Last updated: April 8, 2026 

OVERVIEW OF THIS POLICY 

This Privacy Policy (this “Policy”) relates to the personal information that you submit when you  access and use TurnKey DPC (“we,” “our,” or “us”) website – turnkeydpc.com (“Website”) and other information we automatically collect when you access the Website. TurnKey DPC is a  managed service organization (MSO) providing operational, administrative, and business support  services to direct primary care (DPC) medical practices. Our website serves as an informational  and client-facing platform for DPC practices and business professionals interested in our services.  We do not provide direct medical care, and this Website is not intended for patient use. This Policy  explains all activities regarding your information, including but not limited to how we collect, use,  disclose, and secure it and the rights available to you. 

You are required to read, understand, and agree to how we process (collection, use, disclosure,  security, etc.) your information in this Policy. You are also required to read our Terms of Use and  print a copy of each for future reference. All defined terms not defined in this Privacy Policy shall  have the meaning subscribed to them in the Terms of Use. By your use of the Website and your  submission of the requested personal information, you hereby agree to how we process your  information as described in this Policy. If you do not agree, you should not use the Website or  submit information. 

WHAT INFORMATION DOES TURNKEY DPC COLLECT FROM YOU?

1. How We Collect Information 

We collect information from and about users of our Website in two ways: 

• Directly from you when you provide it to us. 
• Automatically as you navigate or interact with the Website. 

2. Sensitive Personal Information We Do Not Collect 

Except as expressly authorized by you, we do not collect the following categories of “sensitive  personal information”: 

• Social Security Numbers 
• Driver’s license or passport numbers 
• Third-party account numbers or login credentials (excluding credentials you create for  your TurnKey DPC account) 
• Precise geolocation 
• Protected health information 
• Credit or criminal records 
• Racial or ethnic origin 
• Political opinions 
• Membership in political, professional, or trade associations (other than the Practice) • Trade union membership 
• Religious beliefs or affiliations 
• Philosophical beliefs 
• Sexual orientation or sexual practices 
• Biometric information
• Contents of mail, email, or text messages (except messages sent through the Website) 

3. Personal Information You May Provide 

Information you voluntarily provide to us (“personal information”) when using our Website may  include: 

• First and last name 
• Business name and title 
• Mailing or business address 
• Phone number 
• Email address 
• Payment and billing information (processed securely through Stripe) • Client portal account credentials (such as username and password); information and  materials you upload or submit through your client portal account; and service  preferences and account settings 

Protected Health Information (PHI) 

As a managed service organization, TurnKey DPC does not collect Protected Health Information  through our Website. We provide operational and administrative support to DPC practices but do  not provide direct medical care or maintain patient records. This Website is intended for business  professionals interested in our MSO services. If you are a patient of a DPC practice supported by  TurnKey DPC, please direct any health information inquiries to that practice directly. 

Payment and Billing Information 

We collect payment information directly through our Website to process service fees. Payment  transactions are processed securely through Stripe, a third-party payment processor. We do not  store your full credit card number, CVV, or other sensitive card details on our servers. Stripe  processes and stores this information on our behalf in accordance with PCI-DSS standards. For  more information, see Stripe’s Privacy Policy at https://stripe.com/privacy. 

• Cookies and Similar Technologies 
• Session Cookies: These temporary cookies are used to keep you logged in during  your visit. They are automatically deleted when you close your browser. 
• Preference Cookies: These cookies remember your settings and preferences (such  as language or display settings) to provide a more personalized experience across  visits. 
• We do not use advertising or tracking cookies. You can control or disable cookies  through your browser settings; however, doing so may affect the functionality of certain  features on our site. 

We use the information we collect for the following purposes: to provide, manage, and improve  our services to DPC practices; to process payments and maintain billing records; to respond to  inquiries, requests, and support needs; to communicate with you about your account or our  services; to analyze website usage and improve functionality; and to comply with legal obligations. 

We do not sell, rent, or share your personal information with third parties for their own marketing  purposes. 

Use of hCaptcha 

We use hCaptcha, a third-party CAPTCHA service provided by Intuition Machines, Inc., on certain  forms on our Website to help prevent spam and abuse. hCaptcha may collect information about your interactions with the CAPTCHA challenge, including device and browser data, mouse  movements, and other behavioral signals, to determine whether you are a human user. The  collection and use of this information by hCaptcha is governed by the hCaptcha Privacy Policy  (https://www.hcaptcha.com/privacy) and Terms of Service (https://www.hcaptcha.com/terms). By  using forms on our Website, you acknowledge that your interaction data may be processed by  hCaptcha for bot detection and fraud prevention purposes. 

WHAT DOES TURNKEY DPC USE INFORMATION COLLECTED FOR? Any information collected by us is for a purpose in relation to your use of the Website and our  services, including: 

• Provide services to you: We collect information to enable you to use the Website,  provide MSO services to DPC practices, process payments, and fulfill other business  relationship management functions. 
• To allow communication with you: We collect your email address and phone number  to (i) contact you regarding your use of our Website, (ii) respond to your questions,  complaints, and queries, (iii) send you our periodic newsletters with important updates,  (iv) send you updates regarding our Website or this Policy and other agreements, (v) send  service-related announcements regarding the operation or availability of our services, and  (vi) send you text messages related to your account, our services, or promotional offers.  You may not opt-out of service-related communications, which are not promotional in  nature. You may opt out of promotional communications, such as newsletters and  promotional text messages, at any time by following the unsubscribe instructions included  in each email, replying STOP to any promotional text message, or by contacting us at  Website@turnkeydpc.com. Please note that we may send email as unencrypted plain text  for your convenience; if misrouted or intercepted, such email could be read more easily  than encrypted email. 
• Research and Improvement: TurnKey DPC may use aggregate or de-identified  information to improve our services, develop new service offerings, and enhance  our operational support to DPC practices. Identifiable client information is never used  for research purposes without explicit written consent. 
• Analytics: We collect information for use in performing various types of analytics. For  example, we use the information to analyze how visitors interact with our Website, where  visitors to our Website arrive from and exit to, pages visited, links clicked, text entered and  mouse movements to understand site usage, to detect fraud and potential threats and  improve our Website. We use Jetpack for these  purposes. For more information, see see Jetpack’s Privacy Policy at https://jetpack.com/support/privacy/.
• Provide technical support: We collect information to optimize or improve our Website and operations, for example, training and quality assurance, data analysis, audits,  developing new products, enhancing our Website, improving our products and/or Website, and identifying Website trends. 
• Fulfilling legal and compliance obligations: We collect information to fulfill our legal  obligations. We may also collect information to detect fraud or other suspicious activity.
• For other purposes with your consent: We may collect and process your information for some other reasons which your consent will be sought before we process such  information.  

We may use anonymous or de-identified information for any lawful purpose. If we combine anonymous information with personal information, we will treat the combined information as  personal information for as long as it remains combined. 

DO THIRD PARTIES COLLECT OR USE INFORMATION? 

When you use the Website, certain third parties may use automatic information collection  technologies to collect information about you or your device. These third parties may include: 

• Jetpack
• Fluent Forms
• MailPoet
• Yoast SEO

These third parties may use tracking technologies to collect information about you when you use  the Website. The information they collect may be associated with your personal information or  they may collect information, including personal information, about your online activities over time  and across different websites, and other online services. They may use this information to provide  you with interest-based (behavioral) advertising or other targeted content. 

We do not control these third parties’ tracking technologies or how they may be used. If you have  any questions about an advertisement or other targeted content, you should contact the  responsible provider directly. For your convenience, our Website may provide links to other  websites. When you click on one of these links, you are leaving our Website and entering another  site. We are not responsible for such third-party sites. You should carefully review the privacy  statements of any other websites you visit, because those privacy statements will apply to your  visit to such other sites. 

Third-Party Software/Website. We use the following third-party software/Website to collect and  process your personal data for the following reasons: 

• Stripe: To securely process payments made through our Website. See Stripe’s Privacy Policy at https://stripe.com/privacy. 
• Spruce Health: To send text messages related to your account, our services, and  promotional communications. See Spruce Health’s Privacy Policy at  https://sprucehealth.com/privacy-policy/. 

By using and continuing to use the Website, you agree to all privacy policies and other terms of  these third-party software/service companies. You do not hold us responsible for any claims or  liabilities arising out of the use of these third-party software/Website.  

HOW PERSONAL DATA IS COLLECTED. 

Active Collection. Some of our Website, including our client portal, may ask you to submit your personal information in order for you to benefit from the specified features. We collect personal  information from you only when you voluntarily submit it to us, such as when you: 

• Submit materials through our Website. 
• Complete in-take documents or any other form. 
• Purchase a product or service from us or from one of our vendors, suppliers or other  agents. 
• Sign-up to receive email newsletters or other correspondence. 
• Request e-mail, mail or telephone support or services. 
• Register for or log into your client portal account.  
• Upload documents or other materials through your client portal.  
• View or manage billing information, service details, or account settings through your  client portal. 

You will be informed on what information is required and what information is optional at the time of  your submission.

Passive Collection. As you use our Website, we may passively collect (that is, gathered without you actively providing the information) non-personal identifiable information and/or use the following  technologies which collect such information on our behalf: 

Browser and/or Device Information. Certain information is collected from most browsers, such as  your IP address, your media access control (MAC) address, computer type (Windows or  Macintosh), screen resolution, operating system version, internet browser type and version. We  also may collect information about any mobile device used to access our Website, such as a unique  device identifier and type if you access our Website through a mobile device. Your IP address is  a number that is automatically assigned to your computer or device by your Internet Service  Provider. An IP address is identified and logged automatically in our server log files whenever a  user accesses our Website, along with the time and date of the visit and/or use and the page(s)  and/or features that are visited and/or used. Collecting IP addresses is standard practice on the  Internet and is done automatically by many websites and/or Website. 

Website Usage Data. When you access our Website, we and our service providers may track and  collect application and/or Website usage data, such as date and time that your devices access  our servers and what information and files have been downloaded and/or uploaded to our Website on your device number. 

The Website use cookies (including Flash cookies). A cookie is a small, removable data file that  is stored by your web browser or application on your computer and/or device. Cookies allow us to  collect various information including, but not limited to, browser type, time spent on our Website,  features and pages visited, and language preferences. We and our service providers use this  information for security purposes, to facilitate navigation, display information more effectively,  serve you with more tailored information, facilitate your ongoing access to and use of our Website and to personalize your experience while using our Website. We also use cookies to recognize  your computer and/or device, which makes your use of our Website easier, such as to help you log  into our Website. 

You can choose to have your computer and/or device warn you each time a cookie is being sent to your computer and/or device or you can choose to turn off all cookies. You do this through your  computer and/or device settings. If you turn cookies off, you will not have access to many features  that make your use of our Website more efficient and enjoyable, and in some cases, some of our  Website will not function or will function with limited capability.  

Pixel Tags, web beacons, clear GIFs and other similar technologies. We and our service providers  may use pixel tags, web beacons, clear GIFs and other similar technologies in connection with some of our Website (including email messages) to, among other things, analyze our users’  behavior and information about them, track the actions of the users of our Website and/or  recipients of our emails, and compile statistics about our Website usage and response rates. 

SHARING INFORMATION AND DISCLOSURE 

We disclose your personal information collected from you through our Website to third parties in  the following manner and for the following reasons: 

• If you have consented to such disclosures. 
• If there are special circumstances, including, but not limited to, any reorganization, merger,  sale, joint venture, assignment, transfer or other disposition of all or any portion of our business or assets (including in connection with a bankruptcy, liquidation or similar  proceeding) and the due diligence related to such circumstances. 
• If the third party is our service provider who provides services to us in connection with our  Website. 
• If the party is our affiliate, in which case we are the party responsible (or data controller)  for the management of the jointly used personal information. 
• Upon request by the government (including, but not limited to, the investigatory and  enforcement powers of the Federal Trade Commission and other administrative bodies). • As permitted or required by applicable law. 
• In response to a court order or other legal process. 
• To enforce our Privacy Policy or Terms of Use other agreements and polices applicable  to our Website. 
• To protect our operations, rights, privacy, safety and/or property. 
• To contact, identify or bring legal action against someone who may be causing injury to or  interference with our or others’ rights or property including, but not limited to, claims for  infringement of intellectual property, invasions of privacy or situations involving threats or  alleged threats to the physical safety of a person’s property; or companies assisting in  fraud protection or investigation. 

