Privacy Policy | EvokeMD

This Privacy Policy describes how EvokeMD ("EvokeMD," "we," "us," "our") collects, uses and protects information you provide when using our website and telehealth services ("Services"). By using the Services, you agree to the practices described here. For our full HIPAA Notice of Privacy Practices, which covers how we handle your Protected Health Information (PHI), see our HIPAA Notice.

1. Who we are

EvokeMD. Contact: our Contact page or email support@evokemd.com.

2. Information we collect

Information you provide:

Name, email address, phone number and date of birth
Mailing address (for medication shipments)
Health history, current medications, allergies and health goals provided in your intake form
Consultation notes and communications with affiliated Providers
Payment information processed by the payment provider selected for the Services

Information collected automatically:

IP address, browser type and device information
Pages visited and time spent on the site
Referring URLs
Cookies and similar tracking technologies (see Section 7)

3. How we use your information

We use your information to:

Facilitate your intake, Provider consultation and treatment workflow
Process program enrollment and recurring billing
Communicate with you about your account, orders and care coordination
Send appointment reminders, health updates and program-related messages
Improve our platform, services and patient experience
Comply with legal obligations and respond to regulatory inquiries
Prevent fraud and protect the security of our platform

4. Health information and HIPAA

EvokeMD and the licensed providers involved in your care handle Protected Health Information (PHI) in accordance with applicable privacy requirements. Your health information may be:

Shared with affiliated licensed Providers only as necessary to deliver your care
Stored and transmitted using safeguards appropriate to the information and applicable law
Accessible to service providers only as needed to support the Services and subject to applicable agreements

For your full rights as a patient, including the right to access, amend or restrict use of your PHI, see our HIPAA Notice of Privacy Practices.

5. Third-party service providers

We share your information with the following third parties who assist in operating our services:

Payment processor: Payment processing. Data shared: name, email, billing address, payment method.
Rx Ave Health: Medication fulfillment. Data shared: name, address, prescription details.

Service providers that handle PHI are required to protect it as required by applicable law and contract. We do not sell personal information for monetary consideration.

6. SMS and email communications

By providing your phone number and checking the SMS consent box during enrollment, you consent to receive text messages from EvokeMD related to your account, appointments, health updates and membership.

To opt out of SMS: reply STOP to any message. Standard message and data rates may apply.

To opt out of marketing emails: click "Unsubscribe" in any marketing email. Transactional messages (billing, appointment confirmations) may still be sent as necessary to manage your account.

7. Cookies and analytics

We use cookies and similar technologies to:

Keep you logged in to your account
Understand how patients use our site (via analytics tools)
Improve site performance and personalization

You can disable cookies in your browser settings, though some features may not function properly.

8. Your rights

You have the right to:

Access the personal information we hold about you
Correct inaccurate information
Request deletion of your personal data (subject to legal retention requirements)
Opt out of SMS and marketing email communications
Receive a copy of your data in a portable format upon request

To exercise any of these rights, contact us through our Contact page. We will respond within 30 days.

9. Data security

We use administrative, physical and technical safeguards designed to protect personal information, which may include:

Protected transmission of sensitive information
Restricted storage and handling of health and payment information
Access controls limiting data access to authorized personnel
Regular security reviews and vendor assessments

No system is 100% secure. If you believe your account has been compromised, contact us immediately through our Contact page.

10. Data retention

Records are retained for 7 years. Protected health information is securely destroyed after the retention period. Payment records are retained as required by applicable financial regulations.

11. Children

Our Services are not directed at anyone under the age of 18. We do not knowingly collect personal information from minors. If we learn that a minor has submitted information, we will delete it promptly.

12. Data breach notification

In the event of a security breach involving your personal information or PHI, we will notify affected individuals without unreasonable delay and in accordance with applicable federal and state breach notification laws, including HIPAA's Breach Notification Rule.

13. Governing law and dispute resolution

This Privacy Policy is governed by the laws of the state in which EvokeMD is legally established. Any dispute arising out of or relating to this policy shall be resolved by binding arbitration under the American Arbitration Association's Consumer Arbitration Rules. You waive your right to participate in class action litigation.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date. If changes are material, we will notify you by email. Continued use of the Services after changes take effect constitutes your acceptance of the revised policy.

15. Contact