What we collect, why, and how we protect it, for clinicians, patients, food merchants, organizations, and visitors.
This Privacy Policy explains how Function Flo Corporation, doing business as Prado (“Prado,” “we,” “us”), collects, uses, shares, and protects personal information. Prado is software that lets clinicians prescribe medically tailored meals, connects those prescriptions to food merchants who prepare and deliver them, and gives those merchants storefront, subscription, point of sale, and payment tools.
This policy applies to getprado.com, functionflo.com, the Prado platform and mobile apps, merchant storefronts and checkout powered by Prado, and our communications with you (together, the “Services”). It covers:
Prado handles information in different roles depending on how you reach us. Section 2 explains which role applies to you. If you live in California, Section 10 also applies. If you live in Washington, Nevada, or Connecticut, Section 11 also applies.
Prado handles personal information in one of three roles. Which one applies decides whose privacy terms govern your information and where to send requests about it.
| When you… | Prado’s role | Whose terms govern | Send requests to |
|---|---|---|---|
| Order meals from a plan your clinician or their organization wrote | Business associate under HIPAA, acting for your clinician or organization | Their Notice of Privacy Practices and our business associate agreement with them | Your clinician or their organization |
| Buy from a food merchant’s own storefront, app, or store that runs on Prado | Service provider, acting for the merchant | The merchant’s privacy policy | The merchant |
| Visit our sites, join a waitlist, contact us, sign up as a merchant or organization, or order directly from Prado | Business that decides how your information is used | This Privacy Policy | Prado, at privacy@getprado.com |
When we act for a clinician or organization, the information we handle is protected health information (“PHI”) under the Health Insurance Portability and Accountability Act (“HIPAA”). We use and share it only as our business associate agreement allows.
When we act for a food merchant, we process customer information to provide our Services to that merchant, such as running their checkout, subscriptions, and order queue. The merchant decides what it collects and how it shares information with us.
When we act for ourselves, this Privacy Policy governs. Some of that information may relate to your health even though it is not PHI. We treat it with the same care, and Section 11 describes additional rights some states give you over it.
In all three roles, we protect information as described in Section 8, and we will help the clinician, organization, or merchant respond to any request you send them.
We collect information you give us, information collected automatically when you use our site and platform, and information from third parties.
Information you give us
| Who you are | What we collect |
|---|---|
| Clinician | Name, work email, phone, clinician type, credentials and NPI, practice or organization, states of practice, and the nutrition plans you write |
| Patient or customer | Name, contact details, billing and delivery address, dietary needs, allergies, nutrition targets, the plan your clinician signed, order and subscription history, and payment method details |
| Food merchant | Business and contact details, menu and nutrition data, pricing, service area, fulfillment settings, and payout and bank account details |
| Organization or employer | Contact details for your team, organization type, population size, states of operation, and program details |
| Anyone who contacts us | Your name, email, phone, and what you tell us in forms, emails, chat, or calls |
Information collected automatically
When you use our sites, apps, or a merchant checkout that runs on Prado, we collect device and usage information. This includes IP address, device identifiers, browser and operating system, pages and screens viewed, actions taken, referring page, and the date and time of your visit. We may infer your general location from your IP address. We collect some of this through cookies and similar technologies, described in Section 6.
Information from third parties
We may receive information from clinicians and organizations that enroll you in a program, food merchants about purchases and fulfillment, payment and HSA/FSA processors that confirm transactions, and public sources such as the NPI registry when we verify clinician credentials.
Payment information. Card numbers and bank account details are collected and stored by our payment processor, not by Prado.
We use personal information to provide Prado and to run our business. Specifically, we use it to:
We share personal information with:
We may also share information that has been de-identified or aggregated so it can no longer reasonably identify you.
Information you choose to post publicly, such as a review of a meal, may be visible to other users and the public.
We use cookies, pixels, log files, and device identifiers to keep you signed in, remember your preferences, understand how our Services are used, measure how people find us, and prevent fraud. These include tools from HubSpot and other analytics providers.
You can block or delete cookies through your browser or device settings. Some parts of the Services may not work without them.
Depending on where you live, you may have the right to:
How to make a request. Email privacy@getprado.com with the subject line “Privacy request,” or write to the address in Section 9. We will verify your identity before acting on your request and respond within the time the law requires, usually 45 days. You may use an authorized agent, and we may ask for proof that they act for you. We do not charge a fee unless a request is excessive and the law allows one.
Appeals. If we deny your request, you can appeal by replying to our decision with the subject line “Privacy appeal.” We will respond in writing within the time the law requires. If you disagree with the outcome, you may contact your state attorney general or your local data protection regulator.
Marketing emails. Use the unsubscribe link in any marketing email. We will still send service messages about your account and orders.
Information held for someone else. If your information is PHI held for your clinician or their organization, or customer information held for a food merchant, send your request to them, as Section 2 explains. If you send it to us, we will pass it along and help them respond.
Retention. We keep personal information as long as your account is active or as needed to provide the Services, then for a reasonable period for backup, fraud prevention, and legal, tax, accounting, and regulatory purposes. PHI is kept as our business associate agreements require, and customer information we hold for a merchant is kept as our agreement with that merchant requires. When we no longer need information, we delete or de-identify it.
Security. We use administrative, technical, and physical safeguards designed to protect personal information. No system is perfectly secure, and we will notify you and regulators of a breach as the law requires.
Children. Prado is not directed to children under 13, and we do not knowingly collect their information online. A parent or guardian may order meals for a minor in their care, and we treat that information under this policy.
Where we process information. Prado operates in the United States, and we store and process information here.
Changes to this policy. We will post updates here with a new effective date. If we make a material change, we will notify you by email or through the platform before it takes effect.
Function Flo Corporation, doing business as Prado
Attn: Privacy
1135 West 6th St., Suite 120
Austin, TX 78703
Email: privacy@getprado.com
This section applies to California residents and supplements the rest of this policy, as required by the California Consumer Privacy Act (“CCPA”). It does not apply to PHI we handle under HIPAA, or to information we handle as a service provider for a food merchant.
What we collected in the past 12 months, and why
| Category | Examples | Sources | Purposes | Disclosed for business purposes to |
|---|---|---|---|---|
| Identifiers | Name, email, phone, address, IP address, device identifiers | You, your device, clinicians, organizations, merchants | Providing the Services, support, security, communications | Service providers, food merchants, clinicians and organizations as Section 5 describes |
| Customer records | Billing and delivery details, payment method (held by our processor) | You, payment processors | Processing orders and payments | Payment and HSA/FSA processors, food merchants |
| Commercial information | Orders, subscriptions, purchase history | You, food merchants | Providing the Services, improving them | Food merchants, service providers |
| Professional information | Clinician type, credentials, NPI, practice | You, the NPI registry | Verifying credentials, providing the Services | Service providers |
| Internet activity | Pages viewed, actions taken, referring page | Your device, cookies | Analytics, security, improving the Services | Analytics and hosting providers |
| General location | Location inferred from IP address | Your device | Delivery options, security | Service providers |
| Sensitive personal information | Health information such as dietary needs, allergies, and conditions; account login | You, clinicians, organizations | Providing the Services you request | Food merchants, clinicians and organizations, service providers |
| Inferences | Meal preferences drawn from your orders | Our analysis | Personalizing the Services | Not disclosed |
Your CCPA rights. You have the right to know what personal information we collect, use, and disclose; to get a copy; to correct it; to delete it; and not to be discriminated against for exercising these rights. Make a request as Section 7 describes.
Shine the Light. California residents may ask whether we disclosed personal information to third parties for their own direct marketing in the past year. Send your request to privacy@getprado.com.
This section is our Consumer Health Data Privacy Policy. It applies to consumer health data about residents of Washington, Nevada, and Connecticut, and to consumer health data collected in those states. Consumer health data is personal information that identifies your past, present, or future physical or mental health, and that is not PHI covered by HIPAA.
Consumer health data we collect. Dietary needs and restrictions, allergies, nutrition targets, health conditions you or your clinician tell us about, the meal plans and orders tied to them, and HSA/FSA purchase information.
Why we collect it. To match meals to your plan and allergies, fill and deliver your orders, process HSA/FSA payments, prepare supporting documentation, and provide support.
Where it comes from. From you, from your clinician or the organization that enrolled you, from food merchants about fulfillment, and from payment and HSA/FSA processors.
Who we share it with. Food merchants filling your order, your clinician and their organization, and service providers who process payments, host the platform, and send messages on our behalf. We share it only as needed to provide the service you asked for, or with your separate consent.
Your rights. You can confirm whether we collect or share your consumer health data, see a list of the third parties we share it with, get a copy, delete it, and withdraw consent. Make a request at privacy@getprado.com with the subject line “Consumer health data request.” Appeals work as described in Section 7.