Data Privacy & Security
How well the provider protects your health data — the quality of its privacy policy, its security posture, and whether it has a public breach record.
Why it matters
Telehealth intake collects some of the most sensitive information you have. A vague privacy policy that reserves the right to share health data for marketing, or a history of breaches, is a real cost that never shows up on the price page.
How we assess it
We read the privacy terms for what they actually permit and check for any public security failures.
- Privacy-policy specifics — especially whether health data is shared or sold for advertising
- Security posture and safeguards described
- Any public breach or enforcement record
Source types: The provider’s published privacy policy and terms, and the public record of breaches or regulatory findings.
How we score it
A specific, protective privacy policy with a clean record scores high. Boilerplate that permits broad health-data sharing, a weak security posture, or a breach history pulls the subscore down.
- Importance
- Medium
Medium — a moderate weight. It rarely makes or breaks a ranking on its own, but it separates providers that treat your data as a liability to protect from those that treat it as an asset to monetize.
- Scope
- Universal — applies to every provider
What this tier is worth
- Scope
- Universal — applies to every provider
How this shows up in real reviews
Cited evidence we captured on this factor in live provider reviews.
- SkinnyRx
SkinnyRx publishes a Privacy Policy at /privacy (last updated 2026-05-20, ~33,000 characters rendered) with a "Categories of Personal Information We Collect" section, a "Data Security and Data Retention" section, cookie controls, and an explicit carve-out directing protected health information to a separate HIPAA Notice of Privacy Practices. Confirmed on the rendered page 2026-08-24. Two disclosed practices weigh against it, both read from the brand's own pages rather than inferred: the policy states it does NOT honour Do Not Track signals, and the site discloses using hashed and de-identified customer data to build custom audiences for targeted advertising on Facebook, Google and similar platforms - a weight-loss brand doing health-adjacent ad targeting. CONFIRMED ABSENT ON THE RENDERED PAGE: no dedicated consumer-health-data policy of the kind remedymeds publishes. No breach appears on
- Gala Health
A privacy policy is published and the homepage displays a “HIPAA Compliant” badge. The badge is a claim by Gala and is not a certification we can check — HIPAA has no certifying body — so it is recorded as displayed, not as verified.