Privacy Policy – Simple Pro Rx

Last updated: October 19, 2026

SimpleProRx and its affiliated Simple brands (“SimpleProRx”, “we”, “our”, or “us”) respect your privacy and are committed to protecting it. This Privacy Policy (“Policy”) describes how we collect, use, retain, and disclose personal data about you when you use our website at simpleprorx.com, our mobile applications, and the related telehealth services that link to this Policy (collectively, our “Services”).

This Policy applies to information we collect:

Through the Services;
In communications between you and the Services, including email, text/SMS, secure messaging, chat, and video visits; and
When you interact with our content or advertising on third-party sites that link to this Policy.

This Policy does not apply to:

Information governed by our separate Notice of Privacy Practices (“NPP”), which describes how we handle protected health information (“PHI”) as a HIPAA covered entity. Where PHI is involved, the NPP controls and this Policy is supplemental. See our Notice of Privacy Practices at https://simpleprorx.com/hipaa/.
Information collected by any third party (including independent pharmacies or laboratories) that maintains its own privacy practices; or
Information collected offline or on any site or service that does not link to this Policy.

Please read this Policy carefully. By using the Services or providing your information, you agree to the collection, use, and disclosure of your information as described here. This Policy may change from time to time (see Changes to This Policy).

1. Where We Provide Services

SimpleProRx provides telehealth services to patients located in all 50 U.S. states: Alabama, Alaska, Arizona, Arkansas, California, Colorado, Connecticut, Delaware, Florida, Georgia, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Texas, Utah, Vermont, Virginia, Washington, West Virginia, Wisconsin, and Wyoming. Care is available only where our providers are licensed and where you are located at the time of your visit.

2. Children’s and Minors’ Data

Our Services are intended for users 18 years of age and older. We do not knowingly collect personal data from a child under 18 without the involvement of a parent or legal guardian. If we learn we have collected such data without the required consent, we will delete it.

3. The Personal Data We Collect

“Personal data” is information that identifies, relates to, or could reasonably be linked to you. The categories we collect or process include:

Account and contact information — name, date of birth, mailing address, email address, phone number, username, and account credentials.
Identity and eligibility information — government ID or driver’s license number (for identity verification), and, where applicable, insurance member ID and payer information.
Health and clinical information — reason for visit, symptoms, medical and medication history, allergies, vitals and self-reported measurements, provider notes, diagnoses, prescriptions, lab or diagnostic results, appointment history, and messages exchanged with providers. Most of this is PHI governed primarily by our Notice of Privacy Practices; see Section 4.
Payment information — payment card or bank information, billing address, and transaction history (processed by our third-party payment processor).
Communications — the content of your messages, chats, emails, and video-visit recordings, where lawfully recorded with notice and any required consent.
Device and technical information — IP address, device identifiers, operating system, browser type and settings, and preferred language.
Usage information — pages viewed, features used, clickstream data, dates and times of access, and referring and exit pages.

We also derive aggregated or de-identified data that does not identify you. If we combine de-identified or technical data with personal data so that it identifies you, we treat the combined data as personal data.

Sensitive data. Some of the above — including health information, government ID numbers, and insurance information — is treated as sensitive personal data under HIPAA and applicable state law. Where required, we collect and process sensitive data only with your consent, and we do not use it for purposes beyond those disclosed here or in the NPP.

4. How We Handle Health Information — Protected Health Information Under HIPAA

SimpleProRx is a covered entity under the Health Insurance Portability and Accountability Act (“HIPAA”). Our use and disclosure of your protected health information (“PHI”) is governed by HIPAA and described on this page. In general, we may use and disclose PHI without your authorization for treatment, payment, and health care operations, and for other purposes permitted or required by law; most other uses and disclosures require your written authorization, which you may revoke. If PHI held by us is subject to a breach, we will notify affected individuals, and where required the media and the U.S. Department of Health and Human Services, as required by the HIPAA Breach Notification Rule. To the extent this Policy and the NPP conflict as to PHI, the NPP controls.

Because your clinical information is generally protected as PHI under HIPAA, it is largely exempt from state consumer-privacy statutes. The state privacy rights described in Section 9 apply principally to non-PHI data we collect through the website (such as account, device, and usage information).

5. How We Use Your Information

We use the information we collect to:

Provide, operate, and maintain the Services, including scheduling, facilitating, and documenting telehealth visits and connecting you with providers in Stealth Health LLC, a DE Company’s provider network;
Verify your identity and eligibility, and process insurance (where applicable) and payments;
Communicate with you about appointments, prescriptions, results, account matters, and service updates;
Provide customer and technical support;
Improve, personalize, and secure the Services, including analytics, quality assurance, and fraud prevention;
Comply with legal, regulatory, licensing, accreditation, and recordkeeping obligations;
Send you administrative and, where you have not opted out, promotional communications about our own Services (we do not use PHI for marketing without any authorization required by law); and
Fulfill any other purpose disclosed at collection or with your consent.

