Privacy Policy

Scope of This Policy

This Privacy Policy applies only to okuleypharmacy.com (the “Site”), operated by Okuley's Pharmacy Inc. (“Okuley's Pharmacy,” “we,” “us,” or “our”).

This policy does not govern your protected health information.Information relating to your prescriptions, medications, health conditions, insurance, or your relationship with our pharmacy is Protected Health Information (“PHI”) governed by the Health Insurance Portability and Accountability Act (“HIPAA”) and described in our Notice of Privacy Practices, not by this policy. If any provision of this Privacy Policy conflicts with our Notice of Privacy Practices with respect to PHI, the Notice of Privacy Practices controls.

Information We Collect

Information you provide

Our Site is informational. We do not operate a patient portal, online ordering system, or refill application on this Site. If you contact us by email, telephone, or through a form hosted on a third-party platform we link to, we receive the information you choose to provide.

Information collected automatically

When you visit the Site, our hosting provider automatically records technical information as part of serving the Site and keeping it secure, including:

• IP address
• Browser type, version, and language
• Device type and operating system
• Pages requested, and date and time of access
• Referring website

Health information

We do not knowingly collect health information through this Site. Please do not send prescription details, diagnoses, or other health information through general website contact channels or email. Contact us by telephone at (419) 784-4800 for anything involving your prescriptions.

How We Use Information

We use the information described above to:

• Operate, maintain, and secure the Site
• Understand how visitors find and use the Site
• Measure and improve Site performance
• Respond to inquiries you send us
• Comply with legal obligations and enforce our Terms of Service

We do not sell personal information. We do not share personal information with third parties for cross-context behavioral advertising.

Cookies and Analytics

The Site does not currently use third-party analytics services and does not set advertising or tracking cookies. Fonts and other assets are served from our own hosting infrastructure rather than third-party servers.

Our hosting provider generates standard server logs as part of delivering the Site. These logs may contain IP addresses and are retained for a limited period for security and operational purposes.

If we adopt an analytics service in the future, we will update this policy to describe what it collects and how you can opt out before it is put into use.

Managing cookies. You can control cookies through your browser settings. Some browsers transmit a Global Privacy Control (GPC) signal; because we do not sell personal information or share it for targeted advertising, there is no sale or sharing for a GPC signal to opt out of, but where applicable law requires it, we treat a GPC signal as a valid opt-out request.

Service Providers

We share information with vendors who provide services to us, including:

• Vercel Inc. — website hosting and infrastructure
• HighLevel Inc. (GoHighLevel) — patient communications, appointment scheduling, and forms hosted on separate pages off this Site, operating under a Business Associate Agreement

Vendors that create, receive, maintain, or transmit PHI on our behalf do so under Business Associate Agreements as required by HIPAA. Our website hosting provider does not receive PHI: no patient forms or health information are collected on, or stored by, this Site.

Third-Party Links and Forms

Certain links on this Site direct you to services hosted by third parties, including forms and scheduling tools hosted on a separate platform we have engaged for that purpose. Once you leave this Site, the practices of that third-party service apply. Where you submit health information through a service we have engaged to act on our behalf, that information is treated as PHI under our Notice of Privacy Practices.

We are not responsible for the privacy practices of websites we link to but do not control.

Data Retention

Hosting logs are retained for a limited period consistent with our hosting provider's standard practices. We retain email correspondence as long as necessary for the purpose it was sent and to meet legal obligations. PHI retention is governed by our Notice of Privacy Practices and Ohio pharmacy record retention requirements.

Security

We use reasonable administrative, technical, and physical safeguards to protect information under our control, including TLS encryption in transit. No method of transmission or storage over the internet is completely secure, and we cannot guarantee absolute security.

Your Rights

Depending on your state of residence, you may have rights to:

• Know what personal information we collect and how we use it
• Access or obtain a copy of your personal information
• Correct inaccurate personal information
• Request deletion of your personal information
• Opt out of sale, targeted advertising, or profiling (we do not engage in these activities)
• Not be discriminated against for exercising these rights

To exercise a right relating to this Site, email qokuley@okuleypharmacy.com or call (419) 784-4800. We will verify your request before responding, generally by confirming information you have previously provided to us. We respond within the timeframe required by applicable law, typically 45 days, and may extend once where permitted. If we deny your request, you may appeal by replying to our response; we will inform you of any further appeal rights available under your state's law.

Requests concerning your prescription or medical records are handled under HIPAA, not this policy. Direct those requests to our Privacy Officer as described in our Notice of Privacy Practices.

Children's Privacy

The Site is not directed to children under 13, and we do not knowingly collect personal information from children under 13 through the Site. If you believe a child has provided us information through the Site, contact us and we will delete it.

Do Not Track

The Site does not currently respond to browser Do Not Track signals, as no common standard has been adopted. We honor Global Privacy Control signals where required by law, as described above.

Changes to This Policy

We may update this policy. Material changes will be reflected in the “Last Updated” date above and, where required by law, communicated to you directly.

Contact