Legal
Consumer Health Data Privacy Policy
Last updated: October 3, 2026
This policy explains how ForbiddenRX LLC (“ForbiddenRx,” “we”) collects, uses and shares consumer health data: personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health. It is written to meet Washington’s My Health My Data Act (RCW 19.373), Nevada’s consumer health data law (SB 370) and the consumer health data provisions of Connecticut’s Data Privacy Act, and it applies to everyone who uses frx.md, wherever they live.
It supplements our Privacy Policy. Information that your treating provider holds as protected health information under HIPAA is governed by the HIPAA Notice of Privacy Practices, which these state laws defer to.
1. Consumer health data we collect, and why
| Category | How we use it |
|---|---|
| Health history, conditions, symptoms, medications, allergies, height and weight, and other answers to medical questions | So a licensed provider can evaluate you, decide whether a treatment is appropriate, and prescribe it |
| The treatments you look at, choose or order, and your order and prescription history | To process your order, fill and ship your prescription, send refill reminders you have opted into, and provide customer support |
| Photos you upload, such as a photo ID, a selfie, a photo of a current medication, or lab results | To verify your identity, and so your provider can review your treatment and labs |
| Lab orders and results, and video-visit appointments, where your treatment requires them | To arrange the labs or visit your provider requires before prescribing |
| Your provider’s decision, notes and prescriptions | To fill your prescription and tell you about the decision |
| Inferences about your health from how you use the site, such as visits to a treatment page | To measure and improve the site in aggregate. Our analytics do not record account, order or payment pages, and remove everything after the page address (except campaign tags) before anything is sent |
| Payment details linked to a health purchase | To charge you, issue refunds and prevent fraud. Card numbers are handled by our payment processor; we do not store them |
We collect consumer health data only to provide the services you request, or with your consent for a purpose we describe to you first. We will not collect, use or share additional categories, or use the data for additional purposes, without first telling you and getting your consent.
2. Where it comes from
- You, when you answer questions, upload photos, place an order or contact us
- Automatically, from your device and how you use the site (see the inferences row above)
- Your treating provider, who records their decision, notes and prescriptions
- Pharmacies, laboratories and shipping carriers, which report fulfillment, lab and delivery status
3. Who we share it with
We share consumer health data only as needed to provide what you asked for, or with your consent. The categories of recipients are:
- Independent licensed providers who evaluate and treat you
- Licensed pharmacies that fill your prescription, and the pharmacy-network and medical-records service providers that route it to them
- Laboratories, when your treatment requires lab work
- Payment processors, to charge and refund you
- Shipping carriers, to deliver your order
- Technology service providers that host our site and database, send email and text messages, verify addresses and provide site analytics
- Government authorities, when the law requires it
Service providers process data on our behalf under written contracts that limit what they may do with it.
Affiliates: we do not share consumer health data with any affiliate.
We do not sell consumer health data, and we will never sell it without a separate, signed authorization from you as the law requires.
4. Your rights
You have the right to:
- Confirm whether we collect, share or sell your consumer health data, and access it
- Get a list of every third party and affiliate we have shared it with, and an email address or other online way to contact each one
- Withdraw your consent to our collection and sharing of it
- Have it deleted. We will also tell everyone we shared it with to delete it. Copies on backup systems are deleted within six months of your verified request
We will not discriminate against you for exercising these rights. Records that a provider or pharmacy must keep by law, such as medical and prescription records, may have to be retained for the period the law requires.
5. How to make a request
Use the form on Your Privacy Choices, or email support@forbiddenrx.co with “Consumer health data request” in the subject. You do not need an account. We will verify your identity using the contact details on your account or order, and may ask for more information if we cannot.
We respond within 45 days. If we need more time we may extend that once by up to 45 more days, and we will tell you why within the first 45 days. Responses are free up to twice a year.
6. How to appeal
If we decline your request, you can appeal by replying to our decision or by emailing support@forbiddenrx.co with “Appeal” in the subject. We will tell you in writing what we did and why within 45 days. If we deny the appeal, you can submit a complaint to your state attorney general. Washington residents can do so at atg.wa.gov/file-complaint.
7. Security and location
Access to consumer health data is limited to the people and service providers who need it to provide the services you request, and we protect it with administrative, technical and physical safeguards.
We do not use geofencing. We do not draw virtual boundaries around health care facilities to identify, track, collect data from or send messages to people who visit them.
8. Contact
ForbiddenRX LLC
Privacy Officer
1270 Avenue of the Americas, 7th Floor, #1178
New York, NY 10020
Email: support@forbiddenrx.co
Questions about this page? Email support@forbiddenrx.co or visit our contact page.