Privacy Policy

BraveRX’s Privacy Policy outlines the obligations of all users of the platform. This policy is a continuation of the Terms of Service, so it is important to read both documents together.

BraveRX shall not (a) be subject to any obligations of confidentiality regarding any User Content except as specified in BraveRX’s Privacy Policy, or as otherwise specifically agreed to or required by law; (b) be obligated to pay you or any third party any compensation for any User Content; and (c) be required to respond to any of your submissions as User Content.

Exercising your rights. Requests to access, correct, or delete your information — under HIPAA, the GDPR, or the CCPA — go to legal@braverx.com. See Your rights under HIPAA below for what each request involves and how long we take to answer.

Information collection

BraveRX collects certain personally identifiable information about you, including information that is reasonably capable of being associated with you (“Information”).

When registering an account on our BraveRX Platform, it is mandatory to provide your Contact Information and Financial Information. As a user, this includes your first and last name, email address, phone number, and birth date, which are necessary for the creation and management of your BraveRX account. We also use this information to verify your identity before your first order ships, and we may ask you for additional information if we need it to complete that verification.

Personal health information

By creating an account with BraveRX, you are establishing a direct customer relationship to utilize the Service. Throughout your use of the Service, you may furnish information to BraveRX, such as your name, email, social media profiles, date of birth, phone number, address, and transactional details. We categorize this information as not constituting “protected health information” or “medical information.”

You may also share certain health or medical information protected by applicable laws with BraveRX. BraveRX is not identified as a “covered entity” under the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, and its related regulations and amendments (“HIPAA”). The Pharmacies, Medical Groups, and/or Providers associated with the Service may or may not be “covered entities” or “business associates” under HIPAA. However, in specific cases, BraveRX might be deemed a “business associate” of a Pharmacy or Medical Group.

HIPAA may not be applicable solely based on the involvement of health information, and it might not govern transactions and/or communications with BraveRX, the Pharmacies, Medical Groups, and/or Providers of the Service. In instances where BraveRX is regarded as a “business associate,” it could be subject to specific HIPAA provisions regarding protected Health Information (“PHI”) that you share with BraveRX, the Pharmacies, Medical Groups, and/or Providers. Moreover, any medical and/or health information subject to protections under applicable state laws will be handled in compliance with those laws (collectively, “Protected Information”). However, information not qualifying as Protected Information under applicable laws may be utilized or disclosed as outlined in this Privacy Policy.

The Pharmacies, Medical Groups, and/or Providers each maintain their own Privacy Policy notices outlining how they handle and disclose Protected Information. By using the Service, you acknowledge receipt and confirm that you have read, accepted, and adhere to the Privacy Policies of the Pharmacies, Medical Groups, and/or Providers, available on their respective websites.

By accessing or using the Service, you acknowledge that any information submitted to BraveRX that can be used to identify an individual — including, but not limited to, your name, email, social media profiles, date of birth, phone number, address, and transactional details — is considered Protected Health Information (PHI) under HIPAA. This information is subject to the Privacy Rule, which protects all “individually identifiable health information” held or transmitted by a covered entity or its business associate. The Privacy Rule ensures the protection of this information when it relates to:

• the individual’s past, present, or future physical or mental health or condition;
• the provision of health care to the individual; or
• the past, present, or future payment for the provision of health care to the individual.

All such information, whether it is in electronic, paper, or oral form, is protected under our Privacy Policy and in accordance with HIPAA regulations and applicable state laws governing privacy and security.

Information BraveRX collects automatically

Device data

This includes gathering data concerning the device or browser you utilize, the operating system of your device, your internet service provider, the regional and language settings of your device, and device identifiers like IP address.

When you access and engage with the BraveRX Platform, BraveRX may automatically collect specific information through cookies or other technologies. This information encompasses details such as the type of computer or mobile device you use, the unique device ID of your mobile device, the IP address of your computer or mobile device, your operating system, the type(s) of internet browser(s) you use, and information about how you utilize the BraveRX Platform (referred to as “Device Information”).

Cookies

We use “cookies” and equivalent technologies to collect information through our Website. Cookies are small data files stored on your device that act as a unique tag to identify your browser. We also use analytics tracking software provided by Google.

