Privacy Policy

How HYDROINFUSION collects, uses, shares, and protects personal information through our website, patient portal, and clinical services.

1. Who we are

HYDROINFUSION PLLC ("HYDROINFUSION," "we," "us," or "our") is an Illinois professional limited liability company that operates a concierge mobile medical practice in Chicago. We furnish concierge wellness, longevity, and telehealth services through advanced practice registered nurses and family nurse practitioners licensed in Illinois.

Certain non-clinical functions, including technology, marketing, scheduling, billing administration, and patient experience operations, are administered by MedXpreneur LLC on behalf of the practice under a written Management Services Agreement. MedXpreneur LLC acts as a Business Associate of HYDROINFUSION PLLC to the extent it accesses or processes protected health information. Clinical decision-making is made solely by HYDROINFUSION PLLC clinicians.

We collaborate with trusted third-party companies that provide technology infrastructure, laboratory services, compounding pharmacy fulfillment, telehealth network access, and patient experience tools. Their roles and our disclosures to them are described in section 6 below.

2. Information we collect

Information you provide

• Contact data, such as your name, postal address, email address, and other contact identifiers.
• Account data, such as your username, password, security questions, and account preferences.
• Demographic data, such as your date of birth, gender, and ZIP code.
• Service-eligibility data, such as your intake responses, screening questionnaires, and health history.
• Health-related data, such as symptoms, conditions, allergies, current medications, prior treatments, lab results, and wellness goals you share through the patient portal, intake, or messaging with our clinicians. This data is generally protected health information governed by our HIPAA Notice of Privacy Practices.
• Payment data, such as payment card information, billing address, and transaction history. Card details are processed by our payment processors (for example, Stripe) and not stored on our servers.
• Government-issued identification data, such as a driver's license or passport image, used for identity verification.
• Communications data, such as your messages, emails, calls, and other communications with us.
• User-generated content, such as testimonials, reviews, photographs, and other content you submit.
• Marketing data, such as your responses to our marketing, communication preferences, and interaction with our advertisements.

Information collected automatically

• Device data: operating system type and version, browser type, screen resolution, IP address, mobile carrier, device type, and similar identifiers.
• Online activity data: pages or screens viewed, search history, time spent on pages, navigation paths, referring URL, access times, and email opens or clicks.
• Precise geolocation data: collected only when you grant our mobile application or website permission to access your device's location.
• Cookies and similar technologies: cookies, web beacons, pixel tags, local storage, and chat technologies. See our Cookie Policy for details and your choices.

Information from third-party sources

We may combine information you provide with information we obtain from other sources, such as:

• Public sources, such as government agencies, public records, professional directories, and other publicly available sources.
• Private sources, such as data providers and social media platforms.
• Linked third-party services, such as Google, Apple, or other third-party services you use to log in to or link to your HYDROINFUSION account. This may include your username, profile picture, and other information your account settings make available.
• Linked third-party devices, such as wearable or Internet of Things devices that you link to your HYDROINFUSION account. This may include device-app health information and historical data related to your use of the wearable.
• Lab and provider partners, including reference laboratories, compounding pharmacies, imaging providers, and other healthcare and medical-adjacent service providers we coordinate with on your behalf.
• Enterprise customers, such as employers, gyms, wellness companies, and other entities through which you may have received access to our services. They may provide us with your contact data and service-eligibility data.
• Marketing partners, such as joint marketing partners and referral sources.

3. How we use your information

We use your information for the following purposes:

Service delivery and operations

• Provide, operate, and improve our services and our business.
• Process your intake, bookings, payments, and program enrollments.
• Verify your identity and confirm your eligibility for services.
• Coordinate clinical care, including sending prescriptions to compounding pharmacies, ordering labs, and arranging in-home or telehealth visits.
• Communicate with you about appointments, programs, billing, security, and clinical care.
• Provide customer support and respond to your requests.

Insights and development

• Analyze how patients and visitors use our website and patient portal.
• Conduct internal research and quality improvement.
• Develop new services, programs, and features.

Marketing and advertising

• Send direct marketing about our services and programs when you have opted in or where permitted by law.
• Personalize marketing based on your interests and your account activity.
• Conduct interest-based advertising on third-party platforms. We do not use health-related data or genetic data for interest-based advertising.
• Administer promotions, referral programs, and events.
• Use testimonials and reviews you submit, where you have separately authorized such use.

Compliance and protection

• Comply with applicable laws, subpoenas, court orders, and lawful requests.
• Protect the rights, privacy, safety, or property of HYDROINFUSION, our patients, and others.
• Detect, investigate, and prevent fraud, abuse, security incidents, and unlawful activity.
• Enforce our Terms of Use, Cancellation Policy, and other agreements.

De-identified and aggregated data

We may create de-identified or aggregated data that cannot reasonably be used to identify you and use that data for any lawful purpose, including research, benchmarking, and service improvement. We do not attempt to re-identify de-identified data except to test our de-identification processes.

4. How we share your information

We share your information with the following categories of recipients:

• Service providers, including hosting, IT, customer support, email delivery, marketing software, analytics, identity verification, chat, and similar vendors who process information on our behalf under written contracts.
• Payment processors, such as Stripe, which process your payment card transactions under their own privacy policies.
• Pharmacy, laboratory, and clinical partners, including 503A compounding pharmacies, reference laboratories, imaging providers, and telehealth network partners, to fulfill prescriptions, run lab orders, and coordinate care.
• Affiliates, such as MedXpreneur LLC (our management services organization) and any corporate affiliates.
• Marketing and advertising partners, including advertising networks, with the limits stated in section 3 (no health-related data or genetic data for interest-based advertising).
• Professional advisors, such as lawyers, auditors, bankers, and insurers, in the course of their services to us.
• Authorities and others, including law enforcement, government regulators, and private parties, when we believe in good faith that disclosure is necessary or appropriate to comply with the law or to protect rights, safety, or property.
• Parties to a business transaction, such as actual or prospective merger, acquisition, financing, reorganization, or sale-of-assets counterparties and their advisors.
• Parties you designate, such as a primary care provider you ask us to send records to, a family member you have authorized, or a third-party platform you connect to your account.

For protected health information, our sharing practices are governed by our HIPAA Notice of Privacy Practices.

5. Cookies and tracking technologies

We use cookies, web beacons, local storage, and similar technologies for essential, functional, analytics, and advertising purposes. See our Cookie Policy for the full description, categories used, third parties involved, and your choices, including browser controls, the Global Privacy Control signal, and industry opt-out programs.

6. Marketing and SMS communications

We send marketing communications by email, SMS, postal mail, and other channels you have authorized. You can opt out of marketing email at any time using the unsubscribe link in any marketing message or by submitting a request through our Contact Us page. You can opt out of marketing SMS by replying STOP to any marketing text. HELP returns help information. Message and data rates may apply. Message frequency varies.

You cannot opt out of transactional communications related to appointments, clinical care, billing, security, or safety while you are an active patient or member.

7. Security

We use administrative, technical, and physical safeguards designed to protect personal information from accidental loss and unauthorized access, use, alteration, and disclosure. No system is completely secure. The transmission of information over the internet is not entirely secure, and any transmission is at your own risk. You are responsible for keeping your account credentials confidential.

8. Data retention

We retain personal information only as long as needed for the purposes described in this Privacy Policy, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. Approximate retention periods follow.

When we no longer need personal information, we delete, anonymize, or de-identify it, or isolate it from further processing.

9. Children and teens

Our services are intended for individuals 18 years of age or older. We do not direct our website to children, and we do not knowingly collect personal information from children under 13. If we learn we have collected personal information from a child under 13 without parental consent, we will promptly delete it consistent with the Children's Online Privacy Protection Act (16 CFR Part 312).

10. State privacy rights summary

Many U.S. states grant residents specific rights regarding their personal information. The list below summarizes the rights typically available. The specific scope, thresholds, and exceptions depend on your state and on whether we meet that state's applicability thresholds.

• Right to know and access: request information about the categories and specific pieces of personal information we have collected about you.
• Right to delete: request that we delete personal information we have collected from you, subject to exceptions.
• Right to correct: request that we correct inaccurate personal information.
• Right to portability: request a copy of your personal information in a portable, readily usable format.
• Right to opt out: opt out of the sale of your personal information, of sharing for cross-context behavioral advertising, and of certain profiling.
• Right to limit use and disclosure of sensitive personal information.
• Right to non-discrimination for exercising your rights.
• Right to appeal our denial of a request, where state law provides.

To exercise any of these rights, submit a request through our Contact Us page. We may need to verify your identity before responding. Authorized agents may submit requests on your behalf with appropriate proof of authorization.

Global Privacy Control. We honor browser-based Global Privacy Control (GPC) signals as opt-out preference signals where required by applicable state law. For more information, see globalprivacycontrol.org.

11. California (CPRA)

California residents have additional rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act. We summarize them below. The "Personal Information" categories below are the statutory categories at Cal. Civ. Code §1798.140.

Categories of personal information collected

In the preceding twelve months, we have collected the following categories from California residents: identifiers; customer records; protected classification characteristics; commercial information; internet and other electronic network activity; geolocation data; audio, visual, and similar information; professional or employment-related information (only from job applicants); sensitive personal information (including precise geolocation, health information, government-issued identifiers, and account login credentials); and inferences drawn from the above.

