Apothecare Privacy Policy

Effective date: October 3, 2026
Last updated: October 3, 2026

1. Who we are and what this policy covers

Apothecare, Inc. ("Apothecare," "we," "us," or "our") provides an AI clinical intelligence platform for functional, integrative, and longevity health practitioners. Practitioners use Apothecare to manage patient records, ask clinical questions, interpret lab results, review evidence citations, document visits, run patient intake, and offer a patient portal.

This Privacy Policy explains how Apothecare collects, uses, shares, and protects personal information when you:

visit apothecare.ai or our other websites (the "Site");
create or use a practitioner account on the Apothecare platform (the "Services"); or
use the Apothecare patient portal or intake forms at the invitation of your practitioner.

If you have questions about this policy, contact us at notifications@apothecare.ai.

2. Patient health information and your practitioner

Many people whose information is in Apothecare are patients of the practitioners who use our Services. Apothecare does not provide medical care and does not have its own relationship with those patients.

When a practitioner enters information about a patient, uploads a patient's lab report or document, records a visit, or invites a patient to use the patient portal or intake forms, Apothecare handles that patient information on the practitioner's behalf. We handle it under the practitioner's instructions and our agreements with the practitioner. The practitioner decides what patient information is collected and how it is used in the patient's care.

This Privacy Policy describes Apothecare's own practices. It does not replace the privacy notice or privacy practices of your practitioner. If you are a patient and want to see, correct, or delete your health information, or have questions about how it is used, please contact your practitioner first. If you contact us about information a practitioner controls, we will refer your request to that practitioner or help them respond, as our agreements with them allow.

3. Information we collect

3.1 Practitioners and their staff

Account information. When you register, we collect your full name, email address, and password. If you choose to sign in with Google, we receive basic profile information from Google, such as your name and email address.

Professional and practice information. During onboarding we collect your license type, license state, license number (optional), practice name, practice phone number, and clinical specialty focus. We also record when you accepted our AI disclosure and which version you accepted, and when you accepted our Terms.

Billing information. If you purchase a subscription, payment is handled by our payment processor, Stripe. You enter your card details directly with Stripe. We receive and store information such as your Stripe customer identifier, subscription plan and status, and billing email. We do not receive your full card number.

Content you provide. We collect the content you enter or upload in the Services, including questions you ask in AI chat, conversation history, files and images you attach, documents you add to your knowledge base, notes, protocols, and settings.

Communications. If you contact us for support or otherwise communicate with us, we collect the contents of those communications and your contact details.

Account activity and security information. We collect information about how you use your account, such as sign-in events, failed sign-in attempts, password resets, actions you take in the Services, the IP address and browser information associated with those actions, and records of AI feature usage.

3.2 Patient information provided by practitioners or by patients

Practitioners, and patients using the patient portal or intake forms, may provide information such as:

Identifiers and contact details: name, date of birth, sex, gender identity, ethnicity, email address, phone number, mailing address, and how the patient was referred.
Health history: chief complaints, medical history, current medications and supplements, allergies, diagnoses, surgeries, hospitalizations, family history, lifestyle information, symptom scores, health goals, and genetic markers the practitioner chooses to record.
Lab results and documents: lab reports and other files uploaded as PDFs or images, and the biomarker values extracted from them.
Visit records: visit notes, vitals, treatment protocols, and, if the practitioner uses our visit recording (scribe) feature, audio recordings of visits and their transcripts.
Portal and intake activity: intake form answers (including saved drafts), electronic signatures on consent documents (such as the typed name, the time of signing, and technical information about the device and browser used), symptom check-ins, messages, requests to amend records, protocol acknowledgments, medication and supplement lists, and invoices.

Patients sign in to the portal using a link sent to their email address.

3.3 Site visitors

Contact and sales forms. If you use our contact form, we collect your name, email address, subject, and message. If you use our sales inquiry form, we collect your name, email address, company, role, phone number, team size, area of interest, your message, and which page you came from.

