Privacy Policy

Table of contents

• 1. Who we are
• 2. Information we collect
• 3. How we use your personal data
• 4. How we share your personal data
• 5. Data security
• 6. Your state privacy rights and additional disclosures
• 7. Data retention
• 8. Third party links
• 9. Children’s privacy
• 10. International data transfers
• 11. Accessibility
• 12. Contact us
• 13. Changes to this Policy

Who we are

Avellum Health Co LLC is a Florida limited liability company with its principal office at 4736 Pebble Bay Cir, Indian River Shores, FL 32963. It runs the Sites, your account, the catalog, and your order history. For that information we act as a “data controller,” meaning we decide why and how it is processed, and you exercise your privacy rights directly with us, by email or by post, as described in “Contact us” below.

The medical care is not ours. Your medical intake, your consultation, and the clinical decision to prescribe or to decline are handled by licensed clinicians working with our telehealth partner, and your medication is dispensed by a licensed pharmacy. Those providers keep their own records of your care, and their own notices govern that information. Where Avellum receives Protected Health Information (“PHI”) from or on behalf of one of them, we handle it under a business associate agreement and at their direction.

This Privacy Policy is not a HIPAA Notice of Privacy Practices. It describes the personal data we collect through the Sites and Services. Where we maintain a HIPAA Notice of Privacy Practices for PHI we hold, it is available here. The full record of your care, including your intake answers and your clinician’s notes, is held by your treating provider or the dispensing pharmacy rather than by us, so ask them for their notice. What we hold about a visit is the fact of it: that one was requested, which therapies it covered, which intake you were sent to, and the outcome that came back. You can send a request about any of it to our Privacy Officer, and we will answer for our part and route the rest to whoever holds it.

Information we collect

We collect personal data from you through your use of the Sites and Services. Personal data is information that is linked or reasonably linkable to an identified or identifiable individual. The categories below are what we collect and why.

Personal data that you give us

• Account information. The signup form asks for what an account and an order need: your name, email address, a password (which we store hashed, never in the clear), your date of birth, your phone number, your shipping address, and whether you want marketing email.
• Requesting a consult. Before a consult you tell us the state you live in and the products you put in your cart. The medical intake itself is different: your medical history, current medications, allergies, and anything you upload are entered into our telehealth partner’s own system, not ours. What we act on is the outcome of the visit, such as whether the consult was approved, declined, or never finished, together with the references we need to match it to your order and show it to you. Their systems also send us their own product events, and some of those carry intake detail we have no use for. Where an event has not been mapped to something we act on, we keep the outline of the message, meaning field names and their types rather than the values in them, plus our reference for your visit and their id for the message.
• The goals quiz. If you take the quiz on our Sites, your answers stay in your browser. They are not sent to us, and we do not store them.
• Screening before a weight-management visit. Before that visit we ask a short set of questions on our Sites, including your height, weight, age and some medical history. Those answers stay in your browser as well and are not sent to us or stored. What reaches us is a single word naming which of our telehealth partner’s two programs your visit should start. If your answers rule the treatment out, we take you to a page that says so, and no answer from those questions is sent to us or stored.
• Order information. When you order, we hold what we need to record the order and show it back to you. That includes what you ordered, your order history, the status of your consults and shipments, tracking numbers, the address a kit ships to, references that let us match an order to the partner and processor systems that handled it, and the referral id carried by the link you arrived on (see Cookies below).
• Payment information. Avellum does not collect or store your card number. Two different charges can arise, on two different systems.
  • For medication, our telehealth partner collects your payment details and charges you on its own payment processor, on completion of the medical intake, before clinician review. Billing then recurs every 28 days. That charge and the terms that govern it are the partner’s, and your card details never pass through Avellum.
  • For a blood panel, the charge is taken at checkout on our side, on a hosted page operated by our payment processor, with Valdura as the merchant of record. You enter your card on the processor’s page, not on ours, and you enter the name and address your collection kit ships to on that page as well. Your card number never reaches us. What comes back to us from that page is what we need to record the order and get the kit to you, including the amount, whether it was paid, that shipping name and address, our own order reference, and tokenized references to the payment.
  If you buy both in one visit, you enter a card twice, with two different merchants.
• Messages to the assistant. If you use the assistant while you are signed in, we store your messages and its replies so the conversation can continue. They are processed by an AI provider working under a HIPAA business associate agreement, held by Avellum or by an affiliated company on our behalf, and that provider keeps its own copy for 30 days.
• Contacting us. If you write to us, you give us your contact information and whatever else you choose to include in your message. Which mailbox you use decides who reads it, and only one of the two reaches Avellum. Mail to support@avellumhealth.com is routed to the care team that runs your care rather than to us, so a question about an order, a shipment, a bill, or your treatment reaches the people who can see it, and their helpdesk rather than Avellum holds what you write there. Mail to privacy@avellumhealth.com reaches our Privacy Officer, and that is the address for your health information, your records, a privacy right, a complaint, or this Policy.
• Marketing. We may use your contact information to tell you about our Services, and to let you know about changes to this Privacy Policy, our Terms and Conditions, or any other agreement between you and us.

