Privacy policy
This describes what Xilo collects, why it is collected, who it goes to, and what you can ask us to do with it. Health information receives stricter handling than the rest.
Last updated 14 August 2026
What is collected
- Account information. Name, email address, postal address, date of birth, and state of residence.
- Health information. Intake answers, medical history, medications, laboratory results, and communications with your provider.
- Institutional buyer information. For research supply accounts: entity name and registration, institutional address, and the named responsible scientist.
- Payment information. Processed by a third-party payment processor. Xilo does not store full card numbers.
- Technical information. Server logs, including IP address and browser type, retained for security and fraud prevention.
How it is used
To provide care or supply materials, to verify eligibility, to process payment, to meet legal and regulatory obligations, and to secure the service. Health information is used to deliver care and is not used for advertising.
Who it is shared with
- The licensed providers who treat you, and the laboratories and pharmacies involved in your care.
- Service providers acting on our instructions, including payment processing, shipping, and hosting, bound by contract.
- Authorities where disclosure is legally required.
Xilo does not sell personal information, and does not share health information with advertisers or data brokers.
Your choices
You may request access to the information held about you, request correction, request deletion where the law permits and no retention obligation applies, and object to certain processing. Medical records held by a treating provider are subject to retention periods that override a deletion request. To make a request, write to privacy@tryxilo.com.
Residents of some states, including California, have additional rights over their personal information. Those rights are honoured for all users regardless of residence, and exercising them will not result in different pricing or service.
Retention
Account and transaction records are retained while your account is open and afterwards for as long as legal, tax, and regulatory obligations require. Medical records are retained by the treating provider under the retention rules of their jurisdiction.
Security
Information is transmitted over encrypted connections and stored with access limited to those who need it. No system is perfectly secure, and we will notify affected users and regulators as required if a breach occurs.
Children
Xilo services are for adults. We do not knowingly collect information from anyone under 18, and the eligibility check stops applicants under 18 before any account is created.
Changes and contact
Material changes to this policy will be posted here with a revised date. Questions go to privacy@tryxilo.com.