Persistent cookies help with personalizing your experience, remembering your preferences, and supporting security features. Additionally, persistent cookies allow us to bring you advertising both on and off the Platform. Persistent cookies may remain on your device for extended periods of time and generally may be controlled through your browser settings. We utilize persistent cookies that only BraveRX can read and use, and access mobile device IDs, to:

• save your login information for future logins to the BraveRX Platform;
• assist in processing items during checkout;
• hold session information; and
• track user preferences.

Session cookies make it easier for you to navigate our Website and expire when you close your browser. We utilize session ID cookies and similar technologies to:

• enable certain features of the BraveRX Platform;
• better understand how you interact with the Websites/Apps and the BraveRX Platform;
• monitor usage by our Users and web traffic routing on the BraveRX Platform;
• track the use of BraveRX promotions and offers; and
• identify visited areas of the BraveRX Platform.

How we use your information

The main objective of gathering your information is to enhance your experience while using the Services. We utilize your information to closely observe the most utilized features of the Services and identify areas that require improvement. This includes analyzing usage patterns and geographic locations to determine the optimal places to offer or concentrate our services, features, and resources.

We also use information that we collect about you, or that you provide us:

• to enable Service providers to provide services to you;
• to operate and make available our Platform, including connecting you with the providers and pharmacies that deliver your care and processing payment for your orders, in order to fulfill our contracts with Users;
• for billing and fraud prevention, on the basis of our legitimate interests in ensuring a safe and secure environment for our Users, and in order to comply with our legal obligations;
• to verify your identity, in order to further our legitimate interests in preventing or uncovering unlawful activities, safeguarding the public from dishonesty, and upholding the integrity of the BraveRX Platform;
• to analyze BraveRX Platform usage as necessary for our legitimate interest in improving the BraveRX Platform to grow our business;
• to get in touch with you and send you transactional information, administrative notices, marketing notifications, offers, and communications related to your use of the BraveRX Platform. This may be done through email, SMS, push notifications, or other means. We will obtain your consent when necessary according to applicable law;
• to provide you with customer support in order to fulfill our contracts with Users;
• for internal market research for our legitimate interest in improving the BraveRX Platform to grow our business;
• for troubleshooting problems for our legitimate interests in ensuring a safe and secure environment for Users;
• to enforce our Terms of Service and our legitimate interests in ensuring our Agreement is complied with;
• to improve the User Experience;
• to provide, develop and improve BraveRX and its services, including making assessments and recommendations about the Service;
• to notify you about changes to our Website or any services that we offer or provide through it;
• to allow you to participate in interactive features on our Website; and
• for any other purpose with your consent.

We also collect Users’ Personal Information for administrative purposes such as addressing account and troubleshooting Website issues, investigating abuse on the Website, responding to User inquiries, and enforcing and applying our Terms and Conditions of Service.

BraveRX uses IP addresses for systems administration purposes.

Disclosures we may make

We may also release Personal Information or other information we collect if we believe that such action is necessary to:

• comply with legal requirements and processes;
• identify, contact or bring legal action against persons or entities who are, or we believe have caused or might cause, injury to us or a third party;
• defend or respond to claims brought or threatened against us, our employees, service providers, users of our Services, or others;
• share with vendors, service providers and technicians who help with some of our processing and storage, including helping to answer your questions; and/or
• otherwise protect and assert the rights and interests of BraveRX and of our employees, service providers, Users of the Services, or others.

Any such release decisions may be made by us in our sole discretion. Although we aim to choose our third-party collaborators carefully, we cannot be held accountable for how they utilize your personal information.

Furthermore, considering that User information present on our Website holds value as a business asset, if we undergo reorganization, sale, or merger with another company, we reserve the right to sell, assign or transfer your personal information to the buyer of our business assets or to a relevant affiliate, as applicable.

Mobile and text messaging. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All of the categories above exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Information sharing

To grant you access to the Services, certain third parties engaged by BraveRX to perform various services — such as hosting, analytical tasks, data management, or similar functions, or those acting on our behalf (“Service Providers”) — may have access to your personal information, including your Health Information. These Service Providers are authorized to utilize your information solely for the designated service and are prohibited from sharing it with any third parties. They are obligated to adhere to the terms outlined in our Privacy Policy, which includes implementing reasonable measures to ensure the security of your personal information.

Periodically, we may engage trusted third-party providers who receive your personal information or Health Information to conduct anonymized, aggregate analyses of the data. Our contractual agreements mandate that these partners maintain sufficient security measures for the provided personal information. We strictly prohibit such third parties from selling your personal information to other entities.

Third-party platforms

BraveRX connects with various third-party devices and services, including our payment processors Stripe, PayPal, Google Pay, and Apple Pay, to ensure the best service for you. The website might contain links to other websites that are not maintained by us, and we want to clarify that BraveRX is not responsible for the privacy policies or practices of these third parties or their websites. This includes any apps linked to or linking from our website.

If you disclose personally identifiable information to these third parties, they may have different rules regarding its use and disclosure. We strongly advise you to review the privacy policies of these websites before sharing your personal information with them. By linking to third-party websites, you may be subject to their terms and conditions as well as other policies. BraveRX cannot guarantee the accuracy or authenticity of the information found on these third-party websites, and any link you establish with another website is done at your own risk. BraveRX holds no liability in such cases.

Opting out or unsubscribing

In order to provide you with our daily, weekly, or monthly newsletter service, we gather your name and email address. The email address you provide will be utilized to deliver the information you have requested from this website.

The data we gather is solely utilized to fulfill the requested services, and we do not disclose it to any other entities for business motives. Under no circumstances will we sell or lease your email address.

To unsubscribe from our emails or other communications from us, you may follow the “unsubscribe” link at the bottom of the email, or sign in to your account and change your settings. However, this section does not cover the messages and advertisements you may receive from the Website.

How long is this data stored for?

Your data will be stored as long as you have an active account with us. Please be aware that if you decide to close your account, your data will not be immediately deleted. If you wish to have your data deleted immediately, you can send us an email requesting so.

See Data retention below for the typical retention periods by category.

Security

We take the security of your data very seriously, but no data transmission or storage is 100% secure. This means that there is always a risk that your information could be stolen, destroyed, or inadvertently disclosed. While we take steps to protect your information, we cannot guarantee its absolute security.

The safety and security of your information also depend on you. Where we have given you — or where you have chosen — a password for access to certain parts of our Website, you are responsible for keeping this password confidential. We advise you not to share your password with anyone.

User data rights

By using our Services and participating in our marketing activities, you expressly give consent for the collection and use of your personal information as outlined in this Privacy Policy. This consent does not hinder the lawful processing allowed by other legal bases, such as fulfilling contractual obligations, complying with applicable laws, and pursuing legitimate purposes.

Child protection

Our Services are only available to individuals who are at least 18 years old. If we learn that we have collected information from anyone under the age of 18, we will take appropriate steps to delete or eliminate such information from our records.

Your rights under HIPAA

You also have the right and choice to instruct us on:

• sharing information with family, close friends, or others involved in your care;
• sharing information in a disaster relief situation; and
• including your information in a hospital directory.

Your rights under the GDPR

If you are part of the EU, you possess the following entitlements:

• Request more information. If you wish to gain further knowledge, or have any reason to do so, you may request additional information regarding the data we gather. Likewise, if you intend to lodge a complaint, you may also express your wish.
• Access any data we’ve collected. You may ask for a detailed disclosure of the personally identifiable data we have gathered.
• Update any data we’ve collected. You may ask for the rectification, modification, or updating of any or all of the personally identifiable information we have gathered.
• Delete any or all data we’ve collected. You may ask for the deletion and removal of any or all of the personally identifiable information we have gathered, ensuring it is no longer retained in our records.
• Revoke consent. You may withdraw your consent for the collection and utilization of your data at any time.

In order to exercise any of these rights, simply contact us.

Right to access or correct personal information

You are entitled to access and rectify your personal information. If you wish to review or make corrections to your personal information, you can visit your account profile page or email us at legal@braverx.com.

Once we receive your written request, we will provide you with a copy of your Personal Information. However, in certain exceptional cases, we may be unable to disclose all relevant information if it pertains to another user. If this situation arises, we will provide you with an explanation upon request. We strive to address all requests for access and modifications promptly. We will make reasonable efforts to ensure the accuracy and currency of your Personal Information and offer you options to update, correct, delete, or add to it as necessary. Any amended Personal Information will be shared with authorized parties as permitted by our disclosure policies.

Notice to EU residents

Personal information. With respect to EU data subjects, the term “personal information” as used in this Privacy Policy is equivalent to “personal data” as defined in the European Union General Data Protection Regulation (GDPR).