Information collected automatically

When you visit the Sites, our hosting provider and our own application record a small amount of technical information. We run no third-party analytics, no advertising pixels and no session-replay tools anywhere on the Sites, including the marketing pages and your signed-in account pages. What is recorded is technical rather than behavioral, and it includes:

• Usage information. The pages requested and when, in server logs kept for security and reliability.
• Device information. The browser and operating system your device reports when it makes a request.
• Security records. The IP address and browser your device reports when you sign in, create an account, reset your password, or change your account details, kept so we can tell a genuine request from a suspicious one.
• Location. We do not derive or store a place from your IP address, and we run no location tracking. The location information we hold is the state you tell us and the address you give us for shipping.

Cookies and other tracking technologies

Cookies are small files of information stored by your browser on your computer or device. We use them to run the Sites, not to advertise to you. These are the ones we set on a visitor’s browser today:

• A sign-in cookie, so you stay signed in and so we can end the session when you sign out.
• A referral cookie. If you arrive on a link distributed through Amway’s network, that link carries a referral id. We check that it is well formed and store it for 90 days in a cookie your browser will not expose to JavaScript. It records which account referred you. We use it to attribute the referral in our own records, and, while account creation is limited to people arriving from Amway, to decide whether the signup form is offered to you. It does not set your price: which price you see is decided separately, from the standing of the Amway account you connect, as described in How we use your personal data. The cookie carries no health information and nothing about what you buy.
• A cookie remembering the state you selected, so the catalog can show what is available where you live.
• While the Sites sit behind a preview password, a cookie recording that you unlocked them.
• A short-lived cookie used only while you are linking an account, and sent only on the pages of that flow.

Some things are kept in your browser’s own storage rather than in a cookie. Your light or dark theme choice is held there and does not leave your device. So is your cart, which reaches us when you continue to a consult or to checkout with it and not before. Your browser also holds a few things for the length of a tab and drops them when you close it: a count of how many product pages you have opened, so we can offer help after a few, and the page you were on if a sign-in interrupts you, so you land back where you were.

What we do not use. We set no advertising or analytics cookies, and we allow no other company to set one on the Sites. There are no Meta, Google, TikTok or comparable tags anywhere, including the marketing pages. We do not sell personal data, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising. The cookies above are there to run the Sites, keep you signed in, and record the referral you arrived on.

Browser settings. You can block cookies by changing your browser settings to refuse all or some of them. If you block all cookies you will not be able to sign in, and parts of the Sites will not work.

You can read more about cookies and how to manage them at www.aboutcookies.org or www.allaboutcookies.org.

Global Privacy Control. Some browsers and extensions transmit a Global Privacy Control (GPC) signal. We do not sell personal data, share it for cross-context behavioral advertising, or set advertising cookies, so there is nothing for the signal to switch off. We treat one as a valid opt-out request to the extent applicable under state law. GPC is the established opt-out signal today; the Sites do not separately respond to “Do Not Track” signals.