Sources, purposes, and disclosures

Sources, purposes, and disclosure recipients are described in sections 2, 3, and 4 above.

Sale and sharing

We do not "sell" personal information for monetary consideration. To the extent the broad CPRA definition of "share" includes our use of advertising and analytics cookies for cross-context behavioral advertising, we treat this as "sharing" and provide an opt-out mechanism (the "Do Not Sell or Share My Personal Information" link in our website footer and the GPC signal). We do not sell or share sensitive personal information, health-related data, or genetic data for advertising purposes. We do not sell or share personal information of consumers under 16.

Right to limit use of sensitive personal information

You have the right to direct us to limit our use of sensitive personal information to what is necessary to perform the services you requested and to other limited uses permitted by CPRA. Submit your request through our Contact Us page.

Shine the Light

California Civ. Code §1798.83 permits California residents who have an established business relationship with us to request information about our disclosures of personal information to third parties for direct marketing purposes. Submit your Shine the Light request through our Contact Us page.

12. Illinois (BIPA, IGIPA, PIPA, MHDDCA)

Biometric Information Privacy Act (BIPA, 740 ILCS 14)

If you submit a government-issued identification document and a photograph for identity verification, our third-party identity verification partner may create biometric identifiers (a facial template) for the limited purpose of confirming that your photograph matches your identification document. The biometric template is created and held by the verification partner, not by HYDROINFUSION. Before any such collection, we obtain your separate written consent through a dedicated BIPA release. The verification partner's retention schedule provides for destruction of biometric identifiers immediately after the verification result is returned, and in any event within the period required by Illinois BIPA. We do not sell, lease, trade, or otherwise profit from biometric identifiers.

Illinois Genetic Information Privacy Act (IGIPA, 410 ILCS 513)

Where our longevity programs include genetic biomarker testing, we will obtain your written informed consent before ordering the test and will not disclose genetic test results to any third party without your specific written authorization, except as permitted by IGIPA.

Personal Information Protection Act (PIPA, 815 ILCS 530)

In the event of a breach of unencrypted personal information, we will notify affected Illinois residents in the most expedient time possible and without unreasonable delay, consistent with the requirements of PIPA, and notify the Illinois Attorney General when required.

Mental Health and Developmental Disabilities Confidentiality Act (MHDDCA, 740 ILCS 110)

HYDROINFUSION does not provide mental health treatment within the scope of MHDDCA. If our services ever come within MHDDCA scope, the more stringent MHDDCA confidentiality protections will apply to mental-health records.

13. Washington My Health My Data Act

For Washington residents, "consumer health data" includes data linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status. We collect consumer health data only with your consent, for the purposes described in this Privacy Policy. We do not sell consumer health data. You have the right to confirm whether we are processing your consumer health data, to access it, to request deletion, and to withdraw consent. Submit requests through our Contact Us page.

14. Connecticut Consumer Health Data

For Connecticut residents, this section serves as our separate Consumer Health Data Privacy Policy under Conn. Gen. Stat. §42-518. The categories of consumer health data we collect, the sources, the purposes of collection, the categories of recipients, and the rights of Connecticut residents (to access, delete, and withdraw consent) are described elsewhere in this Privacy Policy. We do not sell consumer health data. Submit requests through our Contact Us page.

15. Other U.S. states

Residents of Virginia (VCDPA), Colorado (CPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), Iowa, Tennessee, Indiana, Delaware, New Hampshire, New Jersey, Minnesota, Maryland, Nebraska, Rhode Island, and Florida (FDBR) have rights similar to those summarized in section 10, subject to that state's applicability thresholds, definitions, and exceptions. The Nevada opt-out of certain sales of personal information is also available. To exercise any of these state rights, submit a request through our Contact Us page.

16. Do Not Track

Some browsers send a "Do Not Track" header. There is no consensus standard for honoring DNT, and we do not currently respond to DNT signals. We do honor the Global Privacy Control signal where required by law, as described in section 10.

17. International users

Our services are intended for individuals located in the United States, primarily in Illinois and other states where our clinicians are licensed. If you access our services from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

18. Third-party websites and services

This Privacy Policy does not apply to websites, applications, or services operated by third parties, including third-party platforms linked from our website. We encourage you to read the privacy policies of any third party you interact with.

19. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The current version is always posted at this URL. If we make material changes, we will notify you through the patient portal, by email, or through a notice on our website before the changes take effect. Your continued use of our website or services after the effective date constitutes acceptance of the updated Privacy Policy.

This Privacy Policy works alongside our HIPAA Notice of Privacy Practices, Cookie Policy, Terms, Cancellation Policy, and Service Guarantee Terms.