Privacy policy

Last updated: October 13, 2025

Kitch Pharmacy is a Texas-licensed pharmacy serving patients located within the State of Texas.

We currently dispense and ship prescription medications and compounded prescriptions only within Texas, in accordance with Texas State Board of Pharmacy regulations.

Over-the-counter products, vitamins, and supplements available through our online store (kitchpharmacy.com) are available for purchase throughout the United States, excluding jurisdictions where such products are restricted by law.

This information is publicly available on our website under the “Terms of Service” and “Privacy Policy” sections.

Kitch Pharmacy (“Kitch Pharmacy,” “we,” “our,” or “us”) operates this website, online store, and related services (collectively, the “Services”) to provide pharmacy, wellness, and e-commerce experiences, including the purchase of prescriptions, supplements, and other health-related products. This Privacy Policy & Notice of Privacy Practices (“Policy”) explains how we collect, use, disclose, and protect your information—covering both general personal information and Protected Health Information (“PHI”) under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). By accessing or using the Services, you acknowledge that you have read and understood this Policy.

Scope and Relationship to Other Terms
If any conflict exists between our Terms of Service and this Policy as it relates to the collection, processing, and disclosure of your information, this Policy controls.
Information We Collect
We collect two categories of information:

A. Personal Information (Non-PHI): Depending on how you interact with the Services, this may include: contact details (name, address, phone, email); account information (username, password, preferences, security questions); order and payment information (billing/shipping details, payment confirmations, purchase history); device and usage data (IP address, browser type, device identifiers, pages visited, interactions); and communications you send to us (including customer support requests, reviews, referrals, loyalty programs, and gift cards).

B. Protected Health Information (PHI): When you request prescription fills, compounding, pharmacy clinical services, or pharmacist consultations, we collect and create information that identifies you and relates to your past, present, or future physical or mental health, the provision of care, or payment for that care. This information is PHI and is handled in accordance with HIPAA.

Sources of Information
We collect information: (i) directly from you (e.g., account creation, orders, forms, consultations); (ii) automatically through cookies, pixels, and similar technologies when you use our Services; (iii) from service providers that help us operate the Services (e.g., hosting, payments, shipping, analytics, support); and (iv) from healthcare professionals involved in your treatment as permitted by HIPAA.
How We Use Your Information
We use personal information and, where applicable, PHI to:
• Provide, operate, fulfill, and improve the Services and pharmacy care;
• Dispense prescriptions, process orders, coordinate care, and provide customer support;
• Verify identity, maintain accurate pharmacy records, and prevent fraud;
• Communicate with you about care, refills, safety notices, orders, accounts, or policy updates;
• Conduct analytics and quality improvement;
• Send marketing or educational materials for non-PHI data (you can opt out); and
• Comply with legal, regulatory, and reporting obligations.
We do not sell PHI or use PHI for marketing without your written authorization.
How We Disclose Information
A. Disclosures involving PHI (HIPAA): We may use and disclose PHI as follows:
• Treatment: To dispense prescriptions and coordinate your care with your prescribers and other healthcare professionals.
• Payment: To bill and receive payment from you or your health plan for services.
• Health Care Operations: For quality assessment, training, audits, compliance, and customer service.
We may also disclose PHI as permitted or required by law (e.g., to prevent disease; for product recalls and adverse event reporting; suspected abuse, neglect, or domestic violence; public health; organ/tissue donation; research under applicable rules; workers’ compensation; law enforcement or other government requests; health oversight; national security; court orders, subpoenas, or other legal processes). We will not use or disclose PHI for marketing, fundraising, or sale of information without your written authorization. If you authorize a use or disclosure of PHI, you may revoke your authorization in writing at any time, except to the extent we have already relied on it.

B. Disclosures involving Personal Information (Non-PHI): We may disclose personal information (not PHI) to:
• Service providers (e.g., website hosting, payment processing, fulfillment/shipping, IT and security, analytics, customer support) under contracts that require confidentiality and appropriate safeguards;
• Business and marketing partners for limited advertising and analytics (excluding PHI);
• Our affiliates or within our corporate group;
• Third parties at your direction (e.g., shipping carriers) or with your consent;
• Government authorities, courts, or law enforcement to comply with legal obligations or protect our rights or the rights and safety of others; and
• Parties to a business transaction (e.g., merger or acquisition), subject to appropriate protections.

HIPAA: Your Rights and Our Responsibilities
Your HIPAA Rights: You have the right to (i) get an electronic or paper copy of your pharmacy record and other PHI we maintain about you (we will provide it within 30 days and may charge a reasonable, cost-based fee); (ii) request corrections to your PHI if you believe it is incorrect or incomplete (we may deny requests and will explain our reasoning in writing within 60 days); (iii) request confidential communications (e.g., alternative address or phone number), which we will honor if reasonable; (iv) request restrictions on certain uses or disclosures of PHI (we are not required to agree except where you pay out-of-pocket in full for an item or service and request that we not share that PHI with your health plan unless required by law); (v) receive an accounting of disclosures of PHI for six years prior to your request (excluding routine disclosures for treatment, payment, and operations and certain other disclosures); (vi) receive a paper or electronic copy of this Notice; and (vii) file a complaint if you believe your HIPAA privacy rights have been violated. We will not retaliate against you for filing a complaint.

