Thrival Health LLC (“Thrival,” “we,” “us,” or “our”) operates www.thrivalhealthsolutions.com and provides software and administrative infrastructure used by clinics, medical groups, licensed healthcare professionals, pharmacies, business customers, staff members, and patients. Depending on the services selected, the Thrival platform may support patient intake, telehealth workflows, electronic medical record functionality, patient and provider portals, prescription routing, pharmacy fulfillment coordination, payment routing, communications, audit logs, and shipment tracking (collectively, the “Services”).
This Privacy Policy explains how Thrival collects, uses, maintains, discloses, and protects personal information when you visit a Thrival website, request a demonstration, communicate with us, create or use an account, interact with a Thrival-hosted or white-labeled experience that links to this Policy, or otherwise use the Services.
Thrival is a technology and administrative infrastructure company. Thrival is not a pharmacy and does not practice medicine. Licensed healthcare professionals and medical entities make clinical decisions, and licensed pharmacies make dispensing decisions. Their privacy notices and Notices of Privacy Practices may also apply to you.
1Scope of This Privacy Policy
This Policy applies to personal information that Thrival handles in its own capacity and to information Thrival processes for its business customers, participating medical entities, healthcare professionals, and pharmacy partners. It applies only where it is posted or linked.
A clinic, medical group, prescriber, pharmacy, or other customer may operate a website or patient experience under its own name while using Thrival technology. In those cases, that organization may decide why and how personal information is processed and may be the controller, covered entity, healthcare provider, or record owner. Thrival may act as its processor, service provider, contractor, or HIPAA business associate. The customer's privacy policy, patient consent, telehealth consent, and Notice of Privacy Practices may apply in addition to this Policy.
This Policy does not replace a healthcare provider's HIPAA Notice of Privacy Practices and is not a HIPAA authorization. Where a Business Associate Agreement (“BAA”), customer agreement, provider notice, pharmacy notice, or applicable law imposes stricter requirements, the stricter requirement controls for the applicable information.
This Policy does not apply to the independent privacy practices of prescription-routing networks, licensed healthcare professionals, medical groups, pharmacies, payment processors, shipping carriers, or other third parties except to the extent Thrival processes information on their behalf.
2Information We Collect
2.1 Information You Provide Directly
- Identity and contact information, such as your name, email address, telephone number, mailing or shipping address, date of birth, and account identifiers.
- Business and professional information, such as employer or practice name, job title, National Provider Identifier, professional license information, state of practice, business address, ownership or credentialing information, and authorized-user role.
- Account and authentication information, such as usernames, passwords, multifactor-authentication information, security questions, permissions, and access logs.
- Patient intake and health information, such as symptoms, diagnoses, medical history, medications, allergies, treatment interests, vital information, photographs, laboratory information, consent records, identity-verification details, and communications with a care team.
- Prescription and fulfillment information, such as medication, dosage, quantity, directions, prescriber, pharmacy, prescription status, refill information, order status, shipping address, and tracking information.
- Appointment and consultation information, such as requested services, scheduling details, telehealth modality, consultation notes, care-plan information, and follow-up communications.
- Payment and transaction information. Payment-card and bank information is generally collected directly by independent payment processors. Thrival may receive transaction identifiers, payment status, amount, refund or chargeback information, processor tokens, and limited card details such as brand and last four digits.
- Communications and support information, including messages, emails, forms, demonstrations, service requests, complaints, adverse-event reports, survey responses, and other information you choose to provide.
- Content uploaded through the Services, including documents, images, electronic signatures, patient records, prescription files, and other customer or user content.
2.2 Information Collected Automatically
- Device and network information, such as IP address, browser type, operating system, device identifiers, language, referring URL, and approximate location derived from an IP address.
- Usage and log information, such as pages viewed, features used, links selected, account activity, session times, errors, API activity, audit records, and security events.
- Cookie and similar technology information, as described in Section 8.
We do not intentionally collect precise geolocation, biometric identifiers used to uniquely identify a person, or other sensitive information unless the feature requires it, the collection is separately disclosed, and any legally required consent is obtained.
