TELEHEALTH PRIVACY POLICY

Generic template - replace every bracketed field before publication

IMPORTANT: This document is a general business template and is not legal advice. Privacy obligations may arise under HIPAA, the FTC Act, the FTC Health Breach Notification Rule, state consumer-health-data laws, state comprehensive privacy laws, biometric laws, advertising rules, medical-record laws, and other requirements. Have qualified privacy and healthcare counsel review the final version.

Effective Date: August 24, 2026

This Privacy Policy explains how Voyocare and PYLOT LLC (collectively, “Company,” “we,” “us,” or “our”) collect, use, disclose, retain, and protect personal information when you visit voyocare.com, use our websites, applications, patient intake experiences, customer support, communications, and related non-clinical services (collectively, the “Services”). Clinical services may be provided by independent licensed healthcare professionals, medical groups, pharmacies, laboratories, or other healthcare entities. Those entities may maintain separate privacy notices, including a HIPAA Notice of Privacy Practices where applicable.

1. Scope of This Privacy Policy

  • This Privacy Policy applies to personal information processed by the Company through the Services unless another privacy notice expressly applies.
  • This Privacy Policy does not replace a healthcare provider's Notice of Privacy Practices or other legally required notice governing protected health information.
  • If a separate medical group, pharmacy, laboratory, payment processor, or other third party independently determines how it processes information, that party's privacy practices may also apply

2. Information We Collect

  • Identifiers and contact information: name, email address, telephone number, date of birth, mailing address, shipping address, account identifiers, and similar information.
  • Account and transaction information: account credentials, order history, subscription status, transaction details, billing information, and limited payment-related information. Full payment-card details may be processed directly by third-party payment processors rather than stored by us.
  • Health and wellness information: medical history, current medications, allergies, symptoms, treatment goals, lifestyle information, measurements, questionnaire responses, prescription history, uploaded documents, and other information submitted in connection with an assessment or healthcare service.
  • Communications: customer-support requests, emails, chat messages, telephone communications, survey responses, and other correspondence.
  • Device and internet information: IP address, device identifiers, browser type, operating system, language, referring pages, approximate location derived from IP, and similar technical information.
  • Usage information: pages viewed, clicks, session activity, timestamps, navigation patterns, conversion events, and interactions with the Services.
  • Cookies and similar technologies: cookies, pixels, SDKs, local storage, tags, and related technologies used for functionality, analytics, security, preferences, and - where permitted - advertising or measurement.
  • Information from third parties: information received from healthcare providers, pharmacies, laboratories, identity-verification services, payment processors, marketing partners, analytics providers, service vendors, or other sources as permitted by law.

3. Sensitive and Consumer Health Information

  • Certain information we process may be considered sensitive personal information, consumer health data, or protected health information depending on the context and applicable law.
  • Health-related information may include diagnoses, symptoms, medications, treatment interests, reproductive or sexual-health information, weight-related information, laboratory information, and inferences that could reveal a person's physical or mental health status.
  • We use and disclose sensitive or consumer health information only for purposes permitted by applicable law and, where required, with appropriate consent or authorization.
  • Insert any jurisdiction-specific consumer health data notice or consent mechanics here: [INFORMED CONSENT].

4. How We Use Information

  • Provide, operate, maintain, personalize, and improve the Services.
  • Create and manage accounts and patient intake experiences.
  • Connect users with licensed healthcare professionals and facilitate telehealth workflows.
  • Coordinate prescriptions, pharmacy fulfillment, laboratory services, shipping, and related administrative functions where applicable.
  • Process payments, subscriptions, refunds, and transactions.
  • Provide customer support and respond to requests.
  • Authenticate users, detect fraud, prevent misuse, protect security, and enforce our agreements.
  • Analyze performance, diagnose technical issues, understand usage, and improve user experience.
  • Send transactional, service, safety, account, or administrative communications.
  • Send marketing communications where permitted and where any required consent has been obtained.
  • Comply with legal, regulatory, tax, audit, reporting, licensing, recordkeeping, and law-enforcement requirements.
  • Establish, exercise, or defend legal claims and protect the rights, safety, and property of users, providers, partners, and the Company.

5. Healthcare Providers and Clinical Information

  • Information submitted through a healthcare intake may be made available to licensed healthcare professionals for clinical evaluation and treatment decisions.
  • Licensed healthcare professionals exercise independent medical judgment and may collect or create additional medical information as part of the clinician-patient relationship.
  • Medical records maintained by a healthcare provider or medical group may be governed by separate privacy obligations and retention requirements.
  • The Company should identify the applicable clinical entity and Notice of Privacy Practices here where required: [MEDICAL GROUP / NPP LINK].

6. HIPAA and Protected Health Information

  • HIPAA does not automatically apply to every piece of health-related information collected through a consumer website or technology platform.
  • Where the Company acts as a HIPAA covered entity or business associate, protected health information will be handled in accordance with applicable HIPAA requirements and contractual obligations.
  • Where information falls outside HIPAA, it may still be protected by other federal or state privacy,
    consumer-protection, or consumer-health-data laws.
  • Do not publish broad statements that all platform data is 'HIPAA compliant' unless counsel has confirmed the applicable entities, data flows, contracts, security controls, and permitted uses.

7. How We Disclose Information

  • Healthcare providers and medical groups: to facilitate clinical evaluation, treatment, care coordination, and required medical recordkeeping.
  • Pharmacies and laboratories: to process prescriptions, dispensing, fulfillment, laboratory orders, results, shipping, and related services.
  • Service providers: hosting, cloud infrastructure, security, identity verification, customer support, communications, analytics, shipping, payment processing, fraud prevention, and other operational functions.
  • Professional advisers: lawyers, accountants, auditors, insurers, compliance advisers, and consultants where reasonably necessary.
  • Corporate transactions: in connection with a merger, acquisition, financing, restructuring, bankruptcy, sale of assets, or similar transaction, subject to applicable law.
  • Legal and safety disclosures: where required by law, subpoena, court order, regulatory request, or where reasonably necessary to protect rights, safety, security, or prevent fraud or harm.
  • With your direction or consent: when you request or authorize a disclosure.

8. Sale, Sharing, Targeted Advertising, and Marketing Disclosures

  • Insert the Company's actual position based on its data practices. Do not state 'we do not sell personal information' unless that statement is accurate under every applicable legal definition.
  • If advertising pixels, audience tools, retargeting, cross-context behavioral advertising, or data-sharing
    arrangements are used, counsel should determine whether those activities constitute 'sale,' 'sharing,' 'targeted advertising,' or regulated consumer-health-data disclosure.
  • Template disclosure: [WE DO / DO NOT] sell personal information as defined by applicable law. [WE DO / DO NOT] share personal information for cross-context behavioral advertising. [WE DO / DO NOT] use consumer health data for targeted advertising.
  • Privacy choices and opt-outs can be exercised at: [PRIVACY CHOICES URL / COOKIE SETTINGS / GPC
    MECHANISM].

9. Cookies, Analytics, and Similar Technologies

  • We may use cookies and similar technologies for essential functionality, authentication, fraud prevention, preferences, analytics, measurement, and marketing where legally permitted.
  • Depending on jurisdiction, we may ask for consent before using non-essential technologies.
  • Users may be able to manage cookies through browser settings, consent-management tools, or our privacy controls.
  • If the Company recognizes browser-based opt-out signals such as Global Privacy Control, describe the
    implementation here: [GPC DISCLOSURE].

10. Payment Processing

  • Payments may be processed by third-party payment processors. Those processors may collect payment-card, bank, billing, fraud-prevention, and transaction information under their own privacy terms.
  • The Company may receive transaction identifiers, payment status, limited card metadata, and related information needed to manage orders and accounts.
  • Insert applicable payment processor disclosures if required: [PAYMENT PROCESSOR(S)].

11. Data Security

  • We use reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, destruction, loss, alteration, or disclosure.
  • Safeguards may include encryption in transit, access controls, authentication, vendor controls, logging, monitoring, employee training, incident-response procedures, and other measures appropriate to the sensitivity of the information.
  • No transmission or storage system can be guaranteed to be completely secure. Users should protect account credentials and notify us promptly of suspected unauthorized access.

12. Data Retention

  • We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, including service delivery, account administration, legal compliance, fraud prevention, dispute resolution, and enforcement of agreements.
  • Medical records and information maintained by licensed healthcare providers may be retained for periods required by medical-record laws and professional obligations.
  • Retention periods may vary by information type, jurisdiction, legal requirement, contractual obligation, and operational need.
  • When information is no longer required, we may delete, de-identify, aggregate, or anonymize it as permitted by law.

13. De-Identified and Aggregated Information

  • We may create de-identified, anonymized, or aggregated information that is not reasonably capable of being linked to an identifiable individual.
  • Where required by law, we will take reasonable measures to prevent re-identification and will not attempt to re-identify data maintained as de-identified except as legally permitted.

