Privacy Policy

Overview

HardSide Health operates the platform at hardside.com. We connect people who are seeking GLP-1 weight-management care with licensed clinicians through our telehealth network, powered by OpenLoop Healthcare Partners. HardSide Health is the platform and digital storefront. We are not a healthcare provider. Medical evaluation, prescribing, and clinical decisions are made by independent licensed clinicians affiliated with OpenLoop Healthcare Partners, who are licensed in the state where you reside.

This Privacy Policy covers the personal information HardSide Health collects through hardside.com and any related apps or services that link to this policy. It does not cover information you provide directly to your clinician or through the patient portal operated by or on behalf of OpenLoop Healthcare Partners. That information is protected health information ("PHI") governed by the Health Insurance Portability and Accountability Act (HIPAA) and by OpenLoop's Notice of Privacy Practices. See the Health Data Privacy section below for more detail.

By using hardside.com, you agree to this policy. If you do not agree, please do not use the site.

Information We Collect

Information You Give Us Directly

• Account and intake details - name, email address, date of birth, phone number, and mailing address when you create an account or complete the intake questionnaire.
• Health screening responses - answers to pre-screening questions we ask on behalf of the clinical network. These responses help determine whether you may be a candidate for a clinician evaluation. They are not a clinical assessment.
• Payment information - billing address and payment card details processed by our third-party payment processor. We do not store full card numbers.
• Communications - messages you send via our support channels, email, or chat.
• Photos or uploads - if you voluntarily provide images as part of the intake process.

Information Collected Automatically

• Device and browser data - IP address, browser type, operating system, device identifiers, and advertising identifiers.
• Usage data - pages visited, links clicked, time spent, referral URLs, and other interaction data.
• Cookies and similar technologies - see the Cookies section.

Information From Third Parties

• Marketing partners - advertising and analytics providers may share aggregate or pseudonymous data with us.
• Clinical network - OpenLoop Healthcare Partners may share limited administrative information with us (for example, enrollment status) for order fulfillment and support purposes.

Sensitive Personal Information

Some information you provide may qualify as sensitive under applicable law, including consumer health data (information that identifies or could reasonably be linked to your past, present, or future physical health status). We collect this only to facilitate your access to the clinical evaluation process. For information that qualifies as PHI under HIPAA, see the Health Data Privacy section.

How We Use Your Information

• Service delivery - processing your intake, routing your information to the clinical network, and fulfilling your order if a prescription is issued.
• Communication - sending order confirmations, appointment reminders, account updates, and support responses.
• Marketing - sending promotional messages if you have opted in. You can opt out at any time.
• Improving the platform - analyzing how users interact with the site so we can improve design and functionality.
• Fraud prevention and security - detecting and preventing unauthorized access, fraud, and abuse.
• Legal compliance - meeting our obligations under applicable law and defending our legal rights.
• Aggregate analytics - creating de-identified or aggregated data that cannot reasonably identify you. We may use and share such data for any lawful purpose.

How We Share Your Information

We do not sell your personal information to third parties for their own marketing. We share information in the following circumstances:

• OpenLoop Healthcare Partners and its clinicians - we share your intake responses and contact information so that an independent clinician can evaluate your eligibility and, if appropriate, issue a prescription.
• Fulfillment pharmacies - if a prescription is issued, the clinician or OpenLoop will direct your prescription to a state-licensed compounding pharmacy for fulfillment and shipping.
• Service providers - companies that help us operate the platform, including payment processors, cloud hosting providers, analytics vendors, customer support tools, and email delivery services. They are contractually limited to using your data only to provide services to us.
• Marketing partners - with your consent, or in pseudonymous form for advertising purposes.
• Corporate transactions - in connection with a merger, acquisition, sale of assets, or similar transaction, your information may be transferred as a business asset.
• Legal obligations - when required by law, court order, subpoena, or valid governmental request, or to protect the rights, safety, or property of HardSide Health, its users, or the public.

Cookies and Tracking

We and our third-party partners use cookies and similar tracking technologies when you visit hardside.com. Cookies are small text files stored on your device.

Types of Cookies We Use

• Necessary cookies - required for the site to function. You cannot opt out of these.
• Performance cookies - collect anonymous usage data to help us understand how visitors use the site.
• Functionality cookies - remember your preferences and personalize your experience.
• Advertising/targeting cookies - used to serve ads relevant to your interests and to measure ad campaign effectiveness.

