Privacy Policy

Washington and Nevada residents: additional disclosures about consumer health data are in our Consumer Health Data Privacy Policy. To manage cookies or opt out of the sale or sharing of personal information, see Your Privacy Choices.

1. Introduction

Soha Health LLC, a California limited liability company ("Soha," "we," "us," or "our"), owns and operates the website located at https://www.joinsoha.com, together with any related subdomains, mobile or web applications, and online services that link to this Privacy Policy (collectively, the "Platform"). This Privacy Policy describes how Soha collects, uses, and discloses information in connection with the Platform, its content, and the products and services made available through or in connection with the Platform (collectively, the "Services"). Capitalized terms not defined in this Privacy Policy have the meanings given to them in the Soha Terms and Conditions (the "Terms").

By creating an account, accessing the Platform, or otherwise using any part of the Services, you acknowledge the most recent version of this Privacy Policy. If you use the Services on behalf of another individual, you represent that you are authorized to act for that individual and that the individual has been made aware of the practices described in this Privacy Policy.

2. Important Notices

Soha is not a medical provider, pharmacy, or laboratory and does not practice medicine, provide medical advice, or dispense medications. Soha operates a technology and support platform that facilitates access to independent medical groups and licensed physicians and other clinicians engaged by them (collectively, the “medical groups” and “providers”) and to licensed pharmacies (the “pharmacies”). The medical groups, providers, and pharmacies are independent of Soha, and Soha is not responsible for their use or disclosure of your information.

The services are intended solely for users located in the United States, and your information will be processed and stored in the United States. This Privacy Policy, and our collection, use, and disclosure of information about you, are governed by U.S. law. We make no representation that the services are appropriate or available for use outside the United States.

If you do not agree with the policies and practices described in this Privacy Policy, your choice is not to use the services.

3. No Use by Minors

The Services are intended only for individuals who are at least eighteen (18) years of age. The Services are not designed or intended to attract, and are not directed to, anyone under the age of eighteen (18), and Soha does not knowingly collect personal information from anyone under eighteen (18). If we obtain actual knowledge that we have collected personal information from an individual under eighteen (18), we will take reasonable steps to delete that information or refrain from further use of it in retrievable form, except where retention is required by law or maintained on behalf of a Medical Group as part of a medical record. A parent or legal guardian who believes a child has provided us with personal information may contact us using the information in the "Contact Us" section below. The foregoing describes Soha’s voluntary practices and is not an admission that Soha is subject to the Children’s Online Privacy Protection Act or any similar federal, state, or local law, rule, or regulation.

4. Health Information; Relationship to HIPAA

When you register for an account, you establish a direct customer relationship with Soha. Information you provide to establish and maintain that relationship, including your name, date of birth, email address, shipping and billing addresses, phone number, account credentials, and transactional information, is customer account information that Soha does not consider to be "protected health information" or "medical information."

In using certain components of the Services, you may also provide health or medical information that is protected under applicable law. Soha is not a "covered entity" under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, each as amended ("HIPAA"). One or more of the Medical Groups, Providers, or Pharmacies may or may not be a "covered entity" or "business associate" under HIPAA, and Soha may in some cases act as a "business associate" of a Medical Group or Pharmacy. HIPAA does not necessarily apply to a person or entity merely because health information is involved, and HIPAA may not apply to your transactions or communications with Soha, the Medical Groups, the Providers, or the Pharmacies. Solely to the extent Soha acts as a business associate, and solely in that role, Soha may be subject to certain provisions of HIPAA with respect to "protected health information," as defined under HIPAA ("PHI"), that it receives or maintains on behalf of a Medical Group or Pharmacy.

Any medical or health information you provide that is subject to specific protections under applicable state law (together with PHI, "Protected Information") will be used and disclosed only in accordance with such applicable law. Information that does not constitute Protected Information under applicable law may be used and disclosed in any manner permitted by this Privacy Policy. Protected Information does not include information that has been de-identified in accordance with applicable law.

