Privacy Policy

Introduction

Prime Metabolic LLC ("Prime Metabolic," "we," "our," or "us") is committed to protecting the privacy and security of your personal and health information. This Privacy Policy describes how we collect, use, disclose, and safeguard information when you visit our website at prime-metabolic.com, use our telehealth platform, or interact with us in any capacity as a prospective or active patient.

By accessing our website or enrolling in our program, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the terms described here, please do not use our services.

This policy applies to all information collected by Prime Metabolic LLC, a Delaware limited liability company. It does not govern third-party websites or services that may be linked from our platform, including LillyDirect or other pharmacy fulfillment partners.

Information We Collect

Information You Provide Directly

When you create an account, complete our medical intake form, join the waitlist, or contact us, we may collect:

• Full name, date of birth, and contact information (email address, phone number, mailing address)
• Medical history, current medications, allergies, and relevant health conditions
• Lab results, body measurements, and biometric data you submit as part of your care plan
• Payment information processed securely through our payment processors (we do not store full card numbers)
• Communications you send to us, including messages to your assigned physician or our support team
• Survey responses and feedback provided voluntarily

Information Collected Automatically

When you visit our website, we may automatically collect certain technical data, including:

• IP address, browser type, and operating system
• Pages visited, time spent on pages, and referral URLs
• Device identifiers and general geographic location (city/region level)
• Cookie data and similar tracking technologies (see Section 6)

Information from Third Parties

We may receive information about you from third parties in connection with your care, such as laboratory testing partners (e.g., Quest Diagnostics, LabCorp), pharmacy partners (e.g., LillyDirect), and identity verification services. We handle all such information in accordance with this Privacy Policy and applicable law.

How We Use Your Information

We use the information we collect for the following purposes:

Delivering & Managing Your Care

• Matching you with a named physician and supporting your ongoing clinical relationship
• Processing medical intake, issuing prescriptions, and coordinating medication fulfillment
• Scheduling and conducting telehealth consultations and check-ins
• Ordering and interpreting your quarterly metabolic lab panels
• Monitoring treatment progress and adjusting your care plan as clinically appropriate

Operations & Communications

• Responding to your inquiries, support requests, and feedback
• Sending appointment reminders, prescription status updates, and care-related communications
• Processing billing and managing your account
• Sending program updates and waitlist notifications (you may opt out at any time)

Safety, Compliance & Improvement

• Maintaining the safety and integrity of our platform
• Complying with applicable federal and state laws, including HIPAA, state telehealth regulations, and DEA requirements
• Detecting and preventing fraud, unauthorized access, and other harmful activity
• Analyzing aggregate, de-identified data to improve our clinical protocols and patient experience

We do not use your personal or health information for advertising purposes or to build marketing profiles without your explicit consent.

How We Share Your Information

Prime Metabolic does not sell your personal information. We share your information only in the following limited circumstances:

Your Care Team

Your information is shared with your assigned physician and, where clinically necessary, with other licensed healthcare professionals involved in your care.

Service Providers & Business Associates

We share information with trusted vendors who assist us in operating our business and delivering your care. These include laboratory testing partners, pharmacy and medication fulfillment services (including LillyDirect), telehealth infrastructure providers, payment processors, and electronic health record systems. All such vendors are bound by Business Associate Agreements (BAAs) where applicable under HIPAA, and by contractual obligations that prohibit them from using your information for any purpose other than providing services on our behalf.

Legal Requirements

We may disclose your information when required to do so by law, court order, subpoena, or government regulation; to comply with mandatory reporting obligations (e.g., public health authorities); or when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Prime Metabolic, our patients, or the public.

Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email or a prominent notice on our website if such a change occurs, and you will have the opportunity to exercise applicable privacy rights.

With Your Consent

We may share your information for other purposes with your explicit prior consent.

HIPAA & Health Data

Your PHI includes any health information that can be linked to your identity, such as diagnoses, prescriptions, lab results, treatment notes, and demographic information collected in connection with your care. We maintain HIPAA-compliant administrative, technical, and physical safeguards to protect the confidentiality, integrity, and availability of your PHI.

