Privacy Policy

Two Hands Healing Arts and its affiliates (“Two Hands,” “we,” “our,” and/or “us”) value the privacy of individuals who use our websites and related services (collectively, our “Services”). This privacy policy (the “Privacy Policy”) explains how we collect, use, and disclose information from users of our Services (“Users”), including website visitors and individuals who partner with us to promote our Services. By using our Services, you agree to the collection, use, disclosure, and procedures this Privacy Policy describes. Beyond the Privacy Policy, your use of our Services is also subject to our Terms of Service.

THIS NOTICE DESCRIBES HOW INFORMATION ABOUT YOU (INCLUDING MEDICAL INFORMATION) MAY BE COLLECTED, USED, AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Information We Collect

We may collect a variety of information from or about you or your devices from various sources, as described below.

A. Information You Provide to Us.

Registration and Account Information. If you sign up for an account, we may ask you for your name, sex assigned at birth, date of birth, email address, shipping address, billing information, and phone number.

Identification Verification. If you choose to purchase prescription medication through our Services, we will ask you to provide a government-issued ID and a photo of you so that we and our third party providers (such as Persona) can verify your identity. You may be asked to provide a copy of your insurance card when purchasing certain medication.

Symptoms Quiz and Medical History. If you choose to complete our Symptoms Quiz in order to request treatment or connect with our partner Telehealth Provider (“Provider”), we will collect information about the treatment or service you are seeking, as well as information that you provide through the form, such as your health symptoms and conditions. If you choose to consult with a Provider through our patient portal, we may collect additional information, such as your medical history.

Clinical Services. If you choose to use our clinical services, we may collect additional information such as videos of your face for our providers to provide care.

Communications with Two Hands. If you contact us directly, we may receive additional information about you, such as your name, email address, phone number, the contents of a message or attachments that you may send to us, and other information you choose to provide. If you subscribe to receive updates, promotions, and discounts, then we will collect certain information from you, such as your email address.

Payment Information. If you subscribe to or make a purchase through our Services, your payment-related information, such as credit card or other financial information, is collected by our third-party payment processor (such as PaymentWorld) on our behalf.

Careers. If you decide that you wish to apply for a job with us, you may submit your application and your resume online. We will collect the information you provide on your application and resume, such as your education, email address, phone number, gender, and employment experience.

B. Information We Collect When You Use Our Services.

Communications with Providers. If you exchange messages with a Provider through our platform, we receive the messages between you and the Provider, including the contents of a message and any attachments you send to them. We also work with third parties to facilitate audio and video consultations between you and the Providers off our platform. But while a third party provides the communication services, we collect certain information about those communications. For example, for audio consultations, we receive your phone number and the date and time of the consultations in order to provide payments to the Provider. For video consultations, we receive information about whether you were in the virtual waiting room and messages may you send in the room.

Medication Information. We receive information about the medications you purchase and the prescriptions that the Provider has prescribed to you. We also receive your home address for delivery of your medications.

Usage Information. We automatically receive information about your interactions with our Services, like the pages, products, or other content you view, the searches you conduct and the dates and times of your visits.

Prompts and Outputs. Our Services allow you to submit text, audio, images, video, documents, and other materials to the Services (“Prompts”), which generate responses based on your Prompts (“Outputs”). We will collect any information you choose to provide in your Prompts and this information may be reproduced in the Outputs.

Device Information. We receive information about the device and software you use to access our Services, including IP address (from which we infer your general location information), web browser type, operating system version, and device identifiers.

Information from Cookies and Other Tracking Technologies. We and our third-party partners collect information using cookies, pixel tags, SDKs, or other tracking technologies. Our third-party partners, such as analytics and advertising partners, may use these technologies to collect information about your online activities over time and across different services.

Use of Google Services and Digital Fingerprinting: Our website uses services provided by Google that may involve the collection of technical and device information through methods such as digital fingerprinting. These technologies help us and Google detect fraud, enhance security, ensure proper website functionality, and—in some cases—deliver personalized content or advertising.

Google may collect information including, but not limited to: your IP address, browser type and settings, device type and identifiers, operating system, referring URLs, system activity, crash reports, and other technical data. This information may be used to create a unique identifier associated with your device or browser.

Types of Data You Can and Cannot Opt Out Of

Some types of data collection are essential for the operation and security of the website and cannot be opted out of. For example, digital fingerprinting used by services like Google reCAPTCHA is necessary to detect bots, prevent fraud, and protect against abuse. Likewise, some core website functions that rely on tools like Google Tag Manager or baseline analytics settings are considered strictly necessary and do not offer an opt-out.

You can opt out of Google’s data collection used for non-essential purposes, such as personalized advertising. You can manage and opt out of Google’s personalized ads through Google Ad Settings or your device settings.

C. Information We Receive from Other Sources.

Information from Your Provider. If you choose to consult with a Provider, we receive the Provider’s clinical notes from the consultation and prescription approval information.

Information from Your Pharmacy. If you elect to obtain a prescription from our mail order pharmacy partners, through our Services, we receive fulfillment and shipping status information from our pharmacy partners (including Curexa, FuzeRx, formerly known as TruePill, Precision Compounding Pharmacy and ARX-X, LLC, a pharmacy facilitator).

Lab Results. If you choose to direct our lab partners to send your lab results directly to us, we receive that information from our lab partners (including LabCorp, Quest, and Daye) on your behalf.

How We Use the Information We Collect

We use the information we collect:

To provide, maintain, improve, develop, and enhance our Services, including to train the artificial intelligence, machine learning, and models that we use to support our Services;

To personalize your experience on our Services such as by providing tailored content and recommendations;

To understand and analyze how you use our Services and develop new products, services, features, and functionality;

To communicate with you, provide you with updates and other information relating to our Services, provide information that you request, and otherwise provide customer support;

For marketing and advertising purposes, such as developing and providing promotional and advertising materials that may be relevant, valuable or otherwise of interest to you;

For research purposes;

To partner with you to promote our Services;

To generate anonymized or aggregate data containing only de-identified, non-personal information that we may use and disclose for any lawful purposes;

To facilitate transactions and payments;

To find and prevent fraud and abuse, and respond to trust and safety issues that may arise;

For compliance purposes, including enforcing our TOS or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency; and

For other purposes for which we provide specific notice at the time the information is collected.

How We Disclose the Information We Collect

Vendors and Service Providers. We may disclose any information we receive to vendors and service providers retained in connection with the provision of our Services.

Telehealth Providers. If you choose to have a telehealth consultation with a Provider, we may disclose your information to the provider to facilitate the consultation, such as your self-reported demographics information, health-related questionnaires, and requests for treatment.

Pharmacy Partners. We disclose your order and prescription information to partnering pharmacies to facilitate medication fulfillment and/or delivery.

340B Non-Profit Partners. Only in regard to the PrEP program, we share confidential health information with non-profit partners and their associated physicians, clinicians, and other personnel. AI Service Providers. We may disclose information we receive to vendors that provide artificial intelligence services that provide backend support for our Services.

Advertising Partners. We work with third-party advertising partners to show you ads that we think may interest you. Some of our advertising partners are members of or the Digital Advertising Alliance (https://optout.aboutads.info) and serve ads through cookie-based technologies. If you do not wish to receive these personalized ads, please visit their opt-out pages to learn about how you may opt out of receiving personalized ads from member companies.

We work with Prospect Point Media, LLC (“PPM”) to assist in advertising our services across various digital streaming platforms. To support this function, we may share the following customer data with the vendor for the purpose of internal analytics and performance measurement related to the advertising campaigns; IP address, anonymized User ID, hashed email address, page view, and that an item was added to the cart (the actual product purchased is not shared).

As Required By Law and Similar Disclosures. We may access, preserve, and disclose your information if we believe doing so is required or appropriate to: (a) comply with law enforcement requests and legal process, such as a court order or subpoena; (b) respond to your requests; (c) protect your, our, or others’ rights, property, or safety (d) disclose certain positive test results to public health agencies as mandated by law for communicable disease tracking.

Merger, Sale, or Other Asset Transfers. We may transfer your information to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our assets.

Consent. We may also disclose your information with your permission.

Authorized Agents. We may disclose your information to your authorized agent, executor, administrator, or other person with the authority to act on your behalf.

Marketing Communications

Promotional Messaging. You can unsubscribe from our promotional emails via the link provided in the emails. You can also opt out from our promotional SMS messages by replying “STOP” to our message.

Third Parties. Our Services may contain links to other websites, products, or services that we do not own or operate. We are not responsible for the privacy practices of these third parties.

Security. We make reasonable efforts to protect your information by using physical and electronic safeguards designed to improve the security of the information we maintain.

Biometric Privacy Notice

This biometric privacy notice explains how we collect, use, share, retain, and destroy your data for identity verification purposes when you use Two Hands for online consultations and for the purposes of providing our clinical services that you requested.

We use our third-party service provider, Persona Identities, Inc. to extract your face geometry from the government-issued identification documents and photo that you provide for identity verification.

For the data collected from the government-issued identification documents, our service provider retains your data as long as Persona Identities needs it to verify your identity, and in no event will it be retained for longer than three years unless there are legal requirements to keep it for a longer period.

For the data collected from your videos, we retain your data as long as we need it to provide our clinical services, and in no event will it be retained for longer than three years unless there are legal requirements to keep it for a longer period.

When the retention period ends, your data is permanently deleted.

Requests for Personal Information

You may make the following requests with respect to your health information maintained by us:

Confidential Communication. You may request that you receive your health information by alternative means or at alternative locations.

Restrictions. You may request restrictions on certain uses and disclosures of your health information. You must submit your request in writing to Two Hands at privacy@twohandshealingarts.com.

Inspection and Copies. You may make a request to inspect and copy your health information. You must submit your request in writing to Two Hands at privacy@twohandshealingarts.com.

Amendment. You may request that we amend your health information if you believe it is incorrect or incomplete. You must submit your request in writing to Two Hands at privacy@twohandshealingarts.com.

Accounting of Disclosures. You may request an accounting of all disclosures we have made of your health information. You must submit your request in writing to Two Hands at privacy@twohandshealingarts.com and you must specify the time period involved (which must be for a period of time less than six years from the date of the disclosure).

Paper Copy. You have the right to obtain a paper copy of this Privacy Policy from us at any time upon request. Please contact Two Hands by emailing us at privacy@twohandshealingarts.com.

Complaint. You may complain to Two Hands if you believe that your privacy rights have been violated. To file a complaint with Two Hands, you must submit a statement in writing to us at privacy@twohandshealingarts.com. Two Hands will not retaliate against you for filing a complaint.

Children’s Privacy. We do not knowingly collect, maintain, or use personal information from children under 18 years of age, and no part of our Service(s) is directed to children. If you learn that a child has provided us with personal information in violation of this Privacy Policy, then you may alert us at privacy@twohandshealingarts.com.

International Visitors

Our Services are hosted in the United States and intended for visitors located within the United States. If you choose to use the Services from the European Union or other regions of the world with laws governing data collection and use that may differ from U.S. law, then please note that you are transferring your personal information outside of those regions to the U.S. for storage and processing. By providing any information, including personal information, on or to the Services, you consent to such transfer, storage, and processing.

Update Your Information

You can update your account information that does not require additional verification such as your name or date of birth through your account settings. For further assistance, please contact our team at support@twohandshealingarts.com.

You can exercise your right to opt out of the processing of your Personal Information for targeted advertising or the “sale” of your Personal Information by adjusting your cookie settings.

Changes to this Privacy Policy

We will post any adjustments to the Privacy Policy on this page, and the revised version will be effective when it is posted. If we materially change the ways in which we use or disclose personal information previously collected from you through the Services, we will notify you through the Services, by email, or other communication.

Contact Information

If you have any questions, comments, or concerns about our processing activities, please email us at privacy@twohandshealingarts.com.

Two Hands U.S. State Privacy Notice Addendum

This U.S. State Privacy Notice Addendum supplements the information and disclosures contained in our Privacy Policy. It applies to the residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Tennessee, Texas, Utah, and Virginia (the “Covered States”) and explains how we collect and process information about you as a business or controller and how you can exercise your privacy rights under these states’ comprehensive privacy laws.

Personal Information means information that the U.S. State Privacy Laws in this Notice defines as “Personal Information” or “Personal Data.” Personal Information does not include information that is deidentified or aggregated or otherwise excluded from the scope of the U.S. State Privacy Laws.

Categories of Personal Information We Collect

Over the past 12 months, we may have collected: Identifiers (name, address, online identifiers, IP address, email, phone, driver’s license); California Customer Records (name, address, telephone, driver’s license, physical characteristics, education, employment, payment card, medical information); Characteristics of Protected Classifications (age, sex/gender, medical condition); Commercial Information; Biometric Information (facial geometry); Internet/Network Activity (browsing history, search history); General Geolocation; Audio and Video Information; De-identified or Aggregated Data; Professional/Employment Information; and Sensitive Personal Information (driver’s license, account log-in, biometric, health, sex life).

Categories of Third Parties

We may disclose your information to: Service providers and vendors; Providers; AI service providers; Pharmacy partners; Advertising partners; Analytics providers; Law enforcement; Third parties in mergers and corporate transactions; Corporate affiliates; and Pharmaceutical companies.

Your U.S. State Privacy Rights

Depending on where you live, you may exercise: The right to confirm whether we process your personal information; The right to access, correct, or delete specific pieces of Personal Information; The right to opt out of the “sale” or “sharing” of your Personal Information for cross-context behavioral advertising; The right to be free from discriminatory treatment or retaliation; and The right to appeal any decision with regard to your privacy request.

You can submit a request by completing the Two Hands Privacy Access Request Form or emailing privacy@twohandshealingarts.com.

Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy supplements the Two Hands Privacy Policy and applies only to personal data defined as “consumer health data” that is subject to the Washington State My Health My Data Act (MHMDA) and the Nevada Health Data Privacy Act (NHDPA).

Categories of Consumer Health Data we collect include: Individual health conditions, treatment, diseases, or diagnosis; Diagnoses or diagnostic testing, treatment, or medication; Use or purchase of medication; Bodily functions, vital signs, symptoms, or measurements; Data that identifies a consumer seeking health care services; Reproductive or sexual health information; Health-related surgeries or procedures; Gender-affirming care information; and Biometric information.

If you have any questions about our privacy policy or processing activities, please email us at privacy@twohandshealingarts.com.