Privacy Policy

---

TopMedMD Privacy Policy

This Privacy Policy describes how TopMedMD collects, uses, and shares your personal data.

In addition to this Privacy Policy, we provide data and privacy information embedded in our products and certain features that ask to use your personal information. This product-specific information is accompanied by our Data & Privacy Icon.

You will be given an opportunity to review this product-specific information before using these features. You also can view this information at any time, either in settings related to those features and/or online at TopMedMD.com under the heading Privacy Policy.

Please take a moment to familiarize yourself with our privacy practices, accessible via the headings below, and contact us if you have questions.

What Does TopMedMD Consider Personal Data?

At TopMedMD, we believe strongly in fundamental privacy rights. That they should not differ depending on where you live in the world. We treat any data that relates to an identified or identifiable individual or that is linked or linkable to them by TopMedMD as "personal data," no matter where the individual lives. This means that data given to TopMedMD that directly identifies you, such as your name, address, phone number or any other user specific data is personal data. TopMedMD maintains the privacy, confidentiality, and security of all personal and health-related information in accordance with applicable federal and state laws. These include, but are not limited to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health (HITECH) Act, the Children’s Online Privacy Protection Act (COPPA), the California Consumer Privacy Act (CCPA), and other relevant privacy regulations.

This Privacy Policy governs the collection, use, disclosure, retention, and protection of information obtained through your interaction with our Site, including any telemedicine services provided.

We also include data that does not directly identify you, but that can reasonably be used to identify you, such as the information used to deliver medications or to install your equipment is personal data. Aggregated and non-identifiable data is considered non-personal data for the purposes of this Privacy Policy.

This Privacy Policy covers how TopMedMD handles personal data whether you interact with us on our websites, through TopMedMD apps, or in person (including by phone or when visiting our licensed locations. TopMedMD's Privacy Policy does not apply to how third parties define personal data or how they use it. We encourage you to read their privacy policies and know your privacy rights before interacting with them.

Your Privacy Rights at TopMedMD

At TopMedMD, we respect your ability to know, access, correct, transfer, restrict the processing of, and delete your personal data. We have provided these rights to our customer base and if you choose to exercise these privacy rights, you have the right to be treated in a way that is not discriminatory. You also have to right to receive the same degree of service from TopMedMD regardless of status of your data. TopMedMD does not sell your data including as "sale" is defined in Nevada and California.

To exercise your privacy rights and choices including where a third-party service is a provider, visit that provider’s website and become familiar with their privacy policies and know your privacy rights before interacting with them. If the TopMedMD Data and Privacy page is not available in your region, you can make privacy rights requests at Contact Us.

There may be situations where we cannot grant your request. For example, if you ask us to delete your transaction data and TopMedMD is legally obligated to keep a record of that transaction to comply with law, we will be unable to grant your request. We may also decline to grant a request where doing so would undermine our legitimate use of data for anti­fraud and security purposes, such as when you request deletion of an account that is being investigated for security concerns. Other reasons your privacy request may be denied are if it jeopardizes the privacy of others, is frivolous or vexatious, or would be extremely impractical.

If you live in California, if you cannot access TopMedMD's Data and Privacy page, you or your authorized agent can make a request at Contact Us or by calling TopMedMD at ‪801.780.2887.

For additional information on other privacy policies and exercising your rights, visit Privacy Policy.

Protecting Your Health Information

We maintain the highest standards for safeguarding your protected health information (PHI) in accordance with the Health Insurance Portability and Accountability Act (HIPAA) and related regulations. As healthcare providers, we create, collect, and maintain detailed records of your medical care including diagnoses, test results, treatment plans, and billing information. This comprehensive documentation allows us to provide coordinated, high-quality care while ensuring your privacy rights remain protected at all times.

When you engage with our healthcare services - whether through in-person office visits, virtual telemedicine consultations, diagnostic testing, or ongoing treatment management - we implement multiple layers of security measures to protect your sensitive health data. Our electronic health record systems utilize advanced encryption technologies, while our staff undergoes rigorous training on proper information handling procedures. We maintain physical safeguards for paper records and implement strict access controls to ensure only authorized personnel can view your health information.

