Consumer Health Data Privacy Notice

This notice applies to visitors to our website and is required by Washington’s My Health My Data Act, Nevada SB 370, and similar state consumer health data laws. It supplements, and does not replace, our Privacy Policy.

If you are a Praxiom patient, the information we hold about your care is protected health information governed by HIPAA and by our Notice of Privacy Practices, not by this notice. Those state laws expressly exempt information covered by HIPAA. This notice is about the narrower question of what our website observes about someone who is only reading it.

Because Praxiom offers one kind of care, the fact that you visited this website can imply an interest in weight-loss treatment. We treat the following as consumer health data for that reason, even though none of it is health information you gave us:

• A random identifier. A first-party cookie named praxiom_pcid containing a randomly generated value. It is not derived from anything about you — not your name, email, device, or IP address — and means nothing outside our systems. It expires after 90 days.
• Which pages you viewed and what you clicked, including pages that name a specific medication or program.
• How you arrived. The advertising click identifier contained in the link you followed, if there was one, any campaign tags on that link, and the domain name of the website that referred you. We store the referring domain only, never the full referring address.

The purpose is measuring our own advertising. We use this to learn which advertisements and pages lead people to enquire, so we can stop paying for the ones that do not. We do not use it to build a profile of you, to infer anything about your health, or to decide what care or pricing you are offered.

Sources. All of it comes directly from your browser as you use our website. We do not buy consumer health data, receive it from data brokers, or obtain it from any third party.

We do not collect any of the above, and set no cookie, if any of the following is true:

• Your browser sends a Global Privacy Control signal. We honour it automatically. You do not need to ask us.
• You appear to be in Washington or Nevada. Those states require your consent before this kind of information may be collected at all. Rather than ask you for it, we simply do not collect it — including from people we can and do treat there. This is determined from the apparent location of your network connection, which is approximate.
• You are on our patient intake or portal pages. Measurement does not run on any page where health information is entered or displayed.

This is why our website has no cookie consent banner. Rather than ask you to authorise collection, we have limited what is collected to what does not require it.

We do not sell consumer health data. We have never sold it and we do not have a process for doing so.

We share a strictly limited signal with the advertising platforms we buy from — currently Google and Meta. When one of their advertisements leads to an enquiry, we tell them three things: their own click identifier from the original advertisement, a generic event name such as “lead” or “purchase”, and a fixed numeric value that is the same for everyone in that category.

What is never included in that signal, in any form:

• Your name, email address, telephone number, postal address, or date of birth — including hashed, encrypted, or otherwise encoded versions of them, which we do not send either
• Your IP address or device identifiers
• Which page you were reading, or any medication, condition, or program name
• The amount you paid, or anything from which a dose or clinical decision could be inferred
• Anything at all about a patient, as distinct from a website visitor

We do not run retargeting or remarketing advertising of any kind, and we do not upload customer or patient lists to any advertising platform.

Our other recipients are service providers who operate our systems under written contracts that prohibit using the data for their own purposes: our website host, our cloud data provider, and our clinical platform. We also may disclose information where the law requires it.

Consumer health data collected through this website is stored in the United States, in a Google Cloud environment covered by a HIPAA Business Associate Agreement and restricted to a small number of named employees.

The praxiom_pcid cookie expires after 90 days. The records held against it — the pages you viewed and how you arrived — are deleted automatically after 13 months. That is not a policy we apply by hand: the deletion is configured on the storage itself, so it happens whether or not anyone remembers.

We keep one thing longer. A log of what we sent to advertising platforms is retained for 25 months, because it is the record proving what was disclosed. It contains no identifier of any kind — not yours, not anyone’s — and cannot be linked back to you.

You have the right to:

• Confirm whether we are collecting or sharing your consumer health data, and access it
• Withdraw consent to its collection and sharing
• Have it deleted, including from our archived and backup systems, and to have us instruct any recipient to delete it
• Not be discriminated against for exercising any of these rights

To withdraw consent immediately and without contacting us, enable Global Privacy Control in your browser or install an extension that supports it. We stop collecting on your next page load. Clearing the praxiom_pcid cookie in your browser settings has the same effect for that device.

To make a request of us, email hello@praxiomhealth.com or call 1-888-455-3411, Monday to Friday, 9am to 5pm ET. Because the identifier we hold is random and not linked to your name, the practical way to identify your records is to send us the value of your praxiom_pcid cookie; if that is not workable, tell us and we will find another way rather than refuse the request.

We will respond within 45 days, and will tell you before that if we need a further 45 days. If we decline a request we will explain why and how to appeal; if we deny an appeal we will give you a link to submit a complaint to your state attorney general.

If we change what we collect or who receives it, we will update this notice and change the effective date above before the change takes effect. We will not apply a change retroactively to data already collected without your consent.

Praxiom Health LLC, 230 South Bemiston Suite 1000, St. Louis, MO 63105. Email hello@praxiomhealth.com or call 1-888-455-3411.