Privacy Policy

This Privacy Policy describes how ONLY YOU HEALTH LLC (the "Company," "we," "us") collects, uses, and protects personal information on the onlyyou.health website, the only you mobile applications, and related services (the "Platform"). Two companion documents govern specific categories: once care begins, your clinical information is protected health information governed by the Notice of Privacy Practices of WINTERS MEDICINE PLLC; and health-related information you provide before or outside of care is additionally covered by our Consumer Health Data Privacy Notice. The Consumer Health Data Privacy Notice is linked in the site footer; the Notice of Privacy Practices is provided when care begins.

1. What we collect

• Contact and account information: name, email address, phone number if you provide one, state of residence, account credentials, and your communications with us.
• Intake and health information: the answers you give in an intake or quiz, health history you share, and identification you upload. Once a clinician's review begins, this information is handled as protected health information under the Notice of Privacy Practices.
• Order and payment information: your orders, plan, and payment confirmations. Card numbers are collected and stored by our payment processor (Stripe), not by us.
• Technical information: device and browser type, IP address, and usage measurements we collect ourselves to operate and secure the Platform; no analytics company receives them.
• App information (when you use the only you mobile app): the device model and operating-system version, an identifier for your device or app installation, the app version, and, if you turn notifications on, the token that lets us send them to your device; and crash and error reports, which we collect ourselves and which contain no intake answers or clinical content.

2. What we do NOT do

• We do not sell personal information, and we have not sold it in the preceding twelve (12) months.
• We never sell sensitive personal information, including health, biometric, genetic, precise location, and immigration status data. This is unconditional: we would not sell it even if you told us we could, and we will never ask.
• We do not share personal information for targeted advertising.
• We use no third-party advertising trackers or pixels on the Platform.
• Health information is never used for marketing without your explicit written authorization, and we do not seek such authorization today.
• The weekly letters require only an email address, and unsubscribing always works.

3. How we use information

To provide the services you request (routing your intake to the Medical Group, processing approved orders, delivery, support); to operate, secure, and improve the Platform; to send transactional communications about your care and account; to send optional marketing you can always decline; to comply with law; and to establish or defend legal claims. We use information for the purposes described here and for no others without telling you first.

Sensitive information, including health information, gets a stricter rule. We collect and process it only with your consent, which you give by the clear, affirmative act of choosing to submit it (for example, by completing an intake or a quiz), and only where it is strictly necessary to provide or maintain the specific product or service you requested. We do not process sensitive information for any other purpose, and we never treat consent as permission to go beyond that limit. You may withdraw your consent at any time by emailing hello@onlyyou.health; we will stop the processing as soon as practicable and in no case later than fifteen (15) days after receiving your request. Once care has begun, your clinical record is governed by the Notice of Privacy Practices and is retained as medical-records law requires.

4. Who sees information

• The Medical Group and its licensed clinicians see your intake and records to evaluate and provide care.
• Licensed pharmacies see your prescription and shipping information to fill and deliver it.
• Service providers see only what their function requires, under written contracts limiting use. We use, or may use, the kinds of providers a company like ours depends on: hosting and infrastructure (such as Vercel and Amazon Web Services, whose first-party page counter is the only measurement on this site), email delivery (such as Resend, which sends the letters, and Amazon Simple Email Service), the waitlist mirror (LaunchList), mail forwarding for hello@onlyyou.health (ImprovMX), and payment processing (Stripe) when the service opens. The current list is available on request.
• Legal: we disclose information if required by law, subpoena, or court order, or to protect the rights, safety, or property of our users or others; and, where the law allows, we will tell you before we do.
• Business transfers: if the Company is involved in a merger or sale, information may transfer subject to this Policy's promises.

5. Cookies and analytics

We use the minimum necessary cookies to keep the Platform working (session, security, preferences) and measurement we collect ourselves to understand what pages help. We do not use third-party advertising cookies. Because we do not sell or share personal information for targeted advertising, there is nothing to opt out of, and we honor universal opt-out signals such as Global Privacy Control regardless, as required in a growing number of states, and we treat a browser's Do Not Track signal the same way.

6. Your rights and choices

Depending on your state, you may have rights to access, correct, delete, and obtain a portable copy of your personal information, and to opt out of sales, targeted advertising, and profiling (activities we do not engage in). We honor these rights for everyone, regardless of which state you write from. To exercise them, email hello@onlyyou.health; we will verify your identity and respond within the time your state's law requires (and in any case within 45 days). If we decline a request, we will explain why, and you may appeal by replying to our decision; we will answer your appeal within the period your state's law requires and tell you how to contact your state Attorney General if you remain unsatisfied. Deletion is subject to records we are legally required to keep (for example, medical records retained under the Medical Group's obligations and pharmacy records).

7. Retention

We keep personal information only as long as needed for the purposes above, and then delete or de-identify it, except where longer retention is required by law (medical-record, pharmacy, tax, and consent-record retention rules). A quiz you take without giving an email address is not stored once your session ends; quiz answers tied to an email address, and an intake you begin but do not submit, are kept for twelve (12) months from your last interaction with us and are then deleted or de-identified.

8. Security

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including encryption in transit and at rest, role-based access controls, multi-factor authentication for staff, and audit logging. No system is perfectly secure; if a breach of unsecured information affects you, we will notify you as the law requires.

9. Children

The Platform is for adults eighteen (18) and older. We do not knowingly collect information from anyone under eighteen; if we learn we have, we delete it.

10. Changes

If this Policy changes materially, we will notify you before the change takes effect, by email or prominent notice on the Platform. The current version and effective date are always posted here.

11. Contact

Privacy questions and requests: hello@onlyyou.health · ONLY YOU HEALTH LLC · 515 Madison Avenue, Suite 8092, New York, NY 10022