Save $200 monthly w/ Helix’s Black Card

Book Appointment

Privacy Policy

Appendix D – Privacy Policy

Effective Date:  September 1, 2025
Updated: January 22, 2026

This Privacy Policy explains how the Contracting Entity (“Helix,” “we,” “us,” or “our”) collects, uses, and discloses information about you when you use our website, mobile application, and related services (collectively, the “Services”). This Privacy Policy is intended to supplement (not replace) any HIPAA Notice of Privacy Practices that applies to a particular Helix entity or clinician relationship.

1. Information We Collect

  • Account and contact information (for example, name, email, phone number, date of birth, address).
  • Health and wellness information you provide (for example, symptoms, goals, medical history, lab results, medications).
  • Communications (for example, messages with our care coordination team, support requests).
  • Payment information (processed by third-party payment processors; we receive limited payment metadata).
  • Device and usage information (for example, IP address, device identifiers, app interactions, and crash logs).
  • Approximate location derived from IP address for security and fraud prevention. We do not use geofencing for advertising or tracking around health care facilities.

2. How We Use Information

  • Provide the Services, including scheduling, care coordination, and customer support.
  • Facilitate care delivery by clinicians and fulfillment by labs and pharmacies.
  • Operate, maintain, and secure the Services, including fraud prevention and troubleshooting.
  • Quality improvement and internal analytics using de-identified or aggregated information where feasible.
  • Communicate with you about service-related topics (appointments, labs, billing).
  • Comply with legal obligations and enforce our terms.

3. How We Share Information

We share information only as needed to operate the Services and provide care coordination.

  • With clinicians, laboratories, and pharmacies involved in your care and orders.
  • With service providers that perform services on our behalf (for example, hosting, customer support, messaging) under contracts that require confidentiality and security.
  • For legal and compliance reasons (for example, to respond to lawful requests, protect rights and safety, or during a business transaction such as a merger or asset sale).

No targeted advertising; no sale/share. Helix does not use personal information for targeted advertising and does not sell personal information for money. Helix also does not share personal information for cross-context behavioral advertising (as those terms may be defined under certain state laws).

No biometrics. Helix does not collect biometric identifiers or biometric information (such as faceprints, fingerprints, or voiceprints) as defined under the Illinois Biometric Information Privacy Act (BIPA). If this changes in the future, we will provide a separate biometric notice and obtain any required written consent before collection.

4. Cookies and Similar Technologies

We use cookies and similar technologies for essential functionality and limited analytics. We do not use third-party advertising cookies for targeted advertising.

You can control cookies through your browser or device settings. Some features may not function without essential cookies.

5. Data Retention

We retain information for as long as necessary to provide the Services and comply with legal obligations, including medical record retention requirements where applicable. Retention periods may vary by data type and applicable law.

6. Security

We use reasonable administrative, technical, and physical safeguards designed to protect information. No system is perfectly secure, and we cannot guarantee absolute security.

7. Your Privacy Choices and Rights

Depending on where you live and how your information is regulated, you may have rights to access, correct, delete, or obtain a copy of certain information. You may also have rights to opt out of certain processing (such as targeted advertising, sale, or sharing). Because Helix does not engage in targeted advertising or sale/share for advertising, opt-out rights may not apply to our current practices; however, we will honor verified requests as required by law.

To submit a request, contact us using the information in Section 17 of the Terms or at:customerservice@helixbayarea.com. We may verify your identity before responding. We will not discriminate against you for exercising privacy rights.

8. State-Specific Disclosures

The following state disclosures are provided for convenience and apply where required. If information is also regulated by HIPAA, HIPAA may supersede certain consumer privacy rights.

