Privacy Policy

When you become a member, register for services, or interact with Forged Wellness & Co., we may collect:

• Full name, email address, phone number, and mailing address
• Date of birth, gender, and government-issued ID when required for clinical services
• Payment and billing information
• Emergency contact details
• Membership preferences and account credentials
• Electronic signatures captured on consent forms, waivers, and the Membership Agreement

As a clinical longevity and hormone health practice, we collect health-related information including:

• Medical history, family health history, current medications, allergies, and contraindications
• Laboratory results and biomarker data
• Body composition and biometric measurements (including 3D body scan data)
• Vitals and physical performance data
• Treatment records from clinical, wellness, and lifestyle services
• Prescriptions, protocols, clinical notes, injection/infusion logs, and dosing history
• Treatment-specific consents, clinical imaging authorized for charting, and before/after images where separately consented
• Incident and adverse event reports generated during your care

Clinical and membership records are maintained in industry-standard, HIPAA-aligned platforms under Business Associate Agreements where applicable. These include:

• Cerbo EHR — electronic health records, clinical notes, prescriptions, and charting
• Heads Up Health — health data aggregation and patient wellness tracking
• Open Practice Solutions — practice operations and administrative management
• Bluefin — payment processing (PCI-compliant; cardholder data is not stored by Forged)

We may collect and retain records of your communications with Forged Wellness & Co., including:

• Email, SMS, and portal messages exchanged with staff or your clinician
• Telehealth encounter recordings or summaries, where separately consented
• Voicemails and call logs to our main line

We automatically collect certain information when you visit our website or use our digital services:

• IP address, browser type, and operating system
• Pages visited, time spent, and referral sources
• Device identifiers and interaction data

We use the information we collect for the following purposes:

• Service delivery: To provide clinical longevity medicine, hormone & weight health services, and related wellness programs
• Personalization: To create and maintain your individualized health protocols, care plans, and lab monitoring schedules
• Communication: To send membership updates, appointment reminders, health insights, and service-related notifications
• Analytics & improvement: To understand how members use our services, improve our offerings, and develop new programs
• Safety & compliance: To maintain clinical records as required by law, ensure patient safety, and comply with healthcare regulations
• Marketing: To send promotional materials, with your consent, about Forged Wellness & Co. services, events, and offers (you may opt out at any time)

Forged Wellness & Co. provides clinical services through licensed healthcare practitioners operating under Montana full practice authority. Certain health information we collect qualifies as Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA).

PHI is handled in accordance with HIPAA regulations and our separate Notice of Privacy Practices, which is provided to all members at enrollment. Key protections include:

• PHI is stored in HIPAA-compliant, encrypted systems
• Access to PHI is restricted to authorized healthcare personnel on a need-to-know basis
• We maintain Business Associate Agreements (BAAs) with all third-party vendors who handle PHI
• PHI is only disclosed as permitted or required by law, for treatment purposes, or with your written authorization
• You have the right to request an accounting of PHI disclosures

As permitted by HIPAA for Treatment, Payment, and Health Care Operations (TPO), PHI may be disclosed to:

• Treating clinicians, supervising physicians, and credentialed staff within Forged Wellness & Co.
• Licensed 503A and 503B compounding pharmacies that prepare or dispense your protocols — limited to the prescription, demographics, allergies, and clinical data necessary to compound and dispense safely
• Reference laboratories and diagnostic partners for specialized testing
• Emergency medical services, hospitals, and on-call providers in the event of an adverse event or medical emergency
• Legal counsel, professional liability carriers, and supervising physicians in connection with adverse event review, incident reporting, or regulatory compliance
• Regulatory agencies (FDA, DEA, state licensing boards) where reporting is required by law

In the event HIPAA regulations and this Privacy Policy conflict, HIPAA regulations and our Notice of Privacy Practices shall prevail with respect to PHI.

We do not sell your personal information. We may share your information with the following categories of third parties:

Where your clinician prescribes a compounded product, we share the minimum necessary information — prescription, demographics, allergies, weight where relevant to dosing, and clinical context — with the licensed compounding pharmacy responsible for preparing and dispensing your protocol. These pharmacies are independently licensed and are engaged under a Business Associate Agreement or equivalent confidentiality arrangement.

We work with trusted technology providers to operate our practice. Providers that store or process your personal information or PHI do so under a Business Associate Agreement or equivalent security commitment, and are permitted to use your information only to provide services to us. Our principal sub-processors include:

• Cerbo EHR — electronic health record storage and clinical workflow management
• Heads Up Health — patient health data aggregation, wearable integration, and wellness tracking
• Open Practice Solutions — practice operations and administrative workflow
• Bluefin — PCI-DSS-compliant payment processing; card data does not pass through or reside with Forged
• Website hosting and analytics providers for our public-facing digital presence
• Email and SMS delivery platforms for appointment and clinical communications

This list may change as our technology evolves; we will update it to keep it accurate. To request the current list of sub-processors, contact us using the information in Section 13.

In the event of an adverse event, incident, or near-miss related to a service received at Forged Wellness & Co., PHI may be disclosed to the treating clinician and supervising physician, the compounding pharmacy or product manufacturer where relevant, emergency medical services and hospitals in the case of an acute emergency, our legal counsel and professional liability carrier, and applicable regulatory bodies where reporting is required or authorized by law.

We may disclose information when required by law, regulation, legal process, or governmental request, or to protect the rights, safety, or property of Forged Wellness & Co., our members, or the public.

We implement administrative, technical, and physical safeguards designed to protect your information, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Role-based access controls and multi-factor authentication for staff systems
• Regular security reviews and vulnerability assessments
• HIPAA-compliant infrastructure for all medical and clinical data
• Employee training on data privacy and security procedures
• Secure disposal of physical and electronic records

While we strive to protect your information, no method of transmission or storage is 100% secure. If you have reason to believe your interaction with us is no longer secure, please contact us immediately.

We use cookies and similar technologies on our public website for essential functions (such as session management) and for analytics to understand aggregated, anonymized usage.

• Essential cookies — required for sign-in, session management, and security; these cannot be disabled
• Analytics cookies — used on our public website to understand aggregated usage patterns
• Marketing & lead capture — via forms and communications you choose to engage with

Most browsers allow you to control cookies through their settings; disabling some cookies may limit website functionality.

Certain consultations and follow-ups may be conducted via synchronous telehealth (video or phone). By participating in a telehealth encounter with Forged Wellness & Co., you acknowledge the following:

• Telehealth services are provided only in states where the treating clinician holds an active, unrestricted license
• We use HIPAA-aligned video platforms with encryption in transit; however, no electronic communication is 100% secure
• Telehealth visits are documented in your medical record; any audio or video recording of a visit will occur only with your separately-obtained consent and will be stored as part of your PHI
• Clinical photography captured to document treatment response is maintained in your chart and is not used for marketing without a separate, written photo-release

By providing your mobile phone number to Forged Wellness & Co. — whether at enrollment, during booking, or in your member profile — you expressly consent to receive calls and text messages related to your care, your membership, and, where you separately opt in, marketing communications. This is done in compliance with the Telephone Consumer Protection Act (TCPA).

• Message types: appointment reminders, schedule changes, clinical follow-up, billing notices, and (with opt-in) promotional messages about Forged Wellness & Co. services and events
• Frequency: message frequency varies based on your activity and enrollment
• Cost: standard message and data rates may apply per your wireless carrier
• Opt-out: you may reply STOP to any marketing SMS to unsubscribe, or HELP for assistance. Opting out of marketing SMS does not stop essential treatment, billing, or safety messages related to active care
• Carriers: wireless carriers are not liable for delayed or undelivered messages

We retain personal information and PHI only as long as necessary to fulfill the purposes described in this policy, to comply with our legal and regulatory obligations, and to support the ongoing clinical relationship. General retention periods include:

• Adult medical records: retained for a minimum of seven (7) years after the last date of service, or longer where required by Montana law or applicable federal regulation
• Minor medical records (where applicable): retained until the patient reaches the age of majority plus the applicable statutory period
• Adverse event and incident reports: retained for a minimum of ten (10) years and consistent with our liability-carrier requirements
• Signed consents, waivers, and membership agreements: retained for the duration of membership plus the applicable statute-of-limitations period
• Billing and financial records: retained in accordance with applicable tax and accounting rules (typically seven years)
• Marketing and website analytics data: retained in aggregated or anonymized form for as long as necessary for business analysis; identifiable marketing data is deleted upon opt-out request

Upon expiration of the applicable retention period, records are securely destroyed in a manner designed to prevent re-identification.

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information, subject to legal retention requirements
• Opt-out: Unsubscribe from marketing communications at any time
• Data portability: Request your data in a commonly used, machine-readable format
• Restrict processing: Request that we limit how we use your data in certain circumstances

For PHI-related requests, additional rights may apply under HIPAA, including the right to request amendments, obtain an accounting of disclosures, and request restrictions on certain uses. Please refer to our Notice of Privacy Practices or contact our Privacy Officer.

To exercise any of these rights, please contact us at the information listed in Section 13. We handle these requests on an individual basis and will respond within 30 days. Deletion requests are subject to the medical-record retention requirements described in Section 9.

Forged Wellness & Co. does not knowingly provide services to individuals under the age of 18, nor do we knowingly collect personal information from children. If you believe we have inadvertently collected information from a minor, please contact us immediately and we will promptly delete such information.

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. When we make material changes, we will notify members via email and update the “Last updated” date at the top of this page. We encourage you to review this policy periodically.

If you have questions or concerns about this Privacy Policy or our data practices, please contact us: