Privacy Policy

Karpa Health LLC (“Karpa Health,” “Karpa,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect information when you visit our websites, use our platform, submit information through our forms, communicate with us, or otherwise interact with our services.

Karpa Health provides telehealth infrastructure, software, operational support, intake technology, provider-coordination workflows, pharmacy-partner workflow coordination, payment-workflow support, and related business services. Karpa Health does not provide medical services, prescribe, dispense, compound, manufacture, or ship medications. Clinical services are provided solely by independent licensed healthcare providers, and pharmacy services, when applicable, by independent licensed pharmacy partners.

1. Scope and Application

This Privacy Policy applies to information collected through our public website, sales forms, onboarding workflows, customer communications, and platform services. It does not apply to:

• information that constitutes protected health information (“PHI”) processed by Karpa Health on behalf of a covered entity or business associate, which is governed by HIPAA and the applicable Business Associate Agreement; or
• information that our business customers, providers, or pharmacy partners collect and control under their own privacy policies.

For personal information that Karpa Health processes on behalf of a business customer through that customer’s workflows, the customer is the controlling party, and Karpa Health acts as a service provider, processor, or business associate, as applicable, processing such information only as permitted by its agreement with the customer and applicable law. This Privacy Policy is a statement of our practices, is not a contract, and does not create any right or remedy beyond those required by applicable law.

2. Information We Collect

Information you provide directly. We may collect information you provide when you fill out a form, request information, book a call, create an account, use our platform, communicate with us, or participate in onboarding, including name, email address, phone number, business name, website URL, business address, role or title, program interests, payment and billing information, communications with our team, and information submitted through intake, onboarding, support, or operational workflows.

Business and partner information. If you are a customer, partner, brand operator, clinic, provider group, or other business user, we may collect business entity information, contact information for authorized users, branding assets, program preferences, service-configuration details, provider, pharmacy, or operational workflow preferences, and marketing or customer-acquisition information you provide to us.

Patient or end-user information. Where our platform supports healthcare-related workflows, we may collect or process information submitted by or about patients or prospective patients on behalf of our customers, providers, or other authorized parties, including contact information, date of birth, address, health history, medical-questionnaire responses, medication interests, eligibility information, identification information where required, payment-related information, provider-review status, pharmacy-workflow information, and related communications. Some of this information may be PHI under HIPAA when collected or processed on behalf of a covered entity or business associate under an applicable Business Associate Agreement.

Payment information. We may collect billing and transaction information related to setup fees, platform fees, subscriptions, consultations, administrative services, or other eligible services. Payment information may be processed by third-party payment processors, and we do not store full payment-card numbers unless expressly stated and supported by a compliant processor.

Automatically collected information. When you visit our website or use our services, we may automatically collect IP address, device type, browser type, operating system, referring URLs, pages viewed, time on pages, clickstream data, approximate location derived from IP address, and information from cookies, pixels, and similar technologies.

Cookies and tracking technologies. We may use cookies, pixels, tags, scripts, and similar technologies to operate our website, analyze traffic, improve our services, remember preferences, measure advertising performance, and support marketing campaigns. These may be provided by third parties such as analytics providers, advertising platforms, CRM tools, scheduling tools, and hosting providers. You can control cookies through your browser settings, and disabling cookies may affect functionality.

3. Website Information Versus Healthcare Workflow Information

Information collected through our public marketing website, sales forms, newsletter forms, demo requests, advertising campaigns, or general business communications is generally treated as business or marketing information. Information submitted through designated patient-intake, provider-review, pharmacy-workflow, or healthcare-related platform workflows may be treated differently and may be subject to HIPAA, applicable Business Associate Agreements, healthcare-privacy laws, and additional contractual requirements. Submitting information through a general website form does not automatically make it PHI under HIPAA, which generally applies only when information is collected, created, received, maintained, or transmitted by or on behalf of a covered entity or business associate in connection with healthcare services.

4. How We Use Information

We may use information to:

• provide, operate, maintain, and improve our website and services;
• respond to inquiries and demo requests, and evaluate potential customers, partners, providers, pharmacies, or vendors;
• onboard customers, configure and provide platform access, and provide administrative support;
• coordinate provider-review and pharmacy-partner workflows where applicable;
• process payments and manage billing;
• communicate service updates, operational notices, support messages, and permitted marketing;
• personalize experiences, analyze usage, and improve performance;
• monitor security, prevent fraud, and protect the rights, safety, and property of Karpa Health and others;
• comply with legal, regulatory, contractual, and payment-processor requirements; and
• enforce our Terms of Service and other agreements.

5. Aggregated and De-Identified Data

We may create aggregated, anonymized, or de-identified information from the information we collect, and we may use and disclose such information for any lawful purpose, including operating, improving, and developing our services, analytics, benchmarking, and marketing, provided that we do not attempt to re-identify it except as permitted by law. This Privacy Policy does not restrict our use or disclosure of aggregated or de-identified information.

6. How We Share Information

Customers and authorized business users. If our services are provided for a business customer or partner, information submitted through that customer’s workflows may be shared with that customer and its authorized users, subject to applicable agreements and permissions.

Licensed healthcare providers. Where applicable, patient or prospective-patient information may be shared with independent licensed providers for intake review, eligibility review, consultation, treatment and prescription decisions, follow-up, documentation, and related services. Karpa Health does not make clinical decisions.

Pharmacy partners. Where applicable, information may be shared with independent licensed pharmacy partners to support pharmacy review, fulfillment, dispensing, shipping, patient support, adverse-event handling, compliance, and related operational requirements. Karpa Health does not dispense, compound, manufacture, or ship medications.

Service providers. We may share information with vendors that help us operate, including hosting and cloud infrastructure, CRM and sales tools, email and communication platforms, scheduling tools, payment processors, analytics and advertising providers, customer-support tools, security and fraud-prevention providers, professional advisors, and data-storage and workflow-automation providers, each of which may use information only as permitted by our agreements and applicable law.

Payment processors. We may share information with payment processors to process payments, prevent fraud, manage subscriptions, comply with processor rules, and support billing, subject to the processor’s terms and privacy practices.

Legal and compliance disclosures. We may disclose information where we believe it necessary or appropriate to comply with law, regulation, legal process, subpoena, or government request; enforce our agreements; respond to claims or disputes; protect the rights, safety, or property of Karpa Health or others; or detect, prevent, or address fraud, security, or technical issues.

Business transfers. We may disclose or transfer information in connection with a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar transaction.

7. HIPAA and Protected Health Information

Karpa Health may act as a business associate or subcontractor business associate when it creates, receives, maintains, or transmits PHI on behalf of a covered entity or another business associate. When required, Karpa Health enters into Business Associate Agreements that govern our use and disclosure of PHI, and in those cases our use and disclosure of PHI is governed by the applicable Business Associate Agreement, HIPAA, and other applicable healthcare-privacy laws. To the extent of any conflict between this Privacy Policy and an applicable Business Associate Agreement with respect to PHI, the Business Associate Agreement controls. Customers are responsible for using the services in accordance with applicable laws, professional obligations, and contractual requirements.

8. Your Privacy Responsibilities

If you are a business customer, partner, provider, or pharmacy partner, you are responsible for your own compliance with applicable privacy and data-protection laws with respect to information you collect, control, or submit through your brand or workflows, including providing all required privacy notices and obtaining all required consents and authorizations from your customers, patients, leads, staff, and users. You represent that you have a lawful basis and all rights necessary to provide any information you submit to us. You shall not submit PHI to Karpa Health except through designated secure workflows or as otherwise authorized in writing.

9. Marketing Communications

We may use contact information to send marketing emails, newsletters, product updates, educational content, offers, and other business communications. You may unsubscribe using the link in the email or by contacting us. Even if you opt out of marketing, we may still send transactional, legal, security, billing, or service-related messages.

10. SMS and Phone Communications

If you provide your phone number, we may contact you by phone or text for sales, onboarding, support, operational updates, or other service-related purposes. Where required by law, we will obtain appropriate consent before sending marketing texts. Message and data rates may apply. You may opt out of texts by replying STOP or following the instructions in the message.

11. Advertising, Analytics, and Opt-Out Preference Signals

We may use third-party analytics and advertising tools to understand traffic, improve and market our services, and measure advertising performance. These tools may collect information through cookies, pixels, tags, and similar technologies and may be used for measurement, targeted advertising, retargeting, and analytics. Where required by applicable law, we honor recognized opt-out preference signals, such as the Global Privacy Control, as a valid request to opt out of sale or sharing for the browser or device from which the signal is sent. Depending on your location, you may have the right to opt out of certain targeted advertising or data-sharing practices.

When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email addresses. You may opt out of receiving this advertising by visiting https://app.retention.com/optout.

12. Do Not Sell or Share Personal Information

Karpa Health does not sell personal information for money. Certain privacy laws define “sale” or “sharing” broadly to include some advertising, analytics, or retargeting activities involving third-party cookies or pixels. To the extent our use of these technologies is considered a “sale” or “sharing” under applicable law, eligible users may opt out by contacting us at [email protected] or using any “Do Not Sell or Share My Personal Information” link we make available where required.

13. Data Retention

We retain information for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, unless a longer period is required or permitted by law. Retention periods may vary by type of information, context, legal and regulatory requirements, contractual obligations, business needs, dispute resolution, security requirements, and backup practices. Healthcare-related information may be retained in accordance with applicable provider, customer, legal, regulatory, contractual, or Business Associate Agreement requirements.

14. Security

We use administrative, technical, and physical safeguards designed to protect information against unauthorized access, loss, misuse, disclosure, alteration, or destruction, which may include access controls, encryption, logging, authentication, vendor review, and data minimization. No system or method of transmission is completely secure, and we cannot guarantee absolute security. To the fullest extent permitted by law, you use our website and services, and transmit information to us, at your own risk, and our liability for any security incident is subject to the limitations in our Terms of Service.

