Privacy Policy

Effective Date / Last Updated: September 25, 2026

1. Who We Are and What This Policy Covers

Craft Men's Clinic is a brand and d/b/a of Craft Medical Inc ("Craft Men's Clinic," "we," "us," or "our"), a men's health medical practice headquartered at 5711 E. 71st St., Suite 100-H, Tulsa, OK 74136. We provide telehealth evaluation and treatment by licensed physicians and clinicians to patients located in Oklahoma, Texas, Arizona, and Florida only. We do not provide services to patients located in any other state.

This Privacy Policy explains how we collect, use, disclose, and protect information about you when you visit craftmensclinic.com (the "Website"), contact us, or receive care from us (together, the "Services"). It also contains our Notice of Privacy Practices (Section 4), which describes how your medical information may be used and disclosed and how you can get access to it. Please review it carefully.

2. Our Commitment to Protecting Health Information

As a healthcare provider, we treat all individually identifiable health information we create or receive about you in connection with your care — including your intake answers, lab results, diagnoses, prescriptions, visit notes, and communications with our clinicians — as Protected Health Information ("PHI"). We protect PHI in accordance with the Health Insurance Portability and Accountability Act of 1996 and its Privacy, Security, and Breach Notification Rules (together, "HIPAA"), and with the health-information privacy laws of each state we serve. Where a state law gives you more protection than HIPAA, we follow the state law.

To meet these obligations we:

• Maintain written HIPAA privacy and security policies and have designated a Privacy Officer responsible for them (contact details in Section 11);
• Train our workforce on HIPAA and applicable state privacy requirements, and limit access to PHI to the minimum necessary for each person's job;
• Use administrative, physical, and technical safeguards, including encryption of PHI in transit, role-based access controls, audit logging, and secure, access-controlled electronic health record and telehealth systems;
• Require every vendor that creates, receives, maintains, or transmits PHI on our behalf (for example, our electronic health record, telehealth, laboratory, pharmacy, and billing vendors) to sign a Business Associate Agreement and protect PHI as HIPAA requires;
• Perform periodic risk assessments of our systems; and
• Investigate suspected privacy or security incidents and provide breach notifications as required by law (Section 8).

3. Information We Collect

Information you give us. When you request information, book a consultation, or become a patient, we collect your name, date of birth, sex, email address, phone number, mailing and shipping address, state of residence and current location (to confirm we can lawfully treat you), government-issued ID for identity verification, payment information, and your communication and consent preferences.

Health information. When you receive care, we collect your medical history, symptoms, health questionnaires, lab orders and results, vital signs, medications and allergies, diagnoses, treatment plans, prescriptions, visit notes, and messages with our care team. Before any prescription is issued, a licensed clinician reviews your lab results and health history and conducts a consultation with you. We may also receive health information from laboratories, pharmacies, your prior providers (with your authorization or as permitted by law), and state prescription drug monitoring programs.

Information collected automatically. When you visit our Website we and our service providers may automatically collect device and usage information such as IP address, browser type, pages viewed, referring pages, and cookie identifiers. See Section 5 for how we limit this.

4. Notice of Privacy Practices

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. We are required by law to maintain the privacy of your PHI, to give you this notice of our legal duties and privacy practices, to follow the terms of the notice currently in effect, and to notify you if a breach of your unsecured PHI occurs.

How we may use and disclose your PHI without your written authorization:

• Treatment — to evaluate, diagnose, and treat you, including sharing with laboratories, pharmacies that fill your prescriptions, and other providers involved in your care.
• Payment — to bill and collect for the services we provide, including through our payment processor.
• Health care operations — to run our practice, such as quality review, clinician training, compliance audits, and customer support.
• Appointment reminders and care communications — to contact you about appointments, lab orders, refills, results, and treatment follow-up, using the contact methods you provide.
• As required by law — including reporting to state prescription drug monitoring programs for controlled substances such as testosterone, responding to court orders or subpoenas as the law allows, public health reporting, reporting abuse or neglect, health oversight activities (such as audits by licensing boards), law enforcement purposes permitted by law, and to avert a serious threat to health or safety.
• Business associates — to vendors that perform services for us under a Business Associate Agreement.

Uses that require your written authorization. We will not use or disclose your PHI for marketing, sell your PHI, or disclose psychotherapy notes without your written authorization. Any other use or disclosure not described in this notice will be made only with your written authorization, which you may revoke in writing at any time (except to the extent we have already relied on it).

Your rights regarding your PHI. You have the right to:

• Inspect and obtain a copy of your medical and billing records, including in electronic form, generally within 30 days of your request (or within 15 business days for electronic records requested by Texas patients);
• Request that we amend information you believe is incorrect or incomplete;
• Receive an accounting of certain disclosures of your PHI;
• Request restrictions on certain uses and disclosures, including the right to restrict disclosures to a health plan for services you paid for in full out of pocket;
• Request that we communicate with you by alternative means or at an alternative location;
• Choose someone, such as a personal representative, to act for you;
• Obtain a paper copy of this notice at any time; and
• File a complaint if you believe your privacy rights have been violated (see Section 11). We will not retaliate against you for filing a complaint.

We reserve the right to change this notice and to make the new notice effective for all PHI we maintain. The current version will always be posted on this page with its effective date.

5. Website Cookies and Tracking Technologies

Our Website uses cookies and similar technologies to operate the site, remember your preferences, understand how visitors use it, and measure our advertising (see the Cookie Policy below). We do not use tracking technologies to disclose health information you submit for your care — such as intake answers, symptoms, lab results, or treatment details — to advertising or social media platforms. Health information you provide for care is collected through our secure clinical systems, which are operated by business associates bound by HIPAA. You can limit cookies through your browser settings. We do not currently respond to browser "Do Not Track" signals.

6. How We Use and Share Other Personal Information

We use contact and account information to provide and schedule the Services, verify your identity and location, process payments, send care and account communications, respond to your requests, improve our Website, comply with law, and — only if you have opted in — send you marketing messages. We share it only with service providers who perform services for us under contracts that limit their use of it (such as hosting, payment processing, identity verification, email, and messaging vendors), with professional advisors, when required by law, or in connection with a merger or sale of our practice subject to applicable law.

We do not sell your personal information or your health information, and we do not share it with third parties for their own marketing purposes. Mobile phone numbers and text-messaging consent are handled as described in the SMS / Text Messaging section below.

7. State-Specific Privacy Rights

We provide care only in Oklahoma, Texas, Arizona, and Florida, and we comply with the medical-privacy, data-security, and breach-notification laws of each. In addition to your HIPAA rights above:

• Texas residents. We comply with the Texas Medical Records Privacy Act (Texas Health & Safety Code Chapter 181), including workforce training on state privacy law, providing electronic health records within 15 business days of a written request, and not selling PHI or disclosing it electronically without the notice and authorization the law requires. To the extent the Texas Data Privacy and Security Act applies to personal data that is not PHI, you may request to access, correct, delete, or obtain a copy of that data and to opt out of targeted advertising, and you may appeal our decision on your request by contacting us as described in Section 11.
• Florida residents. We maintain the confidentiality of patient records as required by Florida Statutes §456.057 and do not disclose them without your written authorization except as permitted by law. We protect personal information and provide breach notice as required by the Florida Information Protection Act (§501.171), generally within 30 days.
• Arizona residents. We maintain and disclose medical records only as permitted by Arizona law (A.R.S. §12-2291 et seq.) and provide breach notification as required by A.R.S. §18-552.
• Oklahoma residents. We protect medical records and personal information as required by Oklahoma law, provide breach notification under the Oklahoma Security Breach Notification Act (24 O.S. §§161–166), and honor applicable consumer data rights under Oklahoma privacy law.

To exercise any of these rights, contact us as described in Section 11. We will verify your identity before fulfilling a request and will not discriminate against you for exercising your rights.

8. Data Security and Breach Notification

We use the administrative, physical, and technical safeguards described in Section 2 to protect your information. No system is perfectly secure, so please keep your account credentials confidential and tell us right away if you believe your information has been compromised. If a breach of your unsecured PHI or personal information occurs, we will notify you without unreasonable delay — no later than 60 days after discovery under HIPAA, or sooner where state law requires (for example, 30 days under Florida law) — and will notify the U.S. Department of Health and Human Services, state regulators, and others as required.

9. Data Retention

We retain medical records for at least as long as required by the medical-records retention laws of the state where you received care and by federal law, and we retain other personal information only as long as needed for the purposes described in this Policy or as required by law. When information is no longer needed, we securely dispose of it.

10. Eligibility and Children

Our Services are intended only for adults 18 years of age or older who are located in a state we serve. We do not knowingly collect personal information from children under 18. If you believe a child has provided us information, contact us and we will delete it.

11. Contact Us, Complaints, and Changes

Questions, requests to exercise your rights, and privacy complaints may be directed to our Privacy Officer:

• Email: privacy@craftmedical.com
• Phone: 918-906-6666
• Mail: Craft Men's Clinic, Attn: Privacy Officer, 5711 E. 71st St., Suite 100-H, Tulsa, OK 74136

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at www.hhs.gov/ocr/complaints, by calling 1-800-368-1019, or by writing to 200 Independence Avenue S.W., Washington, D.C. 20201, or with the attorney general or medical board of your state. We will not retaliate against you for filing a complaint.

We may update this Privacy Policy from time to time. We will post the updated version on this page with a new effective date and, where required by law, notify you of material changes.