Privacy policy

Fonde LLC (“Fonde”, “we”, “us” or “our”) runs the website at fonde.com, the online health assessment at intake.fonde.com and the patient portal at portal.fonde.com. Together with any products or services we offer through them, these make up the “Service”.

This privacy policy explains what personal information we collect, how we use it, who we share it with and the choices you have. Capitalized terms we don’t define here have the meaning given in our terms of service.

By using the Service, you acknowledge this policy. If you use the Service on someone else’s behalf, you confirm that you’re authorized to do so and that they acknowledge this policy too.

The short version

• We don’t use advertising pixels or sell your personal information. The only analytics we use is Vercel Web Analytics, which doesn’t use cookies.
• Your health information is used to provide your care: your clinician reviews it to decide whether treatment is right for you, and the pharmacy uses it to fill any prescription.
• You can ask to see, correct or delete your information at any time.

Fonde, your clinicians and HIPAA

Fonde is not a healthcare provider. Clinical care is provided by independent licensed clinicians (the “Clinicians”), and prescriptions are filled by licensed pharmacies: Strive Pharmacy, Rush Pharmacy and Boudreaux’s New Drug Store (the “Pharmacies”). See our terms of service for more about how these relationships work.

The Clinicians and the Pharmacies are “covered entities” under the Health Insurance Portability and Accountability Act of 1996 and its regulations (“HIPAA”). Where we handle health information on their behalf, we do so as their “business associate” and only as HIPAA and our agreements with them allow. Health information that HIPAA protects (“protected health information”) is governed by the notices of privacy practices that the Clinicians and the Pharmacies give you, not by this policy.

Some information you give us, such as your name and email address when you create an account, may not be protected health information. We still treat any information that relates to your health, including the fact that you’re interested in or using a weight-loss treatment, as sensitive, and we handle it as this policy describes. Some state laws, such as Washington’s My Health My Data Act, give that information additional protection. See Consumer health data below.

Information we collect

What we collect depends on how you use the Service.

Information you give us

• Contact details, such as your name, email address, phone number and shipping and billing addresses.
• Account details, such as your login credentials.
• Demographic details, such as your date of birth and sex.
• Health information, such as your answers to the health assessment, your height and weight, medical history, medications, allergies, photos or documents you upload, and messages with your clinician or care team.
• Identity verification, such as a photo of a government-issued ID, where the Clinicians or the Pharmacies need it to verify who you are before prescribing or dispensing.
• Payment details, such as your card number and billing address. These are collected and processed by a third-party payment processor. We don’t store full card numbers.
• Communications, such as emails and messages you send to us or our support team.

Information we collect automatically

• Website analytics. We use Vercel Web Analytics to understand how many people visit our pages and which pages they view. It doesn’t use cookies. It records aggregated information such as the page visited, the referring website, and your browser, operating system, device type and country.
• Marketing parameters. If you arrive at our website from a link that includes campaign parameters (such as utm_source) or an ad click identifier (such as gclid or fbclid), our website may include those parameters in links to the health assessment, and our website analytics may record them. We never add personal or health information to a URL.
• Technical information. Like most online services, our servers log technical details such as your IP address, browser type and the time of your request, to keep the Service running and secure.
• Essential cookies. The health assessment and patient portal use cookies or similar storage that are strictly necessary to keep you signed in, remember your progress and protect against fraud.

Information from others

• The Clinicians and the Pharmacies, such as your prescription, dose, treatment plan and shipping status.
• Service providers, such as our payment processor (for example, to confirm a payment) and identity verification provider.
• Shipping carriers, such as delivery confirmation.

How we use information

We use personal information to:

• Provide the Service: create and run your account, pass your health assessment to a Clinician, let you message your care team, arrange for the Pharmacies to fill and ship any prescription, and manage your plan.
• Process payments: bill you for your plan, process refunds and prevent payment fraud.
• Communicate with you: send order and shipping updates, reminders, account and security notices, and replies to your questions. With your consent, we may also send you marketing emails or texts, which you can turn off at any time.
• Keep the Service safe: verify identity, detect and prevent fraud and abuse, and secure our systems.
• Improve the Service: understand how people use our website and assessment so we can make them clearer and easier to use, mostly using aggregated or de-identified information.
• Meet legal obligations: comply with laws, regulations and legal process, keep required records, and establish, exercise or defend legal claims.

We don’t use advertising pixels, and we don’t use your health information for advertising.

We don’t use your health information to make decisions about you other than those needed to provide the Service. Decisions about your treatment are made by your clinician, not by automated systems.

We may use artificial intelligence tools to help our support team respond to messages more efficiently. A person reviews any message drafted this way before it’s sent, and AI is never used to make clinical decisions. We’ll tell you if you’re talking directly to an automated assistant.

We may create de-identified information, which can’t reasonably be linked back to you, and use it for any lawful purpose. We won’t try to re-identify it.

How we share information

We share personal information only as described here.

• Clinicians, so they can review your assessment, provide care and communicate with you.
• The Pharmacies, so they can fill, ship and support your prescription.
• Service providers that work on our behalf under contracts that limit how they can use your information. These include providers of hosting, payments, identity verification, customer support, email and text messaging, and shipping. Service providers that handle protected health information sign business associate agreements.
• Legal and safety reasons, when we believe in good faith that sharing is needed to comply with the law or legal process, protect the safety of you or others, investigate fraud, or protect our rights and property.
• Business transfers, if we’re involved in a merger, acquisition, financing, reorganization, bankruptcy or sale of assets, subject to the same protections described in this policy.
• With your consent or at your direction.

