Consumer Health Data Privacy Policy

Consumer health data is personal information that is linked, or reasonably linkable, to you and that identifies your past, present or future physical or mental health: for example a health condition, a treatment, or a product bought for a health purpose.

Most health information on Porto MD belongs to a clinic: its patient records, visit notes, intake forms and messages. When a clinic is a HIPAA covered entity, Porto MD handles that information as the clinic’s business associate under a Business Associate Agreement, and the clinic’s Notice of Privacy Practices explains your rights. Requests about those records go to your clinic. See Patient Privacy & HIPAA.

Some businesses that use Porto MD are not HIPAA covered entities, for example a gym or a wellness studio. For their clients, Porto MD is a processor: we handle health information only on that business’s instructions. Ask that business to exercise your rights, and we will help it respond.

• Orders and products. The products you view, add to a cart or order in a Porto MD storefront or the marketplace, where a product suggests a health purpose.
• Delivery details tied to an order. Your name, shipping address, email and phone number.
• Age and eligibility. That you confirmed you meet a product’s age requirement, and the state an order ships to. We record the confirmation, not your date of birth.
• What you send us. Messages and forms you send Porto MD that mention health.

To process and deliver an order you place; to apply the age and state rules a product carries; to confirm your payment; to answer your questions; to keep the platform secure and prevent fraud; and to meet our legal obligations. We do not use consumer health data for advertising, and we never send it to advertising platforms.

From you; from the clinic, practitioner or sales representative whose storefront you order through; from the supplier or pharmacy that fills your order (shipping and tracking updates); and from our payment processor (whether a payment went through, never your full card number).

• The supplier or pharmacy filling your order: the items ordered and your delivery details.
• The clinic, practitioner or representative whose storefront you used: the orders placed through it, so they can support you.
• Service providers working for us under contract: hosting and database, email delivery, text messaging, payment processing and shipping labels. They may use it only to provide their service to us.
• Authorities, when the law requires it.

Porto MD has no affiliates that receive consumer health data. We do not sell consumer health data. We collect and share it only as needed to provide the product or service you asked for, or with your consent, which you can withdraw at any time. We do not use geofences around places where people receive health care.

• Confirm whether we collect, share or sell your consumer health data.
• Get access to it, including a list of the third parties we have shared it with and how to contact them.
• Have it deleted. We also pass your deletion request on to the service providers and third parties that hold it.
• Withdraw your consent to our collecting or sharing it.
• Appeal if we turn down your request.

Email privacy@portomd.com with the subject “Consumer health data request,” say what you would like us to do, and give the email address or phone number you used with us. We will confirm your identity before acting, and we will not ask for more information than we need to do that.

We answer within 45 days. If we need more time we will tell you why, and take no more than another 45 days. Requests are free, up to twice in any 12 months.

If we turn down a request, reply to our answer with the word “Appeal” and we will review it and answer in writing within 45 days, with our reasons. If you are not satisfied, Washington residents may contact the Washington State Office of the Attorney General, and Nevada residents the Nevada Attorney General.

We post any change here with a new date. If a change would let us collect, use or share consumer health data in a new way, we will ask for your consent first where the law requires it.

Questions about this policy? Email privacy@portomd.com.