Privacy Policy
Draft — last updated October 9, 2026
1. Information We Collect
Account information (name, email, password); intake and health profile information (sex, age or date of birth, height, weight, medical history, and current medications); medication and dose-tracking logs; weight and food-logging entries you choose to enter; billing contact information (billing name and ZIP code, and card type/last four digits — we do not store full card numbers); and messages you exchange with your care team through the app.
2. How We Use Your Information
To provide the Service — clinical review, prescribing decisions, messaging with your care team, dose and progress tracking, and billing for your membership — and to route a prescription, if one is issued, to the dispensing pharmacy. We do not sell your information.
3. How We Protect Your Information
Data in transit to and from the Service is encrypted. Access to patient data within the Service is restricted by account role (for example, a provider can see only the patients assigned to them), and certain actions — a provider viewing a patient's record, a membership cancellation — are recorded in an internal audit log.
4. Who We Share Information With
Our database hosting provider; the licensed clinicians and contracted clinical partner who provide your care; the dispensing pharmacy (LillyDirect or NovoCare) if a prescription is issued, which requires enough information to fill and ship it; and any payment processor used to bill your membership fee. We do not share your information with anyone else without your consent, except where required by law.
5. Your Rights and Choices
You can access, correct, export, or request deletion of your account information from your profile, or by contacting us. Depending on where you live, you may have additional rights under state or other applicable law.
6. Data Retention
We retain your information for as long as your account is active, and for a period after account deletion as needed to meet legal, billing, and clinical record-keeping obligations. Certain records, such as audit logs, may be retained longer for compliance purposes.
7. Children's Privacy
The Service is not directed to, and we do not knowingly collect information from, anyone under 21.
8. HIPAA Notice
Your health information is handled with privacy protections appropriate to its sensitivity. The subsections below are a placeholder structure, pending attorney review, for how we expect to handle protected health information — not a confirmed compliance claim.
Our status
We expect Lipra Health, or the clinical partner providing your care through the Service, to be a HIPAA covered entity or business associate with respect to your health information. Which of us holds that role, for which pieces of your data, is confirmed by counsel before this notice is final.
Vendors who may handle your health information under a Business Associate Agreement
Our database hosting provider, our contracted clinical partner, and any other vendor that stores or processes your health information on our behalf are expected to sign a Business Associate Agreement (BAA) with us before handling that data. We do not claim HIPAA compliance for any vendor without a BAA actually in place; a pharmacy that dispenses your medication (LillyDirect or NovoCare) is a separate covered entity in its own right for that relationship, not our business associate.
Your rights regarding your health information
Once finalized, this notice will confirm your rights to access and get a copy of your health information, request a correction, request a restriction on certain uses or disclosures, get an accounting of certain disclosures, and file a complaint with us or with the U.S. Department of Health and Human Services if you believe your privacy rights have been violated — without retaliation for filing a complaint.
How to reach us about this notice
Email support@lipra.health with any question about this HIPAA Notice or to file a complaint; we will confirm the full complaint process, including any applicable response timeline, once this section is finalized.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated before they take effect.
10. Contact
Questions about this Privacy Policy can be sent to support@lipra.health.