Privacy Policy.

Scope and who we are

This policy describes how Lennox Health (“Lennox,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information through lennox.health, Lennox communications, patient-facing technology we operate, and other services that link to this policy (the “Services”).

Some services involve separate healthcare professionals, clinical entities, pharmacies, laboratories, payment processors, or other third parties. Those parties may collect information directly and provide their own privacy notices. When a separate notice applies, it governs that party’s handling of your information.

This policy does not apply to de-identified information that cannot reasonably be linked to you or to information processed solely on behalf of an employer or other organization under a separate agreement.

Information we collect

The information we collect depends on how you use the Services.

Identity and contact

Name, date of birth, email address, telephone number, mailing address, account identifiers, and identity-verification information.

Health and care

Health goals, symptoms, medical and family history, conditions, medications, allergies, treatment preferences, photos, laboratory information, provider messages, prescription and fulfillment information, and other information you choose to submit for care.

Transaction

Services requested, order and subscription details, billing status, shipping details, refunds, and limited payment information. Payment-card numbers are generally collected by a payment processor rather than stored directly by Lennox.

Device and use

IP address, browser and device type, operating system, pages viewed, referring page, approximate location derived from IP address, timestamps, error logs, and interactions with the Services.

Communications

Messages, support requests, survey responses, call details, marketing preferences, and records of your consent or instructions.

Inferences

Basic inferences we may make from the information above, such as likely service interests, support needs, fraud risk, or eligibility for a communication. Clinical decisions are made by licensed providers, not by marketing profiles.

Sources of information

We collect information:

• directly from you, including when you browse, join a list, create an account, complete an intake, purchase a service, contact support, or communicate about care;
• from healthcare professionals and clinical entities involved in evaluating or treating you;
• from pharmacies, laboratories, payment processors, shipping carriers, identity-verification providers, and other service providers involved in requested services;
• automatically from your device through standard web logs, cookies, pixels, local or session storage, and similar technologies when present; and
• from other people or sources you authorize, such as a caregiver, representative, prior provider, or connected account.

How we use information

We may use personal information to:

• provide, coordinate, personalize, and support the Services you request;
• connect you with licensed providers and support clinical intake, consultations, follow-up, prescriptions, pharmacy fulfillment, and patient communications;
• process payments, orders, subscriptions, shipments, refunds, and account activity;
• verify identity, location, eligibility, consent, and account access;
• respond to questions, send service notices, and provide customer support;
• maintain, troubleshoot, secure, and improve the Services;
• detect fraud, misuse, safety concerns, security incidents, and violations of our terms;
• send marketing communications where permitted and consistent with your choices;
• create aggregated or de-identified information; and
• comply with legal, regulatory, licensing, quality, recordkeeping, and reporting obligations.

We will not use consumer health data for a materially different purpose without providing any notice or consent required by applicable law.

How we disclose information

We may disclose personal information to the following categories of recipients for the purposes described above:

• healthcare professionals and clinical entities that evaluate or treat patients;
• pharmacies, laboratories, and care-support partners that help fulfill a prescription or requested service;
• operational service providers such as hosting, communications, identity verification, security, analytics, support, payment, shipping, document, and professional-advisory vendors;
• your representatives or other parties you direct us to contact;
• government authorities, regulators, courts, and other parties when required by law or reasonably necessary to protect rights, safety, security, and the integrity of the Services;
• parties to a corporate transaction, such as a financing, merger, acquisition, restructuring, or sale, subject to appropriate safeguards; and
• other recipients with your direction or consent.

We do not sell personal information for money. As of the effective date, the Lennox public website does not use advertising pixels to disclose site activity for cross-context behavioral advertising. If that practice changes, we will update this policy and provide any opt-out method required by law.

Consumer health data

Certain state laws define “consumer health data” broadly. It may include information that identifies or could be linked to you and reflects your past, present, or future physical or mental health, health conditions, treatment, medications, reproductive or sexual health, biometric or genetic information, precise location near health facilities, or information inferred from other data.

