How we handle your information.

A platform, not a pharmacy or a medical practice.

LuneRx, operated by The Piper Group, runs this website, the free eligibility check on it, and the support around them. We are a marketing and technology platform. We are not a pharmacy and not a healthcare provider, and we do not prescribe, dispense, treat, or give medical advice.

Care is provided by an independent medical group of licensed providers. Prescriptions, where a provider issues one, are filled and shipped by state-licensed partner pharmacies. Those are separate organizations. They hold their own records about you and handle them under their own legal obligations, which are not covered by this policy.

This policy covers the information you give to LuneRx through this website, and the information this website collects automatically while you use it.

It should be read alongside our Terms and Conditions, and, for information held by the medical group and the pharmacy, our HIPAA Notice of Privacy Practices.

What we collect.

The eligibility check is the main thing this site collects, and it collects health-related information. Here is the complete list of what it asks for and sends:

• Contact details — your first and last name, email address, and mobile phone number.
• Your state of residence and your date of birth.
• Your height and your weight, and the body-mass-index figure the site calculates from them.
• Which of four goal options you selected.
• Your answers to a short health-history question, covering a personal or family history of medullary thyroid cancer or MEN 2, a history of pancreatitis, type 1 diabetes, current pregnancy or breastfeeding, and whether you currently take a GLP-1 medication. This is health-related information about you.
• Which consent boxes you ticked, the version of the consent text you were shown, and the date and time you agreed.
• The page you submitted from, including anything carried in its web address. If you arrived from the BMI calculator on the homepage, that address includes the height and weight you entered there.

The contact form collects less: your name, your email address, the topic you chose, and the message you write. That form asks you not to include medical details, and you should not.

This website also collects the ordinary technical information any site with analytics collects: your device and browser type, the pages you view and when, how you arrived, and an approximate location derived from your IP address. Section 7 covers that in detail.

There are things we deliberately do not collect on this website. It has no accounts and no logins, so there is no password. It has no checkout, so we collect no card or bank details. It does not ask for a Social Security number, an insurance number, or a government ID. Your answers to the eligibility check are never written to your browser’s local storage, so refreshing the page loses your progress on purpose. And we do not receive your medical records, consultation notes, or prescription history from the medical group or the pharmacy.

Where your information actually goes.

It is worth being specific about the path, because "we may share information with service providers" tells you very little.

1. When you press submit, your browser sends the answers directly to Formspree, a hosted form-processing service in the United States. Nothing is stored on this website itself, which is a static site with no database of its own.
2. Formspree holds the submission and delivers it to the LuneRx team by email and through its dashboard.
3. LuneRx passes the submission to Vital Link PLLC, the independent medical group, so a licensed provider can review it and arrange a consultation.
4. If a provider decides treatment is appropriate and writes a prescription, the medical group sends what the pharmacy needs to Logos RX, the state-licensed compounding pharmacy that dispenses and ships to you. From that point Logos RX holds its own record, including your delivery address, under its own privacy obligations rather than under this policy.

Once your information is with the medical group or the pharmacy, it is held by them under their obligations, and their notices apply to it as well as this one.

[TO CONFIRM: vendor list and data processing agreements. The processors above are the ones present in this website’s code today — Formspree for forms, Vercel for hosting, Google Analytics for measurement. Before launch, confirm the full list, including the email service used to reply to leads, any CRM the submissions are copied into, and the SMS platform, and add each one here with its role, along with a data processing agreement for each. Step four names Logos RX as the dispensing pharmacy on the client’s instruction; obtain the pharmacy’s own privacy notice and the agreement governing what the medical group may send it, and link the notice here.]

Why we use it.

We use the information described above to:

• route your submission to the independent medical group so a licensed provider can review it and decide whether treatment is appropriate for you;
• let the medical group and, where a prescription is issued, the partner pharmacy contact you and complete the next steps;
• reply to you, including confirming a submission and following up on a support request;
• send marketing messages, but only where you have separately agreed to receive them;
• operate, secure, and improve this website, including understanding which pages people use and whether the eligibility check works;
• keep a record of the consents you gave and when, which is both a legal requirement and a protection for you;
• meet our legal obligations, respond to lawful requests, and establish or defend legal claims.

