Privacy Policy

Introduction

This Privacy Policy describes how Corivo, LLC, a Wyoming limited liability company doing business as Corivo Health ("Corivo," "we," "our," or "us"), collects, uses, and discloses information about you when you visit our websites that link to this Privacy Policy (including www.corivohealth.com) (the "Websites"), use our mobile applications (the "Apps"), or otherwise interact with us. We refer to the Websites, Apps, and related services together as the "Services."

Corivo is a consumer membership program for medically guided weight care. Corivo is a marketing and administrative platform. Corivo does not provide medical care, pharmacy services, or any other professional healthcare services. Medical services are provided exclusively by licensed, independent healthcare providers through contracted third-party telehealth partners ("Telehealth Partners"), and coaching services are provided through our partner Concorde Health ("Concorde"). Those providers and partners maintain their own privacy practices, described further below.

This Privacy Policy is incorporated into our Terms and Conditions. Capitalized terms used but not defined here have the meanings given in the Terms and Conditions.

PLEASE READ THIS PRIVACY POLICY CAREFULLY. IF YOU DO NOT AGREE WITH IT, PLEASE DO NOT USE THE SERVICES.

Our Compliance With Applicable Privacy and Health Information Laws

Corivo is committed to handling your information in accordance with all privacy, data-protection, and health-information laws that apply to our operations and to the jurisdictions in which our members reside. Corivo makes the Services and this Privacy Policy available to residents of the U.S. states in which we operate, and we maintain a written privacy and information-security program designed to meet our obligations across those jurisdictions. Among other measures, we:

• Maintain, and regularly review and update, this Privacy Policy and our internal privacy and data-handling policies so they reflect current legal requirements in the jurisdictions we serve.
• Comply with applicable U.S. state comprehensive privacy laws, including the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and the comprehensive privacy laws of the other states listed in Section 9, by providing the individual rights, disclosures, and opt-out mechanisms described in this Privacy Policy and by honoring recognized opt-out preference signals such as the Global Privacy Control.
• Comply with applicable state consumer health data laws, including Washington's My Health My Data Act, Nevada's SB 370, and Connecticut's consumer health data provisions, by limiting our collection and use of consumer health data to the purposes described in this Privacy Policy, obtaining consent where required, and not selling consumer health data or using it for targeted advertising except as permitted by those laws.
• Address the Health Insurance Portability and Accountability Act ("HIPAA") according to our role. Corivo is not a healthcare provider or HIPAA covered entity, and the licensed providers and Telehealth Partners who deliver your medical care maintain their own HIPAA-compliant notices of privacy practices governing the protected health information they create and hold. To the extent Corivo receives or handles protected health information as a business associate of a covered entity, we do so pursuant to a written business associate agreement and in accordance with the HIPAA Privacy and Security Rules, as further described in Section 5.
• Require our service providers, Telehealth Partners, and other partners, by written contract, to protect your information consistent with this Privacy Policy and applicable law and to use it only for the purposes for which it is disclosed to them.
• Maintain administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of your information, including encryption of information in transit, as further described in Section 7.
• Provide oversight and accountability for our privacy practices, including designating personnel responsible for privacy compliance, training relevant staff, responding to individual rights requests and complaints within the timeframes required by law, and monitoring legal and regulatory developments so we can update our practices as the law evolves.

If you have questions about how we comply with a specific privacy or health-information law, wish to exercise a privacy right, or wish to make a complaint, you may contact us at privacy@corivohealth.com or at the address in Section 15. We will not retaliate against you for exercising any right available to you under applicable privacy law.

1. Information We Collect

Information you provide to us

We collect information you provide directly to us, including when you create an account, complete our eligibility quiz or intake questionnaires, purchase a membership, communicate with your coach, contact member support, or participate in surveys or promotions. Depending on how you use the Services, this may include:

• Identifiers, such as your name, email address, phone number, mailing address, and date of birth.
• Health information, such as your height, weight, health goals, medical history, current medications, lifestyle information, and other responses you provide in our eligibility quiz or intake questionnaires, as well as information generated through your participation in coaching (such as session notes, check-in responses, and progress information).
• Payment information, such as your payment card number, expiration date, and billing address, which is collected and processed by our third-party payment processors on our behalf. We do not store full payment card numbers.
• Communications, including the contents of messages you exchange with member support and, where applicable, with your coach through the Services.
• Demographic information, such as your gender, age, and similar information you choose to provide.
• Account credentials, if you create an account.

Certain information we need in order to provide the Services. If you do not provide it, or you ask us to delete it, you may no longer be able to use some or all of the Services.

Information we collect automatically

When you use the Services, we and our service providers automatically collect certain information about your device and how you interact with the Services, including your IP address, browser type, operating system, device identifiers, referring and exit pages, pages viewed, links clicked, and the dates and times of your visits. We collect this information using cookies, pixels, software development kits (SDKs), server logs, and similar technologies. You can manage cookies through your browser settings; blocking some cookies may affect the availability of certain features. We also collect general location information (such as the city, state, or zip code associated with your IP address), which among other things allows us to route you to the correct Telehealth Partner experience for your state.