How we use your personal data

In addition to the purposes stated above, we use the personal data we collect, in accordance with applicable law, to:

• Create and run your account, sign you in, and keep the account secure.
• Arrange your consult with our telehealth partner, and, where you bought a blood panel, send the pharmacy that packs your collection kit what it needs to ship it to you. Your prescription reaches the dispensing pharmacy from our telehealth partner, not from us.
• Show you your orders, shipments, and the status of your consults.
• Decide which price to show you, from the standing of the Amway account you connect.
• Send you messages about your account, your orders, and your consults, and answer you when you write to our Privacy Officer.
• Run, maintain, and improve our Sites and Services.
• Protect the security and integrity of our Sites and Services.
• Investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, or violations of our Terms and Conditions, and to fulfill our legal obligations.
• Monitor compliance with and enforce this Privacy Policy and any applicable agreements and policies.
• Defend our legal rights and the rights of others.
• Fulfill any other purposes for which you provide it.
• For any purpose that is reasonably necessary to or compatible with the original purpose for which we collected the personal data as disclosed to you.
• Comply with applicable law, court orders, or other legal processes.

How we share your personal data

We may share the personal data that we collect about you in the following ways:

• With our telehealth partner, which runs the medical intake, the consultation, the payment for medication, and patient support. Most of what they hold about you, you gave to them yourself when you completed their intake.
• With the pharmacy that fills your prescription, though not by our hand. Your prescription reaches that pharmacy from our telehealth partner, which runs the prescribing; we send it nothing for a medication order. Which pharmacy it is depends on the product and on the state you live in: Precision Pharma (Precision Pharma Corp, NPI 1770389629) fills the products it carries in the states it is licensed in, and a partner pharmacy network fills the rest.
• For a blood panel, with the laboratory that processes it and with Valdura, which sells the panel and is the merchant of record for it. Your results go from the laboratory to Valdura. Avellum never receives, stores, or displays a lab result. Where a collection kit ships to you, we send the pharmacy that packs it what it needs to put the box together and get it to you, including the name and address it goes to, our order reference, which kit to pack and how many, when it was paid for, and whether a prescription order is on its way to the same person so the two can travel together. We send it no diagnosis, no dose, no marker and no result.
• With the vendors that run our systems, including application hosting, our database, the service that sends our email, the workspace that runs our mailboxes, and the AI provider behind the assistant. Where PHI can reach one of them it works under a HIPAA business associate agreement, held by Avellum or by an affiliated company on our behalf.
• With our payment processor, for a blood panel purchase. It receives what it needs to take the payment and to let us ship your kit, including your email address so it can send a receipt, the amount, a plain product name, the name and shipping address you enter on its page, and our own order and account references, which are opaque ids that mean nothing outside our systems. It does not receive your date of birth, your medical history, or any result, and it does not ship anything: the kit is packed and sent by the pharmacy described above. Under HIPAA a payment processor handling a transaction is not a business associate, under the carve-out at 45 CFR 164.502(e)(1)(ii), so this one holds no business associate agreement with us.
• With our professional advisors (legal, accounting, audit).
• With Amway, to check the standing of an Amway account you connect. We send an obscured reference to that account and receive back that account’s standing, meaning whether it is active and whether it carries a current Amway membership, along with the reference itself and the time of the check. Nothing about your care goes out, and nothing about your health comes back: we send no health information, no order information, and no purchase history. Amway is not a sponsor, endorser, or co-provider of any product offered through Avellum Health.
• We do not share your personal data with the account that referred you. We record the referral in our own records. That account is not told what you bought, or that you became a patient.
• With any person who we reasonably believe may apply to a court or other competent authority for disclosure of that personal data where, in our reasonable opinion, such court or authority would be reasonably likely to order disclosure of the personal data.
• To the extent we are required to do so by law, regulation, court order, subpoena, or other legal process.
• In connection with any legal proceedings or prospective legal proceedings.
• To investigate or prevent suspected illegal activity, fraud, security or technical issues, or violations of our Terms and Conditions.
• To establish, exercise, or defend our or a third party’s (including other users, our partners, or the public’s) legal rights, property, or safety.
• With any other person or entity as part of any merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or anything similar, proceeding or in preparation for any of these events, and that person may use your personal data for their own purposes.
• With any other person or entity where you consent to or direct the disclosure.

