Privacy Policy

01Scope of this policy

This Privacy Policy describes how Reborn RX LLC ("Reborn Rx," "we," "us") handles personal information collected through the Reborn Rx website, mobile experience, and customer support channels.

This policy does not cover the privacy practices of dispensing pharmacies, laboratories, or any third-party site you reach from a link on our platform. Those parties have their own notices.

02Information we collect

Information you give us

• Account and identity: name, date of birth, email, mobile number, mailing and shipping address, and state of residence.
• Health information: your intake answers, height and weight, medical and family history, medications, allergies, prior NAD+ or precursor use, lab results, photographs you upload, and messages with your care team.
• Payment information: processed by our PCI-DSS certified payment processor. We do not store your full card number. We retain the card brand, last four digits, and expiration date.
• Insurance information where you ask us to pursue coverage or prior authorization.
• Support communications: emails, chats, and call recordings where permitted and disclosed.

Information collected automatically

• Device and browser type, operating system, IP address, and approximate location derived from IP;
• Pages viewed, referring URL, timestamps, and interactions with the site;
• Cookies and similar technologies, as described in Section 6.

Information from third parties

• Identity and address verification services;
• Pharmacies and laboratories involved in your care;
• Your health plan or pharmacy benefit manager, where you ask us to check coverage;
• Fraud prevention and payment risk services.

03How we use information

We use personal information to:

• Create and administer your account and verify your identity and eligibility;
• Route your intake to a clinician licensed in your state and support the delivery of care;
• Transmit prescriptions to a pharmacy and coordinate shipping and refills;
• Process payments, prevent fraud, and manage refunds and disputes;
• Provide customer support and respond to your questions;
• Send transactional and clinical messages — appointment reminders, shipment notices, refill and check-in prompts, safety communications, and billing notices;
• Send marketing communications where you have not opted out, or where you have opted in for SMS marketing;
• Monitor, secure, debug, and improve the platform;
• Comply with legal obligations, including recordkeeping, pharmacy, and public health reporting requirements.

We do not use your health information to train advertising models or to build advertising profiles.

04How we share information

We share personal information only as described here:

With your clinicians and the Medical Group

So that care can be delivered. This is the primary purpose of collecting your health information.

With dispensing pharmacies and laboratories

The information necessary to fill a prescription, run ordered tests, and ship to you.

With service providers

Hosting, secure messaging, payment processing, identity verification, shipping, email and SMS delivery, and customer support tooling. These vendors act on our instructions under written contracts and, where they handle PHI, under Business Associate Agreements. They may not use your information for their own purposes.

With your insurer

Only where you ask us to pursue coverage, a prior authorization, or an appeal.

For legal reasons

Where required by law, subpoena, or court order; to report adverse events or product quality problems to the FDA or a manufacturer; to comply with public health obligations; or to protect the rights, safety, or property of you, our staff, or the public.

In a corporate transaction

If Reborn Rx is involved in a merger, acquisition, financing, or sale of assets, information may transfer as part of that transaction. PHI transfers only in a manner permitted by HIPAA, and we will notify you of any material change to how your information is handled.

05How we protect information

We maintain administrative, physical, and technical safeguards designed to protect personal information, including:

• Encryption of data in transit (TLS 1.2 or higher) and at rest;
• Role-based access controls and the minimum necessary standard — staff see only what their role requires;
• Multi-factor authentication for workforce accounts;
• Audit logging of access to medical records;
• Background screening and annual HIPAA and security training for workforce members;
• Vendor security review and Business Associate Agreements;
• Incident response procedures and breach notification consistent with the HIPAA Breach Notification Rule and applicable state law.

No system is perfectly secure. If a breach affects your unsecured PHI, we will notify you as required by law.

06Cookies, analytics, and advertising

We use the following categories of cookies and similar technologies:

Strictly necessary

Authentication, session management, load balancing, and fraud prevention. These cannot be disabled.

Functional

Remembering preferences such as your state and saved intake progress.

Analytics

Aggregate measurement of how the site is used so we can improve it.

Advertising

Measuring the performance of our advertising on marketing pages only.

You can control cookies through your browser settings and through our cookie preferences tool. We honor Global Privacy Control (GPC) signals as a valid opt-out of sale and sharing under applicable state law.

07Your privacy rights and choices

Rights available to everyone

• Access: request a copy of the personal information we hold about you.
• Correction: ask us to correct inaccurate information.
• Deletion: ask us to delete information we are not required to retain. We generally cannot delete medical records within the retention period required by state law.
• Portability: receive your information in a portable, machine-readable format.
• Opt out of marketing: unsubscribe from marketing email at any time using the link in any message, or reply STOP to marketing SMS. You cannot opt out of transactional and clinical messages while you are an active member.

State privacy rights

Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have additional rights, which may include the right to opt out of targeted advertising, sale, and certain profiling, and the right to appeal a denied request. We do not sell personal information or share it for cross-context behavioral advertising.

Note that information protected by HIPAA is generally exempt from these state laws; requests concerning your medical record are handled under the Notice of Privacy Practices, which gives you comparable and in some cases stronger rights.

How to exercise a right

Email info@rebornrx.health, call 1-877-671-5767, or write to the address in Section 11. We will verify your identity before acting and will respond within 45 days, extendable once by another 45 days where permitted. You may use an authorized agent. We will not discriminate against you or change your care because you exercised a privacy right. If we deny a request, you may appeal by replying to our response.

08How long we keep information

We keep personal information only as long as necessary for the purpose it was collected, and then for the period required by law.

• Medical records: retained by the Medical Group for the period required by the law of the state where care was delivered — commonly 6 to 10 years after the last encounter, and longer for patients who were minors.
• Billing and tax records: generally 7 years.
• Account and marketing data: deleted or de-identified within 24 months of account closure, unless a legal hold applies.
• Web logs: generally 13 months.

09Children

Reborn Rx is intended for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it promptly. If you believe a minor has provided us information, contact info@rebornrx.health.

10Changes to this policy

We may update this Privacy Policy. If we make a material change, we will update the "Effective" date above and notify you by email or through the platform before the change takes effect. We encourage you to review this page periodically.

11Contact our Privacy Officer

To file a complaint about the handling of your medical record, see the Notice of Privacy Practices, which explains how to complain to us and to the U.S. Department of Health and Human Services.