PRIVACY

MADRES PRIVACY POLICY

Last Updated: August 20, 2026

MADRES LLC ("MADRES," "we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, retain, and protect information when you visit wethemadres.com, create an account, communicate with us, purchase products or services, or otherwise use our websites, applications, portals, and services that link to this Privacy Policy (collectively, the "Services").

This Privacy Policy is intended to provide notice about our information practices. It does not replace any Notice of Privacy Practices, telehealth consent, authorization, or other privacy notice provided by an independent healthcare provider, medical practice, pharmacy, or other healthcare entity.

By using the Services, you acknowledge that you have had an opportunity to review this Privacy Policy. Where applicable law requires your affirmative consent to a particular collection, use, or disclosure of information, MADRES will obtain that consent separately.

1. WHO WE ARE

MADRES LLC is a Wyoming limited liability company operating primarily in Florida.

MADRES LLC
12555 Biscayne Blvd #1006
North Miami, FL 33181

MADRES operates a technology and administrative platform that may facilitate access to independent, licensed healthcare providers, medical practices, pharmacies, laboratories, and other healthcare-related service providers.

MADRES is not itself a healthcare provider, medical practice, pharmacy, or insurer.

The healthcare providers and medical practices that provide clinical services through or in connection with the Services are responsible for the medical care they provide, including diagnosis, treatment, prescribing, and clinical decision-making.

2. MADRES'S ROLE AND HEALTH INFORMATION

The information you provide to MADRES may include information that relates to your health.

However, not all health-related information handled by MADRES is necessarily "protected health information" ("PHI") under HIPAA.

Whether HIPAA applies to MADRES depends on the particular services being provided, the role MADRES performs, the applicable contractual relationships, and the circumstances under which information is received and processed.

MADRES will not represent that all health information collected through the Services is HIPAA-protected simply because it concerns health.

Where MADRES acts as a Business Associate of a HIPAA-covered entity, MADRES will handle PHI in accordance with the applicable Business Associate Agreement, HIPAA, and other applicable law.

Where information is maintained by an independent healthcare provider or medical practice as part of your medical record, that provider or practice may have its own Notice of Privacy Practices governing the use and disclosure of that information.

Your healthcare provider's Notice of Privacy Practices controls the provider's use and disclosure of PHI maintained by that provider.

Similarly, pharmacies, laboratories, and other healthcare entities may have their own privacy obligations and notices.

MIDI and Winona use a similar structural distinction: their platform privacy policies distinguish platform-level personal data from health information handled by medical groups and pharmacies, while acknowledging that the platform may become a Business Associate in certain circumstances.

3. INFORMATION WE COLLECT

Depending on how you interact with MADRES, we may collect the following categories of information.

A. Information You Provide Directly

This may include:

name;
mailing and shipping address;
email address;
telephone number;
date of birth;
account credentials;
identity-verification information;
payment and billing information;
information submitted through intake forms;
symptoms and health history;
current and prior medications;
allergies;
treatment history;
reproductive or sexual-health information;
photographs;
laboratory results;
documents you upload;
communications with MADRES;
customer-service communications;
information you provide when requesting a particular product or service; and
information you voluntarily provide in surveys, reviews, feedback, or other communications.

Some of this information may constitute sensitive personal information, consumer health data, or PHI, depending on applicable law and the context in which it is collected.

4. INFORMATION WE COLLECT AUTOMATICALLY

When you visit or use the Services, we may automatically collect information about your device and interactions with our Services.

This may include:

IP address;
browser type;
operating system;
device identifiers;
approximate location;
pages viewed;
referring and exit pages;
dates and times of access;
links clicked;
search terms;
interaction with forms and pages;
cookies and similar identifiers; and
information concerning how you interact with our Services.

Some information collected through these technologies may constitute personal information or consumer health data, particularly where it can reasonably reveal or infer an individual's interest in, attempt to obtain, or receipt of healthcare services.

For this reason, MADRES treats website tracking and advertising technology involving health-related pages as a significant privacy and compliance issue.