We do not use your health-related answers to target advertising, and we do not build advertising profiles from them.

Health information and HIPAA.

This is the part people most often get told wrong, so here it is plainly.

LuneRx is not a healthcare provider, a health plan, or a healthcare clearinghouse. Information you submit directly to us through this website is therefore protected by this policy, by our contracts with the vendors who process it, and by the consumer privacy laws that apply to it — not by HIPAA in our hands. Do not assume that because a question sounds medical, HIPAA governs our copy of the answer.

The independent medical group and the state-licensed partner pharmacies are covered entities. Once your information reaches them, and for the records they create about your care, HIPAA applies and their Notices of Privacy Practices govern.

We hold health-related answers to a standard we set for ourselves rather than one HIPAA imposes on us: we collect only what the provider review needs, we share it only with the parties in Section 5, we do not use it for advertising, and we do not store it in your browser.

[TO CONFIRM: legal review of HIPAA and BAA framing. Counsel should confirm whether LuneRx acts as a business associate of the medical group under its agreement with it, whether a business associate agreement is required with the form processor and any CRM that holds these submissions, and whether any state law imposes a stricter standard. If a BAA is in place, say so here and name the parties.]

How the medical group and the pharmacy handle protected health information is summarised on our HIPAA Notice of Privacy Practices page.

Cookies, analytics, and tracking.

This website uses Google Analytics 4 to measure how the site is used. It loads on every page of this site, including the eligibility check. It sets cookies in your browser, gives your browser an identifier that persists across visits, and reports to Google information such as the pages you view, how long you stay, how you arrived, your device and browser, and an approximate location derived from your IP address.

Google Analytics does not receive your name, your email address, your phone number, or your answers to the health-history question. The site does not pass form values into analytics.

This website does not use advertising pixels, retargeting tags, conversion trackers, session recording, heat mapping, or any other behavioral tracking tool. If that changes, this section changes first.

One point deserves plain language rather than a legal formula. Several state privacy laws, California’s among them, define "sale" and "sharing" broadly enough to catch letting an analytics provider set an identifier in your browser, even where no money changes hands. We do not sell personal information for money and never have. Whether the Google Analytics identifier described above amounts to "sharing" under those laws turns on how the analytics property is configured — principally whether Google Signals and advertising features are switched on — and that is being confirmed rather than assumed. See the note at the end of this section. Either way, if your browser sends a Global Privacy Control signal, we honor it.

There is one other piece of browser storage: if you dismiss the announcement bar at the top of the site, we store a single value in your browser so it stays dismissed. It contains no personal information and no form answers.

The fonts on this site are served from our own domain rather than fetched from a third party, so viewing a page does not send a request to a font provider.

• You can block or delete cookies in your browser settings. The site works without them, apart from the announcement bar reappearing.
• You can opt out of Google Analytics on every site by installing Google’s browser add-on at tools.google.com/dlpage/gaoptout.
• Most browsers offer a Global Privacy Control or "do not sell or share" signal. We honor it where the law requires us to.

[TO CONFIRM: cookie and consent tooling, and the sale/share determination. This site does not currently present a cookie banner or consent manager, and analytics load on page view. Counsel should confirm whether a consent mechanism is required across the states now listed on the States Served page, whether Google Signals and Google Analytics advertising features are disabled on the property, and whether analytics on the eligibility-check page should be suppressed. The answer on Google Signals settles whether the paragraph above must be rewritten to disclose "sharing" outright and whether a "Your Privacy Choices" control is required; resolve it before certification. Until then, treat this section as describing behaviour that may need to change rather than behaviour that has been cleared.]

Marketing choices.

Marketing is opt-in and separate from everything else. The eligibility check has one required consent box, which is an agreement to our policies and not a marketing consent, and one optional box for marketing calls and texts. Ticking the optional box is never a condition of being evaluated, of receiving care, or of buying anything.

• To stop marketing texts, reply STOP to any message. Message and data rates may apply.
• To stop marketing emails, use the unsubscribe link in any marketing email.
• To stop all marketing contact, email support@lunerx.com and say so.

Service messages are different. If you submit an eligibility check or send us a message, we may reply about that, and the medical group or the pharmacy may contact you about your care or your order, whatever your marketing preferences are.

How long we keep it.

We keep personal information only as long as we need it for the purposes in this policy, or as long as the law requires, and then we delete it or strip it of anything that identifies you.

In practice that means submissions are held by our form processor and in the inboxes that receive them, consent records are kept for as long as we may need to evidence them, and analytics data is retained for the period set on the analytics property.

[TO CONFIRM: retention periods. Set and state a specific retention period for form submissions held by the processor, for lead records in any CRM, for marketing lists, and for the analytics property, together with the deletion process that enforces them. "As long as necessary" is not a schedule.]

Records held by the independent medical group and the pharmacy are kept under the retention rules that apply to medical and pharmacy records, which are longer and are not ours to set.

How we protect it.

This website is served over an encrypted connection, and submissions are transmitted over that encrypted connection to our form processor. Access to submissions is limited to the people who need it to do their work, and to the vendors described in Section 5 under contracts that limit what they may do with it.

We keep health-related answers out of your browser’s storage by design, so they cannot be recovered from a shared or borrowed device after you close the page.

No method of transmission or storage is completely secure, and we cannot promise absolute security. If a breach affects your information, we will notify you and the relevant authorities as the law requires.

[TO CONFIRM: security program. Confirm access controls and multi-factor authentication on the form processor, the email accounts that receive submissions, and any CRM, and record who is accountable for them.]

Your privacy rights.

Depending on where you live, you have some or all of the following rights over the personal information we hold:

• to know what we collect, why, and who we disclose it to;
• to get a copy of it in a portable form;
• to correct it if it is wrong;
• to ask us to delete it;
• to opt out of the sale or sharing of personal information, and of targeted advertising — we do not sell personal information, and Section 7 describes the only tracking on this site;
• to withdraw a consent you gave, at any time, without affecting anything done before you withdrew it;
• not to be discriminated against for exercising any of these rights.

Several states give extra protection to consumer health data specifically, including Washington’s My Health My Data Act, Nevada’s consumer health data law, and the health-data provisions of the California, Colorado, Connecticut, and other state privacy laws. Where those apply to the answers you gave on the eligibility check, we honor the rights they give you, including the right to have that data deleted.

To make a request, email support@lunerx.com from the address you used, or call (813) 390-8181, and tell us what you would like us to do. We will take reasonable steps to verify who you are before we act, respond within the time your state’s law allows, and tell you if we cannot do what you asked and why. An authorized agent may make a request for you with proof of authority.

A request to us covers the information LuneRx holds. Records held by the independent medical group or the pharmacy have to be requested from them, and the HIPAA Notice explains how.

[TO CONFIRM: rights request mechanism. Counsel should confirm which state laws apply given the states served, whether a dedicated privacy request form or toll-free number is required, the verification standard, and the appeal process some states mandate.]

Children.

The services described on this site are for adults aged 18 and over. This website is not directed at children, and we do not knowingly collect personal information from anyone under 18.

The eligibility check asks for a date of birth and stops if the answer indicates someone under 18, without sending what was entered.

If you believe someone under 18 has submitted information through this site, email support@lunerx.com and we will delete it.

Where we operate.

LuneRx is based in Tampa, Florida. This website and the services described on it are intended for people in the United States, and the independent providers and pharmacies involved operate only where they are licensed. Information collected here is processed in the United States.

If you access this site from outside the United States, you do so on your own initiative and your information will be processed in the United States, where privacy laws may differ from those where you live. We do not offer services outside the United States.

Because state privacy laws differ, the rights described in Section 11 may depend on where you live. Where the dispensing pharmacy is licensed to ship is set out on our States Served page.

Changes, and how to reach us.

If we update this policy we will change the effective date at the top of this page, and for a material change we will take reasonable steps to tell you before it applies.

Privacy questions and requests:

• LuneRx, operated by The Piper Group
• Email: support@lunerx.com
• Phone: (813) 390-8181
• Mailing address: 8888 W Hillsborough Ave, Tampa, FL 33615
• Privacy requests are handled by [PLACEHOLDER: privacy officer or responsible contact].

For what this website does and the terms you agree to by using it, see our Terms and Conditions. For how the medical group and the pharmacy handle health information, see the HIPAA Notice of Privacy Practices.