Privacy Policy

1. Who We Are

Thrivewell Kids is a California telehealth-only pediatric specialty practice operated by Rebecca Winderman, MD, a board-certified Pediatric Gastroenterologist. The Practice provides virtual weight management and GI care to patients ages 12 through 21 who are California residents.

The legal entity responsible for this Site and for the processing of personal information described in this Policy is:

2. Information We Collect

A. Information Collected Automatically

When you visit the Site, certain information is collected automatically through cookies and similar technologies, as described in our Cookie Policy and Tracking Disclosure. This may include:

• IP address
• Browser type, version, and language
• Device identifiers and operating system
• Referring URLs and search terms
• Pages visited, time spent on pages, and clickstream data
• Date and time of visits
• General geographic location inferred from IP address
• Preference and consent settings

B. Information You Provide Voluntarily

If you submit a contact form, request information, or otherwise communicate with us through the Site, we may collect:

• Name
• Email address
• Phone number
• The content of your message or inquiry

C. Information We Do NOT Collect Through the Site

The public Site is not intended to collect protected health information, medical records, diagnoses, prescriptions, insurance details, or other sensitive clinical information. Users should not submit such information through website contact forms or other non-secure channels. If sensitive health information is submitted through the Site, the Practice will not process it through the Site and will redirect the user to a secure channel.

All clinical data is collected exclusively through the Practice’s HIPAA- and CMIA-compliant electronic health record system (Healthie) and related secure workflows.

3. How We Use Your Information

We use information collected through the Site for the following purposes:

• Operating and maintaining the Site. Ensuring the Site functions properly, remains secure, and performs effectively.
• Responding to inquiries. Replying to messages submitted through the Site’s general contact form.
• Analytics and improvement. Understanding how visitors interact with the Site and improving content, functionality, and performance.
• Legal compliance. Complying with applicable federal, state, and local laws, regulations, and legal processes.
• Security. Detecting, preventing, and addressing fraud, abuse, or technical issues.

We do not use information collected through the Site to provide medical diagnosis, treatment, or clinical recommendations.

4. How We Share Your Information

We do not sell or share your personal information for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (Cal. Civ. Code §1798.100 et seq.) (“CCPA/CPRA”).

We may disclose personal information collected through the Site in the following limited circumstances:

• Service providers. We may share information with vendors that perform services on our behalf (e.g., website hosting, analytics, security), subject to contractual obligations to protect your information and use it only for the purposes we specify.
• Legal obligations. We may disclose information when required by law, subpoena, court order, or governmental request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business transfers. In the event of a merger, acquisition, reorganization, or sale of assets, personal information may be transferred as part of that transaction, subject to applicable law.

5. Healthcare-Specific Tracking Disclosure

Consistent with the U.S. Department of Health and Human Services, Office for Civil Rights (HHS OCR) guidance on the use of online tracking technologies by HIPAA-covered entities (December 2022), Thrivewell Kids commits to the following:

• The Site does not transmit individually identifiable health information to third-party advertising platforms.
• If analytics tools (such as Google Analytics in standard configuration) are deployed on the Site, they are configured to anonymize IP addresses and are limited to aggregate, non-identifiable site-performance metrics.
• Any tracking technology deployed on the Site is disclosed in the Cookie Policy and Tracking Disclosure and is subject to the cookie-preference controls described therein.

6. No Unsolicited Communications (TCPA Compliance)

The Practice does not use information collected through the Site to send unsolicited SMS messages, place autodialed calls, or deliver marketing communications without express written consent.

By submitting a contact request through the Site, you consent to receive a response for the limited purpose of addressing your inquiry. That consent does not authorize marketing messages, autodialed calls, or other communications beyond what applicable law permits.

7. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (Cal. Civ. Code §1798.100 et seq.):

• Right to Know. You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the business or commercial purpose for collecting it, and the categories of third parties with whom we have shared it.
• Right to Delete. You may request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to Correct. You may request that we correct inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale or Sharing. You have the right to opt out of the sale or sharing of your personal information for cross-context behavioral advertising. As stated in Section 4, Thrivewell Kids does not engage in sale or sharing of personal information.
• Right to Limit Use of Sensitive Personal Information. You may direct us to limit the use and disclosure of sensitive personal information to purposes permitted under the CCPA/CPRA.
• Right to Non-Discrimination. We will not discriminate against you for exercising any of your CCPA/CPRA rights.

How to Exercise Your Rights

To submit a request, contact us at: rebeccawinderman@kidsgastrodoc.com. We will verify your identity before processing your request. We will confirm receipt of your request within 10 days and respond to verifiable consumer requests within 45 days, as required by law, with a possible extension of an additional 45 days if reasonably necessary.

Global Privacy Control (GPC)

Thrivewell Kids honors browser-based opt-out preference signals, including Global Privacy Control (GPC), as required by the CCPA/CPRA regulations (Cal. Civ. Code §1798.135). If your browser transmits a GPC signal, we will treat it as a valid opt-out request for any tracking technologies that would otherwise constitute a “sale” or “sharing” of personal information.

8. Categories of Personal Information Collected (CCPA Disclosure Table)

The following table summarizes the categories of personal information we may collect through the Site, the purposes for collection, and whether each category is sold or shared:

We do not collect Social Security numbers, financial account information, biometric information, or protected characteristics through the public Site.

9. Children’s Privacy

The Site is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13 through the public Site. If we become aware that a child under 13 has provided personal information through the Site, we will take steps to delete such information promptly.

The Practice’s clinical services are available to patients ages 12 through 21 who meet eligibility criteria. For patients ages 12 and older, all clinical data — including any information collected from or about adolescents — is collected through the HIPAA- and CMIA-compliant Healthie platform during the clinical intake and enrollment process, not through the public Site. That information is governed by the Notice of Privacy Practices and applicable consent forms, including the Adolescent Assent (Form M-6).

Parents and legal guardians with questions about minor privacy rights should review the Notice of Privacy Practices (Form M-3) and may contact the Practice directly.

10. Data Security

We implement reasonable administrative, technical, and physical safeguards designed to protect personal information collected through the Site from unauthorized access, use, alteration, or destruction. These measures include encrypted connections (HTTPS/TLS), access controls, and regular security practices.

However, no method of electronic transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

11. Data Retention

We retain personal information collected through the Site only as long as reasonably necessary to fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Retention periods vary based on the type of information and the purpose for which it was collected.

Information submitted through contact forms is retained only for the period necessary to respond to your inquiry and maintain records for legal compliance purposes. Automatically collected data (cookies, analytics) is subject to the retention periods described in our Cookie Policy and Tracking Disclosure.

12. Third-Party Links

The Site may contain links to third-party websites, including pharmacy resources, manufacturer savings-program pages, social media platforms, or other external resources.

Thrivewell Kids does not control and is not responsible for the content, privacy practices, or security of any third-party site. This Policy does not apply to information collected by third parties through their own sites or services. We encourage you to review the privacy policies of any third-party site you visit.

13. Do Not Track Signals

Some browsers transmit “Do Not Track” (DNT) signals. There is currently no uniform standard for how websites should respond to DNT signals. In addition to DNT, Thrivewell Kids honors Global Privacy Control (GPC) signals as described in Section 7 above.

14. Updates to This Privacy Policy

Thrivewell Kids may update this Policy from time to time to reflect changes in law, technology, business practices, or Site functionality. Any material changes will be posted on this page with an updated “Last Updated” date. We encourage you to review this Policy periodically.

Your continued use of the Site after a revised Policy is posted constitutes your acceptance of the changes. If a change materially affects previously collected information, we will make reasonable efforts to provide notice (such as a prominent disclosure on the Site).

15. Accessibility

Thrivewell Kids is committed to making this Policy and the Site accessible to all users, including individuals with disabilities. If you have difficulty accessing this Policy or any portion of the Site, please contact us and we will work to provide the information in an alternative format.

16. Contact Information

If you have questions about this Privacy Policy, wish to exercise your California privacy rights, or have concerns about how your information is handled, please contact us:

Minor Privacy Law:

A Note About Your Teenager’s Privacy Rights Under California Law

California law gives adolescents ages 12 and older independent privacy rights in certain areas of healthcare — even when a parent or guardian has consented to the overall program. This means:

• Mental health. Under California Family Code §6924, minors age 12 and older may consent to their own outpatient mental-health treatment. If your teenager independently accesses mental-health services (whether through ThriveWell Kids’ screening process or through an outside provider), information related to those services may be confidential between your teenager and their provider — unless your teenager agrees to share it with you, or unless a safety concern requires disclosure.
• Reproductive health and contraception. Under California Family Code §6925, minors may consent independently to pregnancy-related care, contraception, and related services. Because GLP-1 medications interact with oral contraceptives and are contraindicated during pregnancy, reproductive health may be discussed as part of your teenager’s care. Information about those conversations may be kept confidential at your teenager’s request.
• Sexually transmitted infections. Under California Family Code §6926, minors age 12 and older may consent to STI diagnosis and treatment without parental involvement. Any related information is confidential unless the minor consents to disclosure.

What this means in practice:

For general weight-management care — including GLP-1 medication management, nutrition counseling, lab results, visit summaries, and progress tracking — parents and guardians are fully involved and informed. This is the core of the ThriveWell Kids program, and parental participation is required for patients under 18.

However, if your teenager independently accesses or discusses sensitive services in the categories above, California law may limit what Dr. Winderman can share with you about those specific topics — even though you consented to the overall program. This is not a ThriveWell Kids policy; it is California law.

If you have questions about what is and isn’t shared, Dr. Winderman will discuss your family’s specific situation during the intake process. The goal is transparency within the boundaries of California law — not secrecy.