Skip to main content
MAGNUSRX
Sign inStart visit

Privacy Policy

Effective date: October 31, 2026. Last updated: October 31, 2026.

1. Who we are and what this policy covers

Obsidian Research Group, Inc. (ORG) operates MagnusRX at magnusrx.org. This policy covers our website, accounts, order coordination and related communications. ORG is not a medical provider. Beluga Health, P.A. supplies licensed clinicians and maintains the clinical system of record. Licensed pharmacies dispense prescriptions.

Beluga and pharmacies have their own privacy duties and notices. See Beluga Health's Privacy Policy for clinical care. Where we handle protected health information on a provider's behalf, applicable HIPAA duties and our agreements govern that handling. Not all website information is covered by HIPAA.

Our separate Consumer Health Data Privacy Policy describes consumer health data under Washington's My Health My Data Act. We apply the California Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA), CalOPPA, and Connecticut and Nevada privacy protections to the practices described here. We do not rely on a business-size or HIPAA exemption to deny the state privacy rights described in this policy.

2. Information we collect and why

  • Account and contact information: name, email, phone number, birth date, sex, address, login credentials and account preferences. We use it to create and secure your account, check service eligibility, communicate with you and coordinate orders.
  • Health and care information: treatment choices, symptoms, medical and treatment history, medications, allergies, questionnaire and follow-up answers, and information such as height, weight and lab information when relevant. We process this information to send your visit to Beluga, support clinician review and coordinate the service you request.
  • Photos and documents: a government-ID photo and any requested lab images, prescription-label photos or other intake images. We process and forward these uploads to Beluga without saving the image files in our database. Separately, we store signed prescription documents when needed for pharmacy fulfillment and lab requisition documents so you can access them.
  • Care and fulfillment records: consent records, visit and appointment status, prescriptions, clinician and pharmacy details, lab-order status, shipment and tracking information. We receive these from Beluga and pharmacies. Structured lab results are fetched from Beluga when you view them rather than kept as a separate results archive.
  • Messages: messages you send to support or your care team, and their replies. Text chat and support messages may be stored. Clinical chat goes through Beluga. Do not send medical records, ID photos, passwords or full payment details in ordinary support email.
  • Payment and subscription information: Stripe processes your payment details. We receive and keep payment references, amounts, status and subscription/plan records, not full card numbers. Stripe also receives your name, email, account identifier and transaction information.
  • Website, referral and device information: IP/network information, browser information, referring links, page interactions, cookie identifiers and campaign/referral codes. We use these to operate and protect the site and measure referrals and marketing. Referral and campaign records can be linked to signups, subscriptions and revenue. A treatment page you visit may reveal or suggest a health interest.

California category and disclosure summary

The collection categories above correspond to the following California categories. Purposes are described above and retention criteria are in section 5. Recipients receive only the information relevant to their roles; an entry does not mean that every recipient receives every field.

  • Identifiers and customer records: name, contact details, address, account/cookie IDs and payment/service records; disclosed to hosting/security providers and, as needed, Beluga, pharmacies, laboratories, fulfillment providers, SES and Stripe. Google receives online identifiers; LegitScript receives normal network/browser request information.
  • Protected characteristics and health information: age/birth date, sex and health or sexual/reproductive information provided for care; disclosed to hosting providers, Beluga and the clinical, pharmacy or lab partners needed for the requested service.
  • Commercial information: selected services, transactions, subscriptions and fulfillment; disclosed to hosting providers, Stripe and clinical/pharmacy/fulfillment partners as needed.
  • Internet/network activity and inferences: browsing, referral/campaign and device data and inferred health interests; processed by hosting/security providers and Google for the purposes in section 4. Network information can indicate approximate location; the site does not request device GPS access.
  • Visual and communication information: ID and health-related images, documents and message text; processed by hosting providers and disclosed to Beluga/care partners; SES delivers transactional email.
  • Sensitive personal information: login credentials, government-ID information in uploaded documents, and information concerning health, sex life or sexual orientation when supplied or revealed through the service. Credentials support authentication; ID and health information support requested care and the related uses described here. Beluga, relevant care partners and infrastructure providers receive the information needed for those roles. Treatment-page activity disclosed to Google may itself reveal a health interest.

Information comes from you and your device, and from our clinical, pharmacy and payment partners. We also use service records for support, billing reconciliation, security, audit, legal obligations and resolving disputes. We do not collect, use or sell customer information to train artificial intelligence, including large language models.

