Insert MD
Insert MD

Privacy Policy & HIPAA Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective Date: July 26, 2026 · Last Updated: July 26, 2026 · Versions: NPP 2026.07.26c / Privacy 2026.07.26c

By using insertmd.com, partner storefronts, or our Services, you acknowledge this Policy. Using the Services is not a condition of agreeing to optional marketing communications.

1. Who We Are

Insert MD (“Insert MD,” “we,” “us,” or “our”) operates a technology and administrative platform that enables wellness partners (such as gyms and clinics) to offer physician-directed wellness and telehealth programs to their members and customers.

Medical care is provided by independent, licensed clinicians in a provider network operated through Ola Digital Health (“Program Clinicians” / “care platform”), and medications (when prescribed) are dispensed by licensed pharmacies — not by Insert MD as a medical practice. Insert MD does not practice medicine and does not control independent clinical judgment.

Insert MD handles protected health information (“PHI”) in accordance with the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and applicable state law. We operate as a technology / business associate–style platform supporting licensed medical providers and maintain appropriate agreements (including with our clinical technology partner) to help safeguard PHI. Your PHI is protected by administrative, technical, and physical safeguards appropriate to our role.

2. Scope of This Policy

This Policy applies to:

  • Website and storefront visitors on insertmd.com and partner-branded store hosts
  • Business clients and partner (affiliate) accounts using our partner or agency dashboards
  • Patients / clients who purchase or receive care through programs powered by our platform

3. Information We Collect

Information you provide

  • Account registration and contact details (name, email, phone, shipping address)
  • Date of birth, sex/gender, and other demographics needed for care coordination
  • Telehealth intake information and treatment preferences — transmitted to the care platform (we do not retain clinical questionnaire answers in our application database)
  • Government-issued ID image when required — transmitted to the care platform for identity verification (we do not archive ID images in our application storage)
  • Billing and payment details processed by our payment processor (we do not store full card numbers)
  • Support requests and partner/business onboarding information

Automatically collected data

You may disable cookies in your browser; some features (including partner attribution) may not work properly. We do not place advertising pixels on pages where you submit clinical intake information.

  • Device type, browser, and IP address
  • Pages visited, clickstream, and basic usage analytics needed to operate and secure the Site
  • Session and attribution cookies (for example, to keep your partner storefront selection)

Data from third parties

We may receive limited information from partners, the care platform, pharmacies, or payment processors as needed to operate orders, status updates, and support — for example, fulfillment status from the care or pharmacy network.

4. How We Use Your Information

  • Provide medical coordination and storefront / checkout services
  • Support licensed healthcare providers in offering treatment via the care platform
  • Process payments and help fulfill pharmacy-related orders
  • Respond to customer service inquiries and improve security and performance
  • Send service-related notices (order confirmations, account, or support) — and marketing only with separate opt-in where required
  • Comply with legal obligations

5. How We May Use and Disclose PHI (HIPAA Notice)

The following categories describe ways PHI may be used or disclosed without a separate written authorization, as permitted by HIPAA. Some activities are performed by Program Clinicians or pharmacies rather than by Insert MD directly.

Treatment

PHI may be used and disclosed to provide, coordinate, or manage your care — including sharing intake information, identity verification materials, and clinical communications with Program Clinicians, consulting providers, pharmacists, pharmacy technicians, and other health care providers involved in your care. You may receive an individual notice and have the opportunity to opt out of any subsidized treatment communications where applicable.

Payment

PHI and related billing information may be used to obtain payment for services, process payments, prevent fraud, handle refunds or chargebacks, and reconcile fees with clinical and pharmacy partners — including prior approval or coverage checks when a health plan is involved. Our programs are typically cash-pay; we do not routinely bill health insurance unless we expressly notify you otherwise.

Healthcare operations

PHI may be used in connection with managing our platform and supporting pharmacy/clinical operations — for example quality assessment and improvement, internal compliance audits, performance evaluations, customer support, training, security monitoring, and general administrative activities — limited to the minimum necessary for the purpose.

Prescription refill reminders, treatment alternatives, or health-related benefits

We or Program Clinicians / pharmacies may use and disclose PHI to contact you about prescription refills, treatment options or alternatives, or health-related benefits or services that may be of interest to you, as permitted by law.

Family members, relatives, or close friends

Unless you object, we (or Program Clinicians / pharmacies, as applicable) may disclose PHI relevant to your treatment or payment to family members, relatives, close personal friends, or others you identify as involved in your care. If you are not present to agree or object, professional judgment may be used to determine whether a limited disclosure is in your best interest.

Business associates and vendors

We may share information with business associates and technology vendors who perform services on our behalf (for example: clinical telehealth platform / Ola Digital Health, cloud infrastructure for limited commercial records, payment processing, authentication), under agreements requiring appropriate safeguards.

Wellness / referral partners (affiliates)

If you purchase through a partner storefront (for example, a gym’s Insert MD link or embedded checkout on their website), that partner may receive limited commercial information about the order — such as your name, product purchased, amount, and order status — so they can support you as a member and track referrals. Partners do not receive your clinical intake answers, ID images, diagnoses, prescriptions, or clinician messages through our partner dashboards.

Other permitted or required uses and disclosures

PHI may also be used or disclosed without authorization when permitted or required by law, including (as applicable): to public health authorities; to health oversight agencies; for judicial or administrative proceedings; to law enforcement in limited circumstances; to coroners, medical examiners, or funeral directors; for organ procurement; for certain research with required approvals; to avert a serious threat to health or safety; for military, national security, or protective services activities as authorized; to correctional institutions if you are in custody; and as necessary to comply with workers’ compensation laws.

6. We Do Not Sell Your Information

We do not sell your personal information. We do not share your personal information with third parties for their own marketing purposes. Optional marketing from Insert MD (if offered) is opt-in and separate from receiving care.

7. SMS / Mobile Messaging

Transactional or support text messages may be sent by Insert MD and/or by the care platform or Program Clinicians regarding your order, intake, appointments, or treatment status. Clinical messaging from clinicians typically originates from the care platform, not from partner dashboards.

  • Mobile numbers and SMS opt-in data are not sold to third parties for their marketing
  • Care/support SMS consent, when collected, is separate from optional promotional SMS
  • Message frequency varies based on your order and care activity; message and data rates may apply
  • You can opt out of Insert MD texts by replying STOP (where that program supports it) or contacting support@insertmd.com; reply HELP for help
  • Consent to SMS is not required to purchase Services, though you may need a phone number for clinical coordination

8. Uses and Disclosures Requiring Your Authorization

Uses and disclosures not described in this Notice — including most marketing uses of PHI and any sale of PHI — will be made only with your written authorization, which you may revoke in writing except to the extent we have already acted in reliance on it.

9. Your Rights Regarding Your PHI

Under HIPAA, you generally have the right to:

  • Access, inspect, and obtain a copy of PHI in a designated record set
  • Request an amendment (correction) of PHI
  • Receive an accounting of certain disclosures
  • Request restrictions on certain uses and disclosures (we are not always required to agree)
  • Request confidential communications by alternative means or locations
  • Receive a paper copy of this Notice upon request
  • Be notified of a breach of unsecured PHI
  • Opt out of Insert MD marketing communications
  • File a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights (hhs.gov/ocr), without retaliation

How clinical records are held

Your clinical chart, clinician communications, and prescription records are maintained primarily on the care platform (Ola Digital Health) and by Program Clinicians / pharmacies. Insert MD retains commercial account and order records needed to operate the storefront, billing, and partner attribution. To exercise access or amendment rights, contact our Privacy Officer; we will coordinate with the care platform as needed.

10. State-Specific Disclosures

If state law gives you greater privacy rights than federal law, we will comply with those enhanced protections where they apply to us.

California (CCPA/CPRA)

California residents may have rights to know what personal information we collect and how it is used, to request deletion (subject to legal exceptions), and to opt out of the “sale” or certain sharing of personal information. We do not sell personal information. Submit requests to privacy@insertmd.com.

Florida and other states

Insert MD’s governing law reference is Florida. We also aim to honor applicable consumer and health privacy rules in states where Services are offered (including, where applicable, laws in states such as New York, Texas, Illinois, Washington, and Colorado). Contact privacy@insertmd.com for state-specific requests.

11. Data Retention

Account and commercial order data on Insert MD is retained while your account is active and as needed to provide Services, meet legal and accounting obligations, and resolve disputes; afterward it is deleted or de-identified when feasible.

Clinical / health records on the care platform are retained according to that platform’s policies and applicable medical record retention laws (often multi-year). Insert MD does not keep a duplicate clinical chart of your intake answers or ID images in our application database.

Usage and analytics data is typically retained for a shorter period (for example, up to 12 months) unless needed longer for security or legal reasons.

12. Security Measures

We implement administrative, technical, and physical safeguards appropriate to our role, including encryption in transit, access controls, and segregation of clinical intake (sent to the care platform) from our commercial databases. No method of transmission or storage is 100% secure. You use the Site at your own risk to that extent.

13. Breach Notification

In the event of a breach of unsecured PHI, we will notify affected individuals without unreasonable delay and no later than 60 days after discovery, as required by the HIPAA Breach Notification Rule and applicable state law.

14. Telehealth-Specific Notes

  • Care may be asynchronous (questionnaire / store-and-forward) or synchronous (video/audio) depending on the program and clinician judgment
  • Clinician messaging and video tools, when used, are provided through the care platform — not as an open chat inside the partner dashboard
  • You are responsible for completing intake accurately and using a reasonably private location and secure device when participating in care

15. Children’s Privacy

Our Services are not intended for children under 18. We do not knowingly collect personal information from anyone under 18 for these programs. If we become aware that a child has submitted personal information, we will delete it from our systems where feasible.

16. Third-Party Links and Integrations

Our Site may link to or integrate with third-party services (for example, payment processors, pharmacies, labs, or analytics). We are not responsible for their privacy practices. Review their policies before sharing information with them directly.

17. Changes to This Notice

We may update this Notice periodically. Updates will be posted on this page with a new effective or last-updated date. We encourage you to review this page regularly. Material changes will be highlighted on this page. The revised Notice may apply to PHI we already hold as well as information we receive in the future, as permitted by law.

18. Contact Us / Privacy Officer

Privacy Officer — Insert MD

Insert MD — Privacy Officer (contact via privacy@insertmd.com)

Privacy email: privacy@insertmd.com

Support email: support@insertmd.com

Website: https://insertmd.com

To exercise rights or file a complaint with us, use the contact information above. You may also complain to the U.S. Department of Health and Human Services, Office for Civil Rights. There will be no retaliation for filing a complaint.

19. Governing Law

This Notice is governed by applicable federal law, including HIPAA, and the laws of the State of Florida, without regard to conflict-of-law rules that would require another jurisdiction’s law.

This document is provided for patients and partners using Insert MD services. It is not legal advice to third parties. Questions: privacy@insertmd.com.