14. Privacy Rights

  • Depending on where you live, you may have rights to request access, correction, deletion, portability, or information about our collection, use, and disclosure of personal information.
  • You may also have rights to opt out of certain sales, sharing, targeted advertising, profiling, or processing of sensitive information; withdraw consent; limit certain uses; or appeal a denied privacy request.
  • Some information may be exempt from certain requests, including medical records retained under healthcare laws or information required for legal compliance.
  • To submit a request, use [PRIVACY REQUEST URL] or contact privacy@voyocare.com.

15. Verification of Privacy Requests

  • We may take reasonable steps to verify identity and authority before processing a privacy request.
  • Verification requirements may vary based on the request, sensitivity of the information, and applicable law.
  • Authorized agents may submit requests where permitted, subject to documentation and verification requirements.

16. State-Specific Privacy Rights

  • Residents of certain U.S. states may have additional rights under state comprehensive privacy or consumer health data laws.
  • Insert state-specific disclosures or link to a supplemental notice where required: [STATE PRIVACY NOTICE URL].
  • Where applicable, provide information regarding categories collected, sources, purposes, disclosure categories, retention, opt-out rights, appeals, sensitive-data processing, consumer-health-data authorization, and regulator complaint rights.

17. California Notice

  • If the Company is subject to California privacy law, insert a California-specific notice describing applicable categories of personal information, purposes, sources, disclosures, retention criteria, sale/sharing practices, sensitive personal information practices, rights, request methods, and any financial incentive programs
  • [CALIFORNIA PRIVACY NOTICE / CCPA-CPRA DISCLOSURE]

18. Consumer Health Data

  • If the Services are subject to laws such as Washington's My Health My Data Act or similar state consumer health privacy laws, a separate Consumer Health Data Privacy Policy may be required.
  • Such a notice may need to identify categories of consumer health data, sources, purposes, categories of entities with whom data is shared, specific affiliates, rights, consent procedures, authorization requirements for sale, and complaint mechanisms.
  • [CONSUMER HEALTH DATA POLICY URL]

19. Marketing Communications

  • You may opt out of promotional emails by using the unsubscribe mechanism in those messages or by contacting us.
  • Text-message marketing is subject to separate consent and opt-out requirements where applicable.
  • Opting out of marketing does not prevent service-related, transactional, safety, or legally required communications.

20. Children's Privacy

  • The Services are intended for adults unless a specific service expressly states otherwise.
  • We do not knowingly collect personal information from children under 13 through general-audience Services, and healthcare eligibility may require users to be at least 18.
  • If you believe a child has provided personal information in violation of this policy, contact us at privacy@voyocare.com.

21. International Users and Data Transfers

  • If users outside the United States may access the Services, insert appropriate disclosures concerning international transfers, legal bases, representative requirements, contractual safeguards, and applicable data-protection rights.
  • [INTERNATIONAL DATA TRANSFER / GDPR / UK GDPR LANGUAGE, IF APPLICABLE]

22. Third-Party Websites and Services

  • The Services may link to third-party websites, applications, pharmacies, laboratories, social networks, or other services.
  • We are not responsible for the independent privacy practices of third parties. Review their privacy notices before providing information to them.

23. Business Transfers

  • Personal information may be transferred or disclosed in connection with an actual or proposed merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar corporate transaction, subject to applicable law and required notices.

24. Changes to This Privacy Policy

  • We may update this Privacy Policy as our Services, data practices, vendors, or legal obligations change.
  • The revised policy will identify an updated effective date. We will provide additional notice or obtain consent when required by applicable law.

25. Contact Us

  • Brand / Platform: Voyocare
  • Legal Entity: PYLOT LLC
  • Website: voyocare.com
  • Privacy Email: privacy@voyocare.com
  • Support Email: support@voyocare.com
  • Business Address: 30 N Gould St, STE R, 82801, Sheridan, Wyoming
  • Privacy Request Portal: [PRIVACY REQUEST URL]
  • Medical Group / Notice of Privacy Practices: [MEDICAL GROUP / NPP LINK]
  • Consumer Health Data Contact / Notice: [IF APPLICABLE]

Publication checklist: Map actual data flows first; identify the platform entity, medical group, pharmacies, labs, analytics tools, ad pixels, payment processors, CRM, email/SMS tools, hosting vendors, and fulfillment partners. Then replace every placeholder, verify whether data is sold/shared or used for targeted advertising, add required state consumer-health notices, link the Notice of Privacy Practices where applicable, implement actual privacy request and opt-out mechanisms, and obtain privacy/healthcare counsel approval before publication.