Privacy Policy

1. Welcome

EZ Medica, LLC (“EZ Medica,” “we,” “us,” or “our”) operates EZColonPrep, a web-based colonoscopy preparation platform available at https://ezcolonprep.com and its related support resources, reminder sign-up pages, and notification services (collectively, the “Platform”). EZColonPrep provides personalized, video-guided colonoscopy preparation instructions for patients on behalf of participating gastroenterology practices.

This Privacy Policy describes how we collect, use, disclose, and protect personal information in connection with the Platform. By using the Platform, on any computer, mobile phone, tablet, or other device (collectively, a “Device”) or otherwise interacting with EZ Medica, you acknowledge that you have had an opportunity to review this Privacy Policy. This Privacy Policy is intended to describe our practices under applicable U.S. privacy laws, including HIPAA and, where applicable, state consumer privacy laws. If you do not agree with our practices, please do not use the Platform.

EZColonPrep is deployed by medical practices. Patients use the Platform because their physician’s practice has selected EZColonPrep as a patient-education tool. EZ Medica acts as a Business Associate under HIPAA and processes Protected Health Information (“PHI”) on behalf of practices pursuant to Business Associate Agreements (“BAAs”). This Privacy Policy describes EZ Medica’s privacy practices for the public website, the prep-guide interface, notification sign-up forms, reminder services, practice-facing pages, and analytics tools. It does not supersede any Business Associate Agreement, SaaS Agreement, or other written agreement between EZ Medica and its customer practices, which controls with respect to PHI processed on behalf of that practice.

2. Information We Collect

2.1 Information Provided Directly by Users

• Procedure and Prep Details. When patients visit the Platform to access their personalized prep guide, we collect selections such as the patient’s chosen physician, preferred language, procedure date and approximate time, bowel prep type, medication flags, and dose schedules. This information is entered directly by the patient via a form on the Platform. No username or account is required; a QR code or branded link brings the patient directly to their prep guide. We do not request the patient’s name, diagnosis, or a complete medication list, and we do not integrate with electronic health record (EHR) systems.
• Notification Sign-Up Information. If patients choose to receive timed prep reminders via SMS, we collect additional details such as the patient’s phone number, procedure date, selected physician, bowel prep type, and yes/no responses for various medications. Collectively, the phone number, procedure date, and doctor identifier constitute PHI. A consent log records whether the patient enrolled in reminders and any subsequent opt-out requests. Patients enroll in SMS reminders through a separate affirmative consent flow. SMS consent is not required to receive medical care or to use the Platform without SMS reminders.
• Practice-Specific Information and Branding. Practice managers may provide practice name, contact information, physician lists, branding preferences, and other details when requesting a demo, applying for a pilot practice via the practice-inquiry page, or if their practice becomes a client and subscriber to the Platform. Physicians and practices may submit photos, credentials, introduction videos, voice recordings, personal statements, and related materials for physician profiles and practice-specific Platform content. Where a physician or practice separately signs a likeness, media, or AI-content authorization, EZ Medica may use physician- or practice-provided photos, videos, voice recordings, and related materials to create AI-generated translated audio, avatar, dubbing, or other derivative versions of physician/practice educational videos. This content is derived from physician/practice materials and is not created from patient data or PHI.
• Communications and Support. When you contact us by email or complete support forms, we collect your email address or phone number, the content of your message, and any additional details you provide. The help page also allows patients to change contact details or opt out.
• Payment and Commercial Information. At present, the Platform is free for patients. Practices or other business customers that purchase or subscribe to the Platform may provide payment and commercial information, such as billing contact information, business name, billing address, subscription or purchase details, invoice history, tax information, and payment method information. Payments may be processed by our third-party payment processor, and we generally do not store full credit card numbers or complete payment account credentials. Our payment processor may collect and process payment card information, bank account information, billing details, transaction identifiers, authorization information, and related payment data as necessary to process payments, prevent fraud, comply with legal obligations, and provide payment-related services. Our payment processor may process payment information in accordance with its own privacy notice and terms where it acts as an independent controller, business, or service provider.

2.2 Automatically Collected Information

When you use our Platform, we may collect certain information automatically, which may include device and usage information such as:

• IP address
• Browser and device characteristics
• Operating system
• Language preferences
• Referring URLs
• Device type
• Page views, video playback events, time spent, and feature interactions

When you access our Platform through a mobile device, we may also collect certain mobile device information, including device type, mobile operating system, and mobile browser type.

