Start by identifying the organizations, not the badge
A GLP-1 telehealth purchase can involve a website operator, a medical practice and a dispensing pharmacy. A separate app or wellness tool may add another organization. HHS explains that HIPAA protection depends on covered entities and business associates, and generally does not extend to every personal app or piece of browsing information. I would therefore begin with names: who evaluates the history, who keeps the medical record and who runs the shopping account? Ask where each privacy notice can be found before completing a questionnaire. That is a more useful starting point than treating a lock icon or a HIPAA statement as a complete explanation of every data use.[1] Read our first appointment checklist for the related questions.
The GoodRx action explains why promises deserve detail
In its 2023 GoodRx announcement, the FTC alleged that prescription and other sensitive health information had been shared with advertising companies contrary to privacy promises. It also challenged a misleading suggestion of HIPAA compliance. The announcement described an enforcement action and proposed order at that time; it should not be turned into an unsupported statement about every present-day GoodRx service or another company. The useful consumer lesson is to ask what information is used for advertising, which organizations receive it and what choice is available. A broad promise of privacy is less informative than specific answers about the purpose and recipient of a disclosure.[2]
Not covered by HIPAA does not mean no protections exist
The FTC explains that its Health Breach Notification Rule can apply to certain health-record vendors and related services outside HIPAA. Its guidance also makes clear that a breach can involve unauthorized disclosure, not only hacking. Those boundaries depend on the actual organization and information, so a consumer should not try to assign every platform to a legal category from a homepage. Instead, ask which privacy contact handles concerns, where notices are published and how a user is informed if information is compromised. This is a framework for reading disclosures and asking questions, not an individualized legal determination about a particular account or service.[3]
| Information or service | Question to ask |
|---|---|
| Medical practice or its business associate | Which notice applies to the clinical record? |
| Separate consumer health app | Does HIPAA apply to this relationship, and what other protections are described? |
| Personal browsing or device activity | What is collected, for what purpose, and which choices are available? |
HHS explains that HIPAA does not cover every personal app or browsing activity. This question list is a reading aid, not a legal finding about a particular provider. Source: HHS: personal phones, health apps and HIPAA boundaries.
Separate the care information from optional marketing choices
A treatment assessment needs accurate medical information in the appropriate clinical channel. That does not make every promotional email, text campaign or advertising-related use necessary for care. As one example of why the distinction matters, Lemonaid publishes website, consumer-health and medical-information disclosures within its policy material. I would look for the corresponding documents at any service under consideration and ask which choices are optional. If the answer is unclear, save the relevant language and request an explanation before submitting more information. Avoid sending a full health history to a general sales inbox when a limited question about pricing or state access is all that needs answering.[4]
Ask what deletion actually removes
Lemonaid's policy says an account can be deleted while some medical-record information must be retained for legal or regulatory reasons. That is a useful example of a broader distinction to investigate, rather than a privacy score or a claim that its practices are superior. Ask a service what closes the shopping account, what ends marketing contact and what happens to the clinical record. Those may be different requests with different outcomes. Before closing an account during a care transfer, obtain needed records through the proper channel. An account-deletion button should not be mistaken for a complete instruction about ongoing treatment, refill obligations or access to the medical history.[4] Read our care-transfer records guide for the related questions.
Use record-access rights through the responsible practice
HHS describes rights that can apply to protected health information, including obtaining records and asking about privacy practices. The practical step is to identify the medical practice that holds the information and follow its request process. Specify what the receiving clinician needs, use a secure route and keep a copy of the request. If a platform support team directs you elsewhere, ask for the actual practice contact rather than repeatedly sending sensitive documents to multiple addresses. Account support and clinical-record access can overlap in appearance while being handled by different organizations. Keeping the request specific makes it easier to complete without unnecessarily expanding who receives the information.[5] Read our switching-provider guide for the related questions.
Device settings help, but do not replace a service explanation
HHS recommends considering app permissions and reducing unnecessary collection on personal devices. Those settings can reduce exposure, but they do not eliminate a digital footprint or explain what happens to information already provided to a service. I would review permissions and notification previews, then return to the provider's actual data-use answers. For example, ask whether a general chat is intended for medical details and whether another channel is required for a clinical question. Use the service's current instructions rather than assume that every tool on its website belongs to the care team. Privacy choices should support accurate care communication instead of encouraging incomplete or misleading medical answers.[1]
Compare privacy clarity alongside the care and price
Our Lemonaid Health review provides one example of a service with separate membership, prescription and policy questions. The LifeMD review offers an another service comparison when assessing how a different service describes access to care. Neither review certifies legal compliance, cybersecurity or the absence of tracking. The consumer test is whether the organization can explain the relevant data flow in plain language: what information it needs, who receives it and which requests remain available later. Keep those answers with the selected plan and payment terms. An affordable care arrangement should also make it practical to share accurate information through the right channel and obtain records when needs change.[4] Read our Lemonaid Health review for the related questions. Read our LifeMD review for the related questions.
Put the questions to work
Compare our researched providers or build your provider checklist.
Explore relevant provider reviews
Use these reviews to compare the published services and terms. Inclusion is a research starting point, not a recommendation for treatment.
Continue your research
Sources & scope
Sources checked October 25, 2026. This guide explains published information and consumer research questions; it is not a clinical evaluation.
- HHS: personal phones, health apps and HIPAA boundaries
- FTC: 2023 GoodRx health-data enforcement announcement
- FTC: Health Breach Notification Rule compliance guidance
- Lemonaid: privacy, health-data and account-retention disclosures
- HHS: individual rights under HIPAA
Prices and terms can change. Confirm your specific offer directly with the provider.