We also may provide aggregated, non-personally identifiable information to third parties for any  legal purposes whatsoever. 

PROTECTING YOUR INFORMATION 

We use commercially reasonable efforts to safeguard and secure your personal information while  stored on our computer systems and/or transmitted to or from our computer systems. Regardless  of these efforts by us, no data transmission over the internet or data storage system can be  guaranteed to be 100% secure. Any transmission of personal information is at your own risk. We  are not responsible for circumvention of any privacy settings or security measures contained on  the Website. If you have reason to believe that your interaction, stored data and/or transmissions  to and with us are no longer secure (for example, if you feel that the security of any account that  you have with us has been comprised), please immediately notify us of the problem by contacting  us immediately at Website@turnkeydpc.com. 

Some features of our services may require you to set up a user ID and password. We recommend  that you do not divulge your password to anyone. We will never ask you for your password in an  unsolicited telephone call or email. If you suspect you have received a fraudulent communication  from us or any of our affiliates, please contact us immediately at Website@turnkeydpc.com. 

Do not provide your personal or financial information in response to an email request or after  clicking on a link from an email. We do not ask for this type of information through an email or any  communication. 

To help protect your computer and personal information, make sure you have current anti-virus  and firewall software installed on your computer and update such software on a regular basis.  Also, please review your credit card statements carefully and verify that all transactions are  authorized and report any discrepancies immediately to your credit card issuer. 

CHILDREN’S ONLINE PRIVACY 

Our Website is intended for business professionals and is not directed at children under the age  of 13. We do not knowingly collect personal information from children. If we learn that we have inadvertently collected personal information from a child under 13 without verification of parental  consent, we will delete that information promptly. Please contact us at Website@turnkeydpc.com  if you believe we may have inadvertently collected such information. 

CROSS-BORDER TRANSFER 

The Website is controlled and operated by us from the United States and is not intended to subject  us to the laws or jurisdiction of any state, country or territory other than that of the United States.  Your personal information may be stored and processed in any country where we have facilities or service providers, and by using the Website or by providing consent to us (where required by  law), you agree to the transfer of information to countries outside of your country of residence,  including the United States, which may provide for different data protection rules than in your  country. Additionally, when using or disclosing personal information transferred from the European Union, we use standard contractual clauses approved by the European Commission,  adopt other means under European Union law for ensuring adequate safeguards, or obtain your  consent. In certain circumstances, courts, law enforcement agencies, regulatory agencies or  security authorities in those other countries may be entitled to access your personal information. 

CALIFORNIA PRIVACY RIGHTS 

If you are a resident of the State of California, you may exercise the rights described below. By  choosing to exercise your rights as described below, you are declaring that you are a California  resident as defined in the California Consumer Privacy Act of 2018, Civil Code Section 1798.100  (“CCPA”).

