Kaerwell Health LLC — Privacy Policy

1. Introduction

Kaerwell Health LLC (“Kaerwell,” “we,” “us,” or “our”) is committed to protecting the privacy of our users. This Privacy Policy describes how we collect, use, disclose, and safeguard your personal information when you access or use our website, platform, and related services (collectively, the “Services”).

Our Services are designed for licensed healthcare practitioners, including physicians, nurse practitioners, naturopathic doctors, and other qualified health professionals. This Privacy Policy applies to all users of our Services, including practitioners who purchase supplements for resale or create private-label products through our platform.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by posting the updated policy on our website and updating the “Last Updated” date. Your continued use of the Services after any changes constitutes your acceptance of the revised Privacy Policy.

2. Our Privacy Principles

Our approach to privacy is guided by these core principles:

• Data Minimization: We collect only the information necessary to provide and improve our Services.
• Transparency: We clearly communicate what data we collect, how we use it, and with whom we share it.
• Control: We give you meaningful choices about your personal information and respect your privacy preferences.
• Security: We implement appropriate technical and organizational measures to protect your data.

3. Information We Collect

3.1 Information You Provide to Us

We collect information you voluntarily provide when you use our Services, including:

• Account Information: Name, email address, phone number, and practice or business name when you create an account.
• Professional Information: NPI number, license type, license number, and professional credentials for practitioner verification.
• Order Information: Shipping addresses, billing addresses, and order history.
• Payment Information: Credit card or other payment method details, which are processed by our third-party payment processor and not stored on our servers.
• Private Label Information: Brand name, logo, label designs, and other branding materials you provide for private-label product creation.
• Communications: Information you provide when you contact us for support, submit feedback, or communicate with us through any channel.

3.2 Information Collected Automatically

When you use our Services, we may automatically collect certain information, including:

• Device Information: Browser type, operating system, device type, and screen resolution.
• Log Information: IP address, access times, pages viewed, referring URL, and actions taken on the platform.
• Cookies and Similar Technologies: We use cookies and similar tracking technologies to enhance your experience. See Section 8 for more details.

3.3 Information from Third Parties

We may receive information about you from third parties, including:

• NPI Registry (NPPES): We verify practitioner credentials by querying the National Plan and Provider Enumeration System (NPPES) API using the NPI number you provide.
• Shipping Carriers: Tracking and delivery status information for your orders.

4. How We Use Your Information

We use the information we collect to:

• Provide and Maintain Our Services: Process orders, fulfill shipments, manage your account, and provide private-label product creation services.
• Process Payments: Facilitate secure payment transactions through our payment processor.
• Verify Professional Credentials: Confirm that users are licensed healthcare practitioners authorized to purchase and resell supplements.
• Communicate with You: Send order confirmations, shipping updates, account notifications, and respond to your inquiries and support requests.
• Improve Our Services: Analyze usage patterns to enhance functionality, user experience, and product offerings.
• Ensure Safety and Security: Detect, prevent, and address fraud, unauthorized access, and other harmful activities.

5. How We Share Your Information

We do not sell your personal information. We have never sold personal information and have no plans to do so.

We may share your information in the following circumstances:

• Affiliated Entities: We share information with our affiliated companies, including Kaerwell Fulfillment LLC (for order fulfillment and warehousing) and Kaerwell Private Labeling LLC (for private-label product creation), which operate under the same ownership and data protection standards.
• Payment Processors: We share payment information with Authorize.net to process transactions securely. Their use of your information is governed by their own privacy policy.
• Shipping Carriers: We share shipping addresses and order details with carriers through EasyPost to fulfill and deliver your orders.
• NPPES API: We query the NPPES database using your NPI number to verify your practitioner credentials. This is a public database maintained by CMS.
• Legal Requirements: We may disclose your information if required to do so by law, regulation, legal process, or governmental request.
• Business Transfers: In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction.
• With Your Consent: We may share your information for other purposes with your explicit consent.

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Specifically:

• Active Accounts: We retain your account information for as long as your account remains active.
• Transaction Records: We retain order and payment records for a minimum of 7 years for tax, accounting, and legal compliance purposes.
• Verification Records: We retain practitioner verification data for as long as your account is active and for a reasonable period thereafter.
• Legal Obligations: We may retain certain information as required to comply with legal obligations, resolve disputes, and enforce our agreements.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS (Transport Layer Security).
• Tokenized Payments: Payment card information is tokenized by our payment processor and is never stored on our servers.
• Access Controls: Access to personal information is restricted to authorized personnel who need it to perform their job functions.
• Authentication: We use magic link (passwordless) authentication to reduce the risk of credential-based attacks.

While we strive to protect your personal information, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

8. Cookies and Tracking Technologies

8.1 Categories of Cookies We Use

• Strictly Necessary Cookies: Essential for the operation of our Services, such as session cookies for authentication and shopping cart functionality. These cannot be disabled.
• Functional and Analytics Cookies: Help us understand how you use our Services and improve functionality. These may be disabled without affecting core functionality.
• Advertising Cookies: We do not currently use advertising or targeted marketing cookies. If this changes, we will update this policy and provide you with appropriate notice and choices.

8.2 Your Cookie Choices

You can control cookies through your browser settings. Most browsers allow you to block or delete cookies. Please note that disabling strictly necessary cookies may impair the functionality of our Services.

8.3 Global Privacy Control

We honor Global Privacy Control (GPC) signals. When we detect a GPC signal from your browser, we treat it as a valid opt-out request for the sale or sharing of personal information, as applicable under state privacy laws.

9. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

• Right to Know and Access: You may request information about what personal data we have collected about you and obtain a copy of that data.
• Right to Correction: You may request that we correct inaccurate personal information we hold about you.
• Right to Deletion: You may request that we delete your personal information, subject to certain legal exceptions.
• Right to Portability: You may request a copy of your personal information in a portable, commonly used format.
• Right to Opt Out: You may opt out of the sale or sharing of your personal information. As noted above, we do not sell personal information.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

9.1 How to Exercise Your Rights

To exercise any of your privacy rights, please contact us at privacy@kaerwellhealth.com. We will respond to verifiable requests within 45 days. If we need additional time, we will notify you of the extension and the reason for it.

9.2 State-Specific Privacy Rights

California (CCPA/CPRA): California residents have additional rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act, including the right to know what categories of personal information we have collected, the right to request deletion, and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information for cross-context behavioral advertising.

Virginia, Colorado, Connecticut, and Other States: If you reside in a state with comprehensive privacy legislation (such as the Virginia Consumer Data Protection Act, the Colorado Privacy Act, or similar laws), you may have additional rights including the right to access, correct, delete, and obtain a copy of your personal data, as well as the right to opt out of targeted advertising and profiling.

Washington and Nevada: If you reside in Washington or Nevada, you may have specific rights related to health data privacy. We comply with the Washington My Health My Data Act and similar state laws that provide additional protections for health-related information.

10. HIPAA Notice

Kaerwell Health LLC is not a covered entity or business associate under the Health Insurance Portability and Accountability Act (HIPAA). Our Services do not involve the collection, storage, or transmission of protected health information (PHI) as defined by HIPAA. We provide a B2B supplement purchasing and private-label platform for practitioners and do not handle patient medical records or health plan data.

11. Children's Privacy

Our Services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe we have inadvertently collected information from a child, please contact us at privacy@kaerwellhealth.com.

12. Third-Party Links

Our Services may contain links to third-party websites, services, or applications that are not operated by us. This Privacy Policy does not apply to those third-party services. We are not responsible for the privacy practices of any third-party websites or services. We encourage you to review the privacy policies of any third-party services you access through our platform.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at:

Kaerwell Health LLC
7590 Currency Drive
Orlando, FL 32809
privacy@kaerwellhealth.com

14. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the State of Florida, without regard to its conflict of law principles. Any disputes arising under or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts located in the State of Florida.