On This Page
California Privacy Rights (CCPA/CPRA)
Scope & Applicability
This California Privacy Rights Notice ("CA Notice") is provided to California residents pursuant to the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA), California Civil Code §1798.100 et seq. It supplements the information in our general Privacy Policy.
This CA Notice describes how Hotspan Meds, LLC collects, uses, discloses, and retains Personal Information about California consumers, and describes the rights California consumers have regarding their Personal Information.
Note for Health Information: Much of the personal information we collect qualifies as Protected Health Information (PHI) under HIPAA. HIPAA-covered PHI is generally exempt from certain CCPA rights. Where HIPAA applies, our HIPAA privacy practices govern. For non-PHI personal information, this CA Notice applies.
Categories of Personal Information We Collect
In the preceding 12 months, we have collected the following categories of Personal Information from California consumers:
- Identifiers: Real name, email address, postal address, phone number, IP address, and account identifiers
- Personal information under California Civil Code §1798.80: Name, address, telephone number, payment card information (processed by third-party processor; we do not store full card numbers)
- Protected classification characteristics: Date of birth, gender, and other health-related demographic information collected for clinical purposes
- Health and medical information: Medical history, diagnoses, medications, symptoms, treatment plans, and other health data (see HIPAA note above)
- Commercial information: Products and services purchased, subscription history, billing records
- Internet or network activity: Browsing history on our platform, page interactions, clickstream data, session duration
- Geolocation data: General location derived from IP address (country, state, city)
- Inferences: Inferences drawn from the above to create a profile about treatment needs, product preferences, and service usage
We collect this information directly from you, automatically through your use of our Services, and from third-party sources such as analytics providers.
Purposes for Collection & Use
We collect and use Personal Information for the following business and commercial purposes:
- Providing telehealth services and facilitating physician consultations
- Processing transactions and managing subscriptions
- Communicating with you about your care, account, and service updates
- Improving and personalizing the Services
- Analytics and research to understand platform usage
- Marketing communications about our services (subject to opt-out)
- Legal compliance, fraud prevention, and security
- Auditing and reporting as required by law
Sale or Sharing of Personal Information
Hotspan Meds does not sell your Personal Information for monetary consideration.
We may "share" certain categories of Personal Information (as defined under CPRA — sharing information with third parties for cross-context behavioral advertising) with analytics and advertising partners. Categories of information that may be shared in this context include identifiers and internet activity data. We do not share health or medical information for advertising purposes.
You have the right to opt out of the sharing of your Personal Information for cross-context behavioral advertising. See "How to Submit a Request" below, or click "Do Not Sell or Share My Personal Information" in the footer of our website.
Your California Privacy Rights
Right to Know
You have the right to request that we disclose what Personal Information we have collected about you, including the categories of information, sources, purposes for collection, categories of third parties with whom we share it, and specific pieces of information.
Right to Delete
You have the right to request deletion of Personal Information we have collected about you, subject to certain exceptions (e.g., information needed to complete a transaction, for legal compliance, or to detect security incidents).
Right to Correct
You have the right to request correction of inaccurate Personal Information we maintain about you.
Right to Opt Out of Sale/Sharing
You have the right to opt out of the sale or sharing of your Personal Information. We do not sell personal information. To opt out of sharing for advertising purposes, submit a request as described below or use a Global Privacy Control (GPC) signal from your browser (we will honor GPC signals).
Right to Limit Use of Sensitive Personal Information
You have the right to limit the use and disclosure of Sensitive Personal Information to what is necessary to perform the services you requested.
Right of Non-Discrimination
You have the right not to receive discriminatory treatment for exercising your California privacy rights. We will not deny you services, charge different prices, or provide a different quality of service because you exercised your rights under CCPA/CPRA.
Sensitive Personal Information
Under CPRA, certain categories of Personal Information are classified as "Sensitive Personal Information," including health and medical information, financial information, racial or ethnic origin, and precise geolocation. We collect the following Sensitive Personal Information:
- Health and medical history, conditions, and treatment information
- Payment card information (handled by our PCI-compliant processor)
- Date of birth and demographic identifiers provided during intake
We use Sensitive Personal Information only to provide the requested Services, for legal compliance, and for security purposes. We do not use Sensitive Personal Information for advertising, profiling, or purposes unrelated to your care without your explicit consent.
Retention of Personal Information
We retain Personal Information for as long as necessary to provide our Services, fulfill the purposes for which it was collected, comply with legal obligations (including medical record retention requirements), resolve disputes, and enforce our agreements. Retention periods vary by information type and applicable law. Health records are generally retained for the period required by applicable state law, typically 7–10 years from the last date of service.
How to Submit a Request
California residents may submit rights requests by:
- Email: privacy@meds.hotspan.com — Subject line: "California Privacy Rights Request"
- Toll-free phone (upon request): Contact us at the email above for a phone callback
We will verify your identity before processing any request. Verification may include confirming your email address, account information, or other identifying details. We will respond within 45 days. If we require additional time (up to 90 days total), we will notify you with an explanation.
You may submit up to two (2) requests per 12-month period for access and deletion.
Non-Discrimination
We will not discriminate against you for exercising your California privacy rights. We will not deny goods or services, charge different prices, provide a different quality of goods or services, or suggest that you will receive different treatment as a result of exercising your rights.
Changes to This Notice
We will update this CA Notice at least once every 12 months or when there are material changes to our data practices. The date of the last update is stated at the top of this page.
Contact
Privacy Officer, Hotspan Meds, LLC
Email: privacy@meds.hotspan.com
Subject: California Privacy Rights Request