Consumer Health Data Privacy Policy


Prepare Medical Inc.
Effective date:
Sept 1st, 2026. · Last updated: Sept 1st, 2026.

SCOPE OF THIS POLICY

This Consumer Health Data Privacy Policy applies to "consumer health data" as defined under the Washington My Health My Data Act, the Nevada Consumer Health Data Privacy Law, and comparable state consumer health data laws. It applies to residents of those states who use www.preparemedical.com (the "Website").

Canadian residents. If you are a resident of Canada, our collection, use and disclosure of your personal information and personal health information is governed by our Privacy Policy and by the Personal Information Protection and Electronic Documents Act and applicable provincial privacy and health privacy legislation, including Ontario's PHIPA, Alberta's HIA, British Columbia's PIPA and Quebec's Law 25. The rights and response periods described in this policy are those required by the US state laws referred to above. Where we choose to extend any of them to Canadian residents, we do so as a matter of practice and not in substitution for your rights under Canadian law. Access and correction requests from Canadian residents are handled within the timelines required by Canadian law, and complaints may be directed to the Office of the Information and Privacy Commissioner for British Columbia or the applicable provincial commissioner.

This policy applies only to consumer health data. Our general handling of personal information is described in our Privacy Policy. This document is provided separately as required by applicable state law.

This policy does not apply to information that is protected health information governed by HIPAA, information governed by other exempt frameworks, or de-identified data that cannot reasonably be linked to you.

CATEGORIES OF CONSUMER HEALTH DATA WE COLLECT

  • Health-related purchase information — the emergency medication kits and add-on packs you view,  request or purchase, and quantities ordered.
  • Health condition and treatment information — information you provide in the medical intake questionnaire, including age, height, weight, medical history, current medications, allergies, and responses to clinical screening questions.
  • Information about health-related services sought or received — that you requested a telehealth consultation, the status of a prescription request, and prescription fulfilment information.
  • Identifiers and contact information associated with the above, including name, email address, mailing and shipping address, telephone number, date of birth, and state of residence.
  • Payment and transaction information associated with a health-related purchase.
  • Inferences drawn from any of the above that identify your past, present or future physical or mental health status

HOW WE COLLECT CONSUMER HEALTH DATA

  • Directly from you, when you complete the intake questionnaire, place an order, create an account or contact customer support.
  • From our partners, being the prescribing physician network and the dispensing pharmacy, in connection with fulfilling your order.
  • From the platform on which our services operate, being our affiliated technology provider.
  • Through the Website, limited to information you actively provide. We do not use advertising or analytics technologies to collect consumer health data.

PURPOSES FOR COLLECTING AND USING CONSUMER HEALTH DATA

  • To enable an independent licensed physician to review your request and determine whether a prescription is clinically appropriate.
  • To enable a licensed pharmacy to dispense and ship your order. To process payment and provide order confirmations, shipping notifications and customer support.
  • To process payment and provide order confirmations, shipping notifications and customer support.
  • To maintain records required by applicable pharmacy, medical and health privacy laws.
  • To detect and prevent fraud and to secure our systems.
  • To comply with legal obligations.

We do not use consumer health data for advertising, marketing, profiling or targeted advertising, and we do not use it to train models.

SOURCES OF CONSUMER HEALTH DATA

You; the prescribing physician network; the dispensing pharmacy; our affiliated technology platform provider; and payment processors, each as described above.

CATEGORIES OF THIRD PARTIES WITH WHOM WE SHARE CONSUMER HEALTH DATA

We share consumer health data only as necessary to provide the services you request, and only with:

  • The independent prescribing physician network — to conduct the clinical review and issue a    prescription where appropriate.
  • The licensed dispensing pharmacy — to fill and ship your order.
  • Our affiliated technology platform provider — which hosts the platform and processes data on our behalf under contract.
  • Service providers and processors bound by contract to use the data only to perform services for us, including cloud infrastructure, secure communications and payment processing.
  • Legal and regulatory recipients — where required by law, court order or lawful government request.


