Effective date: October 27, 2026
Last updated: October 27, 2026
shiftMD, LLC ("shiftMD," "we," "us") operates the shiftMD mobile apps for iPhone and Android (the "Apps") and the services behind them. This policy covers the Apps only.
shiftMD is a closed-distribution healthcare marketplace. Licensed healthcare providers and their practice staff use the Apps to recommend supplements, devices and over-the-counter products to their patients. The patient receives a text message with a checkout link, buys on the shiftMD website, and shiftMD ships the order from its own warehouse. Providers can earn from completed orders.
Who uses the Apps. The Apps are for healthcare providers (for example MD, DO, PA and NP) and the people who work with them. There are three kinds of account: a Master Account (the provider who owns the account), a Clinical Provider (a provider under a Master Account), and Staff (a non-provider team member who sends recommendations on a linked provider's behalf). In this policy, "you" means a person who uses the Apps.
Patients do not use the Apps. Patients do not create accounts in the Apps. A patient's mobile number reaches us because a provider types it in to send a recommendation, or because the patient scans a QR code shown in the provider's App and texts us to receive their recommendation (see section 2.2). When a patient buys, they do so on the shiftMD checkout website, outside the Apps.
Mailing address: shiftMD, LLC, 5000 SW 75 Av Suite 113, Miami, Florida 33155
When you sign up or are added as staff
A Master Account can add Staff and Clinical Providers. When it does, it gives us that person's first and last name, mobile number, title and, optionally, NPI number.
In your profile and settings
Agreements and onboarding
Payouts (see section 6)
Referrals ("Invite a Colleague")
Support
To send a product recommendation, a provider (or their staff) enters the patient's mobile number and chooses the products. The App does not ask for the patient's name, date of birth, diagnosis or any other health information when a recommendation is sent. We use the number to text the patient a checkout link on the provider's behalf (see section 5).
For a QR-code recommendation, the provider enters no patient information. The patient scans a QR code shown in the provider's App. This opens the patient's own messaging app with a pre-filled message asking to receive their recommendation. When the patient sends that message, we receive the patient's mobile number from it, and we text the patient a link to their cart page.
If a patient buys, they give their own name, shipping and billing address, email and payment details on the shiftMD checkout website, not in the App. Card details are entered into Stripe's payment fields (see section 6).
My Patients. After a provider signs the BAA, the "My Patients" area of the App shows that provider information about their patients who bought through the provider's store: name, mobile number, email, address, order history, products ordered, order totals, shipping and billing names and addresses, and tracking numbers. We show this so the recommending provider can see whether the patient is actively taking the products they recommended. The App shows this information but does not store it on the phone, and access is protected by Face ID, Touch ID, fingerprint or device passcode. See section 11 for how the BAA applies.
With every request to our servers, the App sends:
IP address and approximate location. When the App contacts our servers, our servers see your device's IP address. Our servers send that IP address to ipinfo.io, a third-party IP lookup service, and store the result with your account: your IP address, city, region, country, approximate coordinates, network host name, and internet provider or organization. We use this to keep a record of the devices and places your account is used from. The App does not use your phone's GPS or location services, and does not ask for location permission.
Push notifications (iPhone). If you allow notifications, the iPhone App sends us a push notification token linked to your account and device so we can send you notifications. The Android App does not currently register for push notifications.
How you use the App (iPhone). The iPhone App records in-app activity and sends it to us in batches with your account ID and device identifier: screens you open and how long you stay on them; products, categories and bundles you view; searches you run (including the search words); search results you tap; products you add to or remove from favorites or your cart; and the tabs you switch between. The Android App does not currently send this activity data.
Address and ZIP lookups. When you type a practice address or ZIP code, the App uses your phone's built-in mapping service to suggest addresses or fill in the city and state.
Videos and help content. Some product and help videos are hosted by a third-party video service and play inside the App, and help articles are hosted on our Zendesk help center. When you play or open them, that service receives your IP address and device information under its own privacy policy.
What we do not collect. The Apps:
To work offline and keep you signed in, the App stores some information on your device:
We use the information above to:
Patients belong to the provider. While a provider's store is open, patients who buy through it are that provider's patients. shiftMD handles the logistics and technology. shiftMD does not contact or market to a provider's patients without the provider's consent.
We do not sell, rent or give away provider or patient information to any third party, and we do not share it for cross-context behavioral advertising. We share information only with the service providers that help us run the Apps and in the other cases below.
Service providers that process information for us under contract:
| Provider | What they do for us | What they receive |
|---|---|---|
| Amazon Web Services | Hosting, databases, file storage, our own email system, and push notifications and provider text messages | Everything we store; provider email addresses and phone numbers; push tokens |
| Twilio | Text messages: sign-in codes, and checkout links to patients | Provider and patient mobile numbers; message content, which includes the provider's name |
| Stripe | Patient card payments at checkout; the paid membership fee; provider payouts (Stripe Connect) | Card details entered into Stripe's payment fields; for patient orders, the patient's name, email, phone and shipping address and the order contents (product names and quantities); for the membership fee, the provider's name, email, phone and address; payout amounts; identity, bank and tax details providers enter on Stripe's own pages |
| PayPal | Provider payouts (PayPal Payouts) | PayPal email and name; payout amounts; tax details providers give PayPal directly |
| ipinfo.io | IP address lookup | Your IP address |
| Zendesk | Help center | IP address and device information when you open help articles |
| Shipping carriers | Delivering orders that shiftMD packs and ships from its own warehouse | Patient name and shipping address |
| AI and analytics tools used by shiftMD staff | Internal reporting and support | Provider and business information only; these tools do not process patient information |
shiftMD fulfills orders itself and does not use third-party logistics providers. Email is sent through shiftMD's own system on AWS; we do not use a third-party email marketing service.
Your practice. Information you enter in a Master Account is visible to that account's administrators. A Staff member's activity and the orders they send are visible to the Master Account and to the provider the order is sent under.
shiftMD staff. Our employees, including your assigned Practice Development Manager, see your account, practice and order information in our internal systems in order to support you.
Patients. Text messages to patients are written as coming from you, the recommending provider, and include your name.
Legal and safety. We may disclose information if the law requires it, to respond to lawful requests, or to protect the rights, property or safety of shiftMD, our users or others.
Business transfers. If shiftMD is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that deal, subject to this policy.
We keep information for as long as your account is active, and afterwards for as long as we need it to meet our legal, tax and accounting obligations, resolve disputes, and enforce our agreements.
Update your information. You can view and edit your profile, practice details, communication preferences and payout method in the App under Settings.
Notifications. You can turn push notifications on or off in your phone's settings.
Marketing. You can opt out of marketing messages at any time: reply STOP to a marketing text, or email us at support@shiftmd.com. You will still receive system and service messages, such as sign-in codes and order, account and security messages.
Close your account. You can close your account from inside the App: Settings → Membership → Close Account, then type CLOSE to confirm. You can also email us at support@shiftmd.com to ask us to close your account.
When you close your account:
Your privacy rights. Depending on where you live, you may have the right to:
To make a request, email support@shiftmd.com. We will verify your identity, for example by sending a code to the mobile number on your account, and we will respond within the time the law requires. You may use an authorized agent; we may ask for proof that the agent is authorized. If we deny your request, you may appeal by replying to our decision.
Patients. If you are a patient and want to know what information shiftMD has about you, or want it deleted, email support@shiftmd.com. Where we hold your information on behalf of your provider, we may refer your request to your provider.
The Apps are for healthcare professionals and their staff. Our services are not directed to children, and we do not knowingly collect personal information from children. Any information about a minor patient is provided by the patient's parent or guardian. If you believe a child has given us information, contact us and we will delete it.
We use administrative, technical and physical safeguards to protect information, including:
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a security breach that affects your information, we will notify you as required by law.
shiftMD designed the recommendation flow so that no health information is collected when a provider sends a recommendation: the App sends only the patient's mobile number and the products selected, with no name, date of birth or diagnosis attached.
Before a provider can view patient identity and order information in My Patients, the App asks them to read and sign a Business Associate Agreement (BAA) with shiftMD. To the extent shiftMD creates, receives, maintains or transmits protected health information (PHI) on behalf of a provider who is a HIPAA covered entity, shiftMD handles that PHI as a business associate as the BAA requires, and the BAA governs over this policy where they conflict.
This policy does not replace a provider's own Notice of Privacy Practices to their patients.
We may update this policy. If we make material changes, we will notify you in the App or by email or text before the change takes effect, and we will update the "Last updated" date.
Questions and privacy requests go to:
shiftMD, LLC
Email: support@shiftmd.com
Mail: 5000 SW 75 Av Suite 113, Miami, Florida 33155