Ro Privacy Policy

This document is Ro's consumer-facing Privacy Policy governing the collection, use, disclosure, and retention of personal information across Ro's telehealth platform, which includes services such as Roman, Ro Derm, and Ro Fertility. The policy states that Ro collects identifiers, health and medical information, financial data, device and usage information, and communications content, and the terms authorize sharing this information with affiliated entities, healthcare providers, pharmacies, payment processors, analytics vendors, advertising partners, and data brokers for marketing purposes. Notably, the policy discloses that pixel tracking technologies from advertising platforms including Meta and Google may receive health-related behavioral data generated during the patient intake and checkout flows, an operational pattern that has drawn regulatory scrutiny in the digital health sector under FTC consumer protection authority and HHS guidance on HIPAA-regulated entities. The policy engages HIPAA with respect to protected health information handled by Ro's affiliated medical practices, CCPA/CPRA for California residents, and FTC Act standards applicable to consumer-facing health data practices; the policy's disclosure that non-HIPAA-covered data flows may be used for advertising purposes warrants evaluation under applicable state health privacy laws, including Washington's My Health MY Data Act and similar statutes enacted in multiple states. Compliance teams should note that the stated uses of health-related data for advertising and the deployment of third-party tracking technologies in clinical intake flows create heightened regulatory exposure in jurisdictions with expanded health data protections.