Your health is personal, so we built Rovymi to collect as little as possible. This policy explains what we collect, why, and the rights you have. It applies to rovymi.com and to Rovymi's services. Health information you give for medical care is also protected by HIPAA, as described in our HIPAA Notice.
On this page
- The short version
- Scope
- Information we collect
- Where it comes from
- How we use it
- How we share it
- No sale, no ad tracking
- Cookies and similar technology
- Data retention
- Security
- Children
- Your privacy rights
- Consumer health data (Washington, Nevada, Connecticut and similar laws)
- How to make a request
- Do Not Track and Global Privacy Control
- Users outside the United States
- Changes
- Contact
The short version
- We never sell your personal information or health information.
- We do not use advertising pixels, session-recording tools or data brokers on rovymi.com, and we never send health information to advertising platforms.
- Health information goes straight from your browser into a HIPAA-compliant clinical platform; it is not stored on this website.
- Our BMI calculator and the Ask Rovy assistant run in your browser; what you type into them is not sent to us or saved.
- You can ask to see, correct or delete your information, and we will honor that request wherever the law allows.
Scope
This policy covers personal information Rovymi handles as a business. Protected health information ("PHI") created or received by the Medical Group (ZMD of CA, P.C.) to provide care is governed by HIPAA and the Medical Group's Notice of Privacy Practices; where HIPAA applies, it controls. Our technology provider Telea handles PHI under a HIPAA business associate agreement.
Information we collect
- Identity and contact details: name, email, phone number, date of birth, shipping address, and, where required for telehealth, a photo ID and selfie used only for identity verification.
- Health information you provide in the intake and during care: height, weight, medical history, medications, goals, messages with your care team, photos you choose to share, and prescription and order details.
- Payment information: processed by Stripe. We see only limited details such as card brand, last four digits and billing ZIP; full card numbers never touch our systems.
- Gift card details: the purchaser's and recipient's names and email addresses, the amount and the optional message.
- Technical information: IP address, browser and device type, pages visited and timestamps, collected in server logs for security, fraud prevention and reliability.
- Communications: emails and support requests you send us.
Where it comes from
From you; from the Medical Group, Pharmacy and laboratories involved in your care; from our payment and identity-verification providers; and automatically from your browser when you use the website.
How we use it
- To provide the Service: run the intake, route it to a Clinician, process payments, fill and ship prescriptions, and support you.
- To communicate with you about your account, care, orders, billing and the Service.
- To verify identity and eligibility, prevent fraud and misuse, and keep the Service secure.
- To comply with law, respond to lawful requests, and enforce our Terms.
- To improve the Service using aggregated or de-identified information that cannot reasonably identify you.
- To send you marketing about Rovymi only with your consent where required; you can opt out at any time. We never use health information for marketing without your written authorization.
No sale, no ad tracking
Rovymi does not sell personal information, does not share it for targeted advertising, and does not knowingly allow third parties to collect information about your activity on rovymi.com across other sites. rovymi.com does not use third-party advertising or analytics cookies. If that ever changes, we will update this policy before the change, use privacy-preserving settings, honor Global Privacy Control signals, and never send health information to advertisers.
Data retention
We keep personal information only as long as needed for the purposes above. Medical records are retained by the Medical Group as required by state law (often 7 to 10 years, longer for minors). Payment and tax records are kept as required by law. Server logs are kept for a limited period for security. When information is no longer needed, we delete or de-identify it.
Security
We use administrative, technical and physical safeguards appropriate to health information, including encryption in transit (HTTPS with HSTS), encryption at rest on our clinical platform, role-based access with least privilege, sign-in verification, access logging and vendor review. No system is perfectly secure; if a breach affecting your information occurs, we will notify you and regulators as the law requires.
Children
The Service is only for adults 18 and older. We do not knowingly collect information from children under 18. If you believe a child has given us information, email care@rovymi.com and we will delete it.
Your privacy rights
Depending on where you live, you may have the right to: know what personal information we hold and how we use it; get a copy in a portable format; correct inaccurate information; delete it; opt out of sale, sharing for targeted advertising and certain profiling (we do none of these); limit the use of sensitive information; and appeal our decision on a request. We give these rights to every customer, wherever they live, except where a law requires us to keep information (for example, medical records).
Consumer health data (Washington, Nevada, Connecticut and similar laws)
Some states give extra protection to "consumer health data" that is not covered by HIPAA. We collect consumer health data only to provide the Service you request, we do not sell it, and we share it only with the service providers listed above. You may confirm, access and delete your consumer health data and withdraw consent by emailing care@rovymi.com. Our Consumer Health Data Privacy Policy for Washington residents is this section plus the sections above.
How to make a request
Email care@rovymi.com with the subject "Privacy request" and tell us what you would like. We will verify your identity using information we already hold, respond within 45 days (we may extend once by 45 days where the law allows and will tell you why), and never discriminate against you for using your rights. An authorized agent may make a request with your signed permission. If we deny a request, you may appeal by replying to our decision with the subject "Appeal"; we will respond within the time your state requires. If you are not satisfied, you may contact your state attorney general.
Do Not Track and Global Privacy Control
We do not track you across websites. We treat a Global Privacy Control signal from your browser as a valid request to opt out of sale and targeted advertising.
Users outside the United States
The Service is intended only for people located in the United States. Information is processed and stored in the United States.
Changes
We will post any changes here with a new date and, for material changes, notify you before they take effect.
Contact
Privacy questions or requests: care@rovymi.com (subject "Privacy request").