What we collect
We collect health information (medical history, lab values, prescriptions), identity information (name, date of birth, address, government ID for verification), payment information (processed by third-party PCI-compliant providers), and product usage information (interactions with this site and our app).
How we use it
To provide medical care through licensed clinicians, to fill and ship prescriptions through partner pharmacies, to process payments, to comply with state and federal medical recordkeeping requirements, and to improve our services. We do not sell health information.
Who has access
Your assigned clinical team, the pharmacy that fills your prescription, our customer support team (limited access on a need-to-know basis), and third-party service providers (cloud hosting, payment processors, shipping carriers) bound by confidentiality agreements.
Your rights under HIPAA
Members may request access to their medical records, request corrections, request restrictions on disclosure, and receive an accounting of disclosures. See our HIPAA Notice of Privacy Practices for the full picture.
State-specific rights
California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and Utah (UCPA) residents have additional rights including access, deletion, correction, and opt-out of certain processing. To exercise these rights, email privacy@zappyhealth.com.
Cookies and tracking
We use first-party cookies for authentication and session continuity. We use limited third-party analytics that do not transmit health information. We do not use cross-site advertising trackers on member portal pages.
Data retention
Medical records are retained per state law (typically 7+ years from last patient interaction). Account-level data is retained for as long as the account is active plus the legally required period.
Children
Zappy is for adults 18+. We do not knowingly collect information from minors.
Contact
Privacy questions: privacy@zappyhealth.com. Data subject requests should reference "Privacy request" in the subject line.