Optional public website analytics
With your permission, Plunge Care records public page visits and signup or support-link clicks in its own systems. These events include the public page path, recognized campaign tags, a mobile or desktop category, and a random browser-tab session identifier. This collector does not record form answers, account identifiers, full query strings, or raw referrers, and does not send these events to advertising platforms. Event records are retained for up to 90 days. Your analytics choice is remembered for up to 180 days. Use Analytics preferences on a participating public page to decline or withdraw; browser Global Privacy Control also disables this collection. Choices apply separately on each website origin.
1. Who We Are and Our Role
This policy describes how Plunge Care LLC ("Plunge Care," "we," "us") handles information on the Plunge Care platform, including our website at plungecare.com and our mobile applications for iOS and Android. Plunge Care is a technology platform. We are not a healthcare provider; care is delivered by independent licensed providers and their practices, each of which holds its own professional licensure and professional liability coverage.
Under HIPAA, the practice that treats you is the covered entity for your medical records. Plunge Care acts as a business associate, handling protected health information on that practice's behalf under a Business Associate Agreement, and only as needed to operate the platform. Your treating practice provides its own Notice of Privacy Practices, which governs how it uses your health information. See also our HIPAA Notice.
2. Information We Collect
Information you provide: name, email, phone, date of birth, address, gender, health history and intake responses, messages to your provider, emergency contact information, health insurance carrier and member ID, pharmacy preference, documents you upload, and identity information needed to deliver care.
Information collected automatically: device information, IP address, and audit logs of platform activity, which we maintain to meet HIPAA security requirements. In our mobile applications, if you enable notifications, we store a push notification token supplied by your device so we can deliver alerts.
Information from others: prescription status from our e-prescribing vendor, and lab order status from the laboratory you use.
We do not collect or store full payment card numbers. See Section 5.
What our mobile applications do not collect
Our iOS and Android applications contain no analytics software, no crash reporting software, no advertising software, and no attribution or cross-app tracking software of any kind. Specifically:
- We do not collect advertising identifiers and do not track you across other apps or websites.
- We do not request or collect your location.
- We do not access your camera roll, photo library, contacts, or calendar. When you upload a document, the app uses your operating system's file picker and receives only the file you select.
- Camera and microphone are used only during a live video visit, which you initiate.
3. How We Use Information
We use information to operate the platform on behalf of participating practices: to route your request to a provider licensed in your state, to enable consultations and secure messaging, to support electronic prescribing and lab ordering, to process payments, to send transactional notifications, to maintain security and audit records, to prevent fraud and abuse, and to comply with legal obligations.
We do not use your health information for advertising, we do not sell it, and we do not use it to train artificial intelligence models.
4. How We Share Information
We share information with the practice and provider treating you, and with the pharmacy or laboratory you select. We also share with service providers who help us operate the platform, each under a Business Associate Agreement or equivalent contractual protection, and only to the extent necessary:
- DoseSpot — certified electronic prescribing, routed via the Surescripts network
- Supabase — HIPAA-eligible database, authentication, and file storage
- Lovable — application hosting, and the connector gateway through which our transactional email and text messages are delivered
- Stripe — payment processing; no clinical information is included in payment records
- Daily.co — telehealth video infrastructure
- Twilio — transactional text message delivery, with health information excluded from message content
- Expo, Apple (APNs), and Google (FCM) — push notification delivery to mobile devices. These services receive your device push token and the notification text only
We may also disclose information when required by law. We do not sell your health information or share it with advertisers or data brokers. Optional measurement of visits to our public start page, described in Section 7, shares limited browser information with Meta only if you allow it. Any future service provider will be engaged only under equivalent protections.
Text messaging (SMS) and your mobile number
If you opt in to text messages from Plunge Care LLC, we use your mobile number only to send the messages you agreed to receive. We do not sell, rent, or share your personal information - including your mobile opt-in and SMS consent data - with third parties for advertising purposes. Your number and consent records are shared only with our text-message delivery vendor (Twilio) as needed to deliver the messages, and never for that vendor's own marketing. Message frequency varies and message and data rates may apply. Reply STOP to unsubscribe at any time or HELP for assistance.
5. Payments
Payments are processed by Stripe. Card details are submitted directly to Stripe and are not stored on our systems; we retain only transaction records such as amount, date, and status. Your treating practice is the merchant of record for care, and Plunge Care charges a separate flat platform fee. Clinical information is not transmitted to our payment processor.
6. Notifications, Text Messages, and Email
With your consent, we send transactional messages about your care requests, appointments, and prescriptions.
Push notifications do not contain clinical information. A notification tells you that something is waiting for you — for example, that you have a new message — and the content itself is visible only after you sign in to the app. Our transactional emails are similarly limited and do not include clinical detail.
For text messages: message and data rates may apply; reply STOP to opt out and HELP for assistance. Mobile opt-in consent and phone numbers are never sold, rented, or shared with third parties for marketing purposes. Opting out of texts does not affect your ability to use the platform.
You can disable push notifications at any time in your device settings.
7. Cookies, Analytics, and Tracking
On our website, we use cookies and similar technologies that are necessary to operate the site, keep you signed in, and maintain security. We do not place advertising or social media tracking pixels on pages where health information is entered or displayed, and we do not disclose health information to advertising platforms.
Our mobile applications use no analytics, tracking, or advertising technologies of any kind.
On our public start page only, you may choose to allow Meta Pixel and Conversions API to measure our advertising. If you allow this, Meta receives the public page view and time, a page address without query parameters, IP address, browser information, a random event identifier, and a Meta browser cookie identifier when available. Meta may associate this information with its users and use it for advertising and measurement. This information is not anonymous. We do not send signup information, contact details entered in forms, patient identifiers, clinical activity, payments or visit revenue through this integration.
Declining does not affect access to care. The integration remains off until you allow it, and a Global Privacy Control signal keeps it off. Your choice is saved in your browser for up to 180 days. Use “Ad measurement choices” on the public start page to withdraw consent and stop future measurement; this does not recall events already shared. See ad measurement details and Meta’s privacy policy.
8. Mobile Applications
This policy also covers the Plunge Care mobile applications for iOS and Android. The mobile apps collect the same categories of information as the web platform. In addition:
- Push notifications — with your permission, we store a device push token to deliver notifications about your care, such as new messages, prescriptions, lab results, and billing updates; notification content is kept minimal and you can disable notifications at any time in your device settings, which also removes the token when you sign out.
- No tracking — our mobile apps contain no advertising, analytics, or tracking software and do not use advertising identifiers.
- On-device security — your session on mobile devices is protected with hardware-backed encrypted storage.
9. Data Security
We use encryption at rest, TLS in transit, multi-factor authentication for all provider and administrative accounts, database row-level security so that patients see only their own records and providers see only their assigned patients, and continuous audit logging. Two-factor authentication is also available to patients in account settings. All access to protected health information is logged and monitored.
No system can be guaranteed completely secure, but we maintain administrative, physical, and technical safeguards designed to meet HIPAA Security Rule requirements.
10. Data Retention
Medical records are the records of your treating practice and are retained in accordance with applicable state medical record retention requirements and federal law. Audit records are retained to meet HIPAA requirements. Account and transaction records are retained as long as needed for the purposes described in this policy or as required by law. When retention periods expire, records are deleted through scheduled retention processes; backups age out on our infrastructure provider's rotation schedule.
11. Your Rights and Choices
You may request access to, correction of, or deletion of personal information we hold, and you may object to or restrict certain processing. Because your treating practice is the covered entity for your medical records, requests concerning those records are directed to that practice; we will assist and forward requests as needed.
Deleting your account. You can request account deletion directly in the mobile app under Settings, or by contacting us. You may request deletion of your account directly in the app or web platform (Settings → Delete account). Account deletion requests are completed within 30 days, subject to records we must retain under applicable medical-records laws, and you will receive email confirmation. Records subject to HIPAA or state medical record retention requirements are retained as required by law rather than deleted, and are restricted from ordinary use.
To make any other request, contact support@plungecare.com. We will verify your identity and respond within the time required by applicable law.
12. State Privacy Rights
Residents of states with comprehensive privacy laws, including Texas, California, and others, may have rights to know what personal data we process, to obtain a copy, to correct or delete it, and to appeal a denied request. Optional public-page advertising measurement described in Section 7 may constitute targeted advertising or sharing under applicable privacy laws. You may decline or withdraw permission through “Ad measurement choices” on the start page, or use Global Privacy Control to keep it off. We do not use health information for targeted advertising. To exercise these rights or appeal a decision, contact support@plungecare.com. Information protected by HIPAA is handled under HIPAA rather than these state laws.
13. Children's Privacy
The platform is intended for adults 18 and over. We do not knowingly collect personal information from children. If you believe a child has provided information to us, contact support@plungecare.com and we will delete it.
14. Breach Notification
If protected health information is breached, we notify the affected practice without unreasonable delay so that required notifications to individuals, the Department of Health and Human Services, and where applicable the media can be made within the timeframes set by the HIPAA Breach Notification Rule, along with any notice required by state law.
15. Changes to This Policy
We may update this policy from time to time. The "Last updated" date above reflects the most recent revision, and material changes will be communicated through the platform or by email.
16. Contact
Privacy questions: support@plungecare.com or 713-474-6994.
Plunge Care LLC
11242 Farm to Market 1960 Rd W #107
Houston, TX 77065
The platform is operated in and intended for use within the United States.