We do not sell your personal data, and we do not share it for cross-context behavioral advertising. See “Your state privacy rights and additional disclosures” below.

Data security

We use commercially reasonable administrative, technical, and physical safeguards to protect the personal data we hold from loss, misuse, destruction, or unauthorized access. In practice that includes data encrypted in transit and at rest, an idle timeout on staff sign-ins, and administrative access to our internal console that is authenticated, restricted by role, and written to an audit log recording who looked, at what, and when.

No method of transmission or storage over the Internet is 100% secure, however, and we cannot guarantee absolute security.

Your state privacy rights and additional disclosures

Depending on the state in which you reside, you may have certain privacy rights regarding your personal data.

Where the information you are asking about is part of the record of your medical care, including the record of your telehealth visit, it is held by your treating provider or the dispensing pharmacy rather than by us, and HIPAA rather than state consumer privacy law governs it. You do not have to work out who holds which part. Write to our Privacy Officer and we will route your request to whoever holds the record, and we will act on that holder’s instructions in responding.

Where we act as a data controller, you may exercise your rights directly with us. If you are a California resident, please also see our “Notice to California residents” section below. For residents of other states, your privacy rights may include (if applicable):

• The right to confirm whether or not we are processing your personal data and to access such personal data;
• The right to obtain a copy of your personal data that we collected from and/or about you in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the information to another controller without hindrance, where the processing is carried out by automated means;
• The right to obtain a list of specific third parties to which we have sold your personal data (unless we do not maintain this information in a format specific to you, in which case, we will provide a list of specific third parties to which we have sold any consumers’ personal data);
• The right to delete personal data that we collected from and/or about you, subject to certain exceptions;
• The right to correct inaccurate personal data that we maintain about you, subject to certain exceptions;
• The right, if applicable, to opt out of the processing of your personal data for purposes of (1) targeted advertising; (2) the “sale” of your personal data (as that term is defined by applicable law); and (3) profiling in furtherance of decisions that produce legal or similarly significant effects concerning you;
• If your personal data is profiled in furtherance of decisions that produce legal or similarly significant effects concerning you, you have the right to question the result of the profiling, to be informed of the reason that the profiling resulted in the decision, and, if feasible, to be informed of what actions you might have taken to secure a different decision (and the actions that you might take to secure a different decision in the future). If applicable, you also have the right to review the personal data used in the profiling and, if the decision is determined to have been based upon inaccurate personal data, the right to have the data corrected and the profiling decision reevaluated based upon the corrected data;
• If we are required by applicable law to obtain your consent to process sensitive personal data, the right to withdraw your consent; and
• The right not to receive discriminatory treatment by us for the exercise of your privacy rights.

Two of those rights have short answers here. We do not sell personal data, however “sale” is defined by the privacy law of your state, and we do not process personal data for targeted advertising, so there is no advertising opt-out to exercise. We do not profile you in furtherance of decisions that produce legal or similarly significant effects. Clinical decisions are made by a licensed clinician, not by an automated process. If any of that changes, we will update this Policy before the change takes effect.

Notice to Washington and Nevada residents

Washington’s My Health My Data Act and Nevada’s SB 370 give residents specific rights over consumer health data. The consumer health data we collect is described in “Information we collect” above, and it includes the products you select, the program a visit is routed to, the fact that you requested a consult and what became of it, what you order, and what you write to the assistant while you are signed in. Your answers to the goals quiz are not part of it, because they stay in your browser and do not reach us, and neither are your answers to the screening questions before a weight-management visit. We collect what we do collect to provide the Services you asked for and to arrange care with the clinicians and pharmacies described above. We do not sell it, and we do not use it for advertising. Our Consumer Health Data Privacy Notice sets this out in full, including how to ask what we hold, how to make a deletion request, and how to withdraw a consent you gave us.