Our HIPAA Responsibilities: We are required by law to maintain the privacy and security of your PHI; limit uses, disclosures, and requests of PHI to the minimum necessary for the purpose; provide this Notice; and promptly notify you following a breach of unsecured PHI. We will not use or share your PHI other than as described in this Policy unless you authorize us in writing. You may revoke your authorization at any time in writing.

How to Exercise HIPAA Rights or Submit a HIPAA Complaint:
Privacy Official: Dr. Kristine Isaacson, PharmD
Kitch Pharmacy, 10501 Quaker Ave, Suite 300, Lubbock, TX 79424
Email: wellness@kitchpharmacy.com | Phone: (806) 370-6935
You may also contact the U.S. Department of Health and Human Services, Office for Civil Rights (www.hhs.gov/ocr/privacy/hipaa/complaints, 200 Independence Avenue SW, Washington, DC 20201, 1-877-696-6775).

Business-Associate Agreements and Where PHI Is Stored
Any patient health information related to prescription information is not stored on Shopify. PHI associated with pharmacy services (e.g., prescriptions, clinical notes, counseling records) is maintained in systems and with partners operating under HIPAA Business-Associate Agreements (BAAs) that require appropriate administrative, physical, and technical safeguards. We ensure that vendors handling PHI are bound by BAAs and adhere to HIPAA requirements. Non-PHI e-commerce data for supplements and general retail purchases may be processed through Shopify and related processors as described below.
Relationship with Shopify (Non-PHI)
Our storefront is hosted by Shopify. Shopify may process certain personal information (not PHI) relating to your use of the Services (e.g., device identifiers, IP address, order details) to operate the storefront, process payments, provide fraud screening, and maintain secure checkout. Shopify may use automated decision-making (risk scoring) to flag potentially fraudulent transactions; flagged orders may be reviewed by our staff before action is taken. We do not store full credit card numbers. For more information about Shopify’s privacy practices, please refer to the Shopify Consumer Privacy Policy and Shopify Privacy Portal. To access, correct, delete, or export data held by Shopify on our behalf, contact us at wellness@kitchpharmacy.com.
Cookies and Tracking Technologies (Non-PHI)
We use cookies and similar technologies (including pixels, scripts, and web beacons) to support site functionality, secure checkout, analytics (e.g., traffic and usage patterns), and advertising. These technologies may collect IP address, device and browser information, pages viewed, and interactions. Some cookies are essential; others are for performance, analytics, or marketing. You can control cookies through your browser settings and, where offered, our on-site preferences banner. Blocking cookies may limit certain features.
Marketing and Advertising (Non-PHI)
We may use limited personal information (not PHI) to send marketing and educational communications, display relevant ads, and measure campaign performance. You can opt out of promotional emails at any time by clicking “unsubscribe” or contacting wellness@kitchpharmacy.com. We do not use or disclose PHI for marketing without your written authorization, and we do not sell PHI. We do not sell your personal information for monetary value. We may “share” limited non-PHI data with advertising partners to provide targeted advertising consistent with applicable law and your preferences.
Security Measures and Data Retention
We use administrative, technical, and physical safeguards designed to protect your information. Our site uses HTTPS/SSL. Sensitive payment data is processed by PCI-compliant providers (e.g., Shopify Payments), and we do not store full credit card numbers. PHI is handled under HIPAA, safeguarded by BAAs, and retained as required by pharmacy and health-care regulations. Non-PHI account and order information is retained for as long as necessary to provide Services, comply with legal obligations, resolve disputes, and enforce agreements. No security system is perfect; if you believe your account or information has been compromised, contact us immediately.
Your General Privacy Rights (Non-HIPAA)
Depending on your jurisdiction, you may have rights to: access/know, correct, delete, or port your personal information; opt out of certain sharing or targeted advertising; and manage communication preferences. To exercise these rights, contact wellness@kitchpharmacy.com or write to us at the address in Section 6. We may need to verify your identity (and, if acting through an authorized agent, confirm the agent’s authority). We will not discriminate against you for exercising these rights. Where supported, if you visit our site with a valid Global Privacy Control (GPC) signal enabled, we will treat that as a request to opt out of certain “sharing” or “selling” under applicable law for that browser and device.
Children’s Privacy
Our Services are not intended for minors. We do not knowingly collect personal information from children. If you believe we have collected a child’s information, contact us so we can delete it.
International Data Transfers
If you access our Services from outside the United States, your information may be transferred to, stored, or processed in the U.S. or other countries with different data protection laws. Where required, we use appropriate safeguards (e.g., Standard Contractual Clauses) for international transfers of non-PHI personal information.
Changes to This Policy
We may update this Policy from time to time to reflect changes in our practices, technologies, or legal requirements. When we make changes, we will post the updated Policy on our site, update the “Effective Date,” and provide additional notice where required by law. For HIPAA material changes, we will issue a revised Notice of Privacy Practices that applies to PHI we maintain.
Contact Information and Privacy Official
Privacy Official: Dr. Kristine Isaacson, PharmD
Kitch Pharmacy
10501 Quaker Ave, Suite 300
Lubbock, TX 79424
Email: wellness@kitchpharmacy.com
Phone: (806) 370-7311

For HIPAA complaints, you may also contact the U.S. Department of Health and Human Services, Office for Civil Rights: www.hhs.gov/ocr/privacy/hipaa/complaints, 200 Independence Avenue SW, Washington, DC 20201, 1-877-696-6775.