Privacy policy
Effective Date: October 26, 2026
Last Updated: November 10, 2026
This policy explains what personal and health information we collect, how we use and share it, how we protect it, and the rights you have over it. It applies to everyone who shops with us, orders our kits, or uses our patient care portal.
1. Who we are and what this policy covers
Zelenko Labs LLC ("Zelenko Labs," "we," "us") operates the ZStackLife platform, including https://zstacklife.com, https://careportal.zstacklife.com, and our customer support channels (together, the "Services").
This policy does not cover the platforms operated by our Telehealth Provider or Pharmacy, or any website we do not operate. Those are governed by their own notices.
Our role versus our partners' roles
We sell Z-Stack® dietary supplements and medical kits, and we operate the platform. A kit may include prescription medications, where prescribed for you by a licensed clinician; we do not sell prescription medication directly. We do not employ physicians, provide medical consultations, write prescriptions, or dispense medication. Those services come from independent partners:
- Independent telemedicine providers (each a "Telehealth Provider") supply consultations and prescribing through their own licensed clinicians. The Telehealth Provider that treats you is the HIPAA Covered Entity for your care and holds your medical record. Our Telehealth Providers are:
- Beluga Health, P.A. — belugahealth.com; clinician licensing information at belugahealth.com/about
- Licensed dispensing pharmacies (each a "Pharmacy") fill and ship any prescription a clinician writes.
The specific Telehealth Provider and Pharmacy handling your order are identified in the patient care portal before you consent to a consultation, and on your order confirmation. If we add or change a Telehealth Provider or Pharmacy, we will update this policy.
Where we handle protected health information on the Telehealth Provider's behalf, we do so as a HIPAA Business Associate under a Business Associate Agreement with them.
2. Categories of information we collect
Personal Information is any information that identifies you, relates to you, or could reasonably be linked to you, directly or indirectly. It includes your name, email address, telephone number, date of birth, shipping and billing addresses, account details, order history, and your correspondence with us.
Protected Health Information (PHI) is a subset of Personal Information protected under HIPAA. Your clinical intake answers, medical history, allergy disclosures, the fact that a prescription was written for you, and what was dispensed are PHI.
Consumer Health Data is a category defined by some state laws, such as Washington's My Health My Data Act. It is information that identifies or reasonably permits an inference about your health status and is not PHI. Ordinary shopping activity, such as browsing or purchasing dietary supplements and wellness products, is commercial information and is not consumer health data. Shopping activity becomes consumer health data when it reveals or reasonably permits an inference about your health status, which includes requesting a clinical consultation or purchasing a kit that contains prescription medication. See Section 7 and our Consumer Health Data Privacy Notice.
Non-Personal Information is information that cannot on its own be used to identify, contact, or locate you, such as browser type or aggregated site statistics. If we combine Non-Personal Information with Personal Information, we treat the combination as Personal Information.
3. Where that information comes from
Information you provide to us
- Account and contact details when you create an account, place an order, or contact support.
- Purchase and subscription information when you buy a product or sign up for a recurring order. We never store full payment card numbers; payments are processed by our payment provider.
- Clinical intake information when you request a kit that requires a clinician: your medical history, current medications, allergies, physical location, and a government-issued photo ID for identity verification.
- Communications you send us by email, phone, chat or SMS.
Information we collect automatically
- Cookies and similar technologies on our storefront record which pages you visit, how often, and from what device, so we can keep you signed in, remember preferences, enable checkout, prevent fraud and measure performance.
- Device and log data, including IP address, browser type and version, operating system, and the date and time of your visit.
- Approximate location derived from your IP address, used to confirm eligibility for telehealth services and to prevent fraud.
You can control cookies in your browser settings. Where state law requires it, we honor the Global Privacy Control signal as an opt-out of sale and sharing. We do not run advertising or targeting tags on the patient care portal or on clinical intake pages.
Information we receive from the Telehealth Provider and Pharmacy
- Consultation outcome: whether a clinician approved, partially approved, or declined a prescription, so we can fulfill or refund your order.
- Fulfillment status from the Pharmacy, so we can support your purchase and tell you when it ships.
We do not receive your clinician's notes or your full medical record. That record is created and held by the Telehealth Provider under its own HIPAA compliance program and Notice of Privacy Practices, available in the patient care portal.
4. Why we collect it
We use the information described above for the following purposes:
- Providing the Services and fulfilling your requests. Creating and managing your account, processing orders and subscriptions, routing your clinical intake to the Telehealth Provider, coordinating fulfillment with the Pharmacy, and answering your questions.
- Communicating with you. Sending transactional messages about your account, order and care coordination, and sending marketing only where you have opted in. You can unsubscribe at any time.
- Verifying identity and eligibility. Confirming that you are who you say you are, that you are 18 or over, and that you are located in a state where our Telehealth Provider operates.
- Operating, protecting and improving our business. Preventing fraud, securing our systems, measuring site performance, and developing our products and services.
