Effective Date: January 1, 2025

Last Updated: January 1, 2025
​

Welcome to Rythm Health (“Rythm,” “we,” “us,” or “our”). We are committed to protecting your privacy. This Privacy Policy (“Policy”) explains how we collect, use, disclose, protect, and retain your personal information (“Personal Information”) when you use:

Important Note (No Medical Advice):

Rythm Health currently provides informational testing only; we do not diagnose, treat, or serve as a substitute for a licensed healthcare professional.

Rythm Health operates across all 50 U.S. states and Washington, D.C. (“U.S.”). If you are using our Services from outside the U.S., your information may be transferred to and processed in the U.S., under U.S. data protection laws, which may differ from those in your home jurisdiction.
​

Our Services are not intended for individuals under 18 years of age. We do not knowingly collect data from minors under 18. If you believe we have inadvertently collected such data, contact us at [email protected] to request deletion.
​

This Policy aims to meet or exceed relevant U.S. privacy requirements (federal and state). If your local or state law imposes stricter obligations, we will do our best to comply. Please reach out with any questions or concerns.

We keep your Personal Information only as long as needed for our legitimate business or legal obligations (e.g., complying with health regulations). We may dispose of or delete data at any time unless otherwise required by law or under a specific agreement.
​

We implement industry-standard safeguards such as encryption (SSL/TLS), secure data centers, firewalls, and role-based access. However, no method of transmission or storage is 100% secure. By using our Services, you acknowledge the inherent risks of online data transmissions.

Our Services are not directed to individuals under 18. We do not knowingly collect or store such data. If you believe we have information about a minor under 18, contact us at [email protected] so we can delete it.

Under the New York SHIELD Act, we implement reasonable administrative, technical, and physical safeguards to protect NY residents’ private information. If a data breach affects unencrypted private information of a New York resident, we will notify affected individuals per New York law.

We use cookies (session and persistent), web beacons, pixels, and similar technologies to store preferences, analyze site traffic, and enable targeted advertising.
​

You can adjust your browser settings to block or alert you about cookies. However, disabling cookies could limit certain features of our Services.
​

Where required by law, we will honor “Do Not Track” (DNT) or Global Privacy Control (GPC) signals. Some tracking may still be necessary to provide core service functionality.
​

We may share user data (e.g., IP addresses, usage patterns) with third-party ad networks for personalized ads. If state law deems that a “sale” or “share,” you can opt out (see Section 11).
​

Third-party vendors may collect Personal Information (such as cookie IDs, IP addresses, browsing behavior) on our websites and apps for analytics and advertising purposes. Some of these disclosures may be considered “sales” or “shares” under state laws, granting you opt-out rights. Please see the “Choice and Control” and “State-Specific Privacy Notices” sections for more details.

Below are examples of third-party partners we use:

These vendors may combine data from multiple sites or apps to improve analytics for their own or other parties’ purposes. For more details about how they collect, use, or share your information, please review their privacy policies directly.

We respect and comply with major U.S. privacy laws, including those in California, Colorado, Connecticut, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Montana, Oregon, Texas, Utah, Virginia, Nevada, Washington, and D.C. Below are highlights:
​

Certain states grant special protections or require opt-in consent for SPI (e.g., Colorado, Virginia). Where applicable, you can request to limit or opt out of such processing.
​

If we deny a rights request (in whole or in part), you may appeal by emailing [email protected] with the subject line “Appeal of Privacy Request.” We will respond within any legally required timeframe. If you remain dissatisfied, you may file a complaint with your state’s attorney general or relevant consumer protection authority.

When you set up an account with Rythm Health, you create a direct customer relationship enabling you to use various aspects of our Services. Personal details you provide (e.g., name, email, address, phone number) are generally notconsidered “protected health information” (“PHI”) or “medical information” unless you submit them for a health or medical purpose governed by HIPAA or other state laws.

Although Rythm Health is not a “covered entity” under the Health Insurance Portability and Accountability Act of 1996 and its regulations (“HIPAA”), some labs, pharmacies, or telehealth partners we work with may be “covered entities” or “business associates.” In certain scenarios, Rythm Health may be deemed a “business associate.” HIPAA does not apply universally to all health data; it applies only to specific covered activities by covered entities or their business associates.

If we are ever deemed a business associate under HIPAA, we will handle “protected health information” in compliance with relevant HIPAA provisions. Additionally, any “medical or health information” subject to specific state protections (collectively, “Protected Information”) will be used or disclosed only as permitted by applicable law.

Note: Protected Information does not include data that has been de-identified in accordance with applicable regulations.
​

Accredited labs, pharmacies, or other healthcare providers you interact with via Rythm Health’s Services may have their own Notice of Privacy Practices describing how they use and disclose PHI. By using our Services with those providers, you acknowledge you have received or been given the opportunity to review their Notice of Privacy Practices.
​

Personal information provided outside of direct diagnostic or treatment contexts (e.g., name or address for shipping a test kit) is typically not Protected Information under HIPAA. Such information is governed by this Policy and applicable state law. Only health data specifically collected or used by a covered entity/business associate for a covered purpose under HIPAA is considered PHI.
​

You may communicate with Rythm Health, labs, or providers via unencrypted email, text (SMS), or other methods that may not be fully HIPAA-compliant. By choosing these channels, you accept the inherent security risks associated with unencrypted communication. If you have concerns, contact [email protected] for alternative options.
​

Rythm Health may retain Protected Information as required to fulfill our Services or comply with legal obligations. Labs, pharmacies, and telehealth providers may also keep your information for legal or business reasons. De-identified data is not subject to HIPAA retention requirements and may be retained or used without additional limitations.

All credit card, debit card, and other monetary transactions on or through the Services occur via an online payment processing application. Our primary third-party online payment processing vendor is Stripe (“Stripe”). Additional information about Stripe’s privacy policy and its information security measures (collectively, the “Stripe Policies”) can be found at:

Reference to the Stripe Policies is for informational purposes only; they are not incorporated into or made part of this Privacy Policy. Rythm Health’s relationship with Stripe is purely contractual, with Stripe acting as a third-party vendor; Stripe is not subject to Rythm Health’s direction or control. Thus, their relationship is not, and should not be construed as, one of fiduciaries, franchisors-franchisees, agents-principals, employers-employees, partners, or joint venturers.

When you conduct transactions (e.g., purchasing test kits or services), you may be asked to provide payment details, billing/shipping addresses, or phone numbers. By submitting this information, you grant Rythm Health the right to share it with payment processors or other necessary third parties (e.g., shipping carriers) to facilitate the transaction. Payment processors maintain their own policies and practices for safeguarding your information.

By accessing or using our Services or communicating with us via emails, text messages, or other electronic methods, you consent to receive communications from us electronically. This includes but is not limited to:

Note: If you choose to send or receive information about your health or any other sensitive information by text message or email, you do so at your own risk, as these channels may not be fully secure. You can opt out of marketing/promotional messages at any time.

We reserve the right to modify this Policy periodically. When we make significant changes, we will:

Your continued use of the Services after the changes become effective indicates your acknowledgment of the updated Policy.

If you have questions, concerns, or wish to exercise any privacy rights, please contact us at:

Thank you for choosing Rythm Health. We remain committed to safeguarding your personal and health information and providing a secure, user-friendly experience.