Privacy Policy

Lyla Health (“Lyla Health,” “we,” “us,” or “our”) provides AI-guided virtual care, including virtual primary care, urgent care, mental and behavioral health, women’s health, men’s health, weight management, sexual health, and prescription-related services. This Privacy Policy explains how we handle information collected through our website, mobile and web applications, patient accounts, and related digital products and services (collectively, the “Services”).

This Privacy Policy applies to personal information we collect as a business operating a website and digital products. It does not replace any separate notice that may apply to protected health information created or received in connection with clinical care.

By using the Services, you acknowledge that you have read this Privacy Policy. Where required by applicable law, we will obtain your consent before engaging in certain processing activities.

The information we collect depends on how you interact with Lyla Health. We may collect the following categories:

Information you provide

• Account information — name, date of birth, email address, phone number, mailing address, password, and state of residence used to create and maintain a patient account.
• Identity verification — information used to confirm your identity or eligibility for care, which may include a government-issued identification document where required by law or clinical policy.
• Health information — symptoms, medical history, medications, allergies, lab or diagnostic information, visit notes, treatment plans, and other clinical information you or your healthcare provider records in connection with a visit.
• Insurance and billing information — insurance carrier, member and group identifiers, coverage details, and payment information processed by our payment processors.
• Communications — messages you exchange with our care team, support team, or AI assistant, along with appointment requests, feedback, and survey responses.

Information collected automatically

• Device and browser information, including device type, operating system, browser type, and language settings.
• Usage information, such as pages viewed, features used, referring pages, and dates and times of access.
• Approximate location derived from IP address, and state of residence where required to determine clinician licensure.
• Cookies, pixels, SDKs, and similar technologies as described in the Cookies section below.

Information from other sources

• Healthcare providers, pharmacies, laboratories, and health plans involved in your care or coverage, where permitted by law and with your authorization when required.
• Service providers that support identity verification, fraud prevention, payments, and analytics.
• A parent, guardian, caregiver, or authorized representative acting on your behalf, where permitted.

[Company-specific data sources and vendor categories to be confirmed prior to publication.]

We use information for the purposes described below:

1. To provide, coordinate, and support virtual care, including scheduling visits, connecting you with licensed clinicians, and supporting prescription-related services where clinically appropriate.
2. To create and manage your patient account and authenticate you when you sign in.
3. To communicate with you about visits, care instructions, follow-ups, refills, technical notices, and changes to the Services.
4. To process payments, submit or support insurance claims, and administer billing and refunds.
5. To operate, maintain, secure, troubleshoot, and improve our website, applications, and other digital products.
6. To provide AI-guided navigation features that help you identify potentially appropriate care options. AI guidance is informational and does not replace professional medical advice.
7. To conduct analytics and quality improvement activities, using de-identified or aggregated information where practicable.
8. To detect, investigate, and help prevent fraud, abuse, security incidents, and other unlawful activity.
9. To comply with legal, regulatory, licensing, accreditation, and professional obligations, and to establish, exercise, or defend legal claims.
10. For marketing and promotional communications where permitted by law and, where required, only with your consent. You may opt out at any time.

Where information constitutes PHI, we use it only as permitted by HIPAA and other applicable law, including for treatment, payment, and health care operations, or as otherwise authorized by you.

We do not sell protected health information. We may share information in the following circumstances:

• Healthcare providers — with licensed clinicians, professional entities, and care teams involved in your treatment.
• Pharmacies and laboratories — to fulfill prescriptions, orders, or diagnostic services associated with your care.
• Health plans and payors — for eligibility verification, claims submission, coordination of benefits, and payment activities.
• Service providers — including cloud infrastructure providers, communications and telehealth platform vendors, payment processors, analytics providers, and customer support tools that process information on our behalf under contract. Where a vendor handles PHI, we seek to enter into a business associate agreement as required by HIPAA.
• Legal and regulatory — in response to a subpoena, court order, or other lawful request, or where disclosure is required or permitted by law, including public health and safety disclosures.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to applicable law and any continuing privacy obligations.
• With your direction — to family members, caregivers, or other third parties you authorize.

