Privacy Policy

Introduction

This Privacy Policy (“Privacy Policy”) describes the data protection practices of Vivo Health LLC (“Vivo,” “we,” “our,” or “us”), including when you visit our website at https://www.vivoclinic.org/ or any Vivo subdomain (collectively, our “Websites”), or otherwise provide data to Vivo. We refer to the Websites and the other services provided by Vivo together in this Privacy Policy as the “Services.” This Privacy Policy is incorporated into our Terms of Service. All capitalized terms used in this Privacy Policy but not defined herein have the meanings assigned to them in the Terms of Service.

PLEASE READ THIS PRIVACY POLICY CAREFULLY TO UNDERSTAND HOW WE HANDLE YOUR INFORMATION. IF YOU DO NOT AGREE TO THIS PRIVACY POLICY, PLEASE DO NOT USE THE SERVICES.

Vivo is a technology and administrative services company. Vivo does not practice medicine and does not dispense medication. Clinical services are provided by Arora Health & Aesthetics, LLC (the “Medical Group”), an independent professional entity. Medication, where prescribed, is compounded and dispensed by VialsRX (the “Pharmacy”), an independent state-licensed 503A compounding pharmacy.

This distinction determines how your information is handled, so we state it plainly:

Where these overlap, the stricter rule applies. If information in our possession is PHI, we treat it as PHI regardless of how it reached us. Where anything in this Privacy Policy conflicts with the Notice of Privacy Practices as to PHI, the Notice of Privacy Practices governs.

This Privacy Policy contains the following sections:

• Protected Health Information and HIPAA
• The Information We Collect and the Sources of Such Information
• Purposes for How We Use Your Information
• Online Analytics and Advertising
• How We Share and Disclose Your Information
• Your Marketing Choices
• Third Party Services and Notice About Health Information
• How We Protect Your Information
• Retention of Your Information
• Privacy Information for California Residents
• Privacy Information for Nevada Residents
• Privacy Information for Residents of Other States
• Children
• Revisions to Our Privacy Policy
• Contacting Us

Protected Health Information and HIPAA

When you create an account with Vivo, you establish a direct customer relationship with Vivo. The information you provide for that purpose — your name, email address, shipping address, phone number, and transactional information — is not protected health information, and is handled under this Privacy Policy.

The clinical information you submit through an intake is different. Vivo is not a “covered entity” under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”). The Medical Group and the Pharmacy are covered entities. Vivo accesses your protected health information solely as a Business Associate of those entities, under a written Business Associate Agreement, and only to perform administrative services on their behalf.

The Medical Group has adopted a Notice of Privacy Practices describing how it uses and discloses protected health information and the rights you have with respect to it. By using the Services, you acknowledge receipt of the Notice of Privacy Practices. Requests concerning your medical record — including access, amendment, an accounting of disclosures, or restrictions — must be directed to the Medical Group’s Privacy Officer as described in that Notice. Vivo cannot fulfill a request for your medical record.

Vivo is not a HIPAA covered entity, but other laws apply to Vivo directly. These include California’s Confidentiality of Medical Information Act and the consumer health data laws of several states. See “Privacy Information for California Residents” and “Privacy Information for Residents of Other States” below.

The Information We Collect and the Sources of Such Information

We obtain information about you through the means discussed below when you use the Services. Please note that we need certain types of information so that we can provide the Services to you. If you do not provide us with such information, or ask us to delete it, you may no longer be able to access or use part or all of our Services.

1. Information You Provide to Us

We collect information that you provide directly to us, for example through:

• Account registration and administration of your account
• Processing your orders and requests for treatment
• Questions, communications, or feedback you submit to us via forms or email
• Your participation in surveys
• Requests for customer support
• Reviews, testimonials, or affiliate/creator applications you submit
• Employment applications you submit

The specific types of information we collect depend on the Services you use and the information you choose to provide. The types of data we collect directly from you include:

• Identity and contact information: name, shipping and billing address, telephone number, date of birth, and email address
• Account credentials: username and password (stored in hashed form), and your account preferences
• Payment information: processed by our third-party payment processor. We do not store full payment card numbers. We receive a payment token, the last four digits of your card, the card brand, and the expiration date.
• Transaction information: information about your purchases and subscription status
• Customer service information: the content of your support requests and correspondence with us
• Content you submit for publication: reviews, testimonials, and any images you choose to include with them
• Employment information: the contents of any application you submit
• Intake and clinical information: the health information you provide through an intake, which is routed to the Medical Group. This is protected health information. Vivo handles it only as a Business Associate, as described above, and does not use it for its own purposes.

We do not collect Social Security numbers, driver’s license or passport numbers, other government-issued identifiers, biometric identifiers, or information about your sex life or sexual orientation.

2. Information We Collect Through Automated Means

We collect certain information about your use of the Services and the device you use to access them.

Our Websites. When you use our Websites, we collect and analyze information such as your IP address, browser type and language, operating system, referring and exit pages and URLs, pages viewed and the order in which you viewed them, the amount of time spent on particular pages, interaction events, the date and time of your visit, and error logs.

Location information. We infer general location only — such as state, city, or postal code associated with your IP address. We use this because eligibility for the Services depends on the state in which you are physically located, and because sales tax depends on your address. We do not collect precise GPS location information, and we do not ask for it.

Cookies and similar tools. We use cookies and similar technologies to operate the Websites and collect the information described in this section. A cookie is a small text file placed on your device when you visit a site, which allows a web server to recognize your browser over time.

• Strictly necessary cookies enable authentication, security, and session management. These are always active.
• Analytics cookies are set by Google Analytics and Google Tag Manager, described in “Online Analytics and Advertising” below. These are non-essential and do not run unless you accept them.

We use advertising pixels only on our order-confirmation step, to record that a purchase was completed; this is described in “Online Analytics and Advertising” below. We do not use advertising or social-media pixels anywhere else on the Websites, and we do not use software development kits (SDKs) or mobile advertising identifiers. We do not operate a mobile application.

You can change your browser settings to notify you when a cookie is being set, or to block cookies altogether. Please consult the “Help” section of your browser for more information. Blocking strictly necessary cookies may prevent you from logging in to your account.

Email. Our email messages contain a small embedded image that tells us whether a message was opened and whether links in it were clicked. We use this to understand whether our communications are being received and are useful. You can prevent this by configuring your email client to block automatic image loading, which most email clients allow.

3. Information We Collect From Social Media and Other Content Platforms

If you “like,” follow, tag, or message us on a social media platform, we may receive your handle, your name, and any content you post that relates to us. We may also collect information you submit to us through a social media platform in connection with a promotion. We do not receive health information through social media, and we ask that you not send any.

4. Information We Receive From Other Sources

The Medical Group, the Pharmacy, our platform vendor, our payment processor, and shipping carriers may provide us with fulfillment status, order events, and administrative data in connection with the Services you have requested.

We do not purchase personal information from data brokers, and we do not receive information about you from advertising networks.

Purposes for How We Use Your Information

In connection with providing you with the Services, we use your information to:

• Create and administer your account, verify your identity, process your payments, and fulfill your orders.
• Coordinate the clinical and pharmacy services you request, and ensure the Medical Group and the Pharmacy have the administrative support necessary to provide them.
• Communicate with you about the Services — including order confirmations, shipping notifications, refill reminders, reassessment requests, and account status. These are transactional communications and cannot be opted out of while you have an active subscription.
• Send you marketing communications, including about products, offers, and events — only where you have opted in, and with an unsubscribe link in every message.
• Provide customer support and respond to your questions.
• Measure and improve the Services, in aggregate.
• Evaluate employment applications.
• Detect, prevent, and investigate fraud, abuse, and diversion, and keep the Services secure.
• Comply with legal obligations and establish, exercise, or defend legal claims.

We do not use protected health information for marketing. Marketing communications are sent based on your consumer relationship with Vivo and the preferences you have stated — not on your diagnosis, your intake answers, or your prescription record.

Aggregate/De-Identified Information. We may aggregate or de-identify information so that it can no longer reasonably be linked to you or your device, and use it to measure and improve the Services. We maintain de-identified information in de-identified form and do not attempt to re-identify it. We do not sell, license, or disclose de-identified information derived from health information to advertisers, data brokers, or advertising intermediaries. De-identification of protected health information is performed only in accordance with HIPAA and only as permitted by the applicable Business Associate Agreement.

Online Analytics and Advertising

1. Online Analytics

We use Google Analytics and Google Tag Manager to collect and analyze usage information through cookies and similar tools, in order to understand how the Websites perform and to improve them. These services may assign your browser or device a pseudonymous identifier. Google processes this information as described in Google’s own privacy policy and terms; you can learn how Google collects and uses information at www.google.com/policies/privacy/partners.

