Privacy Policy

This Privacy Policy explains how NextAct ("NextAct," "we," "us") collects, uses and protects your information when you use nextact.health and our related services (the "Services"). By using the Services, you agree to this policy.

1. Who we are

NextAct is a healthcare technology platform. We are not a medical provider or a pharmacy. Clinical care is provided by licensed providers affiliated with Elite Care Health, an independent physician group. Prescriptions, if approved, are fulfilled by Rx Ave Health, a licensed U.S. pharmacy.

NextAct · support@nextact.health

2. Information we collect

Information you give us

• Name, email address, phone number, date of birth and shipping address.
• Health history, current medications, allergies, goals and other answers you give in an intake questionnaire.
• Messages with our team or your provider, consultation notes, lab results and treatment plans.
• Payment details. These are processed by [[PAYMENT PROCESSOR]], a PCI-compliant payment processor. We do not store full card numbers.

Information collected automatically

• IP address, device and browser type, pages visited, referring URLs and similar usage data.
• Cookies and similar technologies (see section 7).

3. How we use your information

• To process your intake and let a licensed provider review it.
• To process payments for consultations and any approved treatment.
• To coordinate prescription fulfillment and shipping with the pharmacy.
• To communicate with you about your account, your care, orders and reminders.
• To operate, secure and improve the Services, and to prevent fraud.
• To comply with legal and regulatory obligations.

4. Health information and HIPAA

Protected health information ("PHI") is shared only as needed for your care: with licensed providers affiliated with Elite Care Health, with Rx Ave Health for prescription fulfillment, and with vendors that support the Services under a Business Associate Agreement. PHI is stored on HIPAA-compliant systems and encrypted. For more detail, see our HIPAA Notice of Privacy Practices.

5. Who we share information with

• Elite Care Health (independent physician group): to review your intake and provide clinical care.
• Rx Ave Health (licensed U.S. pharmacy): to fulfill and ship prescriptions a provider approves.
• [[PAYMENT PROCESSOR]]: to process payments.
• Service providers that host our systems, send messages, or help us run the Services, each bound by contract (and a Business Associate Agreement where they handle PHI).
• Authorities, when required by law.

We do not sell your personal information. We do not use your health information for marketing without your written authorization.

6. SMS and email communications

If you opt in, we may send you text messages and emails about your account, care and orders. Message and data rates may apply. You can stop texts at any time by replying STOP, and unsubscribe from marketing emails using the link in any email. We may still send messages needed to provide the Services (for example, order or account notices).

7. Cookies and analytics

We use cookies and similar tools to keep the site working, remember preferences and understand how the site is used (for example, through analytics services). We do not place health information in analytics or advertising tools. You can disable cookies in your browser settings; some parts of the site may not work as expected.

8. Your rights

Subject to applicable law, you may request to:

• Access a copy of your personal information.
• Correct inaccurate information.
• Delete your information, except where we must keep it by law (for example, medical record retention rules).
• Opt out of SMS or marketing emails.
• Receive a portable copy of your data.

Send requests to [[PRIVACY EMAIL]]. We respond within 30 days.

9. Data security

We use encryption in transit (TLS) and at rest for PHI and payment data, access controls, and security reviews of our vendors. No system is completely secure, and we cannot guarantee absolute security.

10. Data retention

We keep your information while your account is active and for at least seven years after your last interaction, or longer where the law requires. Payment records are kept as required by financial regulations.

11. Children

The Services are for adults 18 and older. We do not knowingly collect information from anyone under 18. If we learn we have, we will delete it promptly.

12. Data breach notification

If a breach affects your information, we will notify you without unreasonable delay, as required by federal and state law, including the HIPAA Breach Notification Rule.

13. Governing law and disputes

This policy is governed by the laws of the State of [[STATE]]. Disputes are resolved as described in our Terms of Service, including binding individual arbitration and a waiver of class actions.

14. Changes to this policy

We may update this policy. We will post the new version here with a new "Last updated" date, and email you about material changes. Continued use of the Services means you accept the updated policy.

15. Contact us

NextAct