Privacy Policy

1. Scope

This Privacy Policy explains how Connective Group LLC, an Oklahoma limited liability company doing business as Protocol Therapeutics ("we," "us," or "our"), collects, uses, discloses, and retains personal information through physician-branded storefronts, Shopify checkout and customer accounts, physician and representative dashboards, wholesale ordering, support channels, and related websites and services (the "Services").

This Policy does not govern a participating physician's separate clinical practice, medical records, or independent privacy practices. It also does not replace a just-in-time notice or separate consent required for a particular activity.

2. Ecommerce and Clinical-Information Boundary

The Services are designed for ecommerce, product-selection links, and business reporting—not clinical care. We collect customer contact and transaction information, but we do not ask customers or platform users to submit symptoms, diagnoses, medications, laboratory results, treatment notes, clinical records, or other medical information. Do not submit clinical information through storefront, dashboard, review, upload, or general support fields.

Customer contact information does not become medical information merely because a customer was referred by a physician. Product, order, subscription, and referral information may nevertheless reveal or permit inferences about health or wellness interests, so we limit access as described below. Whether information is protected health information under HIPAA depends on the context, the parties’ roles, and applicable law; users must not submit clinical information through the Services.

This Policy must be updated before we introduce any electronic health-record integration, clinical-data feature, or workflow designed to receive protected health information.

3. Personal Information We Collect

Information from customers

Identifiers and contact information, such as name, email, telephone number, shipping and billing address, account identifier, and referring-storefront association; transaction information, such as products, quantity, price, discounts, subscription elections, order and return history, fulfillment status, and support history; payment-related information handled by Shopify or payment providers, such as payment tokens, card type, and limited transaction details; and communications, reviews, preferences, and information submitted to support.

Information from physicians and practices

Professional and practice details, credentials, biography, images, contact information, product selections, configured retail prices and earnings allocations, wholesale orders, commissions, tax documentation, ACH payout enrollment and limited payout-status or transaction records, authorized users, and account and support records. When a physician sends a product-selection link, the physician may enter the recipient’s first and last name, email address, optional telephone number, selected products, subscription settings, link duration, delivery method, and confirmation of an SMS request. Bank account and routing information for clinic payouts is entered directly into the ACH provider’s system rather than Protocol Therapeutics’s platform.

Information from independent sales representatives

Identity and contact information, business and tax information, ACH payout enrollment and limited payout-status or transaction records, assigned physicians, recruitment and onboarding activity, training records, aggregate portfolio performance, commissions, dashboard activity, and communications. Bank account and routing information for representative payouts is entered directly into the ACH provider’s system rather than the Services.

Device and usage information

IP address, browser and device details, approximate location derived from IP, pages and features used, referral URL, identifiers, cookie and pixel information, logs, timestamps, security events, and interactions with messages. These technologies are used for Service operation, security, troubleshooting, and internal analytics—not cross-context behavioral advertising, audience building, or sale of personal information.

4. Sources of Information

We collect information directly from you; automatically from devices and browsers; from participating physicians or authorized practice administrators; from representatives; and from service providers including Shopify and Shopify Payments, Shopify subscription and hosting functions, Extensiv and fulfillment providers, USPS and FedEx, Brevo for operational email and SMS, tax-calculation and compliance tools, internal analytics tools, and banking or payout providers that collect payee banking credentials directly for ACH payouts. Protocol Therapeutics does not use a separate customer-support or fraud-prevention provider.

Storefront and referral attribution identifies the referring physician or practice. A product-selection link may be sent to a particular recipient using contact information supplied by the physician, but the Services are not intended to encode diagnoses or clinical information in the link.

5. How We Use Personal Information

• Provide storefronts, accounts, checkout, orders, subscriptions, wholesale purchasing, delivery, returns, refunds, and support.
• Associate activity with the appropriate physician and calculate, report, audit, and pay commissions.
• Onboard and administer physicians, practices, staff users, and representatives.
• Authenticate users, protect accounts, prevent fraud, secure systems, investigate incidents, and enforce agreements.
• Communicate about orders, shipments, subscriptions, payments, accounts, onboarding, support, safety, recalls, and service changes.
• Operate, troubleshoot, analyze, and improve the Services and develop permitted features.
• Maintain records, comply with legal and regulatory obligations, respond to lawful process, and establish or defend legal claims.

We will not use customer purchase or referral information for a materially different purpose without providing notice and obtaining consent where required.

6. How We Disclose Personal Information

Service providers and processors

Shopify and Shopify Payments receive identifiers, contact and account details, billing and shipping information, order and subscription information, and payment-related information needed to operate storefronts, checkout, accounts, payments, subscriptions, and orders. Tax-calculation and compliance providers receive transaction, product, price, shipping-location, and tax information needed to calculate and administer taxes. Extensiv and fulfillment providers receive the customer’s name, telephone number, email address, shipping address, and products ordered; USPS and FedEx receive the name, shipping address, and shipment information needed for delivery and tracking. Brevo receives the customer’s name, telephone number, email address, shipping address, and products ordered as needed to send operational email and SMS. Clinics and representatives submit bank account and routing information directly to the ACH payout provider, not Protocol Therapeutics’s platform. No customer information is provided to the ACH provider for those payouts. Protocol Therapeutics may receive enrollment, verification, masked-account, payout-status, and transaction records needed to administer payouts. Other service providers receive information appropriate to their functions and are subject to contractual or legal duties where required.

Participating physicians and practices

A referring physician may see the customer’s name and email address, order number, products purchased, sale total, order date, fulfillment status, and subscription status for orders attributed to that physician. Authorized office users may see the referring physician’s name, a pseudonymous customer ID, order number, products purchased, sale total, date, fulfillment status, and subscription status. Authorized practice users may also see the office associated with the order and corresponding practice-wide earnings information. Physicians and practice users do not receive payment-card details through the portal.

Independent sales representatives

A representative may see an assigned practice, pseudonymous referring-physician and customer IDs, order number, products purchased, date, fulfillment status, subscription status, aggregate performance, and the representative’s own commission information. Representatives do not receive customer names, email addresses, telephone numbers, shipping or billing addresses, payment-card details, or clinical information and may not use dashboard data to identify or contact customers.

Legal, safety, and corporate transactions

We may disclose information to comply with law or lawful process; protect safety, rights, products, and systems; investigate fraud or misconduct; enforce agreements; obtain professional advice; or complete a merger, financing, reorganization, sale, or transfer subject to appropriate safeguards.

7. Sale, Sharing, and Targeted Advertising

Protocol Therapeutics does not sell personal information for money, disclose customer information to data brokers, use personal information for cross-context behavioral advertising or audience building, or otherwise share personal information for targeted advertising. Protocol Therapeutics discloses personal information only as described in this Policy, including to service providers as necessary in the ordinary course of business.

If Protocol Therapeutics later implements a practice that constitutes a sale, sharing, or targeted advertising under applicable law, we will update this Policy and provide required notices and choices before using personal information for that practice. We do not knowingly sell or share personal information of persons under 18.

8. Cookies and Similar Technologies

We and Shopify may use cookies, pixels, local storage, SDKs, and similar technologies for login, cart and storefront operation, preferences, fraud prevention, security, measurement, troubleshooting, and internal analytics. These technologies are not used for cross-context behavioral advertising or audience building.

Where required, we will provide applicable cookie notices or controls and honor legally required privacy signals. Browser settings may block some technologies but can impair functionality.

9. Communications

We use Brevo to send operational and transactional email and SMS messages concerning accounts, orders, subscriptions, shipments, payment failures, security, support, recalls, and material service changes. These messages may use the contact and order information described above. Transactional messages are not controlled by marketing opt-out preferences when needed to provide a requested service or meet legal obligations.

We do not send marketing email or marketing text messages through the Services. If marketing communications are introduced, we will provide any required notice, obtain consent where required, and provide applicable opt-out methods.

10. Retention

We retain personal information for as long as reasonably necessary for the purposes described, including to maintain accounts and subscriptions, fulfill orders, process returns, administer commissions, meet tax and accounting duties, address safety and recalls, prevent fraud, resolve disputes, enforce agreements, and comply with law. Retention varies by record type and legal obligation.

We do not apply one fixed retention period to every record. When information is no longer reasonably necessary for an active account, subscription, order, support matter, commission, tax or accounting obligation, security need, recall, dispute, or other lawful purpose, we will delete, deidentify, or securely dispose of it as appropriate. Backup copies may remain until overwritten or deleted through normal retention cycles.

11. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including role-based access, authentication, logging, vendor controls, and secure payment and payout providers as appropriate. Customer payment information is handled through Shopify Payments. Clinic and representative bank account and routing information is entered directly into the ACH provider’s secure system rather than Protocol Therapeutics’s platform. No system is completely secure, and we cannot guarantee absolute security.

Protect your credentials and contact us immediately at support@protocoltherapeutics.com or 405-768-1228 if you suspect unauthorized access. Do not send payment-card details, banking credentials, or clinical records through ordinary email, general support forms, uploads, or platform messages. Clinic and representative users must submit ACH banking details only through the designated payout provider’s secure interface.

12. Your Privacy Choices and Rights

Depending on your state and our legal coverage, you may have rights to request access, confirmation, correction, deletion, portability, or a list of certain third parties; to opt out of sale, sharing, targeted advertising, or qualifying profiling; to withdraw consent; and to appeal a denied request. Rights and exceptions vary.

Submit a privacy request by emailing support@protocoltherapeutics.com, calling 405-768-1228, or writing to Protocol Therapeutics, 1236 NW 5th Street, Oklahoma City, Oklahoma 73106. We may verify identity and authority, request additional information, and deny or limit a request where an exception applies. Authorized agents must provide proof of authority, and we may verify directly with the consumer. We will not unlawfully discriminate for exercising privacy rights.

If we deny an appealable request, you may appeal by emailing support@protocoltherapeutics.com with “Privacy Appeal” in the subject line or by writing to the postal address above. We will provide regulator-contact information where required.

13. Consumer Health Data

Protocol Therapeutics does not intend to collect diagnoses, symptoms, medications, laboratory results, treatment notes, clinical records, or other medical information. Some states may nevertheless define product purchases, subscription choices, or physician-referral associations as consumer health data when they reveal or permit an inference about health or wellness interests. Where a consumer health privacy law applies, Protocol Therapeutics will provide required notices and choices and apply applicable processor, security, and consumer-rights requirements.

Protocol Therapeutics does not sell consumer health data or use it for targeted advertising. If a separate state-specific consumer health data notice is legally required for the final production configuration, Protocol Therapeutics will provide it before the applicable processing begins.

14. Children

The Services are not directed to children, and we do not knowingly allow persons under 18 to create accounts or place orders. If you believe a minor has provided personal information contrary to this Policy, contact us so we can evaluate and take appropriate action.

15. United States Processing

Orders are available only for delivery within the 50 states and the District of Columbia; U.S. territories and international destinations are not supported. Information may be processed in the United States and other locations where our service providers operate, subject to applicable protections.

16. Third-Party Sites and Services

Links to or integrations with third-party services may be governed by those parties' privacy notices. This Policy does not govern a participating physician's separate website, clinical system, or medical practice, or a third-party service when it determines its own purposes and means of processing.

17. Changes to This Policy

We may update this Policy prospectively. We will post the revised version, update the Last Updated date, and provide additional notice or obtain consent when required. Material changes do not authorize a materially different use of previously collected information where law requires additional choice.

18. Contact Us

Protocol Therapeutics, 1236 NW 5th Street, Oklahoma City, Oklahoma 73106

Privacy requests, questions, and appeals: support@protocoltherapeutics.com | 405-768-1228

Security concerns: support@protocoltherapeutics.com | 405-768-1228

Customer support: support@protocoltherapeutics.com | 405-768-1228