Privacy Policy

This Privacy Policy describes the privacy practices of Koves LLC ("Koves," "we," "us," or "our") in connection with the websites, applications, portals, services, features, communications, and other online services owned, operated, administered, or made available by Koves, including Koves.co and any related websites, portals, applications, or digital services that link to this Privacy Policy (collectively, the "Platform").

The Platform is intended to provide health and wellness information and facilitate access to independent healthcare providers, pharmacies, laboratories, technology services, administrative support, payment processing, communications, prescription coordination, and related services.

Certain portions of the Platform may be hosted, powered, facilitated, supported, or administered through third-party technology providers, including Bask Health, Inc. and its affiliates or service providers. Certain medical services are provided by independent licensed healthcare providers or professional medical entities.

Information collected in connection with medical care may be governed by additional privacy notices, including a healthcare provider's Notice of Privacy Practices, telehealth consent, pharmacy notice, laboratory notice, or other disclosure presented during the clinical process.

Where applicable law requires consent for a particular collection, use, disclosure, or other processing activity, Koves will seek that consent separately.

This Privacy Policy applies to personal information processed by Koves in connection with the Platform.

It does not necessarily govern information processed independently by:

• physicians;
• nurse practitioners;
• physician assistants;
• professional medical entities;
• pharmacies;
• laboratories;
• payment processors;
• shipping carriers;
• Bask Health or other technology providers acting independently of Koves; or
• other third parties whose services may be accessible through the Platform.

Those organizations may maintain their own privacy policies, Notices of Privacy Practices, terms, consents, or other disclosures.

Where Koves creates, receives, maintains, or transmits Protected Health Information ("PHI") on behalf of a healthcare provider or another entity regulated by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), our processing of that PHI is additionally governed by HIPAA, applicable agreements, and the healthcare provider's Notice of Privacy Practices.

Nothing in this Privacy Policy authorizes Koves to use or disclose PHI, consumer health data, sensitive personal information, or other regulated information in a manner prohibited by applicable law.

The information we collect depends on how you interact with Koves and which features or services you use.

We may collect information that you provide directly to us, including:

• name;
• email address;
• telephone number;
• mailing, billing, and shipping address;
• date of birth and age;
• account identifiers and login information;
• communication preferences;
• program enrollment information;
• transaction and subscription information;
• customer support communications;
• survey responses, reviews, and feedback;
• photographs, documents, and files you choose or are required to submit; and
• other information you voluntarily provide in connection with the Platform.

When relevant to services you request, information submitted through the Platform may include:

• health concerns and symptoms;
• medical history;
• diagnoses;
• allergies;
• prescription and over-the-counter medications;
• supplements;
• treatment history and preferences;
• height, weight, and other physical measurements;
• photographs;
• laboratory information;
• health goals and lifestyle information;
• demographic information;
• pregnancy-related information where relevant;
• family history;
• side-effect information;
• information concerning treatment response;
• physical characteristics; and
• other information relevant to healthcare services.

Some of this information may constitute PHI, sensitive personal information, or consumer health data under applicable law.

Clinical information submitted for purposes of receiving medical care may be provided to or processed by an independent healthcare provider or professional medical entity.

We may collect information concerning:

• programs, products, or services you view or inquire about;
• purchases;
• subscriptions and renewals;
• cancellations and refunds;
• discounts and promotional codes;
• order and shipping status;
• transaction history; and
• other commercial interactions with Koves.

Payment-card information may be collected directly by payment processors rather than stored by Koves.

When you interact with the Platform, Koves and our service providers may automatically collect technical and usage information, including:

• IP address;
• browser type and language;
• operating system;
• device type and device identifiers;
• screen resolution and device characteristics;
• approximate geographic location derived from IP address;
• referring and exit URLs;
• landing pages and pages viewed;
• page-view sequence;
• links and buttons clicked;
• scrolling and interaction activity;
• time spent on pages and session duration;
• search activity;
• conversion events;
• campaign attribution information;
• error logs and performance information;
• network information;
• cookie, session, and similar identifiers; and
• other similar technical information.

We and our service providers may use technologies such as:

• cookies;
• pixels;
• tags;
• web beacons;
• software development kits;
• local storage;
• server logs;
• APIs;
• session-management technologies; and
• similar technologies.

These technologies may be used for authentication, security, fraud prevention, account functionality, preferences, analytics, troubleshooting, performance measurement, attribution, personalization, advertising measurement, website optimization, and other permitted business purposes.

Where applicable law requires consent before the use of a particular tracking technology, we will seek that consent.

We may restrict or disable certain tracking technologies on pages or within environments involving PHI, consumer health data, or other sensitive information when required by applicable law.

We may infer approximate location information from information such as your IP address.

Because healthcare availability and provider licensing can depend on the jurisdiction in which you are physically located, we may also ask you to provide your state or other location information directly.

We will not collect precise device geolocation through GPS or similarly precise device-location technologies unless permitted by applicable law and, where required, after obtaining appropriate permission or consent.

To facilitate services requested by you, Koves may receive information from:

• independent healthcare providers;
• professional medical entities;
• pharmacies;
• laboratories;
• Bask Health;
• payment processors;
• shipping and fulfillment providers;
• identity-verification providers; and
• other organizations involved in providing requested services.

Information received may include administrative status, eligibility information, appointment or consultation information, prescription status, fulfillment status, laboratory status, shipping status, transaction information, and other information reasonably necessary to operate or support the Platform.

Where permitted by applicable law, we may receive information concerning your interactions with Koves advertising or marketing, including:

• advertisement views and clicks;
• campaign identifiers;
• source and referral information;
• conversion activity;
• audience information;
• device information;
• cookie or advertising identifiers; and
• other attribution or engagement information.

If you interact with Koves through a social network, advertising platform, marketplace, search engine, or other third-party platform, we may receive information made available to us by that platform in accordance with your settings and the platform's policies.

Where permitted by law, we may also obtain information from public records, fraud-prevention providers, identity-verification services, marketing databases, data-enrichment providers, business partners, and other lawful sources.

We may combine information obtained from these sources with information collected through the Platform, subject to applicable law.

Subject to applicable law and any additional restrictions applicable to PHI, consumer health data, or sensitive personal information, we may use information to:

• operate, maintain, and improve the Platform;
• create and administer accounts;
• authenticate users;
• process requests and transactions;
• administer programs and subscriptions;
• facilitate healthcare services requested by users;
• facilitate communications with healthcare providers;
• coordinate pharmacy or laboratory activities where appropriate;
• provide order and fulfillment information;
• provide customer support;
• process cancellations and refunds;
• personalize content and Platform experiences where permitted;
• remember preferences and selections;
• analyze Platform use and user journeys;
• measure acquisition, conversion, engagement, and retention;
• conduct cohort, trend, and performance analysis;
• conduct forecasting and business planning;
• develop statistical models and reports;
• perform benchmarking and business intelligence;
• design, test, and improve features;
• perform quality assurance and troubleshooting;
• conduct research and statistical analysis where permitted;
• send account, transaction, security, and service communications;
• send marketing communications where permitted and subject to your choices;
• measure advertising and marketing performance;
• prevent fraud, abuse, and unauthorized access;
• maintain Platform and information security;
• comply with applicable laws and legal process;
• establish, exercise, or defend legal rights; and
• support financing, audits, insurance, due diligence, investments, mergers, acquisitions, restructurings, asset sales, or other corporate transactions.

Where permitted by law, we may use eligible information to understand how users discover, navigate, and use Koves; identify trends and preferences; improve content and user experience; evaluate acquisition channels; measure conversion and retention; perform cohort analysis; understand customer needs; forecast demand; evaluate operational performance; develop statistical models; conduct benchmarking; and make business decisions.

Personalization or analytics involving regulated health information will be performed only as permitted by applicable law.

Where permitted by law, we may use information for internal research, trend analysis, statistical analysis, outcomes-related analysis, operational research, product research, market research, benchmarking, quality improvement, and development of new products, services, or features.

Where required, information used for these purposes will be de-identified, aggregated, or processed pursuant to an appropriate authorization, consent, agreement, or legal basis.

Where permitted by law, we may combine information collected directly from you, automatically through the Platform, from different Koves services, from service providers, from business partners, from marketing sources, and from other lawful sources.

We may analyze combined information to derive insights, preferences, trends, predictions, segments, or other inferences relating to Platform use, content engagement, acquisition channels, customer behavior, and service improvement.

We will not create, use, or disclose inferences derived from regulated health information in a manner prohibited by applicable law.

To the extent permitted by applicable law, Koves may create aggregated, de-identified, anonymized, statistical, or otherwise non-identifiable information from information collected through or in connection with the Platform.

Once information has been processed so that it is not reasonably capable of being associated with, linked to, or used to identify an individual as required under applicable law, we may use such information for lawful purposes, including:

• analytics;
• research;
• benchmarking;
• product development;
• service improvement;
• machine learning and statistical modeling;
• forecasting;
• market analysis;
• operational analysis;
• business intelligence;
• publication of statistical insights;
• development of new services;
• evaluation of treatment-access trends;
• measurement of Platform performance;
• marketing insights; and
• commercial planning.

We may disclose aggregated or de-identified information to service providers, researchers, business partners, consultants, investors, advertisers, analytics providers, healthcare organizations, and other third parties when permitted by applicable law.

Where applicable law requires us to maintain information in de-identified form and prohibits attempted re-identification, we intend to maintain that information in de-identified form and not attempt to re-identify it except as permitted by law, including where necessary to verify the effectiveness of de-identification processes.

Nothing in this section authorizes the use of PHI in a manner inconsistent with HIPAA or an applicable Business Associate Agreement.

We may disclose information in the circumstances described below, subject to applicable law.

We may disclose information to licensed healthcare providers and professional medical entities to facilitate healthcare services requested by you, including eligibility review, medical evaluation, telehealth consultation, treatment, prescribing, follow-up, monitoring, laboratory review, and other clinical activities.

Healthcare providers exercise independent professional medical judgment.

Where necessary to provide requested services, information may be disclosed to dispensing pharmacies, compounding pharmacies, laboratory providers, and related healthcare service providers.

These organizations may use information according to their own legal obligations and privacy practices.

Certain Platform functions may be hosted, operated, supported, or facilitated using technology or services provided by Bask Health or other technology vendors.

Information may be processed by such providers as necessary to operate Platform functionality, support account features, facilitate healthcare services, transmit information, administer workflows, maintain systems, or provide other contracted services.

We may disclose information to vendors that perform services for us, including:

• cloud hosting and infrastructure;
• data storage;
• cybersecurity;
• identity verification;
• fraud prevention;
• payment processing;
• customer support;
• email and SMS delivery;
• shipping;
• analytics;
• advertising;
• marketing and attribution;
• website optimization;
• auditing;
• legal services;
• accounting;
• compliance; and
• other business services.

Where required by law, these providers are contractually restricted in how they may process information.

Service providers that process PHI on behalf of a HIPAA-regulated entity must be appropriately authorized to receive such information and subject to applicable contractual and legal requirements.

Subject to applicable law and your privacy choices, we may disclose or make available eligible identifiers, device information, usage information, or marketing information to advertising and analytics providers for measurement, attribution, analytics, campaign management, audience management, and advertising.

Koves does not intend to disclose PHI to advertising networks for behavioral advertising except where expressly permitted by applicable law and, where required, pursuant to a valid authorization.

We may similarly restrict the use of consumer health data for targeted advertising where applicable state law requires consent or otherwise limits such activity.

We may disclose information to attorneys, accountants, auditors, insurers, consultants, and other professional advisors where reasonably necessary and subject to appropriate confidentiality obligations.

We may preserve, access, or disclose information when we reasonably believe doing so is necessary to:

• comply with applicable law;
• respond to lawful legal process;
• comply with a subpoena, warrant, court order, or governmental request;
• enforce agreements;
• investigate fraud or security incidents;
• protect the rights or property of Koves;
• protect the safety of users or others; or
• establish, exercise, or defend legal claims.

Where appropriate and legally permitted, we may challenge or seek to narrow requests that we believe are excessive, invalid, or inconsistent with applicable law.

Information may be disclosed in connection with an actual or proposed merger, acquisition, financing, investment, restructuring, asset sale, bankruptcy, insolvency, reorganization, or similar corporate event.

If personal information is transferred, the recipient remains responsible for processing the information in accordance with applicable law.

We may disclose information when you direct us to do so, request an integration or transaction, authorize the disclosure, or otherwise consent.

Where a specific authorization is legally required for health information, we will seek that authorization separately.

Koves does not sell PHI in exchange for money.

Koves does not intend to sell consumer health data except pursuant to any separate written authorization required by applicable law.

Certain state privacy laws define "sale," "sharing," or "targeted advertising" more broadly than ordinary usage of those terms. Under some of those laws, certain advertising or analytics activities involving cookies, pixels, advertising identifiers, or similar technologies may constitute a "sale" or "sharing" even where no money is exchanged.

Where applicable, eligible users may have the right to opt out of sale of personal information, sharing of personal information for cross-context behavioral advertising, processing for targeted advertising, or certain profiling.

Some information processed through Koves may constitute "consumer health data" under state privacy laws even where that information is not PHI under HIPAA.

Depending on your interaction with Koves, consumer health data may include information that identifies or may reasonably be associated with:

• health conditions;
• symptoms;
• diagnoses;
• treatments;
• medications;
• prescription activity;
• health-related purchases;
• bodily functions;
• physical measurements;
• laboratory information;
• health goals;
• treatment interests;
• reproductive or sexual health information where relevant;
• inferred health information; or
• attempts to seek healthcare services.

Subject to applicable law, consumer health data may be processed to provide services you request, facilitate healthcare services, verify eligibility, operate the Platform, provide support, maintain security, prevent fraud, comply with law, process transactions, improve requested services, conduct permitted research or analytics, and perform other purposes for which appropriate consent has been obtained.

Consumer health data may be disclosed to categories of recipients including healthcare providers, professional medical entities, pharmacies, laboratories, Bask Health, technology processors, service providers, transaction providers where appropriate, security and fraud-prevention vendors, legal and compliance providers, and other entities necessary to provide services you request.

Where applicable law requires affirmative consent before collecting or sharing consumer health data for a particular purpose, Koves will seek that consent.

Where applicable law requires a separate authorization for the sale of consumer health data, Koves will not sell such information without the required authorization.

HIPAA does not apply to every company or every piece of health-related information.

When Koves creates, receives, maintains, or transmits PHI on behalf of a healthcare provider or another HIPAA-regulated entity, Koves may act as a business associate or in another legally recognized capacity.

In those circumstances, Koves may use or disclose PHI only as permitted by HIPAA, applicable Business Associate Agreements, the applicable healthcare provider's Notice of Privacy Practices, legally valid authorizations, and other applicable law.

A healthcare provider's Notice of Privacy Practices, rather than this Privacy Policy alone, may govern your rights regarding medical records held by that provider.

Requests concerning diagnosis, prescriptions, treatment decisions, clinical records, or medical care should generally be directed to the applicable healthcare provider through the appropriate clinical channel.

We may use analytics technologies to understand use of the Platform, including number of visitors, acquisition sources, pages viewed, navigation patterns, device characteristics, approximate geography, engagement, conversion, retention, performance, errors, and user experience.

Analytics providers may use cookies and similar technologies where permitted.

We may configure analytics differently on healthcare-related or authenticated portions of the Platform based on privacy and regulatory requirements.

We may use advertising technologies on appropriate portions of the Platform to measure advertising, attribute customer acquisition, understand campaigns, limit repetitive advertising, create eligible audiences, conduct retargeting where permitted, and improve marketing efficiency.

Depending on the technology and jurisdiction, information may include browser identifiers, cookie identifiers, advertising identifiers, device information, campaign information, referral information, website interaction information, and conversion events.

We do not intend to transmit medical questionnaire responses, diagnosis information, prescription information, medical records, or other PHI to advertising platforms for behavioral advertising unless expressly permitted by law and appropriately authorized where required.

Emails sent by Koves may contain technologies that allow us to determine, where permitted, whether a message was delivered, opened, or clicked; which device or browser was used; whether a transaction occurred after a communication; and similar engagement information.

We may use this information to improve communications, measure effectiveness, reduce irrelevant messages, identify technical issues, and understand engagement.

You may unsubscribe from promotional email by following the unsubscribe instructions in the message.

You may opt out of promotional SMS communications by replying STOP where that functionality is available.

Opting out of marketing communications does not prevent us from sending non-promotional communications, including transaction notices, security alerts, account notices, subscription information, legally required communications, customer-support communications, or messages reasonably necessary to provide requested services.

Depending on your jurisdiction and the technologies used on the Platform, Koves may make available controls that allow you to manage certain categories of cookies, analytics, advertising technologies, and data sharing.

You may also be able to manage cookies through your browser or device. Disabling certain technologies may affect Platform functionality.

Where required by law, Koves may recognize legally valid browser-based opt-out preference signals, such as Global Privacy Control, for the browser or device from which the signal is received.

Depending on where you reside and applicable law, you may have rights relating to your personal information, including the right to:

• know or confirm whether we process personal information;
• access personal information;
• obtain a copy of personal information;
• correct inaccurate personal information;
• delete personal information;
• obtain information regarding categories of data collected, sources, purposes, or recipients;
• opt out of certain sales;
• opt out of targeted advertising;
• opt out of certain profiling;
• limit certain uses of sensitive personal information;
• withdraw consent where applicable;
• appeal certain decisions concerning a privacy request; and
• receive equal service and pricing despite exercising a privacy right, except where otherwise permitted by law.

Rights vary by jurisdiction and are subject to legal exceptions.

To submit a privacy request, contact:

hello@koves.co
or, until a dedicated privacy address is established:
hello@koves.co

We may need to verify your identity before completing a request. Verification may require information reasonably necessary to match you to records maintained by Koves.

Where applicable law permits use of an authorized agent, an authorized agent may submit a request on your behalf. We may require evidence that you authorized the agent, that the agent is legally permitted to act on your behalf, and that your identity can be independently verified.

This section applies to California residents to the extent the California Consumer Privacy Act, as amended ("CCPA"), applies to Koves or the relevant information.

Depending on your interactions with Koves, we may collect identifiers, customer-record information, commercial information, internet or electronic-network activity, approximate geolocation information, professional or employment-related information, audio, electronic, visual, or similar information, sensitive personal information, health-related information, characteristics of protected classifications where voluntarily provided or otherwise lawfully collected, and inferences derived from other personal information.

Subject to applicable exceptions, California residents may have the right to know, access, delete, correct, opt out of sale or sharing, limit certain uses and disclosures of sensitive personal information, and receive non-discriminatory treatment for exercising privacy rights.

Where required, Koves will honor applicable opt-out preference signals.

Residents of states with comprehensive privacy or consumer-health privacy laws may have rights in addition to those described above.

Depending on applicable law, these may include residents of Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, Virginia, Washington, Nevada, and other states that enact applicable privacy requirements.

Koves intends to provide rights required by applicable law without requiring this Privacy Policy to be interpreted as granting rights not otherwise provided by law.

To the extent Washington's My Health My Data Act applies to Koves, eligible consumers may have specific rights concerning consumer health data, including rights to confirm collection, access consumer health data, obtain information regarding sharing, withdraw consent, delete consumer health data, and exercise other rights provided by applicable law.

Where required by Washington law, Koves will obtain separate consent before collecting or sharing consumer health data beyond uses necessary to provide services requested by you. Where required, the sale of consumer health data will require a separate valid authorization.

Koves will make available any separate Consumer Health Data Privacy Policy required by applicable law.

To the extent Nevada privacy or consumer health data laws apply, Nevada consumers may have rights relating to covered personal information or consumer health data maintained by Koves.

Where required by Nevada law, Koves will not collect or share consumer health data without required consent or another applicable legal basis, materially expand categories or purposes without required disclosures and consent, or sell consumer health data without the required written authorization.

Nevada residents may submit applicable requests using the methods described in the Privacy Rights and Requests section above.

Koves uses administrative, technical, and physical safeguards designed to protect information against unauthorized access, acquisition, disclosure, alteration, destruction, loss, and misuse.

Measures may include, as appropriate:

• encryption in transit;
• encryption at rest;
• access controls;
• authentication;
• logging and monitoring;
• vendor security requirements;
• workforce controls;
• incident-response procedures;
• security testing;
• backups;
• vulnerability management; and
• other safeguards appropriate to the nature of the information.

No electronic system, network, storage technology, or transmission method is guaranteed to be completely secure. Accordingly, although Koves takes reasonable steps to safeguard information, we cannot guarantee absolute security.

You are responsible for maintaining the confidentiality of your account credentials and should notify us promptly if you believe your account has been compromised.

Koves maintains procedures intended to identify, investigate, mitigate, and respond to security incidents.

If an incident involving personal information triggers a legal notification obligation, Koves will provide notifications as required by applicable law.

Where Koves processes PHI as a business associate, Koves will comply with applicable HIPAA breach-notification obligations and contractual requirements.

Where the Federal Trade Commission Health Breach Notification Rule or another consumer-health breach law applies, Koves will comply with applicable notification requirements.

Koves retains personal information for the period reasonably necessary to accomplish the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Retention periods may depend on the type of information, the purpose for which it was collected, the duration of your relationship with Koves, account status, transaction requirements, healthcare-record obligations, contractual obligations, tax requirements, fraud-prevention needs, security needs, legal limitation periods, litigation holds, regulatory requirements, and other legitimate business needs.

Different categories of information may therefore have different retention periods.

We may retain aggregated or de-identified information for longer periods where permitted by applicable law.

Deletion of a Koves account does not necessarily require deletion of information that must be retained by law, is maintained by an independent healthcare provider, constitutes part of a legally required medical record, must be retained for fraud prevention, is required for legal claims, is maintained in securely isolated backups pending normal deletion cycles, or is otherwise permitted to be retained by applicable law.

Although Koves may collect information necessary to provide and improve the Platform, access to sensitive information is intended to be limited to personnel, contractors, or processors with a legitimate need for such access.

We may apply role-based or purpose-based restrictions to data depending on sensitivity, legal classification, business function, contractual requirements, and security considerations.

Koves primarily operates in the United States.

Information may be processed or stored in locations where Koves or our service providers maintain systems or personnel, subject to applicable law and contractual requirements.

Where restrictions apply to the geographic processing of PHI or other sensitive information, Koves will process such information in accordance with those restrictions.

The Platform is not intended for individuals under 18 years of age unless Koves expressly makes a particular service available to minors in compliance with applicable law.

Koves does not knowingly solicit personal information from children under 13 through the general Platform.

If we learn that information has been collected from a child in circumstances prohibited by applicable law, we will take appropriate steps to address that information.

The Platform may contain links to or integrations with third-party services. Koves does not control the independent privacy practices of third parties.

Examples may include healthcare providers, pharmacies, laboratories, payment services, social media platforms, shipping companies, and external websites.

You should review the privacy policies and notices of those organizations before providing information to them.

Some browsers offer a "Do Not Track" setting.

Because no single universally accepted standard governs all Do Not Track signals, Koves may not respond to legacy Do Not Track signals unless required by applicable law.

This does not affect our obligation to recognize legally required opt-out preference signals, including Global Privacy Control where applicable.

We may update this Privacy Policy from time to time to reflect changes in law, the Platform, technology, vendors, services, data practices, security developments, or operations.

The "Last Revised" date at the top identifies the most recent version.

If a change materially affects how we process information, we will provide additional notice or obtain consent where required by applicable law.

Where consumer health data laws require affirmative consent before materially expanding categories, recipients, or purposes, we will seek such consent before the applicable new processing begins.

If you have questions about this Privacy Policy, Koves privacy practices, or would like to exercise an applicable privacy right, contact:

Koves LLC
Privacy Officer: Aaron Black, aaron@koves.co
Privacy requests and customer support: hello@koves.co
Website: Koves.co

Questions regarding your diagnosis, prescription, medication, symptoms, treatment plan, medical records, side effects, or other clinical matters should be directed to your licensed Healthcare Provider through the appropriate clinical communication channel.

DO NOT CONTACT KOVES PRIVACY OR CUSTOMER SUPPORT FOR A MEDICAL EMERGENCY. IF YOU BELIEVE YOU ARE EXPERIENCING A MEDICAL EMERGENCY, CALL 911 OR SEEK IMMEDIATE EMERGENCY MEDICAL ATTENTION.