The fine print, in plain English.

Privacy policy

This policy explains how Plyamed LLC ("Plya Med", "we", "us") collects, uses, shares, and protects information. It applies to plyamed.com, our online store, our rep and partner pages, the telehealth intake at /visit, and the websites we host for independent representatives and clinics at <name>.plyamed.com. Health information you give a medical provider through our platform is also covered by the Patient privacy and HIPAA section below, and that section controls if the two differ.

Who this covers

• Website visitors, anyone browsing our pages
• Practices and clinicians with a Plya Med account
• Representatives and partners who apply to or join our programs
• Patients and customers who complete a telehealth intake or buy through a store we host

What we collect

• Contact details: name, email, phone, and shipping and billing address
• Practice account information: practice name, address, prescriber ID, and EIN where applicable
• Health information you provide in a telehealth intake: state of residence, sex at birth, health goals, medical history, medications, and answers to a provider's questions
• Order history, invoices, and payment status. Card numbers are entered on our payment processor's page and are not stored by Plya Med.
• Communications with us or with your provider (email, phone, text, secure messages)
• Device and usage data: IP address, approximate location, browser, pages viewed, and referrer, as described under Cookies, analytics and advertising

How we use it

• To provide the services you ask for: accounts, orders, fulfillment, and connecting patients with licensed providers
• To confirm that patients are located in a state we serve, and to verify prescriber credentials
• To send transactional messages (order confirmations, shipping notices, appointment and intake reminders)
• To provide support, keep our systems secure, prevent fraud, and meet legal obligations
• To measure and improve our website and advertising, using only non-health website data and only as described under Cookies

How we share it

• With your providers and pharmacies. Intake and order information goes to the licensed medical practice that reviews your care and the licensed pharmacy that fills a prescription.
• With service providers that run our platform (hosting, payments, email and text delivery, customer support), under contracts that limit their use of the data. Any that handle health information sign a Business Associate Agreement.
• With the representative or clinic whose site you used, limited to what they need to support your order. They never receive your health information unless they are your treating provider.
• When required by law, or to protect the rights and safety of patients, Plya Med, or others.
• In a merger or sale of our business, subject to this policy.

What we never do

• Sell health information, or sell or rent prescriber or practice contact information
• Use health information for advertising, or send it to advertising or analytics companies
• Use your information for a purpose unrelated to the services we provide without your consent

Data retention

We keep account and order records for as long as your account is active and as long as tax, accounting, and pharmacy laws require. Medical records are kept by the treating practice for the period that state medical-records law requires. When information is no longer needed, we delete or de-identify it.

Children

Our services are for adults 18 and older. We do not knowingly collect information from children under 13, and telehealth services on our platform are not available to anyone under 18.

Changes to this policy

We will post any change on this page with a new "last updated" date. If a change materially affects how we use health information, we will notify affected patients before it takes effect.

Patient privacy and HIPAA

When you use a telehealth service on plyamed.com or on a website we host, your care is provided by independent, licensed clinicians, and prescriptions are filled by licensed partner pharmacies. Those medical practices and pharmacies are "covered entities" under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Plya Med provides the technology platform and acts as their "business associate". We sign a Business Associate Agreement with each of them, and we create, receive, store, and transmit your protected health information (PHI) only to provide those services, as HIPAA permits.

How we comply with HIPAA

• We follow the HIPAA Privacy, Security, and Breach Notification Rules (45 CFR Parts 160 and 164) for all PHI on our platform.
• We use and disclose PHI only for treatment, payment, and health care operations, as required by law, or with your written authorization. We use the minimum necessary information.
• We require a Business Associate Agreement from every subcontractor that handles PHI.
• We do not sell PHI, and we do not use it for marketing without your written authorization.
• No advertising or analytics tag from another company runs on telehealth intake, patient account, or other pages where PHI is entered or displayed.
• We have a designated Privacy and Security Officer, perform security risk assessments, and train staff with PHI access.

Notice of Privacy Practices: your rights

Your treating practice gives you its Notice of Privacy Practices before your first visit. Under HIPAA you have the right to:

• Get a copy of your health and billing records, in paper or electronic form, usually within 30 days
• Ask to correct health information you believe is wrong or incomplete
• Ask that we contact you in a specific way or at a specific address
• Ask us to limit what we use or share. If you pay for a service in full out of pocket, you can ask that it not be shared with your health insurer.
• Get a list of the times your information was shared for purposes other than treatment, payment, or operations, for up to six years
• Get a paper copy of the Notice of Privacy Practices at any time
• Choose someone to act for you, such as a legal guardian or a person with medical power of attorney
• Be told if a breach compromises your unsecured PHI
• File a complaint if you believe your rights were violated, with us at support@plyamed.com or with the U.S. Department of Health and Human Services Office for Civil Rights at hhs.gov/ocr/complaints. We will not retaliate against you for filing a complaint.