15. Your Privacy Choices

Depending on your location and applicable law, you may have rights to access, correct, delete, or receive a copy of personal information; opt out of certain marketing; opt out of certain targeted advertising, sale, or sharing; limit certain uses of sensitive personal information; and appeal certain decisions. To exercise these rights, contact us at [email protected]. We may need to verify your identity, and we will not discriminate against you for exercising privacy rights. Some requests may be limited or denied as permitted by legal, regulatory, contractual, security, healthcare, or operational requirements, and requests concerning PHI or information controlled by a customer or provider may be directed to that party.

16. California Privacy Notice

This section applies to California residents to the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to Karpa Health. When Karpa Health processes personal information on behalf of a business customer, it acts as that customer’s service provider or contractor and processes such information only as permitted by its agreement with the customer.

Categories of personal information we may collect. Identifiers; commercial information; internet or network activity; geolocation information; professional or employment-related information; sensitive personal information where submitted through healthcare-related workflows or otherwise provided; inferences; and other information you provide.

Sources. You directly; your business or organization; patients or prospective patients using customer workflows; providers, pharmacies, vendors, or partners; website analytics tools; advertising platforms; CRM, scheduling, and communication tools; payment processors; publicly available sources; and other third parties where permitted.

Purposes. The business and commercial purposes described in this Privacy Policy, including providing services, responding to inquiries, onboarding, supporting healthcare-related workflows, processing payments, marketing, analytics, security, compliance, and legal obligations.

Categories of third parties. Customers and authorized users; licensed providers; pharmacy partners; payment processors; cloud hosting and technology providers; analytics and advertising providers; CRM, support, and communication vendors; professional advisors; government authorities or others when required by law; and parties involved in a business transfer.

Sale or sharing. We do not sell personal information for money. We may use advertising or analytics technologies that could be considered “sharing” or “sale” under California law, and California residents may opt out as described in Section 12.

Sensitive personal information. We do not use or disclose sensitive personal information for purposes other than those permitted by applicable law, such as providing requested services, security, fraud prevention, legal compliance, or healthcare-related workflows.

California rights. California residents may have the right to know, access, correct, and delete personal information; opt out of sale or sharing; limit certain uses of sensitive personal information; and not be discriminated against for exercising these rights. To exercise these rights, contact us at [email protected]. Authorized agents may submit requests where permitted, subject to verification of the resident’s identity and the agent’s authority.

17. Other State Privacy Rights

Residents of certain other states may have additional rights under applicable state privacy laws, which may include access, correction, deletion, portability, opt-out of targeted advertising, opt-out of sale, opt-out of certain profiling, and the right to appeal a denied request. The specific rights and exemptions vary by state, and for some information Karpa Health acts as a processor on behalf of a controlling customer rather than as a controller. To exercise applicable state privacy rights or to appeal a decision, contact us at [email protected].

18. Children’s Privacy

Our website and services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. We do not knowingly sell or share the personal information of consumers under 16 years of age without affirmative authorization as required by applicable law. If you believe a child has provided personal information to us, contact us at [email protected] and we will take appropriate steps to delete it where required. Healthcare-related services involving minors, if any, must be handled by licensed providers in accordance with applicable law, consent requirements, and customer or provider workflows.

19. Third-Party Websites and Services

Our website and services may link to or integrate with third-party websites, platforms, providers, pharmacies, payment processors, scheduling tools, or other services. We are not responsible for the privacy practices, content, policies, or security of third-party websites or services, and your use of them is subject to their terms and privacy policies.

20. International Users; Not Directed to the EEA or UK

Karpa Health is based in the United States, and our services are intended for users located in the United States. Our website and services are not directed to individuals located in the European Economic Area, the United Kingdom, or Switzerland, and we do not intend to offer services to or collect information from individuals in those regions. If you access our services from outside the United States, you do so on your own initiative, your information may be transferred to, stored in, and processed in the United States or other jurisdictions where our service providers operate, and you are responsible for compliance with local law.

21. No Rights Beyond Applicable Law; Relationship to Terms

This Privacy Policy supplements, and is incorporated into, our Terms of Service. To the extent permitted by law, your use of our website and services, and any dispute relating to privacy, is governed by the Terms of Service, including its governing-law, limitation-of-liability, and dispute-resolution provisions. Nothing in this Privacy Policy creates any right or remedy beyond those provided by applicable law.

22. Changes to This Privacy Policy

We may update this Privacy Policy from time to time and will update the “Last updated” date above. If we make material changes, we may provide additional notice where required by law, such as by posting a notice on our website or contacting you directly. Your continued use of our website or services after an updated Privacy Policy is posted means you acknowledge the updated Privacy Policy.

23. Contact Us

Karpa Health LLC Email: [email protected] Website: https://karpahealth.com

For healthcare-related privacy requests involving a provider, clinic, customer, or pharmacy partner, we may direct you to the applicable covered entity, provider, customer, or pharmacy partner as required by law or contract.