Nivara Telehealth Privacy Policy

Effective date: October 1, 2026

Nivara Telehealth LLC, a Texas limited liability company (“Nivara”), is a marketing and non-clinical administrative support company. Nivara helps consumers access telehealth services furnished by independent healthcare provider groups and their licensed healthcare professionals (“Providers”), through a technology platform developed and operated by Rimo Health LLC (“Rimo”). In this Privacy Policy, “we,” “us,” and “our” refer to Nivara and, only when acting on Nivara’s behalf, Rimo.

This Privacy Policy explains how information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an individual (“Personal Data”) is collected, used, disclosed, retained, and otherwise processed in connection with: (i) the Nivara brand website (the “Site”); and (ii) the patient log-in website and mobile application used for telehealth services (the “Platform”). Personal Data does not include information excluded from the scope of applicable law, such as deidentified or publicly available information, to the extent provided by that law.

This Privacy Policy applies to Personal Data processed by or on behalf of Nivara, including by Rimo, in connection with public marketing pages, registration and account functions, the Platform environment, appointment, messaging, and telehealth functions, prescription-ordering coordination, customer support, and other online or offline functions made available by or on behalf of Nivara through the Site or Platform (collectively, the “Services”).

Different privacy notices may apply when Rimo acts for its own purposes or when Providers, pharmacies, payment processors, or other third parties independently determine how and why Personal Data is processed. This Privacy Policy does not describe those independent processing activities. This Privacy Policy is not a substitute for your healthcare Provider’s HIPAA Notice of Privacy Practices.

This Privacy Policy is a notice of our processing practices and is not itself a request for consent or authorization. Where applicable law requires consent or authorization for a particular activity, we will request it separately. If you do not agree with our practices, you may choose not to use the Site or Platform.

Categories of Information We Collect

The types of Personal Data collected by Nivara, and by Rimo on behalf of Nivara, depend on how you use the Site, Platform, and Services.

The Site

If you access or use the Site but do not log in to the Platform, we may collect Personal Data such as your internet service provider, referring website, requested pages, dates and times of requests, and other information used to measure Site activity and improve the Site’s utility. In addition, we may request information including your name, mailing address, email address, and telephone number to communicate with you or respond to your questions or comments.

The Platform

If you access the Platform by creating a user account, Rimo, on behalf of Nivara, may collect and store Personal Data. The specific information collected in a particular interaction depends on your use of the Services, the treatment or program requested, your location, and the systems and vendors involved. The following categories of Personal Data may be collected:

Contact Information (name, date of birth, age, email address, telephone number, address, account or patient identifiers, usernames, digital or electronic signatures, IP address, device identifiers and other similar identifiers)
Account and Authentication Information (username, password, multifactor-authentication information, account preferences, security questions or recovery information, account status, log-in history, session information and authentication or access tokens)
Demographic, Eligibility, and Location Information (preferred language, state of residence, physical location at the time of a consultation, relationship to a dependent or patient, parental, guardian, caregiver, or authorized-representative status)
Health and Medical Information (symptoms and health concerns, medical history, current and prior medical conditions, medications and supplements, allergies and adverse reactions, family medical history, pregnancy or reproductive-health information, mental or behavioral health information, substance-use information, laboratory, diagnostic, or test results, vital signs or measurements, treatment history, diagnoses and treatment plans, and clinical notes)
Information Submitted or Generated Through the Services (information provided through intake forms, eligibility questionnaires, health assessments, appointment requests, consultations, secure messages, chat or support functions, photographs, identity documents, laboratory reports, uploaded medical records, attachments, electronic forms, consent records)
Prescription and Pharmacy Information (medication name, strength, dosage, and instructions, prescription status, prescriber information, selected or assigned pharmacy, pharmacy contact information, fulfillment status, refill information, shipping or pickup information, substitution information, adverse-event or medication-safety information, and communications concerning prescription fulfillment)
Transaction and Payment Information (billing name and address, payment-method type, partial payment-card information, payment token, transaction amount, authorization status, payment, refund, chargeback, and dispute history, transaction date and time, merchant or payment-provider identifiers, and related financial records)
Device, Network, and Log Information (IP address, browser type, device type, operating system, application version, language and time-zone settings, device identifiers, mobile advertising identifiers, referring and exit pages, pages or screens viewed, links selected, dates, times, and duration of activity, log-in and authentication events, error, diagnostic, and crash data, network and connection information, security logs, audit events, and interactions with website or app features)