Disclosure of Personal Information We  Collect About You	You have the right to know, and request disclosure of: The categories of personal information we have collected about you, including sensitive personal information The categories of sources from which the personal information is collected The categories of third parties to whom we disclose personal information, if any –and– The specific pieces of personal information we have collected about you Please note that we are not required to: Retain any personal information about you that was collected for a single one time transaction if, in the ordinary course of business, that information about you is not retained Reidentify or otherwise link any data that, in the ordinary course of business, is not maintained in a manner that would be considered personal information –or– Provide the personal information to you more than twice in a 12-month period
Disclosure of Personal Information Sold, Shared, or Disclosed for a Business Purpose	While we are required to provide this notice, we do not sell any personal information. In connection with any personal information we may sell, share, or disclose to a third party for a business purpose, you have the right to know: The categories of personal information about you that we sold or shared and the categories of third parties to whom the personal information was sold or shared –and- The categories of personal information that we disclosed about you for a business purpose and the categories of persons to whom the personal information was disclosed for a business purpose You have the right to opt-out of the sale of your personal information or sharing of your personal information for the purpose of targeted behavioral advertising. If you exercise your right to opt-out of the sale or sharing of your personal information, we will refrain from selling or sharing your personal information, unless you subsequently provide express authorization for the sale or sharing of your personal information. To opt-out of the sale or sharing of your personal information, please email Website@turnkeydpc.com.
Right to Limit Use of Sensitive Personal Information	You have the right to limit the use and disclosure of your sensitive personal information to the use which is necessary to: Perform the services or provide the goods reasonably expected by an  average consumer who requests those  goods or services To perform the following services: (1)  Helping to ensure security and integrity to the extent the use of the User’s personal information is reasonably  necessary and proportionate for these  purposes; (2) Short-term, transient use, including, but not limited to, non personalized advertising shown as part of a User’s current interaction with the business, provided that the User’s personal information is not disclosed to another third party and is not used to build a profile about the User or otherwise alter the User’s experience outside the current interaction with the business; (3) Performing services on behalf of the business, including maintaining or servicing accounts, providing client service, processing or fulfilling orders and transactions, verifying client information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business; and (4) Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned,  manufactured, manufactured for, or controlled by the business –and– As authorized by further regulations You have a right to know if your sensitive  personal information may be used, or disclosed  to a service provider or contractor, for  additional, specified purposes. To limit the use of your sensitive personal  information, please email  Website@turnkeydpc.com.

Right to Deletion

Subject to certain exceptions set out below, on receipt of a verifiable request from you, we will: Delete your personal information from our records –and– Direct third parties to whom the business has sold or shared your personal information to delete your personal information unless this proves impossible or involves disproportionate effort Please note that we may not delete your personal information if it is reasonably necessary to Complete the transaction for which the personal information was collected, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, provide a good or service requested by you, or reasonably anticipated within the context of our  ongoing business relationship with you,  or otherwise perform a contract  between you and us Help to ensure security and integrity to the extent the use of the User’s personal information is reasonably necessary and proportionate for those purposes Debug to identify and repair errors that impair existing intended functionality Exercise free speech, ensure the right of another User to exercise his or her right of free speech, or exercise another right provided for by law Comply with the California Electronic Communications Privacy Act Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when our deletion of the information is likely to render impossible or seriously impair the achievement of such research, provided we have obtained your informed consent Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us Comply with an existing legal obligation –or– Otherwise use your personal information, internally, in a lawful manner that is compatible with the context in which you provided the information

Right of Correction

If we maintain inaccurate personal information about you, you have the right to request us to; correct that inaccurate personal information. Upon receipt of a verifiable request from you,  we will use commercially reasonable efforts to correct the inaccurate personal information.

Protection Against Retaliation

You have the right to not be retaliated against by us because you exercised any of your rights under the CCPA/CPRA. This means we cannot, among other things: Deny goods or services to you Charge different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties Provide a different level or quality of goods or services to you –or– Suggest that you will receive a different price or rate for goods or services or a different level or quality of goods or services Please note that we may charge a different price or rate or provide a different level or quality of Website to you, if that difference is reasonably related to the value provided to our business by your personal information.

Exercising your Rights. If you wish to exercise one of these rights, please email us at  Website@turnkeydpc.com. Please include your name and email address with your request.  Before we can process any such request, we will need to verify your identity through the email  address or telephone number associated with your use of our Website or your account with us  and confirm your request prior to fulfilling any such request and reserve the right to deny a request  where we are unable to satisfactorily complete this process. If you authorize someone to make a  request on your behalf, we may also deny your request if we are unable to verify that the individual  making the request is authorized to act on your behalf. 

You can also submit a complaint to the California Office of the Attorney General. For more  information on the California Consumer Privacy Act please visit https://www.oag.ca.gov/privacy/ccpa. 

