Privacy Policy
Effective September 13, 2026
This Privacy Policy explains how Brunch Health, LLC collects, uses, discloses, and protects personal information through brunchhealth.com and Brunch-operated services. Brunch is a technology and administrative platform. Independent clinical care is provided by Lone Star Virtual Health, PLLC, and prescriptions are dispensed by licensed partner pharmacies. Those entities may maintain separate privacy notices and legal record-retention obligations.
Information we collect
Depending on how you interact with Brunch, we may collect identifiers and contact information; account credentials; billing and transaction information; shipping information; device, browser, and website activity; marketing and attribution data; customer-support communications; referral and promotion information; and health-related information needed to facilitate care, support, fulfillment, and platform operations.
Clinical information may include intake responses, medications, allergies, symptoms, treatment information, prescriptions, and communications within the Bask platform. Identity verification may use information already associated with your account and additional information reasonably necessary for care, payment, fraud prevention, regulatory compliance, or telehealth requirements.
How we use information
We use information to operate and secure the platform; create and manage accounts; facilitate Lone Star clinical review; coordinate pharmacy fulfillment; process and document payments; provide shipping and support; send required service, billing, and renewal communications; detect fraud and abuse; comply with law; maintain records; measure and improve services; perform quality assurance; and conduct marketing and analytics where legally permitted.
Brunch may use AI and automated systems for support classification, routing, non-clinical responses, workflow administration, summarization, quality assurance, technical operations, and Brunch-specific system improvement. AI does not independently make clinical or prescribing decisions. Brunch does not provide identifiable protected health information or sensitive health information to train a vendor's general-purpose or public AI model.
How we disclose information
We may disclose information to Lone Star Virtual Health, PLLC; assigned pharmacies; Bask and other technology or service providers; payment processors; shipping carriers; professional advisers; security and fraud providers; regulators or law enforcement when legally permitted or required; and other parties reasonably involved in operating and supporting Brunch. Access is limited as reasonably appropriate to the role and purpose.
Affiliate and referral partners may receive limited non-clinical conversion information needed for attribution and commissions, preferably through opaque identifiers. They do not receive clinical intake responses, diagnoses, prescriptions, allergies, side effects, or provider communications for advertising purposes.
Health information and HIPAA
Not all information handled by Brunch is necessarily subject to HIPAA. Lone Star and dispensing pharmacies may be covered entities with their own privacy obligations. Brunch may handle protected health information when acting on behalf of a covered entity under an applicable business-associate arrangement or as otherwise permitted by law. Lone Star's Notice of Privacy Practices governs its clinical records. Requests for Lone Star medical records should be handled through the applicable Lone Star or Bask medical-record process.
Brunch personnel and authorized support systems may access health information within Bask when reasonably necessary and legally permitted for care coordination, support, workflow administration, quality assurance, technical operations, and related functions. Brunch support does not independently provide medical advice.
Cookies, analytics, and advertising
Public Brunch marketing pages may use cookies, pixels, analytics, attribution, and privacy-configured behavioral or session-replay technologies where legally permitted. Necessary cookies may operate by default. Analytics and advertising technologies are subject to applicable consent and opt-out requirements. Brunch maintains a Your Privacy Choices mechanism and honors Global Privacy Control where legally required.
Advertising pixels, retargeting tags, and advertising-oriented session replay are excluded from Bask clinical intake and authenticated patient areas. Brunch does not send medical intake responses, diagnoses, prescriptions, medication or formulation details, allergies, side effects, or provider communications to advertising platforms for targeted advertising.
Brunch does not sell personal information for money. Certain public-site advertising activities may constitute a sale, sharing, or targeted advertising under some state privacy laws. Eligible consumers may opt out through Your Privacy Choices and supported browser signals.
Marketing communications
Promotional SMS requires separate affirmative consent and is not a condition of purchase or care. Promotional email may be sent where legally permitted and includes unsubscribe functionality. Opting out of marketing does not stop necessary clinical, account, billing, renewal, security, pharmacy, or fulfillment communications.
Retention and security
We retain information for as long as reasonably necessary for the purposes described here and as required or permitted by law, including legal, tax, accounting, payment-dispute, fraud-prevention, regulatory, and contractual purposes. Clinical and pharmacy records may be subject to independent retention obligations. Brunch uses reasonable administrative, technical, and organizational safeguards, but no system can be guaranteed completely secure.
Brunch investigates suspected security incidents and provides notices to affected individuals and regulators when and as required by applicable law.
Your privacy rights
Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of certain information and to opt out of sale, sharing, or targeted advertising. Brunch will respond to verified requests within the timeframe required by applicable law and may use legally permitted extensions. Reasonable identity verification may be required based on the sensitivity of the request. Authorized agents may submit requests subject to appropriate verification. Simple advertising opt-outs and Global Privacy Control signals will not be burdened with unnecessary identity verification.
Children
Brunch services are for adults age 18 and older. Brunch does not offer pediatric treatment through this platform, and an adult may not create an account to obtain Brunch prescription treatment for a minor.
Changes
We may update this Privacy Policy. Non-material changes may be posted with a revised effective date; material changes will receive notice when appropriate or required. Where law requires consent, posting a revised policy does not substitute for that consent.
Contact
Privacy, consumer health data, legal notice, and policy requests may be sent to:
Brunch Health, LLC
32 N Gould Street
Sheridan, WY 82801
support@brunchhealth.com