2.3 Information from Customer Practices and Third Parties

EZ Medica acts as a Business Associate for our customer medical practices. We may receive limited information from practices, such as physician names, contact details, practice branding assets, physician profile materials, media files, media and likeness authorizations, procedure types, and patient counts, to configure the Platform and to confirm reminder enrollments. We may also collect aggregated statistics from analytics providers, video hosts, and database vendors. We do not integrate with patient EHRs or with insurance systems.

3. How We Use Your Information

We use the information we collect for the purposes described in this Privacy Policy, which may include to:

• Provide and Personalize the Platform. We use procedure details, medication flags, and prep type information to generate personalized prep guides with stage-by-stage videos, checklists, and reminders. We use practice contact details, images, and audio recordings to configure physician profiles, language options, and branding.
• Send Reminders and Communications. We use phone numbers to send automated SMS reminders at key intervals leading up to the procedure. Message frequency may vary based on the patient’s procedure date and reminder schedule but generally includes one opt-in confirmation message plus up to six scheduled reminder messages. The reminder sequence terminates automatically after the day-of-procedure message, unless the patient re-enrolls separately. Reminder messages contain generic prompts and links and do not include health-identifying information. We also process HELP or STOP requests, support emails, and other communications.
• Maintain Consent and Opt-Out Logs. We log when you consent to notifications and when you opt out; we process STOP requests within 24 hours and send a final confirmation.
• Operate, Analyze, and Improve the Platform. We use anonymized analytics to understand how users interact with the Platform and to improve usability, and to measure video performance by practice, doctor, and language.
• Comply with Legal and Contractual Obligations. We maintain documentation, including certain consent, opt-out, and compliance records, for the periods required by HIPAA, our agreements with customer practices, and other applicable legal obligations.
• Protect Rights and Prevent Misuse. We use information to detect and prevent fraud, abuse, or violations of our Terms of Use and to enforce our agreements.

We do not sell, rent, or share personal information for marketing; we do not use PHI for advertising purposes.

4. Purposes and Legal/Operational Bases for Use

We use personal information and PHI to provide the Platform, deliver personalized prep guides and reminders, fulfill our agreements with customer practices, maintain consent and opt-out records, operate and improve the Platform, protect against misuse, and comply with legal, regulatory, and contractual obligations. Where required, we obtain consent for certain communications, such as SMS or email reminders. We may also use aggregated or anonymized information to understand Platform usage and improve our services.

5. Disclosure and Sharing of Information

We do not sell or rent your personal information. We may disclose personal information in the following circumstances:

5.1 Customer Practices and Physicians

We may share or make available information with the applicable customer practice and its physicians as necessary to provide the Platform, confirm reminder enrollment, support patient preparation, comply with HIPAA and our Business Associate Agreements, and fulfill our agreements with customer practices. We do not sell patient information or use PHI for advertising purposes.

5.2 Service Providers

We may share personal information with service providers that help us operate the Platform, subject to BAAs or confidentiality agreements. These service providers are contractually required to use your information solely to provide services to us (and for no other purpose) and to comply with appropriate security measures.

5.3 Analytics Services

We use third-party web analytics services in our online services. These providers help us analyze how users navigate our Platform. Information collected through these analytic services is automatically sent to the analytics provider, which may use cookies or local storage to assist with the analysis.

5.4 Legal Requirements

We may disclose your personal data if required to do so by law (including responding to a subpoena or request from law enforcement, court, or government agency or other public authorities) or in the good faith belief that such action is necessary to (i) comply with a legal obligation, (ii) protect or defend our rights, interests, or property or that of other customers or users, (iii) act in urgent circumstances to protect the personal safety of users of the Platform or the public, or (iv) protect against legal liability or potential fraud, as determined in our sole discretion.

5.5 Business Transfers

In the event of a merger, restructuring, acquisition, or sale of assets, personal information may be transferred as part of that process, subject to continued protection consistent with this Privacy Policy.

5.6 With Your Consent

We may disclose your information for other purposes with your explicit consent. We do not share information with insurance companies or other healthcare providers beyond confirming enrollment. We do not sell or share personal information for cross-context behavioral advertising.

6. International Data Transfers

EZ Medica is based in Maryland, USA. All personal information and PHI collected through the Platform is stored and processed in the United States. If you access the Platform from outside the United States, your information will be transferred to and stored in the United States.

7. Data Retention

We retain personal data only as long as reasonably necessary to fulfill the purposes described in this Privacy Policy. Typical retention periods include:

• Notification PHI, including phone numbers, procedure dates, reminder preferences, and related reminder data, is retained as reasonably necessary to provide the Platform, maintain compliance records, comply with our Business Associate Agreements, and satisfy applicable legal obligations. Consent logs and opt-out records are retained for at least six years. Reminder links expire automatically at procedure date plus three days. Sent message logs may be retained for compliance and operational purposes and include stage, timestamp, and delivery status, but not message content.
• Practice and physician information: Duration of the customer relationship and a reasonable archival period thereafter.
• Customer support communications: Up to three years.
• Browser-local data: Remains on your device until you clear your browser storage.
• Analytics data: Aggregated or anonymized indefinitely.

Retention periods may be extended where required by law. If you request deletion of your notification data or withdraw your consent, we will delete your information from our reminder database, except where required by law (e.g., to maintain proof of consent or to meet regulatory obligations).

7.1 Notification and Compliance Records

We retain notification-related records, consent logs, opt-out logs, and related compliance documentation for the periods required by HIPAA, our agreements with customer practices, and other applicable legal obligations.

8. Your Privacy Rights

8.1 HIPAA Rights

As a patient of a covered practice, your physician remains responsible for satisfying HIPAA rights of access, amendment, and accounting of disclosures. You may contact your practice for HIPAA-related requests.

For PHI collected by EZ Medica through the reminder service, you may contact us at privacy@ezcolonprep.com. Depending on the nature of your request, we may respond directly where permitted or coordinate with the applicable physician practice, which remains responsible for handling HIPAA rights requests. You may also opt out of SMS or email reminders by replying STOP to any text message or by emailing privacy@ezcolonprep.com.

8.2 United States Privacy Rights

Depending on your state of residence and subject to certain exceptions, you may have rights under U.S. state privacy laws, including the privacy laws of California, Colorado, Connecticut, Maryland, Montana, Oregon, Texas, Utah, and Virginia. Although we may not currently be subject to all of these laws based on our level of activity, we describe below rights that may be available to residents of certain states. Because we handle protected health information (“PHI”) subject to HIPAA, some state consumer privacy rights may not apply to PHI.

We do not sell personal information or share personal information for cross-context behavioral advertising or targeted advertising. We may disclose personal information to service providers and other third parties for the business and operational purposes described in this Privacy Policy.

Subject to applicable law and verification of your request, you may have the right to:

• Access/Know. Request that we disclose the categories or specific pieces of personal information we have collected about you, the categories of sources from which we collected it, the purposes for collecting or disclosing it, and the categories of third parties to whom we disclose it.
• Delete. Request that we delete personal information we have collected from or about you, subject to legal exceptions.
• Correct. Request that we correct inaccurate personal information we maintain about you.
• Data Portability. Request a copy of certain personal information in a portable and readily usable format, where technically feasible.
• Opt Out of Sale or Targeted Advertising. Opt out of the sale of personal information or the use/sharing of personal information for targeted advertising or cross-context behavioral advertising. We do not sell personal information or share personal information for targeted advertising.
• Limit Certain Sensitive Information Uses. Request that we limit certain uses or disclosures of sensitive personal information where required by applicable law. We use sensitive personal information only for permitted purposes, including to provide the Platform, comply with law, maintain security, and support patient care and related services.
• Appeal. Appeal our decision if we deny your privacy request, where required by applicable law.
• Non-Discrimination. We will not discriminate against you for exercising your privacy rights.

8.3 California Residents

California residents may have the rights described above under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”). California residents may also designate an authorized agent to submit a request on their behalf. We may require proof that you authorized the agent to act on your behalf and may also require you to verify your identity directly with us.

8.4 Response Time and Verification

We will confirm receipt within 10 business days and respond within 45 days (extendable by 45 days with notice). We will verify your identity before fulfilling your requests by comparing the information you provide with the information we have on file. Where required, we may ask you to contact your physician’s practice for PHI requests.

8.5 Categories of Personal Information Collected (Last 12 Months)

8.6 No Sale or Sharing

We do not sell personal information. We have not sold personal information in the preceding 12 months. We do not share personal information for cross-context behavioral advertising purposes.

8.7 How to Exercise Your Rights

You can access, correct, or delete your personal data by contacting us as described below. We will consider all such requests and provide our responses as soon as we can. Please note, however, that personal information may be exempt from such requests in certain circumstances, which may include circumstances where we need to keep processing your personal information for our legitimate interests or to comply with legal obligations.

To exercise your rights:
Email: privacy@ezcolonprep.com
Subject Line: “Privacy Rights Request – [Type of Request]”
Include: Your name, the email address or phone number associated with your use of the Platform, a description of your request, and your jurisdiction of residence (if applicable).

9. Cookies and Tracking Technologies (Cookie Policy)

This section serves as both our Cookie Policy and the cookies disclosure within our Privacy Policy. It explains how EZ Medica uses cookies and similar technologies on the Platform. In some cases, the information we collect through cookies and local storage may be considered personal information.

9.1 What Are Cookies

Cookies are small text files transferred to your computer or mobile device whenever you visit a website or app. We use them to remember your preferences, enhance your user experience, and understand how people use our Platform so we can improve it. Cookies can be session cookies, which expire when you close your web browser. They can also be persistent cookies that remain on your device for a specified period or until you delete them.

EZColonPrep does not use tracking cookies for targeted advertising. The Platform relies on browser local storage and similar technologies to remember your preferences, doctor selections, language, and procedure details; this data stays on your device until you clear your browser data. Analytics providers may set analytics cookies or use local storage to collect usage statistics. We may also use session cookies or tokens to deliver videos or remember referral sources.

9.2 Managing Cookies

It is also possible to use our Platform without cookies. You can disable the storage of cookies in your browser, restrict them to certain websites, or configure your browser to notify you when a cookie is sent. You can also delete cookies from your device at any time. Please note that doing so may result in limited page display and reduced user guidance. To learn more about cookies, including how to see what cookies have been set and how to manage and delete them, visit allaboutcookies.org.

9.3 Do Not Track

“Do Not Track” is a feature enabled on some browsers that sends a signal requesting a web application to disable its tracking or cross-site user tracking. Currently, EZ Medica does not respond to or change its practices when a Do Not Track signal is received.

10. Security Measures

We maintain administrative, technical, and physical safeguards designed to protect the confidentiality, integrity, and availability of protected health information and other personal information we maintain. These safeguards may include access controls, encryption, secure authentication, workforce training, business associate/vendor oversight, incident-response procedures, and periodic review of our security practices. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the security of your own devices, credentials, and communications with us.

11. HIPAA Compliance and Business Associate Obligations

We maintain administrative, technical, and physical safeguards designed to support our HIPAA obligations, which may include risk analysis, BAAs with applicable vendors and practices, encryption, workforce privacy and security training, incident response and breach notification procedures, and documentation retention.

12. Children’s Privacy

The Platform is intended for adults undergoing colonoscopy preparation and is not designed for or meant to be used by children. We do not knowingly collect personal information from children under 13 without parental permission. If a parent or guardian learns that their child has provided us with information without their consent, they should contact us at privacy@ezcolonprep.com as soon as possible. We will delete such information from our records. We comply with the Children’s Online Privacy Protection Act (COPPA) and do not knowingly collect personal information from children under age 13.

13. Third-Party Links and Services

EZColonPrep may contain links to third-party websites, apps, and services, such as medical articles, practice websites, and service provider vendors. This Privacy Policy does not cover the activities of third parties when they collect or use data for their own purposes. We are not responsible for the privacy practices or content of third-party services. We recommend reviewing their privacy policies before sharing your information.

14. Data Breach Notification

If we become aware of a security incident involving personal information or protected health information, we will investigate the incident and take steps designed to contain, remediate, and mitigate any potential harm. Where required by applicable law, including HIPAA, and U.S. state breach notification laws, we will notify affected individuals, regulators, media outlets, or other parties within the timeframes and in the manner required by law.

15. Changes to This Privacy Policy

If EZ Medica makes material changes to its Privacy Policy, it will notify you by: (i) updating the Last Updated date at the top of the Privacy Policy, (ii) sending an email or notification to its users, and/or (iii) adding a notice to the Platform. Material changes include new categories of personal information collected, new purposes for processing, new categories of third parties with whom we share information, or substantial changes to your rights. Your continued use of the Platform after an updated Privacy Policy is posted will be subject to the updated Privacy Policy.

16. Contact Information

If you have any questions regarding privacy while using our Platform or about our practices, please contact us via the following:

For General Inquiries: privacy@ezcolonprep.com