Privacy Policy

Information we collect

Account information. When you create an account we collect basic identifiers such as your name, email address, date of birth, state of residence, and shipping address. This information is used to operate your account, verify eligibility (you must be 18 or older and located in a state where we operate), and deliver any treatment a licensed provider prescribes.

Health intake information. The health questionnaire you complete during intake — your symptoms, medical history, medications, and related details — is protected health information (PHI). It is collected for, and handled by, our independent clinical and pharmacy partners so that a licensed provider can evaluate your care. It is not used by Oravix for marketing and never enters our marketing or analytics tools.

Site usage information. We collect limited, PHI-scrubbed analytics about how visitors use our marketing site (pages viewed, buttons clicked, device type) to improve the experience. These analytics are configured so that health answers, messages, and other PHI are never captured.

How we use information

We use your account information to create and secure your account, connect you with our clinical partners, process payments, ship any prescribed treatment, send transactional emails (order updates, appointment reminders, consent records), and provide customer support.

We use PHI-scrubbed site analytics to understand what is working on our site and what is not. We do not use your health information to target advertising, and we do not sell your personal information.

HIPAA and protected health information

Your PHI lives with the clinical, laboratory, and pharmacy partners who deliver your care, each operating under HIPAA and under business associate agreements (BAAs) where required. Oravix's architecture is designed so that PHI does not persist on Oravix marketing systems and never reaches our content management, marketing, or analytics tools.

How your PHI may be used and disclosed for treatment, payment, and healthcare operations — and your rights under HIPAA — are described in detail in our Notice of Privacy Practices at /legal/notice-of-privacy-practices. Where this Privacy Policy and the Notice of Privacy Practices differ with respect to PHI, the Notice of Privacy Practices controls.

Cookies and analytics

We use cookies and similar technologies for essential functions such as keeping you signed in, remembering your theme preference, and securing your session. We use PostHog for product analytics in a PHI-scrubbed configuration: health questionnaire answers, messages, lab values, and other sensitive inputs are excluded from event capture.

You can control cookies through your browser settings. Disabling essential cookies may prevent parts of the site — such as your account and the patient portal — from working.

How we share information

We share information only as needed to deliver your care and operate the service: with our independent clinical partners and licensed providers (to evaluate and deliver your care), with US-based pharmacies (to fill and ship prescriptions, if a provider prescribes), with our payment processor (to charge the fees you approve — we do not store full card numbers), and with service providers who host and secure our systems under contractual confidentiality obligations.

We do not sell your health information, and we do not share it with advertisers or ad networks. We may disclose information when required by law, such as in response to a valid legal request, or to protect the safety of a patient or the public.

Your rights and choices

You may access and update your account information at any time in your account settings, and you may request a copy or deletion of your account data by contacting us. Deletion of clinical records is subject to medical record retention laws that our clinical partners must follow.

Depending on your state of residence, you may have additional rights under state privacy laws — such as the right to know what personal information we hold, to correct it, to delete it, and to opt out of certain sharing. We honor verified requests as those laws require, and we will not discriminate against you for exercising them.

Your HIPAA rights with respect to PHI — including access, amendment, and an accounting of disclosures — are described in our Notice of Privacy Practices.

Data security

We use industry-standard safeguards including encryption in transit, access controls, session timeouts, and audit logging. Clinical data is held by our HIPAA-covered partners in systems designed for medical information. No system is perfectly secure, so we also maintain breach response procedures and will notify you as required by law if your information is ever compromised.

Children

Oravix is for adults 18 and older. We do not knowingly collect information from anyone under 18, and our intake includes a hard age gate. If you believe a minor has provided us information, contact us and we will delete it.

Changes to this policy

We may update this policy as our services, partners, or the law change. We will post the updated version here with a new version identifier and effective date, and for material changes we will provide additional notice, such as email or an in-product banner.

Contact us

Questions about this policy or your information? Email privacy@oravixhealth.com and we will respond promptly.