5. INFORMATION WE RECEIVE FROM THIRD PARTIES

We may receive information from third parties, including:

independent healthcare providers;
medical practices;
pharmacies;
laboratories;
Beluga Health and its applicable network;
CarePortals or other clinical technology platforms;
payment processors;
identity-verification providers;
shipping and logistics providers;
customer-service and communications platforms;
fraud-prevention providers;
analytics providers; and
other service providers that assist us in providing the Services.

The information received may include account information, transaction information, prescription or fulfillment status, appointment information, clinical information, or other information necessary to provide or administer the Services.

6. HOW WE USE INFORMATION

We may use information we collect for the following purposes:

Providing and administering the Services

Including to:

create and maintain accounts;
facilitate healthcare-provider interactions;
facilitate telehealth services;
facilitate prescription fulfillment;
process orders;
coordinate shipping;
process payments;
provide customer support;
communicate with you regarding your account;
verify your identity and eligibility;
authenticate users;
prevent fraud and abuse; and
provide requested products and services.

Business operations

We may also use information to:

maintain and improve our technology;
troubleshoot technical problems;
monitor system performance;
conduct quality assurance;
analyze business performance;
maintain security;
detect and prevent fraud;
enforce our agreements;
comply with legal obligations; and
protect the rights, safety, and property of MADRES and others.

Communications

We may send service-related communications concerning:

appointments;
account activity;
payments;
prescriptions;
orders;
shipping;
security;
customer service;
changes to Services; and
other matters necessary to administer your relationship with MADRES.

Marketing

Where permitted by applicable law, we may use contact information to send promotional or educational communications about MADRES.

You may unsubscribe from marketing emails by using the unsubscribe mechanism included in the communication.

We will not condition access to healthcare services on consent to receive marketing communications.

7. CONSUMER HEALTH DATA

Certain information handled by MADRES may constitute "consumer health data" under state laws, including the Washington My Health My Data Act and Nevada's consumer health-data privacy law.

Consumer health data may include information relating to:

health conditions;
symptoms;
diagnoses;
treatments;
medications;
reproductive health;
sexual health;
bodily functions;
physical characteristics;
healthcare services sought or received;
information that may reveal an individual's attempt to obtain healthcare services; and
inferences drawn from other information that relate to health.

Washington law specifically requires covered businesses to publish a consumer-health-data privacy policy identifying categories of health data collected, sources, sharing categories, third parties, purposes, and consumer rights.

MADRES intends this Privacy Policy to provide those disclosures for the consumer-health data that MADRES itself collects and processes, to the extent applicable.

8. SOURCES OF CONSUMER HEALTH DATA

MADRES may obtain consumer health data:

Directly from you, including through intake forms, questionnaires, communications, purchases, and other interactions.
From healthcare providers and medical practices, where necessary to administer Services or where otherwise authorized or permitted by law.
From pharmacies and laboratories, where necessary to administer fulfillment or related Services.
From technology platforms, including clinical and administrative systems used in connection with your Services.
Automatically through your interactions with the Services, including information concerning pages or features you access.
From service providers, where necessary to provide, secure, or administer the Services.

9. PURPOSES FOR COLLECTING AND USING CONSUMER HEALTH DATA

MADRES may collect and use consumer health data for purposes including:

facilitating requested healthcare services;
facilitating communications with healthcare providers;
facilitating prescription fulfillment;
processing orders and payments;
providing customer support;
administering accounts;
verifying identity and eligibility;
preventing fraud;
maintaining security;
operating and improving the Services;
troubleshooting;
complying with legal obligations;
responding to legal process;
protecting users and others; and
other purposes disclosed to you at or before collection or otherwise permitted by law.

MADRES will not use consumer health data for a materially different purpose without providing additional notice and obtaining consent where required by applicable law.

10. HOW WE SHARE INFORMATION

We may disclose information to the following categories of recipients.

Healthcare providers and medical practices

To facilitate medical evaluation, telehealth services, communications, prescribing, and other clinical services you request.

Pharmacies

To facilitate prescription fulfillment, dispensing, shipping, pharmacy communications, and related services.

Laboratories

To facilitate laboratory testing, processing, reporting, and related services when applicable.

Beluga Health

To facilitate clinical, administrative, pharmacy, or other services provided through the applicable Beluga Health network and contractual arrangements.

CarePortals and other clinical technology providers

To facilitate intake, scheduling, communications, clinical workflows, records, and other healthcare-related administrative functions.

Payment processors

To process payments, refunds, billing, fraud prevention, and related transactions.

Technology and business service providers

Including providers of:

hosting;
cloud infrastructure;
email;
CRM;
customer support;
identity verification;
analytics;
security;
fraud prevention;
communications;
scheduling;
shipping; and
other operational services.

These providers may process information only as necessary to provide contracted services and subject to applicable contractual and legal requirements.

Professional advisers

We may disclose information to attorneys, accountants, auditors, insurers, consultants, and other professional advisers where reasonably necessary.

Legal and safety purposes

We may disclose information when reasonably necessary to:

comply with law;
respond to subpoenas, court orders, or other legal process;
protect the rights, safety, or property of MADRES or others;
investigate fraud or security incidents;
enforce our Terms or other agreements; or
comply with governmental requests.

Corporate transactions

If MADRES is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, information may be transferred as part of that transaction, subject to applicable law.

11. ADVERTISING, TRACKING, AND HEALTH INFORMATION

This is an area I would treat as a hard operational rule for MADRES, not merely a disclosure issue.

MADRES may use cookies, analytics, and similar technologies for website functionality, security, performance measurement, and other legitimate business purposes.

However, MADRES does not intend to disclose identifiable health information or consumer health data to third-party advertising platforms for targeted advertising without legally sufficient authorization or consent.

We will not knowingly configure advertising technologies to transmit sensitive health information from clinical portals, intake forms, provider communications, or other areas where users reasonably expect health information to remain private.

Depending on applicable law and the specific technology used, certain cookie or advertising activities may nevertheless constitute "sale," "sharing," or targeted advertising under state privacy laws.

Accordingly, MADRES may provide privacy controls, consent mechanisms, or opt-out mechanisms where required.

MADRES will not rely on a generic statement that "we do not sell your data" if our actual technology stack constitutes a statutory sale or sharing of personal information.

This is particularly important because the FTC has brought enforcement actions against telehealth and health-related companies involving disclosure of health information to advertising platforms, including cases involving tracking pixels and similar technologies.

12. COOKIES AND SIMILAR TECHNOLOGIES

We may use:

strictly necessary cookies;
functional cookies;
analytics technologies;
security technologies;
preference technologies; and
advertising or marketing technologies, where permitted.

We may use tools such as Google Analytics or other analytics services.

The exact technologies used by MADRES may change over time.

Where required, we will provide mechanisms to:

accept or reject non-essential cookies;
manage certain privacy preferences;
opt out of targeted advertising;
exercise applicable privacy rights; and
respond to legally recognized universal opt-out signals.

Before launch, the actual MADRES cookie/pixel inventory should be mapped to this section.

That means identifying every:

Meta Pixel;
Google tag;
TikTok pixel;
analytics SDK;
CRM script;
session-recording tool;
heat-map tool;
advertising conversion tool; and
other third-party script

on the marketing site, quiz/intake, checkout, customer portal, and post-purchase pages.

I would specifically recommend no advertising pixels on the clinical intake or patient portal unless counsel has affirmatively approved the exact implementation.

13. MARKETING COMMUNICATIONS

You may receive marketing communications from MADRES if you have requested them or where otherwise permitted by law.

For example, you may receive information concerning:

MADRES services;
educational content;
women's health topics;
product updates;
promotions; or
other MADRES offerings.

You can unsubscribe from promotional emails at any time by clicking the unsubscribe link in the communication.

Unsubscribing from marketing communications does not prevent us from sending necessary service-related communications.

If you provide your phone number, text-message marketing will be handled separately in accordance with applicable consent and messaging laws.

14. PAYMENT INFORMATION

Payments made through the Services may be processed by third-party payment processors.

MADRES generally does not need to retain complete payment-card information when the applicable payment processor handles that information on our behalf.

Payment processors may collect and process information under their own privacy policies and contractual obligations.

We may retain transaction information such as:

amount;
date;
payment status;
billing information;
refund status; and
limited payment-method information.

15. DATA SECURITY

MADRES maintains administrative, technical, and physical safeguards designed to protect information against unauthorized access, acquisition, use, alteration, or disclosure.

Depending on the information and applicable legal obligations, safeguards may include:

access controls;
authentication;
encryption;
logging and monitoring;
vendor security requirements;
employee confidentiality obligations;
incident-response procedures;
data minimization; and
security assessments.

No method of transmitting or storing information is completely secure.

Accordingly, we cannot guarantee absolute security.

Where MADRES is subject to HIPAA as a Business Associate, our security practices for applicable PHI will also be governed by the applicable Business Associate Agreement and HIPAA requirements.

Washington's My Health My Data Act and Nevada's consumer-health-data law also impose specific security obligations for covered consumer health data.

16. DATA BREACHES AND SECURITY INCIDENTS

If MADRES experiences a security incident involving personal information or health information, we will investigate the incident and provide notices required by applicable federal and state law.

Depending on the nature of the information and MADRES's legal role, different breach-notification requirements may apply, including requirements under:

HIPAA;
state data-breach laws;
state consumer-health-data laws;
the FTC Health Breach Notification Rule; and
other applicable laws.

MADRES will comply with the notification obligations applicable to the information and circumstances involved.

The FTC's Health Breach Notification Rule can apply to certain health apps and online health services even when HIPAA does not apply, making it important not to treat HIPAA compliance as the only health-data privacy framework relevant to MADRES.

17. DATA RETENTION

MADRES retains information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to:

provide Services;
maintain accounts;
fulfill transactions;
comply with legal obligations;
comply with contractual obligations;
resolve disputes;
enforce agreements;
maintain business records;
protect against fraud; and
comply with applicable record-retention requirements.

Different categories of information may have different retention periods.

Clinical records maintained by healthcare providers are subject to the provider's applicable record-retention obligations and policies and may be retained independently of MADRES.

MADRES does not promise that all information will be deleted immediately upon account cancellation or a deletion request where retention is required or permitted by law.

18. YOUR PRIVACY RIGHTS

Depending on where you live and the laws applicable to your information, you may have rights concerning your personal information or consumer health data.

These rights may include:

confirming whether we process information about you;
accessing personal information;
obtaining a copy of certain information;
correcting inaccurate information;
requesting deletion;
withdrawing consent where applicable;
opting out of certain sales or sharing;
opting out of targeted advertising;
opting out of certain profiling;
requesting information about categories of third parties with whom information has been shared; and
appealing certain decisions concerning your privacy request.

Some rights are subject to exceptions and limitations under applicable law.

For example, information that must be retained for legal, security, fraud-prevention, or other legally permitted purposes may not be deleted even when a deletion request is otherwise valid.

19. CONSUMER HEALTH DATA RIGHTS

Where Washington's My Health My Data Act, Nevada's consumer-health-data law, or another applicable consumer-health privacy law applies, you may have additional rights concerning consumer health data.

These may include the right to:

confirm whether MADRES collects, shares, or sells consumer health data;
access consumer health data;
obtain information concerning third parties with whom consumer health data has been shared;
withdraw applicable consent;
request deletion; and
appeal a denied privacy request.

Washington's law expressly provides consumer rights concerning access, deletion, consent withdrawal, and appeals.

Nevada's law similarly provides rights to confirm collection/sharing/sale, obtain information concerning third parties, cease certain processing, and request deletion.

MADRES will maintain procedures for handling these requests as required by applicable law.

20. HOW TO EXERCISE YOUR RIGHTS

To submit a privacy request, contact:

privacy@wethemadres.com

You may be asked to provide information reasonably necessary to verify your identity and protect against fraudulent requests.

MADRES will respond within the time period required by applicable law.

If applicable law gives you the right to appeal a decision concerning your request, MADRES will provide instructions for submitting an appeal.

MADRES will not discriminate against you for exercising privacy rights to the extent prohibited by applicable law.

21. AUTHORIZED AGENTS

Where permitted by applicable law, you may designate an authorized agent to submit a privacy request on your behalf.

MADRES may require verification of both:

your identity; and
the agent's authority to act on your behalf.

22. CALIFORNIA RESIDENTS

If you are a California resident, you may have additional rights under the California Consumer Privacy Act, as amended ("CCPA"), depending on whether and how the CCPA applies to MADRES and the particular information involved.

These rights may include rights to:

know/access certain personal information;
correct inaccurate personal information;
delete personal information;
opt out of certain sales or sharing;
limit certain uses of sensitive personal information;
obtain information about disclosures; and
receive equal treatment for exercising applicable rights.

Certain information may be exempt from some CCPA rights, including information regulated by HIPAA or other laws.

MADRES will provide California-specific disclosures and mechanisms where required.

This section should be finalized after the launch-state analysis and actual MADRES data map are completed.

23. WASHINGTON AND NEVADA CONSUMER HEALTH DATA

MADRES will maintain and publish this Privacy Policy in a manner intended to satisfy applicable consumer-health-data privacy requirements.

Where required by law, MADRES will obtain affirmative consent before collecting or sharing consumer health data beyond what is necessary to provide a product or service you requested.

Washington's statute specifically restricts collection, use, and sharing of consumer health data beyond disclosed categories and purposes without additional disclosure and consent.

Nevada similarly requires affirmative, voluntary consent for certain collection and sharing of consumer health data and imposes specific disclosure and consumer-rights requirements.

24. CHILDREN'S PRIVACY

The Services are intended for individuals who are at least eighteen (18) years old.

We do not knowingly collect personal information from individuals under eighteen through the Services.

If you believe that an individual under eighteen has provided personal information to MADRES, please contact us at privacy@wethemadres.com.

If we learn that we have collected information from an individual under eighteen in circumstances where collection was not permitted, we will take appropriate steps consistent with applicable law.

25. THIRD-PARTY WEBSITES AND SERVICES

The Services may contain links to websites, applications, products, or services operated by third parties.

Those third parties may have their own privacy policies.

MADRES is not responsible for the privacy practices of third-party websites or services that MADRES does not control.

This Privacy Policy applies only to information collected or processed by MADRES and does not govern information collected directly by independent healthcare providers, pharmacies, laboratories, or other third parties acting independently.

26. BUSINESS TRANSFERS

If MADRES is involved in a merger, acquisition, financing, restructuring, bankruptcy, sale of assets, or similar corporate transaction, information may be transferred as part of that transaction.

Any such transfer will be conducted subject to applicable privacy and healthcare laws.

Where legally required, we will provide notice or obtain consent.

27. DE-IDENTIFIED AND AGGREGATED INFORMATION

Where permitted by law, MADRES may create or receive information that has been de-identified, aggregated, or otherwise processed so that it is no longer reasonably capable of identifying an individual.

MADRES may use such information for legitimate business purposes, including:

analytics;
research;
product development;
service improvement;
operational planning; and
other purposes permitted by law.

Where HIPAA applies, de-identification will be performed consistent with applicable HIPAA requirements.

28. DO-NOT-TRACK AND GLOBAL PRIVACY CONTROL

Certain browsers and devices provide privacy signals, including the Global Privacy Control ("GPC").

Where required by applicable law, MADRES will treat legally recognized universal opt-out preference signals as requests to opt out of applicable sales, sharing, or targeted advertising.

Other browser "Do Not Track" signals may not have a standardized legal meaning.

MADRES's response to such signals will depend on applicable law and the configuration of our Services.

29. CHANGES TO THIS PRIVACY POLICY

MADRES may update this Privacy Policy from time to time.

When we make changes, we will update the "Last Updated" date.

If we make material changes that require additional notice or consent under applicable law, we will provide that notice or obtain the required consent.

Your continued use of the Services after an updated Privacy Policy becomes effective does not by itself constitute consent where applicable law requires affirmative consent.

30. CONTACT US

If you have questions about this Privacy Policy or want to exercise applicable privacy rights, contact:

MADRES LLC
12555 Biscayne Blvd #1006
North Miami, FL 33181

Privacy: privacy@wethemadres.com
Phone: 786-505-4790