Depending on the processing context and applicable law, some Personal Data may constitute protected health information (“PHI”) under the Health Insurance Portability and Accountability Act and its implementing regulations (“HIPAA”), “consumer health data,” “sensitive personal information,” “sensitive data,” or a similar regulated category. These categories are not interchangeable, and the applicable definitions, exemptions, permissions, and obligations vary by jurisdiction and by the role in which Nivara or Rimo processes the information. Nivara and Rimo, on behalf of Nivara, will process Personal Data in accordance with the laws applicable to them in the relevant context.

How We Collect Information

Directly from You

We collect Personal Data that you provide directly, including when you browse the Site, register or manage an account, complete forms or assessments, request or receive Services, communicate with us or a Provider, upload records or images, make a payment, or contact customer support.

Using Cookies and Other Tracking Technologies

We collect certain information through cookies, web beacons, clear GIFs, pixels, tags, web-server logs, software development kits, and similar technologies. For more information, please see the “Tracking Technologies” section below.

Purposes for Which Personal Data is Collected and Used

Personal Data may be used for the following purposes:

Providing and Administering the Services. Personal Data may be used to: (i) create and administer accounts; (ii) authenticate users; (iii) manage log-in sessions; (iv) determine service availability; (v) identify the consumer’s physical location; (vi) connect consumers with the appropriate Provider Group and Clinician; (vii) facilitate registration and intake; (viii) schedule and administer consultations; (ix) transmit messages between patients and Clinicians; (x) coordinate prescription transmission and fulfillment; (xi) collect payments; (xii) provide customer and technical support; and (xiii) communicate about accounts, appointments, prescriptions, transactions, and Services.

Facilitating Healthcare. Personal Data may be used to facilitate care furnished by Provider Groups and Clinicians, including: (i) presenting intake information to a Clinician; (ii) supporting a telehealth consultation; (iii) facilitating secure patient-Clinician communications; (iv) maintaining or supporting access to medical records; and (v) coordinating a prescription with a pharmacy.

Identity, Eligibility, and Location Verification. Personal Data may be used to: (i) confirm identity and age; (ii) verify physical location; (iii) determine whether an appropriately licensed Clinician is available; (iv) determine eligibility for a service or treatment program; (v) prevent duplicate or fraudulent accounts; and (vi) satisfy prescription, telehealth, or other legal requirements.

Payment Administration. Personal Data may be used to: (i) authorize or process payments; (ii) administer refunds or credits; (iii) respond to disputes and chargebacks; (iv) prevent payment fraud; and (v) maintain financial and tax records.

Communications. Personal Data may be used to send: (i) appointment reminders; (ii) security alerts; (iii) patient-account messages; (iv) prescription or fulfillment updates; (v) customer-support responses; (vi) required legal notices; (vii) service announcements; and (viii) marketing communications where permitted by law.

Security and Fraud Prevention. Personal Data may be used to: (i) secure accounts and systems; (ii) authenticate users; (iii) investigate suspected misuse; (iv) identify fraud or unauthorized access; (v) maintain logs; (vi) enforce applicable terms; and (vii) maintain business continuity.

Compliance with Legal and Regulatory Requirements. We may process Personal Data to (i) comply with healthcare, pharmacy, privacy, consumer-protection, tax, financial, recordkeeping, and other laws; (ii) respond to legal process; (iii) cooperate with lawful regulatory or governmental requests; (iv) investigate complaints; (v) establish, exercise, or defend legal claims; and (vi) fulfill professional, licensing, public-health, or patient-safety obligations.

Analytics and Service Improvement. We may process Personal Data to (i) understand how the Services are used; (ii) identify errors and performance issues; (iii) improve usability and accessibility; (iv) develop or evaluate Platform features; (v) measure consumer engagement; (vi) conduct quality assurance; prepare aggregated reports; and (vii) improve administrative operations.

Categories of Recipients to Whom Personal Data May Be Disclosed

We may disclose Personal Data to the following categories of recipients for the purposes described below, subject to applicable law and contractual restrictions:

Providers: We may disclose contact, demographic, eligibility, location, health and medical, and prescription information to Providers involved in your care so that they can provide medical consultations, diagnosis, treatment, prescribing, recordkeeping, and communications services to you.
Management Services Organizations: We may disclose Personal Data reasonably necessary for administrative and management functions to organizations that provide non-clinical administrative support to Providers.
Pharmacies: We may disclose identity, contact, delivery, prescription, prescriber, and related information to your selected or assigned pharmacy for prescription validation, dispensing, fulfillment, payment, shipping, patient communications, and pharmacy compliance.
Payment Processors: We may disclose contact, billing, payment-method, transaction, device, and fraud prevention information to payment processors that perform payment authorization, processing, refunds, chargebacks, fraud prevention, and financial reporting for Nivara.
Government, Regulatory, and Other Lawful Recipients: We may disclose Personal Data if and to the extent required or permitted by applicable law, regulation, legal process, or a valid governmental request, including to protect rights, safety, and security or to establish, exercise, or defend legal claims.
Other Authorized Recipients: We may disclose Personal Data to other third parties at your direction or with your consent or authorization, as applicable. The disclosure will be limited to the information and purposes covered by that direction, consent, or authorization, except as otherwise permitted or required by law.

The legal basis, permissions, and restrictions applicable to these activities may differ depending on whether the information is PHI, consumer health data, sensitive personal information, or ordinary personal information.

HIPAA and Medical Information

This Privacy Policy is not a HIPAA Notice of Privacy Practices. Each Provider subject to HIPAA is responsible for providing a Notice of Privacy Practices that explains how it may use and disclose PHI.

Rimo may process PHI on behalf of a Provider as a business associate. When acting in that capacity, Rimo will handle PHI in accordance with HIPAA, an applicable business associate agreement, and other applicable law. Neither Nivara nor Rimo replaces a Provider for purposes of medical-record ownership, clinical decision-making, or HIPAA obligations.

Tracking Technologies

The Platform may use tracking technologies such as cookies, web beacons, pixels, tags, local storage, mobile software development kits, analytics tools, crash-reporting tools, and similar technologies. These technologies may collect device, browsing, usage, interaction, and identifier information, and may store your preferences. You can set your browser to remove or reject cookies, but the Platform features may not function properly. The Platform uses strictly necessary cookies. Strictly necessary cookies are cookies that are required for the operation of the Platform. They include, for example, cookies that enable you to log into secure areas of our websites and use all of the website’s features. The Platform also uses session cookies to allow you to automatically log into the Platform without re-entering your log-in information or re-entering your preferences during the same session and to allow the shopping and order tracking programs to work properly. Session cookies will expire as soon as you log off the system.

Where required by applicable law, we will treat a legally recognized universal opt-out preference signal as a request to opt out of sale or sharing of Personal Data, or its processing for targeted advertising, for the browser, device, and consumer to which the signal applies, subject to applicable verification and scope requirements.

Consumer Health Data Privacy Notice

Depending on your state of residence and the relevant processing context, Personal Data that identifies or is reasonably linkable to a consumer and identifies the consumer’s past, present, or future physical or mental health status may be regulated as consumer health data. The categories described in “Categories of Information We Collect,” the sources described in “How We Collect Information,” the purposes described in “Purposes for Which Personal Data Is Collected and Used,” and the recipients described in “Categories of Recipients to Whom Personal Data May Be Disclosed” apply to consumer health data to the extent included in those descriptions. Applicable state law may define consumer health data, consent, authorization, sale, and sharing differently and may exempt PHI, medical records, information maintained by regulated entities, or other specified information.

