Your records, and who can reach them.

Not everything we hold is medical, and the distinction changes how it is treated. Protected Health Information (PHI) — anything tied to your care, such as intake answers, lab results, and prescriptions — is governed by HIPAA. Website and marketing data — the pages you visit before you ever create an account — is ordinary commercial data.

We do not mix them: analytics and advertising tools are never loaded on authenticated pages that can display health information.

Service Availability: CULTR Health telehealth services are currently available only to patients physically located in Florida at the time of consultation. CULTR Health does not offer telehealth consultations or clinical services to patients outside Florida at this time. Medication shipment is available only to eligible Florida patients after a provider evaluation and valid prescription.

You can browse the public website without creating an account. When you do, we and our infrastructure providers automatically collect:

• Device and connection data: IP address, browser and device type, operating system, screen size, and language
• Usage data: pages viewed, referring page, links clicked, and time spent
• Security data: request patterns used to block bots, abuse, and denial-of-service attempts
• Attribution data: campaign and referral parameters in the URL, including creator and affiliate codes

If you take an action before becoming a member — joining the waitlist, completing a quiz, or submitting a contact form — we also collect what you type into it. A health-related quiz answer given before you are a patient is not yet PHI, but we treat it with the same confidentiality and never sell it.

We use cookies and similar browser storage for the purposes below. We do not use third-party advertising cookies, we do not sell or share personal information for cross-context behavioral advertising, and we do not offer a sale opt-out because there is no sale to opt out of.

Session and security cookies are strictly necessary — blocking them will break sign-in. You can clear or block the rest through your browser settings without losing access to your care. We honor Global Privacy Control (GPC) and Do Not Track (DNT) signals for analytics.

Once you become a member, we collect and process contact details, account credentials, payment metadata, and PHI — medical history, intake responses, lab results, prescriptions, consultation records, and consent receipts (including which version of each legal document you accepted, and when). We protect PHI under the Health Insurance Portability and Accountability Act of 1996:

• PHI is stored in systems with encryption in transit and at rest
• We maintain Business Associate Agreements with vendors that handle PHI
• We do not sell, rent, or trade health data — ever, to anyone
• Access is restricted to authorized personnel on a need-to-know basis and is audit-logged
• Pages that can display PHI time out automatically after 30 minutes of inactivity
• Routine PHI is excluded from email and SMS content; notifications tell you to sign in rather than restating clinical detail

• Operate, secure, and improve the platform
• Connect you with licensed providers and coordinate your care
• Process payments, manage membership, and prevent fraud
• Send transactional messages about care and billing
• Attribute a referral to the creator whose link you used
• Send marketing only where you have opted in, and only until you opt out
• Meet legal, regulatory, and medical record-keeping obligations

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. SMS consent records and phone numbers are used to provide the messages you request and manage your preferences. Service providers that deliver messages on our behalf may process this information only to provide that service.

SMS frequency depends on your separate choices: one confirmation per completed membership purchase; up to two guidance texts per seven days at least 72 hours apart; up to five saved-cart texts per seven days on the separately selected 15-minute, 3-hour, 12-hour, 24-hour and 72-hour schedule; and varying account/care notifications. Message and data rates may apply. Reply STOP to stop texts or HELP for help. See the SMS terms for quiet hours, sending limits and how to restore your message choices.

We do not use your PHI to train machine-learning models, and we do not make automated decisions that produce legal or similarly significant effects about you without human review.

We enable a vendor to handle PHI only when the required contractual and security controls are in place for that specific use.

We may also disclose information when required by law, to respond to valid legal process, to protect someone’s safety, or in connection with a merger or sale of assets — in which case we will give notice and the successor remains bound by this policy.

• TLS encryption for all data in transit
• AES-256 encryption for data at rest
• Card data handled entirely within the payment processor’s hosted fields (PCI SAQ-A scope)
• Secure, HttpOnly cookies with SameSite protections
• Automatic session timeout after 30 minutes of inactivity
• Rate limiting, bot protection, and audit logging of PHI access

No system is perfectly secure, and we cannot guarantee absolute security. We encourage you to use a unique email account you control and to sign out on shared devices.

Medical records are retained for at least 7 years after your last interaction, consistent with Florida medical record-retention requirements — this is a legal obligation and such records cannot be deleted on request. Billing records are retained as required by tax and financial regulation. Google Analytics records are retained up to 14 months. DataFast visitor-data retention varies under its Data Processing Agreement. Waitlist and marketing contacts are retained until you unsubscribe or ask us to delete them.

Under HIPAA and applicable state privacy laws — including the Florida Digital Bill of Rights — you may request to:

• Access: receive copies of your health records
• Correct: amend inaccurate information
• Restrict: limit certain uses and disclosures of your PHI
• Accounting: receive a list of disclosures of your PHI
• Delete: remove personal, non-medical data
• Port: receive your data in a commonly used electronic format
• Opt out: stop marketing email or SMS at any time

Email privacy@cultrhealth.com. We verify your identity before acting and respond within 30 days (45 for HIPAA access requests, extendable once). Exercising these rights never affects the care you receive. You may also complain to the U.S. Department of Health and Human Services Office for Civil Rights without retaliation.

If unsecured PHI is breached, we will notify affected individuals within 60 days as required by the HIPAA Breach Notification Rule. Breaches affecting 500 or more individuals are also reported to HHS and, where required, to media serving the affected area.

The Services are for adults 18 and over. We do not knowingly collect information from children under 18. If we learn that we have, we will delete it — contact privacy@cultrhealth.com.

We may update this policy. Material changes will be communicated by email or a notice on the platform, and the “last updated” date will change. Continued use after that date constitutes acceptance.

• Privacy and data rights: privacy@cultrhealth.com
• General support: support@cultrhealth.com
• Legal: legal@cultrhealth.com