We use and disclose your PHI only as permitted or required by HIPAA and as described in our Notice of Privacy Practices. You have specific rights under HIPAA regarding your PHI, including the right to access, amend, and request an accounting of disclosures. To exercise HIPAA-specific rights, please contact our Privacy Officer using the information in Section 12.

Cookies & Tracking Technologies

We use cookies and similar tracking technologies on our website to understand how visitors interact with our content and to improve the user experience. We do not use advertising cookies or sell browsing data to third parties.

Types of Cookies We Use

• Essential cookies: Required for the website and patient portal to function securely. These cannot be disabled.
• Analytics cookies: Help us understand page performance, traffic sources, and user behavior in aggregate. We may use tools such as Google Analytics with IP anonymization enabled.
• Preference cookies: Remember your settings and display preferences across visits.

You can manage or disable non-essential cookies through your browser settings or via the cookie preference tool available on our website. Note that disabling certain cookies may affect the functionality of some features.

Data Retention

We retain your personal and health information for as long as necessary to fulfill the purposes described in this Privacy Policy and to comply with our legal and regulatory obligations.

Medical records and Protected Health Information are retained in accordance with applicable state and federal requirements, which generally range from 7 to 10 years from the date of last treatment, or from the date a minor patient reaches the age of majority, whichever is later.

Waitlist and contact information for individuals who have not enrolled in our program is retained for up to 24 months from the date of submission, or until you request deletion, whichever occurs first.

When we no longer have a lawful basis or operational need to retain your information, we securely delete or de-identify it in accordance with our data retention schedule.

Your Privacy Rights

Depending on your state of residence, you may have the following rights with respect to your personal information:

• Right to Access: Request a copy of the personal information we hold about you.
• Right to Correction: Request that inaccurate or incomplete information be corrected.
• Right to Deletion: Request that we delete your personal information, subject to legal retention obligations.
• Right to Restrict Processing: Request that we limit how we use your information in certain circumstances.
• Right to Portability: Receive your information in a structured, machine-readable format.
• Right to Opt Out: Opt out of marketing communications at any time by clicking "unsubscribe" in any email or by contacting us directly.

Residents of California have additional rights under the California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA), including the right to know the specific pieces of personal information collected, the right to non-discrimination for exercising privacy rights, and the right to opt out of the sale or sharing of personal information (we do not sell or share personal information as defined by the CCPA).

To exercise any of these rights, please submit a request to hello@prime-metabolic.com. We will respond within the timeframe required by applicable law (generally 30–45 days). We may need to verify your identity before processing your request.

Data Security

We implement industry-standard administrative, technical, and physical safeguards to protect your information from unauthorized access, use, disclosure, alteration, or destruction. These measures include:

• TLS/SSL encryption for all data in transit between your device and our servers
• AES-256 encryption for data at rest, including all patient health records
• Role-based access controls ensuring that only authorized personnel access your information on a need-to-know basis
• Multi-factor authentication for all staff and clinician accounts
• Regular security assessments, penetration testing, and third-party audits
• HIPAA-compliant infrastructure hosted in SOC 2 Type II certified data centers

No method of transmission over the internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security. In the event of a data breach affecting your rights and freedoms, we will notify you as required by applicable law.

Children's Privacy

Our services are intended exclusively for adults aged 18 and older. We do not knowingly collect personal information from individuals under the age of 18. If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us immediately at hello@prime-metabolic.com and we will take prompt steps to delete that information from our records.

Our services do not comply with the Children's Online Privacy Protection Act (COPPA) because they are not directed at children. We will not accept registrations from individuals who identify themselves as under 18 years of age.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by updating the "Last updated" date at the top of this page and, where appropriate, by sending an email notification to the address associated with your account or by displaying a prominent notice on our website.

We encourage you to review this Privacy Policy periodically. Your continued use of our services after any changes become effective constitutes your acceptance of the updated policy. If you do not agree to the revised policy, please discontinue use of our services and contact us to close your account.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your information, please contact us. We take all privacy inquiries seriously and will respond promptly.

For HIPAA-specific requests, including access to or amendment of your Protected Health Information, please refer to our Notice of Privacy Practices.