Privacy and Policy

1. Introduction

SDKare LLC (“SDKare,” “Company,” “we,” “us,” or “our”) respects the privacy of individuals who access our website, request information, schedule appointments, receive healthcare services, or communicate with our team.

We are committed to handling personal information responsibly and protecting the confidentiality, integrity, and availability of information entrusted to us.

This Privacy Policy explains:

What personal information we collect.
How and why we use personal information.
When information may be shared.
How health information is protected.
Our approach to cookies and tracking technologies.
How we handle patient communications.
Your privacy rights and choices.
How to contact SDKare regarding privacy concerns.

This Policy applies to SDKare’s website, available at https://sdkare.com/, and related online services, appointment scheduling, administrative communications, and other activities involving personal information.

Certain healthcare information is additionally governed by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), its implementing regulations, and other applicable federal and state privacy laws.

Where information qualifies as Protected Health Information (PHI), SDKare’s HIPAA Notice of Privacy Practices provides additional information about permitted uses and disclosures, individual rights, and applicable legal duties.

If this Privacy Policy conflicts with a mandatory legal requirement, the applicable law controls.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal information collected or processed in connection with:

Visiting and interacting with the SDKare website.
Registering or maintaining a patient account.
Requesting healthcare information.
Completing appointment booking forms.
Scheduling or receiving telehealth services.
Communicating with Patient Support.
Completing intake forms, assessments, or questionnaires.
Making payments or submitting billing inquiries.
Receiving appointment confirmations or reminders.
Participating in communications or promotional activities where legally permitted.

SDKare provides services to eligible adults aged 18 years or older.

The specific information collected may depend on the services requested and the individual’s interactions with SDKare.

This Policy does not independently replace SDKare’s HIPAA Notice of Privacy Practices, Terms and Conditions, or other applicable patient agreements.

3. Information We Collect

SDKare may collect personal information directly from individuals, through their interactions with our website and services, and from other sources where collection is authorized or legally permitted.

3.1 Personal and Contact Information

Information may include:

Full name.
Date of birth.
Email address.
Telephone number.
Contact preferences.
Mailing or billing address.
Account identifiers.
Other information provided during registration or scheduling.

3.2 Health and Medical Information

When individuals request or receive healthcare services, SDKare or authorized healthcare providers may collect information necessary for evaluation, treatment, and healthcare administration.

Depending on the service, this may include:

Medical history and current symptoms.
Existing medical conditions.
Diagnoses and treatment history.
Prescription and medication information.
Medication allergies and adverse reactions.
Laboratory results and diagnostic information.
Mental and behavioral health information.
Information concerning reproductive, sexual, or other sensitive healthcare needs.
Clinical notes and healthcare provider recommendations.
Intake questionnaires, screenings, and assessments.
Relevant medical records obtained from other healthcare providers.

Medical information is collected and handled in accordance with applicable clinical, privacy, and confidentiality requirements.

SDKare does not collect every category of health information from every patient. Collection depends on the services requested, clinical circumstances, and applicable requirements.

3.3 Appointment and Healthcare Service Information

SDKare may collect information relating to:

Appointment requests.
Scheduled consultation dates and times.
Selected healthcare services.
Provider assignments.
Appointment attendance.
Cancellation and rescheduling requests.
Follow-up care.
Patient Support interactions.

This information may be used to administer appointments, coordinate services, and support patient care.

3.4 Payment and Billing Information

When patients purchase healthcare services, SDKare may collect or process information necessary to administer payments and maintain accurate billing records.

This may include:

Billing contact information.
Service purchased.
Payment amount.
Payment status.
Transaction references.
Refund or adjustment records.
Billing inquiries and disputes.

Payment information may be processed through authorized payment service providers.

SDKare’s collection, processing, storage, and sharing of financial information are subject to applicable privacy, security, and payment-related requirements.

3.5 Communications and Correspondence

SDKare may maintain records of communications submitted through authorized channels, including:

Emails.
Patient Support inquiries.
Appointment-related messages.
Customer service requests.
Patient feedback.
Complaints.
Privacy requests.
Communication preferences and consent records.

Where communications contain health information, additional privacy protections may apply.

3.6 Website and Technical Information

When individuals access the SDKare website, certain technical information may be collected automatically, depending on the technologies in use.

This information may include:

Internet Protocol (IP) address.
Browser type and version.
Device and operating system information.
Website pages visited.
Date and time of access.
Referring website or traffic source.
Cookie identifiers.
Website interactions.
Technical and diagnostic information.

SDKare may use such information for website operation, security, troubleshooting, analytics, and other legally permitted purposes.

4. How We Use Personal Information

SDKare uses personal information for legitimate healthcare, administrative, operational, and legal purposes.

4.1 Providing Healthcare Services

Where applicable, information may be used to:

Support clinical evaluations.
Facilitate telehealth consultations.
Maintain medical records.
Assist healthcare providers with treatment coordination.
Support medication management.
Coordinate follow-up care.
Facilitate referrals or testing where appropriate.

Clinical decisions remain the responsibility of authorized healthcare professionals.

4.2 Appointment Scheduling and Patient Support

Information may be used to:

Schedule and confirm appointments.
Verify patient information.
Send appointment reminders.
Process rescheduling requests.
Respond to patient inquiries.
Address administrative concerns.
Communicate relevant service information.

4.3 Payment and Billing Administration

SDKare may process personal information to:

Facilitate authorized payments.
Maintain billing records.
Review payment discrepancies.
Process eligible refunds.
Address payment disputes.
Meet applicable accounting and legal obligations.

4.4 Website Operation and Improvement

Information may be used to maintain website functionality, address technical issues, monitor security, and evaluate website performance.

Any use of identifiable health information for analytics or other purposes must comply with applicable privacy laws, including HIPAA where applicable.

4.5 Legal and Regulatory Compliance

SDKare may process information as necessary to comply with applicable legal requirements, respond to lawful requests, maintain required records, and address compliance or patient safety concerns.

4.6 Marketing and Promotional Communications

SDKare may communicate information about its services, updates, or promotional offers where permitted by applicable law.

Marketing communications involving protected health information will be handled in accordance with HIPAA and any other applicable consent or authorization requirements.

Patients and website users may opt out of eligible marketing communications using the available unsubscribe or opt-out mechanism.

Opting out of promotional communications does not necessarily prevent necessary healthcare, appointment, billing, or legally required communications.

5. Protected Health Information and HIPAA

SDKare recognizes that healthcare information is sensitive and may be subject to additional legal protections.

Where HIPAA applies, SDKare and other regulated parties must comply with the HIPAA Privacy, Security, and Breach Notification Rules.

Protected Health Information generally includes individually identifiable health information relating to a person’s health, healthcare services, or payment for healthcare when that information is held or transmitted by a regulated entity in a covered capacity.

5.1 Permitted Uses and Disclosures

PHI may be used or disclosed for treatment, payment, and healthcare operations as permitted by HIPAA.

Other uses and disclosures may be permitted or required by law, including certain public health, oversight, or legally authorized purposes.

Where written patient authorization is required, the relevant information will not be used or disclosed for that purpose without the required authorization.

5.2 Minimum Necessary Standard

SDKare applies the HIPAA minimum necessary principle to uses and disclosures for which that requirement applies.

This generally means limiting access, use, or disclosure to the information reasonably necessary to accomplish a permitted purpose.

Certain activities, including disclosures to healthcare providers for treatment, are subject to applicable exceptions to the minimum necessary standard.

5.3 Additional Protections for Sensitive Records

Certain information, including psychotherapy notes and qualifying substance use disorder records, may be subject to additional confidentiality requirements.

Where these requirements apply, SDKare will handle the information in accordance with the governing law and any required authorization or consent.

Not all behavioral health or addiction-related information automatically qualifies for the same specialized legal protections.

5.4 HIPAA Notice of Privacy Practices

SDKare maintains a separate HIPAA Notice of Privacy Practices describing applicable uses and disclosures of PHI, patient rights, and legal responsibilities.

Patients should consult that Notice for detailed information about their protected health information.

6. How We Share Personal Information

SDKare does not sell or rent personal information as described in its published privacy commitments.

Personal information may be shared where necessary to provide services, operate the business, comply with law, or carry out other legally permitted activities.

6.1 Healthcare Providers

Information may be shared with appropriately authorized healthcare providers involved in a patient’s evaluation, treatment, or care coordination.

6.2 Healthcare-Related Third Parties

Where appropriate and legally permitted, information may be shared with pharmacies, laboratories, diagnostic facilities, specialists, or other healthcare organizations involved in providing requested or recommended services.

6.3 Administrative and Technology Service Providers

SDKare may engage service providers supporting functions such as:

Scheduling.
Payment processing.
Electronic communications.
Technical infrastructure.
Patient records management.
Customer support.
Website administration and security.

Such sharing must be consistent with applicable legal requirements and the relevant service arrangements.

Where a service provider qualifies as a HIPAA business associate, applicable HIPAA requirements, including necessary contractual protections, must be satisfied.

6.4 Legal and Regulatory Disclosures

Information may be disclosed when required or permitted by law, including in response to lawful governmental requests, judicial proceedings, regulatory oversight, or other legally authorized circumstances.

SDKare will evaluate requests according to applicable legal and privacy requirements.

6.5 Business Changes or Transactions

If SDKare undergoes a legally permissible merger, restructuring, acquisition, or transfer of business assets, relevant information may be processed or transferred subject to applicable confidentiality, privacy, and security requirements.

This section does not authorize disclosures that are otherwise prohibited by HIPAA or other applicable laws.

6.6 No Unauthorized Disclosure of Protected Health Information

SDKare does not authorize the disclosure of PHI to third parties for purposes requiring patient authorization unless the required authorization has been obtained or another valid legal basis applies.

7. Cookies, Analytics, and Tracking Technologies

The SDKare website may use cookies and similar technologies to support website functionality, improve user experience, and evaluate website performance.

Depending on the specific technology used, these tools may collect device information, website interactions, or other technical data.

7.1 Types of Technologies

Cookies and similar technologies may support:

Essential website functionality.
User preferences.
Security and fraud prevention.
Website analytics.
Other legally permitted website activities.

7.2 Managing Cookies

Users may be able to control or restrict cookies through their browser settings or available website privacy controls.

Disabling certain cookies may affect website functionality.

7.3 Health Information and Tracking Restrictions

SDKare recognizes that tracking technologies used on healthcare websites may create additional privacy risks.

Tracking technologies must not be configured or used in a manner that results in impermissible disclosure of PHI.

For example, information entered into a patient intake form, appointment booking process, symptom assessment, or patient portal may receive additional protections under HIPAA where applicable.

Any use of tracking technologies involving PHI must meet applicable legal requirements, including appropriate permissions, authorizations, or business associate arrangements where required.

A general cookie notice or cookie consent alone does not replace a legally required HIPAA authorization.

7.4 Browser Privacy Signals

Where applicable law requires recognition of qualifying browser-based privacy preference signals, SDKare will honor those signals in accordance with that law.

8. SMS, Email, and Patient Communications

SDKare may communicate with individuals using contact information supplied during appointment scheduling, registration, or other authorized interactions.

Communications may include:

Appointment confirmations.
Appointment reminders.
Scheduling updates.
Billing and payment notices.
Patient Support responses.
Administrative information.
Promotional messages where properly authorized.

8.1 SMS Consent and Opt-Out

Where SDKare operates an SMS messaging program, individuals may opt out of eligible text message communications by replying STOP, subject to the instructions and requirements of the applicable messaging service.

Marketing text messages will be sent only when applicable consent requirements have been satisfied.

8.2 SMS Consent Information

SDKare does not sell or share SMS opt-in information or consent records with third parties for their independent marketing or promotional purposes.

SMS-related information may be shared with authorized communications service providers, telecommunications carriers, or other vendors as necessary to deliver requested messages and administer the messaging service, subject to applicable legal requirements.

8.3 Confidentiality of Communications

Ordinary email and text messaging may present privacy and security risks.

Patients should avoid sending unnecessary sensitive medical details or payment credentials through unsecured communications.

Where required, SDKare will use appropriate communication methods and accommodate legally protected requests for confidential communications.

9. Data Security

SDKare is committed to implementing reasonable administrative, technical, and physical measures to protect personal information.

Where HIPAA applies, safeguards must satisfy the applicable HIPAA Security Rule and other relevant requirements.

Security measures may address:

Access to confidential information.
User authentication.
Authorization and access controls.
Security monitoring.
Workforce privacy and security training.
Protection of electronic records.
Incident identification and response.
Vendor-related security risks.
Secure handling and disposal of information.

No electronic system or method of transmission can guarantee absolute security.

SDKare will review and address privacy and security incidents according to applicable legal and operational obligations.

10. Data Retention and Disposal

SDKare retains personal information for the period reasonably necessary to support legitimate operational purposes and comply with applicable requirements.

Retention periods may depend on:

The type of information collected.
Healthcare recordkeeping requirements.
Applicable state laws.
Legal and regulatory obligations.
Accounting and billing requirements.
Dispute resolution needs.
Permitted operational purposes.

Medical records may be subject to retention obligations that differ from those applicable to ordinary website information.

When information is no longer required to be retained, SDKare will handle its deletion, destruction, or de-identification in accordance with applicable requirements.

A request to delete information does not automatically require deletion of medical records that must be retained under applicable law.

11. Privacy Rights and Choices

Individuals may have rights concerning their personal information under HIPAA, applicable state privacy laws, or other legal requirements.

Depending on the type of information and the law that applies, these rights may include:

Requesting access to personal information.
Requesting correction of inaccurate information.
Requesting deletion where legally available.
Requesting restrictions on certain uses or disclosures.
Requesting confidential communications.
Receiving information about qualifying disclosures.
Withdrawing certain permissions or authorizations.
Opting out of eligible marketing communications.
Exercising applicable state privacy rights.

Not every right applies to every category of information or every individual.

Requests will be assessed under the applicable law, including any legal exceptions.

12. HIPAA Patient Rights

Where the HIPAA Privacy Rule applies, patients have rights concerning their PHI, subject to applicable conditions and exceptions.

These rights may include:

12.1 Access to Medical Records

Patients may request to inspect or receive copies of qualifying medical and billing records.

Requests are handled according to the timelines and requirements established by HIPAA.

12.2 Requests for Corrections

Patients may request amendments to inaccurate or incomplete information in applicable records.

SDKare or the responsible healthcare provider will review these requests as required by law.

12.3 Confidential Communications

Patients may request that communications containing PHI be sent using an alternative method or to an alternative location.

Reasonable requests will be accommodated where legally required.

12.4 Restrictions on Use or Disclosure

Patients may request restrictions on certain uses or disclosures of their PHI.

Some restrictions are discretionary, while others must be honored when specific HIPAA conditions are met.

12.5 Accounting of Disclosures

Patients may request an accounting of certain disclosures of their PHI, subject to applicable exceptions.

12.6 Personal Representatives

A legally authorized personal representative may exercise certain rights on behalf of a patient, subject to applicable law and verification requirements.

12.7 Complaints

Patients may raise concerns with SDKare’s Privacy Officer or submit a complaint to the U.S. Department of Health and Human Services Office for Civil Rights.

SDKare prohibits retaliation for exercising legally protected privacy rights.

Further information is provided in SDKare’s HIPAA Notice of Privacy Practices.

13. Identity Verification for Privacy Requests

To protect confidential information, SDKare may verify the identity and, where applicable, legal authority of individuals submitting privacy requests.

Verification may be required when requesting access to medical records, seeking corrections, requesting information about disclosures, or acting on behalf of another person.

SDKare will request information reasonably necessary to verify the request in accordance with applicable law.

Patients should not transmit sensitive identification documents through unsecured channels unless instructed to use an approved secure method.

14. State-Specific Privacy Rights

Certain state privacy laws provide additional rights to eligible residents and impose obligations on businesses meeting specified legal criteria.

These laws may have exemptions for HIPAA-regulated information, covered healthcare entities, or other regulated activities.

Accordingly, state privacy rights apply only to the extent required by the relevant law.

14.1 California Residents

California residents may have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, when those laws apply.

Eligible rights may include:

Accessing certain personal information.
Requesting deletion, subject to exceptions.
Requesting correction.
Opting out of qualifying sale or sharing.
Limiting certain uses or disclosures of sensitive personal information.
Receiving legally required information about data practices.
Protection against unlawful discrimination or retaliation for exercising privacy rights.

Some medical and health information is exempt from particular CCPA provisions.

14.2 Virginia Residents

Eligible Virginia residents may have rights under the Virginia Consumer Data Protection Act where applicable.

Such rights may include accessing, correcting, deleting, or obtaining certain personal information, and opting out of specified processing activities.

Applicable exemptions, including healthcare-related exemptions, may limit coverage.

14.3 Texas Residents

Eligible Texas residents may have rights under the Texas Data Privacy and Security Act where applicable.

Such rights may include access, correction, deletion, data portability, and certain opt-out rights.

Texas also maintains additional laws addressing the protection of sensitive personal information and qualifying health information.

Any applicable healthcare-related exemptions or requirements will be respected.

14.4 Delaware Residents

Eligible Delaware residents may have rights under the Delaware Personal Data Privacy Act where applicable.

These may include rights concerning access, correction, deletion, data portability, and certain processing activities.

Applicable exemptions for HIPAA-regulated information and other categories of data remain relevant.

14.5 Other States

Individuals located in other states may have additional rights under laws applicable to their circumstances.

SDKare will address qualifying privacy requests in accordance with the applicable legal requirements.

15. Sale, Sharing, and Targeted Advertising

SDKare will not use or disclose PHI for marketing, sale, or other purposes requiring HIPAA authorization without satisfying the relevant requirements.

Certain state laws define the terms “sale” and “sharing” more broadly than ordinary commercial usage.

Where applicable law provides a right to opt out of qualifying sales, sharing, or targeted advertising, SDKare will provide and honor that right as legally required.

Any such activity must be evaluated based on the actual technologies, vendors, and information involved.

Individuals wishing to raise questions about SDKare’s data-sharing practices may contact the Privacy Officer.

16. Third-Party Websites and External Services

The SDKare website may contain links to third-party websites or services.

Those websites may maintain separate privacy practices and terms.

SDKare encourages individuals to review the privacy policies of independent third parties before providing personal information to them.

This section does not limit SDKare’s responsibilities for third-party service providers acting on its behalf or handling PHI under applicable law.

17. Children’s Privacy and Age Restrictions

SDKare healthcare services are intended for adults aged 18 years or older.

The website and healthcare services are not intended to solicit healthcare information directly from children or individuals under 18.

SDKare does not knowingly solicit personal information from children for the purpose of providing adult-only healthcare services.

If SDKare becomes aware that information concerning a minor has been collected inappropriately, the situation will be reviewed and addressed in accordance with applicable law, including any relevant record retention obligations.

A parent or guardian who believes a minor has submitted information may contact SDKare Patient Support.

18. Data Breaches and Incident Notification

SDKare takes privacy and security incidents seriously.

If a security incident or potential unauthorized disclosure occurs, SDKare will assess the circumstances and determine its obligations under applicable federal and state laws.

Where legally required, affected individuals, regulators, or other parties will be notified within the applicable legal timeframes.

Notification requirements may vary depending on the nature of the information, the incident, and the governing law.

Where HIPAA applies, incidents involving unsecured PHI will be evaluated under the HIPAA Breach Notification Rule.

19. International Access

SDKare’s healthcare services are intended for eligible individuals located in U.S. jurisdictions where SDKare’s healthcare providers are legally authorized to provide care.

Accessing the website from outside the United States does not establish eligibility to receive clinical services from an SDKare provider.

Patients must provide accurate information about their physical location during telehealth appointments.

Information processed in connection with SDKare services may be subject to applicable U.S. laws and any additional data protection requirements that apply to the specific circumstances.

20. Changes to This Privacy Policy

SDKare LLC may revise this Privacy Policy to reflect changes in its services, data practices, technology, operational procedures, or legal obligations.

The Last Updated date at the beginning of this Policy will identify the most recent approved revision.

Where applicable law requires additional notice, consent, or authorization for a material change, SDKare will comply with those requirements.

An updated Privacy Policy does not replace any separate authorization or notice required under HIPAA or another applicable law.

21. Relationship to Other SDKare Policies

This Privacy Policy should be read together with SDKare’s:

Terms and Conditions.
HIPAA Notice of Privacy Practices.
HIPAA Privacy and Security Policy.
Payment Policy for Clients.
Refund Policy.
Patient No-Show and Late Cancellation Policy.
DEA and Telemedicine Prescribing Policy.

Where HIPAA or another applicable law provides specific requirements for health information, those requirements take precedence over inconsistent general statements in this Policy.

22. Contact Information and Privacy Officer

For questions, concerns, or requests relating to this Privacy Policy or the handling of personal information, please contact:

SDKare LLC

Website: https://sdkare.com/

Email: contact.support@sdkare.com

Phone: (520) 800-6043

Mailing Address: 2810 N Church St, Wilmington, DE, United States, 19802

Privacy Officer: Sophie Brown

Security Official: Sophie Brown

Privacy-related requests may be submitted through SDKare’s official support contact information and directed to the Privacy Officer.

For concerns involving protected health information, patients should also consult SDKare’s HIPAA Notice of Privacy Practices.

Individuals may file eligible HIPAA complaints with the U.S. Department of Health and Human Services Office for Civil Rights.

SDKare will not retaliate against individuals for exercising legally protected privacy rights.