Privacy Policy

Effective Date: October 25, 2026
Last Updated: October 25, 2026

1. Who We Are and Scope of This Policy
This Privacy Policy explains how DiversifyRx and the affiliated brands and companies identified below (collectively, “we,” “us,” or “our”) collect, use, disclose, retain, and protect personal information when we operate our websites, online stores, events, memberships, training programs, applications, software platforms, AI-assisted tools, marketing programs, and related products and services (collectively, the “Services”).

Covered legal entities: Lisa Faast Membership; Lisa Faast Events; Lisa Faast Education; and DiversifyRx Consulting (collectively, the “Companies”). These entities share ownership and the privacy contact stated in Section 19. Each legal entity remains responsible for its own processing as applicable.

Covered brands and services: DiversifyRx, Pharmacy Profit Summit, and Pharmacy Badass University, each a DBA associated with the Companies, as well as all websites, courses, memberships, events, mobile apps, AI/software products, and related services operated by any of the Companies. The applicable entity may be identified in purchase, registration, or product-specific terms. The entity-to-DBA registrations and any product-specific notices govern in the event of differences.

This Policy is intended for users and individuals whose information we process in connection with our activities in the United States and Canada. We do not intentionally market or offer Services to residents of the European Economic Area, United Kingdom, or Switzerland. If our practices or applicable law change, we will update the relevant disclosures.

This Policy does not replace a separate patient Notice of Privacy Practices required of a healthcare provider under HIPAA or other health privacy law. If we process information solely on behalf of a customer (for example, a pharmacy or healthcare provider), the customer's privacy notice and our service agreement may also apply. The customer may be responsible for deciding how that information is used and for responding to individual privacy requests.

2. Personal Information We Collect
The categories we collect depend on your interactions with us and may include:

Identifiers and contact details: name, professional title, business/pharmacy name, postal address, email, telephone number, account username, and similar identifiers.
Professional and business information: pharmacy ownership or employment information, license or business details you choose to provide, business needs, event registration, professional interests, and information submitted through assessments or lead forms.
Account and transaction information: subscriptions, purchases, order history, billing details, payment status, and customer-support records. Payment card information may be collected directly by a payment processor rather than stored by us.
Internet and device information: IP address, device and browser identifiers, approximate location inferred from IP address, pages viewed, referral sources, interactions with websites or applications, and cookie or advertising identifiers.
Communications and content: emails, form submissions, chat and support messages, survey responses, webinar questions, recordings or transcripts when disclosed, reviews, testimonials, and content you choose to upload.
Event information: registration, check-in, attendance, organization, badge details, session participation, and networking preferences.
Preferences and inferences: communication choices, product interests, engagement patterns, and recommendations or customer segments derived from your interactions.
Sensitive or health-related information: only where necessary for a particular service, submitted voluntarily, or handled under a customer agreement, and subject to additional restrictions under applicable law.
We may obtain information directly from you, automatically through our Services, from employers or organizations registering you, from authorized customers, from event and marketing partners, and from vendors or publicly available professional sources as permitted by law. We do not treat a data element as anonymous merely because it lacks a name if it can reasonably be linked to a person or device.

3. How We Use Personal Information
We use personal information as reasonably necessary to:

Provide, administer, personalize, and support the Services, accounts, training, events, memberships, purchases, and subscriptions.
Process transactions, invoices, registrations, and customer-service requests.
Communicate about purchased or requested Services, service changes, security, and administrative matters.
Send marketing communications, newsletters, promotions, invitations, and partner materials when permitted by law and your choices.
Organize conferences, share eligible attendee information with disclosed sponsors or exhibitors as described in Section 6, and manage co-branded resources.
Understand usage, analyze performance, troubleshoot, develop features, and improve the Services.
Protect our Services, detect fraud or abuse, enforce agreements, and comply with legal obligations.
Carry out other purposes specifically explained when the information is collected, with consent when required.
Where consent is required, we will seek it in an appropriate form and provide a way to withdraw it, subject to legal or contractual limitations. We do not use sensitive information for an unrelated purpose without the authorization required by law.

