Consumer Health Data Privacy Notice

This notice explains how ONLY YOU HEALTH LLC (the "Company," "we," "us") collects, uses, and shares consumer health data: health-related information that is not covered by HIPAA, such as answers you give in a quiz or waitlist form before care begins, or general wellness information you share with us. Once a licensed clinician's review of your intake begins, your clinical information becomes protected health information governed instead by the Notice of Privacy Practices of WINTERS MEDICINE PLLC, which is provided when care begins.

1. The consumer health data we collect

• Health-related answers you choose to give in quizzes, waitlist forms, or messages before care begins (for example, wellness goals or symptoms you describe to us);
• The fact that you have sought or browsed information about particular health services;
• Your IP address, used only to operate and secure the site; we do not infer or track your location from it. The state you tell us is what determines service availability.

A quiz you take without giving an email address is not stored once your session ends; quiz answers tied to an email address are kept for twelve (12) months from your last interaction with us and are then deleted or de-identified.

Where it comes from (the categories of sources). Directly from you, in the forms, quizzes, waitlist sign-ups, and messages you choose to submit; automatically from your device and browser when you use the Platform (IP address and technical information); and, only when you choose to begin care, from the account and order records the Platform maintains so that your account works. We do not buy consumer health data, and we do not obtain it from data brokers, advertising networks, or any other third party.

2. Why we collect it

Solely to provide the products, services, and information you ask for: to answer your questions, to show you what fits, to route you into care when you choose it, and to send the letters you signed up for. We collect, use, and share consumer health data only where it is strictly necessary to provide or maintain the specific product or service you requested. We do not treat your consent as permission to go beyond that limit, and we do not ask you for consent to do so. Within that limit, we process your consumer health data only with your consent, the clear, affirmative act of choosing to submit it to us, which you may withdraw at any time (see §5); we stop the processing as soon as practicable and in no case later than fifteen (15) days after you ask.

3. What we never do with it

• We do not sell consumer health data. Not for a price, not for anything else of value, and not with your permission either: this is a flat rule we hold ourselves to, not a setting you can be talked into changing. We will never ask you to authorize a sale.
• We do not share it with third parties for advertising, and we use no third-party ad trackers, pixels, or SDKs on the Platform.
• We do not use it for profiling that produces legal or similarly significant effects.

4. Who can see it, and what each receives

We share consumer health data only with the following recipients, and only the data listed for each:

• Our own personnel who need it to serve you, under confidentiality obligations and role-based access controls: what is needed to serve you.
• Processors under contract, which may use it solely to perform their function for us: our hosting provider (Vercel), which serves the site and runs its page counter; our email-delivery provider (Resend), which receives your email address and the content of the messages we send you; our waitlist provider (LaunchList), which receives your email address; our mail forwarder (ImprovMX), which carries the messages you send to hello@onlyyou.health; and our payment processor (Stripe), which receives your order and payment information, never your health answers. The processors are named in our Privacy Policy, and you may request the current list at any time.
• The medical practice, WINTERS MEDICINE PLLC and its affiliated licensed clinicians, named specifically here so there is no ambiguity about who receives your information: your intake answers, health history, and state of location, and only when you choose to begin care.
• Recipients required by law: only what the law compels.

We share consumer health data with no other third party and with no affiliate, and never for advertising.

5. Your rights

You have the right to: know whether we collect, share, or sell consumer health data about you and to access it, including a list of all third parties and affiliates, if any, with whom it was shared or sold, and an active email address or other online way to contact each of them; withdraw consent; and delete your consumer health data. To exercise any right, email hello@onlyyou.health. We will verify your identity, respond within 45 days, and honor deletion including in backups within the additional time the law allows. If we decline a request, we will explain why and you may appeal by replying; if your appeal is denied you may contact your state Attorney General: for Washington, www.atg.wa.gov/file-complaint; for Nevada, ag.nv.gov/Complaints/File_Complaint; for Connecticut, www.dir.ct.gov/ag/complaint; for any other state, your state Attorney General's consumer complaint page.

6. Contact

Questions and requests: hello@onlyyou.health · ONLY YOU HEALTH LLC · 515 Madison Avenue, Suite 8092, New York, NY 10022