Privacy Policy
Riovie is a technology and lifestyle-support platform operated by Riovie Operations LLC. We connect you with independent, licensed healthcare providers and offer nutrition and lifestyle guidance. We do not practice medicine. Our Services are intended for residents of the United States only and are not directed to anyone outside the United States. This Policy explains what information Riovie collects, how we use and share it, and the choices and rights you have. Protected health information created when you receive care is also governed by our HIPAA Notice of Privacy Practices, which controls for that information.
1. The Two Kinds of Information Involved
It is important to understand how your information is handled:
Marketing and account data that Riovie collects directly — for example, your name, email, and the answers you give in our pre-screener — is governed by this Privacy Policy.
Protected health information (PHI) created when you receive care is governed by our HIPAA Notice of Privacy Practices. Riovie Operations LLC maintains that Notice as a covered entity with respect to the PHI it holds in operating the Riovie platform and coordinating your care. The independent, licensed providers who treat you — including Arora Health & Aesthetics, LLC and other affiliated professional entities — are responsible for the clinical care they deliver and maintain their own records under their own privacy practices and applicable health-privacy law (HIPAA). Our technology platform provider, Bask Health, Inc., processes PHI on our behalf as our business associate under a Business Associate Agreement (BAA) that requires it to safeguard that information; Bask is not a healthcare provider and is not the merchant of record.
2. Information We Collect
Information you give us: name, email, phone, and the responses you submit in our pre-screener or contact forms, which may include health-related details you choose to share to check eligibility.
Payment information: processed by our third-party payment processor, Stripe. Riovie does not collect or store full payment card numbers.
Automatic information: device, browser, IP address, general location such as city or state, pages viewed, navigation paths, access times, and similar usage data collected through cookies, pixels, and analytics tools.
3. Cookies, Analytics, and Advertising
We use cookies and similar technologies to operate the site, remember preferences, and measure performance. We use, or may use, analytics and advertising-measurement tools such as Google Analytics and the Meta (Facebook) Pixel to understand how visitors find and use riovie.com. These tools may share limited activity data with the providers of those tools. You can control cookies through your browser settings; some features may not work if cookies are disabled.
To limit interest-based advertising, you can use the industry opt-out tools offered by the Network Advertising Initiative (optout.networkadvertising.org), the Digital Advertising Alliance (optout.aboutads.info), and Your Online Choices (youronlinechoices.eu), and you can adjust ad-personalization settings in your Google account. These opt-outs are specific to each browser and device, so you will need to apply them on each one you use.
4. How We Use Your Information
To check whether you may qualify for a program and to connect you with licensed providers.
To deliver nutrition and lifestyle guidance and customer support.
To communicate with you about your account, programs, and updates you asked to receive.
To operate, secure, measure, and improve our website and services.
To create or use aggregated or de-identified data, from which we remove information that identifies you, for analysis and improvement of the Services.
To comply with law and protect the rights, safety, and property of users and Riovie.
5. How We Share Your Information
We do not sell your personal information. We share it only as described here:
Providers and pharmacies: with the independent, licensed providers (including Arora Health & Aesthetics, LLC and other affiliated professional entities) and the network pharmacies (including VialsRX) who evaluate eligibility, deliver care, and fill prescriptions.
Technology platform: with Bask Health, Inc., which provides the platform that powers the Services and acts as our business associate under a BAA for any PHI it processes.
Service vendors: hosting, communications and customer-relationship tools, our payment processor (Stripe), and analytics providers. Vendors that handle health information do so under written confidentiality and BAA terms.
Legal and safety: when required by law, to respond to legal process, or to protect people and property.
Business transfers: in connection with a merger, financing, or sale of assets, subject to this Policy.
6. How We Protect Your Information
We use reasonable administrative, technical, and physical safeguards, including encryption of data in transit, access controls, and vendor agreements that require appropriate security. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a data breach affecting your information occurs, we will notify you as required by applicable law.
7. Data Retention
We keep personal information for as long as needed to provide our services, meet legal and recordkeeping obligations, resolve disputes, and enforce our agreements, then delete or de-identify it. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, the purposes for which we use it and whether those purposes can be achieved through other means, and applicable legal requirements.
