Scope. This policy explains how Sensa Wellness LLC, doing business as Sol by Sensa ("Sensa Wellness," "we," "us"), collects, uses, shares and protects personal information through solbysensa.com. Health information you give your treating provider is also protected under the Health Insurance Portability and Accountability Act (HIPAA). How that information is used is described in your treating provider's Notice of Privacy Practices. If this policy and your treating provider's Notice of Privacy Practices conflict about your protected health information, the Notice controls.
1. Who provides your care.
Sensa Wellness LLC is not a medical provider. Consultations and prescriptions are provided by independent physicians and nurse practitioners in the Scriptful, Inc. telehealth provider network (scriptful.com). Each provider is licensed in the state where you are located. Your treating provider is a HIPAA covered entity. When Sensa Wellness handles protected health information (PHI) to support your care, we act as a business associate under a written Business Associate Agreement.
2. Information we collect.
Availability requests: when you submit the “Can’t find it?” form, we collect your name, email, optional phone, requested compound or treatment, submission time and consent to respond. Requests are stored privately in Google Sheets, and a notification containing your request is emailed through Gmail to our business inbox. We use this information to check availability and respond, not to enroll you in marketing. This is not a secure clinical intake or medical-messaging form; do not include symptoms, medical history, prescriptions or other sensitive medical information. Use your provider’s patient portal for medical questions. Contact us to request access to or deletion of your request.
Identity and contact details: name, date of birth, email, phone, and shipping and billing address.
Health information: intake answers, medical history, medications, photos or lab results you upload, and your provider's notes and prescriptions.
Consumer health data: treatments you view or ask about, and health goals or symptoms you share outside your clinical consultation.
Payment information: handled by our PCI DSS compliant payment processor. We do not store full card numbers.
Technical information: device, browser, IP address, pages visited, traffic sources and approximate location, processed through website hosting and analytics technologies (see Section 5).
Product reviews: a public display name, rating, review title, review text, selected product, submission date and permission to publish. Do not include medical details, contact information or other identifying information. Submissions are stored in Google Sheets for moderation. Only approved reviews are displayed publicly, with their display name, rating, text and date. Reviews are not verified purchases or clinical outcomes. Contact us to request removal.
3. How we use it.
We use your information to provide consultations and prescriptions, fill and ship orders, process payments and memberships, send order and account messages, respond to support requests, meet legal and regulatory obligations, and prevent fraud. We use health information only to provide, coordinate and pay for your care and for health care operations, as HIPAA permits, or as you authorize in writing.
4. How we share it.
We share information only as needed with:
the licensed providers who treat you
the pharmacies that fill your prescriptions, including compounding pharmacies
our telehealth platform (Scriptful, Inc.)
our payment processor and shipping carriers
Google Sheets, used to store and moderate voluntarily submitted product reviews
service providers who host and support the website, including Replit for hosting and website analytics, under contracts that limit their use of the data
Every vendor that handles PHI signs a HIPAA Business Associate Agreement. We may also share information when the law requires it, for example in response to a valid subpoena or a public health reporting obligation. Where state law requires it, including in Texas, we will tell you when your health information is shared electronically. We do not sell personal information, health information or consumer health data. We do not share health information with advertisers or social media platforms.
5. Cookies and tracking.
Sol by Sensa uses Replit's built-in analytics to understand website visits, pages viewed, traffic sources, approximate location, and browser and device types. Replit processes network and browser information for these measurements. Page URLs may identify the treatment being viewed, including on treatment and consultation pages. This analytics integration does not give us access to medical answers entered inside Scriptful's separate embedded consultation page.
Analytics loads automatically; it does not wait for a visitor to close our privacy notice. Closing the notice only dismisses it and does not give consent or turn tracking off. We store that dismissal in your browser's local storage so the notice does not appear on every visit. Clearing browser storage or using a different browser may show the notice again.
Our website hosting and embedded Scriptful services may use cookies or similar technologies needed to deliver their services. You can manage cookies through your browser settings; blocking cookies may affect embedded consultation or payment features and does not necessarily prevent analytics. We have not added advertising pixels. We do not sell personal information or share it for cross-context behavioral advertising. We have not verified that the Replit analytics tracker responds to Global Privacy Control signals. Our site does not respond differently to browser "Do Not Track" signals. To make a privacy request, contact info@sensaspas.com.
6. Email and text messages.
We send messages about your orders, prescriptions and account. With your consent, we may also send marketing messages. Marketing never includes your health information. Reply STOP to any text, or use the unsubscribe link in any email, to opt out of marketing. Message and data rates may apply.
7. How we comply with privacy laws.
Sensa Wellness keeps a privacy and security program designed to meet the laws of every state we serve, including:
HIPAA: the Privacy, Security and Breach Notification Rules (45 C.F.R. Parts 160 and 164), including administrative, physical and technical safeguards, workforce training, access controls, audit logging and Business Associate Agreements
Florida: the Florida Information Protection Act (§ 501.171, Fla. Stat.) and Florida's patient-records confidentiality law (§ 456.057, Fla. Stat.)
Texas: the Texas Medical Records Privacy Act (Tex. Health & Safety Code ch. 181, as amended by HB 300), including staff training and the ban on selling PHI
California: the California Online Privacy Protection Act (CalOPPA) and the Confidentiality of Medical Information Act
Washington and Nevada: Washington's My Health My Data Act (RCW 19.373) and Nevada's consumer health data law (NRS Chapter 603A), described in Section 13
Connecticut: the consumer health data provisions of the Connecticut Data Privacy Act, including the ban on geofencing around health care facilities and the requirement of consent before any sale of consumer health data
All other states: the medical confidentiality and telehealth laws of each state where our providers treat patients
Our Privacy Officer oversees this program. We review it at least once a year.
8. Security.
We use encryption in transit and at rest, role-based access controls, multi-factor authentication for staff, and HIPAA-compliant hosting. Only staff and contractors who need health information to do their jobs can access it. No system is completely secure, so tell us right away if you think your account has been compromised.
9. Breach notification.
If your unsecured protected health information or personal information is breached, we will notify you, and regulators where required, within the deadlines set by HIPAA and applicable state law. Under Florida law, that is no later than 30 days.
10. Retention.
We keep medical records for as long as Florida and federal law require. We keep other information only as long as needed for the purposes above.
11. Your rights.
Depending on where you live, you have the right to:
access, or get a copy of, your information and medical records
ask us to correct inaccurate information
ask us to delete your information where the law allows
ask for limits on certain uses of your health information, and for an accounting of disclosures
appeal a decision we make about your request
Contact us at info@sensaspas.com or (305) 707-3672. We will respond within the time the law requires. We will not discriminate against you for exercising your rights. If you think your privacy rights under HIPAA have been violated, you can file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights.
12. Children.
Our services are for adults 18 and older. We do not knowingly collect information from anyone under 18.
13. Washington and Nevada residents.
If you live in Washington or Nevada, our Consumer Health Data Privacy Policy explains what consumer health data we collect and share, how to give or withdraw consent, and how to access, delete or appeal decisions about your data.
14. Changes.
We will post any update here with a new date and notify you of material changes by email. If a change affects how we use or share consumer health data, we will ask for your consent again before it applies.
15. Contact.
Privacy Officer, Sensa Wellness LLC, 2830 NW 5th Ave, Miami, FL 33127 · info@sensaspas.com · (305) 707-3672.