Row Telehealth Privacy Policy

Last updated: September 23, 2026

Rely Telehealth Plus, Inc. d/b/a Row Telehealth (“Row Telehealth”, “we”, “our”, or “us”) respects your privacy and is committed to protecting it. This Privacy Policy (“Policy”) describes how we collect, use, retain, and disclose personal data about you when you use our website at rowtelehealth.com, our mobile applications, and the related telehealth services that link to this Policy (collectively, our “Services”).

This Policy applies to information we collect:

• Through the Services
• In communications between you and the Services, including email, text/SMS, secure messaging, chat, and video visits, and
• When you interact with our content or advertising on third-party sites that link to this Policy.

This Policy does not apply to:

• Information governed by our separate Notice of Privacy Practices (“NPP”), which describes how we handle protected health information (“PHI”) as a HIPAA covered entity. Where PHI is involved, the NPP controls and this Policy is supplemental. See our Notice of Privacy Practices at rowtelehealth.com/notice-of-privacy-practices.
• Information collected by any third party (including independent pharmacies or laboratories) that maintains its own privacy practices, or
• Information collected offline or on any site or service that does not link to this Policy.

If you are a Washington, Nevada, or Connecticut consumer, our separate Consumer Health Data Privacy Notice describes the additional rights those states give you over consumer health data and how to exercise them.

Please read this Policy carefully. By using the Services or providing your information, you agree to the collection, use, and disclosure of your information as described here. This Policy may change from time to time (see “Changes to This Policy”).

1. Children’s and Minors’ Data

Our Services are intended for users 18 years of age and older. We do not knowingly collect personal data from a child under 18 without the involvement of a parent or legal guardian. If we learn we have collected such data without the required consent, we will delete it.

2. The Personal Data We Collect

“Personal data” is information that identifies, relates to, or could reasonably be linked to you. The categories we collect or process include:

• Account and contact information, name, date of birth, mailing address, email address, phone number, username, and account credentials.
• Identity and eligibility information, government ID or driver’s license number (for identity verification), and, where applicable, insurance member ID and payer information.
• Health and clinical information, reason for visit, symptoms, medical and medication history, allergies, vitals and self-reported measurements, provider notes, diagnoses, prescriptions, lab or diagnostic results, appointment history, and messages exchanged with providers. Most of this is PHI governed primarily by our Notice of Privacy Practices. See Section 3.
• Payment information, payment card or bank information, billing address, and transaction history (processed by our third-party payment processor).
• Communications. The content of your messages, chats, emails, and video-visit recordings, where lawfully recorded with notice and any required consent.
• Device and technical information, IP address, device identifiers, operating system, browser type and settings, and preferred language.
• Usage information, pages viewed, features used, clickstream data, dates and times of access, and referring and exit pages.

We also derive aggregated or de-identified data that does not identify you. If we combine de-identified or technical data with personal data so that it identifies you, we treat the combined data as personal data.

Sensitive data. Some of the above, including health information, government ID numbers, and insurance information, is treated as sensitive personal data under HIPAA and applicable state law. Where required, we collect and process sensitive data only with your consent, and we do not use it for purposes beyond those disclosed here or in the NPP.

3. Protected Health Information (PHI) Under HIPAA

Row Telehealth is a covered entity under the Health Insurance Portability and Accountability Act (“HIPAA”). Our use and disclosure of your protected health information (“PHI”) is governed by HIPAA and described in detail in our Notice of Privacy Practices at rowtelehealth.com/notice-of-privacy-practices. In general, we may use and disclose PHI without your authorization for treatment, payment, and health care operations, and for other purposes permitted or required by law. Most other uses and disclosures require your written authorization, which you may revoke. If PHI held by us is subject to a breach, we will notify affected individuals, and where required the media and the U.S. Department of Health and Human Services, as required by the HIPAA Breach Notification Rule. To the extent this Policy and the NPP conflict as to PHI, the NPP controls.

Because your clinical information is generally protected as PHI under HIPAA, it is largely exempt from state consumer-privacy statutes. The state privacy rights described in Section 8 apply principally to non-PHI data we collect through the website (such as account, device, and usage information).

Our HIPAA Notice of Privacy Practices is the controlling document for PHI. It contains:

• How we may use and disclose PHI: for treatment, payment, and health care operations without your authorization; the other disclosures permitted or required by law; and the uses, such as marketing and any sale of PHI, that require your written authorization (Notice, Section 2).
• Your rights over your health information and how to exercise them: to inspect and obtain a copy of your records, to request an amendment, to receive an accounting of disclosures, to request restrictions and confidential communications, to a paper copy of the Notice, and to be notified of a breach, with the written-request procedure, identity verification, timelines, and fees (Notice, Sections 3 and 4).
• How to file a complaint: with our Privacy Officer at legal@rowtelehealth.com or by mail, and with the U.S. Department of Health and Human Services, Office for Civil Rights, without retaliation (Notice, Section 5).
• Our legal duties: to maintain the privacy and security of PHI, to provide you with the Notice and follow its terms, to notify you of a breach, and not to use or disclose PHI other than as the Notice describes without your written authorization (Notice, Section 6).

4. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Services, including scheduling, facilitating, and documenting telehealth visits and connecting you with our licensed providers
• Verify your identity and eligibility, and process insurance (where applicable) and payments
• Communicate with you about appointments, prescriptions, results, account matters, and service updates
• Provide customer and technical support
• Improve, personalize, and secure the Services, including analytics, quality assurance, and fraud prevention
• Comply with legal, regulatory, licensing, accreditation, and recordkeeping obligations
• Send you administrative and, where you have not opted out, promotional communications about our own Services (we do not use PHI for marketing without any authorization required by law), and
• Fulfill any other purpose disclosed at collection or with your consent.

Automated decision-making / AI. We do not use your personal data to make legal or similarly significant decisions about you through solely automated means, and we do not sell your data or use your health data to train third-party large language models. Where we use tools such as transcription or decision-support technology to assist our providers and staff, a licensed provider remains responsible for all clinical decisions.

5. How We Collect Information

• Directly from you, when you create an account, complete intake forms, communicate with providers or support, or make a payment.
• Automatically, through cookies, web beacons, pixels, and similar technologies as you use the Services (see Section 7).
• From third parties, pharmacies, laboratories, insurers or payers (where applicable), identity-verification vendors, and service providers acting on our behalf.

6. How and With Whom We Disclose Information

We may disclose your information:

• To service providers and contractors who perform functions on our behalf (such as hosting, secure video, payment processing, identity verification, analytics, and communications) under contracts that limit their use of the information. Those that handle PHI do so under HIPAA Business Associate Agreements.
• To pharmacies, laboratories, and insurers or payers as needed to provide and bill for the Services.
• For legal and safety reasons, to comply with law, legal process, or government or regulatory requests. To enforce our terms, and to protect the rights, property, or safety of you, Row Telehealth, or others.
• In a business transfer, to a successor in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to applicable law and, for health data, any required consent.
• With your consent or authorization, or as otherwise disclosed at the point of collection.
• Aggregated or de-identified data, without restriction.

We do not sell your personal data, and we do not share it for cross-context behavioral advertising.

7. Cookies and Tracking Technologies

We use cookies, web beacons, pixels, and similar technologies to operate the Services, remember your preferences, and measure usage. You can control cookies through your browser or device settings. Disabling them may affect Service functionality.

Global Privacy Control. Where required by law, our Services treat a Global Privacy Control (“GPC”) signal as a valid opt-out request. Because there is no common standard for “Do Not Track” browser signals, we do not currently respond to them. You can instead use the cookie controls described above.

We do not permit third-party advertising trackers that would transmit your health information to third parties for their own advertising purposes.

8. Your Privacy Rights and Choices

Depending on where you live, you may have some or all of the following rights regarding non-PHI personal data:

• Access / know what personal data we process and obtain a copy in a portable format
• Correct inaccuracies in your personal data
• Delete personal data we maintain, subject to legal exceptions
• Opt out of the sale or sharing of personal data, targeted advertising, and certain profiling (note: we do not sell or share personal data)
• Limit the use and disclosure of sensitive personal data
• Appeal a denial of a rights request, and
• Non-discrimination for exercising these rights.

The exact rights, thresholds, and response timelines vary by state (for example, under the California Consumer Privacy Act and the Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and other state privacy acts). For PHI, HIPAA’s separate access, amendment, accounting-of-disclosures, and restriction rights apply and are described in our Notice of Privacy Practices.

To exercise these rights, email legal@rowtelehealth.com or call the number in Section 13. We will verify your request and respond within the period required by applicable law. An authorized agent may submit a request on your behalf with proof of authorization.

9. How We Protect Your Information

We maintain administrative, physical, and technical safeguards designed to protect your information against unauthorized access, use, alteration, and disclosure, consistent with the HIPAA Security Rule for electronic PHI. No system is completely secure, and we cannot guarantee absolute security. Communications sent through non-secure channels (such as ordinary email or text) may not be protected. Please use our secure patient portal for health information.

10. How Long We Keep Your Information

We retain personal data for as long as reasonably necessary to provide the Services, comply with our legal, professional, and recordkeeping obligations, resolve disputes, and enforce our agreements. Medical records are retained for the period required by the medical-record-retention laws of each state in which we provide care. When no longer required, we delete, destroy, or de-identify the data.

11. Changes to This Policy

We may update this Policy from time to time and will post the updated version with a new “Last updated” date. We will provide additional notice of material changes as required by law. Your continued use of the Services after an update signifies acceptance of the revised Policy.

12. Contact Us

To exercise your rights, ask questions, or make a complaint about this Policy or our privacy practices, contact our Privacy Officer:

Rely Telehealth Plus, Inc. d/b/a Row Telehealth, Attn: Privacy Officer Email: legal@rowtelehealth.com Mailing address:

3905 Crescent Park Drive
First Floor
Riverview, FL 33578

To file a HIPAA-related complaint, you may also contact the U.S. Department of Health and Human Services, Office for Civil Rights. See our Notice of Privacy Practices for details.