Elara Privacy Policy

Effective Date: 2/4/2026

Elara is committed to protecting the privacy, confidentiality, and security of your personal and health information. This Privacy Policy outlines how we collect, use, store, disclose, and safeguard your data in accordance with applicable federal and state laws, including but not limited to the Health Insurance Portability and Accountability Act (HIPAA), the California Consumer Privacy Act (CCPA), and other relevant data protection statutes.

1. Scope of This Policy

This Privacy Policy applies to all users of Elara’s websites, mobile platforms, applications, and telehealth services. It governs all data collection and usage practices, whether online or offline, in connection with our healthcare services.

2. Information We Collect

We may collect and store the following categories of information:

• Personal Identifiers: Name, date of birth, address, email address, phone number, government-issued ID (e.g., driver’s license, passport), billing details, and health insurance information.
  

• Health Information (PHI): Symptoms, diagnoses, medications, allergies, treatment history, lab results, and communications with providers, as defined under HIPAA.
  

• Technical Information: IP address, browser type, device identifiers, geolocation data, access times, referral URLs, cookies, and interaction data.
  

• Communications and Preferences: Inquiries, survey responses, support conversations, and user preferences submitted through forms or interactions.

3. Legal Basis for Collection (If Applicable)

Where required by law, we collect and process your personal data only when we have a legal basis to do so, including:

• With your consent
  

• To fulfill a contract (e.g., provide telehealth services)
  

• To comply with a legal obligation
  

• To protect vital interests
  

• For legitimate business interests (e.g., platform improvement, fraud prevention)
  

4. Use of Information

Your information may be used for the following purposes:

• Facilitate diagnosis, consultation, treatment, prescription, and follow-up services through Beluga Health Group
  

• Share necessary data with licensed pharmacy partners for prescription fulfillment
  

• Provide account management, billing, and customer support
  

• Customize user experience and deliver relevant content
  

• Send appointment reminders, prescription updates, and operational messages
  

• Ensure compliance with regulatory obligations and medical recordkeeping
  

• Conduct analytics, research, and development to improve service delivery
  

We do not sell your data to any third party for monetary gain.

5. Disclosure of Information

We may disclose your information:

• To licensed healthcare providers affiliated with Beluga Health Group
  

• To pharmacy partners for the purpose of medication fulfillment
  

• To third-party vendors and contractors (e.g., payment processors, IT providers) under strict confidentiality agreements
  

• To comply with law, regulation, court order, or legal process
  

• If necessary to detect, prevent, or address fraud, abuse, security, or technical issues
  

• In connection with a business transaction, such as a merger or acquisition (with notice provided)
  

All disclosures are made in accordance with applicable data privacy and security laws.

6. HIPAA Compliance

Elara adheres to the privacy and security standards mandated by HIPAA. We protect your Protected Health Information (PHI) using administrative, technical, and physical safeguards. Access to PHI is restricted to authorized personnel only. Any sharing of PHI with third parties is executed through HIPAA-compliant Business Associate Agreements (BAAs).

7. CCPA & California Privacy Rights

If you are a California resident, you have the right to:

• Know what personal information we collect and how it’s used
  

• Access your personal information
  

• Request deletion of your personal information (subject to legal exemptions)
  

• Opt out of the sale or sharing of personal data
  

• Non-discrimination for exercising these rights
  

To exercise your rights under the CCPA, contact us at support@withelara.com with the subject line “CCPA Request.”

8. AI Communications and Limitations

Elara may use AI-assisted technologies to support onboarding, customer service, and general user interactions. While AI may provide helpful information, it should never be considered medical advice or a substitute for human judgment. Only communications directly from an Elara provider or employee should be considered authoritative. Elara disclaims liability for any reliance on AI-generated content.

9. Data Retention and Deletion

We retain your personal and health data for as long as necessary to fulfill the purposes outlined in this policy or to comply with legal and regulatory requirements. Medical records are retained in accordance with HIPAA and applicable state laws. Users may request deletion of their data, subject to retention obligations.

10. Data Security

Elara implements industry-standard safeguards to ensure the confidentiality, integrity, and availability of your data, including:

• Encryption of data in transit and at rest
  

• Secure user authentication and access controls
  

• Activity logging and regular security audits
  

• Vendor security assessments
  

Despite our efforts, no method of transmission or storage is 100% secure. Users are encouraged to protect their login credentials and report any suspected breach immediately.

11. Your Rights and Choices

Depending on your jurisdiction, you may have the right to:

• Access and receive a copy of your data
  

• Correct or amend inaccurate information
  

• Withdraw consent or restrict processing
  

• Object to certain uses of your data
  

• File a complaint with a data protection authority
  

Please submit all requests to support@withelara.com with the subject line “Privacy Policy Request.”

12. Children’s Privacy

Elara services are not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we discover such collection, we will delete the data as quickly as possible.

13. Third-Party Services and Links

Elara’s platform may include links to third-party websites or services. We do not control these third parties and are not responsible for their privacy practices. Please review their privacy policies before providing any information.

14. International Users

14.1 Elara’s services are intended solely for individuals located in the United States. We do not offer medical, pharmacy, or telehealth services to individuals outside the U.S.

While individuals outside the U.S. may access our website, any such access is incidental and not intended to constitute the offering of services to users in other jurisdictions. If you access our platform from outside the United States, you do so at your own initiative.

14.2 GDPR Considerations (EEA and UK Visitors)

Elara is a United States–based company and offers its services exclusively to individuals located within the United States. Elara does not intentionally target, market to, or provide services to residents of the European Economic Area (EEA), the United Kingdom, or Switzerland.

However, if you are located in the EEA or UK and choose to access our website, we process any personal data collected through such access in a manner consistent with generally recognized data protection principles.

Where applicable, processing may occur based on:

• Your consent

• Legitimate interests related to website operation, security, and fraud prevention

• Compliance with applicable legal obligations

If GDPR is deemed to apply to limited website interactions, you may have the right to:

• Request access to personal data collected through the website

• Request correction or deletion of such data

• Object to certain processing activities

15. Changes to This Policy

We may revise this Privacy Policy at any time. Changes will be posted on this page with an updated effective date. Significant changes will be communicated via email or a notice on our platform.

Contact Us

For questions or concerns about this Privacy Policy, or to submit a data request, contact:

Support@WithElara.com
Subject Line: “Privacy Policy Request”