Privacy Policy

Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed, and how you can get access to this information. Please review it carefully. Hello Pepper LLC works with independently licensed providers through Beluga Health, P.A., an independent professional medical practice, and with licensed pharmacies and laboratories. Together we handle protected health information (PHI) for treatment, payment and healthcare operations, as described below.

SMS Usage

We send text messages only for service-related communications, such as notifications, reminders, appointment information, shipment updates and account updates. Message and data rates may apply. You can opt out at any time by replying STOP. Opting out of text messages will not affect your membership or your access to care.

Email Marketing

We use cookies, pixels, web beacons and similar technologies to understand how you interact with our emails and our website, so that we can send you relevant communications. You may unsubscribe from marketing email at any time using the link in any marketing message.

We do not place advertising or analytics technologies on any page where health information is collected or displayed, including the clinical intake, your results, medication pages, the scheduler and the member portal. We do not build advertising audiences from health information, and we do not use health information to market to you.

Uses and Disclosures of PHI

We may use and disclose your health information for the following purposes: • Treatment. To coordinate care with your provider, the dispensing pharmacy and any laboratory involved in your care. • Payment. To verify eligibility, process your payments and bill for services and products you have purchased. • Healthcare operations. Quality assessment, provider review, training and administrative functions. • As required by law. Including reporting required by federal, state or local law. • Public health. Reporting disease, injury, adverse events and product recalls to authorities authorized to receive it. • Health oversight. Audits, investigations, inspections and licensure activity by oversight agencies. • Law enforcement. In response to a court order, subpoena, warrant or other lawful process. • Research. Where permitted by law and subject to required approvals and protections. • Workers' compensation. To the extent necessary to comply with workers' compensation laws. • To avert a serious threat. Where necessary to prevent a serious threat to your health or safety or to the health or safety of another person. Any other use or disclosure of your health information requires your written authorization, which you may revoke at any time in writing. Uses and disclosures for marketing, and any sale of your health information, always require your written authorization.

We do not share your health information with independent Hello Pepper Partners. A Partner can see membership status and compensable activity only. Partners are contractually prohibited from collecting, recording or repeating your health information, and they have no role in your care.

Your Rights Regarding PHI

• Inspect and copy. You may request a copy of your health records, in electronic form where we maintain them electronically. • Amend. You may request an amendment if you believe information about you is incorrect or incomplete. We may deny a request and will tell you why in writing. • Accounting of disclosures. You may request a list of certain disclosures we have made, going back up to six years. • Request restrictions. You may ask us to limit how we use or disclose your information. We are not required to agree to every request, but we will tell you our decision. • Confidential communications. You may ask us to contact you in a specific way or at a specific address. • Breach notification. You have the right to be notified if there is a breach of your unsecured health information. • A paper copy of this notice. You may request one at any time, even if you agreed to receive it electronically. To exercise any of these rights, write to us at privacy@hellopepper.com or use the member portal.

Transmission and Protection of PHI

We use administrative, technical and physical safeguards designed to protect your information, including encryption in transit and at rest, access controls limiting access to those who need it, multi-factor authentication for administrative access, logging, and vendor security review. No system is perfectly secure and we cannot guarantee absolute security. We keep account and transaction records for seven years, marketing contact information until you opt out, support communications for three years, and website analytics for twenty-six months. Clinical records are retained by the provider, pharmacy or laboratory that created them under the medical record retention laws that apply to them.

Changes to This Notice

We may change this notice and apply the change to information we already hold. The current version is always posted on our website with its effective date. Where a change is material we will notify you, and where the law requires your consent before applying a change to information already collected, we will obtain it.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us at privacy@hellopepper.com, and you may file a complaint with the Secretary of the U.S. Department of Health and Human Services. We will never retaliate against you for filing a complaint, and filing one will not affect your membership or your access to care.

Contact Information

Privacy Officer, Hello Pepper LLC · privacy@hellopepper.com · (801) 367 2703 For membership, billing or order questions, use support@hellopepper.com or the member portal.

State-Specific Privacy Rights

Depending on where you live, you may have additional rights: to know what personal information we hold and how we use it, to obtain a copy in a portable format, to correct it, to delete it, to opt out of targeted advertising and of the sale of personal information, to limit the use of sensitive personal information, and to not be discriminated against for exercising a right. Hello Pepper extends these rights to every Member and visitor in the United States, regardless of where they live. We respond within 45 days and may extend once by a further 45 days where the law permits, with notice to you. If we decline a request we will tell you why and how to appeal. We honor the Global Privacy Control and other recognized universal opt-out signals in every state. Certain states give additional protection to sensitive categories of health information, including mental health records, substance use treatment records, genetic information and HIV or AIDS-related information. Where those protections apply, we follow them. California Residents California residents have rights under the California Consumer Privacy Act, including the right to know, delete, correct, and to opt out of the sale or sharing of personal information, and to limit the use of sensitive personal information. Medical information is additionally protected by the Confidentiality of Medical Information Act. We do not sell personal information. New York Residents New York law provides additional protection for HIV-related information and for mental health records, and requires specific written authorization before those categories are disclosed. Texas Residents Texas residents have rights under the Texas Data Privacy and Security Act, and Texas law provides additional protection for mental health and substance use records. Florida Residents Florida law provides additional protection for HIV test results and for mental health records, and requires specific authorization before those categories are disclosed. Illinois Residents Illinois law provides additional protection for mental health and developmental disability records under the Mental Health and Developmental Disabilities Confidentiality Act, and for genetic information under the Genetic Information Privacy Act. Massachusetts Residents Massachusetts law provides additional protection for HIV test results and for certain medical records, and requires written consent before those categories are disclosed. Washington, Nevada and Connecticut Residents Consumer health data collected about residents of these states is governed by our separate Consumer Health Data Privacy Policy, which is linked from our homepage. That policy explains what consumer health data we collect, who we share it with, and how to withdraw consent or request deletion. Washington's My Health My Data Act gives individuals a private right of action. Other States If your state provides rights not described above, those rights apply to you and we will honor them. Contact privacy@hellopepper.com and tell us what you need.

Refunds, Cancellations and Returns

You can cancel your membership at any time, online, in the member portal, using the same steps you used to join. There is no cancellation fee and no minimum term. We will not require you to call anyone, speak to a Partner, or sit through an offer in order to cancel. • If we charge you for a billing period that has not begun, we refund it in full. • Membership fees for a period already underway are not refunded, except where the law requires it. • Prescription medication that has been dispensed cannot be returned, resold or refunded. Pharmacy law in every state prohibits it, because a pharmacy cannot verify how a medication was stored once it has left their control. • If an order arrives wrong, damaged, or outside its required temperature range, we make it right at no cost to you. Refunds are issued to your original payment method within seven business days. Our full Shipping and Returns Policy covers the rest.