This Privacy Policy does not apply to information collected and maintained by or on behalf of the Medical Groups, Providers, or Pharmacies for purposes of diagnosis and treatment. That information is handled in accordance with our agreements with those parties and applicable law. The Medical Groups and Providers maintain a Notice of Privacy Practices describing how they use and disclose Protected Information, and by accessing or using the Services you acknowledge receipt of the Notice of Privacy Practices from your Medical Group and Provider(s). Information you submit to Soha that is not intended and used solely for diagnosis and treatment by the Medical Groups and Providers or prescription fulfillment by the Pharmacies is not considered Protected Information and is governed solely by this Privacy Policy and applicable law.

5. Information We Collect

The personal information we collect depends on how you interact with us, the Services you use, and the choices you make. We collect information from several sources and in several ways, as described below.

Information you provide directly. For example:

• Identifiers and contact information, such as your name, email address, phone number, date of birth, and billing and shipping addresses.
• Demographic information, such as your age, sex or gender, and zip code.
• Payment information, such as payment card details and related billing information, which is collected and processed by our third-party payment processors as described in the "Payments and Transactions" section below.
• Content, communications, and files, such as intake questionnaire responses, photographs or documents you upload, records of your communications with us (including chats, calls, emails, and text messages), and reviews, comments, or survey responses you submit.
• Sensitive personal information, including account log-in credentials; government-issued identifiers, such as a driver’s license or other government identification you provide for identity verification; biometric information that we or our service providers may process to verify your identity prior to your use of the Services; the contents of your communications made through the Services; information concerning your health, including symptoms, conditions, medications, and treatment history you provide through the Services; and, if you choose to provide it, information about racial or ethnic origin or information concerning your sex life or sexual orientation.

Information we collect automatically. For example:

• Device and identifier data, such as IP address, cookie identifiers, mobile advertising identifiers, device type, operating system, browser type and settings, and language preferences.
• Usage data, such as the pages you view, the links and features you interact with, the URL from which you arrived, the duration of your visits, access times, and other details of your activity on the Platform. In some instances, usage data may constitute sensitive personal information if it relates to your browsing activity on health-related pages of the Platform (for example, that you viewed a page relating to a particular treatment).
• Approximate geolocation data, such as the general location we infer from your IP address.

Inferences. We create or generate information from the data we collect, including inferences about your likely preferences, interests, and characteristics.

Information from other sources. We also obtain the categories of information described above from third parties, such as service providers acting on our behalf, analytics and advertising partners, co-marketing and promotional partners, social media platforms you choose to connect or interact with, and publicly available sources.

You may decline to provide personal information, and you may use browser or device controls to limit certain automatic collection; however, if you decline to provide information that is necessary for particular Services or features, those Services or features may be unavailable or may not function fully. We also combine information collected from different sources for the purposes described in this Privacy Policy.

In addition, Soha provides management and administrative services to the Medical Groups and certain Pharmacies accessible through the Services. In that capacity, we may store additional health information on their behalf, including medical records, communications with Providers, medical history, and prescription information, which is handled as described in the "Health Information; Relationship to HIPAA" section above.

6. Cookies and Tracking Technologies

We and authorized third parties use cookies, pixels, web beacons, tags, software development kits, session replay tools, and similar technologies (collectively, "Tracking Technologies") to operate the Platform and collect information, including usage data, identifiers, and device information. Cookies are small text files stored by your browser that allow a web server to recognize your browser over time; some persist across sessions and some expire when you close your browser. Pixels, beacons, and tags are small pieces of code or images embedded in web pages and emails that permit a server to log information about your device and your interactions, including whether you open or act on an email. Session replay tools record how you move through and engage with the Platform, which helps us improve the Services and diagnose technical issues.

We and our partners use Tracking Technologies to store your preferences and settings; enable sign-in; analyze how the Platform performs and how users interact with it; develop inferences; personalize content; deliver and measure advertising, including interest-based advertising; detect and prevent fraud and security incidents; and fulfill other legitimate business purposes. Third-party analytics and advertising partners may collect information through the Platform directly using their own Tracking Technologies and may combine it with information collected across other websites and services over time. When you first visit the Platform, and at any time afterward through the cookie preference center available on the Platform, you can review and set your preferences for the categories of Tracking Technologies we and our partners use. Those categories are: strictly necessary technologies, which are required to operate the Platform and to deliver features you request, such as signing in to your account, and which cannot be disabled; functional technologies, which record your choices and settings and recognize you when you return; analytics and performance technologies, which help us understand how visitors use the Platform and measure the performance of our content and campaigns; and advertising and targeting technologies, which collect data about your online activity to identify your interests and to deliver and measure interest-based advertising on the Platform and elsewhere. The choices available to you with respect to Tracking Technologies are described in the "Your Choices and Privacy Rights" section below. Tracking Technologies do not collect your mobile telephone number or your text messaging consent data, and we do not make that information available to analytics or advertising partners.

7. How We Use Personal Information

Subject to the limitations described in the "Health Information; Relationship to HIPAA" section above, we use the personal information we collect for the following purposes, and as otherwise described to you at the time of collection:

• Providing the Services, including creating and administering your account; verifying your identity, location, and eligibility; facilitating your movement through the Platform; placing, processing, and fulfilling orders on your behalf; coordinating with the Medical Groups, Providers, and Pharmacies; and improving and personalizing your experience. Certain features of the Services may be supported by artificial intelligence or machine learning technologies.
• Business operations, including billing and payment processing, accounting, recordkeeping, auditing, internal reporting, securing our systems, detecting and preventing fraudulent or illegal activity, enforcing our agreements and policies, and protecting and enforcing our rights and property.
• Research and product improvement, including developing, testing, and improving the Services and developing new products, services, and features, and analyzing traffic and user behavior on the Platform.
• Communications, including sending confirmations, invoices, technical notices, security alerts, and administrative and support messages, and communicating with you by mail, email, text message, telephone, or other channels, including on behalf of your Provider(s) to facilitate the Services.
• Customer support, including responding to your questions and requests and providing service through support channels, which may include automated or AI-assisted channels.
• Marketing, including sending you newsletters, promotions, offers, surveys, and information about products, services, events, and programs offered by us or our partners, and building audiences and personalizing marketing to you.
• Advertising, including promoting and marketing Soha and the Services and measuring the performance of our advertising and marketing campaigns. Depending on your activity, this may include usage data relating to your visits to health-related pages of the Platform, to the extent such data is not Protected Information.
• Legal, safety, and security purposes, including complying with legal and regulatory obligations; responding to legal process; establishing, exercising, and defending legal claims; and protecting the safety, rights, and property of Soha, our users, and others.
• Corporate transactions, including evaluating and completing a merger, financing, acquisition, reorganization, bankruptcy, dissolution, or sale or transfer of some or all of our business or assets.

Where applicable law requires consent for the use of sensitive personal information, we obtain consent or limit our use of that information as required. We do not use Protected Information for advertising or marketing except as permitted by applicable law and our agreements with the Medical Groups and Pharmacies. We use your mobile telephone number and your text messaging consent data only to send and administer the text messages described in the "SMS and Text Message Program" section below, and we do not disclose either to any third party or affiliate for that party’s marketing or promotional purposes.

8. De-Identified Information

We may de-identify, anonymize, or aggregate information, and we may use, create, disclose, and sell de-identified, anonymized, or aggregated information for any business or other purpose not prohibited by applicable law, including research, analytics, benchmarking, and the training and improvement of artificial intelligence and machine learning models and related services. Where information has been de-identified through a process designed to be permanent, we will maintain and use it only in de-identified form and will not attempt to re-identify it, except as permitted by law to test or evaluate the effectiveness of the de-identification process. Mobile telephone numbers and text messaging consent data are excluded from the information we use, disclose, or sell under this section.

9. How We Disclose Personal Information

Subject to the limitations described in the "Health Information; Relationship to HIPAA" section above, we may disclose each category of personal information described in this Privacy Policy to the following categories of recipients, in connection with the provision of the Services or as otherwise permitted or required by law:

• Medical Groups, Providers, and Pharmacies, to enable them to provide services to you through the Services and to collect payment on their behalf.
• Service providers, including vendors and agents performing services on our behalf, such as technology, hosting, and IT providers; data analytics providers; customer support providers; communications and messaging providers; identity verification providers; fulfillment, shipping, and logistics providers; and security providers. When you use communication channels offered through the Services, your communications may be recorded and stored by our service providers.
• Payment processors and financial services providers, as necessary for payment processing, fraud prevention, credit risk reduction, analytics, and related financial services, as described in the "Payments and Transactions" section below.
• Analytics and advertising partners, including advertising platforms, networks, and social media companies, which may collect or receive identifiers and device information (such as cookie IDs, device IDs, and IP address), usage data, approximate geolocation data, and inferences, and which may use that information for their own purposes, including measurement and interest-based advertising across other websites and services. These Tracking Technologies operate in accordance with the preferences you set in the cookie preference center available on the Platform. Where required by law, we obtain your consent before these disclosures occur, including before disclosing sensitive personal information for these purposes, and we do not disclose Protected Information, mobile telephone numbers, or text messaging consent data for these purposes.
• Affiliates and subsidiaries, including any parent, subsidiary, or commonly owned or controlled entity of Soha, for the purposes described in this Privacy Policy.
• Co-marketing, promotional, and program partners, including partners with whom we offer co-branded services, promotions, discounts, or benefit programs, for example to verify your eligibility for and deliver a benefit you elect to redeem.
• Professional advisors, such as lawyers, accountants, auditors, insurers, and financial advisors.
• Parties to a corporate transaction, in connection with, or during negotiations of, any merger, financing, acquisition, bankruptcy, dissolution, or transfer, divestiture, or sale of all or a portion of our business or assets.
• Law enforcement and government authorities, when we believe disclosure is necessary to comply with applicable law or valid legal process.
• Other parties for safety, security, and rights protection, when we believe disclosure is necessary to protect our customers and others; to prevent fraud, spam, or loss of life or serious injury; to operate and maintain the security of the Services, including preventing or stopping attacks on our systems or networks; or to protect the rights or property of Soha or others, including enforcing our agreements, terms, and policies.
• Parties you direct or consent to, including any recipient to whom you ask us or authorize us to disclose information.
• The public, if you post reviews, comments, or other content to public areas of the Platform, which may be read, collected, and used by others.

Mobile telephone numbers and text messaging consent are excluded from every category of disclosure described above. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. The only recipients of that information are the service providers that transmit messages on our behalf, which may process it solely to deliver the messages we ask them to send, as described in the "SMS and Text Message Program" section below.

Some disclosures to analytics and advertising partners may constitute a "sale" or "sharing" of personal information as those terms are defined under the laws of California and other U.S. states. Your rights and choices with respect to those disclosures are described in the "Your Choices and Privacy Rights" and "Additional Information for California Residents" sections below, and you may opt out of them at any time through the cookie preference center or the "Your Privacy Choices" link on the Platform. No "sale" or "sharing" of personal information involves your mobile telephone number or your text messaging consent data; that information is never disclosed to analytics or advertising partners. Where recipients use your personal information for their own purposes independently of us, their use is governed by their own privacy policies, and we are not responsible for their practices. We may also disclose de-identified information in accordance with applicable law.

10. SMS and Text Message Program

This section describes the personal information we collect and use in connection with our text message (SMS and MMS) program and how that information is handled. It applies in addition to the rest of this Privacy Policy, and it controls over any other provision of this Privacy Policy with respect to mobile telephone numbers, text messaging opt-in and consent data, and message content.

Information we collect for the messaging program. When you opt in to receive text messages from us, we collect the mobile telephone number you provide; records of your opt-in and consent, including the date and time, the form, page, or other channel through which consent was given, and the disclosure text presented to you at that time; the content of the messages exchanged between you and us, including your replies; and message delivery and interaction data, such as delivery status, carrier responses, opt-out and help requests, and whether a message or a link within it was opened.

How we use that information. We use it to send the messages you have asked to receive and to operate the program, including appointment and visit reminders; prescription, order, and shipping updates; account, billing, and security notices; customer support and care team messages; and, only where you have separately opted in to receive them, promotional messages about our products and services. We also use it to respond to STOP, HELP, and other replies, to maintain a record of your consent and of any opt-out, to detect and prevent fraud and abuse of the messaging program, and to comply with our legal obligations.

We do not share your mobile information for marketing. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. We do not share, sell, or provide your mobile phone number or messaging consent data to third parties or affiliates for marketing or promotional purposes.

Providers who deliver the messages on our behalf. We use service providers to transmit the messages, including our messaging platform provider and the telecommunications carriers that carry them. Those providers may process your mobile telephone number and the content of a message solely to deliver the messages we ask them to send, act only on our instructions under binding contracts, and are prohibited from using, selling, or disclosing that information for their own marketing or promotional purposes or for the marketing or promotional purposes of any other party. We may also disclose messaging information where required by law or valid legal process, or to establish, exercise, or defend legal claims.

Program disclosures. Message frequency varies. Message and data rates may apply. Reply STOP to opt out. Reply HELP for help. You may also opt out, or ask a question about the messaging program, by contacting us at care@joinsoha.com. Consent to receive text messages is not a condition of purchasing any product or service or of receiving care through the Services. Carriers are not liable for delayed or undelivered messages.

11. Your Choices and Privacy Rights

We provide a variety of ways for you to control the personal information we hold about you. Depending on your state of residence and the nature of our relationship, some of these controls may be enforceable as legal rights:

• Right to Know / Access. You may have the right to request confirmation of whether we process personal information about you, to access that information, to receive a portable copy, and to request information about the categories of personal information collected, the sources of collection, the purposes of processing, and the categories of recipients to whom personal information was disclosed, sold, or shared.
• Right to Correct. You may have the right to request that we correct inaccurate personal information we maintain about you.
• Right to a List of Third Parties. Depending on your state of residence, you may have the right to request a list of the third parties to whom we have disclosed personal information, either about you or generally.
• Right to Delete. You may have the right to request that we delete personal information we have collected from you, subject to exceptions provided by law.
• Right to Opt Out of Sales, Sharing, and Targeted Advertising. You may have the right to opt out of the "sale" or "sharing" of your personal information and of the processing of your personal information for targeted advertising.
• Right to Limit Use and Disclosure of Sensitive Personal Information. You may have the right to limit our use and disclosure of sensitive personal information to purposes necessary to provide the Services you request and other purposes permitted by law.
• Right to Non-Discrimination. You will not be discriminated against for exercising your privacy rights.

To exercise these rights, contact us using the methods described in the "Contact Us" section below. To opt out of sales, sharing, and targeted advertising effected through Tracking Technologies, use the cookie preference center, available through the cookie settings or "Your Privacy Choices" link on the Platform, on each browser and device you use, because those disclosures occur at the browser or device level. We honor opt-out preference signals, such as the Global Privacy Control, transmitted in a commonly used and recognized format, to the extent required by applicable law; such signals are processed at the browser level and apply to the browser and device from which they are sent. Because there is no common understanding of how to interpret "Do Not Track" browser signals, the Platform does not respond to them.

Verification; authorized agents; appeals. To process a rights request, we may need to verify your identity to the degree of certainty required by law, which may include asking you to submit the request from the email address associated with your account or to provide identifying information or a signed declaration. We will respond to verified requests within the timeframes required by applicable law, generally within forty-five (45) days of receipt, subject to any extension permitted by law. We do not charge a fee to respond to a verified request unless the request is excessive, repetitive, or manifestly unfounded, in which case we will notify you of the fee and the basis for it before completing the request. You may designate an authorized agent to submit requests on your behalf; we may require the agent to provide proof of authorization and may require you to verify your identity directly with us. If we decline your request in whole or in part, we will explain the basis for the denial and, where required by law, you may appeal by contacting us as described below, and we will respond to your appeal in writing.

When we may decline requests. To the extent permitted by applicable law, we may decline a request, in whole or in part, where granting it would be prohibited by law; would adversely affect the privacy or other rights of another person; would reveal a trade secret or other confidential or proprietary information; would interfere with a legal or business obligation that requires retention or use of the information; where we cannot verify your identity; or where the request is unreasonable, excessive, or otherwise exempt under applicable law.

Marketing communications. You may opt out of promotional emails by using the unsubscribe link in any promotional email, and out of promotional text messages by following the instructions in the message (for example, replying STOP), or in each case by contacting us as described below. Even if you opt out of promotional communications, we may continue to send you transactional and Service-related communications, such as order confirmations, prescription and shipping updates, security alerts, and account notices. Additional information about our text messaging program, including message frequency, message and data rates, and how we handle mobile telephone numbers and messaging consent, is set out in the "SMS and Text Message Program" section above.

• Cookie controls. Most browsers accept cookies by default; you can set your browser to refuse or delete cookies, though doing so may impair Platform functionality and may delete stored preferences, including advertising opt-out preferences.
• Mobile identifiers. iOS and Android provide settings to limit tracking or reset the device advertising identifier.
• Industry opt-outs. Some of our advertising partners participate in the Digital Advertising Alliance and Network Advertising Initiative, which offer opt-out tools at optout.aboutads.info and optout.networkadvertising.org.
• Email images. Most email clients allow you to block the automatic downloading of images, which prevents email pixels from functioning.

These choices are specific to the browser or device on which they are made. If you use multiple browsers or devices, or clear your cookies, you will need to repeat your choices on each browser and device.

12. Additional Information for California Residents

This section supplements the rest of this Privacy Policy and applies solely to California residents whose personal information is subject to the California Consumer Privacy Act, as amended (the "CCPA").

Notice at collection. At or before the point of collection, you have the right to receive notice of the categories of personal information and sensitive personal information we collect, the purposes of collection and use, whether the information is sold or shared, and the applicable retention criteria. Those disclosures are set forth in the "Information We Collect," "How We Use Personal Information," "How We Disclose Personal Information," and "Data Retention" sections of this Privacy Policy.

Sales and sharing. The CCPA defines "sell," "share," and "personal information" broadly. Although we do not disclose personal information in exchange for money, we permit analytics and advertising partners to collect identifiers (such as IP addresses, cookie IDs, and mobile IDs), internet activity data, device data, approximate geolocation data, and inferences through the Platform, and those disclosures may constitute "sales" or "sharing" under the CCPA. You may opt out of sales and sharing as described in the "Your Choices and Privacy Rights" section above, including through the cookie preference center, the "Your Privacy Choices" link on the Platform, and the Global Privacy Control. If you opt out, we will continue to make personal information available to partners acting as our service providers to perform functions on our behalf, and your opt-out will not affect prior disclosures or all advertising you see. We do not knowingly sell or share the personal information of consumers under sixteen (16) years of age. We do not sell or share mobile telephone numbers or text messaging consent data, and no opt-out is required for that information because no such disclosure occurs.

CCPA rights. California residents have the rights to know, access, correct, delete, opt out of sales and sharing, and limit the use and disclosure of sensitive personal information, and the right not to be discriminated against for exercising those rights, each as described in the "Your Choices and Privacy Rights" section above, and subject to the verification, agent, and appeal procedures described there.

Shine the Light. California Civil Code Section 1798.83 permits California residents who have an established business relationship with us for personal, family, or household purposes to request information about our disclosure of personal information to third parties for those third parties’ direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes as defined by that statute. California residents may request further information about our compliance with this law by contacting us as described below; we are required to respond to one request per customer per year and are not required to respond to requests made by means other than the designated contact method.

13. Additional Information for Residents of Other U.S. States

Residents of other U.S. states with comprehensive consumer privacy laws, including Colorado, Connecticut, Delaware, Oregon, Texas, Virginia, and others, may have rights comparable to those described in the "Your Choices and Privacy Rights" section above, including rights to access, correct, delete, and obtain a portable copy of personal information, and to opt out of targeted advertising, the sale of personal information, and certain profiling. If we deny your request, you may appeal as described above. Residents of Colorado, Connecticut, Delaware, Oregon, Texas, and Virginia may also lodge a complaint with their state Attorney General.

Nevada residents. Nevada law permits residents to submit a verified request directing us not to make any sale of certain covered information we have collected or will collect about them. If you are a Nevada resident and wish to submit such a request, please email us at legal@joinsoha.com with the subject line "Nevada Opt-Out Request."

Washington and Nevada consumer health data. Additional disclosures regarding consumer health data, including rights available under the Washington My Health My Data Act and Nevada Senate Bill 370, are set forth in our Consumer Health Data Privacy Policy, which is available on the Platform and supplements this Privacy Policy.

14. Data Retention

We retain personal information for as long as necessary to provide the Services and fulfill the transactions you have requested, comply with our legal, regulatory, and contractual obligations, resolve disputes, enforce our agreements, and for other legitimate and lawful business purposes. Retention periods vary based on criteria such as the type and sensitivity of the information, the purposes for which it was collected, user expectations and consent, the availability of automated deletion controls, and our legal obligations, including record-retention obligations applicable to the Medical Groups and Pharmacies for whom we maintain records. After your relationship with us ends, we may retain personal information in our systems and records as needed to satisfy surviving obligations, demonstrate our business practices and compliance, facilitate any future re-engagement you initiate, and support other legitimate business purposes, after which it is deleted, destroyed, or de-identified in accordance with applicable law.

15. Payments and Transactions

In connection with transactions you conduct through the Services, you may be asked to supply information relevant to the transaction, including payment card details, billing address, shipping address, phone number, and email address. By submitting that information, you grant Soha, without charge, an irrevocable and perpetual right to provide it to third parties (such as payment processors, fraud prevention providers, and fulfillment providers) for the purpose of facilitating the transaction. Those parties may use that information only to facilitate the transaction, and any mobile telephone number you provide is not disclosed to them, or to anyone else, for marketing or promotional purposes.

Payment card and other monetary transactions on the Services are processed by our third-party payment processors, currently including Stripe, Inc. ("Stripe"). Information about Stripe’s privacy practices is available in Stripe’s privacy policy at stripe.com/privacy, which is referenced for informational purposes only and is not incorporated into this Privacy Policy. Our payment processors are independent third-party vendors, are not subject to our direction or control, and are not our agents, partners, fiduciaries, or joint venturers, and we are not responsible for their acts or omissions.

16. Security

We use commercially reasonable physical, technical, and administrative safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration, and destruction. However, no method of transmission over the Internet and no method of electronic storage is completely secure, and we cannot and do not guarantee the security of your information. You are responsible for maintaining the confidentiality of your account credentials and for all activity under your account. We ask that you use a strong, unique password for your account and notify us immediately, as described in the "Contact Us" section below, if you believe the security of your account has been compromised.

17. Third-Party Links and Services

The Services may contain links to, or integrations with, websites and services operated by third parties whose privacy practices differ from ours. If you click a third-party link or provide information to a third party, that information is governed by the third party’s privacy policy. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party site or service, and we encourage you to review the privacy policy of every site you visit.

18. Changes to This Privacy Policy

We may supplement, amend, or otherwise modify this Privacy Policy at any time. Revised versions will be posted on this or a similar page of the Platform and will be effective as of the "Last Updated" date shown above; provided that if we make material changes, we will provide notice or obtain consent as required by applicable law. Your continued use of the Services after a revised Privacy Policy becomes effective constitutes your acknowledgment of the revised Privacy Policy. We recommend that you review this Privacy Policy each time you access or use the Services.

19. Contact Us

If you have questions about this Privacy Policy or our handling of your personal information, or if you wish to exercise a privacy right, please contact us:

• By email: legal@joinsoha.com, Attn: Privacy