Privacy Policy

Overview

This policy applies to all information collected through our website and any related services, sales, marketing, or events. Please read it carefully. If you disagree with its terms, please discontinue use of our site.

Pompton Labs is a telehealth platform. Clinical services are provided by licensed physicians through an affiliated professional medical corporation. Health information collected in the context of clinical services may be subject to additional protections under HIPAA, described in Section 5 below.

Information We Collect

We collect information you provide directly to us, information collected automatically when you use our services, and information from third parties.

Information you provide directly:

• Email address when you join our waitlist
• Name, date of birth, and contact information when you create an account or complete an intake form
• Health history, current medications, symptoms, and other medical information you provide during the clinical intake process
• Payment information (processed by a third-party payment processor; we do not store full payment card details)
• Communications you send us, including support inquiries

Information collected automatically:

• Log data including your IP address, browser type, pages visited, and time spent on pages
• Device information including hardware model, operating system, and unique device identifiers
• Cookie and tracking data as described in Section 8

How We Use Information

We use the information we collect to:

• Operate and improve our website and services
• Communicate with you about your waitlist position, account, or services
• Facilitate your connection with licensed physicians for clinical evaluation and treatment
• Send you updates, educational content, and service announcements (you may opt out at any time)
• Process payments and fulfill orders
• Comply with legal obligations
• Detect and prevent fraud, abuse, or other harmful activity
• Analyze usage patterns to improve our platform

We will not use your information to make automated decisions that significantly affect you without human review.

How We Share Information

We do not sell your personal information. We do not share your information with advertisers or data brokers. We share information only in the following circumstances:

• Service providers: We share information with vendors who assist us in operating our platform, including email service providers, payment processors, and analytics tools. These vendors are contractually prohibited from using your information for any purpose other than providing services to us.
• Affiliated medical practice: We share clinical information with the affiliated professional medical corporation and its licensed physicians to facilitate your care. This sharing is governed by our HIPAA obligations.
• Compounding pharmacies: We share prescription information with licensed, PCAB-accredited compounding pharmacies to fulfill your physician's prescription.
• Legal requirements: We may disclose information if required by law, subpoena, or other legal process, or if we believe disclosure is necessary to protect rights, property, or safety.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.

HIPAA & Health Information

To the extent that Pompton Labs or its affiliated medical practice qualifies as a covered entity or business associate under the Health Insurance Portability and Accountability Act (HIPAA), your protected health information (PHI) will be handled in accordance with HIPAA's Privacy Rule and Security Rule.

Your PHI will be used and disclosed only as permitted by HIPAA — primarily for treatment, payment, and healthcare operations. You have the right to:

• Access and obtain a copy of your health records
• Request corrections to your health records
• Receive an accounting of disclosures of your PHI
• Request restrictions on certain uses and disclosures
• Receive a Notice of Privacy Practices

To exercise any of these rights, contact us at the address listed in Section 12.

Data Retention

We retain your personal information for as long as necessary to provide our services and comply with our legal obligations. Specifically:

• Waitlist email addresses are retained until you unsubscribe or request deletion
• Account and clinical information is retained for a minimum of seven years following your last interaction with our platform, as required by applicable medical records laws
• Payment records are retained as required by applicable financial and tax laws

When information is no longer required, we delete or anonymize it in a manner that prevents recovery.

Your Rights

Depending on your state of residence, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your personal information, subject to legal retention requirements
• Opt-out: Opt out of marketing communications at any time by clicking "unsubscribe" in any email or contacting us directly
• Portability: Request a machine-readable copy of your personal information
• Non-discrimination: We will not discriminate against you for exercising any of these rights

California residents may have additional rights under the California Consumer Privacy Act (CCPA). To exercise any of these rights, contact us at [email protected].

Cookies & Tracking

We use cookies and similar tracking technologies to operate our website and understand how visitors interact with it. Specifically:

• Essential cookies: Required for the website to function. Cannot be disabled.
• Analytics cookies: Help us understand how visitors use our site. We use this data only in aggregate form.
• Marketing cookies: Used to deliver relevant communications. You may opt out by adjusting your browser settings or contacting us.

We do not sell data collected through cookies to third parties.

Security

We implement industry-standard technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit and at rest, access controls, and regular security assessments.

No method of transmission over the internet or method of electronic storage is 100% secure. While we use commercially reasonable means to protect your information, we cannot guarantee absolute security. In the event of a data breach affecting your rights and freedoms, we will notify you as required by applicable law.

Minors

Our services are intended for adults aged 18 and older. We do not knowingly collect personal information from individuals under 18. If we become aware that we have collected information from a minor without parental consent, we will delete that information promptly. If you believe we have inadvertently collected information from a minor, please contact us immediately.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (if you have provided one) and update the "Last updated" date at the top of this page. Your continued use of our services after any changes constitutes your acceptance of the updated policy.

We encourage you to review this policy periodically to stay informed about how we protect your information.

Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: