Health information handled by your treating providers is governed by their own privacy notices. The independent providers, telehealth networks, and pharmacies you interact with through rX by LVLX maintain their own records and provide their own notices of privacy practices. This policy describes how LVLX handles the information we collect.
LVLX does not create or hold your medical records. Where we do handle protected health information, we handle it under HIPAA. See HIPAA and protected health information.
01Scope of this policy
This Privacy Policy explains how LVLX, LLC (“LVLX,” “we,” “us,” or “our”), a Wyoming limited liability company with its principal place of business at 1309 Coffeen Ave., Ste. 1200, Sheridan, Wyoming 82801 collects, uses, discloses, and protects information in connection with rxbylvlx.com, our related sites and applications, and rX by LVLX memberships (the “Services”).
This policy does not cover the independent healthcare providers, telehealth networks, pharmacies, or veterinary professionals you interact with through the Services. Those parties maintain their own records and their own privacy notices, which they provide to you directly.
02HIPAA and protected health information
Some of the information handled in connection with your membership is protected health information (“PHI”) under the Health Insurance Portability and Accountability Act and its implementing regulations (“HIPAA”).
LVLX handles PHI as a business associate of the covered entities that furnish your care — the independent provider organizations and telehealth networks you are connected to through your membership — under written Business Associate Agreements with each of them.
LVLX is not itself a HIPAA covered entity. We are not a healthcare provider, a healthcare clearinghouse, or a health plan, and rX by LVLX is not insurance. Because we are a business associate rather than a covered entity, we do not issue our own Notice of Privacy Practices; the covered entity that treats you provides you with its notice directly.
What that means in practice
- We use and disclose PHI only as permitted by our Business Associate Agreements and by HIPAA, and never for our own marketing.
- We maintain administrative, physical, and technical safeguards for electronic PHI as required by the HIPAA Security Rule.
- We report any use or disclosure not permitted by our agreements, and any breach of unsecured PHI, to the applicable covered entity without unreasonable delay and within the timeframes HIPAA requires.
- We require any subcontractor that handles PHI on our behalf to agree in writing to the same restrictions.
- We make PHI and related records available as needed for a covered entity to meet its own obligations, and to the Department of Health and Human Services on request.
Where to exercise your HIPAA rights
Your HIPAA rights regarding your medical records — including access, amendment, an accounting of disclosures, restrictions, and confidential communications — are exercised through the covered entity that treated you, which maintains those records and provides you its own Notice of Privacy Practices. If you are not sure which provider to contact, email support@lvlxhq.com and we will route you.
Which rules control
Where HIPAA or a Business Associate Agreement applies to information, HIPAA and that agreement control over this Privacy Policy. This policy governs the information we handle outside of HIPAA — for example enrollment, billing, and website information.
03Information we collect
Information you give us
- Enrollment and account information — name, email address, postal address, phone number, date of birth, and the membership you select.
- Payment information — processed by our payment providers. We do not store full payment card numbers on our systems.
- Household information — for family memberships, information about the household members you enroll, including minor children you enroll as their parent or guardian.
- Business contact information — for Group Plan inquiries, your organization name, your name, title, work email, phone, organization type, expected enrollment, funding preference, requested start date, and anything you include in your message.
- Support communications — what you send us by email or through forms on our sites.
Information we collect automatically
When you visit our sites we may collect IP address, device and browser type, operating system, referring page, pages viewed, and timestamps, through cookies and similar technologies. See Cookies and tracking.
Information from others
We may receive information from our telehealth and pharmacy vendors (for example, confirmation that a membership was activated or used), from Wellness Partners who refer you, from a contracting organization that enrolls you under a Group Plan, and from payment processors regarding transaction status.
What we do not collect here
LVLX does not collect the clinical content of your consultations. Notes, diagnoses, and treatment records are created and held by your treating providers under their own privacy practices.
04How we use information
- To enroll you, create and maintain your account, and activate your membership.
- To process payments, invoice organizations, and manage renewals and cancellations.
- To connect you to the telehealth, pharmacy, and support services included in your membership.
- To respond to your questions and provide customer support.
- To prepare and discuss Group Plan quotes and to administer Group Plan agreements.
- To operate, secure, troubleshoot, and improve our sites and Services.
- To detect and prevent fraud, account sharing, and misuse.
- To send service messages about your membership, and, where permitted, marketing messages you can opt out of at any time.
- To comply with legal obligations and enforce our Terms of Service.
06Group Plan information
When an organization purchases a Group Plan, we share with that organization only what it needs to administer the plan: enrollment status, eligibility and roster information, and billing and invoicing details.
We do not share clinical information with the contracting organization. Your employer, association, school, church, or other sponsoring organization does not receive information about whether you sought care, what you discussed with a provider, what was diagnosed, or what was prescribed.
Organizations are separately responsible for how they handle the enrollment information they collect from and about their own participants.
08How long we keep information
We keep personal information for as long as needed to provide the Services and for a reasonable period afterward to meet legal, tax, accounting, audit, and dispute-resolution obligations. Records relating to protected health information are retained for the periods required by HIPAA and by our Business Associate Agreements. Retention periods vary by record type and by applicable law. When information is no longer needed, we delete it or de-identify it.
09Security
We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, workforce training, and vendor due diligence. For electronic protected health information, those safeguards are maintained to the standard required by the HIPAA Security Rule. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at support@lvlxhq.com.
10Your choices and rights
Everyone
- Access and correction — request a copy of the personal information we hold about you, or ask us to correct it.
- Deletion — ask us to delete personal information, subject to legal and contractual retention obligations.
- Marketing opt-out — unsubscribe from marketing email using the link in any message, or contact us. You will still receive service messages about your membership.
- Text messages. Text is often how a treating provider communicates with a patient, so clinical and appointment-related messages are part of the care you have enrolled in. Opting out of those messages may limit your ability to receive care. Separate marketing texts, where you have opted in, can be stopped at any time by replying STOP; reply HELP for help. Message and data rates may apply.
State privacy rights
Residents of certain states — including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and Montana, among others — have additional rights, which may include the right to know, access, correct, delete, obtain a portable copy, opt out of targeted advertising, profiling, or the sale or sharing of personal information, and to be free from discrimination for exercising those rights. Where applicable, you may appeal a denial of a request.
We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising or profiling.
How to make a request
Email support@lvlxhq.com with the subject line “Privacy Request.” We will verify your identity before acting, typically by confirming information already associated with your account. An authorized agent may submit a request with proof of authorization. We respond within the timeframes required by applicable law.
11Children's privacy
Our sites and Services are not directed to children, and primary members must be at least 18 years old.
Family memberships may include minor children, whose information is provided to us by an enrolling parent or legal guardian. We use that information only to enroll and support the membership. Group Plan memberships never include minors.
We do not knowingly collect personal information directly from a child under 13. If you believe a child has provided us information directly, contact support@lvlxhq.com and we will delete it.
12Users outside the United States
The Services are intended for use in the United States and are operated there. If you access the Services from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction.
13Third-party sites
Our sites link to third-party sites and services we do not control, including our medication list and enrollment platforms. This policy does not apply to them. Review the privacy policy of any third-party site you visit.
14Changes to this policy
We may update this Privacy Policy. When we do, we will revise the “Last updated” date above and, for material changes, provide additional notice through the Services or by email. Your continued use of the Services after a change takes effect means you accept the revised policy.