AQUIVIA HEALTH, LLC

PRIVACY POLICY

How Aquivia Health Collects, Uses, and Protects Your Information

Version 1.0  |  Effective April 9, 2026  Aquivia Health, LLC

PLAIN LANGUAGE SUMMARY: This Privacy Policy explains what personal information Aquivia Health collects when you use our platform, how we use it, who we share it with, and what rights you have. We take your privacy seriously — especially your health information. For health-specific rights, see our Consumer Health Data Privacy Policy. Este documento está disponible en Español.

1. INTRODUCTION

Aquivia Health, LLC and its subsidiaries (‘Aquivia Health,’ ‘we,’ ‘us,’ or ‘our’) is committed to protecting your privacy. This Privacy Policy describes how we collect, use, disclose, and protect your personal information when you use the Aquivia Health telehealth platform (‘Platform’ or ‘Service’).

This Privacy Policy is effective as of April 9, 2026 and applies to all users of the Platform. We review and update this Policy at least annually and whenever required by changes in applicable law.

Aquivia Health, LLC is a technology platform and does not itself provide medical care or clinical services. Licensed healthcare providers and medical groups delivering care through the Platform are responsible for clinical services and operate as independent covered entities under HIPAA.

Aquivia Health may act as a Business Associate to such providers and medical groups and, in that role, processes Protected Health Information (PHI) in accordance with applicable provisions of HIPAA and other applicable laws.

2. PROTECTED HEALTH INFORMATION (PHI)

Some information you provide in connection with clinical services may constitute Protected Health Information (PHI) under HIPAA. PHI provided to your treating Provider(s) and the medical groups operating through the Platform is governed by the applicable Notice of Privacy Practices (NPP), available at aquiviahealth.com/npp.

 

Aquivia Health processes PHI as a Business Associate of the medical groups that employ or contract with your Providers. As a Business Associate, Aquivia Health is subject to applicable provisions of HIPAA with respect to PHI.

2.1 Platform and Provider Relationship

Aquivia Health provides a technology platform that enables individuals to connect with independent licensed healthcare providers and medical groups (each, a “Provider”). These Providers are separate legal entities responsible for delivering medical care.

Aquivia Health does not control or direct clinical decision-making and does not practice medicine. Providers determine the medical services they provide and maintain their own legal and regulatory obligations, including compliance with HIPAA as covered entities.

When Aquivia Health processes PHI on behalf of Providers, it does so as a Business Associate pursuant to applicable agreements with such Providers.

3. PERSONAL INFORMATION WE COLLECT

3.1  Information You Provide

We collect personal information you voluntarily provide, including:

• Name, email address, phone number, billing and shipping address.
• Date of birth, gender.
• Government-issued identifiers (collected only where legally required for identity verification; stored in encrypted format; not used for marketing).
• Payment information (processed by Stripe; not stored by Aquivia Health).
• Health information, medical history, and symptoms provided during intake and consultations.
• Reproductive and sexual health information (Special Category — see Consumer Health Data Privacy Policy).
• Mental health and behavioral health information.
• Biometric information for identity verification (where applicable; state-specific consent obtained).
• Communications with Providers and customer support through the Platform.

3.2  Information Collected Automatically

When you use the Platform, we automatically collect:

• Device identifiers (IP address, MAC address, device type, operating system, browser version).
• Location data (city/state level inferred from IP address; precise location only with your permission).
• Usage data (pages visited, time on page, features used, click patterns).
• Cookie identifiers and mobile advertising IDs (subject to your Privacy Preference Center choices).

HEALTH PAGE BROWSING: Usage data from health-condition-specific pages of the Platform is treated as sensitive Consumer Health Data. This data is NOT shared with third-party advertising or analytics vendors. See our Privacy Choices Policy for details.

3.3  Information from Third Parties

We may receive personal information from: corporate affiliates; laboratory and pharmacy partners (to fulfill your orders); and service providers acting on our behalf. We do not purchase personal information from data brokers.

3.4  AI-Inferred Information

Aquivia Health may use artificial intelligence and machine learning tools to assist in analyzing Platform interactions and supporting care coordination and user experience. These tools are designed to support, not replace, clinical judgment by licensed Providers.

Where AI processes information derived from health-related data, such information is treated as Consumer Health Data and handled in accordance with applicable law and our Consumer Health Data Privacy Policy.

Where required by applicable law, users may request information about automated processing or request human review of certain decisions.

