Legal
Consumer Health Data Privacy Policy
Effective: September 2, 2026 · Last updated: September 2, 2026
This Consumer Health Data Privacy Policy describes how XCeed Health LLC (“XCeed,” “we,” “us,” or “our”) collects, uses, shares, and protects consumer health data, and how you can exercise your rights over it.
This policy applies in addition to our general Privacy Policy. Where this policy and the general Privacy Policy address the same subject, this policy controls for consumer health data. This policy is provided to meet the requirements of Washington’s My Health My Data Act, Nevada’s consumer health data law, and comparable consumer health data provisions in other states.
1. What “consumer health data” means
Consumer health data means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. Under Washington law this category is broad. It includes, among other things, health conditions and symptoms, medications you use or purchase, medical interventions, bodily functions and vital signs, measurements such as height and weight, and information that identifies you as someone seeking health care services. It also includes information that is derived or inferred about your health from data that is not itself health data.
Because XCeed operates a platform through which people seek a clinical evaluation and prescription products, we treat the following as consumer health data by default, even where the law might not clearly require it: the fact that you visited a product page, started or completed a medical intake, or placed an order.
2. How XCeed’s role affects this policy
XCeed is a technology and marketing platform. XCeed is not a health care provider, does not practice medicine or pharmacy, and does not make treatment decisions.
- XCeed operates the website and mobile app, the training and coaching experience, billing, and customer support.
- The physician network is an independent network of licensed physicians. It performs your clinical evaluation, makes all treatment decisions, and holds your medical record. It is a HIPAA covered health care provider.
- Licensed pharmacy partners compound, dispense, and ship any prescription. They are separately subject to HIPAA and state pharmacy law.
Why this matters for your rights. Information that qualifies as protected health information under HIPAA, and information that originates from and is intermingled so as to be indistinguishable from such information held by a covered entity or its business associate, is excluded from Washington’s consumer health data framework. In practice this means:
- The clinical record created and held by the physician network, including your intake responses as reviewed by a provider, your diagnosis, your prescription, and your provider communications, is governed by HIPAA. To exercise rights over that record, including requesting a copy or an amendment, contact the physician network directly.
- Consumer health data that XCeed collects and holds in its own systems, including website and app activity, order and billing records, and support communications, is governed by this policy.
If you are not sure which category your information falls into, contact us and we will tell you, and we will forward your request to the physician network where that is the correct route.
3. Categories of consumer health data we collect, and why
| Category | Examples | Why we collect it |
|---|---|---|
| Information indicating you are seeking health care services | That you visited a product page, started a medical intake, or created an account | To operate the site and app, route you to the correct intake, provide customer support, and measure aggregate site performance |
| Health history and clinical questionnaire responses | Health conditions, medications, allergies, goals, height, weight | To transmit your intake to the independent physician network so a provider can evaluate you. XCeed collects this through its interface for the purpose of that transmission |
| Use or purchase of prescribed medication | What you ordered, dosage form, quantity, refill and renewal history, subscription status | To process payment, coordinate fulfillment with the pharmacy, manage your subscription and renewals, and provide customer support |
| Health-related support communications | Messages you send to customer support that describe a symptom, side effect, or condition | To respond to your request, and to route safety concerns to the physician network |
| Coaching and training activity | Workouts logged, program progress, body measurements you choose to enter | To operate the training and coaching experience you asked for |
| Identifiers linked to the above | Name, email, phone, shipping address, account ID, device identifiers, IP address, cookie identifiers | To operate your account, secure our systems, prevent fraud, and connect your order to your intake |
We do not collect consumer health data for any purpose other than those listed above. We do not use consumer health data to make advertising or targeting decisions.
4. Categories of sources
- From you directly. Information you enter on our website or in our app, including account details, intake responses, order information, and support messages.
- Automatically from your device. Information collected through cookies and similar technologies when you use our website or app, as described in Section 7.
- From the physician network. Limited status information necessary to operate billing and fulfillment, such as whether a case was approved, declined, or cancelled, and whether a prescription was issued. XCeed does not receive your clinical notes or diagnosis for marketing purposes.
- From our pharmacy partners. Fulfillment and shipping status.
- From our payment processor. Transaction status and limited payment metadata. XCeed does not store full payment card numbers.
5. Categories of consumer health data we share, and who receives it
We share consumer health data only where it is necessary to provide the service you requested, to comply with law, or to protect someone’s safety. The table below lists the categories of third parties and the specific affiliates that receive it.
| Recipient | What they receive | Purpose |
|---|---|---|
| MD Integrations, Inc., the independent physician network | Your intake and health history, identifiers, and the product and dosage you requested | Clinical evaluation and prescribing |
| Licensed compounding pharmacy partners | Your prescription as issued by the provider, identifiers, and shipping address | Compounding, dispensing, and shipping |
| Payment processor | Order amount, product identifier, and identifiers necessary to process the charge | Payment processing, refunds, and fraud prevention |
| Cloud hosting and infrastructure providers | Data stored or transmitted through our systems, in the ordinary course of hosting | Operating the website, app, and databases |
| Customer support platform | Your support messages and account details, which may include health information you choose to share | Responding to your support requests |
| Email and text message providers | Identifiers and transactional message content relating to your order, shipment, or account | Sending you order, shipping, and account notifications |
| Shipping carriers | Name and delivery address | Delivering your shipment |
| System2 Technologies Corp., our parent company, and its personnel | Access to the categories above as needed to perform services for XCeed | XCeed has no employees of its own. Management, marketing, technology, and support services are performed for XCeed by personnel of System2 Technologies Corp. under a written intercompany services agreement, subject to the same restrictions in this policy |
| Professional advisors, including legal and accounting | Only what is necessary for the specific engagement | Legal advice, audit, and compliance |
| Government authorities and parties to legal process | Only what is required | Complying with law, responding to lawful legal process, and protecting rights, property, or safety |
| An acquirer or successor | Data transferred as part of the transaction | A merger, acquisition, financing, or sale of assets, subject to this policy or a successor policy providing comparable protection |
Every processor that receives consumer health data from us is contractually restricted to processing it only for the purpose we specify and only in accordance with this policy. A processor that uses your consumer health data outside those instructions is acting as a controller in its own right and is directly responsible for that use.
We do not share consumer health data with advertising platforms. We do not send consumer health data to Meta, Google, TikTok, Snap, Microsoft, or any other advertising or ad measurement platform, and we do not upload customer or patient lists to those platforms for audience building, matching, or lookalike targeting.
6. We do not sell consumer health data
We do not sell your consumer health data, and we do not exchange it for monetary or other valuable consideration. If that ever changes, we will not do it without first obtaining your separate written authorization that meets the specific requirements of applicable law, and we will update this policy before doing so. Access to our products and services will never be conditioned on your signing such an authorization.
7. Cookies, pixels, and similar technologies
We use cookies and similar technologies on our website and app. How we use them depends on where you are in the experience, and we deliberately treat different parts of the site differently.
- On general marketing and educational pages, we use analytics and advertising technologies to measure traffic and campaign performance. These do not receive information about your health, the products you viewed, your intake, or your orders.
- On product pages, medical intake pages, checkout, and any logged-in account or portal page, we do not permit third-party advertising or ad measurement technologies to operate. On these pages we use only technologies that are strictly necessary to make the page function and secure, such as session management, load balancing, and fraud prevention.
- We do not fire advertising or analytics events on health-revealing actions. We do not send a third party a signal that you started or completed an intake, that you placed an order, that a prescription was issued, or that a provider approved or declined a case.
Measurement of our own marketing performance is done using first-party data held in our own systems, which is not disclosed to advertising platforms.
You can control cookies through your browser settings, and you can withdraw consent at any time as described in Section 8. Blocking strictly necessary cookies may prevent parts of the site from working.
8. Your rights
If you are a Washington resident, or your consumer health data is collected in Washington, you have the right to:
- Confirm whether we are collecting, sharing, or selling your consumer health data, and to access that data, including a list of all third parties and affiliates with whom we have shared or to whom we have sold it, along with an active email address or other online contact for each of them.
- Withdraw your consent to our collection and sharing of your consumer health data.
- Delete your consumer health data.
- Appeal a decision if we decline your request.
Nevada and Connecticut residents have substantially similar rights under their own state consumer health data laws, and we honor requests from residents of those states on the same terms. Residents of other states may also have rights under general state privacy laws, described in our general Privacy Policy.
What deletion reaches, and what it does not. When you ask us to delete your consumer health data, we will delete it from our own records and from our archived and backup systems, and we will notify all processors and affiliates that received it to do the same. Deletion does not reach:
- Records the physician network or a pharmacy is required by law to retain. Those are governed by HIPAA and state law, not by this policy, and you must contact those parties directly.
- Records we are required by law to keep, such as transaction records required for tax or financial reporting.
We will tell you specifically which records we could not delete and why.
Withdrawing consent. Withdrawing consent stops future collection and sharing. It does not by itself delete data already collected, and it does not undo a disclosure already made to a provider or pharmacy in order to fulfill an order you placed. If you withdraw consent for collection necessary to operate your account or fulfill a pending order, we may not be able to continue providing the service, and we will tell you that before acting on your request.
9. How to exercise your rights
Send your request to support@xceedlife.com with the subject line “Consumer Health Data Request,” or write to us at the address in Section 13. Tell us what you are asking for and the email address or phone number on your account.
- We will verify your identity before acting on a request. Verification uses information already associated with your account and is limited to what is necessary to confirm the request is yours.
- We will respond within 45 days. If we need more time, we may extend once by another 45 days, and we will tell you why before the first period ends.
- There is no fee for a request, and we will not discriminate against you or degrade your service for making one.
- An authorized agent may make a request on your behalf with your written permission, and we may ask you to verify that permission directly.
If we decline. We will tell you why, and you may appeal by replying to our decision or writing to support@xceedlife.com with the subject line “Consumer Health Data Appeal.” We will respond to an appeal in writing within 45 days, explaining the reasons for our decision. If we deny your appeal, we will give you a method to contact the Washington State Attorney General’s Office, or the attorney general of your state, to submit a complaint.
10. Retention
We keep consumer health data only as long as we need it for the purpose we collected it, and then we delete or de-identify it. Concretely:
- Website and app activity data associated with a health-related action is retained no longer than necessary for security, fraud prevention, and service operation.
- Order, billing, and subscription records are retained for as long as your account is active and afterward for the period required by tax, financial, and consumer protection law.
- Support communications are retained for as long as necessary to resolve your issue and to handle any related dispute, and health information volunteered in a support message is redacted or suppressed at intake where our systems allow.
11. Security and internal access
We use administrative, technical, and physical safeguards designed to protect consumer health data, including encryption in transit, access controls, and logging.
Access to consumer health data inside our organization is restricted to the specific personnel who need it to perform a defined function, such as customer support or fulfillment coordination. Personnel who do not need it, including marketing personnel, do not have access to it. No system is completely secure, and we cannot guarantee absolute security.
12. Changes to this policy
We may update this policy. If we make a material change to what we collect, how we use it, or who we share it with, we will notify you as required by law before the change takes effect, and we will not apply a new use or a new sharing category to data we already collected without first obtaining your consent for that new purpose. The “last updated” date at the top reflects the most recent revision.
13. Contact us
XCeed Health LLC
2261 Market Street #4048
San Francisco, CA 94114
United States