Privacy Policy

Who We Are, and Who We Are Not

This Privacy Policy explains how Living Plus Rx LLC, a Wyoming limited liability company ("Living Plus," "we," "us," or "our"), collects, uses, shares, and protects information when you visit livingplusrx.com or use the services offered through it (the "Platform").

Living Plus is a technology and administrative services company. Living Plus does not practice medicine, does not diagnose, does not prescribe, and does not dispense medication. Medical services are provided by independently licensed healthcare providers practicing through their own professional entities, and medications are dispensed by independently licensed pharmacies.

By using the Platform, you agree to this Privacy Policy. If you do not agree, please do not use the Platform.

Scope of This Policy

Two different sets of privacy rules apply to the information involved in your care, and it matters which one covers what.

Where Living Plus handles protected health information on behalf of a provider, we do so as a business associate under HIPAA and under a written business associate agreement that limits how we may use that information.

Information We Collect

Information you give us. Your name, email address, phone number, date of birth, shipping and billing address, and account credentials. When you contact support, we keep a record of that correspondence.

Payment information. Card payments are processed by Stripe, Inc., a PCI-DSS Level 1 certified third-party processor. Your card details are transmitted directly to Stripe and are never received or stored on our systems. We retain only the last four digits, card brand, and expiration date for billing support and fraud prevention. Stripe handles your payment information under its own privacy policy, available at stripe.com/privacy.

Information collected automatically. When you visit the Platform we collect your IP address, device and browser type, operating system, referring page, pages viewed, time spent, and interactions with the site. See Section 7 for how this is used.

Information from others. We may receive information from your treating provider, the dispensing pharmacy, our clinical platform partner, shipping carriers, and fraud-prevention vendors, for example, that a prescription was filled or a package was delivered.

Who Holds Your Medical Record

Your clinical record, intake responses, provider notes, diagnoses, prescriptions, dosing history, lab results, and any photographs you submit, is created and maintained by your treating provider's professional entity, OpenLoop Healthcare Partners, PC, an independent medical practice, using OpenLoop’s HIPAA-compliant clinical platform. Living Plus does not maintain patient medical records and does not have a general right of access to them.

Living Plus personnel can see limited information necessary to run the business: your name and contact details, your account and subscription status, your billing history, your shipment status, and which program you are enrolled in.

Consumer Health Data

Several states regulate "consumer health data" more broadly than HIPAA does. Under these laws, information can count as health data even when it is not part of a medical record, including the fact that you visited pages about a particular treatment, searched for a condition, or signed up for a program.

Where these laws apply to you, we collect consumer health data only to provide the services you request, to communicate with you about your account and care, and to operate and secure the Platform. We do not sell consumer health data. We obtain your separate consent before collecting or sharing consumer health data for any purpose beyond providing the services you asked for, and you may withdraw that consent at any time by contacting us.

Residents of Washington and Nevada have specific rights described in Section 14.

How We Use Information

We use the information we collect to:

• Create and maintain your account, and verify your identity, age, and location;
• Connect you with a licensed provider and transmit information necessary for your evaluation;
• Process payments, manage subscriptions, and handle refunds and disputes;
• Coordinate fulfillment and shipping with the dispensing pharmacy;
• Provide customer support and respond to your questions;
• Send you account, billing, shipping, and care-related messages;
• Detect and prevent fraud, abuse, and security incidents;
• Understand how the Platform is used so we can improve it; and
• Comply with legal obligations and enforce our Terms of Service.

Tracking Technologies and Advertising

We use cookies and similar technologies on the Platform. Some are strictly necessary. They keep you logged in, remember your cart, and protect against fraud. Others help us understand how visitors use the site so we can improve it.

Analytics. We use Google Analytics 4 to measure site traffic and performance. Google Analytics is configured not to receive health information, and we do not send it identifiers that would allow Google to associate your visit with a treatment program. You can opt out of Google Analytics across all websites using Google's browser add-on.

Advertising. On our general marketing pages only, we use advertising technologies from Meta (Facebook and Instagram) and Google to measure how well our advertising works and to reach people who may be interested in our services. These technologies are not present on our intake forms, checkout pages, patient account areas, or any page where you communicate with a provider.

Where these technologies are used, they record that a visit or a general conversion event occurred. They do not receive your intake responses, your prescriptions, your treatment program, your health conditions, or any information identifying you as a patient. We do not create advertising audiences based on health information, and we do not permit Meta or Google to use any information they receive from us to build health-related profiles about you.

Your choices. You can block or delete cookies through your browser settings, though some features of the Platform may not work correctly if you do. Where required by law, we honor the Global Privacy Control (GPC) and similar browser signals as a request to opt out of the sale or sharing of your personal information. You can also adjust ad personalization directly in your Meta and Google account settings.

How We Share Information

With your treating provider. The information necessary for a provider to evaluate you and deliver care.

With dispensing pharmacies. Your prescription, name, contact details, and shipping address so that medication can be prepared and delivered. Pharmacies operate independently and handle your information under their own privacy obligations.

With service providers. Vendors who perform functions on our behalf, payment processing, hosting, clinical platform services, email and SMS delivery, customer support tooling, shipping, and fraud prevention. These vendors are contractually limited to using your information only to perform services for us, and where they handle protected health information they do so under a business associate agreement.

For legal reasons. When required by law, subpoena, court order, or regulatory authority; to investigate suspected fraud; or to protect the safety of any person. Disclosures of protected health information for these purposes follow HIPAA's requirements.

In a business transaction. If Living Plus is involved in a merger, acquisition, financing, or sale of assets, information may transfer to the successor entity, which will remain bound by commitments no less protective than those in this policy. We will notify you before your information becomes subject to a materially different policy.

With your direction. Any other sharing you specifically ask us to do.

What We Never Do

We may create and use de-identified and aggregated information, data that cannot reasonably be used to identify you, to analyze demand, improve our services, and report on business performance. We do not attempt to re-identify this information and we require the same of anyone we share it with.

Email and Text Messages

By providing your contact information you consent to receive account, billing, shipping, scheduling, and care-related messages by email, telephone, and SMS. You may opt out of marketing messages at any time by using the unsubscribe link or replying STOP.

Data Security

We use administrative, technical, and physical safeguards designed to protect your information, including encryption of data in transit and at rest, role-based access controls that limit staff access to what their job requires, multi-factor authentication on internal systems, logging and monitoring, and vendor security review.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affecting your information occurs, we will notify you and the appropriate authorities as required by HIPAA and applicable state breach notification laws.

Data Retention

We keep information only as long as we need it for the purposes described in this policy, and then delete or de-identify it.

• Account and contact information: for as long as your account is active, and for three (3) years after it closes.
• Billing and transaction records: for seven (7) years, to meet tax and accounting requirements.
• Support correspondence: for three (3) years.
• Website and analytics data: for fourteen (14) months.
• Medical records: retained by your treating provider under the record retention laws of the state where you were treated, typically between six and ten years. This is not within our control.

We may retain information longer where necessary to comply with a legal obligation, resolve a dispute, or enforce our agreements.

Your Privacy Rights

Depending on where you live, you may have the right to:

• Know what personal information we have collected about you and how we use and share it;
• Access a copy of that information in a portable format;
• Correct inaccurate information;
• Delete information we hold about you, subject to legal retention requirements;
• Opt out of the sale or sharing of your personal information and of targeted advertising;
• Limit our use of sensitive personal information; and
• Not be discriminated against for exercising any of these rights. We will not deny you service, charge you a different price, or provide a different quality of service because you exercised a privacy right.

To make a request, email support@livingplusrx.com. We will verify your identity before acting, which usually means confirming details already associated with your account. We respond within 45 days and may extend once where permitted by law. An authorized agent may submit a request on your behalf with written permission that we can verify.

If we deny your request, you may appeal by replying to our decision. We will respond to an appeal within 45 days and, if we deny it, will tell you how to contact your state attorney general.

State-Specific Rights

California. Under the CCPA as amended, California residents have the rights listed above. In the past twelve months we have collected the categories of information described in Section 3 and disclosed them for business purposes as described in Section 8. We do not sell personal information and we do not knowingly sell or share the personal information of anyone under 16. California residents may also request information about disclosures to third parties for direct marketing purposes under the "Shine the Light" law.

Washington and Nevada. Washington's My Health My Data Act and Nevada's consumer health data law give residents of those states the right to know what consumer health data we collect and share, to withdraw consent to its collection and sharing, and to have it deleted. Washington residents may enforce these rights directly. Requests go to the same address in Section 13.

Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws provide substantially similar rights, including access, correction, deletion, portability, and opting out of targeted advertising. Treatment information is sensitive data under most of these laws, and we process it only with your consent and only to provide the services you requested.

Everyone else. We extend the rights in Section 13 to all users regardless of where you live.

Requesting Your Medical Records

Because your clinical record is held by your treating provider rather than by Living Plus, requests to access, amend, or receive a copy of your medical record must go to your provider through the Platform's secure messaging. HIPAA gives you the right to obtain a copy of your record, generally within 30 days. If you have trouble reaching your provider, contact us and we will help route your request.

Children's Privacy

The Platform is intended only for adults 18 and over. We do not knowingly collect information from anyone under 18. If we learn that we have collected information from a minor, we will delete it promptly. If you believe a minor has provided us information, contact us at support@livingplusrx.com.

Third-Party Links

The Platform may link to websites we do not operate. This policy does not apply to them, and we are not responsible for their privacy practices. We encourage you to read the privacy policy of any site you visit.

Changes to This Policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date above. If we make a material change to how we use or share your information, we will notify you by email or through the Platform before the change takes effect, and where the law requires it, we will ask for your consent.

Contact Us

Questions about this policy, or about how your information is handled:

For access to your medical record, corrections to clinical information, or any request concerning protected health information, contact your treating provider through the Platform's secure messaging.