Privacy at Leland

1. Who we are and what this covers

This Privacy Policy describes how Inverse Collective LLC d/b/a Leland Health ("Leland," "we") collects, uses, and shares personal information when you visit lelandhealth.com, take our assessment, or otherwise interact with us. Health information you provide as a patient is additionally protected under HIPAA and described in our Notice of Privacy Practices (the other tab). Where the two overlap, the stricter protection applies.

2. Information we collect

You provide: contact details (name, email, phone, shipping address), account credentials, payment information (processed by our payment processor — we never store full card numbers), assessment answers including health information, messages to support and your care team, and reviews or testimonials you submit.

Collected automatically: device and browser type, IP address, pages viewed, referral source, and interactions with our site, via cookies and similar technologies you can turn off via "Cookie preferences" in the footer. We deliberately configure analytics and advertising tools to receive page-level events only — never your assessment answers, health conditions, BMI, medications, or plan names.

3. How we use it

• Providing the service: connecting you with licensed providers, filling prescriptions through partner pharmacies, shipping, and support
• Payments, fraud prevention, and account security
• Service communications: order updates, care-team messages, safety notices (you can't opt out of these while an active patient)
• Marketing communications — only with your consent, and never referencing your health information; unsubscribe anytime
• Improving the site and measuring what content helps people, using de-identified or aggregate data wherever possible
• Legal compliance, including pharmacy, telehealth, and record-keeping laws

4. What we share — and what we never share

We share personal information only with: our medical group and licensed providers; partner pharmacies filling your prescription; service providers under contract (payment processing, shipping carriers, cloud hosting, customer-support tooling) bound to use it only for us; and authorities when legally required.

We never sell your personal information, and we never share your health information with advertising platforms. Ad measurement uses page-level events and, at most, hashed contact information for people who consented to marketing — never health data. We do not use advertising tools' "advanced matching" features that could expose health context.

5. Cookies and tracking

Essential cookies keep you logged in and the site working. We also use analytics and advertising cookies to learn which pages help people and to measure our ads; you can turn either off anytime via "Cookie preferences" in the footer. We honor Global Privacy Control (GPC) signals as an opt-out of targeted advertising where required by law.

6. Your rights

Depending on your state (including California, Colorado, Virginia, and Washington under the My Health My Data Act), you may have the right to access, correct, delete, or export your personal information, and to opt out of targeted advertising. Exercise any of these by emailing privacy@lelandhealth.com or from your portal — we respond within the timeframe your state's law requires, and we never discriminate for exercising your rights. Note: medical and pharmacy records are subject to legal retention periods and may survive an account deletion request; we'll tell you exactly what we must keep and why.

7. Security and retention

Data is encrypted in transit and at rest; access is role-scoped, minimum-necessary, and logged on an immutable audit trail. We retain personal information only as long as needed for the purposes above or as law requires (medical records typically 7–10 years depending on state). We will notify you and regulators of any breach as required by law.

8. Children, changes, and contact

Our services are for adults 18+; we do not knowingly collect information from minors. We'll notify you of material changes to this policy by email and by notice on this page at least 14 days before they take effect. Questions or requests: privacy@lelandhealth.com, or write to Inverse Collective LLC d/b/a Leland Health, 5900 Balcones Drive, Suite 16274, Austin, TX 78731.

Who this notice covers

This Notice of Privacy Practices applies to protected health information ("PHI") held by Leland Health, its affiliated medical groups and providers, and the partner pharmacies that fill your prescriptions (together, the "Care Team"). We are required by law to maintain the privacy of your PHI, give you this notice, and follow its terms.

How we may use and disclose your PHI

• Treatment — your provider, care team, and pharmacy share your PHI to prescribe, fill, ship, and manage your treatment, and to coordinate with other clinicians you authorize.
• Payment — processing your payments and maintaining billing records. (We do not bill insurance.)
• Health care operations — quality review, clinician credentialing, compliance audits, and safety monitoring.
• Required by law — public-health reporting (including adverse drug events to the FDA), abuse reporting, health oversight, court orders, and law enforcement when legally compelled.
• To avert serious threats — to prevent a serious and imminent threat to your health or safety or another person's.

Uses requiring your written authorization: marketing, sale of PHI (which we never do), psychotherapy notes, and most other uses not listed above. You may revoke an authorization at any time in writing, except where we've already relied on it. We will never use your PHI for advertising.

Your rights

• Access & copies — inspect and get a copy of your medical record, electronically or on paper, within 30 days of your request (from your portal, usually faster).
• Amendment — ask us to correct PHI you believe is wrong or incomplete; if we deny the request, you may file a statement of disagreement.
• Accounting of disclosures — a list of certain disclosures we've made in the prior six years.
• Restrictions — request limits on how we use or share your PHI; because you pay out of pocket, you may require us not to disclose treatment information to a health plan.
• Confidential communications — ask us to contact you at a specific phone, email, or address.
• Breach notification — we will notify you if a breach compromises your unsecured PHI.
• Paper copy — of this notice, any time, on request.

Complaints and contact

If you believe your privacy rights have been violated, contact our Privacy Officer at privacy@lelandhealth.com or Inverse Collective LLC d/b/a Leland Health, Attn: Privacy Officer, 5900 Balcones Drive, Suite 16274, Austin, TX 78731. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. We will never retaliate against you for filing a complaint.

Changes to this notice

We may change this notice and apply the changes to PHI we already hold. The current version is always posted here with its effective date, and material changes are announced in your portal. Effective date: August 20, 2026.