This Privacy Policy explains how 1500 Park LLC, doing business as Bivvy Health ("Bivvy," "we," "us"), collects, uses, and shares information when you use our website and membership services. Bivvy provides access to telehealth care delivered by independent, licensed providers through DrCare247; it is not itself a medical provider and is not insurance.
Information we collect
Information you give us
- Account and profile: name, date of birth, sex, email, phone, and mailing address.
- Family members: the name, date of birth, and sex of dependents or family members you add to a plan.
- Payment: processed by Stripe. We do not store full card numbers; we retain limited billing metadata (e.g., last four digits, plan, status).
- Communications: messages you send us, such as contact-form submissions.
Information created through care
When you start a visit, clinical information is created and held by the treating provider and DrCare247. That information is governed by the notices and authorizations you receive from those providers and by our HIPAA Notice of Privacy Practices.
Information collected automatically
Basic technical and usage data (e.g., IP address, device and browser type, pages viewed) collected to operate and secure the service. [Confirm analytics/cookie vendors with counsel before launch.]
How we use information
- To create and manage your account and membership.
- To connect you and your family members to telehealth care through DrCare247.
- To process payments and prevent fraud.
- To communicate with you about your account, visits, and support requests.
- To secure, maintain, and improve the service, and to meet legal obligations.
How we share information
We do not sell your personal information, and we do not use your health information for advertising. We share information only as needed to run the service:
- DrCare247 and treating providers — to create your care record and deliver visits.
- Stripe — payment processing.
- Clerk — authentication and account management.
- SendGrid — transactional email (e.g., family invitations, support replies).
- Service providers under contract — including, where protected health information is involved, under HIPAA Business Associate Agreements.
- Legal and safety — when required by law or to protect people from harm.
How we protect information
Protected health information is encrypted in transit and at rest, with field-level encryption backed by managed keys (Google Cloud KMS). Access is limited and audited. No system is perfectly secure, but we work to protect your data and to meet our obligations under our Business Associate Agreements.
Data retention
We keep information for as long as your account is active and as needed to provide the service, then retain it as required by law and our record-keeping obligations. [Confirm specific retention periods with counsel.]
Children and family members
Accounts are for adults 18 and older. A subscriber may add minor family members and manages their information as the responsible adult. We do not knowingly collect information directly from children under 13 without the involvement of a parent or guardian.
Your choices and rights
You may review and update your profile in your account, and you can contact us to ask about the personal information we hold. Depending on where you live, you may have additional rights (for example, to access or delete certain data). [Confirm state-specific rights, e.g., CCPA/CPRA, with counsel.]
Changes to this policy
We may update this policy. If we make material changes, we will update the effective date and, where appropriate, notify you.
Contact us
Questions about this document can go to support@bivvyhealth.com or, for privacy matters, privacy@bivvyhealth.com.