Notice of Privacy Practices

Who this notice covers

This notice applies to HAIRMDL® and the licensed physicians who review your medical questionnaire and, when appropriate, prescribe treatment through our telehealth service (together, “HAIRMDL,” “we,” or “us”). It covers the health information we create or receive about you through hairmdl.com, our medical intake, our physicians, and our customer support team.

We are required by law to keep your protected health information (“health information”) private, to give you this notice of our legal duties and privacy practices, to follow the terms of the notice currently in effect, and to tell you if a breach compromises the privacy or security of your health information.

The health information we hold

Depending on how you use our service, this can include:

• Your name, date of birth, email address, phone number, shipping address, and the state you live in.
• Your answers to our medical questionnaire, including hair-loss history, current medications and supplements, allergies, medical conditions, and any photos or notes you choose to provide.
• Your physician’s review notes, prescribing decisions, and messages between you and our clinical or support team.
• Prescription and dispensing records from the pharmacy that fills your order, and your order and shipment history.

How we may use and disclose your health information

The law allows us to use and share your health information for the following purposes without asking your permission each time.

• Treatment. Your questionnaire is reviewed by a physician licensed in your state. If treatment is prescribed, we send the prescription and the information the pharmacy needs to fill it to a licensed compounding pharmacy, which ships it to you. We may contact you about your treatment, refills, side effects, or follow-up questions.
• Payment. We use your information to process your order, bill your payment method, and manage your subscription. Payment is processed by our e-commerce and payment providers, who receive what they need to charge you and ship your order but do not receive your medical answers.
• Health care operations. We use your information to run and improve the service: quality review of prescribing decisions, training, auditing, customer support, security monitoring, and legal compliance.
• Business associates. We work with vendors that host our database, send transactional emails and texts, and provide customer support tools. They may only use your health information to do the work we hire them for and must protect it under a written agreement with us.
• Reminders and care information. We may send you refill reminders, usage instructions, and information about treatment options related to your care.
• As required by law. We will share information when federal, state, or local law requires it, including responses to valid court orders, subpoenas, and lawful requests from public health authorities, state medical and pharmacy boards, the FDA (for example, adverse-event reports), and health oversight agencies.
• To prevent serious harm. We may share information when necessary to prevent a serious and imminent threat to your health or safety or the safety of others.
• Other legally permitted purposes. These include law-enforcement requests that meet legal requirements, workers’ compensation, coroners and medical examiners, and certain research with appropriate safeguards.

Uses that require your written permission

We will not do any of the following without your written authorization:

• Use your health information for marketing purposes.
• Sell your health information.
• Share your medical answers, diagnosis, or prescription details with advertising or social-media platforms.
• Share your health information for any purpose not described in this notice.

If you give us an authorization, you may revoke it in writing at any time. The revocation stops future uses and disclosures but does not undo any we made while the authorization was in effect.

We do use website analytics and advertising tools on our public marketing pages. These tools are configured so that they do not receive your medical questionnaire answers, your identity, or anything that links the two. Our website Privacy Policy describes cookies and non-medical data in more detail.

Your rights

You have the following rights regarding your health information:

• Get a copy. You may ask for an electronic or paper copy of the health information we hold about you, including your questionnaire answers and prescription history. We will respond within 30 days and may charge a reasonable, cost-based fee.
• Ask us to correct it. If you believe information is wrong or incomplete, you may ask us to amend it. We may decline in certain cases and will tell you why in writing.
• Ask for confidential communications. You may ask us to contact you in a specific way or at a specific address. We will accommodate reasonable requests.
• Ask us to limit what we share. You may request restrictions on how we use or share your information for treatment, payment, or operations. We are not required to agree, except that we must honor a request not to share information with your health plan about a service you paid for in full out of pocket. Our service is cash-pay, so we do not bill health plans.
• Get a list of disclosures. You may request an accounting of certain disclosures we made in the six years before your request, other than those for treatment, payment, operations, or that you authorized.
• Get a copy of this notice. You may request a paper copy at any time even if you agreed to receive it electronically.
• Choose someone to act for you. A person with medical power of attorney or legal guardianship can exercise these rights on your behalf after we verify their authority.
• Ask us to delete your data. You may ask us to delete your account and questionnaire. We will do so except where law requires us to keep medical and prescription records, which we retain for the period required by the state in which you were treated and federal law.

To exercise any of these rights, email support@hairmdl.com or call (877) 424-7635. We may need to verify your identity before acting on a request.

How we protect your information

Your questionnaire and medical records are stored encrypted in a dedicated database separate from our online store. Access is limited to the physician reviewing your case, the pharmacy filling your prescription, and staff who need it to support you. Staff accounts use two-factor authentication, and access is logged. Payment information is handled by our payment processor and never stored by us.

Changes to this notice

We may change this notice and make the new terms effective for all health information we hold. The current notice is always posted at hairmdl.com with its effective date, and we will ask you to acknowledge material changes the next time you use our service.

Questions and complaints

If you have questions about this notice or believe your privacy rights have been violated, contact our Privacy Officer at support@hairmdl.com, (877) 424-7635, or by mail at HAIRMDL, Attn: Privacy Officer, 363 Grand Avenue, Englewood, NJ 07631.

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at 200 Independence Avenue S.W., Washington, D.C. 20201, by calling 1-877-696-6775, or online at hhs.gov/ocr/complaints. We will not retaliate against you for filing a complaint.

Our telehealth service is also governed by our Telehealth Informed Consent.