4. HOW WE USE PERSONAL INFORMATION

Purpose	Data Categories	Sensitive Data Used?
Clinical care delivery	Health data, contact info, payment info	Yes — only as necessary for care; no marketing use
Business operations (billing, security, fraud)	Contact info, payment info, usage data, device info	Government ID for identity verification only
Product improvement (de-identified)	De-identified / aggregated data only	No identifiable sensitive data
Customer support	Contact info, account info, communications	Health data only to the extent needed to answer your question
Communications about your care	Contact info, care-related health data	Yes — care-related only; not marketing
Marketing (opt-in only)	Contact information (name, email, phone) ONLY	NO health, biometric, reproductive, or mental health data used for marketing — ever
Personalization	Non-sensitive usage data, aggregate preferences	No specific health conditions used for personalization
Legal compliance	All categories as required by law	As required by applicable law

5. HOW WE DISCLOSE PERSONAL INFORMATION

5.1  Service Delivery Disclosures

• To your Providers and their medical group, as necessary for your care.
• To laboratory and pharmacy partners, to fulfill your orders.
• To payment processors (Adyen, Stripe) for payment processing.
• To identity verification vendors, where applicable, with your consent.

Independent Providers and medical groups are responsible for their own privacy practices and compliance obligations. Aquivia Health is not responsible for the privacy practices of such Providers, which are governed by their respective Notices of Privacy Practices.

5.2  Legal Disclosures

• As required by law, court order, or valid legal process.
• To report mandatory reporting obligations (child/elder abuse, danger to self or others).
• To protect the legal rights and property of Aquivia Health and its users.

5.3  Business Transfers

• In connection with a merger, acquisition, or sale of substantially all assets, personal information may be transferred as part of that transaction. We will provide notice of such transfer where required by applicable law.

NO SALE OF PERSONAL INFORMATION: Aquivia Health does not sell personal information to third parties. We do not share health information with any third party for advertising or marketing purposes. We may use limited, non-sensitive personal information for analytics or marketing purposes with your consent and in accordance with applicable law and your preferences set in our Privacy Preference Center.

6. TRACKING TECHNOLOGIES

6.1  Cookies & Web Beacons

We use cookies, web beacons, and similar technologies to operate the Platform and, with your consent, to support analytics and marketing functions. The specific technologies deployed and the third-party vendors operating them are disclosed in our Privacy Choices Policy and the Privacy Preference Center at aquiviahealth.com/privacy-choices.

6.2  Your Controls

• Privacy Preference Center: Manage all cookie and data preferences at aquiviahealth.com/privacy-choices
• Global Privacy Control (GPC): Recognized and honored per applicable law
• Browser cookie controls: Available in your browser settings
• Mobile advertising IDs: Available through iOS and Android settings
• Email beacons: Block by disabling automatic image loading in your email client

We do not respond to Do Not Track (DNT) browser signals, as no industry standard for DNT interpretation exists. We do honor GPC signals as described above.

6.3 Affiliate and Referral Tracking

Aquivia Health may use cookies or similar technologies to track referral sources and measure marketing performance. These technologies collect limited, non-health-related information and do not collect or process Protected Health Information.

7. DATA RETENTION

We or our affiliates retain personal information for the periods specified in our Consumer Health Data Privacy Policy (for health data) and as follows for other personal information:

Data Category	Retention Period	Basis
Account profile data	Duration of account + 90 days after closure	Service delivery
Payment transaction records	7 years	Tax and legal compliance
Medical records (held on behalf of Providers)	7–10 years (state-specific)	State medical record laws; HIPAA
Marketing contact data	Until opt-out + 30 days	Proportionality; state law
Analytics / usage data (non-health pages)	13 months rolling	Industry standard
Health-page browsing data	90 days	Proportionality; Consumer Health Data policy
Security and fraud logs	2 years	Fraud prevention; legal compliance
Legal hold data	Duration of hold	Legal obligation

8. YOUR PRIVACY RIGHTS

8.1  Universal Rights (All Users)

• Access: Request a copy of your personal information
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your personal information (subject to legal retention obligations)
• Opt-Out: Opt out of data sales, targeted advertising, and sensitive data processing
• Portability: Receive your personal information in a portable electronic format

To exercise these rights, visit aquiviahealth.com/privacy-choices, email privacy@aquiviahealth.com, or call 1-877-489-7070. We will respond within 45 days (with one 45-day extension where permitted). You may designate an authorized agent by providing written authorization.

8.2  State-Specific Rights

Depending on your state of residence, you may have additional rights:

State	Additional Rights & Notes
California	Right to Limit Use of Sensitive Personal Information; Right to Know (categories and specific pieces); Opt-Out of Sale or Sharing; Right to Non-Discrimination; Financial Incentive Disclosures; Data Protection Assessments for sensitive data processing. Contact: privacy@aquiviahealth.com or 1-800-XXX-XXXX.
Virginia	Right to Opt-Out of Targeted Advertising, Sale, and Profiling; Data Protection Assessment rights. Contact: privacy@aquiviahealth.com.
Colorado	Right to Opt-Out via Universal Opt-Out Mechanism (GPC honored); Data Protection Assessment rights. Contact: privacy@aquiviahealth.com.
Connecticut	Right to Opt-Out of Targeted Advertising, Sale, and Profiling; Universal Opt-Out honored. Contact: privacy@aquiviahealth.com.
Texas	Sensitive Personal Information requires opt-in for collection and processing. Contact: privacy@aquiviahealth.com.
Washington	Consumer Health Data governed by WMHMD — see Consumer Health Data Privacy Policy. Separate opt-in required for health data sharing.
Nevada	Consumer Health Data governed by SB 370 — opt-out of sale. Contact: privacy@aquiviahealth.com.
Montana, Oregon	Right to Opt-Out of Sale and Targeted Advertising; Universal Opt-Out honored. Contact: privacy@aquiviahealth.com.
All Other States	You have all universal rights described above. Contact: privacy@aquiviahealth.com.

9. DATA SECURITY

Aquivia Health and its affiliates use commercially reasonable industry-standard physical, technical, and administrative safeguards to protect your personal information, including:

 

• Encryption of sensitive data in transit and at rest where appropriate
• Multi-factor authentication for systems handling sensitive data, where feasible
• Role-based access controls limiting access to authorized personnel
• Regular security assessments and monitoring designed to identify vulnerabilities
• Use of infrastructure and service providers designed to support HIPAA-compliant environments

While we strive to protect your information, no method of transmission or storage is completely secure.

Data Breach Notification: If your personal information is involved in a data breach, we will notify you as required by HIPAA (45 CFR §§ 164.400–164.414), the FTC Health Breach Notification Rule (16 CFR Part 318), and applicable state breach notification laws. We will notify you promptly, and no later than 60 days following discovery of a breach unless law enforcement requests a delay.

10. AGE ELIGIBILITY, MINOR EXCLUSION & CHILDREN’S PRIVACY

The Platform is available exclusively to adults. You must be (a) at least 18 years of age AND (b) at or above the applicable age of majority in the state or jurisdiction in which you reside or are located at the time of use, whichever is higher. Aquivia Health has made an executive determination that it will not provide services to any minor or any person below the applicable state age of majority, without exception and regardless of parental or guardian consent. Aquivia Health does not knowingly collect, use, or disclose personal information from any minor. If we become aware that a person who does not meet our age eligibility requirements has created an account or provided personal information, we will promptly suspend the account and delete all associated personal information in accordance with applicable law, including COPPA (where the individual is under 13) and applicable state privacy laws. If a parent or legal guardian believes their child has accessed the Platform, they should contact us immediately at privacy@aquiviahealth.com so that the account may be closed and all data deleted.

Notwithstanding the foregoing exclusion, to the extent any personal information of an individual under 18 was collected prior to the effective date of this policy or through an inadvertent access, that individual (or their parent or legal guardian on their behalf) may request deletion of their personal information by contacting privacy@aquiviahealth.com. We will honor such requests promptly and in accordance with applicable law, including any state-law rights to erasure for minors. The cross-reference to limited minor access in prior versions of our Terms and Conditions is superseded by the executive minor exclusion policy effective as of the revision date of this Privacy Policy.

11. CHANGES TO THIS PRIVACY POLICY

We will notify you of material changes to this Privacy Policy by email and by posting the updated Policy at aquiviahealth.com/privacy. For changes requiring your re-consent under applicable law, we will present the updated Policy for your affirmative acceptance before the changes take effect. We review this Policy at least annually.

12. THIRD-PARTY SERVICES

The Platform may contain links to third-party services or integrations that are not owned or controlled by Aquivia Health. We are not responsible for the privacy practices of such third parties and encourage you to review their privacy policies.

13. CONTACT US

Privacy Officer: Aquivia Health, LLC, 12750 Jefferson Davis Highway #322, Chester, VA 23831, ATTN: Privacy Officer

Email: privacy@aquiviahealth.com

Phone: 804-963-8235

Privacy Rights Portal: aquiviahealth.com/privacy-choices

HHS Office for Civil Rights (PHI complaints): hhs.gov/hipaa  |  1-800-368-1019

FTC (non-HIPAA health data complaints): ftc.gov/complaint