3Sources of Information
We may collect personal information from:
- you directly;
- your employer, clinic, medical group, prescriber, care team, administrator, or other organization that authorizes your use of the Services;
- patients, authorized caregivers, personal representatives, and guardians;
- independent healthcare professionals and medical entities;
- licensed pharmacy partners, including participating 503A compounding pharmacies;
- prescription-routing networks and other healthcare-interoperability vendors;
- payment processors, financial institutions, fraud-prevention providers, and card networks;
- shipping carriers, logistics providers, laboratories, identity-verification vendors, credentialing sources, and other integrations;
- publicly available sources and government or professional databases, when used for lawful credentialing, compliance, or fraud-prevention purposes; and
- cookies, logs, analytics tools, and security technologies used on our websites and platform.
4How We Use Personal Information
Thrival may use personal information to:
- provide, configure, host, support, and maintain the Services;
- create and administer accounts, authenticate users, assign permissions, and enforce role-based access;
- support patient intake, scheduling, telehealth workflows, medical-record functionality, communications, and care-team collaboration;
- enable licensed prescribers to review information and, when clinically appropriate, issue and electronically transmit prescriptions;
- connect to third-party prescription-routing networks and pharmacy-transmission providers;
- route valid prescriptions and related information to licensed pharmacy partners, including 503A pharmacies, for independent review, dispensing, fulfillment, and patient support;
- coordinate order status, recurring medication workflows, shipping, and delivery tracking;
- route and reconcile payments through independent payment processors and respond to refunds, disputes, fraud, and chargebacks;
- provide implementation, customer support, technical support, training, and service communications;
- monitor platform performance, maintain audit trails, troubleshoot errors, secure accounts, prevent fraud, and investigate suspected misuse;
- verify professional credentials, licensing, authority, and compliance where appropriate;
- comply with healthcare, privacy, prescribing, pharmacy, payment, tax, recordkeeping, reporting, legal, and regulatory obligations;
- respond to legal process and protect patients, users, Thrival, customers, partners, and the public;
- develop, test, and improve the Services using aggregated, de-identified, or otherwise lawfully processed information; and
- send marketing communications to business contacts where permitted, subject to your communication choices.
Thrival does not use patient health information or PHI for advertising without a legally valid authorization.
Thrival's software may organize information, apply customer-defined rules, identify missing fields, or flag potential risk indicators. These tools support workflow and do not replace professional judgment. Licensed healthcare professionals remain responsible for clinical decisions. Thrival does not use personal information for solely automated clinical decisions that produce legal or similarly significant effects.
5Health Information, HIPAA, and Medical Records
5.1 Thrival's HIPAA Role
Thrival is not automatically a HIPAA covered entity merely because it provides healthcare technology. When Thrival creates, receives, maintains, or transmits Protected Health Information (“PHI”) on behalf of a HIPAA covered entity or another business associate, Thrival acts as a business associate or subcontractor business associate and processes PHI under a BAA and applicable HIPAA requirements.
Thrival may also handle health-related information that is not PHI because the information is not maintained for a HIPAA covered entity or because another legal exception applies. Such information remains subject to this Policy and other applicable privacy, consumer-protection, and breach-notification laws.
5.2 Provider and Pharmacy Notices
The licensed medical entity or healthcare professional responsible for your care generally controls the clinical record and is responsible for providing any required Notice of Privacy Practices. The dispensing pharmacy controls its pharmacy records and may provide a separate pharmacy privacy notice. Please review those notices carefully.
5.3 Medical Record Requests
Requests to access, amend, restrict, or obtain an accounting of disclosures of a medical record should normally be directed to the clinic, medical group, healthcare professional, or pharmacy identified in your patient experience or prescription materials. Thrival will reasonably assist its healthcare customers in responding to verified requests as required by applicable agreements and law. You may also contact customersupport@thrivalhealthsolutions.com, and we will route the request to the appropriate organization when reasonably possible.
5.4 Minimum Necessary and Permitted Uses
Thrival limits access to PHI and sensitive data based on role, contractual responsibility, and lawful purpose. We do not use or disclose PHI for marketing or disclose it to advertising networks unless the disclosure is expressly permitted by law and supported by any required HIPAA-compliant authorization. A general cookie banner or acceptance of this Policy is not a HIPAA authorization.
6How We Disclose Personal Information
Thrival may disclose personal information to the following categories of recipients for the purposes described in this Policy:
- Customers and authorized users. We disclose information to the clinic, medical group, business, or other customer that sponsors, administers, or provides your account or patient experience.
