Consumer Health Data Privacy Policy

What counts as consumer health data

Some information — for example, quiz and assessment answers, or browsing information that could reveal health status — may be "consumer health data" under state laws, including Washington's My Health My Data Act, Nevada's consumer health data law (SB 370), Connecticut's consumer health data provisions (Connecticut Data Privacy Act), and California law (CCPA/CPRA, including sensitive personal information, and the Confidentiality of Medical Information Act where it applies).

Consumer health data we collect

• Health conditions, symptoms and treatment goals you share during intake.
• Medications, allergies and relevant medical history.
• Measurements such as height, weight and BMI.
• Information about the products and services you view or purchase.

Why we collect it

Solely to deliver care: to allow a licensed provider to evaluate you, to allow a pharmacy to dispense accurately, and to support you over time.

Consent, sales and geofencing

We collect and share consumer health data only with your consent or as necessary to provide the service you request. We do not sell consumer health data, and we do not use geofencing around healthcare facilities.

Who we share it with

• Licensed providers participating in your care.
• Licensed compounding pharmacies fulfilling your prescription.
• Processors bound by contract, such as hosting and shipping partners.
• Authorities where disclosure is required by law.

Your rights

• Confirm whether we collect, share, or sell your consumer health data.
• Access your consumer health data.
• Obtain a list of the third parties and affiliates with whom it has been shared.
• Withdraw consent to collection or sharing.
• Request deletion, subject to legal record-keeping requirements.
• Appeal a denied request.

How to exercise your rights

Email privacy@luunhealth.com with the subject line "Health Data Request". We respond within 45 days and will tell you if we need an extension. If we decline a request, you may appeal by replying to our response.

We will not discriminate against you for exercising these rights.

HIPAA and protected health information (PHI)

Health information you provide through the medical intake — for example, medical history, medications, symptoms, and lab results — is protected health information (PHI) when it is created, received, or maintained by or on behalf of the independent licensed healthcare providers and licensed pharmacies that provide your care.

How PHI is handled: Luun shares PHI only as needed with the independent licensed providers who review your intake and, if they prescribe, with the licensed pharmacy that dispenses your medication, and with service providers that help us operate the service — for treatment, payment, and healthcare operations, or as otherwise permitted or required by law. We do not sell PHI and we do not use PHI for advertising.

Business associate agreements are in place with partner providers, pharmacies, and service providers where required by HIPAA.

PHI is protected with administrative, technical, and physical safeguards, and access is limited to people who need it.

Your rights under HIPAA

• Access and obtain a copy of your health information.
• Request an amendment to your health information.
• Receive an accounting of certain disclosures.
• Request restrictions on certain uses and disclosures.
• Request confidential communications.
• Receive a paper copy of the notice of privacy practices.

You can send requests to privacy@luunhealth.com. Requests may be coordinated with the treating provider or pharmacy that maintains the record. You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights; we will not retaliate for filing a complaint.

Breach notification

If a breach of unsecured PHI occurs, affected individuals will be notified as required by HIPAA and applicable state law, without unreasonable delay.

Privacy contact

For questions, to exercise any right described on this page, or to report a privacy concern, email privacy@luunhealth.com.