Legal
Privacy policy
What we collect, who touches it, and what we will never do with it.
Pre-launch draft. This is a structural placeholder so the link resolves and the information architecture is testable. It has not been reviewed by counsel and must be replaced with a lawyer-reviewed policy before SturdyMD accepts a single real order. A telehealth company handling health information has HIPAA, state privacy law and state telehealth obligations that a template cannot satisfy.
What we collect
- Account information — name, email, phone, shipping address, date of birth.
- Health information — your intake answers, medication and allergy history, any labs you upload, and your messages with your care team.
- Payment information — processed by our payment processor. We do not store full card numbers.
- Device and usage information — standard log data, and cookies as described below.
How we use it
To let a licensed provider evaluate whether a treatment is appropriate for you, to have a licensed pharmacy dispense and ship it, to support you afterward, to take payment, and to meet our legal and recordkeeping obligations.
Who we share it with
Your treating providers and the dispensing pharmacy, and the vendors that operate the service on our behalf (payment processing, shipping, hosting, customer support) under contracts limiting what they may do with it. We also disclose information where the law requires it.
We do not sell your personal information, and we do not share your health information with advertisers.
Advertising and analytics
We use analytics and advertising cookies on our marketing pages. These are never populated with your intake answers, your diagnoses, or your prescriptions.
Your choices
Depending on your state, you may have the right to access, correct, delete, or receive a copy of your information, and to opt out of certain sharing. Requests go to privacy@sturdymd.com. Note that medical records must be retained for a period set by law even after an account is closed.
Security
Information is encrypted in transit and at rest, and access is limited to people who need it to do their job. No system is perfectly secure, and we will not claim otherwise.
Children
The service is for adults 18 and older. We do not knowingly collect information from children.
Changes
If this policy changes materially we will post the new version here and update the date below.
Contact
Last updated: pre-launch draft, not yet in effect.