Last modified: July 7, 2026
1. INTRODUCTION
ZipHealth Services Inc., doing business as ZipHealth ("ZipHealth," "Company," "we," "us," or "our"), operates a digital health platform that facilitates access to prescription treatments for a range of health conditions through licensed healthcare providers and pharmacy partners. Our Services include online health consultations, clinical eligibility assessments, prescription facilitation, medication delivery, ongoing clinical care and support, and progress tracking for treatment categories such as erectile dysfunction, weight loss, migraine, herpes, cold sores, premature ejaculation, yeast infection, and other conditions. The Services are provided through our websites located at https://www.ziphealth.co/ and https://www.dermatica.com/ (collectively, the "Site"), mobile applications, and related platforms.
This Privacy Policy describes how we collect, use, store, and disclose your personal information ("Personal Information") when you access or use the Site, our mobile applications, and any related services, features, or content we offer (collectively, the "Services"). By accessing or using the Services, you acknowledge that you have read, understood, and agree to the collection, storage, use, and disclosure of your Personal Information as described in this Privacy Policy.
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. When we make material changes, we will notify you by posting the revised Privacy Policy on the Site with an updated effective date. We encourage you to review this Privacy Policy periodically. Your continued use of the Services after any changes constitutes your acceptance of the updated Privacy Policy.
2. SCOPE AND APPLICABILITY
This Privacy Policy applies to individuals located in the United States who access or use the Services, including the Site, mobile applications, and related platforms operated by ZipHealth. It describes how we collect, use, disclose, and otherwise process your Personal Information in connection with the Services.
The Site is hosted in the United States, and the Services are directed to users in the United States. If you access the Services from outside the United States, your information will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your jurisdiction. By accessing or using the Services from outside the United States, you consent to such transfer, storage, and processing.
This Privacy Policy does not apply to the practices of third parties that ZipHealth does not own or control, including third-party websites, applications, or services that may be linked from or accessible through the Site. We are not responsible for the privacy practices of such third parties, and we encourage you to review their privacy policies before providing any Personal Information.
3. MINORS
The Services are not intended for individuals under the age of eighteen (18). ZipHealth does not knowingly collect, use, or disclose Personal Information from anyone under the age of eighteen (18). If you are under eighteen (18), you may not access or use the Services or provide any Personal Information to us.
If you are a parent or guardian and believe that your child or a minor under the age of eighteen (18) has provided Personal Information to ZipHealth without your consent, please contact us immediately so that we can take appropriate steps to remove such information from our systems. You may reach us by email at help@ziphealth.co or by telephone at (888)-971-6741.
4. SUPPLEMENTAL STATE PRIVACY NOTICES
Certain states have enacted privacy laws that provide their residents with additional rights and disclosures beyond those set forth in this Privacy Policy. The following supplemental notices apply to you based on your state of residence.
California Residents: If you are a resident of California, please refer to Section 14 (California Privacy Rights Notice) for additional disclosures required under the California Consumer Privacy Act, as amended by the California Privacy Rights Act.
Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Nevada, Oregon, Rhode Island, Tennessee, Texas, Virginia, and Utah Residents: If you are a resident of any of these states, please refer to Section 15 (Additional State Supplemental Privacy Notice) for information about your rights under applicable state privacy laws.
Washington and Nevada Residents: If you are a resident of Washington or Nevada, our separate Consumer Health Data Privacy Policy, which is linked from the homepage of the Site alongside this Privacy Policy, provides additional disclosures and rights applicable to you under the Washington My Health My Data Act (RCW Chapter 19.373) and Nevada SB 370, respectively.
5. HIPAA AND HEALTH INFORMATION
ZipHealth facilitates access to healthcare services provided by independent, licensed healthcare providers through ZipHealth Medical Group, P.A., and affiliated medical groups (collectively, "ZipHealth Provider Group"), as identified in the Terms of Use. ZipHealth also facilitates prescription fulfillment through licensed pharmacy partners (each, a "Pharmacy").
Information you provide through the Services, whether or not it is disclosed to a Provider or Pharmacy, is not considered "protected health information" under the Health Insurance Portability and Accountability Act of 1996 and its related regulations and amendments (collectively, "HIPAA"), and HIPAA does not apply to your transactions or communications with ZipHealth. HIPAA does not apply to an entity simply because health information is involved.
ZipHealth Provider Group is responsible for providing you with a Notice of Privacy Practices describing its collection and use of your health information. Any medical or health information subject to specific protections under applicable state or federal laws will be used and disclosed in accordance with those laws.
6. INFORMATION WE COLLECT
We collect Personal Information in the following ways.
6.1 Information You Provide. We collect information you submit directly, including: account and contact information (name, date of birth, mailing address, email, phone number, and password); health and medical information (current health conditions, medical history, medications, allergies, pre-existing conditions, treatment goals, and lifestyle details transmitted to your Provider); sex life and sexual orientation information where relevant to your requested treatment, which we treat as Sensitive Personal Information and do not share with advertising networks for targeted advertising; consultation and treatment information exchanged with your Provider; progress tracking data (weight, photographs, milestones); payment and billing information; government-issued photo ID for identity verification; communications and support content; webform submissions; information about others you provide with their consent; and social media information if you interact with us on those platforms.
6.2 Information Collected Automatically. We automatically collect device and usage information (IP address, browser type, OS, device identifiers, clickstream data, timestamps), log information (search terms, session duration, feature interactions), and general location information derived from your IP address, device settings, or shipping address.
6.3 Information from Third Parties. We receive information from healthcare Providers and Pharmacies (diagnosis, prescription status, fulfillment details), advertising and analytics partners, identity verification services, fraud prevention services, and other lawful sources.
7. COOKIES AND TRACKING TECHNOLOGIES
We and our service providers use cookies, pixel tags, and similar technologies to collect information about your interactions with the Services, to improve performance, and to support advertising and analytics.
7.1 Managing Your Preferences. You may manage your cookie preferences through the Cookie Policy link on the Site, through your browser settings, or through your mobile device settings.
7.2 Analytics. We use Google Analytics and similar tools to analyze usage of the Services and improve functionality.
7.3 Do Not Track. We do not currently respond to Do Not Track browser signals. Where required by state law, we honor opt-out preference signals (such as Global Privacy Control) as requests to opt out of sale or sharing for targeted advertising.
7.4 Advertising Partners and Opt-Out Controls. We work with third-party advertising and analytics partners to deliver targeted advertisements promoting ZipHealth on other websites and services. We do not use or share your health or medical information, sex life or sexual orientation information, or other Sensitive Personal Information with these partners for targeted advertising purposes.
| Partner | Purpose | Privacy Notice | Opt-Out |
|---|---|---|---|
| Google Analytics | Analytics | https://policies.google.com/technologies/partner-sites | https://myadcenter.google.com/home |
| Google Ads | Advertising | https://policies.google.com/technologies/ads | https://myadcenter.google.com/home |
| Facebook/Meta Pixel | Advertising | https://www.facebook.com/privacy/explanation | https://www.facebook.com/settings?tab=ads |
This table is updated periodically. For the most current list, please visit the Cookie Policy link on our Site.
7.5 Mobile Advertising. When you use our mobile applications, you may receive tailored in-application advertisements. We and our service providers may use mobile advertising identifiers (such as Apple's IDFA or Google's Advertising ID) to deliver relevant advertising within mobile applications. Each mobile operating system provides options to limit ad tracking or reset your advertising identifier. You may review the support materials or device settings for your operating system (iOS, Android) to manage these preferences. Opting out of mobile ad tracking does not eliminate advertising; it limits the personalization of the ads you receive.
8. HOW WE USE YOUR INFORMATION
We use the Personal Information we collect for the following purposes:
9. HOW WE SHARE YOUR INFORMATION
We may disclose your Personal Information to the following categories of recipients for the purposes described in this Privacy Policy.
Healthcare Providers. We share your health questionnaire responses, medical profile, and related information with the Providers in the ZipHealth Provider Group to facilitate clinical assessment and treatment. ZipHealth is not responsible for any Provider's independent use of your Personal Information.
Prescriptions and E-Prescribing. If your Provider prescribes medication, you may choose to have your prescription filled at the pharmacy of your choice, which may include specialty or mail-order pharmacies affiliated with the medication's manufacturer. We share information necessary to fill your prescription (such as your name, contact information, and medication details) with the pharmacy you select, using certified e-prescribing technology provided by DoseSpot, LLC. DoseSpot processes this information solely to facilitate prescription transmission and is contractually obligated to protect your information and use it only for the purposes specified. ZipHealth is not responsible for any dispensing pharmacy's independent use of your Personal Information once your prescription has been transmitted. A current list of our sub-processors, including DoseSpot, is set forth in Schedule A to this Privacy Policy.
Fulfillment Partners. When your Provider authorizes a prescription, we facilitate its fulfillment and delivery through our licensed Pharmacy partners and shipping carriers. We share the information necessary for prescription dispensing, packaging, and delivery, including your name, address, prescription details, and contact information. ZipHealth is not responsible for any Pharmacy's independent use of your Personal Information.
Affiliates. We may share your Personal Information with our parent company, HeliosX Holdings Limited (registered at Unit H, Ashbourne Drive, Leamington Spa, England, CV31 3SS), MedExpress Enterprises Limited (same registered address), and their affiliated entities, including the affiliated brands MedExpress, Dermatica, and Levity, for purposes of providing and improving the Services, internal administration, analytics, and other purposes described in this Privacy Policy.
Service Providers and Processors. We engage third-party service providers that perform functions on our behalf under written contracts, including cloud hosting, payment processing, customer support, email and SMS delivery, identity verification, data analytics, and information security. These providers receive only the information necessary to perform their functions and are contractually obligated to protect it. A current list of our sub-processors is set forth in Schedule A to this Privacy Policy.
Advertising and Marketing Partners. We may share identifiers, internet activity, and inferred interests with advertising networks and marketing partners to deliver targeted advertisements on third-party platforms. We do not use or share your health or medical information, sex life or sexual orientation information, or other Sensitive Personal Information with advertising networks or marketing platforms for targeted advertising.
Text Messaging Data. ZipHealth does not sell, share, or rent mobile phone numbers or SMS consent information with third parties for their own marketing purposes, except with your consent or as permitted by law.
Legal and Safety Disclosures. We may disclose your Personal Information when we have a good-faith belief that disclosure is necessary to comply with applicable law, regulation, legal process, or governmental request; to enforce our Terms of Use; to detect, prevent, or investigate fraud, security incidents, or illegal activity; to support auditing functions; or to protect the rights, property, or safety of ZipHealth, our users, or the public.
Business Transfers. In the event of a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of our assets, your Personal Information may be transferred as part of that transaction. We will provide prior notice where required by applicable law.
De-identified and Aggregated Data. We may disclose de-identified or aggregated data without restriction, subject to applicable law. ZipHealth is the sole owner of such data. We maintain de-identified data in de-identified form, will not re-identify it except as permitted by law, and contractually obligate recipients not to re-identify it.
10. USE OF ARTIFICIAL INTELLIGENCE TECHNOLOGIES
ZipHealth may use artificial intelligence (AI) technologies to support and improve the Services. We may use AI technologies for our legitimate business purposes to process the information we collect about you as described in this Privacy Policy, including to: personalize content and recommendations; improve the efficiency and accuracy of our Services; support customer service through AI-assisted responses; analyze trends to improve our products and services; and detect and prevent fraud or security risks. How We Use AI in Our Services. We may use AI-assisted technologies in the following areas of our Services: Clinical decision support. AI tools may assist your Provider in reviewing health questionnaire responses, identifying potential drug interactions, or suggesting treatment options based on clinical guidelines. These tools provide recommendations to your Provider; they do not independently make diagnosis or prescribing decisions. Your Provider independently reviews and exercises clinical judgment over all treatment decisions.
Customer service. We may use AI-assisted chatbots or automated response tools to help answer common questions. When you are interacting with an AI-assisted system rather than a human representative, we will inform you.
Content personalization. We may use algorithms to personalize the health information, educational content, and treatment options displayed to you based on the conditions you are seeking treatment for and your engagement with the Services. Fraud detection and security. We use automated tools to detect suspicious activity, prevent unauthorized access, and protect the integrity of the Services.
Human Oversight. No treatment decision, diagnosis, or prescription is made solely by automated means. A qualified, licensed healthcare professional reviews all clinical decisions. If an AI-assisted tool contributes to a recommendation about your care, your Provider has the authority to accept, modify, or reject that recommendation based on their independent clinical judgment. Accuracy and Fairness. We evaluate AI systems used in clinical decision support for accuracy and potential bias before deployment and on an ongoing basis. We maintain records of these evaluations and the categories of personal data used as inputs and outputs.
Third-Party AI Services. In some cases, we may use third-party AI services. These services are subject to our vendor management processes, and we require them to adhere to appropriate data protection standards. The information we process through AI systems is subject to the same data protection and security measures described in this Privacy Policy, including all applicable data rights.
No AI Training. We do not use your Personal Information for the purpose of training large language models or generative artificial intelligence systems.
Your Rights Regarding AI and Automated Processing. Depending on your jurisdiction, you may have the right to: (a) be informed when AI or automated processing is used in connection with a decision that affects you; (b) request a meaningful explanation of the logic involved and how a decision was reached; (c) request genuine human intervention in an automated decision; (d) make representations about an automated decision; (e) contest an automated decision; and (f) opt out of profiling that produces legal or similarly significant effects. To exercise any of these rights, contact us using the information in Section 14.8. For jurisdiction-specific details, see Sections 14-16.
11. DATA SECURITY, ACCOUNT PROTECTION, AND DATA MANAGEMENT
11.1 Data Security. ZipHealth maintains commercially reasonable administrative, technical, and physical safeguards designed to protect your Personal Information from unauthorized access, disclosure, alteration, and destruction. These measures include encryption of data in transit and at rest, access controls limiting personnel access to Personal Information on a need-to-know basis, regular security assessments, and employee training on data protection practices. No method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security of your information.
11.2 Protecting Your Own Information. You are responsible for maintaining the confidentiality of your account credentials. Choose a strong, unique password and do not share it with others. Sign out of your account after each session on shared or public devices. Secure the email account associated with your ZipHealth account. If you suspect unauthorized access to your account, contact us immediately at help@ziphealth.co.
11.3 Accessing, Correcting, and Deleting Your Information. You may access and update certain Personal Information through your account profile settings. To request access to, correction of, or deletion of your Personal Information, contact us at help@ziphealth.co. We will make reasonable efforts to respond promptly. We may deny a request if compliance would violate applicable law or cause information to become inaccurate. Deleted information will be removed from active databases but may remain in archived or backup copies. We may retain de-identified information. ZipHealth cannot compel third parties to delete or modify your Personal Information.
12. DATA RETENTION
We retain your Personal Information for as long as necessary to fulfill the purposes described in this Privacy Policy, maintain your account, comply with legal and regulatory obligations (including prescription record retention requirements), resolve disputes, and enforce our agreements. The following are our general retention periods for key categories of information:
| Type of Data | Retention Period |
|---|---|
| Payment records | 10 years |
| Medical records | 10 years |
| Customer service data | 10 years |
These periods may vary where applicable law requires a longer retention period. When Personal Information is no longer needed for any of these purposes, we will securely delete or de-identify it in accordance with our data retention policies and applicable law.
13. MARKETING COMMUNICATIONS, CHILDREN'S PRIVACY, REPORT VIOLATIONS, AND CONTACT INFORMATION
13.1. MARKETING COMMUNICATIONS
You may opt out of receiving marketing emails from ZipHealth at any time by clicking the "unsubscribe" link included in any marketing email or by contacting us at help@ziphealth.co. To opt out of marketing text messages, reply STOP to any such message. Opting out of marketing communications does not affect transactional or administrative messages related to your account, prescriptions, or treatment. Withdrawal of marketing consent may limit certain aspects of the Services available to you.
13.2. REPORT VIOLATIONS
If you believe that any provision of this Privacy Policy has been violated, please report the suspected violation to help@ziphealth.co.
13.3. HOW TO CONTACT US
If you have questions or concerns about this Privacy Policy or our data practices, you may contact us using any of the following methods:
14. CALIFORNIA PRIVACY RIGHTS NOTICE
This Section 14 applies to residents of California and supplements the remainder of this Privacy Policy. Where this Section conflicts with the rest of the Privacy Policy, this Section controls for California residents. Terms used in this Section have the meanings given to them in the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA").
14.1 Categories of Personal Information Collected. In the preceding twelve (12) months, we have collected the following categories of Personal Information:
14.2 Sources and Purposes. The sources from which we collect Personal Information and the purposes for which we use it are described in Sections 6 and 8 of this Privacy Policy.
14.3 Retention. We retain Personal Information as long as needed under applicable law and in accordance with the specific retention periods set forth in Section 12. Criteria include the duration of our relationship with you, legal obligations (such as prescription record retention requirements), and legal interests (including statutes of limitations and pending investigations).
14.4 Categories of Third Parties. All categories of Personal Information listed above may have been disclosed to the categories of third parties described in Section 9 for the business purposes described in Section 8.
14.5 Sale or Sharing of Personal Information. We do not sell Personal Information for monetary compensation. Under California law, sharing certain data with third parties for online behavioral advertising may constitute the "sale" or "sharing" of Personal Information. The following table identifies, for each category of Personal Information, the categories of third parties to which we disclose it, the purposes of use, and whether it is sold or shared for advertising.
| Category of Personal Information | Categories of Third Parties to Which We Disclose | Purposes of Use | Sold or Shared for Advertising? |
|---|---|---|---|
| Identifiers and contact information | Service providers; affiliates; healthcare providers; e-prescribing platform (DoseSpot); dispensing pharmacies; entities for legal and fraud prevention; advertising and marketing partners. | Provide and manage Services; analyze and improve Services; advertising and marketing; legal purposes | Shared with advertising partners |
| Commercial and transactional information | Service providers; affiliates; healthcare providers; entities for legal and fraud prevention | Provide and manage Services; analyze and improve Services; legal purposes | No |
| Financial information (collected by payment processors) | Payment processors; service providers; affiliates; entities for legal and fraud prevention | Provide and manage Services; legal purposes | No |
| Internet or electronic network activity | Service providers; affiliates; entities for legal and fraud prevention; advertising and marketing partners. | Provide and manage Services; analyze and improve Services; advertising and marketing; legal purposes | Shared with advertising partners |
| Visual information (ID photos, progress photos) | Service providers; affiliates; healthcare providers | Provide and manage Services; legal purposes | No |
| Health and medical information | Service providers; affiliates; healthcare providers; pharmacies; e-prescribing platform (DoseSpot); entities for legal and fraud prevention | Provide and manage Services; analyze and improve Services; legal purposes | No |
| Sex life and sexual orientation information | Service providers; affiliates; healthcare providers; pharmacies; e-prescribing platform (DoseSpot); entities for legal and fraud prevention | Provide and manage Services; legal purposes | No |
| Government-issued identification | Service providers; affiliates; entities for legal and fraud prevention | Provide and manage Services; identity verification; legal purposes | No |
| Customer service data | Service providers; affiliates; entities for legal and fraud prevention | Provide and manage Services; legal purposes | No |
We do not have actual knowledge that we have sold or shared Personal Information of any consumer under the age of 16. We do not sell or share Sensitive Personal Information for cross-context behavioral advertising.
14.6 Sensitive Personal Information. We do not use or disclose health or medical information, sex life or sexual orientation information, or other Sensitive Personal Information for targeted advertising or for sale or sharing. Communications with your Provider, medical records, and prescribed medications are never disclosed to advertising networks or marketing pixels. We comply with all additional limitations on the use and disclosure of Sensitive Personal Information under applicable law. You may limit our use and disclosure of Sensitive Personal Information as described below.
14.7 Your California Privacy Rights. Under the CCPA, California residents have the following rights:
14.8 Exercising Your Rights. To exercise any of the rights described above, please email help@ziphealth.co with your full name, email address, mailing address, and a description of the right you wish to exercise. You may also designate an authorized agent to submit a request on your behalf; the agent must provide written permission signed by you or a valid power of attorney. We will verify your identity before processing your request and may request additional information to do so. We may deny a request as permitted by applicable law and may charge a reasonable fee for requests that are excessive, repetitive, or manifestly unfounded. If we deny your request, you may appeal within thirty (30) days by emailing help@ziphealth.co. Note: ZipHealth will never ask you for sensitive personal or financial information when verifying your identity, and no ZipHealth employee will ask you to disclose your password.
