Privacy Policy

Who we are and what this policy covers

This Privacy Policy explains how StemNovaMD, PLLC ("StemNovaMD," "we," "us") collects, uses, shares and protects information when you visit stemnovamd.com, create an account, complete an assessment, or receive care from us. StemNovaMD is a medical practice that provides telehealth care to adults located in Texas and Florida.

Health information you give us through our assessment, the patient portal, a telehealth visit, a lab or a pharmacy is protected health information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA). We use and share PHI only as described in our Notice of Privacy Practices. If anything in this policy conflicts with that notice, the notice controls for PHI.

Information we collect

• Contact and account information: name, email, phone number, date of birth, sex, state of residence, shipping address, and your login credentials (passwords are stored only in hashed form).
• Identity and location verification: information we need to confirm who you are, that you are 18 or older, and that you are located in a state we serve, such as a photo of a government-issued ID and a photo of you.
• Health information (PHI): assessment answers, medical history, current medications, allergies, symptoms, photos you choose to upload, lab orders and results, visit notes, prescriptions and messages with your care team.
• Payment information: your card is collected and stored by our PCI-compliant payment processor. We receive only limited details, such as card type, last four digits and expiration date. We never see or store your full card number.
• Communications: emails, texts, secure messages and phone calls with us, including your communication preferences.
• Technical information: on our public pages, basic device and usage information such as browser type, pages viewed and referring site. See "Cookies and analytics" below.

We also receive information from others involved in your care: the licensed clinicians who evaluate you, our partner pharmacy, laboratories, identity-verification services, and, for controlled substances, state prescription drug monitoring programs.

How we use information

• To evaluate you, provide and coordinate your care, and send prescriptions to the pharmacy and lab orders to the laboratory;
• to verify your identity, age and location, as telehealth and prescribing laws require;
• to process payments, plan renewals, refunds and receipts;
• to ship your medication and send you service messages about your account, visits, prescriptions, shipments, labs and billing;
• to send marketing messages, but only if you opt in (you can opt out at any time);
• to operate, secure and improve our website and services, and to detect and prevent fraud and misuse;
• to meet our legal, licensing, medical-record and regulatory obligations, including reporting adverse events.

How we protect your health information online

• We do not use third-party advertising pixels, tags or tracking technologies on stemnovamd.com, including the assessment, checkout and patient portal.
• We never send drug names, conditions, symptoms, lab values, intake answers or other health information to advertising platforms or social media companies.
• Site analytics are turned off on the assessment, checkout and patient portal, and are configured so they do not collect health information (see "Cookies and analytics").
• Information is encrypted in transit and at rest. Access is limited to people who need it to do their jobs, and every vendor that handles PHI signs a business associate agreement.
• We store electronic medical records in the United States.

How we share information

We share information only as needed to provide our services or as the law requires:

• Your care team: our Medical Director and prescribing physician, and the licensed clinicians of our telehealth partner, Qualiphy PC, who perform video evaluations.
• Pharmacy and laboratory: Strive Pharmacy, the licensed pharmacy that fills your prescriptions, and the laboratory that processes any tests your clinician orders.
• Service providers: companies that host our website and records, send email and text messages, verify identity, process payments, and support our operations, under contracts that limit their use of your information and, where PHI is involved, business associate agreements.
• Legal and safety: when required by law, subpoena or court order; to report to licensing boards, public health authorities or the FDA; and to protect the safety of you or others.
• Business transfers: if our practice is reorganized, merged or sold, subject to the same protections and to the law governing medical records.
• With your permission: for example, to your primary care provider or a family member you designate.

We do not sell your personal information or your health information. We do not share it for targeted advertising. We do not share it with Stem Nova Direct or any other Stem Nova company for their marketing.

Text messages

If you give us your mobile number, we may send you text messages about your account, visits, prescriptions, shipments and billing. We send marketing texts only if you separately opt in. Message frequency varies. Message and data rates may apply. Reply STOP to opt out or HELP for help. Opting out of texts does not affect care-related messages we send by email or through the portal.

We do not share or sell your mobile number or text-messaging consent with third parties or affiliates for their marketing or promotional purposes.

Cookies and analytics

We use a small number of cookies and similar technologies that are needed for the site to work, such as keeping you signed in and remembering your assessment progress. On our public pages we use Vercel Web Analytics, a privacy-focused service that counts page views without cookies, without building profiles, and without tracking you across other websites. Analytics is disabled on the assessment, checkout and patient portal, and we do not record the web address details that could reveal a condition or medication you selected.

We treat a Global Privacy Control signal from your browser as a request to opt out of any sale or targeted advertising. Because we do neither, our practices are the same whether or not you send it. You can also block or delete cookies in your browser settings. Blocking required cookies may stop parts of the site from working.

Artificial intelligence

Your clinicians make every diagnosis and treatment decision. We do not use artificial intelligence to diagnose, prescribe or decide your treatment. If we introduce AI-assisted tools in your care, we will tell you before they are used, and a licensed clinician will review and remain responsible for any result.

How long we keep information

We keep medical records for as long as Texas and Florida law require, generally at least seven years after your last visit, and longer when the law or a legal matter requires it. We keep billing records as tax and accounting laws require. We keep other account information while your account is open and delete or de-identify it when it is no longer needed.

Your privacy rights

• Health information: you can access, get copies of, and ask us to correct your medical records, and use the other rights in the "Your rights" section of our Notice of Privacy Practices.
• Other personal information: depending on where you live, including under the Texas Data Privacy and Security Act, you may ask us to confirm whether we process your personal information; to access, correct, delete or get a portable copy of it; and to opt out of sale, targeted advertising and profiling. We do not sell personal information or use it for targeted advertising or profiling.
• Consumer health data: see our Consumer Health Data Policy.
• Account deletion: we will delete account information that we are not legally required to keep. Medical records must be kept for the periods described above.
• Marketing: unsubscribe using the link in any marketing email, reply STOP to any text, or contact us.

To make a request, email privacy@stemnovamd.com or call 281-531-7500. We will verify your identity before acting, and you may use an authorized agent. We respond within 45 days, and will tell you if we need more time as the law allows. We will not discriminate against you for exercising your rights.

Appeals. If we decline your request, you may appeal by replying to our decision or emailing privacy@stemnovamd.com with "Appeal" in the subject line. We will respond within 60 days. If you are not satisfied, Texas residents may contact the Texas Attorney General.

Security and breach notification

We use administrative, technical and physical safeguards to protect your information, including encryption, access controls, audit logging and staff training. No system is completely secure. If a breach affects your information, we will notify you as HIPAA and state law require. Keep your password private and contact us right away if you think your account has been compromised.

Texas notice about electronic disclosure

Texas law requires us to tell you that your protected health information may be disclosed electronically, for example when we send a prescription to the pharmacy or a lab order to the laboratory. We disclose it electronically only as permitted by HIPAA and Texas law and, where the law requires, with your authorization.

Children

Our website and services are only for adults 18 and older. We do not knowingly collect information from anyone under 18. If we learn that we have, we will delete it unless the law requires us to keep it.

Links to other websites

Our site may link to other websites, such as the FDA or a state medical board. We are not responsible for their privacy practices. Please read their policies.

Changes to this policy

We will post any changes here with a new effective date. If we make a material change to how we use or share your information, we will notify you by email or in the patient portal before the change takes effect.

Contact our Privacy Officer