  • California (CCPA/CPRA): You may have rights to know, delete, correct, and obtain a copy of personal information, and to limit use of sensitive personal information. If we ever engage in “selling” or “sharing” as defined by California law, we will provide a “Do Not Sell or Share My Personal Information” mechanism and honor Global Privacy Control signals where required.
  • Colorado (CPA): Colorado residents may have rights to access, correct, delete, and obtain a portable copy of personal data, and to opt out of sale, targeted advertising, and certain profiling. If applicable, we will honor recognized universal opt-out mechanisms.
  • Texas (TDPSA): Texas residents may have rights to access, correct, delete, and obtain a copy of personal data and to opt out of targeted advertising, sale, and certain profiling.
  • Utah (UCPA): Utah residents may have rights to access, delete, and obtain a copy of personal data and to opt out of targeted advertising and sale.
  • Nevada (SB 220): Nevada residents may opt out of the sale of certain covered information. Submit requests to [PRIVACY EMAIL].
  • New York (SHIELD Act): We maintain reasonable safeguards appropriate to the nature of the information we handle and will provide breach notifications as required by law.
  • Illinois (BIPA): As noted above, we do not collect biometric identifiers or biometric information.
  • Washington (My Health My Data Act) and Washington, DC (Consumer Health Information): If we collect “consumer health data” as defined by these laws, additional notices and affirmative express consent may be required. See Appendix F for recommended consent language and Appendix E for the Consumer Health Data Privacy Notice.

Appendix E – Consumer Health Data Privacy Notice (WA + DC)

Effective Date:  September 1, 2025
Updated: January 22, 2026

This notice applies to “consumer health data” as defined by Washington’s My Health My Data Act and similar laws, and to “consumer health information” under the District of Columbia’s Consumer Health Information Privacy Protection Act, to the extent applicable.

1. Categories of Consumer Health Data We Collect

  • Information you provide about your health, symptoms, goals, medications, and medical history.
  • Laboratory and diagnostic information (for example, lab orders and results) that you provide or that is returned to you through clinicians, labs, or the platform.
  • Appointment, care coordination, and treatment-related information necessary to provide the Services.

2. Purposes for Collection and Use

  • Provide and coordinate services you request (including facilitating clinician care and fulfillment by labs/pharmacies).
  • Operate, maintain, and secure the Services.
  • Compliance, auditing, and legal obligations.
  • Quality improvement using de-identified or aggregated information where feasible.

3. Sources of Consumer Health Data

  • You and your authorized representatives.
  • Clinicians involved in your care.
  • Laboratories and pharmacies involved in your orders and fulfillment.
  • Service providers that support the Services (for example, secure hosting and communications).

4. How We Share Consumer Health Data

We share consumer health data only as needed to provide the Services and comply with law.

  • With clinicians, laboratories, and pharmacies involved in your care and orders.
  • With service providers that process data on our behalf under contracts requiring confidentiality and security.
  • With government authorities or others when required by law.

We do not sell consumer health data. We do not share consumer health data for targeted advertising.

5. Your Rights (WA + DC)

  • Access: You may request access to your consumer health data.
  • Delete: You may request deletion of your consumer health data, subject to legal exceptions (including record retention obligations).
  • Withdraw consent: Where processing is based on affirmative consent, you may withdraw that consent.
  • Appeal: Where required, you may appeal a denial of a rights request.

To exercise these rights, contact  customerservice@helixbayarea.com

6. Geofencing

We do not use geofencing around facilities that provide in-person health care services to identify or track consumers, collect consumer health data, or send health-related advertising.

Appendix F – Recommended Consent Language

Use the following sample checkbox language in account creation and enrollment flows. Present consumer health data consent separately from general Terms acceptance where required.

General

  • I agree to the Helix Terms of Service and Patient Agreement.
  • I agree to receive service-related communications (appointments, labs, billing) by email, phone, and/or text as described in the Terms.
  • I consent to telehealth services where offered and appropriate, and I understand telehealth limitations.

Consumer Health Data (WA + DC) – Separate Affirmative Express Consent

  • I consent to Helix collecting and using my consumer health data as described in the Consumer Health Data Privacy Notice (Appendix E) and the Privacy Policy (Appendix D) to provide the Services I request.
  • I consent to Helix sharing my consumer health data with service providers and partners as described in the Consumer Health Data Privacy Notice. (Helix does not share consumer health data for targeted advertising.)

Helix will not sell consumer health data in any circumstance requiring separate authorization under applicable law unless and until it has provided the individual with a separate, standalone authorization and obtained all legally required consent or authorization.