Appropriate Uses of Your Health Information

Your medical records serve several vital functions in your healthcare journey. Primary uses include facilitating direct patient care through information sharing with treating providers, enabling accurate billing and insurance processing, and supporting essential healthcare operations. For example, when we refer you to a specialist, we share relevant medical history to support coordinated treatment. Similarly, when processing insurance claims, we disclose necessary treatment details to secure proper payment for services rendered.

Beyond direct care purposes, we may use de-identified health data for quality improvement initiatives, allowing us to analyze treatment outcomes and enhance our services without compromising patient privacy. Certain public health reporting requirements may also necessitate disclosure of health information, such as mandatory reporting of communicable diseases to state health departments. In rare circumstances involving legal proceedings or serious threats to health and safety, we may be obligated to disclose information as permitted or required by law.

Your Rights and Our Responsibilities

As our patient, you maintain significant control over your health information. You may request access to your complete medical record, including test results, provider notes, and billing information. Should you identify any inaccuracies in your records, we provide a formal amendment request process to ensure your health information remains complete and correct. While we generally cannot restrict information sharing necessary for your treatment, you may request limitations on certain disclosures, particularly those related to payment when you've paid for services out-of-pocket.

We recognize that some health information carries special sensitivity, including mental health treatment records, substance abuse rehabilitation documentation, HIV/AIDS status, and genetic testing results. For these categories of information, we implement additional protections and follow specific legal requirements regarding disclosure. Our staff receives specialized training on handling these particularly sensitive records with the utmost confidentiality.

For our California patients, state law provides additional privacy protections under the California Consumer Privacy Act (CCPA). These include rights to know what personal information we collect, request deletion of certain data, and opt-out of specific data sharing practices. Regardless of your state of residence, we will never penalize or provide inferior service based on your decision to exercise any privacy rights.

Ongoing Compliance and Security

Maintaining the security and confidentiality of your health information is an ongoing priority. We conduct regular risk assessments of our information systems and implement necessary security updates. All business associates and third-party vendors who may handle your health information must sign comprehensive agreements guaranteeing they will maintain HIPAA-compliant safeguards. Our Privacy Officer oversees compliance with all federal and state privacy laws and serves as your point of contact for any questions or concerns about how we protect your health information.

We recognize that privacy regulations and technology continue to evolve, and we remain committed to regularly reviewing and updating our policies and procedures. This ensures we not only meet current legal requirements but exceed them whenever possible to provide you with the highest standard of privacy protection alongside exceptional medical care. You can trust that we handle your health information with the same care and professionalism we bring to your medical treatment.

Business Associate Agreement Compliance Statement

TopMedMD has established a thorough Business Associate Agreement (BAA) program that fully complies with all HIPAA regulations to ensure that protected health information (PHI) remains secure when working with outside vendors and partners.

Before sharing any PHI with third-party vendors or subcontractors, we require a signed BAA. These agreements cover all entities that handle PHI on our behalf, including those that create, receive, maintain, or transmit health information. This includes law firms, accounting services, consultants, cloud storage providers, and companies that help us analyze or anonymize health data.

Every BAA we sign contains essential protections required by HIPAA. The agreements strictly limit how vendors can use PHI, only allowing uses specifically permitted by the contract or required by law. Vendors are prohibited from using the data for any other purposes. They must implement strong security measures including administrative policies, physical safeguards, and technical protections that meet HIPAA's Security Rule standards, with specific requirements for encrypting data both when stored and during transmission.

If a security breach occurs, our BAAs require vendors to notify us promptly (within 60 days as required by law) and work with us to assess and address any risks. The agreements also control how vendors manage their own subcontractors, requiring our approval before sharing PHI with any additional companies and making sure those subcontractors follow the same strict rules.

We go beyond basic HIPAA requirements in our BAAs by including additional security provisions tailored to our organization's needs. Vendors must maintain adequate cybersecurity insurance, complete independent security audits, and perform regular penetration testing. For services involving particularly sensitive data, we include special requirements about where information can be stored and how quickly vendors must respond to security incidents.

