Privacy Policy

This Privacy Policy describes Zoya Health LLC’s handling of personal information. It is not a HIPAA Notice of Privacy Practices. The independent professional medical entity responsible for your care must provide any Notice of Privacy Practices required by HIPAA or state medical-privacy law. Zoya may deliver that notice or process information on the medical entity’s behalf, but the notice must identify the responsible covered entity or medical provider.

Washington and Nevada consumers: consumer health data is addressed in separate state-specific policies linked from the Zoya homepage: the Washington Consumer Health Data Privacy Policy and the Nevada Consumer Health Data Privacy Policy.

This Privacy Policy explains how Zoya Health LLC (“Zoya,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal information when you visit joinzoya.com, use a Zoya-branded intake or patient-facing interface, contact us, create an account, purchase a treatment plan, or otherwise use Zoya’s non-clinical technology and administrative services (collectively, the “Services”).

This Policy applies to information handled by Zoya in its own capacity and, where stated, to information Zoya processes for a Medical Group or other regulated entity. It does not govern an independent Medical Group, Provider, Pharmacy, laboratory, payment processor, carrier, or other third party when that party handles information for its own purposes. Those parties may provide separate privacy notices.

Medical services available through Zoya are provided by independently owned professional medical entities (each, a “Medical Group”) and licensed Providers. Prescription medications are dispensed by independent Pharmacies. Zoya is not a medical provider or pharmacy.

Some health information created or received by a Medical Group, Provider, Pharmacy, or their business associate may be “protected health information” (“PHI”) under HIPAA. When Zoya receives or maintains PHI as a business associate or subcontractor, Zoya uses and discloses it only as permitted by the applicable business associate agreement, the Medical Group’s Notice of Privacy Practices, and law. HIPAA does not automatically apply to every item of health-related information collected by a consumer-facing website or before a covered provider relationship exists.

The Medical Group responsible for your care will provide or make available its Notice of Privacy Practices, which explains HIPAA rights involving access, amendment, restrictions, confidential communications, accountings of disclosure, and complaints. Zoya may route a request to the Medical Group, but Zoya does not independently change a Provider’s medical record.

Health-related information not regulated as PHI may still be protected by state consumer-health, medical-privacy, biometric, genetic, consumer-protection, or data-security laws. Washington consumers should review the separate Washington Consumer Health Data Privacy Policy, and Nevada consumers should review the separate Nevada Consumer Health Data Privacy Policy, in each case to the extent that policy applies.

California law may separately deem a business that offers software or hardware designed to maintain medical information for an individual or health care provider to be a “provider of health care” solely for purposes of the California Confidentiality of Medical Information Act (“CMIA”). To the extent that rule applies to Zoya or to particular information, Zoya will maintain the confidentiality of medical information and use or disclose it only as permitted by CMIA and other applicable law.

Directly from you, including through forms, assessments, account registration, checkout, patient-portal interactions, support communications, and uploaded materials.

From the Medical Group, Providers, Pharmacies, pharmacy-network or fulfillment administrators, laboratories, and other parties involved in your requested services.

From Bask Health, Inc. and other technology, identity, payment, communications, shipping, hosting, analytics, and security providers.

Automatically from your browser or device through cookies, pixels, software development kits, logs, and similar technologies on the public website.

From referral, advertising, or business partners when permitted by law and consistent with your choices.

From public records or other lawful sources for fraud prevention, compliance, or verification.

Provide, administer, and improve the Services and your account.

Connect you with a Medical Group and Provider; transmit information for clinical evaluation; support scheduling, records routing, and patient communications.

Coordinate prescription transmission, Pharmacy fulfillment, shipping, refills, product issues, and recalls.

Process payments, recurring billing authorizations, cancellations, refunds, credits, and fraud prevention.

Confirm identity, age, location, eligibility, and service availability.

Respond to questions, complaints, privacy requests, and support needs.

Send transactional communications and, with required consent, marketing communications.

Maintain security; detect fraud, misuse, unauthorized access, and technical problems; enforce terms and protect rights and safety.

Comply with law, legal process, professional obligations applicable to service partners, audits, record-retention requirements, and regulatory inquiries.

Perform analytics, quality improvement, and product development using the minimum information reasonably necessary and, where appropriate, deidentified or aggregated data.

Support a merger, financing, acquisition, reorganization, bankruptcy, or transfer of all or part of the business, subject to applicable privacy obligations.

We and our providers use cookies, tags, logs, and similar technologies on the public website for essential operation, security, preferences, analytics, campaign measurement, and, where enabled, advertising. These technologies may include a tag-management system and analytics infrastructure supplied by Zoya’s website or platform providers. The exact tools and recipients may change as the website is updated.

Zoya does not authorize advertising or third-party marketing technologies to collect clinical questionnaire responses, medical records, prescription details, Provider communications, or patient-portal content. Zoya’s policy is not to deploy those technologies on clinical intake pages, checkout fields that contain health information, or authenticated patient-portal pages. Website configuration and vendor contracts must be maintained consistently with this commitment.

You can manage nonessential cookies through any cookie-preference tool made available on the website and through browser settings. Where required by applicable law, Zoya honors recognized browser-based opt-out preference signals, including Global Privacy Control, for the browser or device sending the signal. Disabling cookies may affect functionality.

Some browsers offer a legacy “Do Not Track” setting for which there is no uniform industry standard. We do not treat that setting alone as an opt-out request, but we do honor Global Privacy Control as described above.

Where website measurement is allowed by your preferences and applicable regional settings, Zoya may send Google Analytics a generic purchase or refund event with an anonymous browser identifier, an opaque transaction identifier, amount, currency, and time. Eligible Google Ads purchases use an ad-click identifier. These measurement events exclude names, contact information, medication or prescription details, questionnaire answers, and patient-portal content. Starting an intake or visiting a page is not recorded as a completed purchase.

Payments are processed by third-party processors. Zoya may receive a payment token, card type, last four digits, expiration information, billing address, transaction amount, status, and fraud signals, but generally does not receive the full card number or security code. Payment processors handle information under their own privacy notices and payment-network rules.

We use contact information to send account, clinical-workflow, order, payment, refill, shipping, security, and policy communications. Marketing email or text messages are sent only with the consent required by law and may be stopped through an unsubscribe link or by replying STOP. Marketing consent is not a condition of purchase.

Standard email and SMS are not fully secure. Use the secure patient portal for sensitive medical communications. Communications are not monitored continuously and are not an emergency channel.

We may create or receive deidentified or aggregated information and use it for analytics, quality improvement, security, product development, and lawful business purposes. When information is deidentified under applicable law, we maintain it in deidentified form and do not attempt to reidentify it except as permitted for validation, compliance, or another lawful purpose.

We retain personal information only as long as reasonably necessary for the purposes described in this Policy, and then delete or deidentify it. Retention differs by category:

We use administrative, technical, and physical safeguards designed to protect personal information, including access controls, encryption in transit where appropriate, vendor controls, monitoring, and incident-response procedures. No system is completely secure, and we cannot guarantee absolute security.

If a security incident triggers notification duties, Zoya and the responsible Medical Group, Pharmacy, or service provider will allocate investigation and notice responsibilities under HIPAA, the FTC Health Breach Notification Rule, state breach-notification laws, contracts, and other applicable requirements.

Account information: update through your account or contact us.

Marketing: unsubscribe from email or reply STOP to text messages. Transactional or legally required messages may continue.

Cookies: use our preference tool, browser settings, or an opt-out preference signal.

Medical-record rights: follow the Medical Group’s Notice of Privacy Practices, or contact us to route the request.

Consumer privacy rights: submit a request under Sections 14–15. Washington consumers may also exercise rights under the Washington Consumer Health Data Privacy Policy, and Nevada consumers may also exercise rights under the Nevada Consumer Health Data Privacy Policy, in each case to the extent that policy applies.

Depending on your state and whether the applicable law covers Zoya or the information, you may have rights to: confirm processing; access personal information; receive a portable copy; correct inaccuracies; delete information; obtain information about disclosures; opt out of sale, sharing, targeted advertising, or certain profiling; limit certain uses of sensitive information; withdraw consent; and appeal a denial. These rights are subject to identity verification, legal exceptions, and the distinction between Zoya data and medical records controlled by a Medical Group or Pharmacy.

