1. Who We Are and What This Policy Covers
Function Flo Corporation, doing business as Prado (“Prado,” “we,” “us,” or “our”), operates a platform that lets licensed healthcare providers recommend medically tailored meals to their patients and lets patients buy those meals, including with HSA or FSA funds. This Privacy Policy explains what information we collect, how we use and share it, and the choices you have.
This policy applies to information we collect through our website, web and mobile applications, provider portal, and related services (the “Services”) from three groups:
- Providers: licensed healthcare professionals, their practices, and their staff.
- Patients: individuals who receive a recommendation from a Provider or buy meals through the Services.
- Visitors: anyone who browses our website, signs up for updates, or contacts us.
This policy is part of our Terms of Service for Healthcare Providers and Patients. Food merchants that prepare meals for orders placed through Prado are covered by a separate privacy policy. Capitalized terms not defined here, such as Fulfillment Partner and Medical Partner, have the meanings given in those Terms.
2. How HIPAA Applies
Prado acts as a business associate of Providers under the Health Insurance Portability and Accountability Act (“HIPAA”). When a Provider shares a patient’s health information with us to recommend meals or arrange care, that information is protected health information (“PHI”). We handle PHI as our business associate agreements with Providers and HIPAA require, and your Provider’s Notice of Privacy Practices describes your rights in it. Where this policy and those obligations differ, the HIPAA obligations control.
Some information Patients give us directly, such as an account email, shipping address, or payment details entered at checkout, may not be PHI. We protect that information as described in this policy and applicable state law.
The Medical Partner is an independent healthcare provider. When its physicians review a nutrition plan or issue a Letter of Medical Necessity (“LMN”), they handle your information under their own Notice of Privacy Practices.
3. Information We Collect
What we collect depends on how you use the Services.
| Category | Examples | Applies to |
|---|---|---|
| Identity and contact | Name, email, phone number, practice name, mailing and shipping address | Providers, Patients, Visitors |
| Professional credentials | NPI, license type, number, and state, specialty, credential verification results | Providers |
| Business and payout | Legal business name, entity type, tax ID, bank account details, and the account owner’s date of birth and home address | Providers |
| Health information | Diagnoses or conditions your Provider shares, nutrition plans, dietary needs, allergies, LMN status | Patients |
| Orders and delivery | Meals ordered, order history, delivery dates and instructions, recurring order settings | Patients |
| Payment | HSA, FSA, or other card details (processed by our payment processor, not stored by Prado), billing address, transaction records, receipts | Patients |
| Account and communications | Login credentials, preferences, messages, support requests, survey responses | Providers, Patients |
| Device and usage | IP address, browser and device type, pages viewed, features used, referring site, approximate location from IP address | Everyone |
How we collect it. We collect information you give us directly, such as when you create an account, set up payments, place an order, or contact us. We collect device and usage information automatically through cookies and similar tools (see Section 6). We also receive information from others:
- your Provider, when they recommend meals to you or share a nutrition plan;
- the Medical Partner, about whether an LMN was issued;
- Fulfillment Partners, about order and delivery status;
- our payment processor, about transaction results and Provider account verification;
- public sources and verification services, such as the NPPES registry and state licensing boards, to verify Provider credentials; and
- software your Provider connects to the Services, such as an electronic health record system, if they choose to.
De-identified and aggregated data. We may create information that cannot reasonably identify you, such as the percentage of Patients who reorder within 30 days. We keep it in de-identified form, and we do not try to re-identify it. For PHI, we de-identify using the HIPAA standard in 45 CFR §164.514.
4. How We Use Information
We use information to:
- create and manage accounts, and verify Provider credentials and eligibility;
- let Providers recommend meals and track their patients’ orders and engagement;
- process orders and payments, send payouts to Providers, coordinate fulfillment and delivery, and issue receipts;
- route nutrition plans to the Medical Partner and deliver LMNs and other HSA/FSA documentation;
- send account, order, and delivery messages, and respond to support requests;
- operate, secure, troubleshoot, and improve the Services, including measuring how features are used;
- detect and prevent fraud, misuse, and security incidents;
- create de-identified and aggregated data for analysis, research, and reporting; and
- comply with legal obligations, enforce our Terms of Service, and protect the rights and safety of Prado, our users, and others.
We use PHI only as our business associate agreements with Providers and HIPAA allow. We do not use health information to target advertising.
7. Your Choices and Privacy Rights
7.1 Account information
You can update your account information in your settings at any time.
7.2 Your rights
Depending on where you live, you may have the right to:
- know what personal information we hold about you and get a copy of it;
- correct inaccurate information;
- delete your information;
- receive your information in a portable format;
- opt out of the sale of personal information, targeted advertising, or certain profiling (we do not do these, but you can still submit a request); and
- withdraw consent you have given us.
To make a request, email privacy@getprado.com. We will verify your identity before acting, which may mean asking you to confirm details from your account. You may use an authorized agent where state law allows. We will respond within the time the law requires. If we deny your request, you may appeal by replying to our decision, and we will explain the outcome of your appeal in writing. We will not treat you differently for exercising your rights.
If your request involves PHI we hold on behalf of a Provider, we will help that Provider respond as HIPAA requires, and in some cases we may direct you to your Provider. We may keep some information when the law requires it or allows it, such as transaction records.
7.3 Consumer health data
Some states, including Washington and Nevada, have laws that protect health information outside of HIPAA. Where those laws apply, we collect and share consumer health data only with your consent or as needed to provide the Services you request, and you may withdraw consent or ask us to delete that data at any time.
8. Security and Retention
Security. We use administrative, physical, and technical safeguards designed to protect your information, including encryption in transit and at rest, access controls, and workforce training, and we meet the HIPAA Security Rule for PHI. No system is completely secure, so we cannot guarantee the security of your information. Keep your password private and tell us right away at privacy@getprado.com if you think your account has been compromised. If a breach affects your information, we will notify you and the appropriate authorities as the law requires.
Retention. We keep information for as long as we need it to provide the Services, meet our contracts with Providers, Fulfillment Partners, and other partners, and satisfy legal, tax, and accounting requirements. When we no longer need information, we delete it or de-identify it. PHI is returned or destroyed as our business associate agreements require.
9. Children
The Services are not directed to children under 18, and we do not knowingly collect personal information from them directly. If you believe a child has given us personal information, contact us and we will delete it.
10. Third-Party Sites and Services
The Services may link to or connect with sites and services we do not control, including those of Fulfillment Partners and the Medical Partner. Their privacy practices are governed by their own policies, so review them before sharing information.
11. Where We Process Information
Prado operates in the United States, and we store and process information in the United States. The Services are intended for users in the United States.
12. Changes to This Policy
We may update this policy from time to time and will change the “Last Updated” date when we do. For material changes, we will notify you by email or through the Services before the changes take effect. If a change would let us use health information in a materially different way, we will ask for your consent where the law requires it.
13. Contact Us
Send questions or requests about this policy or your information to Prado (Function Flo Corporation) at privacy@getprado.com.
If you believe your HIPAA privacy rights have been violated, you may also file a complaint with your Provider or with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint.