Skip to main content
Legal

Privacy Policy

Last updated: 2026

Eleva MD ("Eleva MD," "we," "our," or "us") is committed to protecting your privacy and safeguarding your personal and health information. This Privacy Policy explains how we collect, use, disclose, and protect information when you access our website, patient portal, telehealth services, and related digital platforms (collectively, the "Services"). Eleva MD is a physician-supervised telehealth service. We operate with the same standards of confidentiality, security, and integrity expected of in-person medical care.

1. Scope of This Privacy Policy

This Privacy Policy applies to:

  • Visitors to our website
  • Individuals who create an account or complete an intake
  • Patients receiving telehealth services through Eleva MD
  • Communications with our clinical or administrative teams

This Policy does not replace or supersede our HIPAA Notice of Privacy Practices, which governs how protected health information ("PHI") is handled under applicable healthcare laws. Patients receiving clinical services should also review our HIPAA Notice.

2. Information We Collect

A. Personal Information

We may collect identifying information, including full name, date of birth, email address, phone number, shipping address, and payment and billing information.

B. Health & Medical Information (PHI)

When you seek care, we collect health information necessary for clinical evaluation and treatment, including medical history, symptoms and conditions, medications and allergies, lab values or diagnostic data (when applicable), and intake responses and follow-up communications. This information is collected solely for the purpose of providing physician-supervised medical care.

C. Technical & Usage Information

We automatically collect limited technical data, such as IP address, device and browser type, log data, usage patterns, cookies, and similar technologies to maintain platform security and performance.

3. How We Use Your Information

We use your information to evaluate eligibility for telehealth services, facilitate physician review and clinical decision-making, prescribe and coordinate fulfillment of medications (when approved), communicate with you regarding care, process payments and prevent fraud, improve service quality and compliance, and meet legal, regulatory, and licensure obligations.

Eleva MD does not sell your personal or health information.

4. Medical Care & Physician Oversight

All medical decisions are made by licensed physicians operating under applicable state laws. Information you provide is reviewed as part of a legitimate clinical workflow and is not evaluated by automated decision-making systems in isolation. Your data is used to support individualized medical judgment, not generalized recommendations.

5. Sharing & Disclosure of Information

A. Healthcare & Operational Partners

Licensed physicians involved in your care, state-licensed pharmacies fulfilling prescriptions, and clinical service providers supporting care delivery.

B. Service Providers

We use vetted third parties for secure data hosting, payment processing, and customer support systems. These providers access information only to perform services on our behalf and are bound by confidentiality obligations.

C. Legal & Regulatory Requirements

We may disclose information if required to comply with applicable laws, court orders, lawful government requests, or to protect patient safety, rights, or integrity of care.

6. HIPAA & Health Information Protections

Eleva MD complies with applicable federal and state privacy laws, including HIPAA where applicable. Protected Health Information is access-restricted, stored in HIPAA-aligned systems, and shared only for treatment, payment, or healthcare operations.

7. Data Security & Breach Notification

We maintain administrative, technical, and physical safeguards designed to protect your information, including encrypted data transmission, access controls, secure hosting environments, and role-based access. While no system can guarantee absolute security, Eleva MD takes reasonable and industry-appropriate measures to protect your information.

In the event of a data security incident involving your personal or health information, Eleva MD will notify you as required by applicable law, including HIPAA breach notification rules (45 CFR §§ 164.400–414) and applicable state data breach notification laws. Notification will be made without unreasonable delay and no later than 60 days following discovery of a breach, unless law enforcement requires a delay. Notifications will describe the nature of the incident, the information involved, steps taken to address the incident, and actions you can take to protect yourself.

8. Cookies & Tracking Technologies

We use cookies and similar technologies to enable core site functionality, improve performance, and understand aggregate usage trends. Specifically, we may use:

  • Essential cookies: Required for core site operation, authentication, and security. Cannot be disabled without affecting service functionality.
  • Analytics cookies: Help us understand how visitors interact with our site (e.g., pages visited, session duration). Data is aggregated and not linked to identifiable individuals.
  • Functional cookies: Remember your preferences and improve your experience across visits.

We do not use advertising or tracking cookies on any page where you submit health or personal information (intake forms, checkout). You may manage cookie preferences through your browser settings. Most browsers allow you to refuse cookies or delete them; doing so may affect certain features of our site.

9. Data Retention

We retain personal and health information only as long as necessary to provide medical care, meet legal and regulatory obligations, and resolve disputes.

10. Your Privacy Rights

Depending on your location, you may have the right to access, correct, or request deletion of your personal information where legally permitted. Requests may be subject to identity verification and medical record retention laws.

California Residents — CCPA Rights

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with specific rights regarding your personal information:

  • Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months, as well as the categories of sources, our business purposes, and the categories of third parties with whom we share your information.
  • Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions (including retaining records required for medical care or legal compliance).
  • Right to Correct: You may request correction of inaccurate personal information we maintain about you.
  • Right to Opt Out of Sale or Sharing: Eleva MD does not sell your personal information and does not share it for cross-context behavioral advertising. No opt-out is required, but you may contact us to confirm.
  • Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

To submit a CCPA request or opt-out inquiry, contact us at privacy@eleva.md or visit our Contact page. We will respond within 45 days of receipt. Note that certain health information governed by HIPAA may be subject to different access and deletion rules under federal law.

11. Children's Privacy

Eleva MD Services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from minors.

12. Changes to This Privacy Policy

We may update this Privacy Policy periodically. Updates will be posted on this page with a revised effective date. Continued use of the Services constitutes acceptance of the updated Policy.

13. SMS / Text Message Communications

A. Opt-In and Consent

Eleva MD offers an SMS text messaging program to provide patients and users with order confirmations, prescription updates, shipping notifications, physician care communications, and related health service alerts. By providing your mobile phone number and checking the opt-in consent box on our health intake form or checkout page at eleva.md, you expressly consent to receive recurring automated text messages from Eleva MD at the mobile number provided. Consent is not a condition of purchase or use of our services.

B. Message Frequency

Message frequency varies based on your order activity, prescription status, and care plan. You may receive messages related to order confirmations, shipment tracking, prescription readiness, physician follow-ups, and account or appointment reminders. Typical users receive between 2 and 8 messages per month.

C. Message and Data Rates

Message and data rates may apply depending on your mobile carrier and service plan. Eleva MD is not responsible for any fees charged by your mobile carrier in connection with receiving SMS messages.

D. How to Opt Out

You may opt out of receiving SMS messages from Eleva MD at any time by replying STOP to any message you receive from us. After opting out, you will receive a single confirmation message and no further messages will be sent. To re-enroll, reply START or re-enter your consent on our website.

E. Help and Support

For help with our SMS program, reply HELP to any message or contact us at support@eleva.md. Additional information about our services is available at eleva.md.

F. No Sharing of SMS Opt-In Data

Your mobile phone number and SMS opt-in consent data will never be shared, sold, rented, or disclosed to any third parties, affiliates, or lead generators for marketing or promotional purposes. This restriction applies regardless of any other data sharing practices described in this Privacy Policy. All other data practices described herein exclude text messaging originator opt-in data and consent, which is governed solely by this section. No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted.