Privacy Policy

1. Information We Collect

Depending on how you interact with our Site, patient portal, and Services, we collect the following categories of information:

• Personal Identification & Contact Information: Your full name, mailing and shipping address, email address, telephone/mobile number, date of birth, and government-issued identification (where required by state telehealth laws for identity verification).
• Protected Health Information (PHI) & Medical Intake Data: Health and medical history, symptoms, current and past medications, allergies, laboratory test results, vital signs, clinical questionnaires, treatment plans, prescription records, and communications between you and your affiliated licensed healthcare provider conducted through our HIPAA-compliant patient portal.
• Transaction & Billing Information: Payment card details, billing address, and transaction history when you pay for clinical consultations, laboratory assessments, or wellness programs. All payment transactions are processed over Secure Socket Layer (SSL) / Transport Layer Security (TLS) encrypted connections through PCI-DSS compliant payment processors.
• SMS / Mobile Opt-In Data: Your mobile phone number, explicit opt-in consent records, timestamps, and messaging preferences when you voluntarily consent to receive SMS/text messages from MDRN DOC LLC.
• Technical & Usage Information: IP address, browser type, device identifiers, operating system, referring URLs, pages visited, time spent on pages, and interaction data collected through cookies and similar analytics technologies on public-facing web pages.

2. How We Ensure Operations Comply with Applicable Privacy & Protected Health Information Laws (HIPAA & LegitScript Standard 6)

MDRN DOC LLC is committed to ensuring that all of its operations, technology platforms, and partner workflows strictly comply with applicable federal and state laws and regulations governing data privacy and Protected Health Information (PHI) across all jurisdictions in which we operate, in full alignment with LegitScript Healthcare Merchant Certification Standard 6 (Privacy) and LegitScript Terms and Conditions Section VI(f):

• HIPAA Compliance & Federal Health Privacy Standards: Where MDRN DOC LLC collects, stores, processes, or transmits Protected Health Information (PHI) or electronic Protected Health Information (ePHI) in connection with telehealth evaluations, clinical coordination, or pharmacy fulfillment, we operate in strict compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health (HITECH) Act, and the implementing Privacy, Security, and Breach Notification Rules (45 CFR Parts 160, 162, and 164).
• HIPAA-Compliant Database & Patient Portal: All patient medical intakes, health records, clinical notes, and PHI are collected and stored within a dedicated, HIPAA-compliant encrypted database and secure sign-in patient/provider portal (powered by our LegitScript-certified telehealth infrastructure partners, including Embed and ConnectMeds). We do not store PHI in unsecured web forms or non-HIPAA-compliant storage systems.
• Business Associate Agreements (BAAs): MDRN DOC LLC executes written, HIPAA-compliant Business Associate Agreements (BAAs) with all third-party technology providers, telehealth platform vendors, cloud hosting providers, and administrative subcontractors that create, receive, maintain, or transmit PHI on our behalf, contractually requiring them to maintain administrative, physical, and technical safeguards that meet or exceed HIPAA Security Rule standards.
• Mandatory SSL/TLS Encryption for All Transactions & Sensitive Data: In accordance with LegitScript Certification Standard 6 and Terms and Conditions Section VI(f), all information regarding financial transactions, customers, patients, medical information, PHI, and any other sensitive or confidential information is transmitted and processed using Secure Socket Layer (SSL) / Transport Layer Security (TLS 1.2/1.3) encryption technology and encrypted at rest using industry-standard AES-256 encryption.
• Licensed Medical Providers & LegitScript-Certified 503A Pharmacies: MDRN DOC LLC is a healthcare coordination platform and does not itself practice medicine or operate as a pharmacy. Clinical consultations and prescribing decisions are performed exclusively by independent healthcare practitioners who hold active licenses in good standing in the patient's state of residence. When a licensed provider determines a prescription is clinically appropriate, patient-specific prescriptions are transmitted securely to state-licensed, LegitScript-certified 503A dispensing pharmacies (including RxRoute, CraftedRx, ChemistryRx, Greenwich, and BelieveRx) licensed in the state where shipment occurs.
• Workforce Training, Access Controls & Privacy Governance: MDRN DOC LLC maintains a designated Privacy Officer, enforces strict role-based access controls and multi-factor authentication (MFA) under the HIPAA "Minimum Necessary" standard (45 CFR § 164.502(b)), logs and audits system access to ePHI, and conducts regular privacy and security compliance reviews.
• Breach Notification Procedures: In the event of any unauthorized acquisition, access, use, or disclosure of unsecured PHI, MDRN DOC LLC will promptly investigate the incident and notify affected individuals, the Secretary of the U.S. Department of Health and Human Services (HHS), and applicable state regulators without unreasonable delay and within all statutory timeframes required by the HIPAA Breach Notification Rule (45 CFR §§ 164.400–414) and state data breach laws (including Fla. Stat. § 501.171).

3. How We Use Your Information & Protected Health Information (PHI)

We use the personal information and PHI we collect only as permitted by applicable law for the following purposes:

• Treatment: To coordinate your telehealth evaluation, transmit your medical intake and laboratory data to your affiliated state-licensed healthcare provider, facilitate clinical follow-ups and health coaching, and—when prescribed by your provider—transmit your prescription to a state-licensed dispensing pharmacy for fulfillment and delivery.
• Payment: To process payments for consultations, laboratory testing, and wellness programs, verify billing details, prevent fraud, and provide receipts and billing support.
• Healthcare Operations: To operate, maintain, and improve our patient portal and clinical coordination workflows, conduct quality assessment and improvement activities, verify practitioner and pharmacy licensure, audit security controls, and provide customer support.
• Communications & Patient Support: To send appointment reminders, clinical intake links, order and shipping updates, account notifications, and responses to your inquiries via email, telephone, or SMS/text message (subject to your explicit SMS opt-in preferences described in Section 7).
• Legal & Regulatory Compliance: To comply with applicable federal and state telemedicine, medical record retention, pharmacy, consumer protection, and data privacy laws.

4. Information Sharing, Permitted Disclosures & Strict SMS Privacy Carve-Out

A. Strict Mobile & SMS Opt-In Data Non-Sharing Clause

B. Permitted Disclosures of Personal Information & PHI

Subject to the strict exclusion of SMS/mobile opt-in data and consent above, MDRN DOC LLC discloses personal information and PHI only as permitted by HIPAA and applicable state law, and never sells, rents, or trades your personal information or PHI to third parties for marketing or lead-generation purposes:

• Affiliated Licensed Healthcare Providers & LegitScript-Certified Dispensing Pharmacies (For Treatment & Fulfillment Only): We disclose relevant medical intake and prescription fulfillment information via encrypted, HIPAA-compliant channels to the state-licensed medical provider evaluating you and the state-licensed pharmacy dispensing your prescribed medication. Text messaging originator opt-in data and SMS consent are strictly excluded from any third-party sharing.
• HIPAA Business Associates & Support Subcontractors: We may share necessary operational data with vetted subcontractors that perform support services on our behalf (such as HIPAA-compliant cloud hosting, patient portal infrastructure, payment processing, and customer service) under binding confidentiality obligations and Business Associate Agreements.
• Written Patient Authorization: Any use or disclosure of your PHI for purposes other than Treatment, Payment, Healthcare Operations, or as otherwise permitted or required by law will be made only with your separate, written HIPAA authorization, which you may revoke in writing at any time.
• Legal Obligations & Public Health/Safety: We may disclose information when required by federal or state law, in response to valid subpoenas, court orders, or regulatory requests from medical or pharmacy boards, or when necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.

5. Data Security, SSL/TLS Encryption & Safeguards

We are committed to protecting the confidentiality, integrity, and availability of your personal information and PHI. MDRN DOC LLC implements comprehensive administrative, physical, and technical safeguards in compliance with the HIPAA Security Rule (45 CFR Part 164, Subpart C) and LegitScript Standard 6:

• SSL / TLS Encryption in Transit: Every page of our Site, checkout flow, and patient portal uses Secure Socket Layer (SSL) / Transport Layer Security (TLS) technology to encrypt all transaction data, customer/patient identifiers, medical information, and confidential data during transmission.
• Encryption at Rest & Firewall Protection: All electronic Protected Health Information (ePHI) is stored on secure, access-controlled servers with AES-256 encryption at rest, network firewalls, and intrusion detection monitoring.
• Access Controls & Authentication: Access to PHI is restricted to authorized personnel and licensed clinicians who require access to perform their duties, enforced through unique user credentials, multi-factor authentication (MFA), and automatic session timeouts.

While we maintain rigorous, industry-standard and HIPAA-compliant security controls, no method of transmission over the internet or electronic storage is 100% infallible; patients are encouraged to keep their patient portal login credentials confidential.

6. Your HIPAA & Personal Data Privacy Rights

Depending on your jurisdiction and our relationship with your data, you have the following rights regarding your Protected Health Information (PHI) and personal information:

• Right to Inspect and Obtain a Copy of Your PHI (45 CFR § 164.524): You have the right to access, inspect, and obtain an electronic or paper copy of your medical and billing records maintained in our designated record set.
• Right to Request an Amendment (45 CFR § 164.526): If you believe that personal information or PHI we maintain about you is inaccurate or incomplete, you have the right to request that we amend or correct the record.
• Right to an Accounting of Disclosures (45 CFR § 164.528): You have the right to request a list (accounting) of certain disclosures of your PHI made by us for purposes other than treatment, payment, or healthcare operations, or disclosures made without your written authorization, during the six (6) years prior to your request.
• Right to Request Restrictions (45 CFR § 164.522(a)): You have the right to request a restriction or limitation on the PHI we use or disclose for treatment, payment, or healthcare operations, including the right to restrict disclosures to a health plan for services you paid for out-of-pocket in full.
• Right to Request Confidential Communications (45 CFR § 164.522(b)): You have the right to request that we communicate with you about medical matters in a specific way or at a specific location (for example, only by email or at a specific telephone number).
• Right to Delete or Withdraw Consent (Non-PHI Personal Data): Subject to statutory medical record retention requirements under federal and state law, you have the right to request deletion of non-clinical personal data or withdraw consent where consent is the legal basis for processing.
• Right to a Copy of This Privacy Policy & to File a Complaint: You have the right to receive a copy of this Privacy Policy at any time. If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer at [email protected] or +1 727-297-2061, or with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR). We will never retaliate against you for filing a complaint.

To exercise any of these rights, please submit a request to our Privacy Officer using the contact information in Section 10 below.

7. SMS / Text Messaging Program & Mobile Privacy Policy (A2P 10DLC Compliance)

When you provide your mobile phone number and voluntarily opt in via an unchecked consent box on our website forms or intake flows, you consent to receive SMS/text messages from MDRN DOC LLC (+1 727-297-2061):

• Types of Messages: Depending on the specific opt-in checkbox(es) you select, messages may include appointment reminders and confirmations, clinical intake and care coordination updates, order and delivery notifications, customer support responses, and—only if you separately opt in to marketing communications—special offers, discounts, and new program updates.
• Voluntary Consent: Consent to receive automated promotional or informational text messages is completely voluntary and is not a condition of purchasing any goods or services or receiving medical evaluation or care.
• Non-Sharing of Mobile Information & Opt-In Consent: No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
• Message Frequency & Rates: Message frequency varies based on your interaction with our services (up to 10 messages per day as disclosed in our Terms & Conditions). Message and data rates may apply for any messages sent to you from us and to us from you according to your mobile carrier plan.
• How to Opt Out (STOP): You may cancel the SMS service at any time by texting "STOP" to +1 (727) 297-2061 (or replying STOP to any message from us). After you send STOP, we will send you one final SMS message to confirm that you have been unsubscribed, after which you will no longer receive SMS messages from us unless you opt in again.
• How to Get Help (HELP): If you experience issues with our messaging program, reply with the keyword "HELP" for assistance, or contact our support team directly at [email protected] or +1 (727) 297-2061.
• Carrier Disclaimer: Wireless carriers are not liable for delayed or undelivered messages.

8. Multi-State & Jurisdictional Privacy Compliance

MDRN DOC LLC ensures that its privacy practices comply with the applicable healthcare confidentiality, telemedicine, and consumer data privacy laws of every state and jurisdiction in which we serve patients. Services are available only in jurisdictions where both the applicable affiliated healthcare professional and partner dispensing pharmacy hold active licensure in good standing and where the requested service or treatment is legally permitted. Currently, MDRN operates in 35 U.S. states and Washington, D.C. (AL, AZ, AR, CA, CO, DE, DC, FL, GA, HI, IN, IA, KY, LA, ME, MD, MI, MN, MS, MO, NE, NV, NJ, NY, ND, OH, PA, RI, SC, SD, TN, TX, UT, VA, WI, and WY) and does NOT operate in or provide telehealth or prescription services to residents of Alaska (AK), Connecticut (CT), Idaho (ID), Illinois (IL), Kansas (KS), Massachusetts (MA), Montana (MT), New Hampshire (NH), New Mexico (NM), North Carolina (NC), Oklahoma (OK), Oregon (OR), Vermont (VT), Washington (WA), or West Virginia (WV). Across all jurisdictions served, we adhere to the following state-specific privacy requirements:

• Florida Residents: In addition to HIPAA, we comply with the Florida Information Protection Act (FIPA, Fla. Stat. § 501.171) and Florida patient medical record confidentiality statutes (Fla. Stat. § 456.057), under which medical records may not be furnished to, and the medical condition of a patient may not be discussed with, any person other than the patient, the patient's legal representative, or other healthcare practitioners and providers involved in the patient's care or treatment, except upon written authorization from the patient or as expressly permitted by statute.
• State Consumer & Health Privacy Laws (CA, TX, WA, NV, VA, CO, CT & Other States Served): For residents of states with comprehensive consumer data privacy or consumer health data statutes—including the California Confidentiality of Medical Information Act (CMIA) and California Consumer Privacy Act (CCPA/CPRA), the Texas Medical Records Privacy Act (TMRPA) and Texas Data Privacy and Security Act (TDPSA), and the Washington My Health My Data Act (MHMDA)—we honor all applicable state rights to know, access, correct, delete (where not preempted by HIPAA or statutory medical record retention laws), and opt out of the sale or targeted advertising of personal or consumer health data. MDRN DOC LLC does not sell personal data or consumer health data and does not share Protected Health Information for cross-context behavioral advertising.
• Children's Privacy: Our Site and Services are intended for adults aged eighteen (18) and older. We do not knowingly solicit or collect personal information or PHI from anyone under the age of 18.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on public-facing pages of our Site to remember your preferences, improve website functionality, and analyze aggregate site traffic. Cookies and third-party advertising pixels are never used to collect, transmit, or share Protected Health Information (PHI) from your secure patient portal or medical intake forms. You may disable cookies in your browser settings at any time, though doing so may affect certain site features.

10. Changes to This Privacy Policy & Contact Us

We may update this Privacy Policy from time to time to reflect changes in legal or regulatory requirements (including HIPAA, state privacy laws, or LegitScript Certification Standards) or our operational practices. Any changes will be posted on this page (https://bemdrn.com/privacy-policy) with an updated revision date.

If you have any questions, concerns, or requests regarding this Privacy Policy, your Protected Health Information (PHI), or our privacy compliance practices, please contact our Privacy Officer at: