The Cardiometabolic Reset — Privacy Policy
Effective Date: October 12, 2026 Last Updated: October 12, 2026
The Cardiometabolic Reset (“CMR,” “we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and protect information when you visit our website, enroll in our programs, communicate with us, or use our services.
CMR provides virtual nutrition and lifestyle education and, for eligible patients located in Illinois at the time of care, individualized healthcare services delivered by a licensed nurse practitioner. Our offerings include Foundations, The Reset, Individual Care Appointments, and the Lifestyle Membership.
This Privacy Policy applies to information collected through our website, digital programs, enrollment forms, business communications, and related online services. Clinical services are also governed by CMR’s separate Notice of Privacy Practices. If this Privacy Policy and the Notice of Privacy Practices conflict regarding protected health information, the Notice of Privacy Practices controls.
By using our website or services, you acknowledge that you have had the opportunity to review this Privacy Policy.
1. Information We Collect
The information we collect depends on how you interact with CMR.
A. Personal and Contact Information
When you contact us, create an account, enroll in a program, or schedule an appointment, we may collect:
Name
Email address
Telephone number
Mailing address, if provided
Account login and registration information
Communication preferences
Information you voluntarily provide through forms, messages, or inquiries
B. Payment and Transaction Information
When you purchase a program or service, we may collect information about your purchase, subscription, payment status, billing history, and applicable discounts.
Payments are processed by third-party payment providers. We do not receive or store your complete payment card number or security code. Payment information is handled under the payment provider’s own privacy and security practices.
C. Nutrition, Lifestyle, and Program Information
When you participate in Foundations, The Reset, or another educational program, we may collect information you voluntarily provide, including:
Nutrition preferences and dietary restrictions
Food and meal-planning preferences
Lifestyle goals and habits
Exercise, sleep, and stress-management goals
Program progress, feedback, and responses to educational exercises
Communications related to your participation
If you share information about health conditions, symptoms, medications, laboratory results, or other medical details as part of an educational program, we treat it as sensitive health information and handle it in accordance with applicable law.
D. Clinical and Health Information
If you receive individualized healthcare services through CMR, we may collect information necessary to evaluate your health, provide care, and manage your clinical relationship, including:
Medical history and current health concerns
Medications, allergies, and supplements
Relevant family and social history
Weight, blood pressure, and other clinically relevant measurements
Laboratory results and other diagnostic information
Information regarding hormonal, metabolic, and cardiovascular health
Treatment plans, clinical assessments, and progress notes
Telehealth appointment information and communications
Prescribing, referral, and follow-up information, when applicable
Clinical information is maintained and used in accordance with applicable healthcare privacy laws, including HIPAA where it applies. Details about how protected health information is used and disclosed are provided in CMR’s separate Notice of Privacy Practices.
E. Website and Technical Information
When you visit our website or use our online services, we or our service providers may collect technical information, such as:
IP address
Browser type and device information
Pages visited and time spent on the website
Referring website or link
General usage and diagnostic information
Cookie identifiers and similar tracking information, where enabled
We use this information to maintain website functionality, understand site performance, improve the user experience, and protect against fraud or unauthorized activity. We do not use website analytics or advertising tools to disclose protected health information in violation of applicable law.
2. How We Use Your Information
We may use the information we collect to:
Provide access to educational programs, course materials, meal plans, recipes, and other resources
Create and manage accounts and program enrollment
Process payments, subscriptions, refunds, and related transactions
Communicate about purchases, appointments, program updates, and customer support
Evaluate and provide individualized clinical care, when applicable
Coordinate treatment, prescriptions, laboratory testing, referrals, and follow-up care, when appropriate
Respond to inquiries and provide requested information
Improve our website, educational materials, and services, using de-identified or aggregated information where practical
Monitor website security, prevent fraud, and troubleshoot technical issues
Comply with legal, regulatory, accounting, and professional obligations
Send marketing communications where permitted by law and consistent with your preferences
We use information only for purposes reasonably related to our business, permitted by law, and consistent with applicable healthcare privacy obligations. We do not use protected health information for marketing without your written authorization where the law requires it.
3. Our Programs: Education Versus Clinical Care
CMR offers educational programs and clinical services. The information we collect, and the privacy protections that apply, depend on the service you choose.
Foundations
Foundations is a virtual nutrition and lifestyle education program that may include structured lessons, educational videos, meal plans, grocery lists, recipes, and habit-building resources. Information you submit is used to administer the program, provide access to materials, communicate with you, and improve our educational services.
Foundations is educational. It is not individualized medical evaluation, diagnosis, or treatment, and enrolling does not establish a clinician-patient relationship.
The Reset
The Reset is CMR’s premium program. It may combine educational content with individualized clinical services for eligible patients located in Illinois at the time of care.
Educational components of The Reset are handled as described for Foundations above.
Clinical components of The Reset, such as health assessments, laboratory review, treatment planning, or prescribing, are healthcare services. Information collected for them is protected health information, handled under applicable healthcare privacy laws and CMR’s Notice of Privacy Practices.
If you are not eligible for clinical services, you will be told before enrolling which parts of The Reset are available to you.
Individual Care Appointments and Lifestyle Membership
Individualized clinical care is offered to eligible patients located in Illinois at the time of care, subject to applicable licensing and other requirements. These services may involve medical history, laboratory results, medication information, and other protected health information, and are governed by applicable healthcare privacy laws and CMR’s Notice of Privacy Practices.
Enrollment Is Separate
Enrolling in an educational program does not enroll you in clinical care, and enrolling in clinical care does not enroll you in a separate educational program, unless the program you purchase expressly includes both.
4. How We Share Information
CMR does not sell your personal information or protected health information. We may share information only in the circumstances below, subject to applicable law.
A. Service Providers
We use third-party companies to support our operations, including website hosting, course delivery, scheduling, payment processing, electronic communications, telehealth, electronic health records, laboratory coordination, and administrative services. These providers receive only the information reasonably necessary to perform their services, under contractual, confidentiality, and legal obligations.
When a service provider handles protected health information on CMR’s behalf, we maintain a business associate agreement with that provider as required by HIPAA.
B. Healthcare Coordination
If you receive clinical services, your health information may be shared with other healthcare professionals, laboratories, pharmacies, or healthcare organizations involved in your care, as permitted or required by law. Where the law requires your authorization, we will obtain it first.
C. Legal and Regulatory Requirements
We may disclose information when required by law, regulation, court order, or valid legal process, or when otherwise permitted or required to protect rights, safety, and security.
D. Business Transactions
If CMR undergoes a merger, restructuring, sale, or similar transaction, information may be transferred as part of that transaction, subject to applicable privacy and confidentiality obligations, including healthcare privacy laws for any clinical records.
E. Marketing and Advertising
We may use your contact information to tell you about CMR services, educational offerings, and updates where permitted by law.
We do not allow advertising platforms to use protected health information for targeted advertising.
We obtain your authorization before using or disclosing protected health information for marketing where the law requires it.
We do not sell personal information or share it for cross-context behavioral advertising.
5. Cookies, Analytics, and Online Tracking
Our website and third-party services may use cookies, pixels, analytics tools, or similar technologies to support website functionality, understand visitor activity, and measure general marketing efforts.
We do not place advertising or social media tracking pixels on pages where you log in to a patient account, book a clinical appointment, or submit health information, such as intake or health-history forms.
You can manage cookies through your browser settings or any cookie preference tool on our website. Blocking certain cookies may affect website functionality.
Third-party websites, platforms, and services have their own privacy policies and practices, which CMR does not control.
6. Email, Text Messages, and Social Media
If you contact CMR by email, text message, social media, or a website form, we use the information you provide to respond and communicate with you.
Please do not send detailed medical information through social media comments, direct messages, or ordinary email. Use the secure patient portal or other secure method we provide. Social media platforms are run by third parties and are not a substitute for secure clinical communication.
Text messages. By providing your mobile number and opting in, you agree to receive text messages from CMR. Message frequency varies, and message and data rates may apply. Reply STOP to opt out of text messages at any time, or HELP for help. Consent to marketing texts is not a condition of purchase. We do not sell or share your mobile number or text-messaging consent with third parties for their own marketing.
Email. You can unsubscribe from marketing emails using the link in any marketing email.
Opting out of marketing does not stop necessary service messages, such as appointment reminders, receipts, and account notices.
7. How We Protect Your Information
CMR uses reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, loss, or misuse. These may include access controls, secure and encrypted systems, password protection, confidentiality obligations for staff and contractors, and HIPAA-compliant platforms for clinical information.
No website, transmission, or storage system is completely secure, so we cannot guarantee absolute security. If a breach affects your information, we will notify you as required by applicable law, including HIPAA and the Illinois Personal Information Protection Act.
8. Data Retention
We keep personal information as long as reasonably necessary to provide our programs and services, maintain business records, resolve disputes, and meet legal requirements. Clinical records are kept for the periods required by healthcare laws and professional standards.
When information is no longer needed, we take reasonable steps to securely delete, destroy, or de-identify it.
9. Your Privacy Rights and Choices
Depending on your relationship with CMR and the laws that apply, you may be able to:
Request access to personal information we maintain about you
Request correction of inaccurate information
Request deletion of eligible personal information
Opt out of marketing communications
Manage cookie preferences
Request information about certain uses or disclosures of your information
Some rights are limited by law, including requirements to keep clinical records.
If your information is protected health information, you have additional rights under HIPAA, including access to and amendment of your medical records, an accounting of certain disclosures, requested restrictions, and confidential communications. These rights are described in our Notice of Privacy Practices.
To make a request, contact us using the information in Section 13. We may need to verify your identity first, and we will respond within the time required by applicable law.
10. Children’s Privacy
CMR’s website, programs, and services are intended for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a minor, we will take appropriate steps to delete it, unless we are required by law to keep it.
11. Third-Party Websites and Platforms
Our website and communications may link to third-party websites, course platforms, payment processors, scheduling tools, or other services. Their own terms, privacy policies, and security practices apply when you use them. CMR is not responsible for their independent practices, except as required by law or contract. We encourage you to review their privacy policies.
12. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our services, technology, business practices, or legal requirements. When we do, we will update the “Last Updated” date at the top. If a material change requires additional notice or consent, we will provide it as required by law.
Continued use of our website after an update does not replace any consent or authorization the law requires.
13. Contact Us
For questions about this Privacy Policy or to submit a privacy request, contact:
The Cardiometabolic Reset (CMR) Privacy Contact: Carly Underkoffler Email: Website:www.cardiometabolicreset.com Business Mailing Address: 122 S. Michigan Ave. Suite 1390 Chicago IL 60603
For questions about protected health information or your rights as a patient, see CMR’s Notice of Privacy Practices or use the contact information in your clinical documentation.
This Privacy Policy explains CMR’s general privacy practices. It does not replace any separate consent, authorization, agreement, or healthcare privacy notice required by law.