- Legal and compliance purposes. Complying with applicable law and legal process, enforcing our Terms of Service, and protecting the rights, safety and property of Zelenko Labs, our partners, you and others.
We do not use clinical intake answers, prescription information, or other PHI for advertising, audience building, or lookalike targeting, and we do not share it with advertising platforms.
We may de-identify or aggregate information so that it no longer identifies you, and use that aggregate information for any lawful purpose.
5. How we share information
- Telehealth Provider. Intake, medical history and contact information, so a licensed clinician can evaluate you and prescribe where appropriate.
- Pharmacy. Prescription, allergy and shipping information, so your medication can be filled and sent to you safely.
- Service providers. Companies that run our store and support our operations, such as e-commerce, payment processing, shipping, messaging, and customer support tools. They receive only what they need to perform their work for us and may not use it for anything else.
- Analytics and advertising platforms. Ordinary commercial activity on our storefront, such as supplement and wellness product pages viewed and items added to your cart, together with identifiers such as cookie IDs, may be shared with analytics and advertising platforms to measure our marketing and show you relevant ads. This excludes information that qualifies as consumer health data, as described in Section 2. You can opt out as described in Section 7, and we honor Global Privacy Control where state law requires it.
- Legal and safety. When required by law, subpoena or court order, or to investigate fraud, protect rights and safety, enforce our agreements or defend legal claims.
- Business transfers. In a merger, acquisition, financing, reorganization, sale of assets or bankruptcy, subject to this policy and applicable law.
What we never share with advertising platforms: clinical intake answers, prescription information, any other protected health information, and consumer health data as defined in our Consumer Health Data Privacy Notice. We do not run advertising or targeting tags on the patient care portal or on clinical intake pages. We do not sell personal information for money.
How we handle your mobile number and SMS consent is described in our Terms of Service; mobile information and SMS opt-in data are never shared with third parties or affiliates for marketing purposes.
Your HIPAA rights
Before any consultation, you will be asked to review and agree to the Telehealth Provider's informed consent, privacy policy, and Notice of Privacy Practices. Those documents govern your care and your medical record, and where they conflict with this policy on those matters, theirs control. Requests to access, amend, restrict, or receive an accounting of disclosures of your medical record go to the Telehealth Provider as Covered Entity. If you send such a request to us, we will forward it.
6. How we protect your information
We use commercially reasonable administrative, technical and physical safeguards to protect your personal information, and we require the service providers that process it on our behalf to do the same.
Protected health information handled through our patient care portal is safeguarded as required of a HIPAA Business Associate.
No system is perfectly secure. Keep your account password confidential and contact us immediately if you believe your account has been compromised.
7. Your privacy rights
Depending on where you live, you may have the right to know what we collect, access a copy, correct it, delete it, receive it in a portable format, opt out of targeted advertising and sale, limit the use of sensitive personal information, and not be discriminated against for exercising these rights.
To make a request, email privacy@zstacklife.com with the subject "Privacy Request," or write to us at the address in Section 8. We will verify your identity, respond within the time applicable law allows, and tell you how to appeal if we deny a request. An authorized agent may act for you with written permission.
Medical records held by the Telehealth Provider follow HIPAA rather than state consumer privacy law. See Section 5.
California residents have the rights above under the CCPA/CPRA. Clinical intake answers and health information are sensitive personal information; we use them only to provide the services you requested. Medical information under the Confidentiality of Medical Information Act, and PHI under HIPAA, are handled under those laws instead.
Washington, Nevada and Connecticut residents: our separate Consumer Health Data Privacy Notice, linked from our homepage, describes the consumer health data we collect, how we use and share it, and how to exercise your rights.
Residents of other states with comprehensive privacy laws have the rights described above as those laws provide.
8. Children, international users, retention and contact
Children
Telemedicine consultations, kit purchases and the patient care portal are for adults 18 and over. Some of our dietary supplements are labeled for children; those are purchased by a parent or legal guardian, and the account holder must be an adult. We do not knowingly collect personal information directly from anyone under 13. If we learn we have, we delete it.
International users
We operate in the United States and process your information here. We ship dietary supplements and wellness products to a limited number of countries outside the United States. Telehealth services, and kits that may include prescription medications, are available only to customers located in the United States. If you order from outside the United States, you consent to your information being transferred to and processed in the United States.
Retention
We keep personal information only as long as needed to provide the service, meet legal and tax obligations, resolve disputes, enforce agreements and maintain business records. Medical records are retained by the Telehealth Provider under its own retention schedule and applicable law. When personal information is no longer required, we delete, destroy or de-identify it securely.
Changes
We may update this policy from time to time by posting the revised version here with a new date.
Contact us
Zelenko Labs LLC
9045 La Fontana Blvd, Suite 105
Boca Raton, FL 33434
Email: support@zstacklife.com
Phone: 1-800-ZELENKO (1-800-935-3656)
Privacy Contact: privacy@zstacklife.com. For your medical record or HIPAA rights, contact the Telehealth Provider identified in your patient care portal. You may also complain to the U.S. Department of Health and Human Services, Office for Civil Rights.
