California Privacy Notice

Last updated: July 28, 2026

This notice supplements our Notice of Privacy Practices and Cookie Policy and applies to California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"). It is provided by UpliftRX LLC, 8 The GRN, STE R, Dover, DE 19901.

Important scope note

Most information we hold about patients is medical information governed by HIPAA and by California's Confidentiality of Medical Information Act (CMIA), and that information is exempt from the CCPA/CPRA. It is protected by those laws instead, and by the commitments in our Notice of Privacy Practices — which in several respects give you more protection than the CCPA does.

This notice therefore covers the limited categories of non-medical personal information we collect: for example, the email address of someone who joins our mailing list without becoming a patient, or the account and billing details we hold outside the clinical record.

Categories of personal information we collect

In the last 12 months we have collected the following categories:

We do not knowingly collect personal information from anyone under 18; our services are for adults only.

Sensitive personal information

Health information you provide as a patient is protected health information under HIPAA and medical information under CMIA, and is outside the scope of the CCPA/CPRA. Apart from account credentials, which we use only to sign you in and secure your account, we do not use or disclose sensitive personal information for any purpose that would give rise to a right to limit its use under Cal. Civ. Code § 1798.121.

We do not sell or share your information

We do not sell personal information, and we do not "share" personal information for cross-context behavioral advertising, as those terms are defined by the CCPA/CPRA. We have not done so in the preceding 12 months, including with respect to consumers we know to be under 16. We do not run third-party advertising or analytics tags on our site at all — see our Cookie Policy.

Who we disclose to, and why

We disclose personal information only to service providers and contractors who perform functions on our behalf under written contracts that prohibit them from using it for their own purposes: application hosting, database and storage, payment processing, shipping, email and SMS delivery, and customer support tooling. We may also disclose information to comply with law, to respond to lawful requests, or in connection with a merger or acquisition, in which case this notice will continue to apply to the information transferred.

How long we keep it

We keep each category only as long as needed for the purpose it was collected for, and then delete it. Account and billing records are retained for the period required by tax and financial regulations. Medical records are retained for the minimum periods required by the law of the state where you received care, which typically exceeds the retention we would otherwise apply.

Your California rights

California residents may exercise the following rights free of charge, generally up to twice in a 12-month period:

• Right to know the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties to whom we disclosed it
• Right to delete personal information we collected from you, subject to legal exceptions — most importantly, medical records carry mandatory retention periods and cannot be deleted on request
• Right to correct inaccurate personal information
• Right to opt out of sale or sharing — we do not sell or share, so there is nothing to opt out of, but we honor Global Privacy Control signals as an opt-out request where applicable
• Right to limit use of sensitive personal information — we do not use sensitive personal information for purposes that trigger this right
• Right to non-discrimination for exercising any of these rights. We will never deny you care, charge you a different price, or provide a lesser level of service because you exercised a privacy right.

Separately, California's "Shine the Light" law (Cal. Civ. Code § 1798.83) allows you to request information about disclosures to third parties for their own direct marketing purposes. We make no such disclosures.

How to exercise your rights

• From your account: Account → Your data
• Email: privacy@upliftrx.co
• Mail: UpliftRX LLC, Attn: Privacy, 8 The GRN, STE R, Dover, DE 19901

We operate exclusively online, so email and the in-account form are our designated request methods. We will confirm receipt within 10 business days and respond within 45 days, extendable once by another 45 days with notice to you.

Verification. To protect your information, we verify your identity by matching the details you give us against our records, and for requests involving specific pieces of information we may ask for additional confirmation. We will not use information you provide for verification for any other purpose.

Authorized agents. An authorized agent may submit a request on your behalf with your signed written permission; we may also ask you to verify your own identity directly and to confirm that you gave the agent permission.

If we deny your request, we will tell you why in writing. You may ask us to reconsider by replying to that response, and you may also file a complaint with the California Privacy Protection Agency or the California Attorney General.

Patients: your rights under HIPAA and CMIA

If you are a patient, your rights of access, amendment, restriction, confidential communication, and accounting of disclosures come from HIPAA and California law, and are described in our Notice of Privacy Practices. Exercise them by messaging your care team or emailing privacy@upliftrx.co.

Contact

UpliftRX LLC · 8 The GRN, STE R, Dover, DE 19901 privacy@upliftrx.co · legal@upliftrx.co