Information we receive from other sources

• Telehealth Partners and providers. Our Telehealth Partners and the licensed providers who deliver your care may share limited information with us as needed to administer your membership, such as confirmation that a consultation occurred or your enrollment status. Clinical records remain with your providers and the Telehealth Partners.
• Concorde Health. Concorde provides coaching services to Corivo members and shares with us information needed to administer the coaching benefit, such as session completion and engagement information.
• Referral and marketing partners. If you were referred to Corivo through a referral partner, that partner may provide us with information such as your name and contact information, or a referral code identifying the source of your membership.
• Service providers, such as analytics providers, payment processors, and fraud-prevention services.

2. How We Use Your Information

We use the information we collect to:

• Provide, administer, and manage your membership, including creating your account, processing payments, and coordinating your access to Telehealth Partners and coaching services.
• Facilitate the provision of healthcare services to you by licensed providers through our Telehealth Partners, including transmitting your intake information to the appropriate Telehealth Partner at your direction.
• Deliver and support the coaching benefit provided through Concorde.
• Communicate with you about the Services, including transactional messages such as membership confirmations, billing notices, coaching reminders, and support responses.
• Send you marketing communications in accordance with applicable law and your choices.
• Analyze, improve, and secure the Services, including internal research and analytics presented in de-identified or aggregate form.
• Detect and prevent fraud, enforce our Terms and Conditions, and comply with legal obligations.

We may combine information collected through the Services with information from other sources, and use and disclose the combined information as described in this Privacy Policy. We may also de-identify or aggregate information so that it can no longer reasonably be linked to you; we may use and disclose de-identified or aggregate information for any lawful purpose, we do not attempt to re-identify it, and we contractually prohibit recipients from doing so.

3. Advertising and Analytics

We use third-party analytics services (such as Google Analytics) to understand how the Services are used, including through cookies and similar tools, and we may use analytics tools in our emails (such as pixels that tell us when a message is opened or a link is clicked) to measure the effectiveness of our communications.

We and our advertising partners (which may include platforms such as Meta, Google, and TikTok) may use cookies, pixels, SDKs, and similar technologies on our Websites and Apps to deliver advertising for Corivo on other websites and applications, measure the performance of our marketing, and build and match advertising audiences. These technologies may collect identifiers such as cookie and device identifiers, IP address, and hashed contact information (such as a hashed email address), together with information about your activity on our Websites and Apps, such as the pages you view and the actions you take (for example, visiting our site, beginning our eligibility quiz, or purchasing a membership). Because Corivo offers weight care services, this activity information may reveal, or permit inferences about, your interest in weight-related health services, and may be treated as health data or sensitive information under the laws of certain states.

We do not disclose your individual responses to our eligibility quiz or intake questionnaires, such as your medical history, conditions, or medications, to advertising platforms. Where applicable law requires consent before we use these technologies, we obtain it. We do not use health-related information for targeted advertising for residents of states whose laws restrict that use absent consent or authorization, currently including Washington, Nevada, and Maryland.

Where these activities constitute a "sale" of personal information or "sharing" or processing of personal information for targeted advertising under applicable state law, you may opt out as described in Section 9, including through the "Your Privacy Choices" link on our Websites and through a recognized browser-based opt-out preference signal such as the Global Privacy Control, which we honor as required by applicable law. If you opt out, you may still see advertising, but it will not be tailored to you based on your activity over time. You can also manage advertising preferences through industry tools such as the Digital Advertising Alliance opt-out page and through your device and platform settings; we do not control those third-party mechanisms.

4. How We Disclose Your Information

• Telehealth Partners and healthcare providers. At your direction and with your consent, we disclose your intake information to the Telehealth Partner serving your state so that a licensed provider can evaluate your eligibility for treatment. Once disclosed, that information is governed by the Telehealth Partner's and providers' own privacy practices and applicable healthcare privacy laws.
• Concorde Health. We disclose information to Concorde as needed to deliver your coaching benefit, such as your name, contact information, and relevant goal and progress information. Concorde is contractually required to use this information only to provide services to Corivo members.
• Service providers. We disclose information to vendors that perform services on our behalf, such as payment processing, cloud hosting, customer support tooling, email and SMS delivery, analytics, and fraud prevention, under contracts that restrict their use of your information.
• Advertising and analytics partners. As described in Section 3, we disclose identifiers, hashed contact information, and Website and App activity information to advertising and analytics partners, subject to the limitations and opt-out rights described in Sections 3 and 9.
• Referral partners. We may confirm to a referral partner that a referred individual enrolled in a membership, for purposes of administering referral arrangements. We do not disclose your health information to referral partners.
• Legal and protective purposes. We may disclose information to comply with legal process, enforce our Terms and Conditions, respond to claims, or protect the rights, property, or safety of Corivo, our members, or the public, including for fraud prevention.
• Business transfers. If Corivo is involved in a merger, acquisition, financing, or sale of some or all of its assets, information about you may be transferred as part of that transaction, subject to applicable law.
• With your consent or at your direction.

We do not sell your health information, and we do not sell or share your mobile phone number or SMS consent with third parties for their own marketing purposes.

