Privacy Policy
Last updated: October 29, 2026
1. Introduction
Stoodious AI, Inc. d/b/a Fae (“fae,” “we,” “us,” or “our”) takes your privacy seriously, especially because the health information you share with us is deeply personal. This policy explains what we collect, why we collect it, and how we protect it. It applies to our website, waitlist, intake, and platform services. Fae connects patients with independent clinicians through MD Integrations (MDI); Fae does not itself provide medical care.
2. Information we collect
Information you provide: Name, email address, phone number, date of birth, mailing address, identity-verification uploads, consent records, and health information you submit during intake or consultations, including sex assigned at birth, symptoms, reproductive health information, medical history, medications, and allergies. We also receive care, prescription, and fulfillment updates from clinicians and pharmacy partners and transaction updates from Stripe.
Payment information: Billing details are processed by our payment provider (Stripe). We do not store your full card number.
Usage data: Page categories, interactions, intake progress, transaction and care-status milestones, referral sources, and random browser identifiers collected through our services and browser storage (see section 6). Hosting services may also process IP addresses and technical request information to deliver and secure the site.
3. How we use your information
We use your information to:
- Facilitate your telehealth consultation and prescription
- Communicate with you about your care
- Process payments and send receipts
- Improve our platform and patient experience
- Comply with legal and regulatory obligations
- Send service updates (you can opt out of marketing emails at any time)
4. Privacy compliance and protected health information
Our handling of personal and health information is subject to applicable federal and state privacy, security, and breach-notification laws in the jurisdictions we serve. These include HIPAA and its implementing rules when we handle protected health information (PHI) as a business associate, and applicable state medical-confidentiality and consumer-health-data laws. Not all information collected through a website is PHI under HIPAA; other privacy protections may apply to information outside HIPAA.
When acting as a business associate, our use and disclosure of PHI must follow the applicable Business Associate Agreement and HIPAA. Vendors that act as business associates must also have the required agreements and safeguards. Access and disclosures must be limited to authorized purposes and, where required, the minimum necessary information. PHI may be used or disclosed for permitted treatment, payment, and healthcare operations, or other purposes allowed or required by law. Uses requiring your authorization require a valid authorization; you may revoke it prospectively, subject to actions already taken in reliance on it.
MD Integrations (MDI) is our provider network. Your treating medical provider is responsible for its clinical records and applicable Notice of Privacy Practices, which explains its uses, disclosures, and your patient rights. Request that notice or medical records through your patient portal or contact privacy@joinfae.com for help reaching the responsible provider. This website policy does not replace that notice.
For health information outside HIPAA, applicable state consumer-health-data laws may require consent for collection or sharing beyond what is necessary to provide a service you request. Where required, we must obtain that consent separately; acknowledging this policy does not itself authorize every use or disclosure. You may request confirmation of collection, access, deletion, withdrawal of consent, and information about recipients of your health data by following section 9, subject to the applicable law and its exceptions.
Sections 5 and 6 explain sharing and analytics, section 8 describes safeguards and breach notification, and section 9 explains requests and complaints. We do not sell or rent PHI.
5. Sharing your information
We do not sell personal information or share it for cross-context behavioral advertising. We disclose information only for the purposes below and as permitted by applicable law:
- MD Integrations and treating clinicians: identity, contact, intake, and health information to arrange and provide your consultation and treatment
- Pharmacy partners: contact, prescription, and relevant health information to dispense and ship your prescription
- Payment processors: to complete transactions (Stripe)
- Service providers: hosting, communications, and analytics vendors processing information for the services described in this policy, subject to applicable contractual and legal restrictions
- Legal authorities: when required by law or valid legal process, or when a disclosure to protect safety is legally permitted
6. Cookies and analytics
We use PostHog to measure use of the platform, including intake progress, payment, and care-status milestones. Random identifiers stored in local storage and session storage link these events; they are pseudonymous, not necessarily anonymous. Our analytics event fields exclude names, contact details, medical answers, uploaded files, medication names, and raw URLs. Automatic interaction capture and session replay are disabled. We do not share these analytics with advertisers. Essential session cookies support secure access.
Our browser analytics respect Global Privacy Control and Do Not Track signals. You can enable these signals before starting an intake or restrict browser storage. This stops browser collection and new analytics attachment; it does not automatically stop server-side updates for a journey already associated with analytics. Contact privacy@joinfae.com for help with an existing journey or a privacy request. Browser settings may affect site functionality.
7. Data retention
Retention depends on the information, its purpose, and applicable recordkeeping requirements. We retain information as needed to provide services, maintain required records, resolve disputes, and meet legal obligations. Medical-record retention is determined by the responsible provider and applicable law; HIPAA does not establish one universal retention period for all medical records. You may request deletion, subject to applicable exceptions. Contact us for information about retention or deletion of your records.
8. Security
Our website and intake use HTTPS with Transport Layer Security (TLS), the successor to SSL, to encrypt information in transit, including patient, medical, and transaction information. Session access controls help restrict access to intake and checkout information. Analytics fields are restricted as described above. Applicable law requires appropriate administrative, technical, and physical safeguards for protected information and required notifications to affected individuals and authorities following a reportable breach. We will provide those notifications as required by law. No system is completely secure. Report suspected unauthorized access to privacy@joinfae.com; use the patient portal, rather than ordinary email, to send medical records or identity documents.
9. Your rights
Depending on your state of residence, you may have the right to:
- Access the personal information we hold about you
- Correct inaccurate information
- Request deletion, subject to legal exceptions and recordkeeping requirements
- Withdraw consent where processing depends on consent
- Opt out of marketing communications
- Data portability (receive your data in a machine-readable format)
To exercise any of these rights, email privacy@joinfae.com. You may also contact support@joinfae.com. We may verify your identity or an authorized representative before releasing or changing records. We respond within the deadlines required by the law applicable to your request and explain any permitted extension or denial. If applicable law provides an appeal, reply with “Privacy appeal” to request a review; you may also complain to your state attorney general. We will not discriminate or retaliate against you for exercising privacy rights.
Where HIPAA applies, you may request access to or a copy of records, an amendment, an accounting of certain disclosures, restrictions on uses or disclosures, confidential communications, and a copy of the provider notice. These rights have legal limits; some requests must be directed to the medical provider. We can help route your request. You may file a complaint with us or the U.S. Department of Health and Human Services Office for Civil Rights without retaliation.
10. Children’s privacy
Our service is intended for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently collected such information, contact us and we will delete it promptly.
11. Changes to this policy
We may update this policy as our practices evolve or as required by law. We will notify you of material changes by email or prominent notice on the site. The “last updated” date at the top of this page reflects the most recent revision.
12. Contact
Questions or concerns about this policy? Email privacy@joinfae.com. Use the same address for privacy complaints and HIPAA-related requests, or contact support@joinfae.com for help. Please do not include medical records or identity documents in your initial email; we can arrange an appropriate way to verify and handle your request.