We do not sell consumer health data.
We do not share consumer health data with advertisers, advertising networks, data brokers or social media platforms. A list of the specific third parties with whom we share consumer health data, together with contact information for each, is available on request from privacy@preparemedical.com.

YOUR RIGHTS

If you are a resident of a state with applicable consumer health data legislation, you have the right to:

  • Confirm whether we collect, share or sell your consumer health data, and to access that data.
  • Obtain a list of all third parties and affiliates with whom we have shared or to whom we have sold your consumer health data, together with contact information for each.
  • Withdraw consent to our collection and sharing of your consumer health data.
  • Request deletion of your consumer health data. On receipt of a verified request we will delete the consumer health data we hold, including from archived and backup systems in accordance with our backup retention cycle, and we will notify our affiliates, processors, contractors and other third parties with whom we have shared your data of your deletion request.
  • Be free from discrimination for exercising any of these rights.


Limits on deletion. Certain records are outside our control or must be retained by law, and we will make reasonable efforts to give effect to your request within those limits. Where a prescription has been issued or medication dispensed, the prescribing clinician and the dispensing pharmacy are independently required by law to retain clinical and dispensing records for prescribed periods; those records are held by them, not by us, and are outside our ability to delete. We may also be required to retain limited information for tax, accounting, fraud-prevention or legal-compliance purposes. Where we have shared your consumer health data with a third party, we will notify that party of your deletion request, but we cannot guarantee the actions of parties we do not control. We will tell you which records fall outside our control and why.

HOW TO EXERCISE YOUR RIGHTS

Submit a request by email to privacy@preparemedical.com or by mail to Prepare Medical Inc., Attn: Chief Privacy Officer, 300-15300 Croydon Drive, Surrey, BC V3Z 0Z5, Canada. We will verify your identity before acting on a request, and will not require you to provide more sensitive information than is necessary to do so. We will respond within 45 days of receipt, and may extend that period by a further 45 days where reasonably necessary, in which case we will notify you within the initial 45-day period and explain the reason.
Appeals. If we decline your request, we will explain why and how to appeal. Appeals may be sent to privacy@preparemedical.com and will be decided within 45 days. If we deny your appeal, we will provide a method to contact the Washington Attorney General, or the applicable state authority, to submit a complaint.

CONSENT AND AUTHORISATION

We collect and share consumer health data only with your consent, or as necessary to provide a product or service you have requested. Consent is obtained separately from our general terms, is not bundled with other permissions, and may be withdrawn at any time. Because we do not sell consumer health data, we do not seek the valid authorisation that applicable law requires for sale. Should that ever change, we would obtain a separate signed authorisation containing the disclosures required by law before any sale.

GEOFENCING

We do not use a geofence around any facility that provides in-person health care services to identify or track consumers, to collect consumer health data, or to send notifications or advertisements relating to consumer health data.

DATA SECURITY AND RETENTION

We apply administrative, technical and physical safeguards to consumer health data, including encryption in transit and at rest, role-based access controls, user authentication, and audit logging of access. We retain consumer health data only as long as necessary for the purposes described above or as required by law, after which it is securely destroyed or de-identified.

DATA LOCATION

Consumer health data may be processed and stored in Canada by our affiliated technology platform provider, and in the United States by our physician and pharmacy partners and certain service providers. Where data is transferred across borders, we require contractual and technical safeguards equivalent to those required by applicable law. Data held outside your state or country may be subject to lawful access by authorities in the destination jurisdiction.

CHANGES TO THIS POLICY

We will notify you of material changes before they take effect and, where required, obtain your consent. The effective date appears at the top of this policy.

CONTACT

Prepare Medical Inc.
Attn: Chief Privacy Officer
300-15300 Croydon Drive, Surrey, BC V3Z 0Z5, Canada
privacy@preparemedical.com