Before signing any BAA, we carefully evaluate each vendor's security practices through detailed questionnaires, document reviews, and sometimes on-site inspections for high-risk services. After the contract begins, we continue monitoring vendors through quarterly compliance checks, annual security reviews, and real-time monitoring of system access. Our termination procedures ensure that when a relationship ends, all PHI is either returned or securely destroyed, with confidentiality protections that continue even after the contract ends.

Certain types of vendors have additional specialized requirements in their BAAs. Cloud service providers must allow audits and clearly document data ownership. Telehealth platforms need end-to-end encryption and restrictions on session recording. Data analytics companies must use approved methods for de-identifying information.

To manage this program effectively, we have a dedicated BAA compliance officer and use a centralized contract management system that tracks obligations, sends renewal reminders, and maintains version control. Our procurement staff receives regular training, and our legal team reviews all BAA templates annually to ensure they meet current standards.

We keep complete records of all BAAs as part of our HIPAA-required documentation, making them available for government inspections and incorporating them into our regular risk assessments. Our legal team verifies that each agreement complies not just with federal HIPAA rules but also with state laws and industry-specific regulations that may impose additional requirements.

This comprehensive approach to BAAs allows us to safely use third-party services while maintaining complete control over protected health information. Our program has proven effective through multiple successful HIPAA audits and years of maintaining secure vendor relationships without privacy incidents.

Personal Data TopMedMD Collects from You

At TopMedMD, we believe that you can have great products and great privacy. This means that we strive to collect only the personal data that we need. The personal data TopMedMD collects depends on how you interact with TopMedMD. Descriptions of how TopMedMD handles personal data for certain individual services are available either in settings related to those features and/or at Privacy Policy.

When you create a TopMedMD Patient ID, apply for commercial credit, purchase and/or activate a product or device, download a software update, register for a class online or at a TopMedMD location, connect to our services, contact us (including by social media), participate in an online survey, or otherwise interact with TopMedMD, we may collect a variety of information, including:

• Account Information. Your TopMedMD Patient ID and related account details, including email address, devices registered, account status, and age.
• Device Information. Data from which your device could be identified, such as device serial number, or about your device, such as browser type.
• Contact Information. Data such as name, email address, physical address, phone number, or other contact information.
• Payment Information. Data about your billing address and method of payment, such as bank details, credit, debit, or other payment card information.
• Transaction Information. Data about purchases of TopMedMD products and services or transactions facilitated by TopMedMD, including purchases on TopMedMD platforms and applications.
• Fraud Prevention Information. Data used to help identify and prevent fraud, including a device trust score.
• Usage Data. Data about your activity on and use of our offerings, such as app launches within our services, including browsing history; search history; product interaction; crash data, performance and other diagnostic data; and other usage data.
• Location Information. Precise location only for shipping or to support installations and repairs.
• Health Information. Data relating to the health status of an individual, including data related to one's physical or mental health or condition. Personal health data also includes data that can be used to make inferences about or detect the health status of an individual. If you participate in a program using a TopMedMD app, the policy governing the privacy of your personal data is the same.
• Fitness Information. Details relating to your fitness and exercise information where you choose to share them.
• Financial Information. Details including salary, income, and assets information where collected, and information related to TopMedMD referred financial offerings.
• Government ID Data. In certain jurisdictions, we may ask for a government-issued ID in limited circumstances, including when setting up a wireless account and activating your device, for the purpose of extending commercial credit, managing appointments, or as required by law.
• Other Information You Provide to Us. Details such as the content of your communications with TopMedMD, including interactions with customer support and contacts through social media channels.
• You are not required to provide the personal data that we have requested. However, if you choose not to do so, in many cases we will not be able to provide you with our products or services or respond to requests you may have.

Personal Data TopMedMD Receives from Other Sources

TopMedMD may receive personal data about you from other individuals, from businesses or third parties acting at your direction, from our partners who work with us to provide our products and services and assist us in security and fraud prevention, and from other lawful sources.

