Privacy Policy

LAST UPDATED: July 10, 2026

Smith Health, Inc. (“SmithRx”, “Company”, “we”, or “us”) recognizes that the privacy of your information is important. This Privacy Policy describes our practices regarding the information we collect from or about you when you visit our websites, use our mobile applications, or otherwise interact with us online, offline, or through any electronic, telephonic, or written communications (collectively, the “Services”). This Privacy Policy details our practices for collecting, using, maintaining, protecting, and disclosing that information. It does not apply to information collected by any third party, including through any application or content that may link to or be accessible from our Services.

Please read this policy carefully to understand how we collect, protect, and treat your information. If you do not agree with our practices, please do not access or use our Services. By utilizing our Services, you acknowledge the terms outlined in this privacy policy. This policy may change from time to time (see Changes to Our Privacy Policy). Your continued use of our Services after we make updates indicates your acknowledgment of those revisions.

Information We Collect About You

We collect several types of information from and about users of our Services, including any information that identifies, describes, relates to, or could reasonably be linked or associated with you or your household (“Personal Information”). Personal information that we may collect about you includes:

Identifiers: Such as name, postal address, email address, telephone number, member ID, account identifier, social security number, or online identifier.
Sensitive Personal Information: Such as your Social Security number or account log-in credentials in combination with required security codes/passwords allowing account access.
Internet and Network Activity: Information about your internet network activity, including browsing or search history, the device or browser you use to access our Services, and information about your interaction with our Services.
Geolocation Data: Geolocation information such as IP address.
Communication: Information that you transmit to us when you contact us through our Services.

We may collect this information:

Directly from you: When you provide it to us.
Automatically as you navigate: As you interact with our Services. Information collected automatically may include usage details, IP addresses, and information collected through cookies, web beacons, and other tracking technologies.

Relationship to HIPAA and Protected Health Information

In some circumstances, our collection and use of Personal Information will be subject to the requirements of the Health Insurance Portability and Accountability Act (“HIPAA”). Identifiable patient or member information related to health care or payment for health care will be treated as protected health information (“PHI”) under HIPAA, at which point state consumer privacy frameworks generally exempt the data. When Personal Information constitutes PHI, it is governed strictly by healthcare privacy rules, and the general consumer rights outlined in this policy generally may not apply to that information.

Cookies

We use cookies, web beacons, pixels, software development kits (SDKs), device identifiers, and similar tracking technologies to analyze traffic, optimize performance, and assist in our marketing and targeted advertising efforts across our Services. When you visit or use our Services, you will be presented with a cookie preference interface that allows you to manage your preferences and opt-out of non-essential trackers.

You can also disable all non-essential cookies, pixels, and tracking technologies at any time by clicking the "Do Not Sell or Share My Personal Information" link in our footer or within our application settings. Clicking this link or toggling this setting will instruct our system to turn off these non-essential trackers on your device.

How We Respond to Automated Browser Signals (GPC and DNT)

Global Privacy Control (GPC): We actively recognize and process automated browser opt-out preference signals, such as the Global Privacy Control (GPC). If you utilize a browser to access our Services and that browser transmits a GPC signal, our system will automatically detect it and instantly block non-essential trackers and pixels from firing, overriding any other banner choices.
Do Not Track (DNT): While we fully support and process GPC signals, we do not currently alter our practices or respond to older, browser-based "Do Not Track" (DNT) signals when you access our Services, as there is currently no uniform, universally accepted industry standard for interpreting them.

How We Use Your Information

We may use information that we collect about you or that you provide to us, including any Personal Information, for the following business and commercial purposes:

Providing and Maintaining Our Services: To present our Services and their contents to you, deliver the information or services you request, and fulfill our contractual obligations.
Identity Verification and Security: To confirm your identity, ensure all communications remain secure and confidential, detect security incidents, protect against fraudulent or illegal activity, and enforce our Terms of Service.
Services Optimization and Analytics: To support, personalize, and develop our Services, products, and operational offerings by analyzing how users interact with our Services.
Marketing and Advertising: To notify you about changes to our Services or contact you regarding products and services that may be of interest to you.
Legal and Regulatory Compliance: To comply with applicable court orders, state and federal laws, and mandatory record-keeping requirements.

We may also use your information, including any Personal Information, for other purposes consistent with the context of the collection of your Personal Information, as otherwise disclosed to you at the time your Personal Information is collected, or with your consent.

How We Disclose Your Information

We may disclose the Personal Information we collect or that you provide under the specific business and commercial circumstances outlined below:

Service Delivery and Operational Maintenance: To provide, manage, and operate our Services, communicate with you regarding your account, provide troubleshooting or technical support, fulfill your requests, and for similar operational support purposes.
Corporate Restructuring and Asset Sales: To a buyer, successor entity, or designated representative during a corporate merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of SmithRx’s assets, including as part of bankruptcy, liquidation, or a similar proceeding.
In Response to Legal Process: To comply with the law, a judicial proceeding, court order, or other legal process, such as in response to a subpoena.
Risk Mitigation and Protective Measures: When we believe disclosure is necessary or appropriate to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person, or to protect the rights, property, or safety of SmithRx, our users, or others, including to enforce our Terms of Service.

To fulfill the business and operational objectives listed above, we may share Personal Information with the following entities:

Contracted Partners and Suppliers: Our service providers, contractors, and agents who perform functions on our behalf. This includes, but is not limited to, IT and cloud hosting providers, customer service or help desk entities, payment processors, analytics providers, consultants, auditors, and legal counsel.
Our Affiliates: Any current or future corporate affiliates or subsidiaries that may be formed under common corporate control, for purposes consistent with this policy.
Our Business Customers: Any business client or commercial customer on whose behalf we process Personal Information, where disclosures are made at their direction or to fulfill our service commitments to them.
Third-Party Advertising Networks and Providers: Third-party ad network providers, sponsors, or traffic measurement services that assist us in evaluating marketing performance and managing targeted outreach campaigns.
Government or Public Authorities: Any administrative agency, regulatory body, or public authority where we believe disclosure is reasonably necessary to comply with a regulatory request, protect the security of our Services, respond to an emergency requiring data disclosure to prevent injury, or defend ourselves against third-party allegations.

Over the preceding 12 months, we have disclosed the categories of Personal Information listed above (Identifiers, Internet Activity, Geolocation, and Communications) to our Contracted Partners, Affiliates, and Third-Party Advertising Networks for the business and commercial purposes detailed above.

We reserve the right to share aggregated or de-identified information that does not identify any individual without restriction. For any other disclosure scenario, we will only share your Personal Information with your consent or for reasons directly consistent with the context of collection.

Children Under the Age of 13

Our Services are designed for a general audience and are not intended for or directed to children under 13 years of age. We do not knowingly collect, solicit, or maintain Personal Information from any person we know to be under the age of 13. If we learn that we have inadvertently collected or received Personal Information from a child under 13 without verifiable parental consent, we will delete that information from our systems.

If you believe we might have any Personal Information from or about a child under the age of 13, please contact us at privacy@smithrx.com so that we may verify and permanently remove the data.

State Privacy Rights

Depending on the jurisdiction in which you live, you may possess specific statutory rights regarding your Personal Information under applicable state law. Subject to certain localized legal conditions, exceptions, and identity verification procedures, these rights may include the ability to request the following actions based on our current processing activities:

Access and Portability: Request confirmation that we process your data and obtain a copy of Personal Information we have collected about you in a portable, readily usable format. Depending on your jurisdiction, this may also include a historical disclosure of the categories of sources from which we collected your data and the categories of third parties to whom it was disclosed.
Correction: Request that we correct inaccurate or incomplete pieces of Personal Information that we maintain about you.
Deletion: Request that we permanently delete the Personal Information we have collected from or about you, subject to ongoing regulatory, operational, or record-keeping compliance exceptions.
Opt-Out of Sales, Sharing, and Targeted Advertising: Direct us not to sell your Personal Information, share your data for cross-context behavioral advertising, or process your data for targeted marketing campaigns.
Limit Sensitive Personal Information: Request that we limit our use and disclosure of your sensitive Personal Information if we process it for purposes outside of core operational necessities.
Non-Discrimination: Exercise any of your statutory privacy rights without fear of service denial, altered pricing, or a reduction in the quality of the Services provided to you.

Submitting and Verifying Privacy Requests

To initiate a request to exercise your access, portability, correction, or deletion rights, please contact our privacy compliance team at privacy@smithrx.com.

To protect your privacy and security, we must verify your identity before fulfilling any statutory requests. When you submit a request, we will ask you to provide standard identifier details that we can match against our existing internal records to confirm your identity. We will be unable to comply with a request if we cannot reasonably verify your identity or confirm that you are authorized to act on behalf of a specific consumer.

We will process and respond to your verified request within the timeframes established by applicable state law. If we require a permitted statutory extension due to complexity or operational necessity, we will notify you in writing of the extension and the underlying reasoning within the initial legal response window.

Request Denials and Appeals

Applicable state law may require or permit us to decline your request. If we deny your request, we will notify you in writing of our decision and explain the grounds for our determination.

To the extent provided by the laws of your jurisdiction, you may have the right to appeal our decision if you disagree with our determination. You may initiate an official appeal by replying directly to our written denial notification email.

We will evaluate your appeal and respond to you in writing within the timeframes mandated by applicable law, detailing any action taken or not taken along with the grounds for our determination. If we decline your request following an internal appeal, or if you remain concerned about the outcome, you may contact the Attorney General in your state of residency to submit an official complaint.

Third Party Services and Links

Our Services may contain links to other websites, applications, or features that are not owned, controlled, or operated by SmithRx. Please be aware that we do not control and are not responsible for the privacy practices, data security, or content of these third-party platforms.

Once you leave our platform or interact with an external application, any information you provide is governed entirely by the privacy policy of that third party. We strongly encourage you to review the privacy policies of any third-party services before providing them with your Personal Information.

Our internal cookie settings, preference choices, and automated opt-out signals do not transfer to external platforms. We cannot enforce your privacy choices on third-party networks, and you must manage your data tracking preferences directly on those external systems.

Security and Data Retention

We maintain specific operational standards designed to secure your data, outline your security responsibilities, and govern our data lifecycle according to the following terms:

Security Safeguards: We have implemented measures designed to secure your Personal Information from accidental loss and from unauthorized access, use, alteration, and disclosure.
User Responsibilities: The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Services, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.
Internet Transmission Risks: Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your Personal Information, we cannot guarantee the security of your Personal Information transmitted to our Services. Any transmission of Personal Information is at your own risk, and we are not responsible for circumvention of any privacy settings or security measures contained within our Services.
Data Retention Policy: We will retain your Personal Information for as long as is necessary to fulfill the purposes set out in this policy, or for such longer period as may be required or permitted by applicable law and regulations. We will also retain and use your Personal Information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements and policies.

Changes to Our Privacy Policy

It is our policy to post any modifications we make to our Privacy Policy on this page, with the effective date of the latest revision identified at the top of the page. If we make material changes to how we treat our users’ Personal Information, we will notify you through a prominent notice within our Services or by direct communication, such as email. You are responsible for ensuring we have an active, deliverable email address for you, and for periodically reviewing our Services and this Privacy Policy to check for any updates.

Contact Information

To ask questions or comment about this Privacy Policy and our privacy practices, you may contact us via email at privacy@smithrx.com, or by mail at the following address: