Legal
Privacy Policy
Last Updated: September 7, 2026
This Privacy Policy describes how Elva MD LLC, doing business as ElvaMD (“ElvaMD,” “we,” “us,” or “our”), collects, uses, discloses, retains, and otherwise processes information when you access or use ElvaMD's websites, applications, online services, patient-facing technology, communications, and other services that link to this Privacy Policy (collectively, the “Services”).
ElvaMD provides a consumer-facing telehealth platform and related administrative services designed to facilitate access to healthcare services, including services provided by independent licensed healthcare providers, pharmacies, laboratories, and other healthcare-related service providers.
ElvaMD works with Telegra as a third-party telehealth infrastructure partner to facilitate certain technology, provider-network, prescribing workflow, pharmacy-routing, fulfillment, patient-portal, and related healthcare services.
The specific healthcare provider, medical group, pharmacy, laboratory, or fulfillment partner involved in your care may vary based on your location, treatment, availability, licensing requirements, and applicable law.
Certain health information submitted in connection with clinical care may be maintained or processed on behalf of healthcare providers and may be subject to additional protections under applicable federal and state law.
Please read this Privacy Policy carefully.
1. Eligibility and Minors
The Services are intended for individuals who are at least eighteen (18) years old or the applicable age of majority in their jurisdiction.
The Services are not directed to children under thirteen (13), and ElvaMD does not knowingly collect personal information from children under thirteen through the Services.
If you believe a child has provided personal information to ElvaMD in violation of this Privacy Policy, please contact us.
2. Health and Medical Information
When you create an ElvaMD account or otherwise interact with the Services, you may provide information such as your name, contact information, account credentials, payment information, and other administrative information.
Certain portions of the Services may also allow you to submit health-related information so that an independent licensed healthcare provider can determine whether consultation, testing, diagnosis, treatment, or prescription services are appropriate.
Depending on the circumstances, information used by a healthcare provider in connection with diagnosis or treatment may constitute protected health information (“PHI”) under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) or may be protected under other federal or state health privacy laws.
ElvaMD itself may not be a HIPAA-covered healthcare provider. Independent medical groups, healthcare providers, pharmacies, laboratories, Telegra, and other entities supporting the Services may separately be covered entities, business associates, or other regulated healthcare entities.
Where ElvaMD processes PHI on behalf of a healthcare provider or other regulated healthcare entity, ElvaMD will handle such information in accordance with applicable law and contractual obligations.
The healthcare provider or medical group responsible for your care may provide you with a separate Notice of Privacy Practices explaining how it uses and discloses PHI and describing your rights regarding that information.
Information not subject to HIPAA or another healthcare-specific privacy law may instead be governed by this Privacy Policy and applicable consumer privacy laws.
3. Information We Collect
The information we collect depends on how you interact with the Services.
Information You Provide Directly
We may collect information including:
- Name
- Email address
- Telephone number
- Date of birth
- Mailing, billing, and shipping addresses
- Account username and credentials
- Payment and transaction information
- Customer support communications
- Documents or files you submit
- Information provided through assessments, questionnaires, or intake forms
- Medical history
- Current and previous medications
- Allergies
- Symptoms
- Treatment goals
- Laboratory information
- Lifestyle or health information
- Sex- or hormone-related health information where relevant
- Photographs or other information voluntarily submitted for evaluation
- Other information you choose to provide
You should provide sensitive health information only through workflows designated for that purpose.
Payment Information
When you purchase products or Services, payment information may be collected and processed by third-party payment processors.
ElvaMD may receive information including transaction amount, payment status, billing information, transaction identifiers, and limited payment-method information.
ElvaMD may not directly store complete payment-card numbers.
Information Collected Automatically
When you use the Services, we and our service providers may automatically collect information including:
- IP address
- Device identifiers
- Browser type
- Device type
- Operating system
- General location derived from IP address
- Referring and exit pages
- Pages viewed
- Links selected
- Dates and times of access
- Session duration
- Website interaction data
- Advertising identifiers
- Cookie identifiers
- Technical and diagnostic information
Certain browsing or interaction information may reveal or permit inferences regarding your interest in particular health conditions or treatments and may be treated as sensitive information under applicable law.