How to exercise your rights

To exercise your rights, email our Privacy Officer at privacy@avellumhealth.com with the subject line “Privacy Rights Request,” or write to us by post at Avellum Health Co LLC, Attn: Privacy Officer, 4736 Pebble Bay Cir, Indian River Shores, FL 32963. A request that arrives by post is handled the same way, on the same timing, as one that arrives by email. If legally required, we will comply with your request upon verification of your identity and, to the extent applicable, the identity of the individual on whose behalf you are making the request. To prevent misuse, we may need to verify your identity against information already in our records. If you are submitting a request on behalf of another individual, use either channel. We will process authorized agent requests in accordance with applicable law. If we refuse to act on your request, you may appeal, either by replying to the email we send you in response or by writing to that same postal address.

We work to a 30-day response standard, with one extension where the law allows it, and we do not charge you for a copy of your own information. Where you ask us to delete something and we are required to keep it, such as the record of an order, we will tell you which part we are keeping and why, stop using it for anything but that obligation, and keep it no longer than the schedule in our retention policy allows.

A rights request has to reach the Privacy Officer to be acted on, so use one of the two routes above rather than support. Support mail is delivered to the care team that runs your care, which is the right place for an order or a treatment question and the wrong place for a request about your records.

Notice to California residents

Shine the Light law. We do not disclose personal information obtained through our Sites or Services to third parties for their direct marketing purposes. Accordingly, we have no obligations under California Civil Code § 1798.83.

California residents hold the rights listed above, and exercise them the same way. We do not sell or share personal information as the California Consumer Privacy Act defines those terms, so there is no “Do Not Sell or Share My Personal Information” link on the Sites to click.

Data retention

We keep personal data for as long as necessary to fulfill the purposes for which we collected it, such as to provide the Services you have requested, comply with our contractual, legal, and regulatory obligations, resolve disputes, enforce our agreements, and protect our legal rights. We hold an internal retention schedule that sets a period for each class of data we store, and disposal at the end of a period is a recorded act rather than an automatic one.

Records of an order are among the things we are required to keep, so closing your account does not erase them. When an account is closed, or when you ask us to stop, we stop using your information for anything beyond those obligations and keep what remains under that schedule.

Records of your medical care are kept by your treating provider and by the dispensing pharmacy under their own retention schedules and the record-keeping laws that apply to them, not under this Policy. Where we hold PHI on behalf of one of them, we handle it as our business associate agreement with them requires and on their instructions.

Third party links

The Sites contain links that will let you leave the Sites and access another website. The most important one is the medical intake: when you continue to your consult, you leave our Sites for a site operated by our telehealth partner, and what you enter there is governed by their privacy policy rather than this one. Linked websites are not under our control, and we accept no responsibility or liability for them.

Children’s privacy

The Services are for adults 18 and older, and an account is for the person named on it. Signing up asks for your date of birth, and the form refuses an account to anyone under 18, so we do not knowingly collect personal data from a minor. If we learn that we hold personal data for someone under 18, we close the account and stop using the information for anything except the records we are required to keep.

International data transfers

For individuals located outside the United States (US), in particular in Switzerland, the United Kingdom (UK), and the European Economic Area (EEA), please note that we are based in the US and the Services are run from, and only intended for, residents of the US. We do not market to or solicit customers from outside the US via the Sites, and users of the Sites should not expect to avail themselves of the rights provided under international privacy laws. If you access the Services from outside the US, be aware that we transfer personal data to the US for purposes described in this Privacy Policy, and the US may have privacy and data protection laws that differ from, and are potentially less protective than, the laws of your country.

Accessibility

We are committed to keeping this Privacy Policy accessible to individuals with disabilities. If you would like it in an alternative format, contact us as described below.

Contact us

For questions or concerns about our privacy practices, or to exercise a right described above, write to or call our Privacy Officer:

That number is answered for privacy and legal matters. It is not a support line. For an order, a shipment, a bill, or a question about your treatment, write to support@avellumhealth.com, which reaches the care team that runs your care and can see your orders. If you reach us on (689) 220-7908 about an order, we will point you back to that team rather than answer for them.

Changes to this Policy

We may change this Privacy Policy from time to time. If we do, we will post an amended version on this page and update the “Last updated” date. For material changes, we will give you additional notice, such as a statement on the homepage of the Sites, or notification by email or by other reasonable means.