Health Data and Measurement Policy

1. Who this policy covers

This policy is published by AnthologyRX LLC ("AnthologyRX", "we", "us"). It covers visitors to anthologyrx.com, visitors arriving through our former storefront domain anthologyrxplus.com, and people who start our online assessment at join.anthologyrx.com. The former storefront domain is retained for redirects to AnthologyRX. Clinical services are provided by an independent licensed provider network, Arora Health & Aesthetics, LLC. The assessment is operated on a platform provided by Bask Health ("Bask"), which acts as our service provider. Our website and measurement systems are hosted by Vercel, Inc., and our measurement records are stored with Neon (part of Databricks, Inc.). Contact for anything in this policy: privacy@anthologyrx.com.

Because we offer prescription treatments, information about which pages you read or how far you get through the assessment can reveal a health interest or care you are seeking. We treat every record described in this policy as consumer health data, and where it relates to a person who becomes a patient, as protected health information handled under our HIPAA Privacy Policy.

2. What is recorded, and from where

Always, because the service needs it (necessary functions). Security and fraud controls, the logs our hosting provider keeps to run the site, and a small cookie that remembers the choice you made on the measurement card. None of this is used to build a profile of your interests.

Always, as anonymous counts (usage tallies). Whether or not you allow measurement, we keep daily totals of how our pages are used: how many times each page was opened and from which kind of site, how many times each button, link, treatment finder answer or FAQ question was tapped and how many times each was on screen, how many times each section of a page came into view and for roughly how long, how many times a price, a photo or a promo code was tapped, copied, or rested on with the pointer, how many times text was selected in a section, which form fields were focused, filled or left empty (never what was typed), which page visitors went to next, how fast pages loaded and responded, whether a script error occurred, how far down a page visitors scrolled, how long pages were open when they were left, and the hour of the day. Each page load is also counted by country, browser and operating system family, whether the browser was inside another app such as Instagram, language setting, screen size band, color and motion preferences, connection type and campaign label. Each total is a single number for a day, a page and an element. It carries no identifier, no cookie, no IP address, no time of day and no order between taps, so it cannot be connected to you, to a visit, or to any other total. We use these counts to see what everyone does on a page, not what any person does.

Only with your permission (internal measurement). When you choose Allow on the measurement card, we record:

• The pages you view on our websites, including treatment pages, and the plan or option selectors you change on them.
• Your interactions on those pages: links and buttons clicked and which were on screen, how far you scroll, which sections you spend time on and when each first appeared, whether you tap, copy or rest the pointer on a price or a promo code, text you select (its length, not its content), form fields you focus, fill or leave (never what you type), how the page loaded and responded for you, your color, motion and contrast preferences and time zone, questions you open in an FAQ, and site search terms, which are reduced to a catalogue category before they are stored.
• The campaign labels on the link that brought you to us (for example the source and campaign name) and, if an advertising platform added a click reference to that link, that reference. These are used only inside our own systems.
• Your progress through the online assessment: which screens you reach, how long each is open, whether you go back, and where you stop. Your answers are not recorded by this measurement. They are handled by the assessment platform and the provider network under the notices shown there.
• A random identifier stored in a cookie on your browser, and a short-lived handoff reference that links your visit to the assessment and to any order you place, so that we can see which information and campaigns lead people to start care.
• Your device type, screen size, browser language, page load times and site errors, and the approximate region your connection appears to come from.
• A record of the choice you made on the card, when you made it, which version of this policy you saw, and whether your browser sent a Global Privacy Control signal.

Payment reconciliation. We check payment identifiers, payment dates, currency, captured and refunded totals, and whether a payment is an initial purchase or renewal against Bask's payment records. This internal reporting copy does not contain your name, contact details, medication names or assessment answers. Linking it to website or assessment activity requires current permission for internal measurement.

Optional feedback. If you answer our separate “How did you hear about us?” question, we count your chosen source and, if applicable, AI assistant. We do not link that answer to an order, account or website visit. A temporary random reference prevents duplicate submissions; the answer is stored only in daily totals. You can skip the question without affecting care.

Only if you choose “Personalize my visits” (recently viewed treatments). This separate option is off by default. If you turn it on, this browser saves a small list of treatment pages you view and when you viewed them, so you can find them again. The list can reflect health interests. This feature does not send the saved list to us or other companies, link it to an account, or store assessment answers. Allowing internal measurement or Google Analytics alone does not enable it. Your separate measurement choices still apply to website activity.

Only if you switch it on (Google Analytics). Under Manage on the card you can separately allow Google Analytics. If you do, page views and clicks are sent to Google LLC with treatment names removed from page paths and titles. Google is an independent company with its own privacy policy. It is off unless you turn it on, and it stays off when your browser sends a Global Privacy Control signal.

We do not record what you type into forms, we do not record your screen, and we do not use fingerprinting. We do not collect precise geolocation.