3.4 Information collected automatically

Essential cookies and similar storage. We use cookies and similar technologies that are needed to keep you signed in, keep the Services secure, and remember your plan settings. See section 7.

Analytics (only if you agree). If you choose "Accept analytics" in our cookie banner, we use Google Analytics to understand how the Site and Services are used. Before page information is sent to Google Analytics, we reduce page addresses to general sections of the Site, and we do not send it on our messaging pages. If you do not accept, Google Analytics is not loaded.

Server and request information. Like most online services, our hosting infrastructure receives information such as IP address, browser type, device information, pages requested, and the date and time of requests. This information is used to operate, secure, and troubleshoot the Services.

4. How we use information

We use personal information to:

Provide the Services. This includes creating and managing accounts, storing and displaying records, generating AI outputs, interpreting lab reports, finding evidence citations, transcribing visit recordings, running the patient portal and intake, and sending service emails such as sign-in links, password resets, and account notices.
Process payments and manage subscriptions.
Provide support and respond to your requests and inquiries.
Keep the Services secure, including verifying identity, detecting and preventing fraud, abuse, and unauthorized access, and investigating security issues.
Maintain and improve the Services, using practitioner account and usage information and Site visitor information.
Communicate with you about the Services, including changes to our terms or policies.
Comply with law and enforce our agreements, and protect the rights, safety, and property of Apothecare, our users, and others.

We do not sell personal information, and we do not use patient health information for advertising. We do not use patient health information to train AI models, and our AI provider does not use the information we send it to train its models.

5. AI features

Several Apothecare features use artificial intelligence, including AI chat, lab report interpretation, evidence summaries, protocol drafting, document and image analysis, visit transcription, and audio generation.

When you use these features, the content needed to produce a result (for example, your question, relevant patient information you choose to include or that the feature is designed to use, attached files, lab reports, or visit audio) is sent to our AI provider so that it can generate the output. Section 6 names our AI provider.

AI outputs can be incomplete, outdated, or wrong. They are meant to support, not replace, professional judgment. Practitioners remain fully responsible for all clinical decisions and for reviewing any AI output before relying on it or sharing it with a patient.

6. How we share information

We share personal information only as described below.

Service providers. We use service providers that process information on our behalf to run the Services. They may use the information only to provide services to us. Our service providers include:

AI provider. OpenAI, whose API models power our AI features.
Cloud hosting, database, file storage, and infrastructure. Amazon Web Services (AWS).
Payment processing. Stripe.
Sign-in. Google, if you choose to sign in with Google.
Analytics. Google Analytics, only if you accept analytics cookies.
Email. Google Workspace, which sends account, sign-in, and notification emails for us.
Business tools we use to onboard and support our practitioner customers.

Public research and reference databases. To find evidence citations and suggest medication and supplement names, the Services send search queries to public research and reference databases, including the U.S. National Library of Medicine (PubMed, PubMed Central, RxNav, and Clinical Tables) and Europe PMC. A search query may be based on the text of a question or entry in the Services. These organizations receive the search query and standard technical information, such as an IP address, but not your account information.

Practitioners and their patients. Patient information is available to the practitioner (and the practitioner's authorized staff) who manages that patient's record. Information a patient submits through the portal or intake forms is shared with that patient's practitioner. Information a practitioner chooses to share through the portal (such as protocols, notes, or invoices) is shared with the patient.

Legal and safety reasons. We may disclose information if we believe in good faith it is required by law, subpoena, or other legal process, or is necessary to protect the rights, property, or safety of Apothecare, our users, patients, or others, or to investigate fraud or security issues.

Business transfers. If Apothecare is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction. If that happens, we will take reasonable steps to require the recipient to protect personal information consistent with this policy and our agreements with practitioners.

With your consent or at your direction. We may share information for other purposes with your consent or at your direction, for example when you ask us to send your data to someone.

No sale or targeted advertising. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We do not run third-party advertising in the Services. Our Google Analytics configuration turns off Google's advertising features (advertising storage, ad personalization signals, and Google signals).