You can manage or disable cookies through your browser settings. Disabling some cookies may limit site functionality. You can also opt out of interest-based advertising through the Digital Advertising Alliance and the Network Advertising Initiative. You will need to repeat this on each browser and device you use.

Your Rights and Choices

All Users

• Marketing opt-out - click "unsubscribe" in any marketing email or contact us at [PLACEHOLDER: support email]. You may still receive transactional and account-related messages.
• Access and correction - you may request a copy of the personal information we hold about you and ask us to correct inaccuracies.
• Deletion - you may request that we delete your personal information. We will do so unless retention is required by law or for legitimate business purposes such as fraud prevention.

Washington State Residents

Washington's My Health My Data Act provides additional rights regarding consumer health data. See the Health Data Privacy section for details.

California Residents

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know, delete, and opt out of the sale or sharing of personal information. To exercise these rights, contact us at [PLACEHOLDER: support email].

How to Submit a Request

Email us at [PLACEHOLDER: privacy email] with your name and the nature of your request. We will respond within 30 days (or as required by applicable law).

Health Data Privacy

HIPAA and Protected Health Information

When you receive clinical services through OpenLoop Healthcare Partners, the information exchanged between you and the licensed clinician constitutes protected health information (PHI) under HIPAA. HardSide Health is not a HIPAA-covered entity with respect to that clinical relationship. The clinicians and medical group affiliated with OpenLoop Healthcare Partners operate as covered entities under HIPAA and are responsible for their own Notice of Privacy Practices governing the use and disclosure of your PHI. You will receive (or have access to) that notice as part of the clinical intake process.

To the extent HardSide Health receives or handles any PHI as a business associate of OpenLoop Healthcare Partners, we do so under a HIPAA Business Associate Agreement and are bound by its terms.

HIPAA Notice of Privacy Practices - Summary

The following is a plain-language summary of how OpenLoop Healthcare Partners uses and discloses PHI, provided here for your convenience. The full Notice of Privacy Practices is available from your clinician.

• Treatment - PHI may be used and shared among members of your care team (including clinicians, pharmacies, and labs) to provide, coordinate, and manage your care.
• Payment - PHI may be used to bill and collect payment for services rendered.
• Healthcare operations - PHI may be used for quality improvement, training, and administrative functions.
• Your rights under HIPAA - you have the right to access your medical records, request corrections, receive an accounting of disclosures, request restrictions on use, and receive a paper copy of the full Notice of Privacy Practices. Contact your clinician or OpenLoop Healthcare Partners at [PLACEHOLDER: OpenLoop privacy contact] to exercise these rights.
• Disclosures without authorization - PHI may be disclosed without your authorization for public health activities, law enforcement, judicial proceedings, or other purposes required by law.

Washington My Health My Data Act

Washington State's My Health My Data Act (MHMDA) grants Washington residents additional rights over consumer health data, defined broadly to include information that identifies or could reasonably be linked to your physical or mental health status.

HardSide Health collects consumer health data in the form of your intake responses (for example, your reported weight, BMI, and health conditions) for the sole purpose of routing you to a clinical evaluation. We do not sell this data or share it for advertising purposes without your authorization.

Washington residents have the right to:

• Confirm whether we hold consumer health data about you.
• Access a copy of the consumer health data we hold.
• Request deletion of consumer health data we hold.
• Withdraw any consent to collection, sharing, or use of consumer health data.
• Appeal our response to your request if you disagree with our decision.

To exercise any of these rights, email [PLACEHOLDER: privacy email] with "MHMDA Request" in the subject line. We will respond within 45 days (or as extended by applicable law with notice to you).

We will not discriminate against you for exercising your MHMDA rights.

Data Retention for Health Screening Data

We retain your intake and screening responses for as long as necessary to complete your order and provide support, and then for a period required by applicable law or legitimate business needs. PHI retained as a business associate is governed by our Business Associate Agreement with OpenLoop Healthcare Partners.

Children's Privacy

HardSide Health is intended for adults 18 years of age and older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has submitted information through our platform, contact us at [PLACEHOLDER: support email] and we will delete that information promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes, we may notify you by email or by a notice on the site. Continued use of hardside.com after the effective date of changes constitutes acceptance of the revised policy.

Contact Us

If you have questions about this Privacy Policy or want to exercise your rights, reach us at:

• Email: [PLACEHOLDER: privacy email]
• Mailing address: [PLACEHOLDER: mailing address]

For questions specifically about your clinical records or HIPAA rights, contact OpenLoop Healthcare Partners directly at [PLACEHOLDER: OpenLoop privacy contact].