TEOS — PRIVACY POLICY
Teos Health, LLC
in collaboration with Teos Physician Group, PLLC
Effective: August 27, 2026
Last Updated: October 30, 2026
This Privacy Policy ("Policy") describes how Teos Health, LLC (“Teos Health”) and Teos Physician Group, PLLC (the "Medical Group"), together referred to as "Teos," “we,” “our,” or “us,” collect, use, share, and protect information when you visit our website, use our mobile applications, or interact with the Teos platform. When this Policy refers to "you" or "your," it means you as the individual using the Services.
This Policy covers information practices broadly — including personal information that is not protected health information ("PHI"). For information about how the Medical Group uses and discloses your PHI as a HIPAA-covered entity, please see our Notice of Privacy Practices, available at https://teoshealth.com/hipaa.html and provided to you at enrollment. The Notice of Privacy Practices governs whenever it applies; in the event of a conflict between this Policy and the Notice of Privacy Practices regarding PHI, the Notice of Privacy Practices controls.
By using the Services, you agree to the collection and use of information as described in this Policy. If you do not agree with our information practices, please do not use the Services. This Policy is part of, and incorporated into, our Terms of Service.
Teos is a membership-based, cash-pay telemedicine practice that currently serves adults located in Texas. It comprises two affiliated entities:
Teos Health, LLC is a Texas limited liability company that owns and operates the Teos website, mobile applications, and technology platform (collectively, the “Platform”) and provides administrative, billing, technology, and support services. Teos Health is a business associate of the Medical Group under HIPAA.
Teos Physician Group, PLLC is a Texas professional limited liability company that provides all clinical and professional medical services through the Platform (the “Medical Services”) by Texas-licensed physicians. The Medical Group is a covered entity under HIPAA.
The Platform and the Medical Services together constitute the “Services.”
Account Information. When you create an account, we collect your name, email address, date of birth, phone number, mailing address, and payment information.
Clinical Information. When you use the Medical Services, you provide medical history, symptoms, photographs, and other health information. This information is PHI and is governed by the Notice of Privacy Practices, not this Policy.
Identity Verification. We may collect government-issued identification information, photographs, or other information reasonably necessary to verify your identity, eligibility, and age.
Communications. When you contact us — for example, by email, chat, or phone — we collect the content of those communications.
Survey and Feedback Data. If you respond to surveys, provide reviews, or submit feedback, we collect the information you share.
Device and Browser Information. We collect information about the device, browser, and mobile application you use to access the Services, including device type, operating system, browser type and version, device identifiers, app identifiers, screen resolution, and approximate location derived from your IP address.
Usage Data. We collect information about how you interact with the Services, such as the pages you visit, features you use, the date and time of your visits, and the referring URL.
Marketing Attribution Data. If you reach the Services through an advertisement or a marketing link, we record the campaign tags in that link, such as UTM parameters, and any advertising click identifier the ad platform added to it. We use this to understand which campaigns bring people to the Services. If you later create an account, we link this information and your earlier visits to your account.
Log Data. Our servers automatically record information when you access the Services, including your IP address, access times, and system activity.
Cookies and Similar Technologies. We use cookies, pixels, software development kits, and similar technologies to recognize your browser or device, remember your preferences, and understand how you use the Services. See Section 12 (Cookies and Tracking Technologies) for details.
We may receive information about you from third-party services you connect to your account, from payment processors for transaction verification, from identity verification providers, from analytics providers, and from laboratories, pharmacies, or other providers involved in your care as permitted by law. We do not purchase data broker lists or buy personal information from third parties for marketing purposes.
We use the information we collect to:
Provide and operate the Services — create and manage your account, process payments, facilitate scheduling, and deliver the platform features described in our Terms of Service.
Support your care — coordinate administrative aspects of your care, send appointment reminders, deliver encounter updates, and communicate with you about the Services. (Clinical uses of PHI are governed by the Notice of Privacy Practices.)
Process payments — charge membership fees, encounter fees, and other amounts you authorize, and provide receipts and billing statements.
Improve the Services — analyze usage trends, diagnose technical problems, develop new features, conduct internal research and analytics, and improve Platform functionality, user experience, and our products and services, including training and developing our artificial intelligence software. Any use of health information for AI training or development is limited to de-identified or aggregated information in accordance with the Notice of Privacy Practices and applicable law.
Ensure security and prevent fraud — detect, investigate, and prevent unauthorized access, fraud, and other illegal activities, and protect the rights and safety of Teos and our users.
Communicate with you — respond to your inquiries, provide customer support, and send you administrative notices (such as changes to this Policy or our Terms of Service).
Comply with legal obligations — meet our obligations under applicable federal, state, and local laws.
Send marketing communications — with your prior express written consent where required and subject to the conditions described in Section 12.4 of our Terms of Service. We do not use PHI for marketing without authorization where HIPAA requires it. You may opt out at any time.
Authentication – authenticate users and enforce access controls.
We do not sell your personal information. We share information only as described below:
Between Teos entities. Teos Health and the Medical Group share information as necessary to operate the Services and provide your care, under the terms of a Business Associate Agreement.
Service providers. We share information with third-party vendors who perform services on our behalf — such as payment processing, cloud hosting, email delivery, identity verification, customer support, security monitoring, and analytics — under contracts that require them to protect your information and use it only for the services they provide to us. We do not permit service providers to use PHI for their own advertising or unrelated commercial purposes.
Laboratories and pharmacies. When a Medical Group physician orders lab tests or prescriptions, we share the information necessary to fulfill those orders. Sharing of PHI for treatment purposes is governed by the Notice of Privacy Practices.
Legal requirements. We may disclose information when we believe in good faith that disclosure is required by law, regulation, legal process, or governmental request, or is necessary to protect the rights, property, or safety of Teos, our users, or the public.
Professional advisers. We may share information with our attorneys, auditors, accountants, insurers, and other professional advisers when reasonably necessary for corporate governance, compliance, risk management, or legal purposes.
Business transfers. In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred to the successor entity, subject to applicable law regarding medical practices and medical records.
With your consent. We may share information for purposes not described in this Policy with your consent.
De-identified, aggregated, and anonymous information. We may create and use de-identified, aggregated, or anonymized information — information that can no longer reasonably identify you, prepared in accordance with HIPAA's de-identification standards — for research, analytics, quality improvement, service improvement and development, and any other lawful business purpose. Once properly de-identified, such information is no longer PHI and is not subject to this Policy, and therefore may be shared with third parties, including Health Information Exchanges’. De-identification and any subsequent use or disclosure comply with Texas Health & Safety Code §181.153, which prohibits re-identification of de-identified health information.
Texas law, including the Texas Medical Records Privacy Act (Texas Health & Safety Code Chapter 181), provides protections for your health information that supplement federal law. The following provisions apply:
Electronic disclosure notice (§181.154). We use electronic systems to store, process, and transmit information in the course of providing the Services. We maintain administrative, technical, and physical safeguards that comply with the HIPAA Security Rule and the HITECH Act. We will obtain your authorization before making electronic disclosures of your PHI except for disclosures made for treatment, payment, or healthcare operations, or as otherwise permitted or required by law.
Prohibition on re-identification (§181.153). We do not re-identify de-identified health information, and we contractually require the same of our service providers and business associates.
Access to electronic health records (§181.102). You are entitled to receive a copy of your electronic health records within fifteen (15) days of your request, as described more fully in the Notice of Privacy Practices.
No waiver of rights. Nothing in this Policy limits your rights under the Texas Deceptive Trade Practices–Consumer Protection Act (Texas Business & Commerce Code Chapter 17) to the extent it applies.
Teos uses AI tools and software as part of the Services. This section describes how Teos collects, uses, and processes personal information in connection with its AI-powered features. This section supplements the other provisions of this Policy and should be read together with them. To the extent personal information constitutes PHI governed by HIPAA, the BAA and HIPAA regulations control.
We use artificial intelligence tools to process your personal information for the following purposes:
Symptom intake, triage, and care navigation. To ask intake questions, gather information about your symptoms, and help route you to the appropriate level of care within the Services.
Clinical decision support. To help summarize your information and draft clinical documentation to assist your treating physician. Any resulting assessment, diagnosis, or treatment plan is reviewed and determined by a licensed physician at the Medical Group, not the AI feature.
Responding to health-related questions. To generate responses to general health-related questions you ask through the Services.
Administrative functions. We use AI tools to support scheduling, appointment reminders, and other administrative aspects of the Services.
Improving our AI tools. We use de-identified or aggregated information to evaluate, train, and improve the performance and accuracy of the AI tools.
Fraud prevention and security. We use AI tools to help detect, investigate, and prevent fraud, unauthorized access, and other security risks.
Legal compliance. We use AI tools as necessary to comply with applicable laws and regulations.
AI Model Training. Teos does not use your identifiable personal health information to train generalized or foundation AI models. We use personal health information for AI model training or improvement only after it has been de-identified in accordance with applicable law, including HIPAA’s de-identification standards, and we maintain controls designed to prevent re-identification.
AI is not a licensed provider. The AI tools support — but do not replace — the independent clinical judgment of your treating physician. No AI tool used by Teos makes a final diagnosis, prescribes treatment, or takes other clinically significant action without review by a licensed physician. All clinical decisions are made by a physician exercising independent medical judgment. The AI features are assistive tools only and do not replace professional clinical judgment. We do not use names, titles, or design elements for the AI tools that imply the AI holds a healthcare license or professional credential. All AI-generated outputs may contain errors, omissions, or inaccuracies and are not guaranteed to be correct or complete.
Fairness and Non-Discrimination. We are committed to designing and using AI tools in a manner that avoids unlawful discrimination. We monitor and evaluate our AI tools to help identify and mitigate bias based on race, color, national origin, sex, age, disability, or other legally protected characteristics.
As a Texas resident, the Texas Data Privacy and Security Act, Tex. Bus. & Com. Code Ch. 541 (the "TDPSA"), grants you certain rights regarding personal data we collect that is not governed by HIPAA or other applicable exemptions. To the extent applicable, you may exercise the following rights:
Access. Request confirmation of, and access to, the personal information we hold about you.
Deletion. Request deletion of your personal information, subject to applicable exceptions.
Correction. Request correction of inaccurate personal information.
Portability. Request a copy of your personal information in a portable format.
Opt-out rights. Opt out of the sale of your personal information, targeted advertising, and certain profiling in furtherance of decisions that produce legal or similarly significant effects. Teos does not sell personal information and does not use your information for targeted advertising.
Limiting use of sensitive personal information. Request that we limit our use of sensitive personal information to purposes necessary to provide the Services.
Non-discrimination. We will not discriminate against you for exercising any of these rights.
To exercise any of these rights, please contact us at privacy@teoshealth.com. You may also use an authorized agent or representative where permitted by law, but we may require information to verify the request and the agent’s authority. We will respond within forty-five (45) days, with one (1) possible forty-five (45) day extension if necessary. We may need to verify your identity before completing your request.
If we deny your privacy rights request, you may appeal by emailing privacy@teoshealth.com with “Privacy Rights Appeal” in the subject line. We will respond to your appeal in writing within sixty (60) days. If your appeal is denied, you may contact the Texas Attorney General.
Sensitive Data. We will not process your sensitive personal data—such as data revealing racial or ethnic origin, religious beliefs, health diagnosis, sexuality, citizenship or immigration status, genetic or biometric data, or precise geolocation data—without first obtaining your consent, unless an exemption applies. You may withdraw consent where required by applicable law, subject to legal and operational limits.
Scope. This section does not apply to protected health information governed by HIPAA or other data exempt under Tex. Bus. & Com. Code § 541.003. For rights concerning your protected health information, please refer to our Notice of Privacy Practices.
We retain your personal information for as long as your account is active or as needed to provide the Services, and afterward for as long as necessary to comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods include:
Medical records: The Medical Group retains medical records for not less than seven (7) years from the date of last treatment (or until a minor patient reaches age twenty-one (21), whichever is later), as required by Texas law (22 TAC §165.1(b)).
Account and billing records: Retained for the duration of your membership and for seven (7) years after the end of your last membership term, for tax, audit, and legal compliance purposes.
Usage and analytics data: Retained in identifiable form for no more than twenty-four (24) months after collection, after which it is aggregated or deleted.
When retention is no longer required, we securely delete or de-identify your information.
We implement administrative, technical, and physical safeguards designed to protect your information, consistent with the HIPAA Security Rule and industry standards. These include encryption of data in transit and at rest, access controls, audit logging, workforce training, and regular security assessments. While no system is perfectly secure, we are committed to protecting your information and will notify you of any breach as required by law.
In accordance with applicable law, Teos maintains a reasonable data security program that includes: (i) administrative safeguards, such as designating employees responsible for the security program, conducting risk assessments, training personnel on data security practices, and selecting service providers capable of maintaining appropriate security measures; (ii) technical safeguards, such as encryption of personal information in transit and at rest, access controls limiting data access to authorized personnel, monitoring systems to detect unauthorized access or anomalous activity, and secure software development practices; and (iii) physical safeguards, such as secure facilities and infrastructure for data storage, disposal procedures for physical records containing personal information, and controls on physical access to systems that store personal information. Teos reviews and updates its security program on an ongoing basis to address new and evolving risks.
In the event of a security breach that compromises the security, confidentiality, or integrity of personal information, Teos will investigate and contain the incident promptly upon discovery. Teos will also notify affected individuals, organizations, and regulators as required by applicable federal and state breach notification laws, including HIPAA (45 CFR Part 164, Subpart D). In the event of a breach affecting a large number of users, Teos may supplement direct notice with a prominent notice on its website or Platform. Breach notifications will describe the nature of the breach, the categories of information affected, the steps Teos has taken to address and remediate the breach, and the steps individuals can take to protect themselves. Where required by applicable law, Teos will notify relevant state attorneys general and other applicable regulatory authorities.
We use the following categories of cookies and similar technologies:
Strictly necessary cookies are required for the Services to function — for example, to keep you logged in and to process transactions. These cannot be disabled.
Functional cookies remember your preferences — such as language or display settings — to provide a more personalized experience.
Analytics cookies help us understand how visitors interact with the Services so we can improve them. We use privacy-respecting analytics tools that do not build cross-site profiles of our users, and we configure analytics tools to avoid collecting clinical content or PHI where reasonably practicable.
We do not use advertising or behavioral-tracking cookies, and we do not use cookies or similar technologies for cross-context behavioral advertising. We do not allow third-party advertising networks to place cookies on the Services. We do not respond to Do Not Track (DNT) signals because there is no industry-accepted standard for DNT, but our practices already reflect DNT principles — we do not track users across third-party websites.
You can control cookies through your browser settings. Disabling strictly necessary cookies may prevent parts of the Services from functioning.
The Services are for adults aged eighteen (18) and older. We do not knowingly collect personal information from anyone under eighteen (18). If we learn that we have collected personal information from a person under 18, we will delete it promptly. If you believe we have information from or about a child, please contact us at privacy@teoshealth.com.
Access and correction. You may access and update your account information at any time through your account settings or by contacting support@teoshealth.com. For access to your medical records, see the Notice of Privacy Practices.
Deletion. You may request deletion of your account and personal information by emailing privacy@teoshealth.com. We will honor your request to the extent permitted by law, noting that medical records are subject to legally required retention periods.
Marketing opt-out. You may opt out of marketing communications at any time by using the unsubscribe link in any message or emailing support@teoshealth.com. Opting out of marketing does not affect treatment-related or administrative communications.
Cookies. You may control cookies through your browser settings as described in Section 12.
The Services may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to read the privacy policy of any website you visit.
We may update this Policy from time to time, in which case we will update the "Last Updated" date above. For material changes, we will provide reasonable advance notice — such as by email or a prominent notice in the Platform — before the changes take effect. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.
If you have questions about this Privacy Policy or our data practices, you may contact us at:
Teos Health, LLC — 500 East 4th Street, Suite 235, Austin, Texas 78701
Teos Physician Group, PLLC — 500 East 4th Street, Suite 235, Austin, Texas 78701
Privacy Officer: Jason Hallock, MD — privacy@teoshealth.com
Support: support@teoshealth.com
Legal: legal@teoshealth.com
Teos is a membership-based medical practice, not health insurance. Medical Services are provided by Teos Physician Group, PLLC through physicians licensed in Texas. © 2026 Teos Health, LLC. All rights reserved.
Form TEOS-PP-001 (Rev. 08/2026)
© 2026 Teos Health, LLC and Teos Physician Group, PLLC