5. How We Use Information
We may use personal information to:
Provide the Services
Operate ElvaMD, maintain accounts, provide requested functionality, process transactions, and facilitate healthcare-related services.
Facilitate Clinical Care
Transmit information to independent licensed healthcare providers or medical groups so they can determine whether consultations, laboratory testing, treatment, prescriptions, or other healthcare services are appropriate.
Clinical decisions are made exclusively by the licensed healthcare professionals responsible for your care.
Facilitate Services Through Telegra
ElvaMD may provide or transmit information to Telegra as reasonably necessary for Telegra to provide telehealth infrastructure and related services, which may include:
- Intake and eligibility workflows
- Provider-network access
- Clinical workflow support
- Prescribing infrastructure
- Pharmacy routing
- Patient portal functionality
- Prescription fulfillment coordination
- Shipping and tracking
- Administrative services
- Other related telehealth infrastructure
Pharmacy and Laboratory Coordination
We may use information to facilitate prescription routing, pharmacy fulfillment, laboratory testing, shipping, tracking, provider review, and related healthcare services.
Customer Support
We may use information to answer questions, resolve account or order issues, and provide technical or administrative support.
Communications
We may send communications concerning:
- Account activity
- Appointments
- Provider messages
- Treatment
- Prescriptions
- Laboratory testing
- Orders
- Shipping
- Payments
- Security
- Administrative matters
- Service updates
Where permitted, communications may occur by email, telephone, SMS, secure messaging, push notification, or other electronic means.
Service Improvement
We may analyze use of the Services to improve functionality, reliability, user experience, service offerings, and internal processes.
Security and Fraud Prevention
We may use information to verify identity, prevent unauthorized transactions, detect fraud, protect accounts, maintain system security, and investigate suspicious or unlawful activity.
Legal and Compliance Purposes
We may process information to:
- Comply with applicable law
- Respond to valid legal requests
- Enforce agreements
- Resolve disputes
- Protect legal rights
- Meet tax, accounting, regulatory, and recordkeeping obligations
- Protect the health or safety of individuals where appropriate
Marketing
Subject to applicable law and your privacy choices, we may use permitted information to communicate with you regarding ElvaMD services, products, programs, or promotions.
ElvaMD will not use PHI maintained on behalf of a healthcare provider for advertising where such use would violate HIPAA or another applicable law.
6. How We Disclose Information
We may disclose information to appropriate recipients including:
Healthcare Providers and Medical Groups
Information may be provided to licensed physicians, nurse practitioners, physician assistants, medical groups, or other healthcare professionals involved in evaluating or treating you.
Telegra
We may provide information to Telegra as necessary to facilitate telehealth infrastructure, provider-network access, prescribing workflows, pharmacy routing, fulfillment coordination, patient-portal functionality, and related administrative services.
Telegra is a separate third-party service provider and may maintain its own contractual and privacy obligations.
Pharmacies
If a prescription is issued, relevant information may be transmitted to one or more independent licensed pharmacies for:
- Prescription verification
- Processing
- Compounding where applicable
- Dispensing
- Pharmacist consultation
- Payment
- Fulfillment
- Shipping
- Recordkeeping
The specific pharmacy may vary based on treatment, location, licensing, availability, network participation, and applicable law.
Laboratories
Information may be disclosed to independent laboratories or testing providers where necessary to order, process, perform, or report laboratory testing.
Service Providers
We may provide information to vendors that assist with:
- Hosting
- Cloud infrastructure
- Payment processing
- Identity verification
- Customer support
- Communications
- Shipping
- Analytics
- Cybersecurity
- Fraud prevention
- Software services
- Professional services
- Accounting
- Legal support
Advertising and Analytics Partners
Subject to applicable law and your choices, analytics or advertising providers may collect certain information through our websites or applications.
Certain state privacy laws may define some advertising-related disclosures as “selling” or “sharing” personal information even where money is not exchanged.
Where required, ElvaMD will provide applicable opt-out rights.
Business Transfers
Information may be disclosed in connection with a merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or similar transaction.
Legal Requirements
We may disclose information when reasonably necessary to:
- Comply with law
- Respond to valid legal process
- Cooperate with lawful government requests
- Investigate fraud
- Protect individual safety
- Protect ElvaMD's legal rights or property
- Enforce agreements
With Your Direction or Consent
We may disclose information where you request or authorize us to do so.
7. De-Identified and Aggregated Information
We may create aggregated or de-identified information that cannot reasonably be associated with an identifiable individual.
Such information may be used or disclosed for lawful business, research, operational, analytical, or service-improvement purposes.
Where required by law, information represented as de-identified will be maintained in de-identified form.
8. Your Privacy Rights
Depending on your state of residence, you may have rights to:
- Access personal information
- Correct inaccurate information
- Request deletion
- Obtain a portable copy of certain information
- Learn categories of information collected
- Learn categories of recipients
- Opt out of certain targeted advertising
- Opt out of certain sales or sharing
- Limit certain uses of sensitive personal information
- Withdraw consent where applicable
- Appeal certain privacy decisions
These rights are subject to applicable legal exceptions.
We may need to verify your identity before completing a privacy request.
We will not unlawfully discriminate against you for exercising a privacy right.
9. California Privacy Rights
California residents may have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”).
Subject to applicable exceptions, these may include the right to:
- Know categories and specific pieces of information collected
- Know sources of personal information
- Know purposes for collecting and using information
- Know categories of recipients
- Request deletion
- Request correction
- Obtain certain information in portable form
- Opt out of sale or sharing
- Limit certain uses of sensitive personal information
- Be free from unlawful discrimination
Certain healthcare information may be exempt from portions of the CCPA because it is governed by HIPAA, California medical privacy law, or other healthcare-specific laws.
Where required by law, ElvaMD will recognize applicable browser-based opt-out preference signals, including Global Privacy Control.
10. Marketing Communications
You may unsubscribe from promotional email communications using the unsubscribe link provided in those messages.
You may opt out of promotional SMS messages by replying STOP where applicable.
Even after opting out of marketing, you may continue to receive transactional, account, administrative, security, or healthcare-related communications.
11. Data Retention
We retain personal information for as long as reasonably necessary to:
- Provide Services
- Maintain accounts
- Complete transactions
- Meet legal requirements
- Maintain medical, financial, tax, or business records
- Prevent fraud
- Resolve disputes
- Enforce agreements
- Protect legal rights
Healthcare providers, medical groups, pharmacies, laboratories, Telegra, and other healthcare entities may maintain separate record-retention obligations.
12. Information Security
We maintain administrative, technical, and organizational safeguards designed to protect personal information from unauthorized access, loss, destruction, alteration, or disclosure.
However, no electronic transmission or storage system can be guaranteed to be completely secure.
You are responsible for protecting your account credentials and devices.
13. Third-Party Services
The Services may integrate with or link to independent healthcare providers, medical groups, Telegra, pharmacies, laboratories, payment processors, carriers, and other third parties.
Those entities may maintain their own privacy policies and legal obligations.
This Privacy Policy does not govern the independent privacy practices of third parties.
14. State-Specific Consumer Health Data
Certain states provide additional privacy protections for consumer health data.
Where such laws apply, ElvaMD will provide required notices, consent mechanisms, rights, and restrictions.
Certain clinical information may instead be subject to HIPAA or other healthcare-specific privacy laws.
15. International Users
The Services are primarily intended for individuals located in the United States.
Information submitted through the Services may be processed or stored in the United States.
16. Changes to This Privacy Policy
We may periodically update this Privacy Policy.
When changes are made, we will update the “Last Updated” date.
Where required by law, we may provide additional notice before material changes become effective.
17. Contact Us
Questions or privacy concerns may be directed to:
Elva MD LLC
1912 Pine St
Huntington Beach, CA 92648
United States
You may also contact ElvaMD through the contact methods provided on the ElvaMD website.
For clinical questions or medical-record requests, use the secure patient communication channel associated with the healthcare provider responsible for your care.