Privacy Policy

1. Introduction

Kiln Health, LLC ("Kiln Health," "we," "our," or "us") operates an online telehealth platform that connects patients with licensed physicians and delivers compounded hormone and peptide therapies through an independent partner 503A pharmacy. We understand that your health information is among the most sensitive data you share with anyone, and we take our responsibility to protect it seriously.

This Privacy Policy explains what information we collect when you use kiln.health and our related services, how we use and protect that information, and what rights you have regarding your data. By accessing or using our services, you agree to the practices described in this policy. If you do not agree, please do not use our platform.

2. Information We Collect

We collect several categories of information to provide personalized, physician-guided care.

Health & Medical Information

When you complete our intake assessment or consult with a provider, we collect information about your symptoms, medical history, current medications, prior hormone therapy, lifestyle factors, and any other health details you voluntarily share. This category constitutes Protected Health Information (PHI) under HIPAA and is handled with the highest level of care.

Contact & Identity Information

We collect your first and last name, email address, phone number, date of birth, and state of residence. This information is used to create and manage your account, verify your identity, and comply with state telehealth licensing requirements.

Lab Results & Diagnostic Data

Where applicable, we receive laboratory results from our partner diagnostic labs on your behalf. These results are stored securely in your patient record and made available to your treating provider to inform prescribing decisions.

Usage & Technical Data

We automatically collect certain technical information when you visit our website, including your IP address, browser type, device type, pages visited, and time spent on those pages. This data is used in aggregate form to improve the performance and usability of our platform and does not identify you personally.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Treatment Delivery: To evaluate your eligibility for care, match you with a licensed provider, and facilitate the prescribing and dispensing of any approved therapies.
• Provider Communication: To enable secure messaging between you and your care team, including clinical reviews, lab result reviews, and dosage adjustments.
• Billing & Payments: To process subscription fees, one-time charges, and any applicable refunds. Payment card data is handled by our PCI-DSS compliant payment processor and is never stored on our servers.
• Regulatory Compliance: To fulfill our obligations under HIPAA, state medical board rules, pharmacy regulations, and DEA requirements governing controlled substances.
• Platform Improvement: To analyze aggregate, de-identified usage patterns and improve the quality, accessibility, and safety of our services.
• Communications: To send you appointment reminders, shipping notifications, and important updates about your care. You may opt out of non-essential communications at any time.

4. HIPAA Notice of Privacy Practices

Kiln Health, LLC and its affiliated medical practice are Covered Entities under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Your Protected Health Information (PHI) is subject to the HIPAA Privacy Rule and Security Rule, which set strict standards for how we may use and disclose your health data.

We use and disclose PHI only as permitted or required by HIPAA, primarily for treatment, payment, and healthcare operations. We will never sell your PHI to any third party, and we will not use it for marketing without your explicit written authorization.

As a patient, you have specific rights under HIPAA including the right to access your medical records, request corrections, receive an accounting of disclosures, and request restrictions on certain uses of your information. A complete HIPAA Notice of Privacy Practices is available upon request by contacting privacy@kiln.health.

5. Sharing of Information

We do not sell, rent, or trade your personal or health information to any third party, ever. We share your information only in the following limited circumstances:

• Our Partner Pharmacy: When a prescription is issued, your name, shipping address, prescription details, and relevant health information are transmitted to our independent partner pharmacy to fulfill and ship your medication.
• Diagnostic Laboratories: When lab work is ordered by your provider, your identifying information and the requisition order are shared with our partner labs solely to complete testing.
• Treating Providers: Licensed physicians and nurse practitioners in our provider network access your health record strictly for the purpose of evaluating and managing your care.
• Business Associates: We share data with third-party service providers (such as our electronic health record system, cloud hosting, and payment processor) under HIPAA-compliant Business Associate Agreements (BAAs) that contractually prohibit them from using your data for any other purpose.
• Legal Requirements: We may disclose information when required by law, court order, or to cooperate with a regulatory investigation, to the extent permitted under HIPAA.

6. Data Security

We implement administrative, physical, and technical safeguards designed to protect your information from unauthorized access, use, alteration, or destruction.

• All data in transit is encrypted using TLS 1.2 or higher. All data at rest is encrypted using AES-256 encryption.
• Patient health records are stored in a HIPAA-compliant cloud environment with signed Business Associate Agreements in place with all infrastructure vendors.
• Access to PHI is restricted to employees and contractors with a legitimate need to know, and all staff with PHI access complete annual HIPAA training.
• We conduct regular security risk assessments and vulnerability testing to identify and remediate potential weaknesses in our systems.
• In the event of a data breach affecting your PHI, we will notify you in accordance with the HIPAA Breach Notification Rule.

7. Your Rights

You have the following rights with respect to your personal and health information:

• Right to Access: You may request a copy of the personal information and health records we hold about you.
• Right to Correction: If any information we hold is inaccurate or incomplete, you may request that we correct or update it.
• Right to Deletion: You may request that we delete your personal information. Note that we are required to retain certain medical records for the period mandated by applicable state law (typically a minimum of seven years), and deletion requests for PHI within that retention period may be declined where prohibited.
• Right to Restrict Processing: You may request that we limit how we use your information in certain circumstances.
• Right to an Accounting: You may request a log of disclosures of your PHI that we have made outside of treatment, payment, and healthcare operations.

To exercise any of these rights, please contact us at privacy@kiln.health. We will respond to all verified requests within 30 days.

8. Cookies & Analytics

We use a minimal set of cookies and analytics tools to understand how visitors interact with our website and to keep the platform functioning correctly.

• Essential Cookies: Required for the site to function, including session management and security tokens. These cannot be disabled.
• Analytics: We use privacy-respecting, aggregate analytics to measure page traffic and identify usability improvements. Individual users are not tracked across sessions for advertising purposes.
• No Advertising Cookies: We do not deploy third-party advertising pixels, retargeting trackers, or social media cookies on any page of our platform. Your browsing behavior on our site is never shared with ad networks.

You can control non-essential cookies through your browser settings. Disabling cookies may affect certain features of the platform.

9. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the way we handle your information, please reach out to our Privacy Officer:

We reserve the right to update this Privacy Policy from time to time. When we make material changes, we will update the effective date at the top of this page and, where required by law, notify you by email or through a prominent notice on our platform. Your continued use of our services after any update constitutes acceptance of the revised policy.