Legal

Privacy Policy

Effective Date: March 1, 2026

Uplevel Bio ("we," "our," "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (uplevel.bio) and use our services.

Information We Collect

Information you provide directly:
  • Name, email address, phone number, and shipping address when you create an account or place an order
  • Date of birth and gender for medical intake purposes
  • Health history, current medications, allergies, and treatment goals submitted during the provider intake process
  • Payment information for order processing
  • Communications you send to our support team

Information from connected devices (optional):

If you choose to connect a wearable device or health account — such as an Oura Ring or WHOOP band — we collect the biometric and activity data you authorize us to access. Depending on the device and the permissions you grant, this may include sleep duration and quality, readiness or recovery scores, heart rate and heart rate variability (HRV), respiratory rate, blood oxygen (SpO2), body temperature trends, daily activity and strain, and workout records. We also store the access credentials (tokens) that let us retrieve this data on your behalf. Connecting a device is entirely optional and is never required to use our services. See the "Connected Devices & Wearable Data" section below for full details.

Information collected automatically:
  • Browser type, operating system, and device information
  • IP address and approximate geographic location
  • Pages visited, time spent on pages, and referring URLs
  • Cookies and similar tracking technologies (see Cookies section below)

How We Use Your Information

We use the information we collect to:

  • Facilitate provider consultations and prescription services
  • Process and fulfill your orders
  • Communicate with you about your orders, account, and treatment
  • Display your connected-device data back to you in your account and, with your consent, help you and your provider understand how you are responding to your protocol
  • Improve our website, services, and customer experience
  • Comply with legal and regulatory obligations
  • Send marketing communications (only with your consent; you can opt out anytime)

We do not use your connected-device data for advertising, and we do not sell it.

Medical Information & HIPAA

Uplevel Bio is a telehealth platform that connects patients with licensed providers. Your medical information — including health intake responses, prescriptions, and provider communications — is handled through our HIPAA-compliant patient portal powered by AsherMD.

AsherMD maintains HIPAA compliance for all protected health information (PHI). This means your medical information is encrypted in transit and at rest, access is restricted to authorized healthcare providers, and all handling follows federal HIPAA regulations.

Uplevel Bio does not sell, rent, or share your medical information for marketing purposes.

Connected Devices & Wearable Data

Uplevel Bio lets you optionally connect third-party wearable devices and health accounts — such as an Oura Ring or WHOOP band — so your biometric data can be shown alongside your protocol. This feature is opt-in: we only access your device data if you actively choose to connect it, and you can disconnect at any time.

How the connection works. We connect using the device provider's standard authorization process (OAuth). We never see or store your password for the device account. Instead, the provider issues us secure access tokens that allow us to retrieve only the categories of data you approve during the connection. We store these tokens encrypted and use them solely to sync your data. What we collect and why. We collect only the data categories you authorize — which may include sleep, readiness or recovery, HRV, resting heart rate, respiratory rate, blood oxygen, temperature trends, activity, strain, and workouts. We use this data to display your trends in your account and, where relevant and with your consent, to help you and your prescribing provider understand how you are responding to your protocol. Sensitive data. This biometric and health information is sensitive personal information. We treat it with the same care as other health data described in this policy: it is encrypted in transit and at rest, access is restricted to authorized personnel and your provider, and it is never sold, rented, or used for advertising. Sharing. We do not share your connected-device data with third parties except: with your prescribing provider as part of your care; with the service providers that host and operate our platform under contractual confidentiality obligations; or where required by law. We do not sell it. Your control and deletion. You can disconnect any device from your account at any time. Disconnecting revokes our access going forward and deletes the biometric data we stored from that device from our active systems, subject to any legal retention requirements. You can also request deletion by contacting privacy@uplevel.bio.

How We Share Your Information

We share your information only in the following circumstances:

Healthcare providers: Your health intake and medical information is shared with the licensed physician who reviews your case and writes your prescription. This is necessary to provide the medical services you've requested. Pharmacy partners: Your prescription and shipping information is shared with our 503A compounding pharmacy partners for medication fulfillment. Payment processors: Payment information is shared with our payment processing partners to complete transactions. We do not store full credit card numbers on our servers. Service providers: We work with third-party service providers for website hosting, analytics, email delivery, and customer support. These providers are contractually obligated to protect your information and use it only for the services they provide to us. Legal requirements: We may disclose information when required by law, court order, or governmental regulation, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

We do not sell your personal information to third parties.

Cookies & Tracking

We use cookies and similar technologies to:

  • Maintain your session and remember your preferences
  • Analyze website traffic and usage patterns (via Google Analytics and Vercel Analytics)
  • Improve website performance and user experience

You can control cookies through your browser settings. Disabling cookies may affect some website functionality.

Third-party analytics: We use Google Analytics 4 and Vercel Analytics to understand how visitors use our website. These services collect anonymous usage data and do not have access to your medical information.

Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. Medical records are retained in accordance with applicable state and federal healthcare record retention requirements. If you request account deletion, we will remove your personal information from our active systems, subject to legal retention requirements.

Your Rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal information we hold about you
  • Request correction of inaccurate information
  • Request deletion of your personal information
  • Opt out of marketing communications
  • Request a copy of your data in a portable format

To exercise any of these rights, contact us at privacy@uplevel.bio.

California residents: Under the CCPA/CPRA, you have additional rights regarding your personal information, including the right to know what information we collect and how it's used, and the right to request deletion. Biometric and health data from connected devices is "sensitive personal information," which we use only to provide the services you've requested and do not sell or share for cross-context behavioral advertising. We do not sell personal information as defined by the CCPA.

Data Security

We implement reasonable administrative, technical, and physical safeguards to protect your information. This includes encryption of data in transit (TLS/SSL), secure hosting infrastructure, and access controls. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

Children's Privacy

Uplevel Bio services are intended for adults 18 years of age and older. We do not knowingly collect personal information from individuals under 18. If we become aware that we have collected information from a minor, we will take steps to delete it promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. We encourage you to review this policy periodically. Continued use of our services after changes constitutes acceptance of the updated policy.

Contact

For privacy-related questions or requests:

Email: privacy@uplevel.bio Mail: Uplevel Bio, 9 Maple Street, Scituate, MA 02066

For medical information requests, use your AsherMD patient portal.