Privacy Policy

1. Overview & scope

Clinzovia (“Everwell,” “we,” “us”) respects your privacy. This Privacy Policy describes how we handle personal information collected through our website, online appointment request forms, email newsletter, and any related pages that link to this policy.

This policy does not apply to your medical record. Health information created or received during your care is protected under the Health Insurance Portability and Accountability Act (“HIPAA”) and is governed by our separate Notice of Privacy Practices, which we provide at your first visit and on request. Where this policy and the Notice conflict regarding protected health information, the Notice controls.

“Personal information” means information that identifies, relates to, or can reasonably be linked to a particular person or household. It does not include aggregated or de-identified information that cannot reasonably be linked back to you.

2. Information we collect

Information you give us

• Contact details: first and last name, email address, phone number, and preferred contact method when you request an appointment or subscribe.
• Request details: the service you are interested in, preferred location, preferred date and time, and a description of what you would like help with.
• Insurance information: plan name and, if you provide it, member ID. Please do not send member IDs through general web forms; we will collect them securely during intake.
• Email preferences: the topics you select, your subscription status, and unsubscribe requests.
• Communications: messages you send us by email, web form, review, or social media, including any attachments.
• Review and testimonial content you choose to submit publicly.

Information collected automatically

When you visit the Site, our hosting provider and analytics tools may record technical information such as your IP address, browser type and version, device type, operating system, referring page, pages viewed, and the date and time of your visit. We configure analytics to avoid collecting full IP addresses where the provider supports it, and we do not use analytics to identify individual visitors.

Information from other sources

If you become a patient, we may receive information from your insurance plan (eligibility and benefits), other treating providers (records you authorize us to request), laboratories, and pharmacies. That information becomes part of your medical record and is governed by our Notice of Privacy Practices.

Categories table

We do not intentionally collect sensitive categories such as precise geolocation, biometric identifiers, government IDs, or financial account numbers through this website. We do not collect information about your sexual orientation, religion, or immigration status unless you volunteer it and it is relevant to your care.

3. How we use information

• Respond to requests: contact you about an appointment, answer questions, and provide the information you asked for.
• Schedule and coordinate care: verify insurance, prepare intake forms, and match you with an appropriate clinician.
• Send email you requested: deliver The Everwell Weekly and the topics you selected, and measure aggregate open and click rates to improve content.
• Operate and improve the Site: diagnose technical problems, understand which pages are useful, and test clarity of content.
• Maintain safety and security: detect fraud, prevent abuse of our forms, and protect the rights of patients and staff.
• Comply with law: meet recordkeeping, reporting, and public-health obligations that apply to healthcare providers.
• Communicate service changes: notify you about material changes to this policy, our Terms, or clinic operations.

We do not use your information to make automated decisions that produce legal or similarly significant effects, and we do not use website form data to train third-party advertising profiles.

4. Legal bases & HIPAA

For website visitors, we process personal information on the basis of your consent (for the newsletter), our legitimate interest in operating and improving the Site, and our need to take steps at your request before entering into a care relationship (for appointment requests). For patients, treatment, payment, and healthcare operations are carried out under HIPAA and applicable state law.

If you are a patient, your HIPAA rights — including the right to access your record, request an amendment, request an accounting of disclosures, and request confidential communications — are described in our Notice of Privacy Practices. You may request a copy at any time by emailing privacy@clinzovia.com.

5. Cookies & tracking

We keep tracking minimal on purpose.

• Strictly necessary: cookies or local storage needed to keep the site functioning, remember form state, and protect against abuse. These cannot be turned off without breaking functionality.
• Preferences: local storage that remembers your newsletter email address so the unsubscribe page can prefill it. You can clear this in your browser settings.
• Analytics: aggregate, privacy-configured analytics that tells us which pages are visited and how the site performs. We do not use analytics to build advertising profiles.
• Advertising: we do not use advertising cookies, retargeting pixels, or third-party ad networks on patient-facing pages.

Most browsers let you block or delete cookies. Blocking strictly necessary cookies may prevent forms from working correctly. Our demonstration site does not set third-party cookies at all.

6. Email marketing & your choices

We send marketing email only when you ask us to. Every marketing email includes a one-click unsubscribe link and a link to manage preferences. You can also use our unsubscribe page. We honor unsubscribe requests immediately and maintain a minimal suppression list so that you are not inadvertently re-added.

Unsubscribing from marketing does not stop transactional messages related to your care, such as appointment confirmations, reminders, lab results, prescription notices, and billing statements. See what changes after you unsubscribe.

We do not sell, rent, or trade email addresses, and we do not add people to our list from purchased databases or third-party lists.

7. How we share information

We do not sell your personal information. We do not share it for cross-context behavioral advertising. We share information only in these circumstances:

• Service providers: vendors who host the Site, deliver email, process payments, or provide analytics, under contracts that limit their use of the information to the service they provide.
• Healthcare operations: laboratories, pharmacies, imaging centers, and referring clinicians involved in your care, as permitted by HIPAA.
• Insurance plans: as necessary to verify benefits and process claims.
• Legal requirements: when we are required to do so by law, subpoena, or court order, or when necessary to report suspected abuse or respond to a serious threat to health or safety.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this policy and applicable law. Medical records may not be transferred without the protections required by HIPAA.
• With your permission: for any other purpose you specifically authorize in writing.

Vendors with access to patient information must sign a HIPAA business associate agreement. Website vendors never receive your medical record.

8. How we protect information

We use administrative, technical, and physical safeguards designed to protect personal information, including:

• Encryption in transit (TLS) for all pages and forms on the Site
• Role-based access controls, so staff see only the information needed for their job
• Multi-factor authentication for administrative and clinical systems
• Audit logging of record access and regular review of access patterns
• Annual workforce privacy and security training
• Vendor risk reviews before onboarding any system that handles patient data
• Documented incident response procedures, including notification within required timeframes

No system is completely secure. If we experience a breach affecting your information, we will notify you and the appropriate authorities as required by applicable law. You can help by using a unique password, not sharing your portal credentials, and telling us immediately if you suspect unauthorized access.

9. Data retention

When retention periods end, we securely delete or de-identify information, unless a legal hold, open investigation, or ongoing care relationship requires us to keep it longer.

10. Your privacy rights

Depending on where you live, you may have some or all of the following rights. We honor these requests regardless of state when we reasonably can, because they are good practice.

• Right to know and access: request a copy of the personal information we hold about you and how we use it.
• Right to correct: request correction of inaccurate personal information.
• Right to delete: request deletion of your personal information, subject to legal retention obligations.
• Right to opt out of sale or sharing: we do not sell personal information or share it for cross-context behavioral advertising, so there is nothing to opt out of — but you may still submit a request and we will confirm.
• Right to limit use of sensitive personal information: applicable to sensitive data we collect; we use it only to provide services you request.
• Right to portability: receive your information in a portable, readily usable format where technically feasible.
• Right to non-discrimination: we will not deny care or charge different prices because you exercised a privacy right.
• Right to appeal: if we deny a request, you may appeal by replying to our decision, and we will review it with a senior privacy officer.

State-specific notices

• California (CCPA/CPRA): California residents may request access, correction, deletion, and information about categories of personal information collected. We do not sell or share personal information as those terms are defined under the CPRA, and we do not knowingly collect personal information of consumers under 16 for sale or sharing.
• Colorado (CPA): Colorado residents may request access, correction, deletion, and portability, and may appeal a denied request.
• Texas (TDPSA): Texas residents may request access, correction, deletion, and portability, and may opt out of targeted advertising and sales. We do not conduct targeted advertising or sell personal data.
• Other states: residents of Virginia, Connecticut, Utah, Oregon, Montana, and other states with comprehensive privacy laws have comparable rights under their respective statutes.
• HIPAA: for medical records, HIPAA provides separate rights described in our Notice of Privacy Practices.

11. How to exercise your rights

Submit a request by emailing privacy@clinzovia.com or calling 858-450-1903 and asking for the Privacy Officer. You can also write to us at Clinzovia, Attn: Privacy Officer, 1041 Hamill Avenue San Diego, CA 92123.

• We will acknowledge your request within 10 business days and respond substantively within 45 days, with a possible 45-day extension where permitted by law.
• We must verify your identity before fulfilling a request. For website data, we typically verify by confirming control of the email address. For medical records, we follow HIPAA verification requirements.
• You may use an authorized agent to submit a request, with written permission and identity verification.
• There is no fee for responding to a request unless it is manifestly unfounded, excessive, or repetitive, in which case we will explain the cost before proceeding.

12. Children's privacy

The Site is not directed to children under 13, and we do not knowingly collect personal information from children under 13 through the Site. If a child under 13 has submitted information, a parent or guardian should contact us and we will delete it promptly.

Patients aged 13–17 may be registered by a parent or legal guardian, subject to state law and our minor consent policy. Certain services related to sexual health, mental health, and substance use may be available to minors confidentially where state law allows. Where state law gives minors the right to consent to their own care, the parent or guardian's access to those records may be limited accordingly.

13. Do Not Track & global controls

Browsers may send “Do Not Track” (DNT) signals. Because there is no common industry standard for interpreting DNT, we do not change our behavior in response to DNT headers — but in practice, we do not run cross-site tracking on this Site, so there is little to opt out of. We honor Global Privacy Control (GPC) signals where required by applicable state law.

You can also restrict tracking by blocking third-party cookies, using a privacy-focused browser, or enabling tracker-blocking extensions. Our pages should function normally with these tools enabled.

14. International visitors

Everwell is located in the United States, and the Site is intended for visitors in the United States. Information is processed in the United States under U.S. law. If you access the Site from outside the United States, you do so on your own initiative and are responsible for compliance with your local laws. We do not offer services outside the United States, and our clinicians are licensed only in specific U.S. states.

15. Third-party links

The Site may link to external websites, including research articles, mapping services, and health organizations. We do not control those sites and are not responsible for their content or privacy practices. This policy applies only to information collected through our Site. We encourage you to read the privacy policy of any website you visit.

16. Changes to this policy

We may update this policy to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will post the revised policy with a new effective date and, for patients, provide notice by email or portal message. Where required by law, we will obtain your consent before applying material changes to previously collected information.

If you would like a copy of a previous version, contact our privacy team.

17. Contact our privacy team

Questions, concerns, or requests about privacy can go directly to our Privacy Officer. We read every message.

• Privacy Officer: privacy@clinzovia.com
• Phone: 858-450-1903, ask for the Privacy Officer
• Mail: Clinzovia, Attn: Privacy Officer, 1041 Hamill Avenue San Diego, CA 92123
• Records requests: records@clinzovia.com

If you are not satisfied with our response, you may file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights, your state attorney general, or your state privacy regulator. We will not retaliate against you for filing a complaint.