Privacy Policy

DRAFT — Pending Attorney Review. This document is a working draft based on standard HIPAA + telehealth practice. It must be reviewed and approved by qualified healthcare counsel before ReddyDoc accepts its first patient.

Last updated: July 4, 2026 · Effective date: [pending attorney sign-off]

1. Who we are

ReddyDoc (“ReddyDoc,” “we,” “our,” or “us“) operates the telehealth platform at reddydoc.com. We provide asynchronous online medical consultation, prescription review, and pharmacy fulfillment services in states where our clinicians are licensed.

This Privacy Policy explains how we collect, use, disclose, and protect information about you when you visit our website, complete a medical intake, or receive care through our platform. For information specifically about how we handle your protected health information under the Health Insurance Portability and Accountability Act (“HIPAA“), see our separate Notice of Privacy Practices.

2. Information we collect

2.1 Information you provide directly

Identity and contact information: name, email, phone number, date of birth, gender, mailing address, government-issued photo ID (for identity verification).
Medical information: symptoms, allergies, current medications, medical history, prior conditions, and answers to clinical questionnaires you complete during intake.
Payment information: credit or debit card details, billing address. Payment card details are processed by our PCI-compliant payment processor and are not stored on ReddyDoc servers in cleartext form.
Consent records: signed HIPAA authorization, telehealth informed consent, and treatment consent documents.
Communications: messages you send to our clinicians, care team, or support staff.

2.2 Information collected automatically

Device and browser information: IP address, browser type, operating system, referrer URL, pages visited, session duration.
Cookies and similar technologies: essential cookies for authentication and cart function; analytics cookies (only with your consent where required).
Delivery and order status: tracking information from carrier partners on prescriptions shipped to you.

2.3 Information from third parties

Identity verification: our verification partner (Persona or Stripe Identity) confirms the government ID you upload matches a real person.
Pharmacy dispensing records: our pharmacy partner reports lot number, expiration date, and shipment status.
Payment processor: transaction result codes and refund confirmations.

3. How we use your information

To provide medical consultation, review your questionnaire, write prescriptions, and coordinate pharmacy fulfillment.
To verify your identity, age, and state of residence.
To process payments, issue refunds, and prevent fraud.
To send transactional communications about your order (status updates, shipping notifications, prescription approvals or declines).
To send you appointment reminders, refill reminders, and follow-up messages (email always; SMS only if you have opted in).
To respond to your inquiries and provide customer support.
To comply with legal obligations, including HIPAA record retention (six years) and pharmacy regulations.
To improve the platform, subject to strict rules that prohibit use of identifiable protected health information for product analytics.

4. When we disclose your information

We only share your information with third parties who have signed a Business Associate Agreement (“BAA“) with us (where applicable) and only for the specific purposes below.

4.1 Service providers (subprocessors)

Electronic health record: Elation Health (patient chart, clinical documentation, prescription writing)
Pharmacy partner: [Truepill / Alto / Cabinet — pending selection] (prescription dispensing and fulfillment)
eRx (electronic prescribing): DoseSpot (Surescripts-certified transmission to pharmacies)
Identity verification: [Persona or Stripe Identity — pending selection]
E-signature: [Jotform HIPAA / Formstack / DocuSign HIPAA — pending selection] (consent form execution)
Shipping and tracking: ShipStation and delivery carriers (USPS, UPS, FedEx, DHL)
Customer relationship management: Zoho CRM (order operations and support)
Record retention: Zoho WorkDrive (encrypted long-term storage)
Analytics: Zoho Analytics (operational KPIs, no identifiable PHI)
Messaging: GoHighLevel and/or Klaviyo (transactional email and SMS)
Payment processing: Shopify Payments (or its designated processor)

A current list of subprocessors will be maintained at reddydoc.com/subprocessors. You may request the full list by emailing privacy@reddydoc.com.

4.2 Legal disclosures

We may disclose your information without your consent when required by law, including in response to a valid subpoena, court order, or as required for pharmacy regulations, public health reporting, or as permitted under HIPAA for treatment, payment, and healthcare operations.

4.3 What we do NOT do

We do not sell your personal information.
We do not share protected health information for marketing without your written authorization.
We do not use identifiable PHI for advertising or profile-building.

5. Your rights

Depending on where you live, you may have some or all of the following rights:

Access: request a copy of the personal information we hold about you.
Correction: request that we correct inaccurate information.
Deletion: request that we delete your information, subject to HIPAA record retention requirements (we must keep certain records for six years from the last date of service).
Opt-out of marketing: unsubscribe from marketing email or SMS at any time. Transactional communications about your care and orders will continue.
Portability: request an electronic copy of your medical records in a common format.
Complaint: file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights if you believe your rights under HIPAA have been violated.

To exercise any right, email privacy@reddydoc.com from the email address associated with your ReddyDoc account. We may need to verify your identity before completing your request.

6. Data retention

Medical records: retained for at least six years from the date of last treatment, per HIPAA.
Pharmacy records: retained per applicable state pharmacy law, typically five to seven years.
Account information: retained while your account is active. On account deletion request, retained only where required by law.
Marketing preferences and unsubscribe records: retained indefinitely as required to honor your opt-out.
Payment records: retained per tax and financial law (typically seven years).

7. Security

We use AES-256 encryption at rest for protected health information, TLS 1.2 or higher for data in transit, role-based access controls limiting PHI access to trained workforce members with a legitimate need, and a comprehensive audit log recording every access to and change of medical records. We follow the HIPAA Security Rule for administrative, physical, and technical safeguards. However, no method of transmission or storage is 100% secure. See our Notice of Privacy Practices for details on breach notification.

8. Children’s privacy

ReddyDoc is intended for use by adults 18 years of age and older. We do not knowingly collect personal information from anyone under 18. If we learn we have collected such information, we will delete it.

9. International users

ReddyDoc services are offered only in the United States, and only in states where our clinicians are licensed. If you access the platform from outside the United States, you do so at your own initiative and are responsible for compliance with local laws.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be posted here with a new “Last updated” date, and, where legally required, we will notify you by email in advance.

11. Contact us

Questions about this Privacy Policy? Contact us:

Email: privacy@reddydoc.com
Phone: +1 (888) 512-9213
Mail: ReddyDoc Privacy Office, [address pending]

Shopping cart