This Privacy Policy explains how Zorlo Health LLC ("Zorlo," "we," "us" or "our") collects, uses, shares and protects information about you when you use zorlo.co, our patient portal and related services (the "Platform").
Medical information you share with your provider and pharmacy may also be "protected health information" under the Health Insurance Portability and Accountability Act (HIPAA). How providers and pharmacies use and disclose that information is described in the Notice of Privacy Practices. Where HIPAA applies, it controls over this Policy.
1. Information we collect
Information you give us
- Contact and account details: name, email, phone number, date of birth, shipping address and login details.
- Health information: answers to medical questionnaires, symptoms, health history, medications, allergies, photos you choose to upload, and messages with your care team.
- Identity verification: a government-issued photo ID or selfie, where required by your provider or state law.
- Payment information: processed by our payment processor. We do not store full card numbers.
- Support communications: emails, calls and chat messages with our team.
Information collected automatically
- Device and usage data: IP address, browser type, device identifiers, pages viewed, and the date and time of visits.
- Cookies and similar technologies: described in Section 4.
Information from others
- Your provider and pharmacy, for example prescription and shipping status.
- Service providers such as identity verification and payment processors.
2. How we use information
- To create and manage your account and connect you with a provider.
- To route prescriptions to a pharmacy and arrange shipping.
- To process payments, subscriptions and refunds.
- To communicate with you about your orders, account and care, including service messages by email or text.
- To verify your identity and prevent fraud and misuse.
- To operate, secure, troubleshoot and improve the Platform.
- To comply with law and enforce our Terms of Use.
- To send marketing messages, only where you have agreed to receive them. Marketing never uses your health information without your explicit authorization.
3. How we share information
We do not sell your personal information or your health information. We share information only as follows:
- Providers: independent licensed providers in the LocumTele network, to evaluate and treat you.
- Pharmacies: independent licensed pharmacies, including Rush Pharmacy and Epiq Scripts, to fill and ship your prescriptions.
- Service providers: companies that host our systems, process payments, verify identity, send communications or deliver orders, under contracts that limit their use of your information and, where required, business associate agreements.
- Legal and safety: when required by law, subpoena or court order, or to protect the rights, safety or property of you, us or others.
- Business transfers: in connection with a merger, acquisition or sale of assets, subject to this Policy.
- With your consent: for any other purpose you authorize.
4. Cookies and tracking
We use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the Platform is used. We may use advertising and analytics tools on our public marketing pages. We do not place advertising pixels or third-party tracking on pages where you enter health information, such as intake questionnaires and the patient portal, and we do not share health information with advertising platforms.
You can control cookies through your browser settings. Where required by law, we honor Global Privacy Control (GPC) signals as a request to opt out of targeted advertising.
5. Consumer health data
Some state laws, including Washington's My Health My Data Act, Nevada SB 370 and Connecticut's consumer health data provisions, give additional protections to "consumer health data" not covered by HIPAA. Where these laws apply:
- We collect consumer health data only as needed to provide the services you request, or with your consent.
- We share it only as needed to provide those services (with your provider, pharmacy and service providers), or with your separate consent.
- We never sell consumer health data.
- You can access, delete, or withdraw consent for our collection and sharing of your consumer health data by emailing support@zorlo.co.
The categories of consumer health data we collect, the sources, purposes and recipients are described in Sections 1 to 3 above.
6. Your privacy rights
Depending on where you live, including California, Colorado, Connecticut, Virginia, Texas, Oregon and other states with comprehensive privacy laws, you may have the right to:
- know what personal information we collect, use and disclose, and get a copy;
- correct inaccurate information;
- delete your information, subject to legal record-keeping requirements;
- opt out of targeted advertising, the sale of personal information and profiling;
- limit the use of sensitive personal information; and
- not be discriminated against for exercising these rights.
To make a request, email support@zorlo.co. We will verify your identity before responding and reply within the time required by law. An authorized agent may submit a request on your behalf with proof of authorization. If we deny your request, you may appeal by replying to our decision; if you remain unsatisfied, you may contact your state attorney general.
Medical records held by your provider or pharmacy may need to be kept for a minimum period under state law, even if you ask us to delete your account. Requests about those records are handled under the Notice of Privacy Practices.
7. Security and retention
We use administrative, technical and physical safeguards designed to protect your information, including encryption in transit and at rest and role-based access controls. No system is completely secure, and we cannot guarantee absolute security. We keep information for as long as needed to provide our services, meet legal and medical record-keeping obligations, resolve disputes and enforce our agreements.
8. Children
The Platform is only for adults 18 and older. We do not knowingly collect information from anyone under 18. If you believe a minor has given us information, contact us and we will delete it.
9. Changes to this Policy
We may update this Policy from time to time. We will post the updated Policy with a new effective date and, for material changes, notify you by email or in your account. We will not use previously collected health information in a materially different way without your consent.
10. Contact
Privacy questions or requests:
support@zorlo.co
Zorlo Health LLC
1309 Coffeen Avenue, STE 1200, Sheridan, WY 82801