We do not use Google Signals, Google User-ID, cross-device identity resolution, or any other feature designed to link your activity across browsers or devices.

To prevent Google Analytics from using your information, you may:

• Decline non-essential cookies in our consent banner;
• Send a Global Privacy Control signal (see below);
• Install the Google Analytics Opt-out Browser Add-on; or
• Block or delete cookies in your browser settings.

2. Online Advertising

We advertise our services online. To understand which advertisements lead to a completed order, we use a deliberately narrow set of measurement technologies. We do not engage in interest-based or health-based advertising. Specifically:

• We use the Meta Pixel and Google Ads conversion tracking solely to record completed purchases. These technologies receive only the order total, the currency, and a randomly assigned order identifier.
• They do not run on our protocol pages, on the intake questionnaire, or on any page where health information is entered or displayed. They are configured to fire on one event — a completed order — and are blocked everywhere else.
• We do not send the name of any product, medication, or therapy to any advertising platform. An advertising platform can learn that an order was placed and what it cost. It does not learn what was ordered.
• We do not enable advanced matching, enhanced conversions, or any comparable feature that would transmit your name, email address, or telephone number to an advertising platform — including in hashed form.
• We do not sell your personal information.
• We do not share your personal information for cross-context behavioral advertising.
• We do not provide customer information to advertising platforms for matching, custom audiences, or look-alike modeling.
• We do not build advertising audiences or remarketing lists based on health information or health-related browsing activity.
• We never send information about your medical conditions, your intake responses, or your prescriptions to any advertising platform or data broker.

If these practices change, we will update this Privacy Policy with a revised “Last Updated” date before the change takes effect, and will obtain your consent where the law requires it. We will not begin a new practice and describe it afterward.

3. Notice Concerning Global Privacy Control and Do Not Track

Global Privacy Control (“GPC”). Some browsers and browser extensions support GPC, which sends a signal indicating your choice to opt out of certain data processing, including sale and sharing. We honor GPC and other recognized opt-out preference signals as valid opt-out requests. Because we do not sell or share personal information, GPC does not change our practices — we honor it regardless.

Do Not Track (“DNT”). DNT is a privacy preference available in certain browsers. Unlike GPC, there is no common understanding of how a DNT signal should be interpreted and no legal standard defining a response to it. We therefore do not respond to browser-initiated DNT signals. We instead provide the controls described above — our consent banner, GPC, browser cookie controls, and the Google Analytics Opt-out Browser Add-on — each of which we do honor.

How We Share and Disclose Your Information

We share your information in the following ways:

Arora Health & Aesthetics, LLC (the Medical Group). To route your intake for clinical review and to support the clinical services you request.

The Pharmacy. To fulfill a prescription issued by a clinician.

Bask Health (platform vendor). Telehealth and pharmacy infrastructure. Bound by a Business Associate Agreement.

Stripe (payment processor). To process transactions. Stripe’s handling of your information is governed by its own privacy policy, available at stripe.com/privacy.

Google (analytics). Usage and device data collected through Google Analytics and Google Tag Manager, to measure and improve the Websites. Google does not receive your intake responses, prescription record, purchases, or the content of any clinical communication.

Shipping carriers. To deliver your order.

Email and customer relationship platform. To send transactional and opted-in marketing messages. Bound by a Business Associate Agreement where applicable, and configured to exclude protected health information.

Professional advisors. Counsel, accountants, and auditors, under confidentiality obligations.

Protection of Vivo and Others. We may access, retain, and disclose information about you where we believe it is reasonably necessary to: (a) comply with legal process such as a subpoena or court order; (b) enforce our Terms of Service, this Privacy Policy, or another contract with you, including investigating potential violations; (c) respond to your requests for customer service; or (d) protect the rights, property, or personal safety of Vivo, its users, or the public, including preventing fraud or serious harm.

Business Transfers. In connection with a merger, acquisition, financing, or sale of assets, your information may be among the transferred assets, subject to this Privacy Policy or a successor policy with equivalent protections. Where applicable law imposes additional restrictions on the transfer of health data, we will comply with those restrictions.

Reviews and Content Submitted for Publication. If you submit a review or testimonial for publication, it is not confidential, and we may display it publicly along with any name you provide. Please do not include health information you do not want made public.

