Privacy Policy and HIPAA Notice of Privacy Practices

This Privacy Policy describes the practices of MediRX, Inc., and its affiliates (“MediRX,” “we,” “us,” or “our”) when you use medirx.org, glp.medirx.org, our patient portal, any app, or otherwise provide information to us (the “Services”). It is part of our Terms of Service.

Health information. When we receive, store, or send health information on behalf of an Affiliated Provider (the independent medical practice that treats you), we act as that provider's “business associate” under HIPAA and handle that information as the Notice in Part B and our agreements with the provider require. Where Part A and Part B conflict for protected health information, Part B controls.

Information you give us

• Identity and contact details: name, address, phone, email, date of birth, sex;
• Health information: medical history, conditions, medications, allergies, height, weight, photos, lab results, pregnancy status, and your intake answers and messages with your care team;
• Account and order details: login credentials, plan, order history, shipping address;
• Payment details: collected and stored by our payment processors (we do not store full card numbers);
• Identity verification information, where required;
• Customer support communications and survey responses.

Information collected automatically

• Device and usage data: IP address, browser and device type, operating system, pages viewed, clicks, referring pages, and dates and times of use;
• General location derived from your IP address (for example, to confirm your state). We do not collect precise GPS location without your permission;
• Cookies, pixels, SDKs, and similar technologies, as described in A5.

Information from others

• Affiliated Providers and Pharmacy Partners (for example, prescription and shipping status);
• Payment processors, identity verification, and fraud prevention providers;
• If you were referred to us, the referring partner.

• To provide the Services: create your account, route your intake to an Affiliated Provider, process payments and refills, send your prescription to a Pharmacy Partner, and ship orders;
• To communicate with you about your account, care, orders, and billing, including texts and calls you have agreed to;
• To send marketing, only as permitted by law and your choices;
• To provide customer support and handle complaints and chargebacks;
• To operate, secure, and improve the Services, prevent fraud, and verify identity;
• To comply with law and enforce our Terms;
• To create de-identified or aggregated data that no longer identifies you, which we may use for any lawful purpose.

We share information only as described here:

• Affiliated Providers to evaluate and treat you;
• Pharmacy Partners to fill and ship prescriptions;
• Service providers that work for us under contract (hosting, payment processing, identity verification, customer support, shipping, communications, analytics, and security). Those that handle health information sign business associate agreements;
• Legal and safety: to comply with law, legal process, or government requests; to protect rights, safety, and property; and to prevent fraud;
• Business transfers: in a merger, acquisition, financing, or sale of assets, subject to this Policy and applicable law;
• With your consent or at your direction.

We do not sell your health information, and we do not disclose your health information, or the fact that you are a patient or sought treatment, to advertising platforms.

We use cookies and similar technologies to operate the Sites, remember preferences, measure performance, and, on our public marketing pages only, measure and deliver advertising.

• Analytics: We use analytics providers (for example, Google Analytics) to understand how the Sites are used. You can opt out with the Google Analytics Opt-out Browser Add-on.
• Advertising: On our public marketing pages, advertising partners (for example, Meta and Google) may use cookies and pixels to measure our ads and show you MediRX ads on other sites. We do not place advertising pixels on intake, checkout, or patient portal pages, and we do not send intake answers or other health information to advertising partners.
• Your choices: You can block or delete cookies in your browser, use the Network Advertising Initiative and Digital Advertising Alliance opt-out tools, or use “Your Privacy Choices” (A9). We honor Global Privacy Control (GPC) signals as a request to opt out of sale and sharing for that browser. We do not otherwise respond to “Do Not Track” signals.

We use administrative, technical, and physical safeguards designed to protect your information, including encryption in transit, access controls, and vendor agreements. No system is completely secure, so we cannot guarantee security. Keep your password confidential and tell us right away if you suspect unauthorized access. We will notify you of a breach as required by law.

We keep personal information only as long as needed for the purposes in this Policy and to meet legal, tax, accounting, and medical-record retention requirements. Medical records are retained by your Affiliated Provider for the period required by your state's law.

Everyone: You may access, update, or correct your account information in the patient portal, unsubscribe from marketing emails using the link in any email, and reply STOP to texts.

Your Privacy Choices (opt out of sale or sharing): Some of our use of advertising cookies on public marketing pages may be considered a “sale” or “sharing” of personal information for targeted advertising under some state laws. To opt out, use the “Your Privacy Choices” link in our footer, enable GPC in your browser, or email care@medirx.org.

California residents. Under the California Consumer Privacy Act, as amended (CCPA), you have the right to: know the categories and specific pieces of personal information we collect, use, disclose, sell, or share; delete it; correct it; opt out of its sale or sharing; limit our use of sensitive personal information (we use it only for purposes permitted by law); and not be discriminated against for exercising these rights. Medical information governed by HIPAA or the California Confidentiality of Medical Information Act (CMIA) is exempt from the CCPA and is protected under those laws.

In the last 12 months we collected these categories, for the purposes in A3, and disclosed them to the recipients in A4:

We do not knowingly sell or share the personal information of anyone under 16.

Residents of other states with privacy laws (including Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, and Virginia) have similar rights to access, correct, delete, and port their data and to opt out of targeted advertising, sale, and profiling. If we deny your request, you may appeal by replying to our response with “Appeal” in the subject line; if your appeal is denied, you may contact your state attorney general.

Nevada residents: We do not sell covered information as defined by Nevada law. You may still submit an opt-out request to care@medirx.org.

How to make a request: Email care@medirx.org with “Privacy Request” in the subject line, or call (302) 204-2197. We will verify your identity by matching information in your account. You may use an authorized agent, who must provide your signed permission. We respond within the time required by law (generally 45 days). Requests for medical records are handled under Part B.

Some states protect “consumer health data” that is not covered by HIPAA. Our full Consumer Health Data Privacy Policy is at glp.medirx.org/consumer-health-data and is also linked separately in our footer. In summary:

• What we collect: health conditions, treatments, medications, body measurements, and similar information you provide in your intake and account, and inferences that you are seeking weight-management care;
• Why: to provide the telehealth services you request, process payment, ship orders, and comply with law;
• Sources: you, your Affiliated Provider, and Pharmacy Partners;
• Who we share it with: Affiliated Providers, Pharmacy Partners, and service providers bound by contract, and as required by law. We do not sell consumer health data;
• Consent: Washington residents give separate consent to collection and to sharing before we collect it, and may withdraw consent at any time;
• Your rights: confirm whether we collect, share, or sell your consumer health data; access it and a list of third parties and affiliates we shared it with; withdraw consent; and request deletion. Email care@medirx.org with “Consumer Health Data Request” in the subject line. You may appeal a denial by replying with “Appeal” and, if denied, contact your state attorney general.

The Services are only for adults 18 and older. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

We may update this Policy. We will post the new version with a new “Last updated” date and notify you of material changes by email or in your patient portal before they take effect.

MediRX, Inc., Attn: Privacy, 30 N Gould St Ste R, Sheridan, WY 82801 · care@medirx.org · (302) 204-2197

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective date: October 16, 2026

This Notice applies to the independent professional medical practice whose licensed clinicians provide your care through the MediRX platform (“the Practice,” “we,” or “us” in this Part B), and to MediRX when it handles your information on the Practice's behalf as a business associate. The name of your treating clinician and Practice is provided in your patient portal and with your prescription, and is available on request.

We are required by law to keep your protected health information (“PHI”) private, give you this Notice of our legal duties and privacy practices, follow the Notice currently in effect, and notify you if a breach of your unsecured PHI occurs.

• Treatment: to provide and coordinate your care, including sharing with a pharmacy to fill your prescription or with other clinicians involved in your care;
• Payment: to bill and collect for services (for example, processing your payment through MediRX);
• Health care operations: to run our practice, such as quality review, training, audits, and customer service;
• Business associates: to companies that perform services for us, such as MediRX, under written agreements that require them to protect your PHI;
• Appointment reminders and treatment communications: including by text or email if you have agreed;
• As required by law;
• Public health and safety: to report adverse drug events to the FDA, prevent disease, or report suspected abuse, neglect, or domestic violence;
• Health oversight: to agencies for audits, investigations, and licensure;
• Legal proceedings: in response to a court order, subpoena, or other lawful process;
• Law enforcement: as permitted by law;
• Serious threat: to prevent or lessen a serious and imminent threat to health or safety;
• Specialized government functions, workers' compensation, coroners, and organ donation, as permitted by law;
• Family and friends: to a person involved in your care or payment, if you agree or do not object.

Uses that require your written authorization: most uses of psychotherapy notes; marketing (other than face-to-face communications or small promotional gifts); sale of PHI; and any other use not described in this Notice. You may revoke an authorization in writing at any time, except to the extent we already acted on it.

Stricter state laws: Some states give more protection to certain information (for example, HIV, mental health, substance use disorder, or reproductive health information). We follow those stricter laws where they apply.

• Get a copy of your records: You may request an electronic or paper copy of your medical record. We will respond within 30 days and may charge a reasonable, cost-based fee.
• Ask us to amend your records if you believe they are incorrect or incomplete. We may deny the request in writing and explain why.
• Request confidential communications, such as contacting you at a different address or by email instead of text. We will agree to reasonable requests.
• Ask us to limit what we use or share. We are not required to agree, except that if you pay in full out of pocket for a service, you may ask us not to share information about it with your health insurer, and we will agree unless the law requires sharing.
• Get a list of those we shared your information with (an accounting of disclosures) for up to six years before your request, excluding treatment, payment, operations, and certain other disclosures. One list per 12 months is free.
• Get a copy of this Notice at any time, electronically or on paper.
• Choose someone to act for you, such as a legal guardian or someone with medical power of attorney.
• File a complaint if you believe your privacy rights were violated, with us (below) or with the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue SW, Washington, DC 20201, (877) 696-6775, or www.hhs.gov/ocr/privacy/hipaa/complaints/. We will not retaliate against you for filing a complaint.

Privacy Officer, c/o MediRX, 30 N Gould St Ste R, Sheridan, WY 82801 · care@medirx.org (subject line “HIPAA Request”) · (302) 204-2197. Requests are forwarded to the Practice's Privacy Officer, who will respond.

We may change this Notice, and the changes will apply to all information we have about you. The new Notice will be available on request and on our website.