Privacy Policy

Effective date: October 28, 2026 · Version 2026-10-28.1

This policy explains how Rx ReLeaf handles information when you visit rxreleaf.com, contact us, request services, or use a patient app feature made available to you. App-specific sections apply only when the corresponding feature is offered. A service description here does not establish that an app feature has been released. The clinical Notice of Privacy Practices separately governs the clinic’s protected health information.

Who is responsible

Rx ReLeaf LLC operates the website and patient app and provides administrative services. Rx ReLeaf Clinic LLC is responsible for the clinic’s medical services and medical records. When a separate treating provider supplies a service, that provider is identified in the relevant intake or visit information and is responsible for its clinical decisions and records.

This app notice supplements the clinic’s Notice of Privacy Practices, available here and from clinic staff. That HIPAA notice explains permitted uses and disclosures of protected health information and your medical-record rights. This app notice does not replace it, reduce a legal right, or provide a general authorization to use health information for marketing. Acknowledging receipt of the HIPAA notice is separate from agreeing to optional AI or marketing features.

Website, cookies, analytics, and advertising

On the public website, we receive information you submit through inquiries, newsletter sign-ups, booking requests, and optional chat, including your name, contact details, message, and consent choices. Technical information may include IP address, browser and device information, referring pages, page views, and cookie or advertising identifiers. Do not submit medical records, payment-card details, passwords, or government identifiers through ordinary website forms or chat. Call for secure instructions when sensitive information is needed.

Kinsta hosts the WordPress website. Cookiebot by Usercentrics provides cookie preferences. HubSpot supports forms, customer relationship management, and communications. Google services support analytics and search-performance measurement; advertising integrations may include Meta. Cookies, pixels, embeds, and similar technologies may process device and online-activity information for operation, measurement, or advertising, depending on the feature, applicable permissions, and settings. A cookie banner is not permission to disclose protected health information to an advertising platform. We do not treat a general inquiry or marketing opt-in as that authorization.

Use the website’s cookie settings control and your browser settings to manage applicable choices. Some necessary features may still operate; blocking technologies may affect functionality. Certain advertising disclosures may count as sharing or targeted advertising under applicable state laws even where no money is paid. Contact executive staff handling privacy requests to exercise an applicable opt-out or other privacy right. We do not sell personal information for money.

The website offers optional Ashley AI assistance. Messages, voice audio where enabled, transcripts, contact details, service interests, appointment details, and any health information you choose to supply may be processed by Retell AI and OpenAI to understand and answer your request and assist with scheduling or follow-up. Ashley is not a clinician or emergency service. You may contact staff instead. Any required express permission, provider agreement, or specific legal authorization must be obtained before the relevant data use; this policy itself grants none of those permissions.

Booking and checkout use the provider shown in the relevant flow, including Boulevard for clinic scheduling and payment. External telehealth, laboratory, imaging, pharmacy, map, video, and other services may process information under their own notices. Review the destination and its terms before submitting information. Browsing, a general inquiry, or an appointment request does not by itself establish a clinician-patient relationship.

Information we handle and how we collect it

We receive information you enter, information generated by features you choose, and information returned from the services that provide those features. The information depends on how you use the app:

• Account and identity: name, email address, mobile number, account identifier, verification results, sign-in events, and permission records. Microsoft provides authentication. We use verified contact details to establish account access.
• Patient profile and appointments: the profile and booking details needed for your chosen service, including name, contact information, date of birth, address, service, location, provider, appointment time, booking status, and related payment or cancellation status. Profile details can come from you or your connected patient record.
• Ashley conversations: messages, live voice audio, transcripts, conversation outcomes, and information you type or say, which may include your name, email address, phone number, service interests, appointment details, or health information. Voice sessions are processed to understand speech and generate responses. Retention practices are described below.
• Payments: the appointment’s quoted amount, deposit or full-payment requirement, payment status, and limited card-on-file references needed for checkout. You enter card numbers and security codes through the scheduling payment provider’s card form; the app’s own server does not receive or store those fields.
• Communications and support: requests you send us, the channel you select, consent and opt-out records, delivery events, and the information staff need to respond.
• Technical information: device and app characteristics, IP address, request and security events, and notification-device tokens needed to operate, protect, and troubleshoot the app. Where device biometric unlock is offered, the operating system handles that authentication; do not send a face image or biometric template to staff for account access.