GDPR PRIVACY RIGHTS 

If you are a resident of the European Union or the United Kingdom, you may exercise the rights described below.

Right to Be Informed	The right to know or be notified about the  collection and use of your personal  information.
Right to Access	The right to be provided with a copy of your  personal information (the right of access)
Right to Rectification	The right to require us to correct any mistakes  in your personal information
Right to be Forgotten	The right to require us to delete your personal  information—in certain situations
Right to Restriction of Processing	The right to require us to restrict processing of  your personal information—in certain  circumstances, e.g., if you contest the  accuracy of the data
Right to Data Portability	The right to receive the personal information  you provided to us, in a structured, commonly used, and machine-readable format and/or  transmit that data to a third party—in certain  situations

Right to Object	The right to object: At any time to your personal information being processed for direct marketing (including profiling) In certain other situations to our continued  processing of your personal information, e.g., processing carried out for the purpose of our legitimate interests
Right Not to be Subject to Automated Individual Decision-Making	The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you

For further information on each of those rights, including the circumstances in which they apply,  see the guidance from the UK Information Commissioner’s Office (ICO) on individual rights under  the EU General Data Protection Regulation. 

If you wish to exercise one of these rights, please email us at Website@turnkeydpc.com. Please  include your name and email address with your request. Before we can process any such request,  we will need to verify your identity through the email address or telephone number associated  with your use of our Website or your account with us and confirm your request prior to fulfilling any 

such request and reserve the right to deny a request where we are unable to satisfactorily  complete this process. If you authorize someone to make a request on your behalf, we may also  deny your request if we are unable to verify that the individual making the request is authorized  to act on your behalf. 

We hope that we can resolve any query or concern you raise about our use of your information. The General Data Protection Regulation also gives you right to lodge a complaint with a  supervisory authority, in the European Union (or European Economic Area) state where you work,  normally live, or where any alleged infringement of data protection laws occurred. The supervisory  authority can be found here. 

YOUR RIGHTS WITH RESPECT TO PERSONAL DATA. 

• You can review and change your personal information by sending us an email at  Website@turnkeydpc.com, or delete any personal information free of charge that you  have provided to us. We cannot delete your personal information except by also deleting  your user account. 
• We will respond to a request to access, correct, or delete any data within 30 days of the  date we receive the request. 
• We may not accommodate a request to change information if we believe the change would  violate or breach any law or legal requirement or cause the information to be incorrect. • If upon your request, we refuse to amend, correct, or delete your personal information, we will set out our reasons for not doing so and provide you with details of how you may  complain about our refusal. 

HOW LONG PERSONAL DATA IS KEPT?

We retain your personal information, as long as necessary, to fulfill the purposes it was initially  collected for or otherwise required by law. We may retain personal information as necessary to  comply with legal obligations, resolve disputes, and enforce our agreements.   

DO NOT TRACK DISCLOSURE 

Third parties such as advertising networks, analytics providers, and widget providers may collect  information about your online activities over time and across different websites when you access  or use our Website. Currently, our Website does not respond to “Do Not Track” signals from web  browsers. However, you may disable certain tracking as discussed in the cookies section of this  Policy. 

CHANGES TO OUR PRIVACY POLICY 

It is our policy to post any changes we make to our privacy policy on this page with a notice that  the privacy policy has been updated on the Website home page. If we make material changes to  how we treat our users’ personal information, we will notify you by email to the primary email  address specified in your account and/or through a notice on the Website home page. Please  take a look at the “LAST UPDATED” legend on the top of this page to see when this Privacy  Policy was last revised. Any such change shall be effective immediately upon posting of the  revised Privacy Policy within our Website. You are responsible for ensuring we have an up-to-date active and deliverable email address for you, and for periodically visiting our Website and this Privacy Policy to check for any changes. 

CONTACT US WITH QUESTIONS AND FEEDBACK 

We welcome your questions, comments, and concerns about this Privacy Policy and our privacy  practices. Please email us at: Website@turnkeydpc.com.