Privacy policy

Effective date: October 9, 2026. Wells & Millar, a California corporation, doing business as HarlanMD, 1301 N Broadway STE 33349, Los Angeles, CA 90012.

1. Notice at collection (California)

At or before the point we collect personal information, we give this notice. We collect the categories below for the purposes in Section 5, keep them for the periods in Section 12, and "share" (and may be considered to "sell") only the categories marked, for cross-context behavioral advertising and ad measurement, which you can opt out of under Your Privacy Choices. Health-related sensitive personal information (the consultation you bought) is used for reminders and advertising measurement as well as to provide the consultation; you can limit that use under Your Privacy Choices.

Category	Purposes	Sold or shared?	Retention
Identifiers (name, email, postal address, phone, account ID, IP address, cookie and device identifiers)	Orders, accounts, support, marketing, security	Shared, and may be a "sale" (advertising measurement and audiences, hashed)	Order records 7 years; account 2 years after last activity
Personal information described in Cal. Civ. Code section 1798.80(e) (billing address; last four digits and type of payment card)	Orders, refunds, fraud prevention	No	7 years
Commercial information (products and consultations viewed and bought, orders, subscriptions, returns)	Orders, subscriptions, reminders, personalization, marketing, analytics	Shared, and may be a "sale" (advertising)	7 years
Internet or other electronic network activity information (pages viewed, clicks, referring site, email opens, help-center use)	Site operation, analytics, advertising, security	Shared, and may be a "sale" (advertising)	Up to 26 months
Geolocation data (approximate location from your IP address; we do not collect precise geolocation)	Site operation, fraud prevention, tax	Shared with the categories above	Up to 26 months
Audio, electronic, visual or similar information (photos or video you submit with a review or testimonial; support messages)	Support, reviews, quality	No	3 years (reviews while published)
Inferences (your likely product preferences)	Personalization, marketing	No	While your order history is kept
Records of your acceptance of our Terms of Service and Telehealth Informed Consent (version, date and time)	Contract records, legal compliance	No	7 years
Sensitive personal information: health-related (the consultation you bought)	Fulfill and support your consultation, refunds, reminders about your consultation and follow-ups, advertising measurement and audiences, fraud prevention, legal compliance	Shared, and may be a "sale" (advertising measurement and audiences); you can opt out or limit	With the order record (7 years)
Sensitive personal information: health-related (coded case-status updates from MD Integrations)	Support and refunds only	No	90 days after your case closes
Sensitive personal information: account access codes	Account sign-in and security	No	Codes expire within minutes

Third parties that collect information on our site. Meta Platforms, Google, TikTok, Pinterest and Converge collect identifiers and internet activity through pixels on our shopping pages and checkout, including purchase events for products and consultations, for ad targeting and measurement, under their own privacy policies. Klaviyo collects your browsing of our product pages and your orders to send you our emails and texts. You can opt out under Your Privacy Choices. No pixel runs on derm.harlanmd.com, and our advertising tools are not designed to read what you enter in the medical intake.

2. Who we are and what this policy covers

This Privacy Policy explains how Wells & Millar, a California corporation doing business as HarlanMD ("HarlanMD", "we", "us"), collects, uses and shares personal information when you visit harlanmd.com, derm.harlanmd.com, help.harlanmd.com or account.harlanmd.com, buy our products or a telehealth consultation, create an account, subscribe to emails or texts, contact support, or otherwise interact with us (together, the "Services"). It also describes your rights and how to exercise them. Our Consumer Health Data Privacy Policy is a separate document that applies to information about your health.

What it does not cover. This policy does not cover:

• Your medical records. Your intake answers, photos, messages, diagnosis, treatment plan and prescriptions are collected and held by M & D Integrations, Inc. (doing business as MD Integrations) for your clinician and the medical group your clinician practices with. Their privacy notices, presented in the intake and the patient portal, govern that information. Section 4 explains the little we receive.
• Pharmacies, which have their own privacy practices.
• Shopify's own services that you use directly, such as Shop Pay, the Shop app and Shopify's fraud-prevention and network services, which are governed by Shopify's Consumer Privacy Policy in addition to ours (Shopify uses that information across the stores it hosts), and other third-party sites we link to.