14.9 Financial Incentive Programs. The Services may offer opportunities to receive certain benefits, such as discounts, promotional pricing, referral rewards, or free services, that involve the collection of Personal Information. Such opportunities may constitute a "financial incentive" under the CCPA (each, an "Incentive Program"). When you participate in an Incentive Program, you agree to the terms of that program and may withdraw at any time (for example, by opting out of promotional emails or contacting us). We estimate the value of the Personal Information associated with an Incentive Program based on the expense we incur in providing the incentive, taking into account the value of providing you with a more personalized experience. We do not assign monetary value to your Personal Information outside the context of the Incentive Program.
14.10 Shine the Light. Under Cal. Civ. Code Section 1798.83, California residents may request information about our disclosure of Personal Information to third parties for their direct marketing purposes during the preceding calendar year. To make such a request, please contact us at help@ziphealth.co. You may submit no more than one such request per calendar year.
14.11 Automated Decision-Making Technology Beginning April 1, 2027, if we use automated decision-making technology to make or substantially assist with significant decisions affecting you (including decisions relating to your healthcare), we will provide you with a pre-use notice describing the technology, offer you the ability to opt out where required by law, and enable you to request access to information about the logic of the technology and to appeal its results. Where generative AI is used in any clinical communication directed to you, such communication will include a disclaimer that the content was generated or assisted by AI, along with instructions for contacting a licensed healthcare professional, in accordance with California AB 3030. We do not use AI in a manner that implies or represents that an AI system holds a healthcare license or that care is being provided by a licensed human professional when it is not.
15. ADDITIONAL STATE SUPPLEMENTAL PRIVACY NOTICE
This Section applies to residents of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Nevada, Oregon, Rhode Island, Tennessee, Texas, Virginia, and Utah (collectively, "State Privacy Laws"). This Section supplements the rest of this Privacy Policy. Where this Section conflicts with the rest of the Privacy Policy, this Section controls for residents of those states.
15.1 Your Rights. Subject to applicable law, you may exercise the following rights:
15.2 Consent for Sensitive Personal Information. We generally collect Sensitive Personal Information (including health information and information relating to sex life or sexual orientation) only in connection with providing the Services you have requested and with your consent. We will not engage in targeted advertising using Sensitive Personal Information for residents of states requiring opt-in consent unless such consent has been provided. You may withdraw consent and opt out at any time.
15.3 Texas Residents: Additional Disclosure. For Texas residents: We may process your sensitive personal data, including health information and information relating to your sex life or sexual orientation, in connection with providing the Services you have requested. To the extent we use sensitive personal data to serve you with online advertising relevant to your use of ZipHealth, we do so only with your consent. You may withdraw consent at any time by visiting the "Cookie Policy" link on the Site or by contacting us at help@ziphealth.co. In accordance with Texas law, if AI is used in connection with your diagnosis or treatment through the Services, your Provider will provide conspicuous written disclosure of such use before or at the time of the interaction. Your Provider will personally review all AI-generated content before any clinical decision is made regarding your care.
15.4 Connecticut Residents: Additional Disclosures. For Connecticut residents: as of the effective date of this Privacy Policy, we do not use your Personal Information for the purpose of training large language models or generative artificial intelligence systems. For information about how we use artificial intelligence technologies, see Section 10. You have the right to opt out of profiling in furtherance of any automated decision that produces legal or similarly significant effects. You also have the right to question the results of profiling, receive an explanation of how the results were reached, and review the personal data used in the profiling. To exercise these rights, contact us at help@ziphealth.co.
15.5 Colorado: Profiling and Automated Decision-Making If we engage in profiling in furtherance of decisions that produce legal or similarly significant effects for Colorado residents, including healthcare-related decisions, we will disclose: (a) the categories of decisions subject to profiling; (b) a plain-language description of the logic used; (c) the categories of personal data processed as inputs; (d) whether the profiling system has been evaluated for accuracy, fairness, and bias; and (e) how you may opt out. You may opt out of profiling by contacting us at help@ziphealth.co. If we decline an opt-out request because the processing involves human-involved automated processing (where a qualified professional meaningfully considers the data and has authority to change the outcome), we will provide you with a detailed explanation.
15.6 Exercising Your Rights. To exercise any of the rights described above, please email help@ziphealth.co with your full name, email address, mailing address, and a description of the right you wish to exercise. We may verify your identity before processing your request and may request additional information as needed. Authorized agents may submit requests on your behalf with written authorization or a valid power of attorney. Parents or legal guardians may exercise rights on behalf of minor or dependent children.
15.7 Appeals. If we deny your request, you may appeal within thirty (30) days by emailing help@ziphealth.co. If your appeal is denied, you may file a complaint with your state Attorney General.
15.8 De-identified Data. We will not attempt to re-identify data that has been de-identified.
16. CONSUMER HEALTH DATA (WASHINGTON AND NEVADA), EFFECTIVE DATE, AND SCHEDULE A: LIST OF SUB-PROCESSORS
16.1. CONSUMER HEALTH DATA (WASHINGTON AND NEVADA)
If you are a resident of Washington or Nevada, our Consumer Health Data Privacy Policy (a separate document linked from the homepage of the Site) provides additional disclosures regarding our collection, use, and sharing of consumer health data under the Washington My Health My Data Act (RCW Chapter 19.373) and Nevada SB 370, including your rights to consent, access, delete, and withdraw authorization.
16.2 EFFECTIVE DATE
This Privacy Policy is effective as of July 7, 2026.
SCHEDULE A: LIST OF SUB-PROCESSORS
Last Updated: July 7, 2026
The following third-party sub-processors are engaged by ZipHealth Services Inc. to process Personal Information in connection with the Services. Each sub-processor is contractually obligated to protect Personal Information and to use it only for the purposes specified.
| Sub-Processor Name | Information Shared | Services Provided | Data Center Jurisdiction |
|---|---|---|---|
| Adyen | Payment and transaction information | Payment processing | EU |
| Amazon Web Services (AWS) | All data, including encrypted personal health information and user data | Cloud infrastructure, data storage, and processing | USA |
| Amplitude | Non-identifiable user action data | Digital product research and testing | USA |
| Apple OAuth | User-provided email address (if shared) | User login authentication (where Apple account is used) | USA |
| AWIN | Conversion tracking and order data | Marketing | EU |
| Braze | User-provided marketing preferences, name, date of birth, order details, behavioral data | Marketing | USA |
| Cookiebot | Cookie preferences and user tracking data | Cookie consent management | EU |
| Datadog | Non-identifiable user action data | Digital product research and testing | EU |
| DoseSpot, LLC | Patient name, date of birth, contact information, shipping address, prescription details, and medication information | E-prescribing platform and prescription transmission to dispensing pharmacies | USA |
| Facebook Pixel | Non-identifiable user action data | Marketing | USA |
| Fax.plus | Transfer of prescriptions via secured digital fax | Prescribing | Canada |
| Google OAuth | User-provided email address and name | Login authentication (where Google account is used) | USA |
| Google reCAPTCHA | Bot detection signals, user action data | Website security | USA |
| Google Tag Manager | Non-identifiable user action data | Digital product research and testing | USA |
| Hex Tech | User-provided data and encrypted patient health information | Analytics and reporting | USA |
| Hightouch | User-provided data and encrypted patient health information | Analytics and reporting | EU |
| Intercom | User-provided customer support queries data | Customer support | USA |
| Metabase | User-provided data and encrypted patient health information | Analytics and reporting | EU |
| Snowflake | User-provided data and encrypted patient health information | Analytics and reporting | EU |
| Stitch | User-provided data and encrypted patient health information | Workflow automation | EU |
| Stripe | Payment and transaction information | Payment processing | USA |
| Timekit | User-provided contact data | Calendar invites for video consultations | USA |
| Typeform | Survey responses and associated email addresses | Digital product research and testing | USA |
| Zapier | User-provided data and encrypted patient health information | Workflow automation | USA |
| Zendesk | User-provided customer support queries data | Customer support | USA |
ZipHealth may update this list from time to time to reflect changes in our sub-processors. Material changes to sub-processors that process Sensitive Personal Information will be posted on the Site with reasonable advance notice where required by applicable law.