Privacy Policy

Draft, not legal advice. This policy is written to match Health Panel's actual data practices, but it has not been reviewed by an attorney. Do not publish live until a licensed attorney with health-data and multi-state consumer-privacy experience has reviewed it, confirmed whether HIPAA applies to any part of Health Panel's handling of order data, and filled in the bracketed placeholders.

Effective date: August 26, 2026   Last updated: August 26, 2026

Who we are

Health Panel ("Health Panel," "we," "us," or "our") operates [healthpanel.com] (the "Site") and the ordering process connected to it. Health Panel is a marketing and ordering platform. We are not a laboratory, a clinic, or a medical provider. Lab testing, blood draws, and results review are performed by independent, licensed third parties in our partner network (referred to below as our "testing partner").

This policy explains what information we collect when you visit the Site or place an order, how we use and share it, and the choices available to you.

Information we collect

Information you provide directly:

• Contact information: name, email address, phone number, mailing and billing address
• Order information: date of birth, which panels you order, promo code used, subscription selections
• Payment information: processed directly by our payment processor (Stripe). We do not store your full card number on our own systems.
• Communications: anything you send us directly, such as support requests

Information collected automatically:

• Device and usage data (browser type, pages visited, referring source) via standard web analytics
• Marketing attribution: which promo code, link, or campaign brought you to the Site

Information we do not collect or store:

• We do not host, store, or display your lab results. Results are reviewed by our testing partner's affiliated physicians and made available to you through our testing partner's own portal. We only send you a notification that results are ready, with a link to that portal.

How we use your information

We use the information above to:

• Process and fulfill your order, including relaying your order (name, date of birth, address, and panel selected) to our testing partner so they can schedule your clinic visit and process your test
• Charge and manage payments, including subscription billing and renewal
• Send transactional communications: order confirmation, processing updates, clinic visit reminders, and results-ready notices
• Attribute orders to promo codes and partners for commission tracking
• Improve the Site and our marketing
• Comply with legal obligations

We do not use your health-adjacent order information (which panel you ordered) for advertising, and we do not sell it to third parties.

How we share your information

• Our testing partner: to schedule your blood draw and process your ordered panel. This is the core of how the service works and is not optional if you place an order.
• Payment processor (Stripe): to process your payment. Stripe's own privacy policy governs how they handle your payment details.
• Email service provider (Resend): to deliver transactional emails.
• Service providers generally: vendors who help us operate the Site (hosting, analytics), bound by confidentiality obligations.
• Legal and safety: if required by law or subpoena, or to protect the rights, property, or safety of Health Panel, our customers, or others.
• Business transfers: if Health Panel is involved in a merger, acquisition, or asset sale, customer information may be transferred as part of that transaction, subject to this policy's protections.

We do not sell your personal information to third parties for their own marketing purposes.

Health-adjacent information

Order data includes information that reveals health-related activity, such as which panel you ordered. We treat this as sensitive and limit access to it internally.

Confirm with counsel: whether Health Panel's handling of this order data makes it a HIPAA business associate of our testing partner, and whether a Business Associate Agreement is required between Health Panel and the testing partner. This has not yet been confirmed and must be resolved before this section is finalized.

Cookies and tracking technologies

The Site uses cookies and similar technologies for essential site functionality, analytics, and marketing attribution.

Insert specific cookie categories, the consent mechanism, and any required state-specific opt-out (for example California "Do Not Sell or Share") once analytics and ad tooling are finalized.

Data retention

We retain your information for as long as needed to provide the service, comply with legal and tax obligations, resolve disputes, and enforce our agreements.

Insert specific retention periods once determined. The intent is to minimize retention of health-adjacent order data, so a concrete retention schedule should be defined and reflected here.

Your rights and choices

Depending on your state of residence, you may have rights to access, correct, delete, or receive a copy of your personal information, and to opt out of certain uses. To exercise these rights, contact us at [PRIVACY EMAIL]. We will verify your identity before fulfilling a request.

This section needs to be tailored to the specific state privacy laws that apply once the states-served list and customer base are finalized, for example CCPA and CPRA in California and similar laws in other states.

Children's privacy

The Site is not directed to individuals under 18, and we do not knowingly collect personal information from children.

Security

We use reasonable administrative, technical, and physical safeguards designed to protect your information. No method of transmission or storage is 100 percent secure, and we cannot guarantee absolute security.

Changes to this policy

We may update this policy from time to time. We will post the updated version with a new "Last updated" date and, for material changes, provide additional notice as appropriate.

Contact us

Questions about this policy or your information can be sent to [PRIVACY EMAIL / MAILING ADDRESS].

Placeholders to fill in before publishing: legal entity name and business address, effective date, privacy contact email, Site domain, specific cookie and analytics tools in use, data retention schedule, and confirmation of HIPAA and BAA status with the testing partner.