Privacy policy

Express Medical Supply LLC
Effective date: September 8, 2026

Express Medical Supply LLC ("Express Medical Supply," "Express," "we," "us," or "our") operates expmedsupply.com and related websites, online forms, patient-intake processes, customer-support channels, and services (collectively, the "Services"). This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use the Services, request products or services, submit an intake, communicate with us, or otherwise interact with Express.

Please read this Privacy Policy carefully. By using the Services, you acknowledge that you have reviewed this Policy. Where consent is required by law, we will request it separately.

1. Scope and Relationship to Our HIPAA Notice

Express may receive health information in connection with insurance eligibility, medical documentation, prescriptions, product needs, order fulfillment, and related services. When information is protected health information ("PHI") governed by the Health Insurance Portability and Accountability Act ("HIPAA"), our HIPAA Notice of Privacy Practices, rather than this Privacy Policy, governs how that PHI may be used and disclosed.

This Privacy Policy applies to personal information collected through our general website, online store, cookies, advertising technologies, and other activities that are not governed by HIPAA. It also describes our general information practices and our SMS program. Nothing in this Policy limits any rights provided under our Notice of Privacy Practices or applicable law.

2. Personal Information We Collect

Depending on how you interact with Express, we may collect:

  • Identity and contact information, such as name, date of birth, mailing and shipping address, telephone number, email address, and account identifiers.

  • Patient and representative information, including whether a person is acting for themselves or as a parent, legal guardian, caregiver, or other authorized representative.

  • Insurance and eligibility information, such as payer or health-plan information, member identification information, coverage details, eligibility results, and information needed to coordinate benefits or payment.

  • Health and product-need information, such as diagnoses or qualifying conditions, product categories, sizes, quantities, medical necessity information, and other information relevant to requested supplies or services.

  • Prescriber and healthcare-provider information, such as provider name, practice, telephone number, fax number, National Provider Identifier, prescriptions, standard written orders, progress notes, and other supporting documentation.

  • Communications and documents, including messages, call information, email, SMS, secure-message content, insurance-card images, attachments, customer-support requests, and communication preferences or consent records.

  • Transaction and payment information, such as products viewed or requested, orders, returns, exchanges, cancellations, payment method, payment confirmation, billing information, and transaction history. Payment-card information may be collected and processed by Shopify or another payment processor rather than stored directly by Express.

  • Account information, such as username, password, preferences, settings, and authentication information.

  • Device and usage information, such as IP address, browser type, device identifiers, network information, pages viewed, referring pages, dates and times of access, and interaction with our Services.

  • Advertising and analytics information, such as cookie identifiers, campaign information, referral information, and interactions with our advertisements or marketing communications.

  • Other information that you voluntarily provide or that we are permitted or required to collect by law.

3. Sources of Personal Information

We may collect personal information:

  • Directly from you or your authorized representative;

  • From healthcare providers, prescribers, health plans, Medicaid programs, payers, caregivers, or other persons involved in your care or requested services;

  • Automatically through cookies and similar technologies when you use our website;

  • From vendors and service providers that support our operations;

  • From advertising, analytics, referral, or business partners; and

  • From public records or other sources permitted by law.

4. How We Use Personal Information

We may use personal information to:

  • Receive, review, and process intake and order requests;

  • Verify identity, insurance eligibility, benefits, coverage, and payer requirements;

  • Contact healthcare providers and request prescriptions, standard written orders, progress notes, or other required documentation;

  • Determine whether Express can provide requested products or services, subject to applicable payer, prescription, medical-necessity, and operational requirements;

  • Create and manage patient, customer, and order records;

  • Process payments, coordinate insurance billing, fulfill and ship orders, process returns, and provide customer support;

  • Communicate about incomplete forms, insurance issues, missing doctor information, required documents, order status, resupply, service updates, and other transactional matters;

  • Maintain consent, opt-out, delivery, communication, audit, and security records;

  • Detect, investigate, and prevent fraud, misuse, security incidents, or unlawful activity;

  • Operate, maintain, analyze, personalize, and improve the Services;

  • Conduct advertising and marketing as permitted by law and consistent with applicable consent choices;

  • Comply with legal, regulatory, contractual, accreditation, payer, and recordkeeping requirements; and

  • Establish, exercise, or defend legal rights.

5. How We Disclose Personal Information

We may disclose personal information when reasonably necessary for the purposes described above, including:

  • Healthcare and coverage parties, such as healthcare providers, prescribers, health plans, Medicaid programs, payers, referral sources, and authorized caregivers or representatives;

  • Technology and operational providers, such as website hosting, online-form, cloud-hosting, patient-management, communications, analytics, security, customer-support, and payment-processing providers. These may include Shopify, Jotform, Google Cloud, NikoHealth, and Spruce Health;

  • Fulfillment and delivery providers, such as product suppliers, distributors, warehouses, shipping carriers, and drop-ship partners;

  • Professional advisers, such as attorneys, accountants, auditors, insurers, and compliance consultants;

  • Government and legal recipients when disclosure is required or permitted by law, legal process, payer rules, program-integrity requirements, or to protect rights, safety, and security;

  • Business transaction recipients in connection with a proposed or completed merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar transaction; and

  • Other parties at your direction or with your authorization.

Where HIPAA applies, PHI is used and disclosed only as permitted by HIPAA, our Notice of Privacy Practices, and applicable agreements. Vendors that handle PHI for Express are required to provide appropriate safeguards and, when required, enter into business associate agreements.

6. Relationship with Shopify

Our online store is powered by Shopify. Shopify may collect and process information about access to and use of the online store to provide, secure, and improve its services. Information submitted through Shopify may be processed in locations outside your state or country. For more information, review the Shopify Consumer Privacy Policy and the Shopify Privacy Portal.

7. Cookies, Analytics, and Interest-Based Advertising

We and our service providers may use cookies, pixels, tags, software-development kits, and similar technologies to operate the website, remember preferences, understand use of the Services, measure advertising performance, prevent fraud, and personalize content or advertising.

Some disclosures for cross-context behavioral or targeted advertising may be considered a "sale," "sharing," or "targeted advertising" under certain state privacy laws even when no money is exchanged. Where required, we provide methods to exercise applicable opt-out rights. We do not use PHI or SMS opt-in data for targeted advertising unless expressly authorized and legally permitted.

Browser controls and device settings may allow you to limit cookies. Disabling cookies may affect website functionality.

8. SMS and Mobile Information

If you affirmatively opt in, Express may send recurring transactional SMS messages concerning your intake, insurance verification, missing information, required documents, order request, order status, resupply, and customer support. Message frequency varies. Message and data rates may apply. Consent to SMS is not a condition of purchasing products or receiving services.

Reply STOP to opt out of SMS messages or HELP for assistance. You may also call 1-866-270-3322. We will honor applicable opt-out requests and may send a final confirmation that the opt-out was processed. Wireless carriers are not liable for delayed or undelivered messages.

We do not sell, rent, or share mobile telephone numbers, SMS opt-in data, or SMS consent records with third parties or affiliates for their marketing or promotional purposes. We may disclose this information to communications providers and other service providers solely as necessary to deliver, support, secure, and document our messages, or as required by law.

Standard SMS is not designed for detailed health information. Express limits sensitive information in ordinary text messages and may direct you to a secure communication channel for insurance-card images, medical documents, or other sensitive information.

9. Email and Other Communication Preferences

You may opt out of promotional email by using the unsubscribe mechanism in the email. Even if you opt out of promotional communications, we may continue to send non-promotional communications concerning an intake, account, order, service, safety issue, legal notice, or existing business relationship as permitted by law.

Communication preferences do not prevent Express from contacting you through another permitted method when reasonably necessary to provide requested services, protect safety, comply with law, or respond to you.

10. Information About Minors and Dependents

The Services are intended for adults and for parents, legal guardians, caregivers, or other authorized representatives acting on behalf of a patient. Minors should not independently submit personal information through the Services. If you submit information about a minor or another person, you represent that you have authority to do so.

We may collect information about a minor patient when provided by a parent, legal guardian, or other authorized representative for purposes such as eligibility verification, documentation, order processing, and supplying requested products or services. To request review or correction of information submitted for a minor, contact us using the information below.

11. Security

We use administrative, technical, and physical safeguards designed to protect personal information. These include access controls, authentication, secure service providers, encryption where appropriate, audit logging, and workforce privacy and security practices. No security method is perfect, and we cannot guarantee absolute security.

Do not send detailed health, insurance, financial, or identification information through ordinary email or SMS unless specifically instructed that the channel is secure. Use the secure methods provided by Express when submitting sensitive documents or images.

12. Retention

We retain personal information for as long as reasonably necessary to provide the Services, manage patient and order records, maintain consent and opt-out records, satisfy payer and legal requirements, resolve disputes, enforce agreements, and protect Express and its patients or customers. Retention periods vary by record type and applicable law. We may retain de-identified or aggregated information as permitted by law.

13. Your Privacy Rights and Choices

Depending on where you reside and subject to applicable exceptions, you may have rights to request access to, correction of, deletion of, or a portable copy of certain personal information. You may also have the right to opt out of certain sales, sharing, targeted advertising, or profiling.

These general privacy rights may differ from rights concerning PHI under HIPAA. Requests involving PHI will be handled under our Notice of Privacy Practices and applicable law.

To submit a request, contact us using the information below. We may verify your identity and authority before acting on a request. Authorized agents may be required to provide proof of authorization. We will not unlawfully discriminate against you for exercising applicable privacy rights.

14. Third-Party Websites and Services

The Services may link to websites or platforms operated by third parties. Their privacy and security practices are governed by their own notices. Express is not responsible for third-party websites or services that we do not control.

15. International Processing

Some service providers may process information outside your state or country. Where required, we use appropriate safeguards for transfers of personal information. Our Services are directed primarily to users in the United States.

16. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, technology, Services, or legal obligations. We will post the revised Policy and update the effective date. We will provide additional notice when required by law.

17. Contact Us

For questions, privacy requests, or complaints concerning this Privacy Policy, contact:

Express Medical Supply LLC
Attn: Privacy Officer
7410 New La Grange Road
Louisville, Kentucky
Phone: 1-866-270-3322
Email: info@expmedsupply.com

For questions or complaints involving PHI, please follow the instructions in our HIPAA Notice of Privacy Practices.