Consumer Health Data Privacy Policy

Effective date: Oct 8, 2026

Last updated: Oct 8, 2026

1. Scope and contact

Regimen Inc. provides Pill Partner, its connected app and caregiver features. This notice addresses consumer health data handled through our direct-to-consumer service and supplements our general Privacy Policy. It does not represent that our D2C service is HIPAA compliant. Our launch is for adults, including adults managed by a caregiver.

Contact: [email protected]. Mailing address: Regimen Inc., 134 E 93rd St., Apt 5A, New York, NY 10128.

2. Health data and its sources

We collect medication names, dosages, schedules and notes entered by you or an authorized caregiver; organizer compartment-access events and their times; manual activity reports; and summaries and notification decisions derived from those records. Account, household, caregiver relationships, device identifiers, connectivity and diagnostics can also become consumer health data when linked to a person’s medication routine or use of our service. Purchase and support records may reveal use of a health-related product.

Sources are your account and app entries, authorized caregivers and household participants, your Organizer, our service’s processing of those records, and information you provide through support or privacy requests. We do not receive a pharmacy data feed for this D2C launch. Compartment access does not establish that medication was taken or ingested.

3. Why and how we process it

We store and process health data to deliver the medication routine, organizer activity, history, reminders and caregiver sharing you request; authenticate users and apply permissions; troubleshoot the connected service; and handle relevant support and privacy requests. Authorized staff use restricted internal tools for these purposes. We minimize information sent outside the health-data backend.

Collection and sharing must have the permission or requested-service basis required by applicable law. Before an adult first enters their own medication information, we request a separate, one-time health-data permission. Caregiver sharing and managed-adult authority use their respective confirmations. General acceptance of terms is not a substitute for separate consent where required. We do not sell consumer health data or use medication data for advertising or advertising profiles.

4. Sharing and recipients

Authorized household participants and caregivers receive the medication routine and activity information within the permissions for the relevant adult. Purchasing the Organizer alone does not give a person access to someone else’s health information. A managed adult may not have an app account; a caregiver entering their health information must confirm that they have that adult’s permission or legal authority. This confirmation does not itself establish that legal authority exists.

Supabase provides authentication, database and backend processing of account, medication, activity and authorization records. Apple’s push service and recipient devices receive limited notification content and delivery identifiers; medication names and person names are kept out of push copy. Push copy describes organizer activity or an organizer needing attention without disclosing a person, medication, dose, compartment or time-of-day details. Linked notification metadata can still be sensitive.

Cloudflare hosts website and staff surfaces and handles associated web traffic and security metadata. Stripe handles purchase, payment, billing and shipping information, not medication plans or dose activity. Resend handles authentication and transactional email delivery and associated account/order metadata. Google Workspace handles support messages and attachments you send to our support inbox. A selected shipping provider receives delivery information needed to fulfill orders.

We may disclose information where legally required or for permitted protection of safety and rights. A purchaser of Regimen’s business must respect applicable privacy obligations. We will give required notices and obtain required permission for new uses or recipients. Specific recipient identities and contact routes are available through a verified privacy request. We do not authorize advertising providers to track your medication information across other websites or services.

5. Permissions and your choices

You may ask us to stop future collection or sharing, withdraw consent, request access or correction, or delete consumer health data. These requests do not require purchasing or cancelling a subscription. Stopping a health-data flow can make the affected tracking, reminder or caregiver feature unavailable; existing account, purchase and support access are separate. Subscription cancellation alone does not erase history. Deleting health history also stops that person’s cloud tracking so old app or device uploads do not immediately recreate the deleted history. Account, orders and billing remain separate; restarting requires verified fresh permission through support.

You can edit supported medication and account fields in the app and contact us for other corrections. Revoking shared access stops future authorized access; information a recipient previously saved may require separate handling.

6. Requests and appeals

Use the website’s privacy-request form or email [email protected]. You do not need to create an account. Tell us the request type and the person concerned; do not send a full medication history by ordinary email. We verify identity and, when someone acts for another adult, authority, using only reasonably necessary information.

A request can seek confirmation of collection or sharing, access to data and recipient contacts, correction, cessation or deletion. We respond without undue delay within applicable deadlines. Deletion includes required notices to recipients and handling of backup copies within applicable limits. We explain a refusal and how to appeal through the same form or email. Appeals receive a written decision and, if denied, the relevant Attorney General’s complaint route. We do not penalize people for exercising applicable privacy rights.

7. Retention and changes

Raw Organizer activity may be compacted after 60 days while summaries and active plans remain available. Cancelling membership does not automatically delete the account or its history. We delete or deidentify data when no longer needed, subject to applicable obligations. Extra copies created to answer an access request normally expire after 30 days; normal app history is separate, and a justified exception requires a review date. Necessary purchase, tax, warranty, fraud or dispute records are retained only for justified purposes and restricted accordingly; these purposes do not create a blanket exception to health-data deletion rights.

We will notify affected users of material changes. When law requires prior disclosure or affirmative consent for new categories, purposes or recipients, we will obtain it before making that change.

Submit a privacy request from your account, or contact [email protected] without creating an account. General Privacy Policy.