Privacy Policy

When you use the Site or Services, you may provide us with the following types of Personal Information:

• Contact Information: name, mailing address, email address, phone number.
• Account Information: username, password, security settings, communication preferences.
• Demographic Information: date of birth, age, gender or gender identity, state of residence.
• Health and Medical Information (PHI): medical history, current and past conditions, symptoms, medications, allergies; information about your use of GLP-1, dual-agonist, or triple-agonist medications (including retatrutide) and related treatments; family medical history, lifestyle information (e.g., smoking, alcohol, substance use); lab results, vital signs, and other clinical data provided or uploaded through the Services.
• Identification Information:images of your driver's license, passport, or other government ID; live photos or selfies for identity verification.
• Payment Information: payment card number, expiration date, billing address, and other payment details provided to our payment processors.
• Communications and Content: messages you send to us, responses to questionnaires, surveys, intake forms, or assessments; feedback, reviews, or other content you submit.

When you visit the Site or interact with the Services, we and our service providers may automatically collect certain information by using cookies, pixels, and similar technologies, such as:

• IP address and approximate location;
• Browser type and settings;
• Device identifiers and device type;
• Operating system and version;
• Referring and exit URLs;
• Pages or screens viewed, links clicked, time spent on pages, and other usage data;
• Dates and times of access and activity (“clickstream data”).

We use this information for analytics, security, personalization, and to improve the Site and Services. We treat this information as Personal Information when it is reasonably capable of identifying you.

We may receive information about you from:

• Medical Practices and Providers: clinical notes, prescribing information, and other PHI needed to provide or coordinate Services.
• Pharmacies: dispensing information, medication history, refill information.
• Service Providers: identity verification services, analytics providers, payment processors, marketing platforms, and other vendors.
• Affiliates and Partners: where we operate related offerings or co-branded programs.
• Public Sources: where allowed by law (e.g., publicly available professional or address data).

We and our service providers may use:

• Cookies: small text files stored on your device;
• Pixels / Web Beacons: tiny graphics embedded in pages or emails;
• Session Replay / Analytics Scripts: to understand how users interact with key pages and forms;
• SDKs and Embedded Scripts: in web or mobile applications.

These tools help us:

• Operate and secure the Site;
• Remember your preferences;
• Measure and improve performance;
• Understand how visitors use the Site;
• Deliver and measure marketing and advertising (where permitted).

Consistent with current HIPAA and regulatory guidance, Direct Reta:

• Does not intentionally configure third-party tracking tools to receive PHI (such as specific symptoms, diagnoses, or medication details) for advertising purposes;
• Implements technical and contractual safeguards to reduce the likelihood that PHI is transmitted to third-party ad platforms;
• May still use analytics tools (e.g., measuring page visits or conversion events) in a way designed to avoid sending PHI.

However, because IP address, device IDs, and browsing patterns can sometimes be linked to health-related activity, we treat tracking around account and consultation areas conservatively and configure tools to minimize risk.

Most browsers allow you to:

• Set your browser to refuse or delete some or all cookies;
• Receive alerts when cookies are being set.

If you disable cookies, some features of the Site or Services may not function properly.

Some advertising and analytics providers participate in industry opt-out programs (e.g., Digital Advertising Alliance and Network Advertising Initiative). Opt-outs may be browser and device specific and do not stop all advertising, but may limit certain interest-based ads.

Some browsers offer a “Do Not Track” (DNT) setting. There is no common industry standard for how to respond to these signals, and Direct Reta currently does not respond to DNT signals. You may use the other control mechanisms described above to manage cookies and tracking.

• Create and manage your account;
• Facilitate telehealth consultations and related services;
• Coordinate with Medical Practices and Pharmacies to provide physician-prescribed retatrutide and related weight-care services;
• Process and fulfill prescriptions;
• Provide customer support and respond to inquiries.

• Remember your preferences and settings;
• Customize content, forms, and recommendations;
• Tailor aspects of the Site and Services to your interests.

• Operate, maintain, and improve the Site and Services;
• Perform data analysis, research, statistics, and trend analysis;
• Test, develop, and enhance features, products, and services;
• Detect, prevent, and troubleshoot technical issues.

• Send you information about Direct Reta products, services, promotions, and educational content;
• Administer surveys, newsletters, and events;
• Conduct non-PHI-based targeted advertising and measurement (where permitted).

You can opt out of marketing emails and texts as described in Section 10.

• Authenticate users and manage access controls;
• Protect against, identify, and investigate fraud, abuse, or security incidents;
• Enforce our Terms of Service and other agreements;
• Comply with applicable laws, regulations, court orders, and lawful requests.

• Create de-identified or aggregated data sets that no longer identify you;
• Use and commercialize such de-identified or aggregated data for research, analytics, product development, and other lawful purposes.

• To schedule and conduct consultations;
• To support diagnosis, treatment, and ongoing care;
• For treatment, payment, and healthcare operations permitted under HIPAA.

• To fill and ship prescriptions, including compounded medications prepared by licensed U.S. 503A pharmacies;
• To handle refills, substitutions where appropriate, and medication questions.

• Companies that host our Site or applications;
• Payment processors;
• Identity verification services;
• Analytics and security vendors;
• Customer support platforms;
• Cloud infrastructure and backup providers.

These service providers may access Personal Information only as needed to perform services for us and are contractually required to protect it, including through Business Associate Agreements where required by HIPAA.

Our parent, subsidiary, or affiliated entities, if any, for purposes consistent with this Privacy Policy.

Advertising networks, social media platforms, and analytics providers may receive limited information (such as cookie IDs, device data, or generalized event data) to help us measure and improve marketing effectiveness and reach appropriate audiences, where permitted by law and our configuration.

We do not ask these partners to use PHI for targeted advertising.

In connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or other corporate transaction, your information may be transferred as part of that transaction, subject to applicable law.

• To comply with applicable laws, regulations, legal processes, or governmental requests;
• To protect the rights, property, or safety of Direct Reta, our users, Medical Practices, Pharmacies, or others;
• To detect, prevent, or respond to fraud, security incidents, or illegal activity.

When you direct us to share information with a third party or explicitly consent to such sharing.

By using the Services and providing contact information (such as your email address and mobile number), you consent to our sending:

• Account-related notices;
• Appointment reminders;
• Prescription or refill notifications;
• Security alerts and important updates;
• Other transactional or administrative messages.

These communications are considered part of the Services and, in many cases, you cannot opt out of them while continuing to use the Services.

With your consent where required by law, we may send you:

• Newsletters;
• Product or service updates;
• Special offers, promotions, or event invitations;
• Educational content related to metabolic health, weight care, and physician-prescribed therapies such as retatrutide.

You may opt out of marketing emails at any time by:

• Clicking the “unsubscribe” link in a marketing email; or
• Contacting us at support@directreta.com.

Opting out of marketing emails does not affect transactional or service-related communications.

If you provide a mobile number and consent to receive text messages, we may send you:

• Appointment reminders;
• Security verification codes;
• Important updates regarding your care or account;
• Occasional promotional messages where permitted by law.

You can opt out of SMS marketing and most non-essential texts by replying “STOP” to any message. We may send a final confirmation message of your opt-out request. Standard message and data rates may apply.

We do not share SMS opt-in data or consent with third parties for their own marketing or promotional purposes.

You may:

• Update or correct certain account and profile information through your account settings;
• Change communication preferences (email, SMS) via account settings or by contacting us;
• Request deletion or deactivation of your Direct Reta account, subject to legal and medical record retention requirements.

We may decline requests that would:

• Violate law or legal requirements;
• Prevent us from meeting legal or regulatory obligations;
• Impact the accuracy or integrity of required medical records.

If you are a resident of California or certain other U.S. states with comprehensive privacy laws, you may have some or all of the following rights with respect to Personal Information not otherwise exempt (for example, some PHI is regulated by HIPAA and may be exempt from state consumer privacy statutes):

• Right to Know / Access: To request that we disclose the categories and specific pieces of Personal Information we have collected about you, the sources, purposes, and categories of third parties to whom it was disclosed.
• Right to Delete: To request deletion of Personal Information we collected from you, subject to legal and operational exceptions (e.g., medical records we must retain by law).
• Right to Correct: To request correction of inaccurate Personal Information we maintain about you.
• Right to Opt Out of “Sale” or “Sharing”:To opt out of certain disclosures of Personal Information for cross-context behavioral advertising or “sales” as defined by law. Direct Reta does not sell PHI, but some uses of cookies or advertising tools may be deemed “selling” or “sharing” under state law.
• Right to Limit Use of Sensitive Personal Information: In certain states, to limit certain uses of sensitive personal information beyond what is reasonably necessary to provide the requested services.
• Right to Non-Discrimination: To not be discriminated against for exercising your privacy rights.

To exercise these rights, you may contact us at:

Email: privacy@directreta.com

We may need to request additional information to verify your identity and state residency before fulfilling a request. You may also designate an authorized agent to submit certain requests on your behalf, subject to additional verification.

Because medical information and PHI are often subject to HIPAA and other health privacy laws, some requests may be handled under HIPAA rather than state consumer privacy statutes, and certain requests may be limited or denied where legally required (for example, if we must retain clinical records).