To use any of these rights, email support@plyamed.com. We will send your request to your treating practice where it is the practice's decision, and help you with it.

Breach notification

If PHI is involved in a breach, we notify the affected practice or pharmacy without unreasonable delay, and individuals are notified within 60 days of discovery, as 45 CFR 164.400 to 414 requires. Where federal HIPAA rules do not apply, we follow the FTC Health Breach Notification Rule and state breach laws.

Consumer Health Data Privacy Policy

This section is our Consumer Health Data Privacy Policy under the Washington My Health My Data Act (RCW 19.373), Nevada SB 370 (NRS 603A), and the consumer health data provisions of the Connecticut Data Privacy Act. It covers health-related data that is not PHI under HIPAA, for example health goals you choose on our website before you start a telehealth intake.

What consumer health data we collect, and why

• Health goals and product interests you select, to show you relevant services and products
• Intake answers you begin but do not submit to a provider, so you can finish later
• Purchases of health-related products, to fulfill and support your order

Sources: we collect it directly from you, and from the representative or clinic site you used.

Who we share it with

• Our service providers (hosting, payments, email and text delivery), only to provide the services
• The licensed medical practice and pharmacy that provide your care, when you submit an intake or order
• The representative or clinic whose site you used, limited to order support

We do not sell consumer health data. We collect and share it only with your consent or as needed to provide the product or service you request. We do not use geofencing around health care facilities.

Your rights

• Confirm whether we collect, share, or sell your consumer health data, and get a copy of it
• Get a list of every third party and affiliate we shared it with, and how to contact them
• Withdraw your consent
• Have your consumer health data deleted, including from our service providers

To make a request, email support@plyamed.com with the subject "Consumer health data request". We respond within 45 days. If we decline your request, you can appeal by replying to our decision with the subject "Appeal". If you disagree with the result of the appeal, you can contact the Attorney General of your state.

Your state privacy rights

Depending on where you live, including California, Colorado, Connecticut, Oregon, Texas, Virginia, and other states with consumer privacy laws, you may have the right to:

• Know and get a copy of the personal information we hold about you
• Correct or delete it
• Opt out of the sale or sharing of personal information, and of targeted advertising, using Cookie settings or a Global Privacy Control signal
• Limit the use of sensitive personal information
• Appeal a decision on your request
• Not be treated differently for using any of these rights

California residents: medical information is also protected by the California Confidentiality of Medical Information Act. We do not sell personal information as that term is commonly understood. Advertising tags described under Cookies may count as "sharing" under California law, and you can opt out at any time.

To make a request, email support@plyamed.com. We respond within 45 days and may need to verify your identity first. An authorized agent may make a request for you with your signed permission.

How we secure your information

• All pages on plyamed.com and the sites we host use Secure Socket Layer (SSL/TLS) encryption, so information about transactions, patients, and medical history is encrypted in transit.
• Data is stored with cloud providers that encrypt it at rest and that have signed Business Associate Agreements with us.
• Access to PHI is limited by role, and staff accounts require individual sign-in.
• Payment card data is handled by our PCI-compliant payment processor and is not stored on our systems.

No system is completely secure. If you think your account has been compromised, email support@plyamed.com right away.

Service areas

Telehealth services and prescription fulfillment through plyamed.com and the websites we host are available only to patients located in these 47 states at the time of each visit:

Alabama, Arizona, Arkansas, California, Colorado, Connecticut, Delaware, Florida, Georgia, Hawaii, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Massachusetts, Michigan, Minnesota, Missouri, Montana, Nebraska, Nevada, New Hampshire, New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Texas, Utah, Vermont, Virginia, Washington, West Virginia, Wisconsin, and Wyoming.

Not available in Alaska, Mississippi, New Jersey, the District of Columbia, U.S. territories, or outside the United States. The telehealth intake does not accept these locations, and we do not take payment for or ship prescriptions to them.

Privacy contact

Privacy and Security Officer, Plyamed LLC
7220 E Mayo Blvd, Scottsdale, AZ 85255
support@plyamed.com · (602) 922-2249

Cookies, analytics and advertising

Our websites — plyamed.com, our online store, our rep and partner pages, and the websites we host for independent representatives and clinics at <name>.plyamed.com and on their own domains — use three kinds of cookies and similar technologies.

Essential cookies

These keep the site working: your cart, checkout, sign-in, age confirmation, and your cookie choice. They are always on.