3. What it is used for

• To understand which information and campaigns help people decide to use our service, and to report that internally.
• To find where people get stuck on the site or in the assessment and fix it.
• To measure how quickly reviews are completed and how often assessments lead to treatment, in aggregate.
• To run the necessary security and service functions described above.
• If you choose personalization, to help you return to recently viewed treatments using the list saved in this browser.

We do not use these records to build advertising profiles, to target you with advertising elsewhere, or to make decisions about your care. Prescription orders are never reported to an advertising platform as a purchase signal.

4. Who receives it

Service providers acting for us. Vercel, Inc. (hosting and the functions that receive measurement records), Neon, part of Databricks, Inc. (database storage), and Bask Health (operation of the assessment). Each is bound by contract to use the records only to provide its service to us.

The assessment platform's own tools. Bask keeps the service and security logs it needs to run the assessment, and its platform may load analytics tools under Bask's own configuration. Those tools are described in the notices shown on the assessment itself. Our optional measurement on the assessment happens only if you allowed it on the card.

Independent recipients. Google LLC, only if you switch on Google Analytics under Manage. No other independent company receives these records.

We do not sell consumer health data. We do not share it for cross-context behavioral advertising. We do not disclose it to advertising platforms.

5. Your choices

Allowing and declining. The measurement card appears on your first visit. Allow and Decline are offered equally. Declining does not change your care, your prices, or your ability to start an assessment.

Withdrawing. Open Privacy choices in the footer of any page and choose Decline or change the switches. Withdrawal is as easy as allowing, and it takes effect immediately: future optional recording stops, pending sends are discarded, and your visit is no longer linked to a new assessment or order. Records already collected are kept only for the periods in section 7 and are then deleted; you can also ask us to delete them sooner (section 6).

Recently viewed treatments. Change “Personalize my visits” in Privacy choices independently of measurement. Turning it off stops saving and clears the recently viewed list from this browser. Clearing this site's browser storage also removes the saved list and choice.

Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as a refusal of sharing with independent recipients. Choosing Allow on the card does not override it. It does not by itself refuse our own internal measurement, which you control with the card.

Policy changes. If this policy changes in a way that affects what is recorded or who receives it, you will be asked again, and your earlier choice is treated as withdrawn until you answer.

6. Your rights and how to use them

You can ask us to confirm whether we hold consumer health data about you, to give you a copy, to tell you who received it, to delete it, and to withdraw any permission you gave. Write to privacy@anthologyrx.com.

Verifying a request. Measurement records are held against a random identifier, not your name. To find records from your browser, open Privacy choices in the footer and quote the reference shown there. If you are a patient and your request concerns your care records, we verify your identity through the patient account before responding.

Timing and appeals. We respond within 45 days, and may extend once by a further 45 days where reasonably necessary, telling you why. If we decline a request, you may appeal by replying to our response with the word "appeal"; we answer appeals within 45 days in writing with our reasons. If your appeal is denied you may contact the attorney general of your state; Washington residents may contact the Washington State Office of the Attorney General.

Deletion. Deletion covers the live records, queues, and our own backups within the periods our providers allow for backup expiry, and we instruct our service providers to delete their copies. Clinical records held under medical record retention duties are not measurement records and are governed by our Notice of Privacy Practices.

7. How long we keep it

• Page load times and site errors: 30 days.
• Detailed page and assessment activity: 90 days, after which only aggregate reports remain.
• The link between a visit and the assessment, where no order followed: 30 days.
• Campaign arrival details and intake delivery receipts: 30 days. Source information linked to a verified payment: up to 90 days after payment, and removed sooner if permission is withdrawn. Our internal payment reconciliation copy: up to one year after payment. Separate accounting and clinical records follow their own retention duties.
• Your recorded internal-measurement and Google Analytics choices: six years, as evidence of the permission you gave or withheld.
• Recently viewed treatments: only visits from the last 30 days are used. Expired entries are removed when the feature next runs, or sooner when you turn it off or clear this site's browser storage. The separate personalization choice is remembered in this browser for up to one year.
• Daily discovery-feedback and delivery-health totals: 25 months. Feedback duplicate-prevention references expire after 24 hours and are removed by the daily cleanup. Other aggregate reports that no longer identify anyone are kept for planning and comparison over time.

8. How it is protected

The optional recently viewed list stays in this browser. The safeguards below describe measurement records held in our systems.

Measurement records are stored in a restricted system that only named staff can reach, separate from clinical records. We do not store your IP address, your user agent string, your name or your email address in it; identifiers are random values or keyed hashes. These records may still be linked to your activity or orders by authorized systems, so we protect them as personal and health information rather than treating them as anonymous. Data travels over encrypted connections, our providers hold recognised security certifications, and access is logged.

9. Relationship to HIPAA and other notices

Your choice on the measurement card is not a HIPAA authorization and does not permit any use of your medical records beyond what our Notice of Privacy Practices describes. Where a specific use of your health information needs a signed authorization, we will ask for it separately and in writing.

10. Changes and contact

We will post changes to this policy here with a new effective date, and we will ask for your permission again where the change affects what is recorded or who receives it. Questions, requests and appeals: privacy@anthologyrx.com.