Automated decision-making / AI. We do not use your personal data to make legal or similarly significant decisions about you through solely automated means, and we do not sell your data or use your health data to train third-party large language models. Where we use tools such as transcription or decision-support technology to assist our providers and staff, a licensed provider remains responsible for all clinical decisions.

6. How We Collect Information

Directly from you — when you create an account, complete intake forms, communicate with providers or support, or make a payment.
Automatically — through cookies, web beacons, pixels, and similar technologies as you use the Services (see Section 8).
From third parties — pharmacies, laboratories, insurers or payers (where applicable), identity-verification vendors, and service providers acting on our behalf.

7. How and With Whom We Disclose Information

We may disclose your information:

To providers in Stealth Health LLC, a DE Company’s provider network who deliver your care, and to Stealth Health LLC, a DE Company’s Pharmacy Network to fill and deliver any prescription your provider issues.
To service providers and contractors who perform functions on our behalf (such as hosting, secure video, payment processing, identity verification, analytics, and communications) under contracts that limit their use of the information. Those that handle PHI do so under HIPAA Business Associate Agreements.
To laboratories and insurers or payers as needed to provide and bill for the Services.
For legal and safety reasons — to comply with law, legal process, or government or regulatory requests; to enforce our terms; and to protect the rights, property, or safety of you, SimpleProRx, or others.
In a business transfer — to a successor in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to applicable law and, for health data, any required consent.
With your consent or authorization, or as otherwise disclosed at the point of collection.
Aggregated or de-identified data — without restriction.

We do not sell your personal data, and we do not share it for cross-context behavioral advertising.

8. Cookies and Tracking Technologies

We use cookies, web beacons, pixels, and similar technologies to operate the Services, remember your preferences, and measure usage. You can control cookies through your browser or device settings; disabling them may affect Service functionality.

Global Privacy Control. Where required by law, our Services treat a Global Privacy Control (“GPC”) signal as a valid opt-out request. Because there is no common standard for Do Not Track browser signals, we do not currently respond to them; you can instead use the cookie controls described above.

We do not permit third-party advertising trackers that would transmit your health information to third parties for their own advertising purposes.

9. Your Privacy Rights and Choices

Depending on where you live, you may have some or all of the following rights regarding non-PHI personal data:

Access / know what personal data we process and obtain a copy in a portable format;
Correct inaccuracies in your personal data;
Delete personal data we maintain, subject to legal exceptions;
Opt out of the sale or sharing of personal data, targeted advertising, and certain profiling (note: we do not sell or share personal data);
Limit the use and disclosure of sensitive personal data;
Appeal a denial of a rights request; and
Non-discrimination for exercising these rights.

The exact rights, thresholds, and response timelines vary by state (for example, under the California Consumer Privacy Act and the Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and other state privacy acts). For PHI, HIPAA’s separate access, amendment, accounting-of-disclosures, and restriction rights apply and are described in our Notice of Privacy Practices.

To exercise these rights, email [email protected]. We will verify your request and respond within the period required by applicable law. An authorized agent may submit a request on your behalf with proof of authorization.

10. How We Protect Your Information

We maintain administrative, physical, and technical safeguards designed to protect your information against unauthorized access, use, alteration, and disclosure, consistent with the HIPAA Security Rule for electronic PHI. No system is completely secure, and we cannot guarantee absolute security. Communications sent through non-secure channels (such as ordinary email or text) may not be protected; please use our secure patient portal for health information.

11. How Long We Keep Your Information

We retain personal data for as long as reasonably necessary to provide the Services, comply with our legal, professional, and recordkeeping obligations, resolve disputes, and enforce our agreements. Medical records are retained for the period required by the medical-record-retention laws of each state in which we provide care. When no longer required, we delete, destroy, or de-identify the data.

12. Changes to This Policy

We may update this Policy from time to time and will post the updated version with a new “Last updated” date. We will provide additional notice of material changes as required by law. Your continued use of the Services after an update signifies acceptance of the revised Policy.

13. Contact Us

To exercise your rights, ask questions, or make a complaint about this Policy or our privacy practices, contact our Privacy Officer:

SimpleProRx and its affiliated Simple brands — Attn: Privacy Officer Email: [email protected]

To file a HIPAA-related complaint, you may also contact the U.S. Department of Health and Human Services, Office for Civil Rights.