Our analytics

We record page views, product views, and items added to a cart, together with the referring site and campaign. Unless you opt out, we give your browser a random visitor ID (the plya_vid cookie) so we can connect these visits. If you later sign in, check out, or send us your details, we link that visitor ID to your email address so that the representative who referred you is credited.

Advertising and analytics tags from other companies

• Plya Med's own tags. The Plya Med online store, our rep recruitment page, and our partner and program landing pages use the Meta Pixel and the Google tag (Google Ads, and Google Analytics where enabled). They measure visits, sign-ups, and purchases from our ads — including on the store's checkout page, to measure purchases — and help show our ads to people likely to be interested. They do not run on account or sign-in pages.
• Representatives' and clinics' own tags. An independent representative or clinic whose website we host may add their own Google Analytics, Google Tag Manager, Google Ads, Meta Pixel, or TikTok Pixel. These run only on general pages of that site: the home page, blog and learning pages, general information pages, and the store's browsing pages. That representative or clinic decides how the data is used, under the provider's terms and their own policies.

When these tags run, the companies that provide them (Meta, Google, TikTok) receive information such as the page you viewed, actions you took, your IP address, and device and browser identifiers. Under some state laws, including California's, sharing this information for cross-context behavioral advertising may be considered a "sale" or "sharing" of personal information.

Where these tags never run

No advertising or analytics tag from another company runs on booking or appointment pages, telehealth intake or other patient pages, account and sign-in pages, or pages about a specific health condition, care pathway, or lab testing.

Your choices: “Do not sell or share my info”

• Cookie settings. Every page has a “Cookie settings · Do not sell or share my info” link in its footer. Turn off “Analytics & ads cookies” and choose Save. We stop loading advertising and analytics tags, ask tags already loaded on the page to stop, delete our visitor ID and the tags' cookies on that site, and remember your choice in that browser for 12 months.
• Global Privacy Control. If your browser or extension sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of the sale and sharing of your personal information — no click needed. GPC overrides any earlier choice in that browser.
• Washington and Nevada. If you visit from Washington or Nevada (judged from your approximate location), we load no advertising or analytics tags and set no visitor ID unless you choose “Allow” in the notice at the bottom of the page. You can change your answer at any time in Cookie settings.
• Other controls. You can also manage ad preferences with Meta and Google, and block or delete cookies in your browser settings.

Your choice applies to the browser and device you make it on. Clearing your cookies clears your choice.

Terms of use

By creating a Plya Med account or placing an order, you agree to the following terms. These terms govern the relationship between Plya Med and your practice.

Eligibility

Plya Med products and services are sold exclusively to licensed medical practices, clinicians, and authorized facilities. Account verification is required prior to first order.

Orders and pricing

Prices shown reflect practice account pricing and may change. Orders are subject to product availability and verification of prescriber credentials. We reserve the right to refuse or cancel any order.

Returns

Most products are non-returnable due to the nature of the category. Damaged or incorrect shipments must be reported within 7 days of delivery — we'll replace at no cost.

Limitation of liability

Plya Med's total liability for any claim arising under these terms is limited to the value of the order giving rise to the claim. We are not liable for indirect, incidental, or consequential damages.

Compliance

Statements made on this website have not been evaluated by the US Food and Drug Administration. Statements and products are not intended to diagnose, treat, cure, or prevent any disease.

Plya Med is a medical-practice supply platform. Plya Med is not a compounding pharmacy or chemical compounding facility as defined under 503A of the Federal Food, Drug, and Cosmetic Act. Plya Med is not an outsourcing facility as defined under 503B of the Federal Food, Drug, and Cosmetic Act. Compounded products are dispensed by licensed third-party partner pharmacies in accordance with state and federal regulations.

HIPAA

Plya Med acts as a business associate of the medical practices and pharmacies on our platform and signs a Business Associate Agreement with each. How we protect patient information is described under Patient privacy and HIPAA. To request a Business Associate Agreement, email support@plyamed.com.

SMS / text message opt-out

Plya Med sends transactional SMS messages (order confirmations, shipping updates) only to phone numbers your practice has explicitly provided, and onboarding and informational messages to prospective sales representatives who submitted our rep interest form and opted in. We do not send marketing SMS.

How to opt out

• Reply STOP to any Plya Med SMS
• Email chris@plyamed.com with the subject line "SMS opt-out"

Opting out of SMS will not affect your account or your ability to receive order updates via email.

Accessibility

Plya Med is committed to making our website and platform accessible to all users, including those who rely on assistive technologies. Our team designs against WCAG 2.1 AA guidelines and tests regularly with screen readers and keyboard-only navigation.

If you encounter an accessibility issue or have a suggestion, please email chris@plyamed.com. We acknowledge every report within 2 business days and aim to resolve issues within 30 days.