We don’t sell your personal information to data brokers, and we don’t share your answers to the health assessment, your messages or your prescription details for advertising.

Your choices and rights

Accessing, correcting and deleting your information

You can ask us to:

• tell you what personal information we have about you and how we use and share it;
• give you a copy of it;
• correct information that’s inaccurate;
• delete it.

Email us at privacy@fonde.com. We’ll need to verify your identity, usually by asking you to send the request from the email address on your account. You can also ask someone to make a request for you, and we’ll ask them for proof that you’ve authorized them.

Some information we can’t delete. For example, the Clinicians and the Pharmacies must keep medical and prescription records for periods set by law, and we must keep some payment and tax records. To request access to or changes to your medical record, contact the Clinician or Pharmacy that holds it, as described in their notice of privacy practices.

If we decline your request, we’ll explain why. Depending on where you live, you can appeal by replying to our decision. If we deny your appeal, we’ll tell you how to contact your state attorney general.

We won’t treat you differently for exercising your privacy rights.

Marketing messages

You can stop marketing emails by clicking “unsubscribe” in any of them, and stop marketing texts by replying STOP. We’ll still send messages about your account, orders and care.

Browser controls

Our website doesn’t respond to “Do Not Track” signals, because there’s no common standard for them. You can also use your browser settings to block or delete cookies, although the health assessment and patient portal may not work without essential cookies.

Consumer health data

Some states, including Washington, Nevada and Connecticut, have laws that protect “consumer health data”, which includes information that identifies your past, present or future physical health, such as your interest in weight-loss treatment. This section is our consumer health data privacy policy for those laws.

• What we collect: the health information listed in Information we collect, including your health assessment answers, uploads, messages and prescription details. We may also infer that you’re interested in weight-loss treatment from your use of the Service.
• Where it comes from: from you, from the Clinicians and the Pharmacies, and from our service providers, as described above.
• Why we collect and use it: to provide the Service you’ve asked for, as described in How we use information. We collect and use consumer health data only as necessary to provide the Service you request, or with your consent.
• Who we share it with: the Clinicians, the Pharmacies and our service providers (processors), as described in How we share information. We don’t sell consumer health data or share it for advertising.
• Your rights: you can confirm whether we collect, share or sell your consumer health data, get a list of the third parties and affiliates we’ve shared it with, access it, ask us to delete it and withdraw your consent. Email privacy@fonde.com to exercise these rights.

We don’t use geofencing around healthcare facilities to identify or track people or to send them messages.

How long we keep information

We keep personal information for as long as we need it to provide the Service, meet legal and regulatory requirements (including medical and pharmacy record retention laws), resolve disputes and enforce our agreements. How long that is depends on the type of information and why we have it. When we no longer need it, we delete it or de-identify it.

How we protect information

We use administrative, technical and physical safeguards designed to protect personal information, including encryption in transit and access controls that limit who can see health information. No system is completely secure, so we can’t guarantee the security of your information.

Keep your login details private and use a password you don’t use anywhere else. If you think your account has been compromised, contact us right away.

Children

The Service is only for adults aged 18 or older. We don’t knowingly collect personal information from anyone under 18. If we learn that we have, we’ll delete it.

Where the Service is available

The Service is offered only in the United States, and your information is stored and processed in the United States.

California privacy rights

If you live in California, the California Consumer Privacy Act (“CCPA”) gives you specific rights over your personal information.

• Categories we collect: identifiers (such as name, email address, IP address), customer records (such as address and payment information), characteristics of protected classifications (such as age and sex), commercial information (such as plans purchased), internet activity (such as pages viewed on our website), and sensitive personal information (such as health information, account login credentials and government ID). We collect these from the sources and for the purposes described in this policy, and share them only with the categories of recipients described in How we share information.
• Sale and sharing: we don’t sell or share personal information for cross-context behavioral advertising, and we don’t knowingly sell or share the personal information of anyone under 16.
• Sensitive personal information: we use the health information you give us in the assessment, your messages and your prescription only to provide the Service you’ve requested and for other purposes the CCPA allows.
• Your rights: you can ask to know, access, correct or delete your personal information, as described in Your choices and rights. We won’t discriminate against you for using these rights.

Medical information governed by HIPAA or California’s Confidentiality of Medical Information Act is covered by the Clinicians’ and Pharmacies’ notices of privacy practices rather than this section.

California’s “Shine the Light” law lets California customers ask whether we’ve shared personal information with third parties for their own direct marketing. We don’t.

Other state privacy rights

Residents of other states, including Colorado, Connecticut, Oregon, Texas, Virginia and others with comprehensive privacy laws, may have similar rights to access, correct, delete and get a copy of their personal information, and to opt out of sale, targeted advertising and profiling. We don’t sell personal information or use it for targeted advertising. We don’t use personal information for profiling that produces legal or similarly significant effects. To exercise any of these rights, email privacy@fonde.com.

Links to other websites

The Service may link to websites run by others, such as a payment processor or shipping carrier. Their privacy practices are their own, so read their privacy policies.

Changes to this policy

We may update this policy from time to time. When we do, we’ll change the “Last updated” date at the top. If we make a material change, such as using your information in a new way, we’ll tell you by email or through the Service before it takes effect and get your consent where the law requires it.

Contact us

If you have questions about this policy or how we handle your information, contact our privacy team:

• Email: privacy@fonde.com
• Mail: Fonde LLC, Attn: Privacy, 971 S University Ave #1066, Provo, UT 84601