Privacy Policy

1. Introduction

ForbiddenRX LLC (“ForbiddenRx,” “we,” “us,” or “our”) operates the telehealth platform at forbiddenrx.co (the “Service”). This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use the Service.

Medical care delivered through the Service is provided by independent licensed medical providers (the “providers”), each licensed in the state where you are located at the time of your visit. The providers maintain a Notice of Privacy Practices governing protected health information (“PHI”) under HIPAA, summarized in Section 4 below.

2. Information We Collect

Personal Data

• Name, email address, mailing address, phone number
• Date of birth, government-issued identification
• Account credentials and authentication data
• Payment information (processed by Stripe; we do not store full card numbers)
• Device, browser, and IP address information
• Usage data and interactions with the Service

Health Data

• Medical history, current medications, allergies
• Symptoms, vitals, and clinical responses you provide during intake
• Photos or video of yourself submitted for clinical review
• Recordings or transcripts of telehealth visits
• Provider notes, prescriptions, and treatment plans

3. How We Use Your Information

• Provide, operate, and improve the Service
• Facilitate telehealth visits and prescription fulfillment
• Process payments and manage subscriptions
• Communicate appointment reminders, refill alerts, and account notices
• Respond to support inquiries
• Comply with legal obligations and prevent fraud

We do not sell your personal or health information. We do not use your PHI for marketing purposes without your written authorization.

4. HIPAA Notice of Privacy Practices

The independent licensed providers who deliver care through the Service are covered health care providers under the Health Insurance Portability and Accountability Act (HIPAA). Your PHI may be used and disclosed by your provider for treatment, payment, and healthcare operations — for example, coordinating care with your treating provider and pharmacy, billing for services, and quality improvement.

You have the right to inspect and request a copy of your PHI, request corrections, receive an accounting of disclosures, request restrictions on certain uses, receive confidential communications, and file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights without retaliation.

The complete Notice of Privacy Practices — including all categories of uses and disclosures, your full set of rights under HIPAA, breach notification, and how to contact the HIPAA Privacy Officer — is available at forbiddenrx.co/hipaa-notice.

5. Who We Share Information With

• Medical providers licensed in your state for clinical evaluation and prescribing
• Licensed pharmacies that fulfill approved prescriptions
• Payment processors (Stripe) to process transactions
• Service providers for hosting, identity verification, communications, and analytics, under written agreements that limit their use of your data
• Legal and regulatory authorities when required by law or to protect safety
• Successors in connection with a merger, acquisition, or sale of assets, with notice to you

6. Data Security

We use administrative, technical, and physical safeguards designed to protect your information, including encryption in transit and at rest, access controls, audit logging, and HIPAA-compliant infrastructure. No method of transmission or storage is 100% secure; we cannot guarantee absolute security.

7. Data Retention

Medical records are retained by your treating provider for the period required by applicable state and federal law (typically 6–10 years). Account and billing records are retained as required by tax and accounting regulations. You may request deletion of non-medical account data at any time, subject to our legal obligations.

8. Your Rights

You have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate data
• Request deletion of personal data, subject to legal retention requirements
• Withdraw consent for non-essential processing
• Receive a copy of your PHI in an electronic format
• File a complaint with a regulatory authority

To exercise these rights, email support@forbiddenrx.co. We will respond within 30 days.

9. Children’s Privacy

The Service is intended for adults aged 18 and older. We do not knowingly collect personal information from children under 18. If you believe a minor has provided us with personal information, contact us and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email and posted on this page with a revised “Last updated” date. Continued use of the Service after changes constitutes acceptance of the updated policy.

11. Text Messaging (SMS)

If you opt in to text messages, we use your mobile number solely to send you account and order messages — order and shipping updates and occasional reminders that it may be time to check in with a provider about your next visit. Message frequency varies; message and data rates may apply. Reply STOP to any message to opt out, or HELP for help. See our SMS Terms.

We do not sell, rent, or share your mobile phone number or SMS opt-in information with any third parties or affiliates for their marketing or promotional purposes. Your mobile information is used only to deliver the messages you requested and is handled under the safeguards described in this policy.

12. Contact

For privacy questions or to exercise your rights, contact:

ForbiddenRX LLC
Privacy Officer
1270 Avenue of the Americas, 7th Floor, #1178
New York, NY 10020
Email: support@forbiddenrx.co