Privacy Policy

CoreSpring Health

Effective Date: April 2026

Business: CoreSpring Health LLC

1. Introduction

CoreSpring Health LLC (“CoreSpring Health,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use and protect it, and your choices regarding your information in connection with our website, forms, scheduling tools, and SMS messaging program.

Because CoreSpring Health LLC provides physician-led medical consulting services, certain health information you share in the context of clinical services may also be governed by our separate Notice of Privacy Practices, which addresses your rights under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). That document will be provided to you upon enrollment and is available upon request.

2. Information We Collect

We may collect the following categories of information:

Identity and contact information: name, email address, mobile phone number, and mailing or billing address
Appointment and inquiry details submitted through forms or messages
Health and medical information voluntarily provided through intake forms, consultations, and ongoing engagement — including medical history, current medications, laboratory results, lifestyle factors, and wellness goals
Payment information, processed securely through third-party payment processors; we do not store full payment card details
Technical information: IP address, browser type, device type, and website usage data

Health information shared in connection with physician-led consulting services constitutes Protected Health Information (PHI) under HIPAA and is handled with the heightened protections required by applicable law.

3. How We Use Your Information

We use the information we collect to:

Respond to inquiries and provide requested services
Schedule, confirm, and follow up on appointments and consultations
Deliver physician-led executive health consulting services, including assessments and care coordination
Send SMS messages you have opted in to receive
Provide relevant health resources, educational content, and service updates
Coordinate referrals to specialists or diagnostic services where clinically appropriate
Comply with legal, regulatory, and medical record-keeping obligations
Maintain website security, performance, and user experience

We do not sell your personal information.

4. SMS Privacy Disclosures

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Text messaging originator opt-in data and consent will not be shared with any third parties, except for aggregators and providers of the text message services required to deliver those messages.

5. How We Share Your Information

CoreSpring Health LLC does not use your personal information for outside parties’ marketing or promotional purposes.

When necessary to operate our business, we may allow carefully selected subcontractors and service providers to process information on our behalf for functions such as website hosting, scheduling, payment processing, customer support, telehealth delivery, and SMS message delivery. These providers may use your information only as needed to perform those services and are contractually obligated to protect it. All providers handling Protected Health Information (PHI) are required to execute HIPAA-compliant Business Associate Agreements (BAAs).

We may also disclose your information: (i) to comply with applicable law, court orders, or law enforcement requests; (ii) to prevent or address fraud, security issues, or imminent threats to safety; or (iii) with your express written consent.

All of the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties, excluding aggregators and providers of the text message services.

6. Health Information and HIPAA

CoreSpring Health LLC handles PHI in accordance with HIPAA and applicable state law. We do not sell, rent, or commercially disclose individually identifiable health information. A full description of your rights regarding your health information — including rights to access, correct, and restrict use of your records — is set forth in our Notice of Privacy Practices, available upon request at hello@corespringhealth.com.

7. Your Rights Regarding Health Information

As a patient of a physician-led consulting practice, you have rights under HIPAA and applicable Ohio law, including the right to:

Access and obtain a copy of your health records
Request corrections to inaccurate or incomplete information
Receive an accounting of certain disclosures of your health information
Request restrictions on certain uses and disclosures

To exercise these rights, contact us at info@corespringhealth.com.

8. Cookies and Analytics

We may use cookies and similar technologies to improve website functionality, understand usage patterns, and enhance performance. You can control cookie preferences through your browser settings. Disabling cookies may limit certain website functionality.

9. Data Security

CoreSpring Health LLC implements administrative, physical, and technical safeguards to protect your information from unauthorized access, use, alteration, or disclosure, consistent with HIPAA Security Rule requirements and applicable state law. No system can guarantee absolute security; you transmit information to us at your own risk. Please do not send sensitive health information or full payment card details via unsecured email.

10. Your Choices

You may:

Opt out of SMS messages at any time by texting STOP to the shortcode
Request help by texting HELP
Unsubscribe from marketing emails using the unsubscribe link in any such email
Contact us to update, correct, or request deletion of your personal information
Exercise your HIPAA rights as described in our Notice of Privacy Practices

11. Data Retention

We retain your information for as long as reasonably necessary for business, legal, operational, clinical, or compliance purposes. Medical and health records are retained in accordance with Ohio medical record retention requirements. Information is securely deleted or de-identified when retention is no longer required.

12. Children’s Privacy

This website and CoreSpring Health LLC’s services are intended exclusively for adults aged 18 and over. We do not knowingly collect personal information from individuals under 18. If we become aware that such information has been inadvertently collected, we will promptly delete it.

13. Links to Other Websites

Our website may contain links to third-party websites. CoreSpring Health LLC is not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policies of any external websites you visit.

14. California Privacy Rights

If you are a California resident and have provided us with personal information within the past year, you may request information about our disclosure of certain personal information to third parties for their direct marketing purposes. To make such a request, email hello@corespringhealth.com with “California Privacy Rights” in the subject line. Requests may be made no more than once per calendar year.

15. Changes to This Privacy Policy

CoreSpring Health LLC may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised effective date. Continued use of the website or messaging program after changes are posted constitutes acceptance of the updated policy.

16. Contact Us

For questions about this Privacy Policy, to request your Notice of Privacy Practices, or to exercise your privacy rights, contact:

CoreSpring Health LLC

Email: info@corespringhealth.com

Website: www.corespringhealth.com