Privacy Policy
Draft for counsel review · Last updated July 2026
Plain-language summary: we collect what we need to provide your care, we protect health information under applicable health-privacy law, we never sell your health data, and you can request access or deletion at any time. The sections below are the details.
1. Who we are
Xilo Health, Inc. ("Xilo", "we") operates this website and the Xilo telehealth platform. Medical services are provided by independent, licensed healthcare providers; laboratory services by accredited laboratory partners; pharmacy services by licensed pharmacies. Each handles your information under its own legal obligations in addition to this policy.
2. Information we collect
- Account information: name, email, state of residence, and login credentials.
- Health information: intake answers, symptoms, medical history, medications, lab results, provider communications, and treatment records.
- Order and payment information: shipping address, order history, and payment method details processed by our payment processor.
- Usage information: device, browser, and interaction data used to keep the service secure and functional.
3. How we use it
- To provide care: routing your intake to a provider, delivering lab results, filling prescriptions, and supporting your plan.
- To operate the service: billing, shipping, support, fraud prevention, and legal compliance.
- To improve the service: aggregate, de-identified analytics that cannot be traced back to you.
- To communicate: care notifications, results, and, only with your consent, marketing you can opt out of at any time.
4. What we never do
- We do not sell your personal or health information.
- We do not share your health information with advertisers or advertising platforms.
- We do not use your health information for marketing without your explicit consent.
5. Health information protections
Health information collected in connection with care is handled in accordance with applicable federal and state health-privacy law, including, where applicable, HIPAA and state consumer-health-data statutes. Access is limited to your care team and the personnel required to operate the service, under confidentiality obligations.
6. Sharing
We share information only with: the providers, labs, and pharmacies involved in your care; service vendors operating under contract and confidentiality (hosting, payments, shipping); and authorities where the law requires it. Business transfers, if any ever occur, would remain bound by this policy's commitments.
7. Your rights
You may request access to, correction of, or deletion of your personal information, subject to medical-record retention laws that may require us to keep clinical records for a legally defined period. Contact care@xilo.example to exercise any right. We respond to verified requests within the timelines your state's law requires.
8. Security
We use encryption in transit and at rest, role-based access controls, and audit logging. No system is perfectly secure; if a breach affects your information, we will notify you as the law requires and tell you plainly what happened.
9. Children
Xilo is for adults 18 and older. We do not knowingly collect information from anyone under 18, and we delete it if we learn we have.
10. Changes
We will post updates here and, for material changes affecting health information, notify you directly before they take effect.
11. Contact
Privacy questions: care@xilo.example.