Privacy Policy

This policy explains how GOODNCO collects, uses, shares, and protects information when you visit our website, complete an intake, contact support, or buy non-prescription products from our shop.

It does not govern the separate privacy practices of the licensed provider group that treats you. That group publishes its own notice, and our HIPAA Notice of Privacy Practices explains how it applies.

GOODNCO is a wellness and telehealth platform. GOODNCO does not practice medicine, does not diagnose, and does not decide what treatment you receive.

When you complete an intake, we collect your answers and transmit them to a clinical platform operated for a licensed provider group. Licensed providers on that platform make every clinical decision and are the system of record for your health record. For that health information, GOODNCO acts as a service provider to the provider group and handles it under that group’s instructions.

Some services described below — shop checkout and paid treatment plans — are not yet open. Their data practices apply when those services launch.

• Identity and contact information: name, email address, phone number, date of birth, and shipping or billing address.
• Intake answers: the health questions you answer to be considered for care. Some product paths may ask for photos in the future; today no photo is uploaded from this site.
• Order information: items requested, order status, and support correspondence.
• Payment information: card details are entered directly into our payment processor’s hosted fields and tokenized by that processor. GOODNCO does not receive or store full card numbers.
• Device and usage information: IP address, browser type, pages viewed, referring page, and interactions with the site.
• Communications: the content of messages you send to support.

We collect information you give us directly through forms, intake, and support email; information collected automatically as you use the site through cookies and server logs (our analytics code is inactive today — see the Cookies section below); and information our service providers give us about the status of an order or a payment. When shipping opens, carriers will provide shipment status.

• Operate the site and the intake experience.
• Transmit your intake to the clinical platform so a licensed provider can review it.
• Verify eligibility details, including age and shipping address validity.
• Process and support orders for non-prescription products once shop checkout opens.
• Answer support requests.
• Today we do not run site analytics — our analytics code is inactive. If we turn it on, we will update this policy first and use it only to measure and improve the site, in the aggregate.
• Today we do not send service or marketing messages by email or text message. If we start — for example, an order update or a change to our policies — we will update this policy first, and any marketing message will only go to someone who opted in and will always include a way to opt out.
• Detect fraud and abuse, secure our systems, and comply with law.

• With the licensed provider group and its clinical platform, so a clinician can review your intake and treat you.
• With service providers working on our behalf under contract: hosting, our payment processor, and address validation. If we add other service providers — for example, email delivery, shipping carriers, analytics, or error monitoring — we will update this policy first. Any service provider we use may use the information only to perform services for us.
• With you, or at your direction.
• For legal reasons: to comply with law, a subpoena, or a lawful government request, to enforce our terms, or to protect the rights, safety, and property of GOODNCO, our users, or others.
• In a business transfer, in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.

GOODNCO does not sell your intake answers, health information, or photographs, and does not share them for cross-context behavioral advertising. Health answers are not sent to analytics or advertising tools.

Health information you provide for clinical review is protected health information held by the licensed provider group that treats you, and that group’s Notice of Privacy Practices governs it. GOODNCO handles that information as a business associate or service provider under a written agreement and uses it only to perform the services described in that agreement.

Information you give GOODNCO outside a care path — a shop order or a general support email, for example — is not protected health information and is governed by this policy.

Today GOODNCO sets only strictly necessary cookies — the ones needed to operate the site’s basic functions. We do not set advertising cookies. Our analytics code is inactive: it is a no-op until an analytics vendor is wired in, so no analytics cookies are set either.

If GOODNCO ever turns on analytics or advertising cookies, we will update this policy first and, where the law requires it, offer you a choice before setting them. For now, your browser settings control cookies on this site; blocking strictly necessary cookies may break parts of the site.

• Marketing email and text messages: today we do not send marketing email or text messages. If we start, every message will include a way to opt out, and you can also write to support at any time.
• Cookies: use your browser settings to manage cookies; see the Cookies section above for what we currently set.
• Your data: ask us to access, correct, or delete information GOODNCO holds about you. For requests about your medical record, we forward by email to the licensed provider group, which is the system of record.

If you are a California resident, you have the right to know the categories and specific pieces of personal information we collect, the sources, the business purposes, and the categories of third parties we disclose to; to request correction; to request deletion; to opt out of sale or sharing; to limit the use of sensitive personal information; and to be free from discrimination for exercising these rights.

• Categories collected: identifiers, customer records, commercial information, internet and network activity, coarse location inferred from IP address, and — where you complete an intake — health information treated as sensitive personal information.
• Sale or sharing: we do not sell personal information and do not share it for cross-context behavioral advertising.
• Sensitive personal information: used only to provide the services you asked for and for purposes the regulations permit.
• Submitting a request: write to support with enough detail to verify you against information we already hold. An authorized agent may submit a request with your written permission.
• Timing: California law requires a business to confirm receipt of a request within 10 business days and to respond within 45 days (extendable once by 45 days with notice). Send requests to support@goodnco.com; we handle them by email until an automated request system exists.
• Global Privacy Control: we do not yet detect Global Privacy Control browser signals. We will honor them when that capability is in place, and this policy will say so.

Residents of other states with comprehensive privacy laws may have similar rights of access, correction, deletion, portability, and opt-out, including the right to appeal a denied request. Use the same contact address to exercise them; we will honor them where the law applies; send requests to support@goodnco.com.

We use administrative, technical, and physical safeguards matched to the sensitivity of the information: encryption in transit, access controls, least-privilege administrative access, server-side handling of privileged credentials, and logging that excludes health answers. No method of transmission or storage is perfectly secure, and we cannot promise absolute security.

Specific retention periods are pending counsel review. Interim rules apply now:

• Intake data: passed to the licensed provider group’s clinical platform and not retained by GOODNCO beyond what is needed to deliver it.
• Contact and support data: kept while our relationship with you is active, and afterward for the period the law requires.
• Medical records: retained by the licensed provider group under the retention periods that apply to it, not by GOODNCO.

The site and services are for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we delete it.

We may update this policy. We post the updated version with a new last-updated date and, where the law requires it, give additional notice.

Email support@goodnco.com. Please do not include health details, payment card numbers, or passwords in email.