MadeMed Privacy Policy

1. Introduction

IDL Health LLC (d/b/a "MadeMed," "we," or "us") is committed to protecting the privacy of our users. This Privacy Policy explains how we collect, use, and disclose your information when you use our websites (e.g., https://www.mademed.com), mobile applications, and other online services (collectively, the "Services").

By accessing or using our Services, you are acknowledging the practices described in this Privacy Policy. We may update this policy when necessary to reflect changes in our Services or as required by applicable law. If we make material changes, we will notify you by updating the "Last Updated" date and, where required by law, obtain your consent.

This Privacy Policy applies to information collected by MadeMed. Clinical services are provided by the Medical Group, which maintains its own Notice of Privacy Practices governing its use and disclosure of PHI.

2. Our Legal Basis for Processing Your Information

We collect and use your information as permitted by applicable U.S. law and as necessary to provide and operate the Services. This includes:

• Performance of a Contract: To provide our Services, process orders, and manage your account.
• Your Consent: For activities such as sending marketing communications, where required.
• Compliance with Law: As necessary to comply with legal and regulatory obligations.

3. Protected Health Information (PHI)

When you set up an account with MadeMed, you create a direct customer relationship with us. As part of that relationship, you provide information to us, such as your name, email address, shipping address, and phone number, which we do not consider to be "Protected Health Information" (PHI).

However, in using certain components of the Service, you will provide health and medical information to the independent medical providers at Xpedicare, LLC (the "Medical Group"). Under the Health Insurance Portability and Accountability Act ("HIPAA"), the Medical Group is a "Covered Entity," and MadeMed is a "Business Associate" of the Medical Group.

It is important to note that HIPAA may not apply to all of your transactions or communications with MadeMed. To the extent we receive, create, or maintain PHI on behalf of the Medical Group, we are subject to HIPAA and will only use and disclose that PHI as permitted by law and our Business Associate Agreement with the Medical Group. Any information that does not constitute PHI may be used or disclosed as described in the rest of this Privacy Policy.

The Medical Group has its own Notice of Privacy Practices that describes how it uses and discloses your PHI. By using the Services, you acknowledge that you have received and reviewed the Medical Group's Notice of Privacy Practices.

4. Collection of Your Information

We collect your information in several ways, from different sources.

Information You Provide Directly to Us

We collect personal information you provide to us, for example:

• Contact & Demographic Information: Your name, email address, phone number, shipping address, and date of birth.
• Account Information: Your username, password, and other credentials used to access the Services.
• Payment Information: Your credit card number, financial account information, and other payment details needed to complete transactions.
• Content and Files: Photographs, videos, and documents you upload to the Service, as well as communications you send to us (e.g., for customer support).
• Health Information: Information about your medical history, symptoms, conditions, treatments, and other health-related data that you provide in questionnaires and consultations.

Information We Collect Automatically

When you use our Services, we collect some information automatically, for example:

• Identifiers and Device Information: Your Internet Protocol (IP) address, device identifiers (like a MAC address), device type, and your browser's operating system and version.
• Usage Data: We automatically log your activity on our Services, including the pages you viewed, how long you spent on a page, the URL of the website you came from, and other details about your actions on our site.
• Cookies and Similar Technologies: We use cookies, web beacons, and similar technologies to help our Services function, analyze performance, store your preferences, and deliver targeted advertising. You can control cookies through your browser settings.

Information We Obtain from Third-Party Sources

We may obtain information from third parties, for example:

• Service Providers: Third parties that provide data in connection with work they do on our behalf, such as identity verification services or data analytics providers.
• Publicly Available Sources: Public sources of information such as open government databases.

5. How We Use Your Information

We use the information we collect for the purposes described in this Privacy Policy. For example, we use your information for:

• Service Delivery: To provide, deliver, and personalize the Services, including creating and managing your account, facilitating consultations with the Medical Group, and fulfilling your orders.
• Business Operations: To operate our business, such as billing, accounting, improving our internal operations, securing our systems, and detecting fraudulent or illegal activity.
• Customer Support: To provide customer support and respond to your requests and questions.
• Communications: To send you information, including order confirmations, technical notices, security alerts, and administrative messages.
• Marketing and Advertising: To communicate with you about new services, offers, and promotions, and to measure the effectiveness of our advertising. We will not use your PHI for marketing without your express authorization.
• Research and Development: We may use de-identified information for research, analytics, and to improve our Services, as permitted by law.

6. SMS & Text Message Communications

When you provide your phone number during account creation or in connection with our Services, we may use it to send you text (SMS) messages. These messages fall into two categories:

Transactional & Service Messages. By providing your phone number, you consent to receive text messages related to your use of the Services, including order confirmations, prescription status updates, consultation reminders, shipping notifications, and account alerts. These messages are necessary to deliver the Services you have requested.

Marketing & Promotional Messages. We will only send marketing or promotional text messages if you have provided separate, explicit consent through our opt-in checkbox during account creation or at a later point. You are not required to consent to marketing messages as a condition of purchasing any product or service.

Third-Party Messaging Provider. We use Twilio, Inc. as our third-party messaging service provider to deliver text messages on our behalf. Your phone number is shared with Twilio solely for the purpose of transmitting these messages. Twilio's use of your information is governed by their own privacy policy.

Message Frequency & Rates. Message frequency varies based on your account activity. Standard message and data rates from your wireless carrier may apply.

Opt-Out & Support. You may opt out of text messages at any time by replying STOP to any message you receive from us. For help, reply HELP to any message or contact us at support@mademed.com. Opting out of transactional messages may limit our ability to send you important updates about your orders and prescriptions.

Data Retention. We retain your phone number for as long as your account is active or as needed to provide the Services. If you opt out of all text messages, we will retain a record of your opt-out preference to ensure compliance with your request. Your phone number will not be shared with third parties for their own marketing purposes.

7. Disclosure of Your Information

We may disclose your information as described below.

• The Medical Group and Pharmacy Partners: We will share your information with the Medical Group (Xpedicare, LLC) and our pharmacy partners (e.g., AbsoluteRx) as necessary to provide you with clinical services, prescribe medication, and fulfill your orders.
• Service Providers: We provide information to vendors and agents working on our behalf, such as companies that assist us with payment processing, shipping and logistics, data storage, identity verification, and marketing.
• Marketing and Advertising Partners: We may share your information with third-party partners for marketing and advertising purposes. This may be considered a "sale" or "sharing" of your information under certain state laws, and you have the right to opt-out of this activity as described in the "State-Specific Privacy Rights" section.
• Corporate Transactions: We may disclose your information as part of a corporate transaction, such as a merger, acquisition, or sale of assets.
• Legal and Law Enforcement: We will access, disclose, and preserve your information when we believe it is necessary to comply with applicable law or a valid legal process, such as a court order or subpoena.
• Security and Safety: We may disclose your information if we believe it is necessary to protect our customers, operate and maintain the security of our Services, or protect the rights and property of MadeMed.

8. User-Generated Content

If you voluntarily submit materials (such as text, images, or videos) to us for the purpose of publication on our website or social media channels (e.g., a product review), this is considered "user-generated content." Please be aware that any content you submit for publication will be public after posting. Once published, it may be accessible to third parties not covered under this Privacy Policy.

9. Your Rights and Choices Regarding Your Information

We provide a variety of ways for you to control the information we hold about you.

• Communications Preferences: You can opt-out of receiving promotional emails from us by following the instructions in those emails. If you opt-out, we may still send you non-promotional communications, such as those about your account or orders.
• Cookie Controls: Most web browsers are set to accept cookies by default. You can usually choose to set your browser to remove or reject browser cookies.
• Account Information: You may update or correct information about you at any time by logging into your account or contacting us at privacy@mademed.com.

10. State-Specific Privacy Rights

Residents of certain states have specific rights regarding their personal information. To exercise any of these rights, please contact us at privacy@mademed.com.

California Residents

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to Know and Access: You have a right to request that we disclose to you the personal information we have collected about you.
• Right to Correct: You have the right to request that we correct inaccurate personal information that we maintain about you.
• Right to Delete: You have the right to request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to Opt-Out of Sale or Sharing: You have a right to opt-out from the "sale" or "sharing" of your personal information.
• Right to Limit Use of Sensitive Personal Information: You have a right to limit our use of sensitive personal information for purposes other than to provide the services you request or as otherwise permitted by law.
• Notice of Collection: In the past 12 months, we have collected the following CCPA-defined categories of personal information: Identifiers; Customer Records; Demographics; Commercial Information; Internet or Other Electronic Network Activity Information; Audio or Visual Data; and Inferences. For more details, please see the "Collection of Your Information" section.
• "Shine the Light" Law: We do not disclose personal information to any third parties for their direct marketing purposes.

Virginia, Colorado, and Nevada Residents

• Virginia, Colorado: You have the right to access, correct, delete, and obtain a copy of your personal data. You may also opt-out of the processing of your data for targeted advertising, its sale, or for profiling.
• Nevada: You have the right to submit a request directing us not to sell your personal information.

11. International Data Transfers

Our Services are operated in the United States. If you are located in another jurisdiction, please be aware that information you provide to us will be transferred to, stored, and processed in the United States, where privacy laws may not be as comprehensive as those in your country of residence. By using our Services, you consent to this transfer.

12. Security and Data Retention

We use reasonable physical, technical, and administrative measures to protect your information from unauthorized access, use, and disclosure. However, no security system is impenetrable. You are responsible for keeping your account password secure and confidential.

We retain personal information for as long as necessary to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements.

13. Children's Privacy

Our Services are not directed to or intended for use by children under the age of 18. We do not knowingly collect personal information from children under 18. If we learn that we have collected personal information from a child under 18, we will take steps to delete that information.

14. Contacting Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us by email at privacy@mademed.com or by regular mail at:
IDL Health LLC (d/b/a MadeMed)
Attn: Privacy Officer
9668 Westheimer Rd Suite 200#32
Houston, TX 77063