Privacy Policy

NORBU MD (“NORBU MD,” “we,” “us,” or “our”) respects your privacy and is committed to protecting the personal information collected through our website, technology platform, and related services.

NORBU MD is a healthcare technology and administrative services platform that connects patients with independent, licensed healthcare professionals and coordinates prescription fulfillment through participating licensed pharmacies.

NORBU MD does not itself practice medicine, diagnose medical conditions, make treatment decisions, or issue prescriptions. Medical services are provided by independent healthcare professionals. Prescription medications are dispensed by licensed pharmacies.

This Privacy Policy explains how NORBU MD collects, uses, shares, stores, and protects information in connection with its services.

Depending on your interaction with our platform, we may collect:

Personal Information

• Full name
• Date of birth
• Contact information
• Residential and shipping addresses
• Account credentials

Health-Related Information

• Medical history
• Symptoms and treatment requests
• Current medications
• Allergies
• Information submitted during medical intake
• Communications with healthcare professionals
• Prescription and fulfillment information

Payment Information

• Billing information
• Payment transaction details
• Purchase history
• Refund information

Payment card information may be processed by authorized third-party payment processors.

Technical Information

• IP address
• Browser and device information
• Website usage information
• Cookies and similar technologies
• Security and authentication logs

NORBU MD may use personal information to:

• Establish and maintain patient accounts.
• Connect patients with independent healthcare professionals.
• Facilitate medical intake and provider communications.
• Coordinate prescription processing and pharmacy fulfillment.
• Collect and process patient payments.
• Provide customer support.
• Maintain platform security.
• Prevent fraud and unauthorized activity.
• Comply with applicable laws and legal obligations.
• Improve platform functionality and service delivery.

NORBU MD does not determine whether a patient should receive a prescription or what treatment is medically appropriate. Those decisions belong exclusively to the treating healthcare professional.

Medical services accessed through NORBU MD are provided by independent healthcare professionals and their affiliated medical practices. These professionals are responsible for:

• Medical evaluations
• Diagnoses
• Treatment recommendations
• Prescription decisions
• Clinical documentation
• Medical follow-up
• Medical record obligations applicable to their practices

NORBU MD provides technology and administrative support that facilitates these services. Patients have ongoing direct access to their treating healthcare professionals through the communication channels made available for their care.

When an independent healthcare professional issues a valid prescription, NORBU MD may coordinate fulfillment through participating pharmacy partners, including FormulateRx.

Participating pharmacies are responsible for reviewing prescriptions as required by law, dispensing medications, maintaining applicable pharmacy records, and shipping medications directly to patients. The dispensing pharmacy’s identity and contact information are provided as required by applicable law.

NORBU MD may share the information reasonably necessary to coordinate prescription fulfillment, payment, shipping, patient support, and related administrative services.

Certain health information processed through the NORBU MD platform may be subject to the Health Insurance Portability and Accountability Act (HIPAA) and other applicable federal or state privacy laws.

Independent healthcare practices and pharmacies are responsible for their own HIPAA obligations when acting as covered entities. NORBU MD’s HIPAA responsibilities depend on its legal relationship with each participating healthcare organization, including whether it acts as a business associate. Where required, NORBU MD enters into appropriate Business Associate Agreements and implements safeguards applicable to its role.

A participating healthcare provider’s Notice of Privacy Practices may separately govern protected health information maintained by that provider. This Privacy Policy does not replace any legally required Notice of Privacy Practices.

NORBU MD may share information with:

• Healthcare Professionals: To facilitate evaluations, treatment, prescriptions, and patient communication.
• Licensed Pharmacies: To coordinate prescription processing, fulfillment, delivery, and pharmacy support.
• Technology Providers: To operate secure hosting, communications, authentication, and other platform services.
• Payment Processors: To process transactions, refunds, and payment-related activities.
• Professional Advisers: To obtain legal, accounting, compliance, and security services.
• Government Authorities: When disclosure is required or otherwise permitted by applicable law.

NORBU MD does not sell identifiable patient health information to advertisers. Any use or disclosure of health information for marketing or analytics will be governed by applicable law, including any required patient authorization.

NORBU MD may use cookies and similar technologies to operate the website, maintain sessions, protect accounts, understand site performance, and improve usability. Where applicable law requires consent or an opt-out, NORBU MD will provide the appropriate mechanism. Tracking technologies will be configured to comply with applicable privacy and healthcare requirements, including restrictions on disclosing sensitive health information.

NORBU MD maintains administrative, technical, and physical safeguards appropriate to the information it processes. These may include:

• Encryption
• Role-based access controls
• Secure authentication
• Access monitoring
• Vendor security reviews
• Incident response procedures
• Employee confidentiality requirements

No electronic system can guarantee absolute security.

NORBU MD retains information for periods reasonably necessary to provide services, meet contractual obligations, comply with applicable laws, resolve disputes, and maintain appropriate business records. Medical records maintained by independent healthcare practices and pharmacies may be subject to separate state-specific retention requirements. Retention periods depend on the type of information, the responsible entity, and applicable law.

Depending on applicable law, patients may have rights to:

• Request access to certain personal information.
• Request correction of inaccurate information.
• Request deletion of eligible information.
• Obtain information about certain disclosures.
• Exercise applicable privacy choices.
• Submit privacy complaints.

Rights relating to medical records maintained by independent healthcare professionals or pharmacies may need to be exercised directly with those organizations. NORBU MD will assist with appropriate routing of such requests.

NORBU MD will honor applicable state privacy rights, including rights under comprehensive consumer privacy laws and state health-data privacy laws where applicable. State-specific notices and rights procedures will be provided when required.

NORBU MD services are intended for adults aged 18 and older unless a specific service expressly permits otherwise. NORBU MD does not knowingly offer adult-only services to minors.

NORBU MD may update this Privacy Policy to reflect changes in its services, legal obligations, or privacy practices. The updated policy will be posted with a revised effective date.

Patients seeking access to clinical records or clinical privacy information may also contact their treating healthcare practice.