• Individuals. TopMedMD may collect data about you from other individuals. For example, if an individual has sent you a product or gift card, invited you to participate in a TopMedMD service or forum, or shared content with you, that information would be received by TopMedMD.
• At Your Direction. You may direct other individuals or third parties to share data with TopMedMD. For example, you may direct your health monitoring bracelet subscription provider to share data about your account with TopMedMD or to share information about your participation so that your progress may be recorded in your TopMedMD Patient ID account.
• TopMedMD Partners. We may also validate the information you provide. For example, when creating a TopMedMD Patient ID, with a third party for security, and for fraud-prevention purposes.
• For research and development purposes. We may use datasets such as those that contain images, voices, or other data that could be associated with an identifiable person. When acquiring such datasets, we do so in accordance with applicable law, including law in the jurisdiction in which the dataset is hosted. When using such datasets for research and development, we do not attempt to reidentify individuals who may appear therein.

TopMedMD's Use of Personal Data

TopMedMD uses personal data to power our services, to process your transactions, to communicate with you, for security and fraud prevention, and to comply with law. We may also use personal data for other purposes with your consent.

TopMedMD uses your personal data only when we have a valid legal basis to do so. Depending on the circumstance, TopMedMD may rely on your consent or the fact that the processing is necessary to fulfill a contract with you, protect your vital interests or those of other persons, or to comply with law. We may also process your personal data where we believe it is in our or others' legitimate interests, taking into consideration your interests, rights, and expectations. If you have questions about the legal basis, you can contact the Data Protection Officer at Request More Information.

• Powering Our Services. TopMedMD collects personal data necessary to power our services, which may include personal data collected to improve our offerings, for internal purposes such as auditing or data analysis, or for troubleshooting. For example, if you would like to access a particular workout or entertainment platform through a TopMedMD subscription, we collect data on that activity in order to provide you with the content requested and for royalty purposes.
• Process Your Transactions. To process transactions, TopMedMD must collect data such as your name, purchase, and payment information.
• Communicate with You. To respond to communications, reach out to you about your transactions or account, market our products and services, provide other relevant information, or request information or feedback. From time to time, we may use your personal data to send important notices, such as communications about purchases and changes to our terms, conditions, and policies. Because this information is important to your interaction with TopMedMD, you may not opt out of receiving these important notices as they may affect your safety or your product warranty.
• Security and Fraud Prevention. To protect individuals, employees, and TopMedMD and for loss prevention and to prevent fraud, including to protect individuals, employees, and TopMedMD for the benefit of all our users, and prescreening or scanning uploaded content for potentially illegal content, including child sexual exploitation material.
• Personal Data Used for Personalization. If you choose to personalize your services or communications where such options are available, TopMedMD will use information that we collect so that we can offer you those personalized services or communications. You can learn more about how relevant services use information to personalize your experience by reviewing the privacy information presented when you first use a service that asks to use your personal data. We make this information easy to find by presenting it with our Data & Privacy icon; . It's also available at all times online at Privacy Policy.
• Comply with Law. To comply with applicable law. For example, to satisfy tax or reporting obligations, or to comply with a lawful governmental request.

TopMedMD does not use algorithms or profiling to make any decision that would significantly affect you without the opportunity for human review.

TopMedMD retains personal data only for so long as necessary to fulfill the purposes for which it was collected, including as described in this Privacy Policy or in our service-specific privacy notices, or as required by law. We will retain your personal data for the period necessary to fulfill the purposes outlined in this Privacy Policy and our service-specific privacy summaries. When assessing retention periods, we first carefully examine whether it is necessary to retain the personal data collected and, if retention is required, work to retain the personal data for the shortest possible period permissible under law.

TopMedMD's Sharing of Personal Data

TopMedMD may share personal data with TopMedMD-affiliated companies, service providers who act on our behalf, our partners, developers, and publishers, or others at your direction. Further, TopMedMD does not share personal data with third parties for their own marketing purposes.

• Service Providers. TopMedMD may engage third parties to act as our service providers and perform certain tasks on our behalf, such shipping, installations, training, as processing or storing data, including personal data, in connection with your use of our services and delivering products to customers. TopMedMD service providers are obligated to handle personal data consistent with this Privacy Policy and according to our instructions. They cannot use the personal data we share for their own purposes and must delete or return the personal data once they've fulfilled our request.
• Partners. At times, TopMedMD may partner with third parties to provide services or other offerings. For example, TopMedMD offerings like pharmacy discounts or rewards cards may be offered by TopMedMD and our partners. TopMedMD requires its partners to protect your personal data.
• Developers and Publishers from Whom You Get a Subscription. If you purchase a third-party subscription from any of the assessment equipment providers, TopMedMD's Privacy Policy does not apply to how third parties define personal data or how they use it. We encourage you to read their privacy policies and know your privacy rights before interacting with them.
• Others. TopMedMD may share personal data with others at your direction or with your consent, such as when we share information to activate your account. We may also disclose information about you if we determine that for purposes of national security, law enforcement, or other issues of public importance, disclosure is necessary or appropriate. We may also disclose information about you where there is a lawful basis for doing so, if we determine that disclosure is reasonably necessary to enforce our terms and conditions or to protect our operations or users, or in the event of a reorganization, merger, or sale.

Protection of Personal Data at TopMedMD

At TopMedMD, we believe that great privacy rests on great security. We use administrative, technical, and physical safeguards to protect your personal data, taking into account the nature of the personal data and the processing, and the threats posed. We are constantly working to improve on these safeguards to help keep your personal data secure. For more information, visit Privacy Policy.

Children and Personal Data

TopMedMD understands the importance of safeguarding the personal data of children, which we consider to be an individual under the age of 13 or the equivalent age as specified by law in your jurisdiction. That is why TopMedMD has implemented additional processes and protections to help keep children's personal data safe.

Children's Online Privacy Protection Act (COPPA) Compliance

TopMedMD strictly adheres to the provisions of the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501-6506, and its implementing regulations at 16 CFR Part 312. Our compliance framework includes many comprehensive measures.

Our website and online services are not intentionally designed for, marketed to, or directed at children under 13 years of age. We employ reasonable age-screening mechanisms to prevent unintentional collection of personal information from children under 13. 

Any interface that may inadvertently appeal to children contains conspicuous COPPA-compliant notices regarding our data practices. We do not knowingly collect personal information from young users without proper parental consent.

To prevent accidental data collection from children, we use age-verification measures on any parts of our website that might appeal to younger visitors. These sections also include clear notices explaining our privacy practices in a way that parents and guardians can easily understand.

In the rare cases where we might need to collect personal information from a child under 13—such as for certain telehealth services—we first obtain verifiable consent from a parent or legal guardian. This process may include signed permission forms, secure identity verification methods, or other approved techniques to confirm that a responsible adult has authorized the collection. Before giving consent, parents receive full details about what information we collect, why we need it, and how it will be used or shared.

Parents always maintain control over their child's information. They can review what data we have collected, ask us to delete it, or withdraw their consent at any time. We provide secure ways for parents to make these requests, including dedicated contact methods and password-protected access to their child's records.

We keep children's information only for as long as necessary and protect it with extra security measures, including strong encryption and strict access controls. When the information is no longer needed, we safely dispose of it, except when we are required by law to keep it longer. We never share children's personal information with third parties unless those companies are helping us provide services under strict privacy agreements, or when required by law. We never use children's data for advertising or create marketing profiles based on their information.

To ensure we continue meeting all legal requirements, we have a designated privacy officer who oversees our COPPA compliance. Our staff receives regular training on protecting children's privacy, and we conduct frequent reviews of our data practices. Our complete privacy policy, which includes specific details about our COPPA compliance, is always available on our website.

Our practices also comply with relevant state laws for minors including:

- California's Privacy Rights for Minors in the Digital World Act

- Delaware's Online Child Privacy Protection Act

- Other state-specific child privacy protections

Parents may exercise any COPPA rights or request information about our compliance practices by contacting our COPPA Compliance Officer at [designated email/phone]. We respond to all verifiable parent requests within the timeframe required by COPPA (typically 30 days). This comprehensive approach ensures we meet both the letter and spirit of COPPA while protecting the privacy and safety of our youngest users. Our policies are regularly reviewed and updated to reflect evolving regulatory requirements and best practices in children's online privacy protection.

Parents. To create a child account, parents must review the Family Privacy Disclosures for Children, which describes how TopMedMD handles children's personal data. If they agree, the parent must provide TopMedMD with a verifiable parental consent. If we learn that a child's personal data was collected without appropriate authorization, it will be deleted as soon as possible. To exercise privacy rights for your child’s information, sign in to their account or contact us at Support.

Cookies and Other Technologies

TopMedMD's websites, online services, interactive applications, and advertisements may use "cookies" and other technologies such as web beacons. These technologies help us to better understand user behavior including for security and fraud prevention purposes, tell us which parts of our websites people have visited, and facilitate and measure the effectiveness of advertisements and web searches.

• Communications Cookies. These cookies are used to enable network traffic to and from TopMedMD's systems, including by helping us detect any errors.
• Strictly Necessary Cookies. These cookies are set as required to provide a specific feature or service that you have accessed or requested. For example, they allow us to display our websites in the proper format and language, to authenticate and verify your transactions, and to preserve the contents of your Cart when shopping online at topmedmd.com.
• Other Cookies. These cookies are used to understand how visitors interact with our websites and online services, including by helping us to assess the effectiveness of advertisements and web searches. TopMedMD also uses these cookies to remember choices you make while browsing, so we can provide you with a customized experience.

If you prefer that TopMedMD, not use cookies, we provide you with the means to disable their use. If you want to disable cookies and you're using the Safari web browser, choose "Block all cookies" in Safari's privacy settings. On your Android device, open the Chrome app. At the top right tap the three dots tap, go to Settings, scroll down to Advanced, then select Site Settings, and select Cookies. If you are using a different browser, check with your provider to find out how to disable cookies. Certain features of the TopMedMD website may not be available if all cookies are disabled.

In addition to cookies, TopMedMD uses other technologies that help us achieve similar objectives.

In some email messages TopMedMD sends to you, we provide a "click-through URL" that links you to content on the TopMedMD website. When you click one of these URLs, they pass through a separate server before arriving at the destination page on our website. We track this click-through to help us determine interest in particular topics and measure whether we are communicating with you effectively. If you prefer not to be tracked in this way, you should not click graphic or text links in email messages.

TopMedMD generally treats data we collect using these cookies and similar technologies as nonpersonal data. However, to the extent that Internet Protocol (IP) addresses or similar identifiers are considered personal data by local law, we also treat these identifiers as personal data in those regions. In addition, TopMedMD sometimes combines nonpersonal data collected from these technologies with other personal data TopMedMD holds. When we combine data in this way, we treat the combined data as personal data for purposes of this Privacy Policy.

Often, there are marketing messages for discounts and other services that are delivered by TopMedMD's platform. If you do not want to receive these offers that targeted to your specific protocols or interests from TopMedMD's platform in those apps, you can choose to disable Personalized Ads, which will opt your TopMedMD Patient ID out of receiving such ads.

Our Companywide Commitment to Your Privacy

To make sure your personal data is secure, we communicate our privacy and security guidelines to TopMedMD employees and strictly enforce privacy safeguards within the company.

Privacy Questions

If you have questions about TopMedMD's Privacy Policy or privacy practices including where a third-party service provider is acting on our behalf, would like to contact our Data Protection Officer, or would like to submit a complaint, you can contact us at Support. You can also ask us questions about how to submit a privacy complaint and we will endeavor to help.

TopMedMD takes your privacy questions seriously. All inquiries are reviewed in person to determine how best to respond to your question or concern, including those inquiries received in response to an access or download request. In most cases, all substantive contacts receive a response within seven days. In other cases, we may require additional information or let you know that we need more time to respond.

Where your complaint indicates an improvement could be made in our handling of privacy issues, we will take steps to make such an update at the next reasonable opportunity. In the event that a privacy issue has resulted in a negative impact on you or another person, we will take steps to address that with you or that other person.If you are not satisfied with TopMedMD's response, you may refer your complaint to the applicable regulator. If you ask us, we will endeavor to provide you with information about relevant complaint avenues which may be applicable to your circumstances.

When there is a material change to this Privacy Policy, we'll post a notice on this website at least a week in advance of doing so and contact you directly about the change if we have your data on file.

TopMedMD LLC, 285 North Main Street #491, Kaysville, Utah, USA, 84037, ‪(801) 780-2887.