How we use information

We use information to create and protect your account; verify and connect the correct patient record; show your profile and eligible appointments; process changes you request; arrange and confirm bookings; provide support; operate optional Ashley assistance; deliver communications you request or permit; detect misuse; resolve disputes; and meet legal, clinical, accounting, and recordkeeping obligations.

A phone number or email match identifies a possible record, not proof that someone owns the record. We use verification and identity checks before granting access. Conflicting or multiple matches require additional review. Staff may need to correct a duplicate or mismatched record. We do not rely on a shared phone number alone to disclose another person’s profile.

Service providers and recipients

We use the following providers for the functions described here. Information is sent for the function you request or for necessary account, security, recordkeeping, and support operations:

• Microsoft: account identifiers, verified contact details, authentication and security information for sign-in and account management. A clinic telehealth appointment may also use Microsoft Teams and its separate visit instructions.
• Boulevard: patient identity and profile details, appointments, chosen services, scheduling status, and checkout information for clinic scheduling and payment. Information you submit to its card form goes to its payment service.
• HubSpot: customer relationship and communications administration. Patient-app transfers of patient-specific profile, clinical appointment, service-interest, conversation-outcome, or follow-up records require the appropriate contractual coverage, eligible account settings, data fields, and access controls before they may be enabled. Existing records remain subject to applicable access, correction, retention, and deletion obligations.
• Retell AI and OpenAI: the Ashley information described in the next section, subject to the permissions and legal conditions applicable to the feature, to process voice or messages and generate AI responses. Retell also processes conversation records and technical information needed to run those sessions.
• Render: application requests, account and permission records, and related information processed by our hosted application and database. Health-information workflows require the applicable protected hosting arrangement and eligible services.
• Apple and Google: app distribution information, notification-device tokens, and generic notification content when you enable push notifications. Your device or store account may also supply diagnostics under settings controlled by that platform.
• Qualiphy and the treating provider: intake, identity, contact, payment, and health information needed when you choose virtual urgent care. Its intake identifies the applicable provider and presents service-specific privacy and treatment information.
• Communications providers: contact details, message content or approved call instructions, consent status, and delivery events when we send requested service messages, permitted promotional messages, or an outbound call you separately authorize. A message or call identifies Rx ReLeaf.

Before enabling an app-based Ashley data-sharing feature, we require written provider obligations covering confidentiality, security, permitted use, assistance with rights and deletion, and the same or equivalent protection for personal information as our commitments in this notice. Where HIPAA applies, the appropriate business associate arrangement and eligible service configuration are required. A contract does not make every feature offered by a vendor eligible to process health information.

Providers may use approved subcontractors to perform their services. Information may be processed outside the United States where the applicable arrangements allow it; this notice does not promise that every recipient or data copy remains in the United States. We may also disclose information when law requires it, to protect legal rights and safety as permitted by law, or in a business transition subject to applicable privacy duties. We do not sell your health information or use Ashley conversations, patient profiles, or appointment details for targeted advertising.

Your separate choice about Ashley

Ashley is an AI receptionist. For an app-based Ashley session, separate express permission is required before sending messages, voice audio, transcripts, and information you type or say, including name, email address, phone number, service interests, appointment details, and health information to Retell AI and OpenAI. They process that information to understand your request, generate responses, answer questions about Rx ReLeaf services, and assist with scheduling or a staff follow-up you request.

You can decline and continue using other app features. You can withdraw a previously given permission through the available profile controls or by contacting executive staff handling privacy requests. Withdrawal stops new Ashley use; it does not recall information already sent or automatically delete records that must be retained. If a material change requires a new choice, we will ask again before the changed use.

Ashley can make mistakes. It does not diagnose, prescribe, select treatment, or replace a licensed professional. Ask a clinician about medical decisions. Do not provide payment-card numbers, passwords, government identifiers, or information about someone else that you are not authorized to share. These instructions do not waive our privacy or security responsibilities.

Notifications, service communications, and marketing

Where push notifications are offered, protected details should be viewed after unlocking and signing in, rather than through a lock-screen preview. You can turn push notifications off in your device settings. Permissions for microphone use, notifications, and device unlock are controlled separately by your device.

Account verification, appointment communications, and responses to your requests are service communications. Optional promotional email or text messages require the relevant separate choice. Outbound calls using an artificial or AI-generated voice require their own permission where required; permitting an Ashley conversation does not by itself permit promotional texts or outbound AI calls.

Marketing permission is not a condition of buying a service or receiving care. Promotional text consent identifies Rx ReLeaf, describes the messages, and explains that frequency varies, message and data rates may apply, and you can reply STOP to opt out or HELP for assistance. Use the unsubscribe link in a promotional email or contact us to change a preference. Opting out of marketing does not erase an appointment or stop communications required by law. Permission records are maintained to document and honor the choices given.

We do not combine a general app acknowledgment with permission to use protected health information for marketing. If a proposed use needs a specific HIPAA authorization or other legal permission, we must obtain that permission before the use. A marketing opt-in does not authorize disclosure of health information to advertising platforms.

Retention, redaction, and security

Recording, transcript, and conversation retention depends on the enabled voice or chat service, its account settings, and applicable legal obligations. This policy does not promise a universal 30-day deletion period or that every identifier is removed. Information processed during a session may remain in appointment, support, consent, security, or legally required records. Contact executive staff handling privacy requests about a particular record or a deletion request.

OpenAI’s retention depends on the service, endpoint, and account arrangements. A setting that limits application-response storage does not by itself establish zero retention across security logs, providers, or legally required records. Required health-information coverage and any approved retention controls must be verified for the actual processing path before it is enabled.

A provider-specific conversation deletion setting does not erase all information held by Rx ReLeaf, HubSpot, Microsoft, scheduling providers, treating providers, backups, or legally required records. We retain account, consent, appointment, support, billing, and medical information for the purpose it serves and the applicable legal period. Retained backup or legal copies remain protected and restricted to their permitted purpose. Records for care may need to be kept after app access ends. Ask us about a particular record if you need its applicable retention period.

We use administrative, technical, and physical safeguards appropriate to the information, including encrypted connections, authentication, and access controls. Provider arrangements and eligible account settings must be verified before enabling health-information features that depend on them. Only people with a service or legal need should receive access. No system provides absolute security. When an incident requires notice, we provide the notices required by applicable law.

Access, correction, deletion, and complaints

You may request access to, correction of, or deletion of eligible app information through your profile or by contacting us. We verify identity before responding and may ask for information needed to complete a request. You can request deletion of your app account without sending medical information in ordinary email.

An approved app-account deletion request ends app access and removes eligible app-only data, subject to the applicable exceptions. It does not automatically cancel appointments, memberships, or payment obligations, or erase a clinic’s medical record. We may retain records needed for clinical, legal, billing, fraud-prevention, dispute, or consent-evidence purposes. We explain applicable exceptions when handling your request. You can separately ask the clinic for medical-record access, an amendment, or other rights described in its Notice of Privacy Practices, available here and from clinic staff.

Applicable law may also give you rights to restrict certain uses, withdraw consent, receive a portable copy, appeal a privacy-request decision, or complain to a regulator. We assess those rights according to the information and law involved. Contact us if you disagree with a response. You may also complain to the U.S. Department of Health and Human Services Office for Civil Rights about HIPAA matters without retaliation.

Children and emergencies

The app is not intended for independent use by children under 13. A parent or legal guardian should contact Rx ReLeaf about a minor’s care and the appropriate account or authorization process. If you believe a child provided information without the required authority, contact us so we can assess and respond.

The app and Ashley are not emergency services. Call 911 in an emergency. For an urgent clinical concern, contact a qualified healthcare professional rather than relying on an AI response.

Changes to this notice

We update this notice when our practices or applicable requirements change. The effective date and version identify the notice in use. We provide notice of material changes and request new permission when required before a new use. An update does not retroactively expand a prior permission or remove a legal right.

SMS and text messaging privacy

SMS section updated October 28, 2026.

When you choose to communicate with Rx ReLeaf by text, we collect your mobile number, message content, consent and opt-out records, and delivery information to respond to inquiries and provide the customer-care communications you request. These may include scheduling, service follow-up, billing questions, and event coordination. We use service providers, including RingCentral and mobile carriers, to deliver and support these messages.

SMS consent is not shared with third parties or affiliates for their marketing or promotional purposes. Mobile opt-in information and consent are not sold or shared for marketing; providers may process them only as needed to operate the messaging service.

Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for assistance, or call 732-291-0000. General text messaging is not an emergency service and is not guaranteed to be secure. Contact staff for a suitable channel before sending sensitive medical information. See our SMS terms.

Contact and privacy requests

Please begin an email request with your name and how we can contact you. Do not include medical details, identification documents, passwords, or payment-card information in ordinary email. We will arrange a suitable way to verify and handle your request.