3. Who receives information

  • Beluga and its clinicians: identity, contact information, intake answers, photos and care communications for clinical services.
  • Pharmacies and fulfillment partners: Strive Pharmacy or the pharmacy arranged through Beluga, including TPH or VS Digital as appropriate to your order. They receive the identity, prescription, contact and delivery information needed to fill and ship. Lab services arranged by Beluga receive information needed for testing.
  • Infrastructure and service providers: Render hosts the application and PostgreSQL database; network delivery and security services process website requests; Amazon Web Services Simple Email Service (SES) sends service and security emails; Stripe processes payments. These providers receive information needed for their functions.
  • Google: Google Tag Manager and Google Analytics on public marketing pages receive browsing/device information as described below. Their processing is separate from clinical care.
  • Other external sites: the LegitScript verification image in the public footer loads from LegitScript and sends normal network/browser request information. Following a provider, pharmacy, carrier or other external link takes you to that company's service and privacy practices.

No ORG corporate affiliates receive consumer health data. Authorized ORG staff access information for their work. We may disclose information when legally required or permitted to protect safety and security, respond to legal process or establish or defend legal claims, subject to applicable health-data restrictions. This policy is not consent to a sale of consumer health data or to an otherwise unlawful disclosure.

4. Cookies, browser storage and analytics

Login cookies keep you signed in (up to 30 days); trusted-device cookies support account security (up to 90 days). Temporary login-code cookies also support authentication. Your theme preference stays in local browser storage until changed or cleared.

Unfinished signup, intake and follow-up drafts are saved in your browser tab's session storage so a refresh does not lose your progress. Drafts can include contact and health answers, but not your signup password or photo files. Successful submission clears the relevant draft. Browser session restoration can preserve tab data; on a shared device, clear site data when finished.

Affiliate referral cookies last up to 30 days. Campaign and random visitor-ID cookies last up to 90 days and help connect referral visits with signups and purchases. These are first-party marketing measurement, not just login cookies. Cookie expiration does not automatically erase associated database records.

Google Tag Manager loads on the homepage, treatment pages, How it works, FAQ, Support and Accessibility pages. The published container includes Google Analytics page and interaction measurement. Google may use cookies and receive page URLs, browser/device identifiers, referring information and interactions. Its configuration also enables automatic detection of user-provided email, phone and address information where present on a tagged page. Our public pages do not contain patient signup or contact-capture forms; public business contact details do appear on Support and Accessibility.

Google Tag Manager does not load on signup, login/reset, intake/checkout, account, dashboard, follow-up, visit/chat/lab, staff or these privacy-policy pages. Leaving the marketing pages for those areas loads a separate document. We do not send intake answers or clinical records to Google through our application's data layer. This boundary does not make treatment-page browsing insensitive.

Third parties such as Google may collect information about your online activities over time and across different websites or online services when you use our site. Their cookies and other identifiers may link those activities; their policies and settings govern their use of that information.

The site currently has no cookie-consent banner and does not automatically change its behavior in response to browser Do Not Track or Global Privacy Control signals. You can block or clear cookies in your browser; this can affect sign-in and other functions. Google provides an Analytics opt-out browser add-on and explains its practices in its Privacy Policy. Browser controls do not replace any rights you have under applicable law.

5. Retention and security

We determine retention by the category and purpose below, rather than promise a fixed storage period. We keep information only while needed for those purposes, subject to applicable deletion rights. Cancellation and cookie expiration do not automatically erase associated records.

  • Account, contact and authentication records: for providing and securing your account, handling requests and investigating misuse, and any related legal obligations or disputes.
  • Health, consent, prescription, lab, fulfillment and message records: for coordinating the requested service, support and continuity, documenting consent and disclosures, and meeting legal/audit obligations or resolving disputes. Uploaded ID and intake photos pass through to Beluga without database storage; structured lab values are retrieved on demand. Stored prescription and lab-requisition documents follow the service-record criteria.
  • Payment and subscription records: for processing and reconciling payments, accounting and legal obligations, fraud prevention and payment disputes.
  • Website, referral and inferred-interest records: for measuring referrals and campaign performance, security, and resolving related attribution or payment disputes; continued retention depends on whether these purposes still require the information.
  • Security and audit records: for protecting the service, investigating incidents, demonstrating compliance and handling legal claims. Audit retention decisions include our six-year audit-record requirement; that is not a six-year promise to keep or erase every category of data.

These criteria also govern our retention reviews for archived or backup copies, subject to statutory deletion deadlines. We do not keep information longer merely because we have not selected a fixed period. Providers and pharmacies have their own clinical-record duties; we will identify any specific legal retention restriction when responding to a deletion request rather than assume all website data is exempt.

We use access controls, patient-scoped database permissions, password hashing, protected session tokens, encrypted connections and audit records to help protect information. We limit the information included in operational logs. No system is completely secure. If an incident requires notice under applicable law, the relevant notification duties apply.

6. Your choices and privacy requests

You can view service information and update supported profile fields in your account. Account settings let you manage order, billing and care email preferences. Security emails, such as password-reset and login messages, are not controlled by those preferences. Our application sends transactional service and security emails through SES. ORG does not send marketing email or SMS, including through programs outside this application. Collecting a phone number for care and delivery does not enroll you in marketing texts.

You can ask ORG to confirm processing, access your information or receive a portable copy, correct inaccurate information, delete information, withdraw consent, or opt out of sale, sharing for cross-context behavioral advertising, targeted advertising or profiling used for decisions with legal or similarly significant effects. California rights also include knowing the categories and specific pieces collected, their sources, purposes and recipient categories, and limiting uses/disclosures of sensitive personal information beyond permitted purposes. You may use an authorized agent. We do not discriminate or retaliate for exercising these rights, including by denying unrelated services, charging different prices or providing a different quality of service.

For consumer health data, you can request access, withdrawal of collection/sharing consent and deletion. Washington rights include a list of third parties and affiliates with whom covered health data was shared or sold, with contact information. Nevada rights include a list of third-party recipients and asking us to cease collecting, sharing or selling covered health data. A provider's legal duty to retain a medical record is different from our website processing; any restriction on a request must be explained, not assumed from our relationship with a healthcare provider.

Obsidian Research Group (ORG) handles access, export, correction, deletion, withdrawal, opt-out and appeal requests through the contact below. To make a request, email support@obsidianresearch.org with the subject "Privacy request," or write to the address below. Tell us the right you want to exercise and how to contact you. Do not attach medical records, ID photos or payment details. We may need to verify your identity and an agent's authority through an appropriate channel before disclosing or changing information. You do not need to create a new account to make a request. We provide requests free of charge within the limits allowed by law and use verification information only for verification, security and request handling. We do not require identity verification for a sale/sharing opt-out. Requests are subject to the deadlines below and specific legal exceptions; deleting or withdrawing information needed for care may prevent us from providing that service.

For California access, correction and deletion requests, we confirm receipt within 10 business days and generally respond within 45 calendar days of receipt; for Connecticut requests, we respond within 45 days of receipt. Washington health-data requests follow the deadlines in the separate health-data policy. Nevada generally allows 45 days after authentication, but covered health-data deletion is due within 30 days after authentication. We explain any permitted extension within the initial response period. California sale/sharing opt-outs and sensitive-information limits are processed as soon as feasible and no later than 15 business days.

If we deny a request, reply with "Privacy appeal" and the request reference. ORG will explain its appeal decision in writing within 45 days; this is also within Connecticut's 60-day limit. If denied, you can complain to the Washington Attorney General, Nevada Attorney General, Connecticut Attorney General, or California Privacy Protection Agency.

Google receives identifiers, internet activity and possible health-interest inferences for the marketing measurement described above. Privacy laws can treat disclosures as "sale," "sharing" or "targeted advertising" even without a payment for data. We accept requests to opt out of these marketing disclosures and to limit sensitive-information use through Do Not Sell or Share My Personal Information and Limit the Use of My Sensitive Personal Information. These email request methods are not an automatic browser opt-out, and the site currently lacks the automated signal handling described in section 4. We do not knowingly sell or share personal information of consumers under 16.

7. Adults only

MagnusRX is for adults aged 18 and older. We do not knowingly collect personal information from children under 13. If you believe a child has supplied information, contact us so we can investigate and take appropriate action. Do not create an account for a child.

8. Changes and contact

We post changes here and update the dates above. For material changes, we will provide additional notice through the website or a direct communication. Before applying material changes to information already collected, we will give you a reasonable opportunity to withdraw consent. We will disclose new categories, purposes or recipients and obtain any required separate consent before the new collection, use or sharing begins. We review this policy at least annually. Posting this policy does not itself obtain consent to health-data collection, sharing or sale.

Privacy questions, requests and concerns: support@obsidianresearch.org.

Obsidian Research Group, Inc.
PO BOX 16254
Seattle, WA 98116
United States