Last updated: September 3, 2026
This Privacy Policy explains how IvySource Inc. d/b/a Underly (“Underly,” “we,” “us” or “our”) collects, uses and shares personal information through the websites, online platform, intake experience and related services that link to this policy.
Underly provides technology and administrative services. Clinical care is provided by independent licensed healthcare providers. Information maintained by your treating medical group may be protected health information under HIPAA and governed by that medical group’s Notice of Privacy Practices rather than, or in addition to, this Privacy Policy.
Pharmacies and other independent healthcare organizations may also provide their own privacy notices.
Depending on how you use the services, we may collect:
Contact and account information, such as your name, email address, telephone number, mailing address, date of birth and login credentials.
Identity and eligibility information, such as your state of residence, government-issued identification and information used to verify your identity or eligibility.
Health and treatment information, such as health history, current conditions, medications, allergies, goals, questionnaire responses, photographs, laboratory information, clinician communications, prescriptions and treatment status.
Order and transaction information, such as products or services requested, shipping address, payment status, refunds and order history. Payment-card information is generally collected directly by our payment processor.
Communications, including messages, support requests, feedback and records of your interactions with us.
Device and usage information, such as IP address, browser type, device identifiers, pages viewed, approximate location derived from IP address and interactions with our website or emails.
Cookie and similar-technology information, as described below.
We may receive information directly from you, automatically from your device, and from providers, pharmacies, payment processors, identity-verification services, delivery carriers and program partners involved in providing the services you request.
We may use personal information to:
provide, operate and support the services;
create and manage your account;
connect you with a licensed healthcare provider and pharmacy;
support clinical review, prescriptions, fulfillment and delivery;
process payments, cancellations, refunds and customer-service requests;
verify identity, eligibility and location;
send account, care, order, security and other service-related communications;
maintain, secure and improve the services;
prevent fraud, misuse and security incidents;
comply with law and protect rights, safety and property; and
use information for another purpose disclosed when it is collected or with your consent.
We may create aggregated or de-identified information that cannot reasonably be linked to you and use it for lawful business, analytics and service-improvement purposes. We will not attempt to re-identify information that we maintain as de-identified except as permitted by law.
We may share personal information with:
Healthcare providers, including Arora Health & Aesthetics and its licensed clinicians, so they can evaluate and provide clinical services.
Pharmacies, including The Pharmacy Hub or another licensed pharmacy partner, to process and fulfill prescriptions.
Service providers, such as hosting, platform, security, identity-verification, communications, customer-support, payment-processing and delivery vendors that perform services for us.
Program partners, if you access the services through a partner-sponsored or partner-branded program. We may provide the partner with limited enrollment, eligibility, transaction or aggregated program information as disclosed when you enroll. We do not provide your clinical intake, diagnosis or prescription information to a program partner unless you direct or authorize us to do so, or the disclosure is otherwise permitted by law.
Legal and safety recipients, when reasonably necessary to comply with law, respond to legal process, investigate fraud or security incidents, enforce our agreements or protect rights, safety and property.
Transaction participants, in connection with a financing, merger, acquisition, reorganization or sale of all or part of our business, subject to applicable legal restrictions.
Other recipients at your direction or with your consent.
We and our service providers may use cookies and similar technologies to keep the website working, remember preferences, understand general website usage and protect the services.
We do not use information entered into the medical intake or patient account for targeted advertising. Any optional advertising or analytics technologies used on public website pages must be disclosed through the applicable cookie notice and preference controls.
Your browser may allow you to block or delete cookies. Some features may not work correctly if required cookies are disabled.
You may update certain account information through your account or contact us. You may opt out of marketing emails by using the unsubscribe link in the message. Service-related communications may continue while you use the services.
Depending on where you live, you may have rights to request access to, correction of, deletion of or a copy of certain personal information, or to appeal a decision concerning a privacy request. You may also have rights concerning consumer health data, targeted advertising, sale or sharing of personal information, or withdrawal of consent.
To submit a request, email hello@underly.ai with “Privacy Request” in the subject line. We may need to verify your identity before completing a request. Certain information may be retained or excluded from a request when permitted or required by law, including medical records maintained by a healthcare provider.
We use administrative, technical and physical safeguards designed to protect personal information. No system or method of transmission is completely secure, and we cannot guarantee absolute security. You are responsible for protecting your password and promptly reporting suspected unauthorized account access.
We retain personal information for as long as reasonably necessary to provide the services, comply with legal and contractual obligations, resolve disputes, maintain security and enforce agreements. Healthcare providers and pharmacies may retain medical and prescription records under their own legal obligations and retention policies.
The services are intended for adults. We do not knowingly offer the services to or collect personal information directly from anyone under 18. If you believe a person under 18 has provided personal information through the services, contact us.
Our services may link to websites or services operated by other organizations. Their privacy practices are governed by their own notices, not this Privacy Policy.
We may update this Privacy Policy from time to time. We will post the revised version with a new “Last updated” date and provide additional notice when required by law.
IvySource Inc. d/b/a Underly
191 Grand St
New York, NY 10013
Phone: (302) 632-1368
Email: hello@underly.ai
Questions about clinical records or the medical group’s privacy practices may be directed to:
Arora Health & Aesthetics
300 Lenora Street
Seattle, WA 98121
medicalcompliance@arorahealthgroup.com
www.arora-health.com