Data Privacy Policy

1) Who We Are & How to Contact Us

Curekey LLC
16192 Coastal Highway, Lewes,
County of Sussex, Delaware 19958
Email: support@curekey.com

2) Curekey, Medical Groups, HIPAA & Other Health Data

Curekey provides non-clinical Services and technology that enable access to independent medical groups and licensed clinicians (“Medical Groups” and “Providers”) and independent pharmacies (“Pharmacies”). Medical Groups and Pharmacies are independent third parties.

• Curekey is not a healthcare provider and does not practice medicine.
• If you receive clinical care through the Services, your patient relationship is with the applicable Medical Group and its licensed healthcare Providers. The applicable Medical Group will provide or make available its HIPAA Notice of Privacy Practices (“NPP”), which describes how it may use and disclose your Protected Health Information (“PHI”) and explains your rights under HIPAA. Curekey may facilitate access to the applicable NPP on the Medical Group’s behalf.
• When Curekey handles PHI on behalf of a Medical Group or other HIPAA-covered entity, Curekey does so as a Business Associate and in accordance with HIPAA and applicable Business Associate Agreements. Requests to exercise HIPAA rights with respect to your medical records or other PHI should be directed to the applicable Medical Group or covered entity. Curekey may assist in facilitating those requests where appropriate.
• This Privacy Policy governs information that Curekey processes in its own capacity (e.g., account, payments, customer support, marketing). Some of that information may include health-related details you provide to us, which may or may not be PHI depending on context.

3) Information We Collect

We collect information in three main ways: you provide it, we collect it automatically, and we receive it from third parties.

A. Information You Provide

• Account & Contact: name, email, phone number, date of birth, billing/shipping address.
• Identity Verification: photos of your government ID, selfies, and similar information used to verify identity and prevent fraud. Depending on the verification method used, this may include biometric identifiers or templates where created or processed by the verification provider.
• Health & Intake Details: medical history, symptoms, photos of hair/scalp, treatment goals, questionnaire responses. When provided to or for Providers/Medical Groups, this may be PHI.
• Transactions: order history, payment method token (we do not store full card numbers), subscription preferences, and records relating to your consents and communication preferences, including the text or version presented, your choice or status, timestamps, source or method, and related audit information.
• Communications & UGC: messages, reviews, survey responses, support requests, and any content you submit.

B. Information Collected Automatically

• Log & Usage Data: IP address, device/OS/browser, pages viewed, referring/exit pages, timestamps, and error diagnostics.
• Device Data: unique identifiers, cookie identifiers, app instance IDs, language, time zone, settings.
• Approximate Location: derived from IP address or device settings (with your consent where required).
• Cookies & Similar Tech: pixels, SDKs, tags, local storage (see Section 10).

C. Information From Third Parties

• Payment processors for fraud prevention and transaction facilitation.
• Identity verification vendors.
• Analytics/advertising partners for audience insights and ad measurement.
• Medical Groups/Pharmacies (e.g., order/fulfillment status) to coordinate your care, if applicable.

4) How We Use Information

• Provide, maintain, and improve the Services.
• Facilitate care coordination among you, Medical Groups/Providers, and Pharmacies where permitted/required.
• Process orders, subscriptions, payments, shipping, and returns.
• Send service communications and, where permitted, marketing communications such as product information, special offers, discounts, and incomplete-purchase reminders. Marketing SMS is sent only where the required consent has been obtained. We may send marketing emails about Curekey products, services, treatment plans, special offers, discounts, and incomplete purchases, subject to applicable law and your opt-out choices. Promotional or discount text messages, including abandoned-cart offers, are treated as marketing SMS and are sent only where the required consent has been obtained.
• Verify identity, prevent fraud/abuse, and ensure platform security.
• Communicate with you about accounts, orders, support, and service updates.
• Conduct analytics, research, A/B testing, and product development.
• Comply with legal obligations and enforce our terms.

Where we act as a Business Associate to a Medical Group/Pharmacy, we use/disclose PHI only as permitted by HIPAA, applicable law, and the Business Associate Agreement.

5) Legal Bases (EEA/UK Visitors)

If you visit from the EEA/UK, our processing is based on: contract (to provide Services), consent (e.g., certain marketing/cookies; sensitive data you choose to provide), legitimate interests (e.g., service improvement, security), and legal obligations.

6) How We Share Information

• Medical Groups/Providers and Pharmacies to coordinate care, fulfillment, and support (including PHI where permitted/required).
• Service Providers/Vendors (e.g., hosting, storage, analytics, advertising, identity verification, payment processing, customer support, communications, security/fraud). These parties process data on our behalf under contractual safeguards. Vendor access is limited according to the services they perform and applicable contractual, privacy, security, and, where relevant, HIPAA Business Associate requirements. Curekey does not treat all vendors as having the same legal role or permission to use health-related information.
• Advertising/Analytics Partners for measurement and reporting, subject to applicable law and the restrictions described below. We do not permit PHI received by Curekey as a Business Associate to be used for Curekey advertising or marketing except as permitted by HIPAA, the applicable Business Associate Agreement, and any required authorization.
• Law enforcement/Regulators as required by law or to protect rights, safety, and security.
• Business Transfers in connection with a merger, acquisition, financing, or sale of assets (your information may be transferred as part of the transaction).

We do not sell PHI. We do not share SMS opt-in consent or SMS originator data with third parties outside service providers necessary to deliver messages.

7) Your Choices & Controls

• Account Data: You can review and update certain account information through your account or by contacting support@curekey.com.
• Marketing Emails: You can unsubscribe using the link in any marketing email or change your marketing email preference in your account. Transactional and service emails may still be sent.
• Marketing Text Messages: You can opt out by replying STOP to a marketing text message or change your marketing text preference in your account. Consent to marketing text messages is not a condition of purchase.
• Care & Account Messages: We may send important treatment, order, payment, and support communications by email or text. You can reply STOP to text messages at any time.
• Device & Cookie Controls: You can use available browser, device, and cookie settings to manage cookies, advertising identifiers, location permissions, and notifications.
• Telehealth Consent: You may withdraw your telehealth consent by contacting Support. Withdrawal may affect our ability to provide telehealth services or continue treatment, but does not affect care already provided before withdrawal.

8) Retention

We retain information for as long as reasonably necessary to provide the Services, comply with legal and regulatory obligations, resolve disputes, enforce agreements, and protect our legal rights. Retention periods vary depending on the type of information and the purpose for which it is maintained.

Certain information may be retained for longer periods where required or permitted by law, including health-related information, consent and communication-preference records, transaction records, identity-verification information, and records needed to establish or defend legal claims. Where appropriate, we delete or de-identify information when it is no longer reasonably necessary for the applicable purpose.

9) Children’s Privacy

The Services are intended for adults age 18 and older and are not directed to children. We do not knowingly provide the Services to, or knowingly collect personal information through the Services from, anyone under 18. If we learn that we have collected personal information from a person under 18, we will take appropriate steps to delete or otherwise handle that information as required by applicable law.

10) Cookies, Pixels & Similar Technologies

We use first-party and third-party cookies and similar technologies to enable core functionality (e.g., login, cart), understand usage, personalize content, and deliver/measure advertising.

Types: essential, performance/analytics, functionality, and advertising cookies/pixels.

Choices: You can manage cookies in your browser settings and via any cookie banner or preferences tool we present. Some features may not function without certain cookies. Where legally required (e.g., in California via Global Privacy Control (GPC) signals), we honor browser-based opt-out signals for sale/sharing and targeted advertising.

11) Security

We use administrative, technical, and physical safeguards designed to protect information. However, no method of transmission or storage is 100% secure. If you suspect an account/security issue, contact support@curekey.com. We provide notifications of qualifying data breaches or unauthorized disclosures as required by applicable law.

12) Communications; Email and SMS

We may send you service communications related to your account, treatment, orders, payments, delivery, and support by email or text message, where permitted by applicable law.

We may send you marketing emails about Curekey products, services, treatment options, offers, and educational content, subject to applicable law. You can unsubscribe from marketing emails at any time using the unsubscribe link in the message or through your account. Unsubscribing from marketing emails does not prevent us from sending service or transactional emails.