5. HIPAA and Health Information

Corivo is not a healthcare provider and is not a "covered entity" under the Health Insurance Portability and Accountability Act ("HIPAA"). Health information you provide directly to Corivo is generally not protected health information under HIPAA, though it may be protected under state consumer health data laws described below. Health information you provide to, or that is created by, the licensed providers and Telehealth Partners who deliver your care may be protected health information under HIPAA and applicable state law, and its use and disclosure by those parties is governed by their own notices of privacy practices. To the extent Corivo acts as a business associate of a covered entity, Corivo will handle protected health information in accordance with HIPAA and the applicable business associate agreement.

6. Consumer Health Data

Certain states, including Washington, Nevada, and Connecticut, provide specific protections for "consumer health data," which can include information such as your health conditions, treatments sought, weight and biometric data, and health-related purchases, and may extend to information that identifies you as seeking health services. To the extent we collect consumer health data as defined under those laws, we collect and use it only for the purposes described in this Privacy Policy, with consent where required. We do not sell consumer health data, and we do not process consumer health data for targeted advertising for residents of those states except with any consent or authorization required by their laws. Residents of those states may have specific rights regarding consumer health data, including rights to access, delete, and withdraw consent, which you can exercise as described in Section 9.

7. How We Protect Your Information

We maintain administrative, technical, and physical safeguards designed to protect your information against unauthorized access, loss, misuse, or alteration. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for notifying us promptly of any suspected unauthorized use of your account.

8. Retention

We retain information for as long as necessary for the purposes for which it was collected, which depends on the nature and sensitivity of the information, the purposes for which we process it, legal and regulatory requirements, and the establishment or defense of legal claims. When information is no longer needed, we delete or de-identify it.

9. Your Rights and Choices

Depending on your state of residence, you may have some or all of the following rights with respect to your personal information under applicable state privacy laws (currently including, among others, California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia):

• To confirm whether we process your personal information and to access a copy of it, including in a portable format.
• To correct inaccurate personal information.
• To delete personal information we hold about you.
• To opt out of the sale of personal information, the sharing or processing of personal information for targeted advertising, and certain profiling.
• To limit the use of sensitive personal information, or to withdraw consent where processing is based on consent.
• To appeal a denial of a rights request, where provided by your state's law.

You may exercise these rights by emailing privacy@corivohealth.com or through the "Your Privacy Choices" link on our Websites. We will verify your identity before acting on a request, and we will respond within the timeframe required by applicable law. We will not discriminate against you for exercising your rights, though certain information is necessary to provide the Services. If you use an authorized agent, we may require proof of their authority.

Marketing choices

You may opt out of marketing emails by using the unsubscribe link in any marketing message, and out of marketing text messages by replying STOP. You may continue to receive transactional messages relating to your membership, such as billing and account notices.

10. Additional Information for California Residents

The California Consumer Privacy Act, as amended ("CCPA"), requires additional disclosures for California residents. The following table summarizes the categories of personal information we collect, the categories of third parties to which we disclose them for business purposes, and whether we "sell" or "share" them as those terms are defined by the CCPA.

California residents may exercise the rights described in Section 9, including the right to opt out of the sale or sharing of personal information and the right to limit the use of sensitive personal information, through the "Your Privacy Choices" link on our Websites or by contacting us as described below. We honor browser-based opt-out preference signals such as the Global Privacy Control as required by law. We do not knowingly sell or share the personal information of consumers under 16 years of age. We do not disclose personal information to third parties for their own direct marketing purposes within the meaning of California's "Shine the Light" law. We do not currently respond to "Do Not Track" browser signals, which are distinct from the opt-out preference signals we do honor.

11. Additional State Notices

Nevada. Nevada residents may opt out of the sale of certain covered information for monetary consideration. We do not engage in such sales; however, Nevada residents may submit an opt-out request for any potential future sales by contacting privacy@corivohealth.com.

Texas. NOTICE: We may sell your sensitive personal data (by serving you with online advertising relevant to your use of Corivo, where you have provided consent).

12. Third-Party Services

This Privacy Policy does not apply to the practices of third parties, including the Telehealth Partners, licensed providers, and pharmacies that deliver your care; Concorde with respect to any information you provide to Concorde outside the Corivo Services; the manufacturer of your device; and any third-party website or service linked from the Services. We encourage you to review the privacy policies of those third parties.

13. Children

The Services are intended for individuals 18 years of age or older. We do not knowingly collect personal information from anyone under 18, and we do not knowingly collect personal information from children under 13 within the meaning of the Children's Online Privacy Protection Act. If we learn that we have collected personal information from a child under 13, we will take reasonable steps to delete it promptly.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, our practices, or the Services. The effective date at the top of this Privacy Policy indicates when it was last revised. If we make material changes, we will provide notice as required by applicable law, such as by email or a prominent notice on the Services. Your continued use of the Services after the effective date of a revised Privacy Policy constitutes your acknowledgment of the changes.

15. Contact Us

If you have questions about this Privacy Policy or our privacy practices, contact us at:
Corivo, LLC
3608 Spruce Avenue, West Palm Beach, FL 33407
privacy@corivohealth.com