8. Your Choices and Rights
Request access to, correction of, or deletion of the personal information Riovie holds about you by emailing support@riovie.com.
Opt out of marketing emails using the unsubscribe link in any message.
Direct requests about medical records or PHI to your treating provider or as described in our HIPAA Notice of Privacy Practices.
9. Your California Privacy Rights
If you live in California, you have the right to know, access, correct, and delete the personal information we hold, and the right to opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising. The categories of personal information we collect and the parties we share it with are described in Sections 2 and 5. Riovie does not sell personal information for money. Advertising tools such as the Meta Pixel may qualify as "sharing" under California law. To opt out, adjust your cookie settings, use the industry opt-out tools listed in Section 3, or email support@riovie.com. Where required by law, we treat a recognized browser opt-out preference signal, such as Global Privacy Control (GPC), as a request to opt out of "sharing" from that browser. We will not discriminate against you for exercising these rights. Some information collected in connection with your care (for example, medical information) is subject to health-privacy laws and is not subject to the CCPA.
10. Other State Privacy Rights
If you live in a state with a comprehensive or consumer-health privacy law — including Washington, Nevada, Texas, Virginia, Colorado, and Connecticut — you may have the right to access, correct, delete, or obtain a copy of your personal information, to opt out of targeted advertising and any sale of personal information, and to appeal a denied request. Washington's My Health My Data Act and similar laws also give you specific rights over consumer health data, including the right to withdraw consent and request deletion. Riovie does not sell consumer health data and does not use or share it beyond providing the services you request, except with your consent or as required by law. To exercise any of these rights, email support@riovie.com; we will verify your identity and respond within the time your state's law requires, and you may use an authorized agent.
11. Children's Privacy
Riovie is intended only for adults 18 years of age and older. We do not knowingly collect information from anyone under 18. If we learn that we have collected information from a child under 18 without the consent required by law, we will delete it.
12. Changes to This Policy
We may update this Policy from time to time. We will post the updated version here and revise the "Last Updated" date above.
13. Contact Us
Questions about this Policy or your information:
Riovie Operations LLC
4539 N 22nd St Ste N, Phoenix, AZ 85016
602-560-7064
HIPAA Notice of Privacy Practices
Notice of Privacy Practices for Protected Health Information (PHI)
This Notice of Privacy Practices ("Notice") describes how Riovie Operations LLC ("Riovie," "we," "us," or "our") may use and disclose your Protected Health Information (PHI) to carry out treatment, payment, and healthcare operations, and for other purposes that are permitted or required by law. It also describes your rights regarding your PHI. Riovie maintains this Notice as a covered entity with respect to the PHI it holds in operating the Riovie platform and coordinating your care. The independent, licensed providers who treat you, including Arora Health & Aesthetics, LLC and other affiliated professional entities, maintain their own records and their own privacy practices for the clinical care they deliver. Our technology platform provider, Bask Health, Inc., processes PHI on our behalf as a business associate under a Business Associate Agreement.
We are required by law to maintain the privacy of your PHI, to give you this Notice of our legal duties and privacy practices, and to follow the terms of the Notice currently in effect.
How We May Use and Disclose Your PHI
We may use and disclose your PHI for the following purposes:
Treatment. To provide, coordinate, and manage your healthcare and related services, including communicating with the licensed providers and network pharmacies involved in your care so that treatment and fulfillment can be coordinated.
Payment. To obtain payment for the services and products provided to you, including billing, processing charges through our payment processor, and related collection activities. Our Services are cash-pay; we do not bill federal or state healthcare programs.
Healthcare Operations. For operations such as quality assessment and improvement, care coordination, credentialing of providers, audits, and obtaining legal and administrative services.
As Required by Law. When federal, state, or local law requires the use or disclosure.
Public Health and Safety. To prevent or control disease or injury, to report adverse events or product problems, and to notify persons who may be at risk, as permitted by law.
Health Oversight. To health oversight agencies for activities authorized by law, such as audits, investigations, inspections, and licensure.
Judicial and Administrative Proceedings. In response to a court or administrative order, subpoena, or other lawful process.
Law Enforcement. For law enforcement purposes as permitted by law, such as to comply with a court order, warrant, or similar process.
Research, Organ Donation, Workers' Compensation, Military, and Correctional Institutions. In the limited circumstances, and subject to the protections, that HIPAA allows.
Uses and disclosures not described in this Notice will be made only with your written authorization, which you may revoke in writing at any time except to the extent we have already relied on it.
Your Rights Regarding Your PHI
You have the right to:
Inspect and copy the PHI we maintain about you, with limited exceptions. We may charge a reasonable, cost-based fee for copies.
Request an amendment to your PHI if you believe it is incorrect or incomplete. We may deny the request in the circumstances the law allows, and will explain the denial.
Request an accounting of certain disclosures we have made of your PHI, other than those made for treatment, payment, healthcare operations, and other exceptions the law provides.
Request restrictions on how we use or disclose your PHI for treatment, payment, or healthcare operations. We are not required to agree to every request but will consider it, and will honor a request to restrict disclosure to a health plan for an item or service you paid for in full out of pocket, where the law requires.
Request confidential communications by a particular means or at a particular location.
Receive a paper copy of this Notice on request, even if you agreed to receive it electronically.
Be notified if a breach of your unsecured PHI occurs.
To exercise any of these rights, submit a written request to our Privacy Officer using the contact information below.
How We Protect Electronic Transmissions
We are committed to protecting the privacy of your PHI and take steps designed to ensure that electronic transmissions of PHI comply with the HIPAA Privacy and Security Rules (45 CFR Part 164), including the use of Secure Sockets Layer (SSL) or equivalent encryption and adherence to applicable security standards for the online transmission of PHI.
Changes to This Notice
We reserve the right to change this Notice, and to make the revised Notice effective for PHI we already hold as well as information we receive in the future. When we make a material change, we will post the updated Notice, with a current effective date, on riovie.com.
Complaints
If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer or with the Secretary of the U.S. Department of Health and Human Services. You will not be retaliated against for filing a complaint.
Contact — Privacy Officer
To exercise any of your rights, or if you have questions about this Notice or our privacy practices, contact our Privacy Officer at:
Riovie Operations LLC, Attn: Privacy Officer
4539 N 22nd St Ste N, Phoenix, AZ 85016
This Notice is provided consistent with the Department of Health and Human Services' model Notice of Privacy Practices and applies across all U.S. states. Certain states provide additional protections for your PHI, summarized below.
State-Specific Provisions
California. In addition to the rights above, California residents may request access to their PHI in a readily usable electronic format and may request that we restrict disclosure of PHI to a health plan for services paid out of pocket in full. We comply with the Confidentiality of Medical Information Act (CMIA) in addition to HIPAA. California residents may request that their PHI not be used for marketing or sold to third parties without authorization. A minor may request that information about certain sensitive services not be disclosed to a parent or guardian without the minor's consent, as the law provides.
New York. We comply with New York's confidentiality laws, which provide additional protections for HIV-related information, mental health records, and genetic testing results, and will obtain written consent before disclosing such information where required, even for treatment, payment, or healthcare operations.
Texas. We comply with the Texas Medical Privacy Act, which provides protections beyond HIPAA, including consent requirements for certain disclosures, additional safeguards for electronic PHI, and specific requirements for the destruction of PHI, as well as protections for mental health and substance use treatment records.
Florida. We comply with Florida law, which provides additional protections for mental health records, HIV/AIDS-related information, and substance abuse treatment records, and will obtain written consent before disclosing such information where required.
Illinois. We comply with Illinois law providing additional protections for mental health records, HIV/AIDS-related information, and genetic testing results, and will notify patients of unauthorized access to electronic PHI as required.
Massachusetts. We comply with Massachusetts law providing additional protections for mental health records, HIV/AIDS-related information, and genetic testing results, and implement the security measures Massachusetts law requires.
If you reside in a state not listed here, please consult your state's privacy laws for any additional rights, or contact our Privacy Officer for more information.