Privacy Policy

Effective Date: August 17, 2026
Last Updated: August 17, 2026

1. Scope of This Policy

StrengthRX ("we," "our," or "us") operates this website and provides telehealth services in Arizona, Idaho, Wyoming, Iowa, Utah, New Mexico, Nevada, and Colorado. This Privacy Policy explains what information we collect through our website and marketing, how we use it, and who receives it.

Two different sets of rules apply to us, and it matters which one covers you. Information you give us before you become a patient — for example, submitting a contact form or requesting a consultation — is governed by this Privacy Policy. Once you become a patient, the medical information we create and maintain about you is Protected Health Information under HIPAA and is governed by our Notice of Privacy Practices, which gives you additional rights. Where the two documents differ regarding your health information, the Notice of Privacy Practices controls.

2. Information We Collect

Information you give us directly

• Contact and consultation requests: your name, email address, phone number, state of residence, and the content of your message.
• Account creation: your name, email address, phone number, date of birth, and a password.
• Health information you choose to provide: the wellness goals you select and whether you have had recent lab work, along with any history, symptoms, or medical details you share during onboarding or a consultation.
• Communication preferences: whether you have agreed to receive text messages from us.

Information collected automatically

• IP address, browser type, device information, and operating system
• Pages you visit, referring page, and the date and time of your visit
• Marketing attribution data, including campaign parameters in the link you arrived on (such as utm_source and utm_campaign) and advertising click identifiers from Meta and Google
• Cookies and similar technologies, described in Section 5

3. How We Use Your Information

• To respond to your inquiry and schedule consultations
• To determine whether we are licensed to provide services in your state
• To provide, coordinate, and bill for care once you become a patient
• To create and maintain your account and patient records
• To send you messages about your care, and — only if you have separately agreed — marketing messages, which you can stop at any time
• To measure how our advertising performs, subject to the limits in Section 5
• To protect our website from spam, fraud, and abuse
• To comply with our legal and professional obligations

4. How We Share Your Information

We do not sell your personal information, and we do not share it with anyone for their own independent marketing purposes. We do rely on service providers to operate, and information is shared with them for that purpose. We disclose the specific recipients rather than describing them only in general terms:

• Practice Better — our patient records and telehealth platform. It receives your name, contact details, date of birth, and your clinical records.
• GoHighLevel — our customer relationship management system, used to manage inquiries, appointments, and follow-up. It receives your name, email address, phone number, state, how you found us, and the marketing attribution data described in Section 2.
• Meta Platforms — receives advertising measurement data from our advertising landing pages only, as described in Section 5.
• Resend — our email delivery provider, used to route your contact form submission to our own inbox.
• Google — reCAPTCHA Enterprise receives technical signals from your browser to distinguish real visitors from automated abuse.
• Laboratories and compounding pharmacies — receive the information necessary to complete lab work or dispense a prescription written for you.
• Legal and safety — we may disclose information when required by law, regulation, subpoena, or court order, or to protect the rights, safety, or property of our patients, our staff, or the public.
• Business transfers — if our business is acquired or merged, information may transfer as part of that transaction, subject to this policy.

Where these providers handle Protected Health Information on our behalf, we require a Business Associate Agreement obligating them to safeguard it under HIPAA.

5. Cookies, Tracking, and Advertising

Our website uses cookies and similar technologies to keep the site working, remember your preferences, and understand how visitors arrived. You can control cookies through your browser settings, though some features may not work correctly if you block them.

Advertising measurement. On our advertising landing pages only, we use the Meta (Facebook) pixel and Meta's Conversions API to measure how our ads perform. These tools may receive your IP address, browser and device information, the page you visited, advertising click identifiers, and — if you submit a form on one of those pages — a cryptographically hashed copy of the contact details you entered, so that Meta can match your response to the ad you saw.

Where we deliberately do not use them. We do not place advertising or analytics trackers on our patient onboarding flow, on the pages describing specific clinical services, or anywhere inside the patient portal. We never transmit your health goals, lab history, symptoms, diagnoses, prescriptions, or any other health information to any advertising platform, in any form, including hashed or de-identified form. We do not use advertising tools to build audiences based on any health condition or treatment.

We honor Global Privacy Control and similar browser-level opt-out signals where required by applicable law.

6. Text Messages

We send text messages only to people who have separately agreed to receive them. Consent to receive marketing texts is never a condition of receiving care. You can stop at any time by replying STOP. Message and data rates may apply. Full details are in our Messaging Terms.

We do not share or sell mobile information, including your phone number and your SMS consent, to third parties or affiliates for marketing purposes. Text messaging originator opt-in data is not shared with any third party for their own marketing.

7. Protected Health Information

As a healthcare provider, we are a covered entity under the Health Insurance Portability and Accountability Act. Your Protected Health Information is subject to HIPAA and to our Notice of Privacy Practices, which describes how we may use and disclose it and the specific rights you have — including the right to access, amend, and request restrictions on your health information, and to receive an accounting of certain disclosures.

8. Data Security

We implement administrative, technical, and physical safeguards intended to protect your information, including encryption of data in transit and at rest, access limited to those who need it to do their job, staff training on privacy and security, and vendor agreements requiring comparable protections. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. How Long We Keep Information

We keep medical records for the period required by the laws of the state in which you received care and by professional recordkeeping requirements, which is typically several years. Inquiry and marketing records are kept only as long as needed for the purpose described in this policy, and then deleted or de-identified.

10. Your Rights and Choices

Regardless of where you live, you may:

• Ask what personal information we hold about you and request a copy
• Ask us to correct information that is inaccurate
• Ask us to delete information, subject to our recordkeeping obligations
• Opt out of marketing emails and text messages at any time
• Ask questions about, or complain about, our privacy practices

State privacy rights. Residents of certain states we serve — including Colorado, Utah, Iowa, and Nevada — have additional rights under state privacy law, which may include the right to confirm whether we process your personal data, to obtain a portable copy, to correct or delete it, to opt out of targeted advertising and of any sale of personal data, and to appeal a decision we make about your request. Some state laws also give specific protections to consumer health data. To exercise any of these rights, contact us using the details in Section 13. We will not discriminate against you for exercising them. If we deny your request, you may appeal by replying to our response, and you may contact your state Attorney General.

To verify your identity before we act on a request, we may ask you to confirm information we already hold. An authorized agent may submit a request on your behalf with written permission.

11. Children's Privacy

Our services are intended for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page and revise the "Last Updated" date above. If we make a material change to how we handle your information, we will provide a more prominent notice.

13. Contact Us

If you have questions about this Privacy Policy, want to exercise a privacy right, or wish to file a complaint about our privacy practices, contact us:

You also have the right to file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint.