Last modified: July 21, 2026
This Privacy Policy ("Privacy Policy") describes the data protection practices of Good Guy LLC and its affiliates (collectively, "Good Guy LLC", "Good Guy RX", "we", "our", or "us"), including when you visit any Good Guy LLC website that links to this Privacy Policy (including goodguyrx.com and any other Good Guy RX websites that link to this Privacy Policy) (collectively, our "Websites"), use any affiliated mobile applications (the "Apps"), or otherwise provide data to Good Guy LLC. We refer to the Websites, Apps, and other services provided by Good Guy LLC together in this Privacy Policy as the "Services." This Privacy Policy is incorporated into our Terms of Use.
PLEASE READ THIS PRIVACY POLICY CAREFULLY TO UNDERSTAND HOW WE HANDLE YOUR INFORMATION. IF YOU DO NOT AGREE TO THIS PRIVACY POLICY, PLEASE DO NOT USE THE SERVICES.
This Privacy Policy contains the following sections:
Good Guy RX is a technology platform. Good Guy LLC is not a healthcare provider or a pharmacy, and clinical and pharmacy services available through the Services are delivered by independent third parties, as described in Section 2.
Because of that structure, information collected in connection with the Services falls into two categories that are governed by different documents:
Protected Health Information ("PHI"). Information that is created, received, or maintained by or on behalf of the Provider Group or the Pharmacies in connection with your treatment, such as your medical evaluation, clinical notes, diagnoses, prescriptions, and dispensing records, is PHI governed by the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA") and applicable state medical privacy laws. PHI is governed by the Notices of Privacy Practices of those entities, not by this Privacy Policy. Where Good Guy LLC handles PHI on behalf of the Provider Group or a Pharmacy, it does so under written agreements that restrict its use and disclosure of that information as required by HIPAA.
Other Information. Information that Good Guy LLC collects for its own purposes, such as information about your visits to the Websites, your account and purchase information, your marketing preferences, and health-related information you provide outside of a clinical relationship (for example, responses to a pre-intake qualifier about the treatment category you are interested in), is governed by this Privacy Policy and, where applicable, the consumer health data laws described in Section 7.
Clinical services delivered to Good Guy RX patients are provided by Arora Health & Aesthetics, LLC, an independent professional medical corporation located at 300 Lenora Street, Seattle, WA 98121 (the "Provider Group"). Providers are credentialed in the state in which the patient resides. Good Guy RX does not employ providers or direct their clinical decisions. Provider-related inquiries, including requests relating to your medical records, can be directed to medicalcompliance@arorahealthgroup.com.
Prescriptions issued through the Services are dispensed and shipped by independent, state-licensed pharmacies, including state-licensed compounding pharmacies (the "Pharmacies"). The privacy notices of the Provider Group and the Pharmacies govern their handling of your PHI.
Identity and contact information, such as your name, postal address, email address, telephone number, and date of birth.
Account information, such as log-in credentials and account settings.
Health-related information you provide outside of the clinical relationship, such as your responses to pre-intake qualifier questions, the treatment categories you express interest in, and information you include in communications with our support team. Information you submit within the clinical intake and patient portal is collected on behalf of the Provider Group and handled as described in Section 1.
Payment and transaction information, such as billing address and purchase history. Payment card details are collected and processed by our payment processors on our behalf; Good Guy LLC does not store full card numbers.
Communications, such as questions, feedback, survey responses, reviews, and customer support interactions, including chat.
Employment application information, if you apply for a position with us.
When you use the Services, we and our service providers automatically collect device and usage information, such as IP address, browser type and language, operating system, device identifiers, referring and exit pages, pages viewed and the order of those pages, time spent on pages, links clicked, search terms used on the Services, error logs, and dates and times of access. We collect general location information (such as the city, state, or postal code associated with your IP address) to determine service availability, comply with state-specific requirements, and tailor content. We will ask your permission before collecting precise GPS location, and you can disable location features on your device at any time.
We may receive limited information from third parties, including administrative information from the Provider Group and the Pharmacies (such as order status and shipment events needed to run notifications and support), information from payment processors and fraud-prevention services, information from analytics providers, and information you make available through social media platforms when you interact with our accounts or promotions.
We use the information described in this Privacy Policy to:
Provide, operate, and administer the Services, including creating and maintaining your account, verifying identity and eligibility (including age and state of residence), processing payments, and fulfilling orders;
Facilitate the provision of healthcare and pharmacy services to you by the Provider Group and the Pharmacies, including scheduling, routing, notifications, and administrative support for those independent entities;
Communicate with you about the Services, including transactional messages regarding your account, orders, shipments, and payments;
Send you marketing communications about our products and Services, subject to the opt-out rights described in Section 8;
Perform analytics, research, and product development to understand how the Services are used and to improve them;
Maintain the safety and security of the Services, including fraud prevention, abuse detection, and enforcement of our Terms of Use;
Comply with applicable law, respond to lawful requests, and establish, exercise, or defend legal claims.
Aggregate and De-Identified Information. We may aggregate or de-identify information so that it can no longer reasonably be linked to you or your device. We maintain and use de-identified information without attempting to re-identify it, except as permitted by law to confirm that it remains de-identified, and we require the same commitment from recipients of de-identified data.
We and our service providers use cookies, pixels, SDKs, and similar technologies to operate the Services, remember your preferences, measure performance, and support marketing. Where required, these technologies are deployed through our cookie consent banner, which allows you to accept or reject non-essential categories.
Essential technologies are required for the Services to function, such as security, session management, and load balancing.
Analytics technologies help us understand how visitors use the Websites, such as page performance and navigation patterns.
Advertising technologies help us measure campaigns and reach audiences on third-party platforms.
Health information safeguards. We treat advertising technology as a regulated surface. We do not run third-party advertising pixels or trackers on authenticated pages of the Services, including the clinical intake and the patient portal. We do not disclose your health information, including qualifier responses, conditions, treatments sought, or prescription information, to advertising platforms, and we do not use that information to build advertising audiences. Where we use audience-matching tools, the matching is limited to contact identifiers (such as a hashed email address) and is subject to the opt-out rights described in Sections 8 and 9.
Analytics choices. To opt out of Google Analytics, you may install the Google Analytics Opt-out Browser Add-on. For interest-based advertising choices generally, you may use the Network Advertising Initiative opt-out, the Digital Advertising Alliance opt-out, or your Google Ads Settings. These mechanisms are cookie- and device-based, and we do not control their availability. If you opt out, you will still see advertising, but it will not be tailored based on your activity.
Email analytics. Our emails may contain pixels that tell us whether a message was opened or a link was clicked, which we use to measure and improve our communications.
We disclose information for the following business purposes:
Provider Group and Pharmacies. At your direction and as part of the Services, we disclose information to the Provider Group and the Pharmacies so you can receive clinical and pharmacy services, such as routing your intake to a licensed provider and transmitting order and shipping details.
Affiliates. We may share information within the Good Guy LLC corporate family to deliver the Services, maintain consistent service levels, and support the purposes described in Section 4.
Service Providers. We disclose information to vendors performing services on our behalf under contractual confidentiality and use restrictions, including hosting and platform infrastructure (including the telehealth intake and patient portal platform), payment processing, email and SMS delivery, customer support and help center tools, analytics, fraud prevention, security, shipping and logistics coordination, and professional advisors such as auditors and legal counsel.
Legal and Protective Purposes. We may access, retain, and disclose information if required by law or where we believe in good faith that doing so is reasonably necessary to comply with legal process, enforce our Terms of Use or this Privacy Policy, respond to claims, protect the rights, property, or safety of Good Guy LLC, our users, the Provider Group, the Pharmacies, or the public, or to detect and prevent fraud, spam, or security incidents.
Business Transfers. If Good Guy LLC is involved in a merger, acquisition, financing, reorganization, or sale of some or all of its assets, information may be transferred as part of that transaction, subject to this Privacy Policy and any additional restrictions under applicable law, including health privacy laws.
With Your Consent. We may disclose information in other ways you direct or with your consent.
Aggregate/De-Identified Information. We may share aggregate or de-identified information, subject to the no-re-identification commitment in Section 4.
We do not sell personal information in exchange for money. Certain cookie-based advertising disclosures may constitute a "sale" or "sharing" under some state laws; your opt-out rights for those disclosures are described in Sections 8 and 9. Text messaging originator opt-in data and consent are excluded from all of the above categories and will not be shared with any third parties.
Some states, including Washington and Nevada, regulate "consumer health data," which generally means personal information that identifies your past, present, or future physical or mental health status. In connection with the Services, consumer health data we collect may include the treatment categories you express interest in, your responses to pre-intake qualifier questions, purchase and subscription information that could reveal a health condition or treatment, and related support communications.
We collect consumer health data directly from you and through your use of the Services, and we use and disclose it only for the purposes and to the recipient categories described in Sections 4 and 6. We do not sell consumer health data, and we do not use it for targeted advertising. Where required, we obtain your consent before collecting or sharing consumer health data beyond what is necessary to provide the Services you request.
Residents of applicable states have the right to confirm whether we collect, share, or sell their consumer health data, to access it (including a list of the third parties with whom it has been shared), to withdraw consent, and to have it deleted. To exercise these rights, email legal@goodguyrx.com. For additional state-mandated disclosures, please see our Consumer Health Data Privacy Policy. If we deny your request, you may appeal by replying to our response, and, if your appeal is denied, you may contact your state Attorney General.
Marketing email. You can opt out of marketing emails at any time by using the unsubscribe link in any marketing message or by contacting us at legal@goodguyrx.com. We will still send you non-promotional, transactional messages about your account and orders.
Text messages. Reply STOP to any Good Guy RX text message to opt out, as described in Section 13.
Cookies. You can manage non-essential cookies through our cookie consent banner and through your browser settings. Blocking some cookies may affect the functioning of the Services.
Opt-out preference signals. Where required by law, we honor recognized opt-out preference signals, such as the Global Privacy Control, as a request to opt out of the sale or sharing of personal information for that browser.
Precise location. You can disable precise location collection through your device settings at any time.
Depending on your state of residence, you may have some or all of the following rights with respect to personal information governed by this Privacy Policy: the right to know and access the personal information we hold about you; the right to correct inaccurate personal information; the right to delete personal information; the right to obtain a portable copy; the right to opt out of the sale or sharing of personal information and of targeted advertising; the right to limit certain uses of sensitive personal information; and the right not to be discriminated against for exercising these rights.
To exercise these rights, email legal@goodguyrx.com with your full name, the email address associated with your use of the Services, your state of residence, and the right you wish to exercise. We will verify your identity before acting on a request, which may require confirming information we already hold about you. You may use an authorized agent where permitted by law; we will require proof of the agent's authority and may still verify your identity directly. If we deny your request, you may appeal by replying to our response, and if the appeal is denied, you may contact your state Attorney General. Please note that requests concerning your medical records are handled by the Provider Group and the Pharmacies, and we will route those requests accordingly.
The California Consumer Privacy Act, as amended ("CCPA"), requires additional disclosures. In the preceding 12 months, we have collected the following categories of personal information and disclosed them for business purposes to the categories of recipients described in Section 6: identifiers and contact information; health-related information you provide outside of the clinical relationship; commercial and transactional information; financial information (collected by our payment processors); internet or other network activity; general location information; demographic information; audio or visual information you choose to provide; customer service data; and inferences drawn from the foregoing. Categories of sources and business purposes are described in Sections 3 and 4. Information subject to HIPAA or the California Confidentiality of Medical Information Act is exempt from the CCPA and is handled as described in Section 1.
Sensitive personal information. Sensitive personal information we collect (such as account log-in credentials and health-related information you provide outside of the clinical relationship) is used only for the purposes permitted by the CCPA, such as providing the Services you request, security, and legal compliance. We do not use or disclose sensitive personal information for purposes that would trigger a right to limit under the CCPA.
Sale and sharing. We do not sell personal information for money. Cookie-based advertising disclosures may constitute "sharing" (or a "sale") under the CCPA; you may opt out through our cookie consent banner or a recognized opt-out preference signal such as the Global Privacy Control. We do not sell or share the personal information of consumers we know to be under 16, and we do not knowingly collect personal information from anyone under 18, as described in Section 10.
Shine the Light. We do not share personal information with third parties for their own direct marketing purposes.
We do not sell covered information for monetary consideration as defined by Nevada law. Nevada residents may nonetheless submit a request to opt out of any potential future sale, and may exercise Nevada consumer health data rights, by emailing legal@goodguyrx.com.
The Services are intended for adults 18 years of age and older. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will delete it. If you believe a minor has provided us personal information, contact us at legal@goodguyrx.com.
We keep information for no longer than necessary for the purposes for which it is processed. Retention periods depend on the type of information, the purposes for which we use it, our legal and regulatory obligations (including tax, accounting, and record-keeping requirements), the need to defend or establish legal claims, and fraud- and abuse-prevention needs. Medical and pharmacy records are retained by the Provider Group and the Pharmacies in accordance with their own legal obligations, which typically require retention for a period of years after your last treatment.
We maintain technical and organizational safeguards designed to protect information against accidental or unlawful destruction, loss, alteration, and unauthorized disclosure or access, including encryption in transit, access controls, and segregation of authenticated patient surfaces from marketing surfaces. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential. If a security incident affects your information, we will notify you and regulators as required by applicable law.
If you opt in to text messages, we will send you messages regarding your account and the Services, which may include customer care, transactional, and marketing messages. Message frequency varies and message and data rates may apply. Consent to marketing texts is not a condition of purchase. Reply STOP to opt out or HELP for help at any time. Text messages and standard email are not encrypted; if you choose to send health or other sensitive information through those channels, you do so at your own risk. Text messaging originator opt-in data and consent will not be shared with any third parties.
This Privacy Policy does not address, and we are not responsible for, the privacy practices of third parties, including the Provider Group, the Pharmacies, the manufacturer of your device, and any third-party website, application, or service to which the Services may link. Those parties' own privacy policies and notices govern their handling of your information, and we encourage you to read them.
We may revise this Privacy Policy from time to time to reflect changes in law, our practices, or the Services. The date of the most recent revision appears at the top of this page. If we make a material change, we will provide notice as required by law, such as by posting a prominent notice on the Websites or contacting you directly, and, where required, we will obtain your consent. Your continued use of the Services after a revised Privacy Policy takes effect constitutes your acknowledgment of the revised policy.
If you have any questions about this Privacy Policy or Good Guy LLC's or Good Guy RX's privacy practices, please contact us at:
Good Guy LLC
1005 17th Avenue South, Suite 900
Nashville, Tennessee 37212
Email: legal@goodguyrx.com