Privacy

Effective September 30, 2026.

Who we are

NicoCares by Totality ("NicoCares", "we", "us") runs nicocares.com, a service that coordinates physician-guided weight care. This policy explains what personal information we collect when you use the site, the eligibility check, your account and the care that follows, what we do with it, who receives it, how long we keep it, and the choices you have.

NicoCares coordinates care; it does not practice medicine. Independent physicians licensed in your state make every clinical decision, and licensed pharmacies fill the prescriptions they write.

Questions and requests about this policy go to [email protected].

What we collect

What you give us

Launch list and newsletter. Your name and email address for the launch list, or your email address alone for the newsletter.
Eligibility check. Your name, email address and phone number; your state, delivery address and the pharmacy you choose; your goal, height, current and goal weight and date of birth; and your answers about medications you have taken and about health conditions. Finishing the check also records your consent to text messages about your account and care.
Your account. Your email address, a display name if you add one, and the one-time codes and links you use to sign in.
Medical intake. Your legal name, address and gender; your current medication and dose; your weight history and goal, appetite, water intake and side effects; your allergies, other medications and supplements and past conditions; how you heard about us; and a photo of a government-issued ID.
Refill check-ins. Whether you took your medication as prescribed, your weight and how it has changed, side effects, safety questions, new allergies, your dosage preference and confirmation of your shipping address.
Payment. You give your payment details on Stripe's secure checkout page. We receive confirmation of the plan you chose and of the payment method, not your card number.
Messages. What you write to your care team through Spruce Health, and anything you send us by email.

Your eligibility answers, medical intake and refill check-ins are health information, and we treat them as the most sensitive information we hold.

What is recorded automatically

When you submit a form or sign in, our systems record your IP address, your browser's user-agent string and the page you were on. We use them to keep the service secure and to investigate misuse. Cookies and browser storage are described in their own section below.

How we use it

To let a physician decide whether treatment may be appropriate for you, and to arrange the care you sign up for.
To create your account, sign you in and keep it secure.
To take payment and manage your plan.
To send a prescription written for you to the pharmacy you chose, and to ship your order.
To contact you by email and, with your consent, by text message about your eligibility, account, care and orders.
To send the launch updates or newsletter you asked for.
To prevent fraud, keep the service secure and meet our legal obligations.

We do not sell your personal information. We do not share it for cross-context behavioral advertising, and we do not use your health information for marketing.

Who receives it

Your physician. An independent physician licensed in your state reviews your eligibility answers, medical intake, ID and check-ins to decide what is clinically appropriate.
Your pharmacy. The pharmacy you chose receives the prescription and the details it needs to fill and deliver it.
Stripe processes your payment.
Spruce Health hosts the secure messaging between you and your care team, and sends you an invitation to set up your messaging account.
Google. As you type your address, the text you enter and an approximate map location are sent to Google's place services to suggest matching addresses and nearby pharmacies. Before your eligibility answers are sent on, the delivery address line alone may be checked with Google's Address Validation service, to confirm it is a real, deliverable address. Nothing else you answered is sent to Google.
Service providers that host our systems and deliver our email and text messages, under agreements that limit them to providing that service to us.
Legal and safety disclosures, when the law requires it, in response to a valid legal request, or to protect you or someone else from harm.
A successor business. If NicoCares is merged, acquired or sold, your information may transfer with it, and this policy continues to apply to it.

Cookies and browser storage

Sign-in cookies. They keep you signed in and protect your account's forms against requests from other sites. They last until you close your browser.
A care-services sign-in cookie, set for nicocares.com so your account works across NicoCares' care services.
Your unfinished eligibility check and refill check-in. Your answers so far are kept in your browser's session storage, so a reload does not lose them. They are kept in that tab only, are deleted once your check or check-in is received or when you close the tab, and expire after 24 hours in any case. If you are signed in, your unfinished eligibility check is also saved to your account as you answer, so you can continue it on another device, as described under how long we keep it. Apart from that, these drafts are not sent anywhere on their own.
Your cookie choice. If the site asks for your cookie preferences, a cookie remembers what you chose so you are not asked on every page.
Small session flags that let the page header show whether you are signed in.

If the site shows a cookie notice, you can accept or decline analytics cookies there. If your browser sends a Global Privacy Control signal, we treat it as an opt-out of any advertising use of your information, which we do not make in any case.

How long we keep it

Account, eligibility, intake, check-in and payment records are kept while your account is open, and afterwards for as long as the law requires us to keep medical and financial records.
Launch-list and newsletter sign-ups, with the IP address and browser details recorded when you signed up, are kept until you ask us to delete them. If you unsubscribe, we keep your email address only so that we never email you again.
The outcome of your eligibility check, meaning whether the program may suit you, is stored against a one-way hash of your email address rather than the address itself, so we can take you straight to choosing a plan. It is deleted after 180 days unless it is renewed. A note that you started checkout is kept the same way for one hour.
Your unfinished eligibility check and refill check-in are kept in your browser for at most 24 hours, as described above.
If you are signed in, your unfinished eligibility check is also saved to your account, encrypted. It is erased when your check is received, 7 days after it was last saved, or when your account is closed, whichever comes first.

How we protect it

Connections to the site are encrypted. Only staff whose role needs a record can open it, and that permission is checked on every request. You sign in with a one-time code or link sent to your email address, so there is no password to steal. No system is perfectly secure; if a breach affects your information, we will tell you as the law requires.

Your choices and rights

You can ask for a copy of the personal information we hold about you, and ask us to correct or delete it.
You can withdraw a consent you gave, including consent to text messages, and where your state's law gives you further rights over consumer health data, you can exercise them the same way.
You can unsubscribe from marketing email with the link in any message we send, and opt out of text messages by following the instructions in any text or by emailing us.
If we decline a request, you can ask us to reconsider it, and you can contact the attorney general of your state.

To make a request, email [email protected] from the address on your account, or name that address in your message. We confirm your identity before acting, respond within 45 days, and tell you if we need longer and why. You may use an authorized agent. We keep only what the law requires us to keep, and we will not treat you differently for using any of these rights.

Children

NicoCares is for adults aged 18 or older. We do not knowingly collect information from anyone younger, and we delete it if we learn we have.

Where we operate

NicoCares is offered in the United States only, and the eligibility check tells you if we do not serve your state.

Changes to this policy

When we change this policy, we post the new version here and update its effective date. If a change is material, we also email account holders before it takes effect.

Contact us

NicoCares by Totality · [email protected]

How we handle your information.