Privacy Policy

Last updated: May 21, 2026

The short version

GolfRx collects what it needs to deliver the program — your name, email, payment info (handled by Stripe, never stored on our servers), the answers you write in the exercises, your monthly check-ins, your golf rounds, and your conversations with the AI coach. We use this data to run the program, calculate your reimbursement, and personalize what the coach knows about you. We don’t sell it. We don’t ship it to advertisers. We share it only with the service providers we need to run the platform.

You can ask us what we have on you. You can ask us to delete it. You can ask us to send you a copy. Email privacy@gogolfrx.com and we’ll handle it.

The rest of this document is the longer version. We’ve kept it as plain as we can.

1. Who we are

GolfRx is operated by GolfRx LLC, a Minnesota limited liability company (“we,” “us,” “our,” or “GolfRx”). Our website is gogolfrx.com and our member platform is at dashboard.gogolfrx.com.

This Privacy Policy describes how we collect, use, and share information when you visit our site, sign up as a member, or interact with the program.

By using GolfRx, you agree to this Privacy Policy. If you don’t agree, don’t use the service.

2. What we collect

Information you give us directly

• Account info: name, email address, password (stored hashed), and any profile details you add.
• Payment info: card details are entered through Stripe’s hosted checkout and never touch our servers. We store your Stripe customer ID, subscription status, plan, and billing history.
• Exercise responses: when you complete a worksheet, log a round, or write a reflection, we store what you wrote.
• Monthly check-ins: the GAD-7 and PHQ-9 questionnaires we ask you to complete each month, and the scores derived from them.
• AI coach conversations: your messages to the AI coach and the coach’s responses.
• Attestation records: the monthly statements you submit confirming you used the program for the purposes it’s designed for.
• Shipping address: if you reach a tier that includes physical gear, we collect a mailing address.
• Communications with us: when you email us, submit a support ticket, or reply to our messages, we keep the content of those communications.

Information collected automatically

• Session data: when you log in, we set authentication cookies so the platform recognizes you across pages and visits.
• Basic analytics: we record events like “exercise submitted,” “tier reached,” “round logged” so we can understand how the program is working and improve it. We do not use third-party tracking pixels at this time.
• Device info: browser type, operating system, IP address, and similar technical details that are standard in web server logs.

Information from third parties

• Stripe: payment status, subscription state, customer ID.
• The clinician you work with: if you complete an assessment with a licensed professional, that professional may share with us the fact that an assessment occurred, the date, the issued Letter of Medical Necessity (if any), and the status of that letter. The clinician does not share the clinical details of your assessment with us unless you separately consent.

3. What we do with it

We use your information to:

• Provide and personalize the program — including the AI coach, which references your past exercises and check-ins to give relevant responses.
• Process payments and apply reimbursements.
• Send transactional emails about your account, billing, attestations, and program milestones.
• Generate the documentation you need for HSA/FSA reimbursement purposes.
• Improve the program — by looking at aggregate patterns across members (we de-identify wherever possible).
• Communicate with you about updates, new features, or relevant content (you can opt out of non-essential emails).
• Comply with legal obligations and protect against fraud or abuse.

We do not use your data to train AI models. Your conversations with the AI coach are not used to train Anthropic’s models — that’s covered by Anthropic’s API terms.

4. Who we share it with

We share information only with:

Service providers who run the platform

• Stripe — payment processing
• Supabase — database hosting (where your account data lives)
• Anthropic — AI coach responses (your message gets sent to Anthropic’s API to generate the reply)
• Mailgun — transactional email delivery
• ActiveCampaign — marketing email and CRM
• BoldSign — e-signatures for clinician agreements
• Thinkific — course content delivery (legacy members only; new members use our in-house platform)
• Vercel — hosting for the dashboard and admin platforms
• Sentry — error monitoring (captures technical errors, may include your email if you were logged in when an error occurred)

Each of these providers operates under its own privacy practices and uses your data only to deliver its specific service to us.

Licensed clinicians you work with

If you complete an assessment with a licensed professional through GolfRx, the clinician sees your relevant information for that assessment (name, contact info, your responses to the assessment questions). The clinician operates under their own state licensing requirements and professional confidentiality rules — which are typically stronger than ours.

When required by law

We may disclose information if compelled by valid legal process (subpoena, court order, lawful request from law enforcement) or to protect the rights, property, or safety of GolfRx, our members, or others.

In a business transfer

If GolfRx LLC is ever acquired, merges, or sells substantially all of its assets, member information may transfer as part of that transaction. You’d be notified before that happens.

What we don’t do

We don’t sell your data. We don’t share your data with advertisers. We don’t share your AI coach conversations with anyone outside Anthropic (and they don’t train on them per their terms). We don’t share your clinical questionnaire scores with anyone except the clinician you’re working with and our internal staff who need access to deliver the program.

5. Cookies and similar technologies

We use cookies for:

• Authentication — keeping you logged in across pages and across the subdomains we operate (dashboard, admin, therapists). This is essential. If you block these, the platform doesn’t work.
• Session state — remembering your in-progress work between page loads.

We do not use third-party advertising cookies, retargeting pixels, or cross-site tracking tools at this time. If we ever add them, we’ll update this policy and tell you.

6. Where your data lives

Your data is stored in Supabase’s hosted infrastructure, which uses cloud servers based in the United States. By using GolfRx, you consent to your data being processed in the United States, which may have different privacy laws than the country you’re connecting from.

7. How long we keep it

• Account data — while your account is active, plus a reasonable archival period after you delete it (typically 30 days, in case of accidental deletion).
• Financial records — billing and reimbursement records are retained for 7 years to satisfy tax and audit requirements.
• Exercise responses and check-ins — retained while your account is active. Deleted when you delete your account.
• AI coach conversations — retained while your account is active. Deleted when you delete your account.
• Email logs and communications — retained for up to 3 years.
• Backups — full database backups may persist for up to 30 days after deletion, after which they cycle out.

8. Your rights

Regardless of where you live, you have the right to:

• Know what we have on you. Email privacy@gogolfrx.com and we’ll send you a copy.
• Correct anything that’s wrong. Update directly in your account or email us.
• Delete your account and your data. Note that we may retain some records (billing, tax) for the periods described in Section 7.
• Object to certain uses. Email us and tell us what you object to.
• Withdraw consent at any time by deleting your account.

We respond to verified requests within 30 days.

California residents (CCPA)

If you’re a California resident, you have the additional rights to:

• Know what specific pieces of personal information we have collected about you in the last 12 months
• Know whether your information has been sold (it hasn’t) or shared with third parties (only with the service providers listed in Section 4)
• Request deletion subject to the retention exceptions in Section 7
• Not be discriminated against for exercising these rights

To exercise CCPA rights, email privacy@gogolfrx.com with the subject “CCPA Request.”

We do not sell personal information as that term is defined under the CCPA.

9. Children

GolfRx is not directed to children under 18. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact privacy@gogolfrx.com and we’ll delete it.

10. Security

We protect your data using industry-standard practices: TLS encryption in transit, encrypted database storage, hashed passwords, role-based access control for our internal team, and routine security review of our codebase.

No system is perfectly secure. We can’t guarantee absolute security, and we recommend you use a strong, unique password for your account.

11. A note on health information

GolfRx is a wellness program. It is not therapy, not medical care, and not a substitute for either.

The questionnaires we ask you to complete (GAD-7 and PHQ-9) are widely used self-assessment tools. The scores generated from them are part of how we personalize the program for you and how we track aggregate program effectiveness. They are not a clinical diagnosis.

Some members work with licensed clinicians through GolfRx — those clinicians may be subject to HIPAA depending on their state licensure and practice setup. Your interactions with the clinician (your assessment, your Letter of Medical Necessity) are governed by the clinician’s own privacy practices, which are typically stronger than ours and which the clinician will share with you directly.

GolfRx LLC itself is not currently a HIPAA-covered entity. Treat the information you share with us accordingly — we protect it carefully, but the legal framework is wellness, not healthcare.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we’ll:

• Update the “Last updated” date at the top
• For material changes, email active members with a summary of what changed and when it takes effect
• For minor clarifications (typos, clearer wording), post the update without separate notification

Continuing to use GolfRx after a change means you accept the updated policy. If you don’t accept, delete your account.

13. Contact us

Questions, concerns, or requests:

GolfRx LLC privacy@gogolfrx.com

We typically respond within 2 business days for most inquiries, 30 days for formal data requests.