Where applicable state law requires opt-in consent for health data or other sensitive personal information, Zoya will obtain the required consent or rely only on another legally permitted basis. Zoya applies the more protective operating rule nationally: it does not sell health data and does not use clinical information for targeted advertising.

To submit a request, email hello@joinzoya.com with the subject “PRIVACY REQUEST” or write to the address in Section 18. Describe the right you wish to exercise and the account or transaction involved. We will use commercially reasonable methods to verify identity and authority. We may ask an authorized agent for proof of authorization and may verify directly with you. You do not need to create an account to make a request.

To appeal a denial, use the same method with the subject “PRIVACY APPEAL” within thirty days after the decision. We will respond within the period required by applicable law and provide any available regulator-contact mechanism if the appeal is denied. Zoya will not discriminate against you for exercising a privacy right, although deleting or withdrawing information necessary to provide a requested health service may prevent continued service.

This Section supplements the Policy for California residents and applies to the extent the California Consumer Privacy Act, as amended (“CCPA”), applies to Zoya or the information. Certain PHI, medical information governed by CMIA, and information processed by or for a covered health care entity may be exempt, while website, account, marketing, and transaction information generally remains covered.

15.1 Categories collected. During the preceding twelve months, Zoya has collected the categories described in Section 3, including identifiers, customer-record information, protected classifications where voluntarily provided or clinically relevant, commercial information, internet or electronic-network activity, approximate geolocation, audio or communications information, professional information if provided, sensitive personal information including health data and account credentials, and inferences. The sources are described in Section 4, the business purposes in Section 5, and the categories of recipients in Section 6.

15.2 Sale, sharing, and targeted advertising. Zoya does not sell PHI, medical information, or consumer health data. Public marketing pages may use the analytics and advertising technologies described in Sections 6 and 7. To the extent a disclosure of online identifiers or browsing activity constitutes a sale, sharing, or targeted-advertising disclosure under applicable law, Zoya provides the applicable opt-out mechanism, honors recognized opt-out preference signals where required, and does not condition a health service on the consumer’s agreement to that processing.

15.3 Sensitive personal information. Zoya uses health information, account credentials, and other sensitive personal information to provide requested Services, protect security, comply with law, and for other purposes permitted without a right to limit. Zoya does not use or disclose sensitive personal information to infer characteristics about you, and does not use clinical information for targeted advertising.

15.4 Retention. The retention periods and criteria in Section 11 apply.

15.5 Minors. The Services are for adults 18 and older. Zoya does not knowingly collect personal information from anyone under 18, does not knowingly collect personal information from a child under 13 within the meaning of the Children’s Online Privacy Protection Act, and does not sell or share the personal information of consumers under 16.

15.6 California “Shine the Light.” To the extent California Civil Code § 1798.83 applies, a California customer may request information concerning any disclosure of specified personal information to third parties for those parties’ own direct marketing purposes. Zoya’s policy is not to disclose personal information to third parties for their own direct marketing purposes. Questions or requests may be sent to hello@joinzoya.com with the subject “SHINE THE LIGHT.”

15.7 Financial incentives. Zoya does not currently offer a financial incentive program in exchange for personal information. If that changes, a separate notice will be provided.

The Services are intended only for adults 18 and older. We do not knowingly collect personal information from anyone under 18 or provide treatment services to minors. If you believe a minor submitted information, contact us so we can investigate and take appropriate action, subject to medical-record and legal-retention requirements.

We may update this Policy prospectively. We will post the updated Policy and revise the “Last updated” date, and we review this Policy at least every twelve months. If a change materially expands the collection, use, or disclosure of consumer health data or other sensitive information, we will provide additional notice and obtain consent where required.

Zoya Health LLC 2108 N Street, Suite N, Sacramento, California 95816 Email: hello@joinzoya.com Website: joinzoya.com

For a privacy request, use the subject line “PRIVACY REQUEST.” For an appeal, use “PRIVACY APPEAL.” Do not send detailed medical information through ordinary email.