Marketing text messages are optional and are sent only where you have provided the required consent. Consent to marketing text messages is not a condition of purchase. You can opt out of marketing text messages at any time by replying STOP or through your account. Message and data rates may apply. Reply HELP for help.

13) U.S. State Privacy Disclosures & Rights (e.g., CA/CO/CT/UT/VA)

Certain U.S. state laws (e.g., California CCPA/CPRA) grant residents specific rights regarding personal information (excluding PHI covered by HIPAA). Subject to exceptions, you may have the right to know/access, correct, delete, opt out of sale/sharing for cross-context behavioral advertising, limit certain uses of sensitive personal information, and exercise these rights without discrimination. We do not sell PHI. We may engage in activities considered “sale” or “sharing” under state laws via advertising/analytics partners. You can opt out via our cookie/preferences tools, supported browser signals such as GPC where required, or by emailing support@curekey.com with “Privacy Request: Do Not Sell/Share.”

14) International Visitors

Our Services are intended for use in the United States. If you access the Services from outside the U.S., you understand your information will be processed in the U.S., which may have different data protection laws than your country. Where required, we implement appropriate safeguards for international transfers.

15A) HIPAA and Protected Health Information

Curekey is not a healthcare provider or health plan. In connection with healthcare services available through the Platform, Curekey may act as a Business Associate to independent Medical Groups, Providers, or Pharmacies that are subject to the Health Insurance Portability and Accountability Act (“HIPAA”). When Curekey acts as a Business Associate, we use and disclose protected health information (“PHI”) only as permitted by HIPAA, applicable law, our Business Associate Agreements, and the instructions of the applicable covered entity.

The applicable Medical Group or other covered entity is responsible for providing its Notice of Privacy Practices and for administering your HIPAA rights with respect to your medical records and PHI. These rights may include rights to access or request copies of your PHI, request corrections or amendments, request restrictions on certain uses or disclosures, receive an accounting of certain disclosures, and file a complaint.

To exercise HIPAA rights relating to your medical care or medical records, please contact the applicable Medical Group or Provider identified in your patient materials or Notice of Privacy Practices. Curekey may assist in routing your request to the appropriate entity.

Curekey also maintains administrative, technical, and physical safeguards designed to protect PHI when acting as a Business Associate and will report breaches or other incidents to the applicable covered entity as required by HIPAA and our Business Associate Agreements.

15B) Third-Party Links & Services

The Services may link to third-party sites, apps, and services that are not owned or controlled by Curekey. Their privacy practices are governed by their own policies. Review those policies; we are not responsible for their content or practices.

16) Changes to This Policy

We may update this Privacy Policy from time to time. The Effective Date above indicates the latest version. If we make material changes, we will provide notice as required by applicable law and, where appropriate, through the Platform, by email, or by other reasonable means. Where applicable law requires consent or authorization for a materially new use or disclosure of previously collected information, including health-related information, we will obtain it before applying that new use or disclosure.

17) Notice for California Residents (Shine the Light)

California Civil Code §1798.83 permits users who are California residents to request information regarding the disclosure of certain personal information to third parties for their direct marketing purposes. To make a request, email support@curekey.com with “California Shine the Light” in the subject.

18) Supplemental Disclosures (Illustrative List of Third Parties)

We may use third parties for hosting, storage, analytics, advertising, communications, payments, and support. Examples include (subject to change): cloud hosting/CDN providers, payment processors, analytics platforms, advertising networks, identity verification vendors, customer support tools, email/SMS service providers, and anti-fraud/security vendors. For an updated list or questions about specific vendors, contact support@curekey.com.

19) Your Rights Summary (EEA/UK)

Subject to exceptions, you may have the right to access, correct, delete, restrict, object, and port your personal data, and to lodge a complaint with your local supervisory authority. You may also withdraw consent at any time where processing is based on consent.

20) Contact Us

Questions or privacy requests?

support@curekey.com

Postal: Curekey LLC, 16192 Coastal Highway, Lewes, County of Sussex, Delaware 19958