Privacy Policy

1. What information we collect

As a physician-directed medical practice, we collect information needed to provide care and operate our practice.

• Personal information: name, date of birth, contact details, mailing address, government-issued ID for identity and age verification, emergency contact, and referring physician information
• Health information (PHI): medical history, current health status and symptoms, lifestyle factors, laboratory and biomarker results, physician notes and treatment plans, relevant genetic information, and prescription/medication records
• Payment & billing: card details processed by our payment processor (tokens and transaction identifiers), purchase and subscription history, and refund records. Kesbury Health does not accept insurance but may record insurance details if voluntarily provided
• Device & usage data: device and browser information, pages visited and interactions, IP address and log data, cookies (Section 5), and general geographic location derived from IP to verify residency in a licensed state for telehealth compliance

2. How your data is used

We use the information we collect for specific, legitimate purposes related to your care and our operations:

• Medical service provision: eligibility screening, evaluation and telehealth consultations, maintaining medical records, developing treatment plans, transmitting prescriptions to licensed pharmacies, and monitoring outcomes
• Communication: scheduling and reminders, treatment and lab updates, support, education, and (with your consent) marketing
• AI-assisted communications: We use automated and AI-assisted systems to help respond to inbound inquiries across our messaging channels (such as SMS and social messaging). These systems process the content of your messages to generate responses. Clinical questions are escalated to Kesbury Health’s licensed clinical team, and AI-assisted messages provide general, administrative, and product information only and do not constitute medical advice. Your protected health information is not used to train third-party AI models
• Payment processing: recurring billing, invoicing, and fraud prevention
• Service improvement: de-identified, aggregate analytics and research to improve our services
• Legal compliance: meeting HIPAA and federal/state healthcare obligations, lawful government requests, and required record retention

3. SMS & text messaging

We collect your phone number through intake and eligibility forms, account registration, direct communication, scheduling, and opt-in/consent forms. Your phone number is never sold to third parties for marketing purposes.

SMS may include appointment reminders, treatment and shipping updates, service and billing notifications, health reminders, account-security codes, and (with separate opt-in) promotional messages (typically 0–4/month). Message and data rates may apply.

To opt out, reply STOP to any message (you’ll get one confirmation), or contact us at care@kesbury.com or (•••) •••-••••. Opting out of promotional SMS does not affect transactional messages tied to your active care. Consent to receive marketing text messages is optional and is not a condition of purchase. Messages about your evaluation, appointments, prescriptions, orders and account are part of providing our services.

4. Mobile information sharing

Your mobile number, SMS consent status and records, message content, and carrier information are protected and never shared for marketing. We share your number only with service providers solely to deliver our services, for example our SMS delivery platform (Twilio), backup notification delivery, the licensed pharmacy that fills your prescription (shipping notifications), scheduling platforms, and the patient portal.

All such providers must sign Business Associate Agreements when handling PHI, comply with HIPAA, use your information only for the services they provide to us, and delete or return it on termination. We will never sell, rent, or share your phone number with third-party marketers for their own campaigns.

5. Cookies & tracking technologies

Our website uses essential and functional cookies and browser storage to make the site work. We do not use Google Analytics, and we do not use advertising pixels such as the Meta or TikTok pixel. The one advertising tag on this website is the Google Ads conversion tag on our confirmation page only, described below under Google Ads measurement.

The evaluation uses Google reCAPTCHA Enterprise to block automated submissions; it loads on the evaluation page only and is subject to Google’s privacy policy and terms of service. Our typefaces are served by Google Fonts on every page, and the LegitScript certification seal is loaded from LegitScript on our marketing pages; each of those providers receives the technical request (your IP address and browser details) needed to serve the file, and nothing about you or your care. Our website host, Cloudflare, also runs Cloudflare Web Analytics on our pages, including the evaluation: a small script counts page views and measures how quickly pages load. It sets no cookie and stores no identifier in your browser; Cloudflare receives the technical request (your IP address and browser details), the address of the page and its load timing, and nothing you type into a form. No page sends your visit to Meta or TikTok. Apart from the confirmation-page measurement described below, no page sends anything to an advertising network. We do not use Google Analytics on any page. The one Google advertising tag runs on the confirmation page (kesbury.com/thank-you) only, for a visit that came from a Google ad: there Google’s advertising storage is allowed and identifier redaction is switched off, so the Google click identifier can be matched (see Google Ads measurement below). Protected health information is held in HIPAA-compliant systems under Business Associate Agreements and is never sent to an analytics or advertising provider.

You can manage or disable cookies through your browser settings. We honor browser Do Not Track signals where technically feasible. Disabling essential cookies may affect site and portal functionality.

Google Ads measurement, on one page only. If you arrive from a Google ad, the address of the page you land on carries a Google click identifier. Our site keeps that identifier in your browser only (local storage, used for up to 30 days) and sends it nowhere. If you later reach our confirmation page (kesbury.com/thank-you, the page shown after you finish your request and save a card), that page loads the Google Ads tag (with Google’s advertising storage allowed and identifier redaction off on that page only) and tells Google Ads that a visit from one of its ads reached our confirmation page, together with that click identifier; on that page the tag also sets Google’s own conversion cookie. Because that page is shown only after a request is finished, this tells Google that someone who clicked the ad finished our request steps. It sends the page address with nothing after it, the referring site’s name only, and no name, email address, phone number, evaluation answer, treatment, medication, condition, amount or physician decision. Google’s ad-personalization and ad-user-data signals are set to denied, enhanced conversions are off, and we do not use it to build audiences or to show you ads. If you did not arrive from a Google ad, the confirmation page sends nothing to Google Ads. It is not sent if your browser sends Global Privacy Control or Do Not Track, and any tracker-blocking extension or clearing this site’s data stops it. We do not report purchases, evaluation answers or treatment to any advertising platform.

Measuring the evaluation. Every step of the evaluation is counted by our own first-party counter, which receives a stage word and nothing about you: none of your evaluation answers, no treatment, and nothing that identifies you by name, email address or phone number. No Google Analytics or other third-party analytics tag runs on the evaluation or on any other page. The Google Ads tag runs on the confirmation page only (see Google Ads measurement above); no other page sends anything to Google Ads.

6. Data security & handling

We implement technical, administrative, and physical safeguards in accordance with the HIPAA Security Rule:

• Encryption: TLS 1.2+ in transit and AES-256 at rest; encrypted patient-portal messaging
• Access controls: multi-factor authentication, role-based least-privilege access, mandatory HIPAA training, and audit logging of record access
• Physical security: access-controlled facilities, SOC 2 Type II cloud infrastructure, and secure media disposal
• Retention: medical records kept a minimum of 6 years after the last encounter, or longer where the law requires, billing records 7 years (IRS), and encrypted backups 90 days before secure deletion

Breach response: in the event of a breach involving PHI, we investigate and contain within 24 hours of discovery, notify affected individuals within 60 days as required by HIPAA, report to HHS (and notify media if 500+ individuals are affected), and document our response and preventive measures.

7. Your privacy rights

You have rights regarding your information, and we honor them promptly:

• General rights: access, correction, deletion (subject to legal retention), opt-out of marketing, portability, restriction of processing, and withdrawal of consent
• HIPAA rights: access to and copies of your medical records, amendments, restrictions on certain uses/disclosures, confidential communications, an accounting of disclosures, and the right to file a complaint
• California (CCPA/CPRA) and similar state laws: rights to know, access, correct, delete (subject to legal retention), portability, and non-discrimination, plus the right to opt out of the “sale” or “sharing” of personal information and to limit the use of sensitive personal information. We do not sell your personal information for money, and we never sell or share the contents of your medical records or your phone number for third-party marketing. The only information this website sends to an advertising network is the Google Ads confirmation-page measurement described in Section 5, sent with ad personalization denied; we do not use it for targeted or cross-context behavioral advertising. We treat a Global Privacy Control signal as an opt-out of it, and you can also opt out by email. To exercise any of these rights, adjust your cookie settings, use the opt-out tools described in Section 5, or contact us at care@kesbury.com and we will honor your request. Protected health information that you provide inside your patient account is governed by HIPAA and our Notice of Privacy Practices.

To exercise your rights, email care@kesbury.com, call (•••) •••-••••, or write to RegenHairSolutions LLC dba Kesbury Health, 8051 N. Tamiami Trail, Suite E6, Sarasota, FL 34243. We acknowledge requests within 5 business days and provide a substantive response within 30 calendar days (with notice if an extension is needed). You may also file a complaint with HHS Office for Civil Rights, the California Attorney General, or the Florida Attorney General without retaliation.

8. Contact & policy updates

RegenHairSolutions LLC dba Kesbury Health
8051 N. Tamiami Trail, Suite E6, Sarasota, FL 34243
Email: care@kesbury.com · Phone: (•••) •••-••••
For privacy-specific requests, contact our Privacy Officer at care@kesbury.com (Subject: Privacy Officer).

We may update this Privacy Policy at any time. For material changes, we update the “Last updated” date, notify active patients via email or portal, and post a prominent notice on our website for at least 30 days. Continued use of our services after changes constitutes acceptance.