Privacy Policy

Last updated: August 14, 2026

This Privacy Policy describes how Oat Meds LLC ("Oat Meds," "we," "us," or "our") collects, uses, discloses, and otherwise processes personal information when you use our websites, applications, and related services (collectively, the "Services"), including oatmeds.com.

PLEASE READ THIS PRIVACY POLICY CAREFULLY. By using the Services, you acknowledge the practices described here. If you do not agree, please do not use the Services.

This Privacy Policy is incorporated into our Terms of Service. Capitalized terms not defined here have the meanings given in the Terms.

Important Context About Oat Meds

Oat Meds operates a technology platform that facilitates relationships among patients, independent licensed healthcare providers, and licensed pharmacies. Oat Meds itself is not a provider group and is not a pharmacy.

Clinical care is provided by independent licensed professionals associated with our contracted provider group, Beluga Health, P.A. ("Beluga"), and Beluga's providers.
Medications, when prescribed, are dispensed by licensed pharmacies, which may include partner 503A or 503B compounding pharmacies.

Because of this structure, information you provide may be shared with Beluga, Providers, and Pharmacy Network partners as needed to deliver care and fulfill prescriptions. Those parties may also have their own privacy notices. Please also review our Notice of Privacy Practices and any Beluga privacy materials presented during intake.

Information We Collect

Information you provide

Depending on how you use the Services, we may collect:

Identifiers and contact details, such as name, email address, phone number, shipping/billing address, and date of birth
Account credentials, such as passwords or authentication information
Payment and commercial information, such as payment method details processed by our payment processors, purchase history, and subscription status
Health and treatment information, such as medical history, symptoms, medications, allergies, lifestyle information, photos or images you upload, questionnaire responses, prescription details, and communications with Providers or support
Identity verification information, including an image of a government-issued identification document when required. We currently collect the image directly rather than using a separate identity-verification service
Communications, including messages you send to customer care or through the platform
Preferences, such as communication and marketing choices
Any other information you choose to provide

Information collected automatically

When you use the Services, we and our service providers may automatically collect:

Device and browser information (for example, IP address, device type, operating system, browser type)
Usage data (pages viewed, links clicked, referring/exit pages, timestamps, approximate location derived from IP)
Cookie and similar technology data (described below)
Log and diagnostic data related to errors, performance, and security

Information from other sources

We may receive information from:

Beluga and Providers in connection with your care
Pharmacies in connection with prescription fulfillment and shipping
Payment processors and fraud-prevention partners
Analytics, advertising, and marketing partners (where permitted by law)
Public or commercially available sources, where appropriate

Cookies, Analytics, and Advertising Technologies

We use cookies, pixels, tags, local storage, server-side APIs, and similar technologies to operate the Services, remember preferences, understand usage, improve performance, prevent fraud, measure advertising effectiveness, and support marketing where permitted by law.

Our analytics and advertising technologies currently include Google Analytics 4 (GA4), Google Ads, Google Tag Manager, Reddit Pixel and Reddit Conversions API, Meta Pixel and Meta Conversions API, and Amplitude. These technologies may collect or receive information such as IP address, device and browser information, identifiers, referring and exit pages, pages viewed, interactions with the Services, and information about whether certain events occurred.

Advertising and analytics technologies may operate on many pages of the Services. We use technical measures designed to prevent raw health information submitted in connection with requesting or receiving care from being transmitted to advertising platforms. Where information is used for permitted measurement or matching, we may use hashing, encryption, filtering, or obfuscation. These measures reduce identifiability but do not necessarily make information anonymous under every applicable privacy law.

We also use server-side conversion APIs to measure campaign performance. Depending on the technology and your settings, third parties may be able to recognize your browser or device over time and across websites or online services.

Where required by applicable law, we recognize applicable opt-out preference signals, including Global Privacy Control (GPC), as a request to opt out of processing treated as a sale, sharing, or targeted advertising. You can also control cookies through your browser settings. Blocking some cookies may affect Service functionality.

How We Use Information

We use personal information to:

Provide, operate, maintain, and improve the Services
Create and manage accounts and authenticate users
Facilitate telehealth consultations with Beluga and Providers
Coordinate prescription fulfillment with Pharmacy Network partners
Process payments, subscriptions, refunds, and related billing
Communicate with you about orders, care coordination, product updates, and support
Send marketing communications where permitted by law and consistent with your choices
Personalize content and measure the effectiveness of our Services and campaigns
Conduct research and analytics, including in de-identified or aggregated form
Detect, prevent, and respond to fraud, abuse, security incidents, and illegal activity
Comply with legal obligations, enforce our Terms, and protect the rights, safety, and property of Oat Meds, users, Providers, pharmacies, and the public
Support corporate transactions (for example, mergers or acquisitions), subject to applicable law

We may combine information from different sources for these purposes.

How We Disclose Information

We may disclose personal information to:

Beluga and Providers, to enable clinical evaluation, treatment, prescribing, follow-up, and related communications
Pharmacy Network partners (including licensed 503A/503B compounding pharmacies and other dispensing pharmacies), to fill prescriptions, ship medications, provide counseling information, and manage fulfillment
Service providers and contractors that help us operate the Services, including AWS and DigitalOcean for infrastructure and hosting; Freshdesk for customer support; Postmark for email delivery; our locally hosted Mailcoach instance for marketing email management; Vonage for SMS; Stripe for payment processing; and analytics, advertising, security, and measurement providers described in this Policy
Professional advisors, such as lawyers, accountants, and insurers, where appropriate
Authorities and other parties when we believe disclosure is required by law, legal process, or to protect rights and safety
Business transfer recipients, in connection with a merger, financing, acquisition, reorganization, or sale of assets
Other parties with your direction or consent

We may also disclose aggregated or de-identified information that cannot reasonably be used to identify you.

We do not sell your personal information for money. We may engage in advertising or analytics activities that some state privacy laws treat as a "sale" or "sharing" of personal information for cross-context behavioral advertising. Where those laws apply, you can exercise opt-out rights as described below.

Health Information

Health information you submit to request care may be used and disclosed by Beluga, Providers, and pharmacies as needed to evaluate and deliver care, prescribe when appropriate, fulfill prescriptions, and coordinate related support, as permitted by applicable law.

Oat Meds and Beluga have advised that neither entity currently operates as a HIPAA covered entity. This Policy does not represent that Oat Meds is a HIPAA covered entity or that all information processed through the Services is protected by HIPAA. Health and medical information may nevertheless be protected by other federal or state privacy, medical-record, consumer-health-data, confidentiality, and security laws. Our Notice of Privacy Practices provides additional detail about how health information may be used and shared in connection with care.

Please remember:

Messages you send outside secure channels (for example, unencrypted email you initiate) may be less secure
Oat Meds support staff may access account and order information to help you; clinical questions should be directed to your Provider when appropriate
We do not use health information you submit in connection with requesting or receiving care to build advertising profiles or deliver targeted advertising based on your medical conditions or treatment requests.

Your Rights and Choices

Depending on your location, you may have rights to:

Access or receive a copy of personal information we hold about you
Correct inaccurate personal information
Delete personal information, subject to legal and operational exceptions (for example, records we must retain for healthcare, billing, or legal compliance)
Opt out of certain processing, including marketing emails and, where applicable, targeted advertising / "sale" or "sharing"
Appeal a decision we make regarding a privacy request (where required by law)

Marketing emails: Use the unsubscribe link in the email or contact us.
SMS: Follow the opt-out instructions in the message (for example, reply STOP).
Account settings: You may update certain profile information in your account.

To submit a privacy request, email privacy@oatmeds.com. We may need to verify your identity before completing your request. You may use an authorized agent where permitted by law.

These rights are not absolute. We may deny requests as permitted or required by law, including where fulfilling a request would impair clinical, pharmacy, security, or legal obligations.

Where required by applicable law, we recognize browser-based Global Privacy Control ("GPC") signals as requests to opt out of certain targeted advertising or "sale" or "sharing" activities covered by applicable state privacy laws.

State Privacy Disclosures (U.S.)

Residents of certain U.S. states (including California and others with comprehensive privacy laws) may have additional rights regarding personal information.

Categories of personal information we collect may include identifiers, commercial information, internet/electronic activity, approximate geolocation, sensory or visual information (such as photos you upload), professional information if provided, inferences, and sensitive personal information (such as health data and account credentials), as described above.

We collect this information from you, your devices, Providers/pharmacies, and service providers for the purposes listed in this Policy. We disclose these categories to the parties described in "How We Disclose Information."

California residents may have rights to know, delete, correct, and opt out of sale/sharing, and to non-discrimination for exercising privacy rights. You may submit requests to privacy@oatmeds.com. If we deny your request, you may appeal by replying to our decision email with the subject line "Privacy Appeal."

We do not knowingly use sensitive personal information for purposes beyond those permitted for providing the Services and as allowed by law.

Consumer health data laws

Certain states, including Washington and Nevada, provide specific protections for consumer health data that may apply independently of HIPAA. Where such laws apply, we provide the notices, choices, consents, access, correction, deletion, withdrawal, and appeal rights required by applicable law.

Washington law requires a separate Consumer Health Data Privacy Policy for businesses subject to the Washington My Health My Data Act. Where applicable, that separate policy should be made available through a clear and conspicuous link on our website. Nevada law similarly imposes specific consumer-health-data notice and consent requirements.

We do not sell consumer health data for monetary consideration. We do not use raw health information submitted in connection with requesting or receiving care to create advertising profiles based on a person's diagnosis, medical condition, treatment request, or prescription. Advertising and analytics technologies are subject to the limitations and technical safeguards described above.

Nevada residents may request to opt out of certain future sales of covered information under Nevada law by contacting privacy@oatmeds.com. Oat Meds does not currently sell covered information for monetary consideration as defined under Nevada law.

Retention

We retain different categories of information for different periods depending on the nature of the information and our legal obligations.

Account information is generally retained while your account remains active and for a reasonable period afterward.
Transaction and billing records may be retained as required by tax, accounting, and legal obligations.
Information related to healthcare services may be retained as required by applicable medical record retention obligations or contractual requirements with Providers and pharmacies.
We may also retain information necessary to resolve disputes, detect fraud, enforce our agreements, and comply with legal obligations.

Security

We implement administrative, technical, and physical safeguards designed to protect personal information, including encrypted communications in transit where appropriate, access controls, authentication measures, monitoring, and security practices intended to reduce unauthorized access. Our primary infrastructure providers include AWS and DigitalOcean, and our customer-support platform is Freshdesk; we maintain contractual data-protection arrangements, including BAAs where applicable to the vendor relationship. No method of transmission or storage is completely secure. You are responsible for maintaining the confidentiality of your account credentials.

Children's Privacy

The Services are not directed to children under 18, and we do not knowingly collect personal information from children under 18. If you believe a child has provided us information, contact privacy@oatmeds.com so we can take appropriate action.

Third-Party Links and Services

The Services may contain links to third-party websites or integrate third-party tools. We are not responsible for the privacy practices of those third parties. Review their policies before providing information to them.

International Users

The Services are intended for users in the United States. If you access the Services from outside the United States, you understand that your information may be processed in the United States, where privacy laws may differ from those in your jurisdiction.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The "Last updated" date will change when we do. Material changes may be posted on the Services or communicated to you by email or other appropriate means. Continued use of the Services after an update becomes effective constitutes acceptance of the revised Policy.

Contact Us

For privacy questions or requests:

Oat Meds LLC
382 NE 191st St PMB 826830
Miami, FL 33179
Email: privacy@oatmeds.com
General support: care@oatmeds.com