Privacy Policy
What information we collect, how it is used and protected, how HIPAA applies to your care, and the choices you have. We never sell your health information.
On this page
1Scope and who is responsible
This Privacy Policy explains how Surna Health LLC ("Surna," "we," "us") collects, uses, shares, and protects personal information when you use surnahealth.com, our apps, and related services (the "Services").
Surna works with independent parties to deliver care:
| Party | Role | Privacy rules that apply |
|---|---|---|
| Surna Health | Technology platform, customer support, billing, and administrative services | This Privacy Policy |
| Medical Groups and Providers | Independent licensed clinicians who evaluate and treat you | HIPAA and the Medical Group's Notice of Privacy Practices |
| Partner Pharmacies | Independent state-licensed pharmacies that fill and ship prescriptions | HIPAA and the pharmacy's Notice of Privacy Practices |
2How HIPAA applies
Health information you provide to a Provider for diagnosis and treatment, such as intake answers, messages with your Provider, prescriptions, and lab results, is protected health information ("PHI") held by the Medical Group, which is a covered entity under HIPAA. Surna collects your assessment answers on behalf of the Medical Group, as its business associate, from the moment you submit them.
When Surna handles PHI on behalf of a Medical Group or pharmacy, we do so as a business associate under a written business associate agreement, and use it only as that agreement and HIPAA allow. The Medical Group's Notice of Privacy Practices, which is provided to you when you become a patient and is available on request at support@surnahealth.com, describes your HIPAA rights, including rights to access and amend your records.
Some information Surna collects is not PHI, such as browsing on our public website before you start an assessment, or your marketing preferences. This Privacy Policy covers that information. Anything that relates to your health but is not PHI is treated as sensitive and handled as described in Section 9 (Consumer Health Data).
3Information we collect
| Category | Examples | Source |
|---|---|---|
| Identifiers and contact | Name, email, phone, shipping and billing address, date of birth, account login | You |
| Identity verification | Government ID image, selfie photo, verification results (see "Identity verification and biometrics" in Section 7) | You; ID verification vendors |
| Health information | Assessment answers, medical history, medications, allergies, weight and BMI, vitals, hormone levels, sexual and reproductive health information, uploaded photos, lab results, messages with Providers, prescriptions, treatment plans | You; Providers; labs; pharmacies |
| Payment and transactions | Order history, subscription status, last four digits of card (full card numbers are held by our payment processor) | You; payment processors |
| Device and usage | IP address, device and browser type, pages viewed, clicks, approximate location from IP, app diagnostics | Automatically, via cookies and similar tools |
| Communications | Support chats, emails, survey responses | You |
| Location for care | The state you are in at the time of a visit, to confirm Provider licensure | You; device, with permission |
4How we use information
- Provide the Services: create your account, verify identity and location, route your assessment to a Medical Group, support visits and messaging, and coordinate prescriptions and shipping with Partner Pharmacies.
- Payments and subscriptions: process charges, renewals, refunds, and receipts.
- Support and communications: respond to requests and send service messages such as visit, refill, and shipping notices.
- Safety, security, and fraud prevention: detect misuse, duplicate accounts, and unlawful activity.
- Improve the Services: analyze usage, using de-identified or aggregated data where possible. We keep de-identified data in de-identified form and will not attempt to re-identify it.
- Marketing: send offers about Surna programs where permitted by law and your preferences. We do not use PHI for marketing without your written authorization.
- Legal compliance: meet legal, regulatory, and tax obligations and enforce our Terms.
7Security, retention, and children
Security. We use administrative, technical, and physical safeguards designed to protect information, including encryption in transit and at rest, access controls, and vendor due diligence. No system is perfectly secure. If a breach affects your information, we will notify you and any required regulators as required by law, including HIPAA and, for health information not covered by HIPAA, the FTC Health Breach Notification Rule and state breach laws.
Retention. We keep personal information as long as needed to provide the Services and meet legal obligations. Medical records are kept by Medical Groups and pharmacies for the periods state and federal law require, often 7 to 10 years or longer, and may not be deletable on request.
Identity verification and biometrics. Our identity-verification vendor may compare your selfie to your ID photo using facial geometry. Before you take a selfie, we will ask for your separate written consent, which explains the purpose, our vendor, and how long the data is kept. Biometric data is used only for identity verification, is not sold or disclosed except to our verification vendor, and is permanently destroyed within 30 days after verification.
U.S. only. The Services are intended for people in the United States, and information is stored and processed in the United States.
Children. The Services are for adults 18 and older. We do not knowingly collect information from anyone under 18. If we learn we have, we will delete it.
8Your choices and privacy rights
- Account and marketing: update your information in your account; unsubscribe from marketing emails using the link in any email; reply STOP to marketing texts.
- HIPAA rights (for PHI): access, copies, amendment, an accounting of disclosures, and restrictions, as described in the Medical Group's or pharmacy's Notice of Privacy Practices.
- State privacy rights: depending on where you live (for example California, Colorado, Connecticut, Virginia, Texas, Oregon, and other states with consumer privacy laws), you may have the right to know, access, correct, delete, and get a portable copy of your personal information; to opt out of targeted advertising, sale, or profiling; and to limit use of sensitive personal information. We use sensitive personal information only for purposes permitted by California regulations (Cal. Code Regs. tit. 11, § 7027(m)), such as providing the Services you request.
- How to exercise rights: email privacy@surnahealth.com. We confirm receipt within 10 business days and respond within 45 days, which may be extended once by 45 days with notice. We will verify your identity before responding. An authorized agent may submit a request with proof of authorization. If we deny your request, you may appeal by replying to our decision; if the appeal is denied, you may contact your state attorney general.
- No discrimination: we will not deny service or charge different prices because you exercised your privacy rights.
Additional disclosures for California and other state residents
Notice at collection. We collect the categories of personal information in Section 3, from the sources listed there, for the purposes in Section 4. We keep each category only as long as needed for those purposes and our legal obligations, as described in Section 7.
| Category (California) | Disclosed for a business purpose to | "Sold" or "shared"? |
|---|---|---|
| Identifiers and contact information | Medical Groups, pharmacies, labs, service providers | Device identifiers from our website pages may be shared with advertising partners for targeted advertising, with your consent. Hashed email and phone are shared only if you opt in to the customer conversion signal. Never sold for money. |
| Internet and device activity | Service providers | Browsing on our website pages, including program and condition pages, may be shared with advertising partners, with your consent. Never from assessment, checkout, account, or patient portal pages. |
| Health, medical, and sexual health information | Medical Groups, pharmacies, labs, HIPAA-compliant service providers | No. Never sold or shared. |
| Government ID, verification, and biometric data | ID verification providers, Medical Groups | No |
| Payment and commercial information | Payment processors, service providers | Only the fact that you became a customer, with the order date and a fixed conversion value, and only if you opt in to the customer conversion signal. Never the program or product. |
| Approximate location (state) | Medical Groups, service providers | No |
Sensitive personal information. We use sensitive personal information, such as health information and ID data, only to provide the Services you request and for other purposes the law permits without an opt-out, so we do not offer a separate "limit" choice. The only exception is the optional customer conversion signal in Section 6, which is sent only with your opt-in consent and which you can withdraw anytime. We do not knowingly sell or share the personal information of consumers under 16.
California "Shine the Light." We do not share personal information with third parties for their own direct marketing purposes.
Nevada. We do not sell covered information as defined by Nevada law. You may still send an opt-out request to privacy@surnahealth.com.
9Consumer Health Data Privacy Policy
This section applies to "consumer health data" as defined by the Washington My Health My Data Act, Nevada SB 370, and the Connecticut Data Privacy Act, and to similar data under other state laws. It does not apply to PHI governed by HIPAA.
Consumer health data we collect
Information that identifies or relates to your physical or mental health, such as weight goals, sexual health, hormone status, hair loss, sleep concerns, interest in any of our programs (Weight Loss, Men's Hormone, Men's Vitality, Women's Hormone, Cellular Health, Sleep & Recovery, Longevity Stack, Hair Loss) that you browse or select, and information inferred from those choices. Assessment answers you submit are PHI handled under HIPAA (Section 2).
Why we collect and use it
To provide the Services you request, including showing which programs may fit you, routing you to a Provider, and supporting your account. We collect and share it only with your consent or as necessary to provide what you asked for.
Sources
Directly from you, from your use of the Services, and from Medical Groups, pharmacies, and labs.
Who we share it with
Medical Groups, Partner Pharmacies, labs, and service providers acting on our behalf (Section 5). Because visiting a telehealth website, including a page about a specific program or condition, may itself be considered consumer health data under some state laws, advertising cookies run only after your separate, specific consent (Section 6). Because the fact that you became a customer of a telehealth service may also be consumer health data, we share that signal with advertising partners only if you give separate consent at checkout (Section 6), and you may withdraw it anytime. We never share assessment answers, the treatment you choose, or other health information you enter with advertising platforms, and we never sell consumer health data.
Your rights
You may confirm whether we collect, share, or sell your consumer health data; access it, including a list of third parties and affiliates it was shared with; withdraw consent; and request deletion, including from our processors. Submit requests to privacy@surnahealth.com. We respond within 45 days, which may be extended once by 45 days with notice. You may appeal a denial by replying to our decision; if your appeal is denied, you may contact the Washington, Nevada, or Connecticut attorney general.
Geofencing
We do not use geofences around healthcare facilities to identify, track, or send messages to consumers.
10Changes to this Policy
We may update this Privacy Policy. We will post the new version with a new "Last updated" date and, for material changes, notify you by email or in the Services before they take effect. Where required, we will ask for your consent before using consumer health data in a new way.
11Contact us
Surna Health LLC · Attn: Privacy
30 N. Gould St., Ste. R, Sheridan, WY 82801
Email: privacy@surnahealth.com