7. Cookies and similar technologies

We use a small number of cookies and similar browser storage:

Essential cookies. These keep you signed in to your account or the patient portal, protect your session, and remember your subscription plan settings. The Services cannot work without them, so they cannot be turned off through our banner.
Consent preference. When you make a choice in our cookie banner, we save that choice in a cookie and in your browser's local storage so we do not ask again each visit.
Analytics cookies (optional). Google Analytics cookies are set only if you click "Accept analytics." If you decline or make no choice, Google Analytics is not loaded. You can change your choice by clearing your browser's cookies and site data for apothecare.ai, which will show the banner again.

We do not use advertising pixels, session recording tools, or third-party advertising cookies.

Browser privacy signals. Because we do not sell personal information or share it for targeted advertising, and analytics runs only if you opt in, we do not change our practices in response to Do Not Track signals. Where state law requires, we treat a Global Privacy Control signal as a request to opt out of sale or sharing.

8. How long we keep information

We keep personal information for as long as needed for the purposes described in this policy, including providing the Services, meeting our agreements with practitioners, resolving disputes, enforcing our agreements, and complying with legal obligations. When information is no longer needed, we delete it or de-identify it, subject to those obligations.

Patient information is kept according to the practitioner's instructions and our agreements with the practitioner, and as required by law.

9. Security

We encrypt stored information, and we use administrative, technical, and physical safeguards designed to protect information. However, no method of transmitting or storing information is completely secure, and we cannot guarantee absolute security.

You are responsible for keeping your password and sign-in methods confidential and for the activity on your account.

10. Your choices and rights

Account information. Practitioners can review and update some of their account and practice information in their account settings. You can also contact us to ask to access, correct, or delete your personal information.

Copies of your data. Practitioners can ask us for a copy of their account data, including patient records they manage.

Deletion. You may ask us to delete your account and personal information. We may need to keep some information to comply with legal obligations (including legal preservation obligations), resolve disputes, prevent fraud and abuse, or enforce our agreements. When this applies, we will tell you what we cannot delete and why, where the law allows.

Patients. If your information was entered into Apothecare by your practitioner, or you provided it through your practitioner's portal or intake forms, your practitioner controls those records. Please send requests to access, correct, or delete that information to your practitioner. If you contact us, we will refer your request to your practitioner or help them respond.

Marketing emails. If we send marketing emails, you can opt out using the link in the email. We will still send service messages about your account.

State privacy rights. Depending on where you live, you may have rights under state privacy laws, such as the California Consumer Privacy Act and similar laws in other states. These may include the right to know what personal information we collect, use, and disclose; to access or receive a copy of it; to correct it; to delete it; to opt out of the sale or sharing of personal information or of targeted advertising (we do not sell or share personal information for those purposes); to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. To make a request, contact us at notifications@apothecare.ai. We will verify your request before acting on it. You may use an authorized agent where the law allows. If we deny your request, you may be able to appeal by replying to our decision.

11. Children

The Site and Services are not directed to children, and practitioner accounts are only for adults who are licensed or otherwise authorized health professionals or their staff. We do not knowingly collect personal information directly from children under 18. Practitioners may treat minors, so a practitioner may enter information about a minor patient, and a parent or guardian may complete portal or intake forms for a minor. That information is handled as described in section 2. If you believe a child has given us personal information directly, contact us and we will take appropriate steps.

12. Where we process information

Apothecare is based in the United States, and our primary hosting infrastructure is in the United States. Some of our service providers may process information in other countries. If you access the Services from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date above and post the updated policy on this page. If we make material changes, we will also notify practitioners through a notice in the Services or by email before the changes take effect, where practical.

14. Contact us

If you have questions or requests about this Privacy Policy or our privacy practices, contact:

Apothecare, Inc.
Attn: Privacy
800 North King Street, Suite 304-2735
Wilmington, DE 19801
Email: notifications@apothecare.ai

If you are a patient, please contact your practitioner first about your health records.