3. Information we collect

We collect information in three ways: you give it to us, we collect it automatically when you use the Services, and we receive it from service providers and partners.

Category	Examples	Where it comes from
Identifiers	Name, email address, mailing and shipping address, phone number, account ID, IP address, cookie and device identifiers; the content of emails, chats and help-center tickets you send us	You; your device; Shopify
Personal information described in Cal. Civ. Code section 1798.80(e)	Billing address, the last four digits and type of your payment card, payment tokens; we do not store full card numbers, which go directly to the payment processor	You; Shopify and payment processors
Commercial information	Products and consultations you viewed, put in a cart or bought; order history, subscriptions, returns and refunds; discount codes; HSA/FSA card use; survey answers	You; Shopify; our apps
Internet or other electronic network activity information	Pages viewed, links clicked, referring site, search terms on our site, browser and device type, operating system, session and cookie data, email opens and clicks, help-center use	Your device; cookies and pixels; analytics providers
Geolocation data	Approximate location from your IP address, and the state in your shipping address. We do not collect precise geolocation.	Your device; Shopify
Audio, electronic, visual or similar information	Photos or video you choose to submit with a review or testimonial, which may show your skin if you choose. The photos you submit for a consultation go only to MD Integrations and your clinician; we do not receive them. We do not record support calls.	You
Inferences	Preferences we infer from your product purchases and site use, such as which products you may be interested in. We do not infer health conditions from product purchases (Section 4).	Derived by us
Records of acceptance	The version, date and time you accepted our Terms of Service and the Telehealth Informed Consent	You; Shopify
Sensitive personal information: health-related	The fact that you bought a consultation for a named skin condition (for example, "Rosacea Consultation"), the condition code and follow-up indicator recorded when you continue from our condition selector to checkout, and the coded status of that consultation (opened, intake completed, completed with or without a prescription or referral, refunded). See Section 4.	You (your order); MD Integrations (status)
Sensitive personal information: account access	One-time login codes for your account; we do not store passwords for harlanmd.com accounts	Shopify

We do not collect Social Security numbers, driver's license numbers, precise geolocation, biometric identifiers, genetic data, or information about your race, religion, sexual orientation or union membership. If MD Integrations verifies your identity with a government ID, that happens in the intake and we do not receive the ID.

4. Health-related information and your consultations

What your clinician and MD Integrations hold. Everything you provide in the medical intake and patient portal (your answers, medical history, medications, photos, identity documents, messages with your clinician, the diagnosis, the treatment plan and any prescription) is collected by MD Integrations for your clinician and the medical group your clinician practices with. MD Integrations and the medical group state that they protect this information as required by HIPAA and state medical-privacy laws, and their privacy notices, presented in the intake and portal, govern it, not this policy. HarlanMD is not a HIPAA covered entity. HarlanMD's staff do not have access to your intake, photos, messages, diagnosis or treatment plan, and our systems do not receive them.

What HarlanMD receives from your case, and how we use it. When you buy a consultation, we and our store platform send MD Integrations your name, email, phone number, address, order number, the consultation you bought and technical details of your order (such as your IP address and approximate location) so it can open your case. With the authorization you give in the medical intake, MD Integrations sends us short status updates: that your case was opened, whether your intake was completed, whether the clinician completed the case with or without a prescription or referred you elsewhere, and whether a refund is due. These updates do not include your diagnosis, your answers, your photos or the name of any medication. We keep them as coded tags on your order, use them only to support you, process refunds and run the service, and delete them 90 days after your case closes. We never use anything from your intake or your case status for marketing, advertising, audiences or product recommendations, and we do not disclose the status updates to anyone except our store platform and help-desk provider as needed for support and refunds, or as the law requires.

Your consultation purchase, and how we use it. Your purchase of a consultation (its name, for example "Rosacea Consultation", and its price) is an order in our store, and we use it in three ways beyond fulfilling it. (1) Reminders: we send you emails, and texts if you opted in, about your consultation and about when a follow-up consultation is due, through Klaviyo, our messaging provider; these reminders may name the consultation you bought but never include anything from your intake or treatment plan. (2) Advertising measurement and audiences: the purchase event (the consultation's name and price, your device identifiers and a hashed version of your email address) is sent to the advertising platforms in Section 6 (Meta, Google, TikTok, Pinterest and Converge) so we can measure which ads lead to purchases and show our ads to people like you. (3) Statistics: aggregated counts such as how many cases were completed within 24 hours. You can opt out of the advertising use at any time under Your Privacy Choices, and where your state requires consent to share information about your health we ask for it before checkout and you can withdraw it at any time. We do not sell this information for money and we do not give it to data brokers.

Our over-the-counter products. We do not use your purchase or viewing of SmartLotion® or Perfect Repair to identify or infer a health condition, and we do not create audiences, segments or messages based on a health condition inferred from a product purchase.

The intake itself. The medical intake that appears on your order confirmation page after you buy a consultation is provided by MD Integrations. Our advertising and analytics tools are not designed to read what you enter in it, and the condition selector at derm.harlanmd.com loads no advertising or analytics pixels.

State health-data laws. Because the fact that you bought a consultation is "consumer health data" under the laws of Washington, Nevada and Connecticut and "sensitive personal information" under California law and similar laws, we publish a separate Consumer Health Data Privacy Policy (Section 10), and Section 9 explains your rights.

5. How we use information

• To provide what you asked for: process orders and payments, ship products, open your consultation with MD Integrations, manage subscriptions and accounts, send order, shipping, subscription and consultation messages (including follow-up reminders), and provide customer support.
• To run and improve the Services: analytics about how the site and our emails are used, testing, fixing problems, understanding which products and content are useful, and training our support team.
• To market our products and consultations: send marketing emails and texts you have signed up for, show you our ads on other sites and apps and measure them (Section 6), offer discounts, and personalize what you see on our site based on your past purchases.
• To keep things safe and legal: verify orders, detect and prevent fraud, abuse and security incidents, enforce our Terms of Service, respond to legal requests, and meet our legal obligations, including tax, consumer-protection and product-safety rules.
• With your consent for any other purpose we describe when we collect the information.

We may de-identify or aggregate information so it no longer identifies you, and use that information for any lawful purpose. We will not try to re-identify it, and we require anyone we give it to not to. We do not use your personal information, or allow our service providers to use it, to train artificial-intelligence models, including large language models. We do not use automated decision-making to make decisions that have legal or similarly significant effects on you, such as refusing a consultation; a person reviews any order flagged for possible fraud before we cancel it.

6. Cookies, pixels and analytics

We and our service providers use cookies, pixels (small pieces of code), software development kits and similar technologies on harlanmd.com, in our emails and in our ads. They fall into four groups:

• Essential: required to run the store, keep your cart, sign you in, process checkout, prevent fraud and remember your privacy choices. Set by Shopify and our checkout and payment providers. These cannot be turned off.
• Functional: remember preferences and power features such as reviews, the help center and signup forms.
• Analytics: tell us how people use the site so we can improve it. We use Shopify's analytics and the Converge analytics pixel, and we may use Google Analytics. Cloudflare provides security and may collect privacy-preserving, cookieless traffic statistics on derm.harlanmd.com.
• Advertising: let us show you our ads on other platforms and measure whether ads lead to purchases. We currently use advertising pixels and server-side connections from Meta (Facebook and Instagram), Google (Google Ads and YouTube), TikTok and Pinterest, loaded through Shopify's pixel manager, and the Converge pixel. These partners receive information such as the pages you visit, the products and consultations you view or buy (including the consultation's name and price), your device identifiers, and, for matching purposes, hashed versions of your email address or phone number. They may combine it with information they hold about you under their own privacy policies.

Your choices about cookies and pixels. If you are in California, Washington, Nevada or Connecticut, analytics and advertising cookies and pixels (including Converge) do not load until you choose "Accept" in our cookie banner. Elsewhere they load unless you choose "Decline", which is offered as prominently as "Accept". Meta, Google, TikTok, Pinterest and other third parties may use cookies, pixels and similar technologies on our site to collect or receive information from our site and elsewhere on the internet, and use it to provide measurement services and target ads. You can opt out at any time through Your Privacy Choices, at optout.aboutads.info or optout.networkadvertising.org, and by limiting ad tracking in your device settings. We honor the Global Privacy Control (GPC) browser signal as an opt-out of targeted advertising and of the sale or sharing of personal information, in the browser that sends it; if you are signed in to your account when we receive the signal, we apply it to your account as well. Your browser's "Do Not Track" setting is not honored by most sites, including ours, because there is no common standard for it; GPC is the signal we honor. If you block all cookies, parts of the site, including checkout, may not work.

Email tracking. Our emails contain a pixel that tells us whether an email was opened and which links were clicked. You can prevent this by turning off image loading in your email program, or by unsubscribing from marketing.

7. How we share information

Service providers and contractors. We share personal information with companies that process it for us under contracts that limit what they can do with it. The main ones are:

Provider	What they do for us
Shopify Inc.	Hosts our store, checkout, customer accounts and order records; processes payments through Shopify Payments; provides analytics, the cookie banner and the pixel manager; screens orders for fraud using information from across the stores it hosts (for which Shopify acts under its own privacy policy)
M & D Integrations, Inc. (MD Integrations) and the medical group your clinician practices with	Receive your name, email, phone, address, order number, the consultation you bought and technical order details so your case can be opened. From that point they hold your medical information for your clinician under their own privacy notices (Section 4)
Payment processors	Shopify Payments, Shop Pay, PayPal and Venmo process your payment, including the order amount and item description, under their own privacy policies
Klaviyo	Sends our marketing emails and text messages and our order and consultation reminder messages, and stores your email, phone, marketing preferences and order history (including consultations you bought) to do so. Klaviyo never receives your case status or anything from your intake
Recharge	Manages product subscriptions and the subscription portal
Gorgias	Runs our help center at help.harlanmd.com and our support inbox, where our support team can see your messages and your order history, including consultation orders and their coded status
ReConvert	Shows post-purchase offers on the order confirmation page (processes data in the United States, Israel and the European Union)
Converge	Marketing analytics and ad measurement for orders and shopping pages
Cloudflare	Hosts derm.harlanmd.com and provides security and performance services for our sites, processing your IP address and the pages you request
Shipping carriers	USPS and other carriers receive your name, address and phone number to deliver orders
Review and survey tools, professional advisers, IT and security vendors	As needed to provide their services

Advertising partners. As Sections 4 and 6 describe, advertising platforms receive information about your activity on our site and your purchases, including consultation purchases, through pixels and server-side connections. Under California and some other state laws, this counts as "sharing" personal information for cross-context behavioral advertising, or a "sale", even though no money changes hands. You can opt out under Your Privacy Choices. We never share your case status or anything from your intake this way, and we have no actual knowledge that we sell or share the personal information of anyone under 16.

Legal, safety and business reasons. We may disclose personal information to comply with law, subpoenas, court orders or government requests; to enforce our Terms of Service; to protect the rights, property or safety of HarlanMD, our customers or others; to investigate fraud or security issues; and to a buyer or successor if we sell or merge all or part of our business, in which case this policy will continue to apply to your information until the successor changes it with notice to you.

With your direction. We share information when you ask us to, for example when you ask us to send a product to someone else or post a review.

No data brokers. We do not provide personal information to data brokers. We do not disclose personal information to third parties for their own direct marketing, except that Shopify may use information about your purchase in the Shop app under Shopify's privacy policy when you use Shop Pay or the Shop app. California residents may ask us once a year about disclosures for direct marketing by emailing privacy@harlanmd.com with "Shine the Light" in the subject line.

8. Your privacy choices

• Do Not Sell or Share My Personal Information / opt out of targeted advertising. Use the "Your Privacy Choices" link at the bottom of every page and turn off "Sale and sharing of personal information (targeted advertising)". Or turn on Global Privacy Control in your browser, email privacy@harlanmd.com with "Opt out" in the subject line, or call (877) 465-7892. When you opt out, we stop the advertising and Converge pixels in that browser and stop sending information about that browser to advertising platforms from our servers. If we know who you are (for example, you are signed in, or you give us your email address), we also stop sharing your email address, phone number and purchases, including consultation purchases, with advertising platforms for matching or audiences. We do this at once where we can, and always within 15 business days. The Your Privacy Choices panel shows your current choice and shows "Opt-out preference signal honored" when we detect GPC. A choice made only in a browser applies to that browser; to apply it everywhere, sign in or give us your email address. We will not ask you to opt back in for at least 12 months.
• Limit the use of my sensitive personal information. Beyond providing your consultation, we use the fact that you bought one for follow-up reminders and advertising measurement. To limit our use of it to providing and supporting the consultation, processing payments and refunds, preventing fraud and meeting legal duties, use the "Limit the use of my sensitive personal information" toggle in the Your Privacy Choices panel, or email privacy@harlanmd.com with "Limit" in the subject line. We apply it within 15 business days. Opting out of sale or sharing (above) also stops the advertising use.
• Marketing emails: click "unsubscribe" in any marketing email, or email us. We process unsubscribes within 10 business days and usually right away, and never require anything more than your email address. You will still receive service emails about orders, subscriptions and consultations; to stop consultation reminders as well, tell us.
• Text messages: reply STOP to any message.
• Account: sign in to your account to view and update your contact details and orders, or ask us to close it.
• Subscriptions: manage or cancel in the subscription portal linked from your order emails, or contact us.
• Reviews and testimonials: ask us to remove content you submitted, or withdraw permission for future use of a photo or testimonial.

9. Your privacy rights

Depending on where you live, state law may give you some or all of the rights below. We extend the rights in this section to every customer in the United States, whatever your state.

• Know and access: ask what personal information we have collected about you, where it came from, why we use it, who we share it with, and get a copy in a portable format.
• Correct: ask us to fix inaccurate personal information.
• Delete: ask us to delete your personal information. We may keep what the law allows or requires, for example order records for tax and refund purposes, information needed to complete a transaction or resolve a dispute, and records of your opt-outs, and we will tell you if we do.
• Opt out of targeted advertising, the sale or sharing of personal information, and profiling that produces legal or similarly significant effects (we do not do that kind of profiling).
• Limit our use of sensitive personal information (see Section 8).
• Withdraw consent to the collection or sharing of consumer health data (see Section 10).
• Not be discriminated against for exercising any right. We will not deny you products, charge a different price or provide a different level of service because you exercised your rights, except where a difference is reasonably related to the value of your information under a financial incentive program you have opted into.
• Appeal a decision we make on your request.

How to make a request. Email privacy@harlanmd.com (please put the type of request in the subject line), call (877) 465-7892 toll-free, or write to Wells & Millar, dba HarlanMD, Attn: Privacy, 1301 N Broadway STE 33349, Los Angeles, CA 90012. Requests about your medical records must go to your clinician through the MD Integrations patient portal, because we do not hold them; if you send one to us we will tell you how to reach them.

Verification. To protect your information we will verify your identity before acting on an access, correction or deletion request, usually by confirming details of your account or recent orders and by sending a confirmation to the email address we have on file. For a copy of health-related information, we will also ask you to confirm details of your consultation order, and if you do not have an account we may ask for a signed declaration. We will ask only for what is needed, will never ask for a password, and will not use the information for any other purpose. Opt-out and limit requests do not require verification, although we may ask for information needed to apply them.

Authorized agents. You may use an authorized agent to make a request. We will ask the agent for proof of your signed written permission (or a power of attorney) and may ask you to confirm the request directly with us. A parent or legal guardian may make requests for a child.

Timing and fees. We will confirm receipt within 10 business days, tell you how we will handle the request, and respond within 45 days. If we need more time (up to 45 more days) we will tell you why. Requests to opt out, to limit or to withdraw consent are always free. Requests to know, access, correct or delete are free at least twice in any 12 months. We may charge a reasonable fee for, or decline, a request that is manifestly unfounded, excessive or repetitive, and if we do we will explain why. If we deny a request, we will explain the reason and how to appeal.

Appeals. To appeal a decision, reply to our response or email privacy@harlanmd.com with "Appeal" in the subject line within 60 days. A different person will review your appeal and respond in writing within 45 days, explaining what we did or did not do and why. If we deny your appeal, you may complain to your state attorney general. Washington: www.atg.wa.gov/file-complaint. Nevada: ag.nv.gov. Connecticut: portal.ct.gov/AG. California: cppa.ca.gov or oag.ca.gov.

California residents: additional information. The California Consumer Privacy Act (as amended by the California Privacy Rights Act) gives California residents the rights above. In the preceding 12 months we collected the categories in Section 3, from the sources and for the purposes stated there and in Section 5. We disclosed for business purposes: identifiers, section 1798.80(e) information and commercial information to our store platform, payment processors, MD Integrations (for consultations), our email and text provider, subscription, help-desk and post-purchase providers, and shipping carriers; internet activity to our store platform, analytics and security providers; audio and visual information to our help-desk provider; and health-related sensitive personal information to our store platform, MD Integrations, our payment processors, our email and text provider (consultation purchases only) and our help-desk provider. We shared, and may be considered to have sold, identifiers, commercial information (including consultation purchases) and internet activity with advertising networks and social media platforms (Meta, Google, TikTok, Pinterest) and our ad-measurement provider (Converge), for cross-context behavioral advertising and ad measurement. We have no actual knowledge that we sell or share the personal information of consumers under 16. Because we use health-related sensitive personal information for reminders and advertising measurement, which are not among the purposes in 11 CCR section 7027(m), we offer the right to limit described in Section 8. Section 1 is our notice at collection.

Notice of financial incentive. When we offer a discount (for example, a percentage off your first order) for signing up for our emails or texts, you give us your email address or mobile number and agree to receive marketing. You opt in by submitting the signup form, and you can withdraw at any time by unsubscribing, without losing a discount you have already received. We estimate the value of your email address or phone number to us as no more than the discount we give for it, calculated from the average discount redeemed and our expected marketing revenue per subscriber. The offer's terms appear with each offer, which links to this notice.

Residents of other states. If you live in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Indiana, Tennessee, Delaware, New Jersey, New Hampshire, Nebraska, Maryland, Minnesota, Kentucky, Rhode Island or another state with a comprehensive privacy law, you have the rights listed above as provided by your state's law, including the right to appeal. Where your state requires consent to process or share sensitive data, including information about your health, we ask for it before checkout when you choose a consultation, and we tell you there that the purchase will be used for reminders and advertising measurement unless you opt out. You can withdraw consent at any time (Section 10).

Nevada residents. We do not sell covered information as defined by Nevada's online privacy law. You may still submit an opt-out request, which we will honor if our practices change.

10. Consumer Health Data Privacy Policy

Because the fact that you bought a consultation is "consumer health data" under the laws of Washington, Nevada and Connecticut, we publish a separate Consumer Health Data Privacy Policy. It lists the consumer health data we collect, its sources, why we collect it, exactly who we share it with and how to contact them, the consent we ask for, and how to exercise your rights to access it, withdraw consent, have it deleted and appeal.

11. Children

Our store is for adults: you must be 18 or older to create an account, make a purchase or sign up for texts. A parent or legal guardian may buy a consultation for a child. In that case the parent's order shows the consultation chosen (for example, "Child Eczema Consultation"), and the child's details are given to the clinician in the MD Integrations intake, not to us. We do not knowingly collect personal information from children under 13, and we do not sell or share, or use for targeted advertising, personal information we know relates to anyone under 18. If you believe a child has given us personal information without a parent's consent, email privacy@harlanmd.com and we will delete it.

12. How long we keep information

We keep personal information for as long as needed for the purposes described above, and then delete or de-identify it. In general:

• Order, payment and refund records: 7 years after the order, for tax, accounting, guarantee and dispute purposes.
• Consultation status updates: deleted 90 days after your case closes or is refunded.
• Account information: while your account is open and for 2 years after your last order or sign-in, unless you ask us to close it sooner.
• Marketing email and text data: until you unsubscribe, plus a record of your unsubscribe so we keep honoring it.
• Support messages: 3 years. We do not record support calls.
• Website analytics and cookie data: up to 26 months; the lifetime of each cookie is shown in the cookie banner's details, and Shopify's cookies are described in Shopify's cookie policy.
• Reviews and testimonials: while published and for 3 years after removal, so we can show the consent we had.
• Records of acceptance of our Terms, the Telehealth Informed Consent and subscription terms: 7 years.
• Privacy requests and opt-outs: 2 years after the request (opt-outs for as long as we need to honor them).

We may keep information longer when the law requires it or to resolve a dispute.

13. Security

We use reasonable administrative, technical and physical safeguards appropriate to the information we hold. These include encrypted connections (TLS); service providers that encrypt stored data; two-step sign-in and role-based permissions for our staff accounts; one-time login codes for customer accounts; and limiting access to consultation orders and status to the staff who handle orders, refunds and support. Card numbers go directly to PCI-DSS compliant payment processors. No system is perfectly secure, and we cannot guarantee that unauthorized access will never occur. If a security incident affects your personal information we will notify you and the authorities as the law requires. If information about your consultation is disclosed in a way this policy does not allow, we will treat it as a security incident and notify you and the authorities as the law requires. Protect your email account, because it is the key to your harlanmd.com account.

14. Email and text messages

We send marketing emails to people who sign up on our site, at checkout, or in response to an offer, and we send marketing text messages only to people who separately opt in to texts; the program terms (frequency, STOP and HELP commands, carrier charges) are in Section 12 of our Terms of Service. We use Klaviyo to send these messages, our order messages and our consultation reminders, and to track opens, clicks and purchases that follow them. Consultation reminders go only to people who bought a consultation, may name the consultation you bought, and never include anything from your intake or treatment plan. Our other marketing is not based on a health condition we know or infer about you. We do not share your mobile number or text-message consent with third parties for their marketing. Text messages are not encrypted, so please do not text us health details. Messages about your medical care come from MD Integrations under its own terms. You can unsubscribe from marketing at any time (Section 8); unsubscribing never requires anything more than your email address or a STOP reply.

15. Our other sites, the help center and social media

derm.harlanmd.com is our condition selector. It sets no cookies, loads no advertising or analytics pixels and does not ask for your name or contact details. Our hosting provider, Cloudflare, processes your IP address and the pages you view to deliver and secure the site. When you continue to checkout, the selector sends our store the consultation you chose, a code for the condition and path you selected, whether you said this is a follow-up, and campaign tags showing that you came from the selector. These are stored with your order and handled as health-related information under Section 4. help.harlanmd.com is our help center, provided by Gorgias; if you submit a ticket there we collect your name, email and message. account.harlanmd.com is the Shopify-hosted sign-in and account area; it shows your orders, including any consultation you bought, but not your case status or medical information. If you contact us or interact with us on social media, the platform's privacy policy applies to the platform's collection, and we may see your public profile and messages. The patient portal is operated by MD Integrations under the privacy notices presented there.

16. United States only

The Services are intended for people in the United States, and our providers process personal information in the United States. Some of our service providers also process data in other countries (for example, ReConvert in Israel and the European Union, and Shopify in Canada). If you access the Services from outside the United States, you understand that your information will be transferred to, stored and processed in the United States and those countries, where privacy laws may differ from those in your country.

17. Changes to this policy

We will update this policy when our practices or the law change, and we will post the new version with its effective date and last-updated date at the top. If a change materially affects how we use personal information we already hold, we will notify you by email or by a prominent notice on the site before the change takes effect, and where the law requires we will ask for your consent. We review this policy at least once every 12 months.

18. How to contact us

Wells & Millar, dba HarlanMD, Attn: Privacy
1301 N Broadway STE 33349, Los Angeles, CA 90012
Email: privacy@harlanmd.com (or support@harlanmd.com)
Phone: (877) 465-7892, toll-free, Monday to Friday, 9 AM to 5 PM Pacific time

If you have a disability and need this policy in another format, contact us and we will provide it.