At Your Direction. We may disclose your information in other ways you direct us to, or where you have consented.

Any service provider that receives protected health information on our behalf does so under a Business Associate Agreement, as HIPAA requires. Advertising and analytics providers never receive protected health information.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

Your Marketing Choices

You may instruct us not to contact you by email, text message, or phone regarding products, services, promotions, and events by emailing us at care@vivoclinic.org, by using the unsubscribe link at the bottom of any marketing email, or by replying STOP to any marketing text message.

Please note that, regardless of your request, you may not opt out of transactional communications — such as order confirmations, shipping notifications, prescription and reassessment notices, and account status messages — while you have an active subscription. These are part of the Services. To stop them, cancel your subscription.

Third Party Services and Notice About Health Information

This Privacy Policy does not address, and we are not responsible for, the privacy, information, or security practices of any third party — including the Medical Group, its clinicians, the Pharmacy, the manufacturer of your device, or any third-party website or service to which the Services may link. These third parties may gather information from or about you. We have no control over their privacy practices, and their collection, use, and disclosure of your information is subject to their own privacy policies and not this one. We urge you to read them.

For protected health information held by the Medical Group or the Pharmacy, see the Notice of Privacy Practices.

How We Protect Your Information

Vivo maintains administrative, technical, and physical safeguards designed to protect your information against accidental or unlawful destruction, accidental loss, alteration, and unauthorized disclosure or access. These include encryption of information in transit and at rest, role-based access controls, multi-factor authentication on administrative accounts, credential management through a password manager, vendor due diligence, and logging.

However, no method of transmission over the Internet, and no means of electronic or physical storage, is absolutely secure. You acknowledge and accept that we cannot guarantee the security of information transmitted to, through, or on the Services, and that any such transmission is at your own risk.

Email and text messages are not encrypted. If you choose to send or receive health information by email or text message, you do so at your own risk. For anything sensitive, use the secure messaging function inside your account.

You are responsible for keeping your password confidential and for all activity under your account. Please do not share your password with anyone. Anyone with access to your device may be able to access your account. Notify us immediately at care@vivoclinic.org if you believe your account has been compromised.

We maintain an incident response process and will notify affected individuals and regulators as required by law.

Retention of Your Information

We keep your information for no longer than necessary for the purposes for which it is processed, and thereafter as required by law. The period depends on the category of information:

Medical records and prescription records are retained by the Medical Group and the Pharmacy under their own state-law retention schedules — typically a minimum of seven to ten years — and are not deleted at Vivo’s discretion. Deletion of your Vivo account does not delete your medical record.

Privacy Information for California Residents

If you are a California resident, California law requires us to provide you with additional information about how we collect, use, and share your “personal information” as defined in the California Consumer Privacy Act (“CCPA”). This section also serves as our notice at collection.

Categories of personal information we collect and disclose

Please note that some of the information collected through the Services — including protected health information — is subject to HIPAA and other health data privacy laws, and is therefore not subject to the CCPA. The chart below covers only CCPA-governed personal information.

The business purposes for which we use this information are described in “Purposes for How We Use Your Information” above. Retention periods are described in “Retention of Your Information” above.

We do not sell any category of personal information listed above, and we do not share any category for cross-context behavioral advertising.

Your California privacy rights

The CCPA allows you to request that we:

• Inform you about the categories of personal information we collect or disclose about you; the categories of sources of that information; the business or commercial purpose for collecting it; and the categories of third parties to whom we disclose it.
• Provide access to and/or a copy of the personal information we hold about you, in a portable format.
• Delete personal information we have about you, subject to exceptions.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of your personal information. We do neither.
• Limit the use and disclosure of sensitive personal information. We use sensitive personal information only to provide the Services you have requested and for purposes the CCPA permits without a limitation mechanism; you may nonetheless submit a request.

The CCPA further provides you with the right not to be discriminated against for exercising your rights.

Confidentiality of Medical Information Act (CMIA)

California law may treat Vivo as a provider of health care with respect to medical information, independently of HIPAA, because we offer software designed to maintain medical information for consumers. Where CMIA applies:

• We will not disclose your medical information without your written authorization, except as CMIA permits or requires;
• We will not use or disclose your medical information for marketing purposes without your authorization; and
• We will not sell your medical information.

These protections are in addition to — not instead of — the HIPAA protections described in the Notice of Privacy Practices.

Exercising your rights

If you are a California resident and would like to exercise any of your rights, email us at care@vivoclinic.org. Please include your full name and the email address associated with your use of the Services, along with the rights you would like to exercise.

We will verify your identity to the degree of certainty required by law before responding — typically by confirming that the request comes from the email address on your account. We will respond within 45 days, extendable by an additional 45 days with notice to you.

Authorized agents. You may designate an authorized agent, in writing or through a power of attorney, to make a request on your behalf. We will require the agent to provide proof of authorization, and we may need to verify your identity directly with you.

When we may decline. To the extent permitted by law, we may decline a request where granting it would be prohibited by law, would adversely affect the privacy or other rights of another person, would reveal a trade secret or confidential information, or would interfere with a legal obligation requiring retention; where we cannot authenticate you as the person to whom the information relates; or where the request is unreasonable or excessive. If we decline, we will tell you why.

Important limit — medical records. Protected health information held by the Medical Group or the Pharmacy, and information Vivo holds as their Business Associate, is exempt from the CCPA and governed instead by HIPAA. Direct those requests to the Medical Group’s Privacy Officer as described in the Notice of Privacy Practices. Vivo cannot fulfill a request for your medical record, and will not transmit medical records by unencrypted email.

Shine the Light Disclosure

The California “Shine the Light” law (Cal. Civ. Code § 1798.83) gives California residents the right, under certain circumstances, to request information from us regarding the manner in which we share certain categories of personal information with third parties for those third parties’ own direct marketing purposes. We do not share your personal information with third parties for their own direct marketing purposes.

Privacy Information for Nevada Residents

Under Nevada law (NRS 603A), certain Nevada consumers may opt out of the sale of “personally identifiable information” for monetary consideration to a person for that person to license or sell such information to additional persons. We do not engage in such activity. However, if you are a Nevada resident who has purchased services from us, you may submit a request to opt out of any potential future sale by emailing care@vivoclinic.org. We will take reasonable steps to verify your identity and the authenticity of the request, and once verified, we will maintain your request in the event our practices change.

Nevada’s SB 370 imposes additional consent and disclosure requirements on consumer health data. We honor those requirements through the same channel.

Privacy Information for Residents of Other States

Residents of other states with comprehensive consumer privacy laws — including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, and Washington — have comparable rights of access, correction, deletion, portability, and opt-out.

Washington’s My Health My Data Act imposes additional consent, disclosure, and authorization requirements on consumer health data, and provides a private right of action. Several states — including New York, Texas, Florida, Illinois, and Massachusetts — provide heightened protection for specific categories of health information, such as mental health records, HIV-related information, genetic testing results, and substance use treatment records. Where those protections apply to information held by the Medical Group or the Pharmacy, they are addressed in the Notice of Privacy Practices.

If you are a resident of any state with a comprehensive consumer privacy or consumer health data law, you may exercise the rights that law provides by emailing care@vivoclinic.org, whether or not your state is named above. We will honor those rights through the same process described in the California section.

Children

The Services are intended only for individuals 18 years of age or older. The Services are not directed to, and are not designed to attract, anyone under 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will stop using it and delete it, except where the law requires retention or where it is maintained as part of a medical record by the Medical Group or the Pharmacy. If you believe someone under 18 has provided us with information, contact us at care@vivoclinic.org.

Revisions to Our Privacy Policy

We reserve the right to change this Privacy Policy to reflect changes in the law, in our data collection and use practices, in the features of our Services, or in technology. We will make the revised Privacy Policy accessible through the Services, and the date it was last revised is identified at the top of this document.

If we make a material change, we will provide you with appropriate notice in accordance with legal requirements. Where a change would materially expand how we use information we have already collected, we will obtain your consent where the law requires it. We will not apply a new practice retroactively to information you provided under a different commitment, and we will not begin a new practice and describe it afterward.

Your continued use of the Services after such amendments and notice will be deemed your acknowledgment of the changes to this Privacy Policy.

Contacting Us

If you have any questions about this Privacy Policy or Vivo’s privacy practices, please contact us at:

Vivo Health LLC
721 East Broadway, Suite A
Glendale, CA 91205
United States

care@vivoclinic.org
+1 (762) 327-2774

For questions about protected health information, contact the Medical Group’s Privacy Officer as described in the Notice of Privacy Practices.