- Licensed healthcare professionals and medical entities. We disclose information needed for identity verification, intake, clinical review, consultation, prescribing, follow-up, and continuity of care.
- Prescription-routing and interoperability providers. We may transmit prescription and provider information through third-party prescription-routing networks and other lawful integrations.
- Licensed pharmacies. We may transmit valid prescriptions, patient details, shipping information, payment status, and related records to a pharmacy selected or authorized for fulfillment. Pharmacies independently determine whether a prescription may lawfully and appropriately be dispensed.
- Payment and financial providers. We disclose transaction-related information to processors, acquiring banks, card networks, fraud-prevention providers, and other financial institutions necessary to route payments and manage disputes.
- Shipping, logistics, and communications providers. We disclose information necessary to send medications or supplies, provide tracking, deliver email or SMS messages, and support patient or customer communications.
- Cloud, hosting, security, analytics, and software vendors. These vendors support the Services under contractual and legal restrictions appropriate to the information they handle. Vendors that create, receive, maintain, or transmit PHI on our behalf are required to enter into a BAA when required by HIPAA.
- Professional advisors and auditors. We may disclose information to attorneys, accountants, insurers, auditors, compliance consultants, and certification reviewers subject to appropriate confidentiality duties.
- Government authorities and legal recipients. We may disclose information when required by law, subpoena, court order, licensing board, regulator, law-enforcement request, public-health requirement, or other lawful process, or when necessary to prevent serious harm, fraud, abuse, or security threats.
- Corporate transaction recipients. Information may be disclosed in connection with a merger, financing, acquisition, restructuring, sale of assets, bankruptcy, or similar transaction, subject to applicable law and appropriate protections.
- Recipients you direct or authorize. We may disclose information when you request or authorize the disclosure, including to a caregiver, personal representative, selected pharmacy, external provider, or integrated service.
Thrival does not sell or rent personal information. Thrival does not sell, rent, or disclose patient information or health information to third parties for marketing or cross-context behavioral advertising. We may disclose information to operational vendors and healthcare participants as necessary to provide the Services, as described above.
7Prescription Routing, Providers, Pharmacies, and Payment Processors
7.1 Prescription-Routing Network Connectivity
Thrival uses third-party providers to enable electronic prescription transmission and to access pharmacy networks. Prescription information may be transmitted to and processed by these providers under their own legal, security, and privacy obligations. Thrival does not control whether a licensed prescriber issues a prescription or whether a pharmacy dispenses it.
7.2 Independent Clinical Partners
Licensed healthcare professionals and medical entities are independent from Thrival and are responsible for patient evaluation, diagnosis, treatment decisions, prescribing, informed consent, medical records, professional licensure, and continuity of care. Thrival may provide technology and administrative support but does not direct clinical judgment.
7.3 Licensed 503A Pharmacy Partners
Where a patient-specific compounded prescription is sent to a participating 503A pharmacy, the pharmacy independently reviews the prescription, confirms its authority to dispense into the patient's jurisdiction, compounds or dispenses the medication, provides required labeling and counseling, and maintains pharmacy records. Thrival may facilitate routing, order status, communications, and payment coordination but does not compound, manufacture, dispense, or sell medication as a pharmacy.
7.4 Processor Network
Thrival does not operate a proprietary “Thrival Checkout.” Payments are handled through an independent processor network. Those processors may collect payment credentials directly and may maintain their own privacy notices. Thrival generally receives only the information necessary to confirm payment, route funds, reconcile transactions, support refunds, and address disputes.
9Email, SMS, and Other Communications
Thrival and participating customers, healthcare professionals, pharmacies, and vendors may send service-related communications, including account notices, authentication messages, consultation reminders, prescription or order updates, shipment notifications, support responses, security alerts, and legally required notices.
Email and standard SMS are not always secure. Do not include sensitive medical information in an ordinary email or text message unless the recipient has instructed you to do so and you understand the risks. Where consent is required for a communication, the responsible sender must obtain and document that consent.
You may opt out of promotional emails by using the unsubscribe link or contacting us. You may opt out of promotional text messages by replying STOP. You may continue to receive nonmarketing messages that are necessary to provide requested services, maintain your account, protect security, or comply with law.
10Data Retention and Deletion
Thrival retains personal information for as long as reasonably necessary to provide the Services, fulfill the purposes described in this Policy, comply with customer instructions and contractual obligations, maintain business and audit records, resolve disputes, enforce agreements, prevent fraud, and satisfy healthcare, prescribing, pharmacy, tax, payment, legal, and regulatory requirements.
Retention periods vary based on the type of information, the customer relationship, applicable state medical-record and pharmacy-record requirements, whether the information is PHI, and whether litigation, an investigation, a regulatory hold, or a security matter is pending. Healthcare customers and pharmacies may be legally required to retain records even after an account is closed or a patient requests deletion.
When information is no longer required, Thrival may delete, de-identify, aggregate, or securely isolate it. Residual copies may remain temporarily in backups, logs, disaster-recovery systems, or archives until overwritten or deleted under standard retention processes. De-identified information may be retained and used as permitted by law, and Thrival will not attempt to re-identify it except to test whether de-identification methods are effective or as otherwise permitted by law.
11Security and Incident Response
Thrival uses administrative, physical, and technical safeguards designed to protect information based on its sensitivity and the nature of the Services. Safeguards may include encryption in transit and at rest, role-based access controls, multifactor authentication, logging and monitoring, audit trails, workforce controls, vendor management, incident response, backups, and secure development practices.
No website, network, transmission, or storage system can be guaranteed to be completely secure. You are responsible for protecting your credentials, using secure devices and networks, promptly reporting suspected unauthorized access, and following the security requirements of your organization.
Thrival investigates suspected security incidents and provides notifications to affected customers, individuals, regulators, law enforcement, or other parties when required by HIPAA, the Federal Trade Commission Health Breach Notification Rule, state breach-notification laws, contracts, or other applicable requirements.
12Your Privacy Rights and Choices
Depending on where you live and the type of information involved, you may have the right to:
- confirm whether Thrival processes your personal information;
- access or obtain a portable copy of personal information;
- correct inaccuracies;
- delete personal information, subject to legal and healthcare-record exceptions;
- opt out of the sale of personal information, targeted advertising, or certain profiling;
- limit or object to certain processing of sensitive personal information;
- withdraw consent where processing is based on consent;
- appeal a decision regarding a privacy request; and
- exercise rights without unlawful discrimination or retaliation.
12.1 How to Submit a Request
Submit a request by emailing customersupport@thrivalhealthsolutions.com with the subject line “Privacy Request.” Please identify your relationship to Thrival, the applicable customer or patient program, the right you wish to exercise, and the state in which you reside. To appeal a denied request, use the subject line “Privacy Appeal” and explain why you believe the decision should be reconsidered.
Thrival may need to verify your identity and authority before completing a request. Verification may require matching information already maintained in our systems, confirming control of an email address or account, or obtaining additional documentation. We will use verification information only for the request and related security purposes.
An authorized agent may submit a request where permitted by law, but Thrival may require proof of authority and may still need to verify the consumer directly. Thrival will respond within the period required by applicable law and will explain any denial and available appeal process.
12.2 Requests Involving Customer-Controlled Data or Medical Records
When Thrival processes information solely for a customer, provider, or pharmacy, Thrival may direct your request to that organization or ask it for instructions. Medical-record rights are generally exercised through the responsible healthcare provider or pharmacy. Thrival will assist those organizations as required by applicable agreements and law.
13U.S. State Privacy Notice
13.1 Texas Residents
Subject to applicable exemptions, the Texas Data Privacy and Security Act may provide Texas residents with rights to confirm processing, access personal data, correct inaccuracies, delete personal data, obtain portable data, opt out of targeted advertising, opt out of sale, opt out of certain profiling, and appeal a decision. Thrival does not sell personal data and does not use patient information for targeted advertising. Submit Texas requests and appeals using the methods in Section 12.
Information processed under HIPAA and certain other regulated information may be exempt from state consumer privacy laws. An exemption does not reduce Thrival's obligations under HIPAA, a BAA, other healthcare laws, or contractual privacy requirements.
13.2 California and Other State Residents
Residents of California and other states with comprehensive privacy laws may have similar rights, subject to applicable thresholds and exemptions. California residents may also have rights to know the categories and specific pieces of personal information collected, correct or delete information, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive equal service and pricing. Thrival does not sell personal information and does not share patient information for cross-context behavioral advertising.
