Privacy Policy | HIPAA Compliant

Effective Date: July 1, 2026 | Last Updated: May 22, 2026

1. Introduction

My Body Labs LLC (“My Body Labs,” “we,” “us,” or “our”) is committed to protecting your privacy and the security of your health information. This Privacy Policy describes how we collect, use, disclose, and protect information in connection with our telehealth platform at mybodylabs.com.

This policy covers both general personal information governed by applicable privacy laws and protected health information (PHI) governed by the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

2. Our Role Under HIPAA

My Body Labs functions as a Business Associate under HIPAA with respect to the independently contracted physicians and licensed compounding pharmacies that use our platform. We handle Protected Health Information (PHI) on behalf of these Covered Entities pursuant to Business Associate Agreements (BAAs).

We are committed to the following HIPAA-compliant privacy practices:

We will only use and disclose PHI as permitted or required by HIPAA and applicable BAAs.
We will implement appropriate administrative, physical, and technical safeguards to protect PHI.
We will report any breach of unsecured PHI to the applicable Covered Entity in accordance with HIPAA requirements.

3. Information We Collect

3.1 Information You Provide

Account information: Name, email address, date of birth, and credentials.
Health intake: Medical history, current medications, allergies, health conditions, and goals.
Contact information: Mailing address, phone number, and state of residence.
Payment information: Processed through PCI-DSS compliant processors; we do not store full card numbers.
Communications: Messages and emails sent to us or to physicians through the platform.

3.2 Protected Health Information (PHI)

In the context of telehealth services, we may collect, maintain, and transmit PHI including health history, physician consultation notes, prescription information, and lab results.

3.3 Information Collected Automatically

We automatically collect IP addresses, browser type, device information, and pages visited through cookies and similar technologies.

4. How We Use Your Information

Facilitating connections with licensed physicians and compounding pharmacies.
Processing your health intake and routing it to healthcare providers.
Processing payments and managing your subscription.
Communicating with you about your care, account, and our services.
Complying with legal obligations.

We will not use or disclose your PHI for marketing purposes or sell your PHI without your written authorization.

5. Your HIPAA Rights

As a patient, you have the following rights with respect to your Protected Health Information:

Right of Access: Inspect and obtain copies of your PHI. Request by emailing support@mybodylabs.com. We will respond within 30 days.
Right to Amend: Request corrections to PHI you believe is incorrect.
Right to an Accounting of Disclosures: Request a list of certain disclosures of your PHI.
Right to Request Restrictions: Request restrictions on certain uses of your PHI.
Right to Revoke Authorization: Revoke any authorization you have given us in writing at any time.
Right to File a Complaint: File a complaint with us or with the HHS Office for Civil Rights at www.hhs.gov/ocr. We will not retaliate against you for filing a complaint.

6. How We Protect Your Information

Technical Safeguards

Encryption of PHI in transit using TLS 1.2 or higher.
Encryption of PHI at rest using AES-256 or equivalent.
Role-based access controls limiting staff access to PHI.
Regular security assessments and audit logs of PHI access.

Administrative Safeguards

HIPAA training for all staff with access to PHI.
Business Associate Agreements with all vendors accessing PHI.
Regular risk assessments per 45 CFR § 164.308(a)(1).

Breach Notification

In the event of a breach of unsecured PHI, we will notify affected individuals and the U.S. Department of Health and Human Services in accordance with the HIPAA Breach Notification Rule (45 CFR Part 164, Subpart D) within 60 days of discovery.

7. Information Sharing

We do not sell your personal information or PHI.

We share information only with:

Healthcare providers: Physicians and pharmacies providing your care, as necessary for treatment.
Service providers: Vendors operating under HIPAA-compliant BAAs (hosting, payment processing, communications).
Legal requirements: When required by law, court order, or to protect safety.

8. State Privacy Rights

California Residents (CCPA/CPRA)

California residents have the right to know what personal information we collect, request deletion of personal information, opt out of sale of personal information (we do not sell personal information), and non-discrimination for exercising these rights. Submit requests to privacy@mybodylabs.com. We will respond within 45 days.

Other States

We comply with applicable state privacy laws in all states where we operate, including the Florida Information Protection Act (FIPA) and state-specific telehealth privacy requirements.

9. Cookies

We use strictly necessary cookies (required for authentication and security), functional cookies (preferences and settings), and analytics cookies (anonymized usage data). We do not use advertising or tracking cookies and do not share cookie data with third parties for advertising purposes.

10. Children’s Privacy

My Body Labs is not directed to persons under 18. We do not knowingly collect information from children under 18. Contact support@mybodylabs.com if you believe we have collected information from a minor.

11. Data Retention

PHI and medical records: Minimum 7 years from date of service (or as required by state law).
Account information: Duration of account plus 7 years after closure.
Payment records: As required by applicable financial laws, typically 7 years.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the revised policy on our platform and, for changes materially affecting your rights, via email with advance notice.

13. Contact Us

For privacy-related questions or to exercise your rights:

Privacy inquiries: privacy@mybodylabs.com
HIPAA compliance: hipaa@mybodylabs.com
General support: support@mybodylabs.com

For complaints to the U.S. Department of Health and Human Services Office for Civil Rights:
Website: www.hhs.gov/ocr/complaints | Phone: 1-800-368-1019