We and our service providers may use cookies, pixels, local storage, and similar technologies on our website and digital products. These technologies support the following purposes:

• Strictly necessary functions, such as authentication, session management, load balancing, and security.
• Preference and functionality, such as remembering language or display settings.
• Analytics and performance, such as measuring page usage and diagnosing errors.
• Marketing and measurement on non-clinical pages, where permitted and where applicable consent has been obtained.

Most browsers let you refuse or delete cookies through browser settings. Blocking strictly necessary cookies may prevent parts of the Services from functioning. We respond to Global Privacy Control (GPC) or other opt-out preference signals where required by applicable law.

Some information you provide to Lyla Health may be protected health information (PHI) governed by the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (HIPAA), together with applicable state health privacy laws.

Information you submit through non-clinical parts of the website — such as general marketing pages, newsletter signups, or general inquiries — is generally not PHI and is handled under this Privacy Policy and applicable consumer privacy laws.

Nothing in this Privacy Policy is intended to describe legal status, certifications, or audit outcomes. Statements about specific HIPAA roles and obligations require confirmation by qualified counsel.

Depending on your state of residence and the law that applies to a specific category of information, you may have some or all of the rights below. Not every right applies to every individual or to every type of information, and certain rights may be limited where information is governed by HIPAA or must be retained under medical recordkeeping laws.

How to submit a request

You may submit a request using the contact details in the Contact Us section. We will verify your identity before responding, and we may ask for additional information to do so. An authorized agent may submit a request on your behalf where permitted, subject to verification. We respond within the timeframes required by applicable law.

We maintain administrative, technical, and physical safeguards designed to protect information against unauthorized access, use, alteration, and destruction. These measures may include access controls, encryption in transit, logging, and vendor due diligence. [Specific security controls, encryption standards, and assessment practices to be confirmed prior to publication.]

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying us promptly if you believe your account has been compromised.

We retain information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Retention periods depend on the type of information and the applicable requirement, including:

• Medical record retention periods required by state law and professional standards.
• Billing, insurance, tax, and accounting requirements.
• Security, fraud prevention, dispute resolution, and legal-hold obligations.
• Account and website usage data retained for operational and analytics purposes.

[Specific retention schedules by data category to be confirmed.]

The Services are intended for adults. We do not knowingly collect personal information from children under 13 through our website without verifiable parental consent where required. Where care is offered to minors, it is provided only in accordance with applicable law and with the involvement of a parent, guardian, or authorized representative as required. [Minimum age and minor care eligibility to be confirmed.]

If you believe a child has provided personal information to us without appropriate consent, please contact us so we can take appropriate action.

Our Services may link to or integrate third-party websites, applications, and services, including payment processors, pharmacy networks, laboratory partners, cloud infrastructure providers, and analytics vendors. Those third parties operate under their own privacy policies, and this Privacy Policy does not govern their practices.

We encourage you to review the privacy notices of any third-party service before providing information to it. [Current list of third-party vendor categories to be confirmed.]

Several U.S. states have enacted comprehensive consumer privacy laws. Whether a given right applies to you depends on your state of residence, the nature of the information, and applicable exemptions — including exemptions for information covered by HIPAA or maintained as part of a medical record.

California

California residents may have rights under the California Consumer Privacy Act, as amended, including rights to know, delete, correct, opt out of the sale or sharing of personal information, limit the use of sensitive personal information, and be free from discrimination for exercising those rights.

Washington and Nevada consumer health data

Residents of Washington and Nevada may have additional rights concerning consumer health data under the Washington My Health My Data Act and Nevada SB 370, to the extent those laws apply to information we process. [Applicability to be confirmed.]

Other states

Residents of states including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and others may have rights to access, correct, delete, obtain a copy of, and opt out of certain processing of their personal information, together with appeal rights where provided.

International visitors

The Services are intended for individuals located in the United States. If you access the Services from outside the United States, your information may be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction. [International availability and applicable transfer mechanisms to be confirmed.]

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. When we make material changes, we will update the “Last Updated” date above and, where required by law, provide additional notice.

We encourage you to review this page periodically. Your continued use of the Services after an update takes effect indicates that you are aware of the revised Privacy Policy.

You may contact us with questions, concerns, or privacy requests using the details below. If you are experiencing a medical emergency, call 911 or go to the nearest emergency room.