Why we collect and use it

We collect and use consumer health data only as reasonably necessary to provide or help provide a product or service you request, support care operations, maintain safety and security, comply with law, or for another purpose with your authorization.

Sources and recipients

Sources may include you, your authorized representative, providers, clinical entities, pharmacies, laboratories, devices or services you connect, and operational vendors. Consumer health data may be disclosed to the recipient categories listed in How we disclose information when necessary for the requested service or as permitted by law.

We do not sell consumer health data without the separate authorization required by applicable law. Where state law applies, you may have rights to confirm collection, access, delete, or withdraw consent relating to consumer health data. To exercise a right, use the contact method below.

HIPAA and clinical records

The Health Insurance Portability and Accountability Act (“HIPAA”) applies to protected health information handled by covered healthcare providers, health plans, and their business associates. It does not automatically apply to every health-related company, website visit, or piece of health information.

When we handle protected health information for a HIPAA-covered provider as its business associate, the provider’s Notice of Privacy Practices describes how that information may be used and disclosed and explains your HIPAA rights. If this Privacy Policy conflicts with an applicable Notice of Privacy Practices regarding protected health information, the Notice of Privacy Practices controls.

Use the approved secure clinical workflow or patient portal for health information needed for care. Do not send private health information through general support channels unless specifically instructed to do so securely.

Cookies and browser storage

We and our service providers may use browser storage and similar technologies to operate the Services, remember preferences, maintain security, understand performance, and measure communications. You can use browser settings to limit cookies or clear stored data, but some features may not work correctly.

The public site may keep a limited browser value to remember whether you dismissed or completed a site message or offer. The preliminary care questionnaire uses session storage as described above. Standard hosting systems may also create server logs for security, troubleshooting, and delivery.

Some browsers offer a Global Privacy Control or “Do Not Track” signal. Where applicable law requires us to recognize a browser-based opt-out signal, we will treat it as a request for the browser or device that sends it. Because industry responses to “Do Not Track” are not uniform, we do not otherwise respond to that signal.

Your privacy choices

Depending on where you live and subject to exceptions, you may have the right to:

• confirm whether we process your personal information and access or receive a copy of it;
• request correction or deletion;
• withdraw consent for future processing where consent is the basis for processing;
• opt out of sale, targeted or cross-context behavioral advertising, or certain profiling if we engage in those activities;
• limit certain uses of sensitive personal information;
• appeal a decision on a privacy request; and
• exercise rights without unlawful discrimination.

To submit a request, contact us through the method below and describe the right you want to exercise. We may need to verify your identity and request details. An authorized agent may submit a request where permitted, but we may ask for proof of authority and direct identity verification. We will respond within the time required by applicable law.

You can opt out of promotional email by using the unsubscribe link and promotional text by replying STOP. Opting out of marketing does not stop account, transaction, safety, or care-related messages.

Retention and security

We retain personal information for as long as reasonably necessary for the purposes described in this policy, including providing Services, maintaining clinical and transaction records, resolving disputes, preventing fraud, enforcing agreements, and meeting legal, tax, accounting, and regulatory requirements. Clinical record retention may be governed by the healthcare professional or clinical entity responsible for the record and by state law.

We use administrative, technical, and physical safeguards designed to protect personal information, taking into account its nature and the risks involved. No system is completely secure. Protect your password, use a private and updated device, and contact us promptly if you suspect unauthorized access.

Children and visitors outside the United States

The Services are intended for adults and are not directed to children under 13. We do not knowingly collect personal information online from a child under 13 without legally valid permission. If you believe a child has submitted information, contact us so we can review and take appropriate action.

Lennox Services are directed to people in the United States. If you access the Services from another country, your information may be processed and stored in the United States, where privacy laws may differ from those in your location.

Changes and contact

We may update this Privacy Policy to reflect changes in our Services, data practices, or legal requirements. We will change the “Last updated” date and provide additional notice when required.

For questions, privacy requests, or appeals, contact Lennox Health support. Please do not include medical details in a general privacy request. Current patients should use the secure patient portal for patient-specific care or medical-record questions.