Processing purposes. To communicate with you, to optimize our platform for compliance, to prevent fraud, and to provide our Service.

Sensitive data. Some of the information you provide us may constitute sensitive data as defined in the GDPR (also referred to as special categories of personal data), including health information and information used to verify your identity.

Legal bases for processing. Your personal information is utilized in accordance with the law. It is necessary for us to inform you about the legal grounds on which we process your personal data. Should you have any inquiries regarding the legal bases for processing your personal information, please reach out to us at legal@braverx.com.

Our legitimate interests encompass these processing activities. Before proceeding with the processing of your personal information for these interests, we make an effort to evaluate and balance the potential effects on you, both positive and negative, as well as your rights. We refrain from utilizing your personal information for activities that would negatively outweigh our interests unless we have obtained your consent or are legally obligated or permitted to do so.

If we rely on your consent as the basis for using your personal information, you retain the right to withdraw it at any time. You can do this by following the instructions provided in the Service or by reaching out to us at legal@braverx.com.

Your rights. Under the GDPR, you may ask us to take the following actions about the personal information that we hold:

Data subject access rights requests. In order to verify your identity and handle your request effectively, we might ask you for certain details. Depending on the relevant laws, there may be instances where we are obligated or allowed to reject your request. If your request is declined, we will provide an explanation within the limits imposed by the law.

If you wish to file a complaint about the usage of your personal information, or address any concerns regarding it, please reach out to us at legal@braverx.com.

Use for new purposes. Where it is legally allowed and aligns with the original purpose of collecting your personal information, we might utilize it for purposes not explicitly mentioned in this Privacy Policy. If there arises a need to use your personal information for an unrelated purpose, we will inform you and clarify the legal justification for such usage. In cases where we have relied on your consent for a specific use, we will seek your consent again for any unrelated purpose. If you object to such usage, you will have the option to discontinue using the Service.

Data retention

Your Personal Data is stored securely during the entire duration of your account with us. We will keep your Personal Data only for the duration required to fulfill the purposes for which it was collected, such as meeting legal, accounting, or reporting obligations, or resolving disputes. The factors we consider when deciding how long to retain your data include the current contractual agreements, legal and statutory limitation periods, relevant regulatory requirements, and industry standards.

The duration for which we retain your personal data varies depending on the jurisdiction. Our typical retention periods are:

Information collected by technical means is typically retained in a de-identified and aggregated form, unless we detect potential abuse of our Service — in which case we will retain the information to help us prevent future abuse. This anonymized and aggregated information cannot be linked to you, your household, an IP address, or any personal information stored.

Notice to California residents (CCPA)

In this section, we provide further details regarding the personal information we gather about individuals residing in California, as well as the rights granted to them under the California Consumer Privacy Act (“CCPA”).

As per California Civil Code Section 1789.3, users in California have specific entitlements related to consumer rights, and we want to make sure they are aware of them. California residents have the option to contact the Complaint Assistance Unit of the Division of Consumer Services, which is part of the California Department of Consumer Affairs.

If you are a California consumer and wish to exercise your rights under the CCPA, you can get in touch with us at legal@braverx.com. In order for us to proceed with your request, you must first verify your identity. In compliance with California law, you are also allowed to designate an authorized agent to make a request on your behalf. To do so, you must supply a valid power of attorney, and we will verify the identity of both the requester and the authorized agent.

To learn about the specific categories of personal information we have collected from you, please refer to Information collection above. The purpose of collecting this information aligns with the business and commercial objectives outlined in How we use your information.

Please be aware that, upon request, we may share information related to fraud risk associated with an individual IP address with an Integrator.

The Company does not engage in the “selling” of personal information as defined by the CCPA.

The CCPA grants California consumers certain privileges within certain constraints. These privileges include the ability to inquire about specific categories or individual elements of their personal information that we gather (including its usage and disclosure), to have their personal information erased, to decline participation in any potential “sales,” and to be free from discrimination as a result of exercising these rights.

Changes to this Privacy Policy

Any information that we collect is subject to the Privacy Policy in effect at the time such information is collected. We may, however, revise the Privacy Policy from time to time. If a revision is material, as determined solely by us, we will try to notify you — for example, via email. The current version will always be posted to this page.

Contact

If you have any questions about this Privacy Policy, please contact us at legal@braverx.com.