State Privacy Rights

Depending on your state of residence and subject to applicable definitions, exemptions, exceptions, and verification requirements, you may have rights to confirm processing; access or obtain a portable copy of Personal Data; correct inaccuracies; request deletion; obtain information about certain recipients; opt out of the sale or sharing of Personal Data, targeted advertising, or certain profiling; withdraw consent for future processing where consent is the applicable basis; and appeal a refusal to act on a request. Some states provide additional rights concerning consumer health data, including rights to withdraw consent to collection or sharing and to receive a list of third parties or affiliates that received such data. A request to delete may not require deletion of information that applicable law permits or requires us or another entity to retain, and deletion from active systems may not result in immediate deletion from backups where delayed deletion is permitted. These rights do not apply uniformly to all individuals or information; for example, applicable law may exempt PHI, medical records, clinical-trial data, or information processed by certain regulated entities. We will not unlawfully discriminate or retaliate against you for exercising an applicable privacy right. To submit a request, use the information in the “Contact Us” section below or call 855-451-4403 and describe the right you wish to exercise. We may request information reasonably necessary to authenticate your identity, authority, and state of residence. If applicable law permits an authorized agent to submit a request, we may require proof of the agent’s authority and may verify your identity directly. If we deny an appeal, we will provide any further information required by applicable law.

Sale of Consumer Health Data

We do not sell consumer health data except, if ever proposed, pursuant to a separate authorization that satisfies the law applicable to the transaction. An authorization for a sale of consumer health data, if ever requested, would be presented separately from general terms, privacy disclosures, or consent to receive Services. Refusing to authorize a sale will not prevent you from obtaining Services unless applicable law permits otherwise.

Data Retention

Nivara and Rimo retain Personal Data for no longer than reasonably necessary for the purposes described in this Privacy Policy, subject to applicable legal, contractual, accounting, fraud-prevention, dispute-resolution, backup, and recordkeeping requirements. Retention periods vary based on the nature and sensitivity of the Personal Data, the processing purpose, the relationship with the individual, the responsible organization, reasonably anticipated legal claims, and applicable law. When retention is no longer reasonably necessary, the responsible entity will delete, deidentify, or otherwise dispose of the Personal Data in accordance with applicable requirements.

Providers may be subject to medical-record retention requirements under the laws applicable to their practices and patients.

Information Security

Nivara and Rimo use reasonable administrative, technical, and physical safeguards designed to protect Personal Data against unauthorized access, acquisition, destruction, loss, alteration, use, or disclosure. Safeguards are selected based on factors such as the nature and sensitivity of the Personal Data, the systems and recipients involved, applicable legal requirements, and the nature and risk of the processing.

No security measure or method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and should notify us promptly if you believe your account or Personal Data has been compromised.

Children

Neither the Site nor the Platform is directed or marketed at, or intended for, children under age 18. We do not knowingly collect Personal Data from anyone under the age of 18. If a parent or guardian becomes aware that their child under the age of 13, has provided us with Personal Data without their consent, they should contact us. We will work with Rimo to delete such Personal Data from the Platform within a commercially reasonable time, but no later than required under the applicable law relating to the child’s place of residence.

Third-Party Links

The Services may contain links to or integrations with websites, applications, pharmacies, payment providers, identity-verification vendors, laboratories, or other services operated by separate organizations. When you are redirected to another website or application, you should review the application privacy policy for more information on that vendor’s collection practices.

Modifications to This Privacy Policy

Nivara may update this Privacy Policy from time to time. The revised Privacy Policy will apply as of the Effective Date stated at the top. If we make a material change, we will provide notice in a manner appropriate to the nature of the change and as required by applicable law. Where applicable law requires consent or authorization for a changed processing activity, we will request it before engaging in that activity. We encourage you to review this Privacy Policy periodically.

Contact Us

Privacy questions and requests should be directed to: Nivara Telehealth LLC, 282 Buc-ee's Blvd Suite 200, Katy, TX 77494; hello@nivaratelehealth.com; 855-451-4403