13.3 Notice at Collection
The following table summarizes categories of personal information Thrival may collect, the purposes for collection, and the categories of recipients to whom information may be disclosed. Actual collection depends on your relationship with Thrival and the features used.
| Category | Examples | Purposes | Recipients |
|---|---|---|---|
| Identifiers and contact data | Name, email, phone, address, date of birth, IP address, account ID | Accounts, communications, patient intake, support, security, fulfillment | Customers, providers, pharmacies, vendors, processors, carriers |
| Professional and business data | Practice, role, NPI, license, credentials, employer | Credentialing, account administration, compliance, prescription routing | Customers, credentialing sources, prescription-routing networks, regulators |
| Health and sensitive data | Symptoms, history, medications, allergies, diagnoses, photos, consent records | Clinical workflow support, prescribing, care coordination, pharmacy fulfillment | Authorized providers, medical entities, pharmacies, healthcare vendors |
| Prescription and order data | Medication, dosage, directions, prescriber, pharmacy, status, tracking | Prescription routing, dispensing workflow, fulfillment, patient support, audit records | Prescription-routing networks, providers, pharmacies, carriers, customers |
| Commercial and transaction data | Services requested, amounts, payment status, refunds, chargebacks | Payment routing, reconciliation, fraud prevention, customer support | Processors, banks, card networks, customers, financial vendors |
| Internet and usage data | Device, browser, pages, feature activity, logs, security events | Operate, secure, troubleshoot, measure, and improve Services | Hosting, security, analytics, software vendors |
| Communications and content | Emails, messages, forms, support tickets, files, e-signatures | Provide Services, support, compliance, recordkeeping, dispute resolution | Customers, providers, pharmacies, communications vendors, advisors |
| Approximate location | Location inferred from IP address | Security, fraud prevention, localization, legal compliance | Security, hosting, and analytics vendors |
Thrival does not sell the categories listed above. Thrival does not share patient or health information for targeted advertising. Categories may be disclosed for business and operational purposes to the recipients identified above, subject to appropriate legal and contractual restrictions.
14Children and Minors
The Thrival business website and business-facing Services are not directed to children under 13, and Thrival does not knowingly collect personal information directly from a child under 13 through those areas without legally valid authorization.
Healthcare services for a minor may be made available by an independent licensed provider when permitted by law and with appropriate consent from a parent, guardian, or legally authorized person, or when the minor may lawfully consent to care. The responsible provider or medical entity determines whether services may be provided and how consent, confidentiality, and parental access rules apply.
If you believe a child submitted information improperly, contact customersupport@thrivalhealthsolutions.com so the matter can be reviewed with the applicable customer or healthcare entity.
15White-Labeled Services and Third-Party Sites
Thrival may power a white-labeled website, mobile application, intake flow, or portal branded by a customer. The customer's name, privacy policy, terms, consents, provider disclosures, and Notice of Privacy Practices should identify its role. When the customer determines the purposes and means of processing, requests and questions should be directed to that customer, although Thrival will provide reasonable assistance.
The Services may link to or integrate with websites and services not controlled by Thrival. Their privacy practices are governed by their own notices. A link or integration does not mean Thrival endorses the third party's privacy or security practices.
16International Users
Thrival is based in the United States, and the Services are intended primarily for use in the United States. If you access the Services from another country, your information may be transferred to, stored in, and processed in the United States, where privacy laws may differ. Customers may not use the Services in another jurisdiction unless authorized by Thrival and all applicable legal, licensing, privacy, and data-transfer requirements are satisfied.
17Changes to This Privacy Policy
Thrival may update this Policy to reflect changes in the Services, vendors, laws, regulations, or privacy practices. The revised Policy will state a new effective date and will be posted on the applicable website or service. Where required, Thrival will provide additional notice or obtain consent. Continued use after the effective date of an update is subject to the updated Policy, except where applicable law requires another form of acceptance.
18Contact Thrival
For privacy questions, requests, or complaints, contact:
- Thrival Health LLC, Houston, Texas, United States
- Website: www.thrivalhealthsolutions.com
- Email: customersupport@thrivalhealthsolutions.com
- Mailing address: 3120 Southwest Fwy Ste 101, PMB #570782, Houston, Texas 77098-4520, United States
Please include enough information for us to understand and respond to your request. If your concern involves medical care, a prescription, a pharmacy order, or a clinical record, contacting the identified healthcare provider or dispensing pharmacy directly may be the fastest way to obtain assistance.