What this website collects, and what it doesn't.

What this policy covers

This Privacy Policy explains how HZN Wellness (“HZN Wellness,” “we,” “us” or “our”) collects, uses and shares information through this website (the “Site”). It applies to the Site only.

It does not apply to the secure patient portal you reach from our Get started page or the “Sign in” links. That portal is run for us by a third-party electronic health record provider, and the health information you enter there is handled under our Notice of Privacy Practices and applicable law, as described below. It also does not apply to other websites we link to.

Our programs are available only to people located in Utah.

What we collect, and what we don't

No health information

The Site does not ask for, and is not designed to collect, health information. There is no questionnaire, symptom checker or account on the Site. The health assessment happens entirely in the patient portal after you leave the Site. Please don't send health information through the contact form or by email; use the patient portal instead.

Information you give us through the contact form

If you send us a message through the contact form, we receive the information you enter: your name, your email address, your phone number if you choose to give it, and your message. The form is for general questions only. We use this information to reply to you.

To protect the form from spam, the Site briefly checks each submission. It issues a short-lived security key tied to your IP address when the page loads, and it looks at the message content and a few hidden fields that automated programs tend to fill in. This check is used only to block spam.

Information collected automatically

Google Analytics. We use Google Analytics 4, a service provided by Google LLC, to understand how visitors use the Site. It collects information such as the pages you view, how long you stay, how you arrived (for example, from a search engine), your general location (such as city or region), and your device, browser and screen size. We also record clicks on key buttons. When you choose a program, we record that a program button was clicked and which program it was (Semaglutide, Tirzepatide or Help me choose). Google states that Google Analytics 4 does not log or store IP addresses. We have not turned on Google's advertising features for the Site.

Heatmap. We use a simple heatmap tool, run for us by our website provider, to see which parts of a page get attention. It records the page address, whether you're on a phone or a larger screen, the approximate position of clicks on the page (rounded to a coarse grid), and how far down the page you scroll. It does not use cookies, does not record what you type, and does not record your screen.

Accessibility settings. The Site offers an optional panel for adjusting text size, contrast and similar display settings. If you use it, your choices are saved in your own browser so they stay in place from page to page. They are not sent to us.

Technical information. Like any website, the servers that deliver the Site receive standard technical information with each request, such as your IP address, browser type and the page requested. Our hosting provider uses this information to deliver the Site and protect it from attacks and abuse.

Where tracking stops. Our analytics and heatmap run on the Site only. They stop when you leave the Site for the patient portal, and nothing you enter in the assessment or the patient portal is tracked by them. If the portal sends you back to our thank-you page when you finish, that page records only that a visit reached it, with no health details.

Cookies and local storage

Cookies are small files a website stores in your browser. Local storage is a similar feature that keeps information in your browser.

• Analytics cookies. Google Analytics sets first-party cookies (their names begin with “_ga”) to tell visits apart and recognize a returning browser. They can last up to two years unless you delete them.
• Security cookies. Our hosting provider, Cloudflare, may set cookies that are strictly necessary to protect the Site from bots and abuse.
• Local storage. The accessibility panel saves your display choices in your browser's local storage. The Get started and thank-you pages also keep a short note in your browser's session storage, cleared when you close the tab, so a visit is counted only once. Nothing else on the Site uses them.

We don't use advertising cookies, social media pixels or other advertising trackers on the Site.

How we use information

We use the information described above to:

• reply to your questions and messages;
• operate, maintain and improve the Site, including how easy it is to use and to find information;
• understand, in general, how many visitors choose each program;
• protect the Site and the contact form from spam, fraud, abuse and security threats; and
• comply with legal obligations and enforce our Terms of Use.

We don't use information from the Site to make decisions about your eligibility or care. Those decisions are made by licensed clinicians using the information you provide in the patient portal.

Who we share it with

We don't sell personal information, and we don't share it with others for their own marketing or for targeted advertising. We share information only as follows:

• Service providers that help us run the Site and handle it only on our behalf: Cloudflare, which hosts and protects the Site; our website provider, which operates the contact form, delivers form messages to us by email and runs the heatmap tool; our email provider; and Google, which provides Google Analytics.
• Legal and safety reasons, when we believe in good faith that the law requires it, or to protect the rights, property or safety of HZN Wellness, our patients or others.
• Business changes, such as a merger, acquisition or sale of all or part of our business, in which case information may transfer to the new owner under this policy.
• With your permission, or at your direction.

Health information and our Notice of Privacy Practices

When you continue to the patient portal or sign in, you leave the Site for our secure patient portal. The information you share there, including your health history, assessment answers, consent forms, payment details, messages with your care team and prescriptions, is medical information. We protect it as required by applicable law, including the Health Insurance Portability and Accountability Act (HIPAA) where it applies.

How we use and share that information, and your rights over it, are described in our Notice of Privacy Practices. The Notice is provided to you in the patient portal before you begin care, and you can ask us for a copy at any time using the contact details below.

Your choices

• Opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.
• Block or delete cookies through your browser settings. The Site works without analytics cookies.
• Clear your accessibility settings with the panel's “Reset all settings” button or by clearing your browser's site data.
• Use private browsing or a content blocker if you prefer, and the Site will still work.
• Don't use the contact form if you'd rather not share your contact details; you can find answers on our FAQ page.

Some browsers send “Do Not Track” signals. Because there is no common standard for how to respond to them, the Site does not change its behavior when it receives one. The choices above work regardless.

Your privacy rights

Depending on where you live, you may have rights over the personal information we hold about you from the Site, such as the right to know what we have, to get a copy, to correct it, to have it deleted, and to opt out of its sale or use for targeted advertising (which we don't do). Whether or not a state law applies to us, we'll honor reasonable requests to see, correct or delete the contact information you've sent us through the Site.

To make a request, email us at the address below. We may need to confirm your identity before acting on it, and we'll respond within the time the law requires. If we deny your request, you can ask us to reconsider by replying to our response. We won't treat you differently for exercising your privacy rights.

Requests about health information in the patient portal are handled under our Notice of Privacy Practices.

Children

The Site is not directed to children, and our programs are available only to adults 18 and older. We don't knowingly collect personal information from anyone under 18 through the Site. If you believe a child has sent us information, please contact us and we'll delete it.

Security

The Site is served only over an encrypted connection (HTTPS), and we use reasonable administrative, technical and physical measures to protect the information we receive through it. No website or internet transmission is completely secure, though, so we can't guarantee absolute security. This is one reason the Site never asks for health information.

How long we keep it

We keep contact form messages for as long as we need them to respond to you and for our ordinary business records, and then delete them, unless the law requires us to keep them longer. Google Analytics data is kept for up to 14 months and then deleted automatically. Heatmap data is stored as rounded click positions and scroll depth by page, without names or contact details.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we'll post the new version on this page and change the effective date at the top. If we make a significant change to how we handle personal information, we'll give a more prominent notice on the Site.