Privacy Policy

Last Updated: 19th October, 2026

ELITE WELLNESS CLINIC,along with its parent, subsidiary, and operating corporate entities (collectively, the “Company,” “we,” “us,” or “our”), publishes this Comprehensive Privacy Policy to detail how we collect, process, record, secure, and disclose personal data gathered through our website, ELITE, our client portals, mobile applications, and electronic administrative interfaces (collectively, the “Platform”).

1. LEGAL STATUS & STATUTORY SCOPE: THE "NON-COVERED ENTITY" CARVE-OUT

1.1. Non-Covered Entity Determination. You explicitly acknowledge that the Company operates as a technology, administrative, and consumer retail vendor. The company is NOT a “Covered Entity” as defined under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (HIPAA). 

1.2. Segregation of Commercial vs. Clinical Data.

Platform Data: Standard identifiers submitted to establish an account, billing entries, browsing footprints, demographic surveys, and purchase histories constitute ordinary commercial data governed solely by this Privacy Policy and state consumer privacy statutes.

Protected Health Information (PHI): Solely to the extent that you submit clinical questionnaires, symptom histories, or photo uploads directed to licensed third-party Providers for diagnosis, or to Pharmacies for dispensing, the Company may function as a contractual “Business Associate” on behalf of those entities. Such data is managed strictly in accordance with our Business Associate Agreements and the Providers’ independent Notice of Privacy Practices.

2. CATEGORIES OF INFORMATION COLLECTED

2.1. Directly Provided Information.

Identity & Contact Credentials: Full legal name, date of birth, biological sex, residential and physical delivery addresses, personal email address, and direct cellular telephone numbers.

Government Verifications & Anti-Fraud Uploads: Photographs of state-issued driver’s licenses, passports, or national identity documents, accompanied by real-time validation selfies.

Transaction & Financial Data: Partial payment tokens, billing details, and subscription histories. Raw credit/debit card numbers are routed directly through our PCI-DSS-compliant payment gateway Easy Pay and are never stored on Company web servers.

Intake & Questionnaire Records: Lifestyle habits, baseline vitals, dietary details, allergy disclosures, prior clinical interventions, and treatment preferences.

2.2. Automated Technical & Tracking Footprints.

Network & System Data: Internet Protocol (IP) addresses, ISP origins, routing hops, operating system builds, web browser configurations, screen resolutions, and language settings.

Cookies, Web Beacons & Pixel Tags: Session cookies (active until tab closure), persistent cookies (maintaining login sessions), and clear graphic beacons tracking marketing campaign interactions.

Device Fingerprinting: The Platform utilizes advanced hardware and browser-configuration profiling (“device fingerprinting”) to authenticate user integrity and prevent multi-account coupon abuse or prescription fraud. Clearing browser cookies does not prevent tracking via device fingerprinting.

3. BIOMETRIC INFORMATION & THIRD-PARTY VERIFICATION PROTOCOLS

3.1. No Direct Storage of Biometrics. The company does not generate, store, capture, or monetize raw biometric identifiers or facial geometry scans on its internal databases.

3.2. Third-Party Identity Authentication. To verify patient identities and curb prescription diversion, you may be required to submit a real-time photographic self-portrait alongside government identity cards. This validation is delegated directly to a certified third-party vendor (e.g., Persona, Trulioo, or equivalent). 

  • The external vendor processes biometric geometry scans purely to confirm match integrity.
  • Biometric data is retained or scrubbed in compliance with vendor retention schedules and local laws (e.g., Illinois BIPA, Texas CBOBA).
  • The vendor transmits to Company only non-biometric authentication scores, data-point match tokens, and extracted textual records.

4. PURPOSES OF PROCESSING & DATA UTILIZATION

  • We utilize gathered data to:
  • Establish and administer user profiles, authentication checks, and platform access;
  • Coordinate fulfillment logistics, pharmacy routing, compounding validation, and courier drop-offs;
  • Process subscription payments, analyze charge validity, and recover overdue liabilities;
  • Feed internal diagnostic analytics to identify technical bugs, UI friction, and behavioral bounce rates;
  • Deliver tailored marketing, special incentives, and transactional announcements (subject to your legal opt-in selections);
  • Detect and defend against chargeback schemes, identify fraud, bot strikes, and malicious platform intrusions;
  • Fulfill regulatory subpoenas, law enforcement inquiries, tax compliance duties, and civil document-production demands.

5. CIRCUMSTANCES FOR DISCLOSURE & DATA TRANSFERS

The company does not sell or rent personal information for direct cash compensation. We disclose information under strict operational parameters:

Independent Clinical Providers: Routing intake forms, health histories, and secure chat inquiries to independent telemedicine groups for clinical triage.

Fulfillment Pharmacies: Supplying shipping names, destination coordinates, and physician prescription orders to licensed distribution pharmacies.

Enterprise Service Providers: Cloud host providers, customer relationship platforms, email relay engines, automated billing gateways, and logistics couriers bound by confidentiality duties.

Corporate Restructuring: In the event of a merger, consolidation, enterprise acquisition, stock sale, or restructuring under corporate bankruptcy proceedings, all user databases and historical records may be transferred as an acquired commercial asset to a successor entity.

Statutory Compulsion: When mandated by grand jury subpoenas, search warrants, judicial decrees, or to protect the safety, physical welfare, and legal property of Company or third-party consumers.

6. DATA SECURITY PROTOCOLS & SYSTEM LIMITATIONS

6.1. Administrative & Technical Safeguards. We enforce industry-standard administrative protocols, TLS 1.3 cryptographic data transfers, internal firewall segmentations, and role-based database permissions to shield personal information.

6.2. Notice of Unencrypted Email. Standard transactional, account status, and promotional communications dispatched via email are unencrypted in transit across public nodes. You acknowledge the inherent risks associated with non-encrypted email interactions and assume liability for intercept risks.

6.3. No 100% Security Guarantee. NO DATA TRANSMISSION ACROSS THE INTERNET OR SYSTEM INFRASTRUCTURE CAN BE RENDERED TOTALLY IMPENETRABLE. We expressly disclaim all warranties and liability for unauthorized system penetration, hacker intrusion, corporate espionage, or technical leakage occurring despite our good-faith deployment of reasonable industry safeguards.

7. DATA RETENTION LIFECYCLE

The company preserves personal information for as long as deemed operationally necessary to service customer profiles, maintain historical financial ledgers, address potential tax audits, resolve civil claims, and assert our legal rights. Clinical notes and prescription documentation retained by independent Providers and Pharmacies are preserved according to mandatory medical board record retention schedules (typically ranging from five (5) to ten (10) years, or until legal thresholds are crossed).

8. STATUTORY JURISDICTIONAL RIGHTS (CCPA/CPRA, GDPR & REGIONAL FRAMEWORKS)

8.1. California Consumer Privacy Rights (CCPA/CPRA). If you are a resident of California, you possess statutory entitlements to:

  • Request disclosure of the categories and specific elements of personal information collected over the preceding 12-month period (limited to two verifiable requests per calendar year);
  • Request formal deletion of personal records held by Company (excluding records protected under healthcare retention mandates, security fraud exceptions, or ongoing contractual fulfillment exemptions);
  • Direct Company to refrain from the “sale” or “sharing” of personal data for cross-context behavioral marketing via global opt-out signals or written petition;
  • Receive equal service without retail discrimination for asserting statutory privacy rights.

8.2. Verification & Agent Demands. Petitions must be submitted to em@elitehealthnwellness.com with the subject line “Statutory Privacy Rights Request.” We will authenticate requests by correlating at least two distinct data points against our internal logs. Submissions executed by an authorized agent require signed authorization instruments or verified powers-of-attorney.

9. DO-NOT-TRACK (DNT) DISCLOSURES

Web browser configurations offer automated “Do-Not-Track” (DNT) signals. Due to the lack of industry-wide technical consensus regarding signal parsing, the Platform does not currently respond to automated browser DNT headers.

10. REVISIONS TO THIS PRIVACY POLICY

Company retains exclusive discretion to update, revise, or restructure this Comprehensive Privacy Policy at any juncture. Modifications take immediate legal effect upon posting to the Platform, denoted by the “Last Updated” metadata. Your continued use of the Platform subsequent to published revisions verifies your binding acceptance of the updated practices.

11. PRIVACY INQUIRIES & COMPLIANCE OFFICE

Submit privacy questions, data access requests, or regulatory queries to:  

Company: ELITE HEALTH AND WELLNESS CLINIC

Email:  EM@elitehealthnwellness.com

Telephone Support: 951-297-7830