Privacy Policy

Last updated October 29, 2026

TabsRx is operated by Tabs Labs LLC ("TabsRx," "we," "us"). We run the tabsrx.co website, the TabsRx brand and its marketing. Medical visits are provided by independent licensed providers through OpenLoop Healthcare Partners, PC and its affiliated entities, and prescriptions are filled by state-licensed pharmacies (the pharmacy partners listed in our terms; together, "the clinical partners"), supported by OpenLoop Health. The clinical partners are the HIPAA covered entities for your medical record. Where we handle protected health information on their behalf, we do so as a HIPAA business associate under a signed business associate agreement. TabsRx is not a compounding pharmacy.

This policy covers what we do with your information. The clinical partners' Notice of Privacy Practices (OpenLoop Health), which you also receive when you start a visit, covers how they use your medical record. Our Consumer Health Data Privacy Notice covers rights under Washington, Nevada and similar state laws.

The public pages of this site collect one thing from you on purpose: the email address you give us when you join the waitlist, kept with the time, your IP address and browser type as the record of your consent. The rest of this policy describes how the service handles information when you start a visit, so you can read it before you do.

The short version

Your intake answers, your messages with your provider and your prescription history are protected health information. The parts we receive are stored in a HIPAA-secured environment and used only to support your care and the services the clinical partners ask us to provide. They are not sold, not given to advertising platforms, and not used for marketing unless you sign a separate HIPAA authorization.
Before you start a visit, and in our emails, we collect ordinary marketing information: whether you asked to hear from us, which emails you open, and survey answers you choose to share. We use that to decide what to send you, with your consent where the law requires it.
There is no Meta pixel, no TikTok pixel, no Google Ads tag and no session recorder on any page of this site. The public pages load no third-party script at all.
Nothing about your visits, prescriptions or patient status is ever sent into the Tabs chocolate store's email, text or advertising systems.

1. Who holds what

The clinical partners, through OpenLoop, hold your medical record: your intake answers, your provider's decisions and messages, your prescriptions, your payment card, your orders and your post-purchase support tickets. Your card is tokenized and we never see or store it. OpenLoop is the merchant of record, so the charge on your statement comes from it. Requests to access or correct your medical record go to the clinical partners; if you send one to us, we pass it on promptly.

We hold:

Marketing and consent records. Your email address and, if you give it, your name; your "Keep me posted" choice, with the wording you agreed to and when and where you agreed; your unsubscribe and suppression records; and which emails we sent you and whether you opened or clicked them.
Survey answers, if you take one of our surveys. Answers are linked to you by a private token rather than your email address and are used to improve the service in aggregate. They are used to personalize what we send you only if you check the box on the survey that says so.
Site information. Our hosting provider keeps standard server logs (IP address, browser and device type, the pages requested and when). If you arrive from a link that carries a referral or campaign code, the site keeps that code in your browser so a visit can be credited to the email, creator or campaign that brought you here. On the pages of the full service we use Google Analytics 4 configured without advertising features or personalization; it receives page identifiers and counts only, never answers, medication names or contact details. The public pages load no analytics.
Protected health information received as the clinical partners' business associate. Once you start a visit, a limited event feed: your email address, an internal reference, the event (such as a visit started, a visit submitted, an order shipped or a plan canceled), the time, and a coarse status. We use it to measure results and to stop sending you marketing when we should.
Record information the clinical partners may later instruct us to handle. If the clinical partners instruct us in writing to provide named services on their behalf (for example refill follow-ups, reminders about an unfinished visit, or passing on that your provider has a question), we may receive the additional record information those services need. We do not receive your intake answers or your provider's clinical notes, and any later receipt of record information is limited to what the written instruction and, for marketing, your signed authorization allow.

Protected health information lives only in our HIPAA-secured systems: a dedicated Amazon Web Services environment under a business associate agreement with AWS, and a Google Workspace account under a business associate agreement with Google. It is kept separately from marketing data, with access limited to the people and systems that need it for the service, and every access is logged.

2. How we use information

Protected health information. Only to provide the services the clinical partners have engaged us for, to measure and run the service, and to meet our legal obligations. We will use protected health information to market to you only if you sign a HIPAA authorization that says exactly what we would use, for what, and that you can revoke it at any time without affecting your care. Declining is never a condition of treatment or purchase. Today no such authorization exists and no marketing uses protected health information.

Marketing and site information (not protected health information):

To email you about TabsRx if you have opted in on this site, in one of our surveys, or through an invitation from Tabs. Every email has an unsubscribe link.
To personalize what we send you and what you see on our pages: the subject line, the opening lines, the order of content, the timing, and which offers or discounts you are eligible for. We may use automated systems, including machine learning models, to make these choices within rules we set: a weekly cap on marketing messages, a pause after a complaint or refund request, the same list price for everyone with only discounts differing, and no message that claims to know something about you that we did not get from you. These choices have no legal or similarly significant effect on you.
Survey answers are used for personalization only when you check the box "Use my answers to tailor what Tabs sends me" on the survey. Otherwise they are used only in aggregate.
To measure results against a control group that we hold out from personalization, to see whether it works.
To attribute visits and orders to the email, creator or campaign that brought you here.
To run and secure the site.

Information from Tabs and from data partners. If you are a Tabs chocolate customer, Tabs may use the information it holds about you, including demographic and household categories obtained from data partners as described in the Tabs privacy policy, to decide whether and when to invite you to TabsRx and which offer to show you. That information is used only to choose and schedule offers. It is not health information. We do not use it to infer a health condition about you, do not show it to you, do not combine it with protected health information, and do not use it to obtain email addresses or add anyone to a list. We never send TabsRx patient or lead information to a data partner or to Tabs.

3. What we never do

We never sell protected health information or consumer health data.
We never send protected health information, consumer health data, or the fact that you visited this site, to any advertising platform. There is no Meta pixel, TikTok pixel, Google Ads tag, Snap tag or session recorder on any page of this site, and we never upload lists of patients, leads or people who engaged with TabsRx emails to an advertising platform.
We never put anything about your visits, prescriptions, orders or patient status into the Tabs chocolate store's systems. Tabs may invite you here. Nothing about your TabsRx activity goes back to Tabs.
We never use protected health information for marketing without your signed HIPAA authorization.
We never buy health, sexual health, ethnicity, religion or political information about anyone.

4. How we share information

The clinical partners and OpenLoop: your contact details, your consent records and, when you start a visit, the information you enter, so that your visit, prescription, payment and support can be provided. OpenLoop's privacy policy applies to its systems.
Service providers under contract, which may use your information only to provide their service to us: Amazon Web Services (hosting and email delivery), Mailgun (email delivery), Google (Workspace for support email, and analytics on the full service), and Netlify (website hosting, which keeps standard server logs). Providers that touch protected health information sign business associate agreements with us.
Our other brand, Tabs: nothing about your TabsRx activity. Tabs may send you TabsRx invitations from a tabs.co address; your response is recorded in TabsRx systems only.
Legal: to comply with the law, respond to lawful requests, or protect rights and safety.
Business transfers: if TabsRx or Tabs Labs LLC is sold, merged or reorganized, your information may be transferred to the new owner, bound by this policy and, for protected health information, by HIPAA.

We do not sell personal information and do not share it for cross-context behavioral advertising, so there is no sale or sharing to opt out of today. We treat a Global Privacy Control signal from your browser as a request to opt out of sale and sharing, and because we do neither, nothing changes for you. If we ever start, we will add an opt-out link to this site before we do and honor that signal and any preference you have sent to privacy@tabsrx.co.

5. Your choices

Marketing email: unsubscribe with the link in any email, or email support@tabsrx.co. Unsubscribing does not affect your care or messages from your provider.
"Keep me posted": optional, unchecked by default, and separate from any consent you give your provider. Withdraw it at any time by unsubscribing.
Personalization: withdraw survey-based personalization by emailing privacy@tabsrx.co; we stop using your answers and delete them from the personalization system.
HIPAA authorization: if you ever sign one, you can revoke it in writing at any time, and we stop the uses it allowed from that point. Read the marketing authorization.

6. Your rights

For your medical record (HIPAA): access, a copy, correction, an accounting of certain disclosures, restrictions and complaints, exercised with the clinical partners under their Notice of Privacy Practices. We route any request we receive to them promptly.

For the information we hold on our own behalf, depending on your state: access, correction, deletion, portability, opt-out of targeted advertising, sale, sharing and profiling with significant effects, the right to limit sensitive personal information, non-discrimination, and appeal. Email privacy@tabsrx.co. We verify a request by matching the details you give us with those we hold, accept authorized agents with proof of authority, respond within 45 days, and answer appeals within 45 days. Deletion of protected health information follows the retention periods the clinical partners must observe and our business associate agreement, so some records cannot be deleted on request; we will tell you which.

Washington, Nevada and other consumer health data laws: see the Consumer Health Data Privacy Notice for the categories we collect, the consent we ask for, and the additional rights (withdrawal of consent, a list of third parties, deletion).

7. How long we keep information

Email engagement and site events: for the life of our relationship with you plus 24 months, then only in aggregate without identifiers.
Decision records (what we sent you and why): six years, as the audit record of a marketing use.
Protected health information we receive as a business associate: for as long as the service it supports needs it plus 24 months, and returned or destroyed within 20 days if our agreement with OpenLoop ends.
Consent, authorization and opt-out records: six years after they are withdrawn or expire.
Survey answers: until you withdraw personalization consent or ask for deletion. The aggregate research export has no identifiers.

8. Security

Protected health information is stored only in HIPAA-eligible services inside a dedicated AWS account, encrypted at rest and in transit, with access limited by role, every access logged, encrypted backups, and an incident process that notifies the clinical partners within the time our agreement requires. Marketing systems live under the same controls. No site is perfectly secure, and we cannot guarantee it.

9. Children

TabsRx is for adults. We do not knowingly collect information from anyone under 18, and we delete it if we learn we have.

10. Contact and changes

Tabs Labs LLC, 18117 Biscayne Blvd #3022, Miami, FL 33160, United States. Privacy questions and requests: privacy@tabsrx.co. Care, orders and support: support@tabsrx.co.

We may update this policy. The date at the top shows the current version. If we materially change how we use information already collected, we will tell you by email or a notice on the site before the change takes effect, and where the law requires it we will ask for your consent. For protected health information, no change to this policy can expand its use beyond what HIPAA and our agreement with the clinical partners allow.