4. Cookies, Analytics, and Advertising
Our websites and applications may use strictly necessary cookies, functional cookies, analytics tools, pixels, software development kits, and advertising technologies. Depending on the tools enabled, these may remember preferences, support security, analyze traffic, measure campaign performance, or help deliver relevant advertising on other sites.

Some advertising or analytics arrangements may be considered a “sale,” “sharing,” or “targeted advertising” under applicable U.S. state privacy laws, even when we do not receive money for the information. We will provide applicable opt-out choices and honor recognized opt-out preference signals, including Global Privacy Control, where legally required. You can manage nonessential cookies through the cookie preference banners available on our websites and request advertising opt-outs or exercise privacy rights at in**@*********rx.com. Where required, applicable sites provide an advertising opt-out mechanism and honor recognized opt-out preference signals; the availability of a cookie banner alone does not necessarily satisfy every state-law opt-out requirement. Where consent is required for nonessential cookies, we will obtain it before enabling them.

You may also control some cookies through your browser. Blocking cookies may affect the functionality of the Services. Browser “Do Not Track” signals and legally recognized opt-out preference signals are not necessarily the same.

Technologies we use: Google Analytics, Meta/Facebook Pixel, Google Ads, and GoHighLevel/LeadConnector. We use retargeting advertising based on website visitor activity. Additional cookies or vendors may appear in a site-specific cookie notice where applicable.

5. AI-Assisted Features and Automated Processing
Some Services may include automated assistance, chatbots, transcription, analytics, personalization, or AI-enabled functionality. If you use these features, information you submit may be processed by us and our contracted technology providers to deliver the requested feature, subject to applicable agreements and privacy protections.

Our AI-enabled Services may process customer conversations, uploaded files, and patient information supplied by pharmacy or healthcare-provider customers under signed Business Associate Agreements (BAAs) when HIPAA applies. We do not use customer information to train or improve our own AI models or third-party AI models. We process information to provide the requested service and through appropriately contracted providers. Do not enter patient records, protected health information, payment-card data, or other highly sensitive information into a general-purpose AI feature unless it is specifically authorized for that data and covered by appropriate agreements. Product-specific terms may explain data handling, subprocessors, and human review. We provide notices and rights for consequential automated decisions where legally required.

6. How We Disclose Information
We may disclose personal information to:

Service providers and contractors supporting web hosting, cloud storage, payment processing, communications, CRM, analytics, advertising, event management, security, and customer support, subject to appropriate contractual and legal safeguards.
Affiliated entities identified in this Policy for legitimate business operations, subject to applicable notice and consent requirements.
Professional advisers, auditors, financial institutions, and authorities when needed to operate the business, protect rights, or comply with legal requirements.
Parties involved in a business transaction, such as an actual or proposed merger, acquisition, financing, reorganization, or asset sale, subject to applicable restrictions.
Other recipients when you direct us to share information or provide legally effective consent.
Pharmacy Profit Summit sponsors and exhibitors
As disclosed at registration or through appropriate event notices and choices, we may disclose attendee contact and pharmacy/business information to selected Pharmacy Profit Summit sponsors and exhibitors for event-related follow-up. Exhibitors receive a one-time use right to follow up after the summit; sponsors may send no more than one event-related follow-up email to ticket holders. These restrictions apply to information supplied by us under the event program and should be reflected in sponsor/exhibitor agreements. Any additional marketing or processing must have its own lawful basis and comply with applicable consent and opt-out requirements, including Canadian rules. Actual data fields disclosed depend on event registration and the disclosures presented there.

Co-branded programs and requested partner materials
When you request a co-branded guide, assessment, offer, or resource, we may share the information disclosed on that form with the partner identified there so the partner can fulfill your request and provide related support. The co-branded partner is identified and the sharing is disclosed before you submit the form. Historical examples of resources included KARE, ICBN, ValueCare Suite, and StreamCare; partner participation may change. Optional partner marketing will be handled as required by law and the choices presented at collection.

No unsupported blanket promise about “sale”
We do not represent that we never “sell” or “share” personal information in the technical meaning of every applicable state law until our advertising, cookie, vendor, and sponsor arrangements are reviewed. Our final state-specific disclosures below must accurately identify practices during the preceding 12 months.

7. Email, Telephone, and Text Marketing
We send transactional and service-related notifications as well as promotional email and SMS/text messages where permitted. Our marketing forms include email and SMS consent choices and unsubscribe or opt-out options. We do not describe automated marketing calls as a current practice. You may unsubscribe from promotional emails using the link in the message or contact us at the address below. Where an automated marketing text program is offered, we will provide program-specific disclosures, obtain required consent, and honor applicable opt-out methods such as replying STOP. Consent to marketing texts is not a condition of purchase where prohibited by law. Message and data rates may apply.

For recipients in Canada, we comply with applicable requirements of Canada's Anti-Spam Legislation (CASL), including obtaining express or legally sufficient implied consent when required, identifying the sender and any person on whose behalf a commercial electronic message is sent, including required contact information, maintaining consent records, and providing an effective unsubscribe mechanism. Withdrawal of marketing consent does not prevent essential transactional or legal communications.

8. Health Information and Customer-Controlled Data
Our Companies do not directly collect patient-identifiable medical information for their own general marketing or direct-to-consumer purposes. Some AI or provider-facing Services process patient information supplied by pharmacies under signed Business Associate Agreements (BAAs), as applicable. The pharmacy or healthcare-provider customer controls the patient relationship and typically determines the permitted processing purposes. Depending on the service and legal roles, that processing may be governed by HIPAA, state consumer-health privacy laws, Canadian federal or provincial health privacy laws, or other obligations.

When acting as a HIPAA business associate, we process protected health information received from pharmacy or healthcare-provider customers pursuant to signed BAAs, applicable instructions, and law. When acting as a service provider or processor for a customer, we handle information under the customer's documented instructions and applicable law. Requests involving such information may need to be directed to the relevant healthcare provider or customer.

Not all health-related information is protected by HIPAA. We assess whether other health-data laws, including applicable U.S. consumer-health laws or the FTC Health Breach Notification Rule, govern a particular product or data set. We enter HIPAA Business Associate Agreements where applicable. The particular products, vendors, and responsibilities are addressed in applicable service agreements or supplemental notices. This general policy does not authorize sensitive data to be entered into an otherwise non-HIPAA-compliant tool.

9. Retention and Deletion
We keep personal information only for as long as reasonably necessary to provide the Services, maintain active customer relationships, meet applicable legal or contractual obligations, resolve disputes, and protect our Services. Retention depends on the category of information and why it was collected. For example, account information may remain while an account is active; event and transaction records may remain afterward for administration, legal, or accounting needs; and marketing records may be retained while consent or a permitted customer relationship remains, with suppression records kept as necessary to respect opt-outs.

Business and tax records are retained as required for applicable tax, accounting, legal, and contract purposes. AI conversations, uploaded files, and associated outputs are retained only as needed to deliver the feature, support the service, comply with legal requirements, or meet documented customer agreements. Pharmacy-supplied patient information is handled according to the applicable BAA, customer instructions, and law; it is not included in a general marketing database. Where information is no longer necessary, we delete, securely destroy, or de-identify it, subject to legal holds, backup cycles, and lawful exceptions.

We maintain a category-specific internal retention schedule and review it as practices and legal requirements evolve. Where a law requires a particular retention period or further detail, that requirement takes precedence. You may request deletion as described below; some records may need to be retained despite a request.

10. Security and Breach Response
We use administrative, technical, and physical safeguards appropriate to the nature of the information and reasonably designed to limit unauthorized access, disclosure, alteration, or destruction. No system is guaranteed secure. If a security incident triggers notification obligations, we will notify affected persons, customers, or authorities as required by the law applicable to that information and our role.

11. International and Cross-Border Processing
Based on our current service arrangements, customer information is stored and processed in the United States, including information about Canadian customers. Information processed in another country may be accessible to its courts, regulators, or law-enforcement authorities under local law. We use appropriate contractual, technical, and organizational safeguards and provide notice, assessment, or consent where required. If we begin serving Quebec or otherwise become subject to Quebec requirements, we will assess additional disclosures, transfer requirements, and French-language obligations before launching there.

12. Your Privacy Choices and Requests
Depending on where you live and the processing involved, you may have rights to request access to or a copy of your personal information; correct inaccurate information; delete certain information; withdraw consent; object to or opt out of specified processing; obtain portable data; appeal a denied request; or ask about how your information is handled.

To submit a request, email in**@*********rx.com, write to the mailing address in Section 19, or call 561-379-7750. Where required, we will also provide an accessible, dedicated online privacy-rights or advertising opt-out method on the relevant website. Please describe the request and the applicable service or brand. We may reasonably verify your identity or authority and may decline or limit a request where law permits. We respond within applicable legal deadlines. We will not unlawfully discriminate or retaliate for exercising privacy rights. Authorized agents may submit requests where permitted by law. If we deny a request and a right to appeal applies, we will explain how to appeal.

You can unsubscribe from marketing independently of submitting a privacy-rights request. For customer-controlled data, we may refer you to the customer that controls the information.

13. Additional Notice for California Residents
This section applies to California residents to the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), applies to the relevant entity and information. Statutory exemptions, including for certain HIPAA-regulated data, may apply.

Categories, sources, purposes, and recipients
Over the preceding 12 months, the information categories we may have collected, depending on the service used, are identifiers; California customer-record information; commercial information; internet or other electronic network activity; professional or employment-related information; audio, electronic, or visual information; approximate geolocation; inferences; and sensitive personal information where a relevant service requires it. The sources and business purposes are described in Sections 2–5. Recipients are described in Section 6. The specific categories actually collected, disclosed for a business purpose, sold, or shared must be confirmed for each covered entity and service before publication.

Illustrative category-level practices (subject to the information actually collected through each Service):

Categories
Purposes and disclosure
Retention criteria
Identifiers, contact, professional and business information
Account administration, events, support, marketing, service providers, and disclosed event/co-branded partners
Active relationship, requested service, then applicable legal and operational needs
Purchase, commercial and billing information
Transactions, records, payment vendors and accounting
Applicable contractual, tax and accounting periods
Internet/device activity, approximate geolocation and inferences
Security, functionality, analytics, advertising, retargeting, and platform vendors
Analytics settings, consent/opt-out choices, and operational necessity
Messages, recordings, content and uploaded files
Communications, customer support, training and requested AI/software functions
Service needs, account settings, customer contracts and legal requirements
Patient information provided by pharmacy customers
Only requested healthcare-related services under signed BAAs and customer instructions
Applicable BAA, instructions and healthcare retention laws

We disclose information to service providers and other parties as described in Section 6. For cross-context behavioral advertising, certain online identifiers and internet-activity data may be shared with advertising platforms, including Meta and Google, subject to applicable opt-out rights. The categories and disclosures that actually occurred during the preceding 12 months require periodic verification as our technologies change.

California residents may have rights, subject to exceptions, to know/access, correct, delete, and obtain information about collection and disclosure; opt out of sale or sharing; limit certain uses and disclosures of sensitive personal information; and be free from discrimination for exercising rights. Additional rights regarding certain automated decision-making may apply. To exercise rights, use Section 12 or the following links where relevant: the “Your Privacy Choices” or “Do Not Sell or Share My Personal Information” control made available on the applicable website, where legally required. We recognize applicable opt-out preference signals, including Global Privacy Control, as required by law.

California minors: We do not knowingly sell or share the personal information of individuals under age 16 without the affirmative authorization required by law.

If a promotion or loyalty offer legally qualifies as a financial incentive for personal information, we will provide the legally required separate notice and choices in connection with that offer.

Where required, we also provide a separate notice at collection on applicable forms, landing pages, or other collection points.

14. Additional Rights for Residents of Other U.S. States
Depending on the applicability of state law, residents of states including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia may have rights to access, correct, delete, obtain a copy of, or opt out of certain processing, including targeted advertising, sale, or qualifying profiling. Some laws offer consent rights for sensitive information and an appeal process. Specific rights, exemptions, verification rules, and response periods vary by state and business. We will honor valid rights and recognized opt-out preference signals where required. Requests may be made using the channels in Section 12.

Additional state privacy, biometric, breach notification, or consumer-health statutes may apply even when a comprehensive state privacy statute does not. Additional notices or consent controls may be provided for particular Services when required.

15. Additional Notice for Residents of Canada
Where Canadian privacy law applies, including the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial private-sector laws, we identify the purposes for which information is collected, seek meaningful consent when required, limit collection and use, maintain appropriate safeguards, provide access and correction procedures, and establish accountability for our handling of personal information.

You may contact the Privacy Officer below to request access or correction, withdraw consent subject to legal or contractual restrictions, or raise a complaint. We will explain how to escalate unresolved concerns, including to the Office of the Privacy Commissioner of Canada or the relevant provincial privacy regulator as applicable. Canadian information may be processed outside Canada as described in Section 11.

Quebec residents: We do not currently have customers in Quebec, but if Quebec's private-sector privacy law applies, we provide additional information about purposes and collection technologies, identify the person responsible for protecting personal information, and honor applicable access, rectification, withdrawal, de-indexing, and data portability rights. We conduct privacy impact assessments and implement default privacy settings and consent mechanisms where legally required. Dr. Lisa Faast is the privacy contact identified in Section 19. Additional French-language notices may be required before operating in Quebec.

Alberta, British Columbia, and provincial health privacy laws: We will comply with applicable provincial private-sector or health-sector privacy duties to the extent they govern a particular activity. This Policy is not intended to override additional provincial notices or patient rights.

16. Children and Minors
Our websites, products, professional education, memberships, and events are intended for adults age 18 and older, and we do not knowingly collect personal information from minors. For Canadian minors and older U.S. teenagers, applicable age-specific consent and privacy protections may differ. If you believe a child has provided information inappropriately, contact us so we can review and take appropriate action.

17. Public Content, Third-Party Links, and Integrations
Content you post in public groups, discussions, reviews, or event forums may be visible to others. Avoid publicly posting confidential business, patient, or personal information. Third-party websites and services linked from our Services may have their own privacy policies. Their independent activities are not governed by this Policy, except to the extent we are legally responsible for our own disclosures or integrations.

18. Changes to This Policy
We may update this Policy as our Services, practices, or legal requirements change. We will update the “Last Updated” date and provide additional notice or seek consent where required for material changes. Archived versions may be available upon request where required.

19. Contact Us and Privacy Officer
Privacy Officer / Privacy Contact: Dr. Lisa Faast
Email: in**@*********rx.com
Telephone: 561-379-7750
Mailing address: 3309 Ferguson Rd, Southlake, Texas 76092, United States
Covered entities: Lisa Faast Membership; Lisa Faast Events; Lisa Faast Education; DiversifyRx Consulting
Covered DBAs: DiversifyRx; Pharmacy Profit Summit; Pharmacy Badass University

Submit privacy requests using the email, phone, or postal address above. You may also use privacy and cookie controls available on the relevant websites.