or de-identified data;
• Comply with legal obligations and enforce our Terms of Service.

4. How we share information

We do not sell personal information and we do not share SMS opt-in data with third parties or affiliates for marketing. We share information only as described here:

• Providers, Medical Group, Pharmacies, and Labs — to deliver your care, fulfill prescriptions, and follow up on results.
• Service vendors — hosting, telehealth software, scheduling, payment processing, shipping, analytics, email/SMS delivery, customer support. These vendors are contractually limited to using your information to perform services for us.
• Legal & safety — when required by law, subpoena, or court order, or to protect the rights, property, or safety of MaxLife MD, our patients, or others.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, your information may be transferred subject to this policy.
• With your consent — for any other purpose disclosed to you at the time you provide the information.
• Aggregated or de-identified data — we may share data that no longer identifies you for research, benchmarking, and marketing analytics.

5. Cookies & tracking

We use cookies, pixels, and similar technologies for session management, analytics, and advertising measurement. You can usually control cookies through your browser settings, including blocking or deleting them. Disabling cookies may limit some features of the Site. We honor Global Privacy Control (GPC) signals where required by law.

6. SMS / text messaging privacy

If you opt in to text messages, we collect your mobile number and your consent record. We use that number only to send messages related to the Services — appointment reminders, shipping notifications, refill prompts, support replies, and occasional informational messages you have opted in to receive.

We do not sell, rent, share, or disclose mobile information or SMS opt-in data to third parties or affiliates for marketing purposes. Mobile numbers may be processed by our SMS delivery vendor solely to transmit messages on our behalf. You can opt out at any time by replying STOP; reply HELP for help. Message frequency varies. Message and data rates may apply.

7. Your rights & choices

Depending on where you live, you may have some or all of the following rights with respect to personal information we hold about you:

To exercise any of these rights, email [email protected]. We may need to verify your identity before fulfilling certain requests. We will respond within the time required by applicable law.

8. Health information & HIPAA

Your medical records and clinical communications with a Provider are Protected Health Information ("PHI") under the Health Insurance Portability and Accountability Act ("HIPAA"). The Medical Group is the HIPAA-covered entity for that care and maintains its own Notice of Privacy Practices, which it will make available to you. MaxLife MD acts as a HIPAA "business associate" of the Medical Group in some workflows and handles PHI in accordance with HIPAA and applicable state law.

How PHI may be used and shared

• Treatment: sharing your information with the Providers, Pharmacies, and Labs delivering your care (e.g., sending a prescription to a fulfilling pharmacy).
• Payment: processing payments and, if you request, sharing limited information with your insurance for reimbursement purposes.
• Healthcare operations: internal quality assurance, training, and care coordination.
• As required by law: public health reporting, court orders, or other lawful requests.

We will not use or share your PHI for any other purpose without your written authorization, which you may revoke at any time (except to the extent the Medical Group or its partners have already relied on it).

Filing a complaint about PHI

If you believe your privacy rights have been violated, you may file a complaint with us at [email protected]. You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights at 200 Independence Ave. S.W., Washington, D.C. 20201, by phone at 1-877-696-6775, or online at www.hhs.gov/ocr/privacy/hipaa/complaints. We will not retaliate against you for filing a complaint.

9. Data retention

We keep personal information for as long as needed to provide the Services, meet our legal and regulatory obligations (including medical-records retention requirements that may exceed seven years in some cases), resolve disputes, and enforce our agreements. When information is no longer needed, we delete or de-identify it in accordance with our retention schedules and applicable law.

10. Security

We use administrative, technical, and physical safeguards intended to protect personal information against loss, misuse, and unauthorized access — including encryption in transit and at rest for sensitive data, access controls, and vendor security review. No method of transmission or storage is 100% secure, however, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and notifying us immediately if you suspect unauthorized use.

11. Third-party sites

Our Site may link to third-party websites, products, or services. Those third parties have their own privacy practices, and we are not responsible for them. We recommend you review their privacy policies before sharing information.

12. Children's privacy

The Services are not directed to, and we do not knowingly collect personal information from, anyone under 18 years of age. If you believe a child has provided personal information to us, please contact us so we can delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. Material changes will be announced through the Site or by email where appropriate. Your continued use of the Services after a change becomes effective constitutes acceptance of the revised policy.