1. Scope of This Notice
This notice is provided by Empower Capital Group LLC ("Tor Health," "we," "us," or "our") under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (together, the "CCPA"). It describes the personal information we collected about California residents in the past twelve (12) months, why we collected it, who we disclosed it to, and the rights you have.
Medical information governed by the California Confidentiality of Medical Information Act and protected health information governed by HIPAA are exempt from the CCPA. That information, which includes your intake answers, prescriptions, clinician messages, and laboratory results, is protected under those laws as described in our HIPAA Notice. This notice covers the rest of the personal information we handle, such as your account, contact, order, and website information.
2. Personal Information We Collect
In the past twelve months we have collected the following categories of personal information:
- Identifiers — name, email address, phone number, postal and shipping address, account username, IP address, and device identifiers.
- Customer records (Cal. Civ. Code § 1798.80(e)) — the above, plus your billing address and the last four digits of your payment card. Full card numbers are handled by our payment processors and are not stored by us.
- Characteristics of protected classifications — age and date of birth, and sex or gender, where you provide them.
- Commercial information — the products and subscriptions you order, your order and payment history, and promotions you use.
- Internet or other electronic network activity — pages you view on the patient platform, the steps you complete in an intake, and session and error diagnostics.
- Geolocation data — your state of residence and shipping address, and an approximate location derived from your IP address. We do not collect precise geolocation from your device.
- Sensitive personal information — account login credentials, government ID and photo used to verify your identity, and information about your health that is not otherwise exempt.
We collect this information directly from you, automatically from your device when you use our website and patient platform, and from service providers that help us verify identity, process payments, and deliver orders.
3. How We Use Personal Information
- To create and maintain your account, process your orders and subscriptions, and arrange shipping;
- To connect you with the clinicians of the affiliated medical groups who review your intake, and with the partner pharmacy that fills any prescription;
- To verify your identity and state of residence, which state telehealth laws require;
- To provide customer support and send you service messages about your account, orders, and care;
- To send you marketing emails and, where you have separately opted in, marketing text messages;
- To keep our services secure, detect and prevent fraud, and fix errors;
- To understand how our website and patient platform are used and improve them; and
- To comply with the law and protect our rights and the rights of others.
We use sensitive personal information only to provide the services you request, verify your identity, keep our services secure, and comply with the law, which are the purposes the CCPA permits without offering a right to limit.
4. How We Disclose Personal Information
In the past twelve months we have disclosed each category of personal information listed above, for a business purpose, to the following categories of recipients:
- The affiliated professional medical groups and their clinicians, who evaluate and treat you;
- Partner pharmacies and laboratories, for prescriptions and tests your clinician orders;
- Service providers that act on our instructions, including our technology platform provider (Medstra Inc DBA Cuvo Health), cloud hosting, payment processors, identity verification, email and text-message delivery, product analytics, and error monitoring; and
- Government authorities or other parties, when the law requires it or to protect rights, safety, and property.
Because we do not sell or share personal information, we do not offer a "Do Not Sell or Share My Personal Information" link. If that ever changes, we will update this notice first, offer an opt-out, and honor opt-out preference signals such as Global Privacy Control.
5. How Long We Keep Personal Information
We keep account, order, and payment records for as long as your account is open and then for as long as tax, accounting, and corporate law require, generally up to seven years. Marketing preferences are kept until you unsubscribe. Website and platform diagnostics are kept for a limited period and then deleted or de-identified. Medical records, which this notice does not cover, are kept by the treating medical group for at least ten years from the last date of service.
6. Your California Privacy Rights
Subject to the exceptions in the law, you have the right to:
- Know the categories of personal information we collected about you, the categories of sources, the purposes, the categories of recipients, and the specific pieces of personal information we hold;
- Delete personal information we collected from you;
- Correct inaccurate personal information;
- Opt out of the sale or sharing of personal information (we do neither);
- Limit the use of sensitive personal information (we already use it only for permitted purposes); and
- Not be discriminated against for exercising any of these rights. We will not deny you services, charge you a different price, or give you a different level of service because you made a request.
7. How to Make a Request
To make a request to know, delete, or correct, email [privacy@bytorhealth.com](mailto:privacy@bytorhealth.com). Please include your name, the email address on your account, and the right you want to exercise.
Verification. We verify your identity before fulfilling a request by matching the information you give us with the information in our records, and we may ask for more if a request involves sensitive information. We will never ask for your full payment card number to verify a request.
Authorized agents. You may use an authorized agent to make a request for you. We will ask the agent for your signed permission and may ask you to verify your own identity with us directly. We may deny a request from an agent who does not show that you authorized it.
Timing. We confirm receipt of a request within 10 business days and respond within 45 calendar days. If we need more time, up to another 45 days, we will tell you why. Requests to know are answered for the twelve months before the request unless you ask for a longer period and the law allows it.
8. Shine the Light
California Civil Code § 1798.83 lets California residents ask which personal information a business disclosed to third parties for their own direct-marketing purposes in the preceding calendar year. We do not disclose personal information to third parties for their direct-marketing purposes.
9. Contact Us
Questions about this notice or our privacy practices may be sent to: Empower Capital Group LLC, Attn: Privacy Team, 900 Church St, Apt 610, Nashville, TN 37203; email privacy@bytorhealth.com. We review this notice at least once every twelve months and post any change here with a new "Last updated" date.