Website Privacy Notice

Rejuvyx Health, LLC ("Rejuvyx," "we," "us," or "our") operates the Rejuvyx website at rejuvyxhealth.com, the Rejuvyx patient portal, and the Rejuvyx mobile app (together with any related services, the "Services"). This Website Privacy Notice explains what personal information we collect, how we use and share it, and the choices and rights you have.

Rejuvyx is a marketing and technology platform, not a healthcare provider, and is not a HIPAA covered healthcare provider. Medical care available through the Rejuvyx platform is provided by independent licensed healthcare providers. Consultations, diagnoses, prescriptions, and treatment decisions are made solely by those independent healthcare providers.

Not all health-related information is PHI under HIPAA. Whether information constitutes PHI depends on the nature and context of the information and the entities involved. In certain circumstances, Rejuvyx may receive, create, maintain, or transmit PHI on behalf of a healthcare provider in its capacity as a business associate. In those circumstances, Rejuvyx handles that PHI in accordance with the HIPAA requirements applicable to its role and its contractual obligations to the applicable healthcare provider.

Independent healthcare providers, pharmacies, laboratories, and other healthcare organizations maintain their own privacy policies and Notices of Privacy Practices governing the information they handle.

This Website Privacy Notice is separate from, and does not replace, the Notice of Privacy Practices ("NPP") applicable to medical care provided by an independent healthcare provider. When information constitutes Protected Health Information ("PHI") under the Health Insurance Portability and Accountability Act ("HIPAA"), the applicable provider's NPP governs the provider's use and disclosure of that information.

If this Website Privacy Notice conflicts with an applicable NPP regarding a healthcare provider's use or disclosure of PHI, the applicable NPP controls.

If you use the Services on behalf of someone else, you confirm that you're their legal guardian or legally authorized representative and that they are at least 18 years old.

This Website Privacy Notice is written in English. If a translated version conflicts with the English version, the English version controls.

1. Summary

We collect the information you give us when you create an account, complete an assessment, buy a plan, or contact us, and information collected automatically when you use the Services.

We use it to operate the Services, facilitate the care you request from independent healthcare providers, process payments, provide support, and, with your consent where required, send marketing.

We use advertising technologies on non-sensitive portions of our website, which some state laws may treat as "sharing" personal information for targeted advertising. You can opt out. We apply additional safeguards designed to prevent PHI and sensitive health information from being transmitted to advertising platforms for profiling, retargeting, or advertising optimization purposes.

Where information constitutes PHI, its use and disclosure may be governed by HIPAA, an applicable healthcare provider's Notice of Privacy Practices, and other applicable healthcare privacy requirements.

Depending on where you live, you may have rights to access, delete, or correct your information. Contact us at support@rejuvyxhealth.com.

2. Information We Collect

Information you give us

• Account information, such as your name, email address, phone number, date of birth, password, and shipping address.
• Health and health-related information you choose to provide, such as through assessments, intake forms, questionnaires, uploads, and messages.
• Identity verification information, such as a government-issued ID, when required for certain prescriptions or to confirm your identity.
• Purchase and billing information, such as the plans and products you buy and your billing address. Payment card details are handled by our payment processors (see Payments).
• Communications, such as messages you send to our support team or Care+ coaches, and your communications preferences.
• Newsletter and marketing sign-ups, such as your email address and phone number.

State-specific consumer health privacy notices, including notices required by Washington law where applicable, are provided separately. See our Consumer Health Data Privacy Notice.

Please don't share medical information in public social media comments or through advertising-platform messaging. Use our secure forms instead.

Information collected automatically

When you use the Services, we and our partners collect device and usage information, such as your IP address, browser and device type, pages viewed, referring URL, and cookie and similar identifiers. See Cookies and Tracking Technologies.

Information from third parties

• People who refer you to us or share your contact information with us.
• Payment processors, which confirm your payment and may provide limited details such as the last four digits of your card and your billing ZIP code.
• Advertising and analytics partners, which may provide information about how you interacted with our ads.
• Independent healthcare providers, pharmacies, and laboratories involved in services you request, such as order and shipping status.

Sensitive and Health-Related Information

Some information you provide may be sensitive, including health-related information. We apply additional restrictions and safeguards to protect this information. We do not knowingly disclose or transmit sensitive, identifiable health information from appointment or intake forms, health assessments, patient portals, or other sensitive areas of our Services to third-party advertising platforms or behavioral tracking technologies for advertising, profiling, retargeting, or advertising optimization purposes.

Certain healthcare services available through our platform are provided by independent healthcare providers. Depending on the circumstances and the entities involved, certain health information may constitute Protected Health Information ("PHI") under HIPAA and may be subject to applicable healthcare privacy laws, a provider's Notice of Privacy Practices, and, where Rejuvyx acts as a business associate, applicable HIPAA requirements.

3. How We Use Information

We use information to:

• Provide and operate the Services, including creating and managing accounts, processing orders and plans, and coordinating shipping.
• Facilitate the services you request from independent healthcare providers, pharmacies, and laboratories.
• Verify your identity and eligibility to use the Services.
• Communicate with you, including order confirmations, account and service messages, and support responses.
• Send marketing, with your consent where required.
• Analyze and improve the Services.
• Personalize content and advertising on our website, subject to the safeguards described in this Website Privacy Notice.
• Detect and prevent fraud, protect security, and debug the Services.
• Comply with legal obligations and enforce our terms.

We use information from assessments, intake forms, patient portals, and other sensitive areas of our Services to facilitate the services you request, communicate with you about those services, and for other purposes permitted by applicable law.

We do not use sensitive health information collected through these areas for advertising, profiling, retargeting, or advertising optimization purposes.

4. Cookies and Tracking Technologies

We and our partners use cookies, pixels, tags, and similar technologies on our website to operate and secure the Services, understand how visitors use our website, and understand where our traffic comes from.

• Strictly necessary: keep you signed in, remember your choices, and protect the Services.
• Analytics: Google Analytics helps us understand how visitors use our website, such as which pages are viewed and how long visits last.
• Advertising: advertising pixels from Meta, Google Ads, TikTok, and LinkedIn help us measure our ads and show ads to people who may be interested in the Services. These tools may collect information such as your IP address, device and cookie identifiers, the non-sensitive pages you view, and whether you arrived from one of our ads, and the platforms may combine it with other information they have about you.

Third parties such as Google, Meta, TikTok, and LinkedIn may collect information about your online activities over time and across different websites when you use our Services.

Protected Health Information and Advertising Technologies

We take additional precautions to protect information that may constitute Protected Health Information ("PHI") or other sensitive health information.

We do not use advertising pixels or similar advertising tracking technologies within patient portals or authenticated patient experiences.

Where advertising or analytics technologies are used on other portions of our websites or Services, we implement safeguards designed to prevent PHI and sensitive health information from being transmitted to advertising or analytics platforms. These safeguards may include restricting tracking technologies from sensitive areas; limiting the information collected or transmitted from website pages and forms; excluding sensitive pages, URLs, form fields, and conversion events from advertising tracking; and configuring integrations so that PHI and sensitive health information are not reported back for advertising, profiling, retargeting, or advertising optimization purposes.

We do not knowingly disclose or transmit PHI to third-party advertising platforms for advertising, profiling, retargeting, or advertising optimization purposes.

Your choices

• Opt out of sharing for targeted advertising: Use the "Your Privacy Choices" link in our website footer.
• Global Privacy Control: We treat Global Privacy Control signals as a valid request to opt out of the sale or sharing of personal information associated with that browser.
• Browser settings: most browsers let you block or delete cookies. Blocking some cookies may affect how the Services work.
• Platform tools: Google Analytics opt-out add-on, Google Ad Settings, Meta ad preferences, TikTok ad settings, LinkedIn ad settings, and industry opt-outs at optout.networkadvertising.org and optout.aboutads.info.

Each platform maintains its own opt-out tools, which may change without notice. Opting out of targeted advertising doesn't stop all ads; you may still see ads that aren't personalized. Opt-out choices apply going forward and only to the browser or device you use to make them.

Do Not Track: Our Services don't currently respond to Do Not Track browser signals.

5. How We May Share Information

• Service providers including hosting (such as Vercel); telehealth technology, including intake, the patient portal, electronic medical records, and payment services (such as Wizlo and its Wizpay service); payment processing (such as Stripe); customer relationship management, email, text messaging, and calling (such as HighLevel); analytics (such as Google Analytics); shipping; and AI tools that help us respond to support inquiries. These service providers process information in connection with the services they provide to us and are subject to applicable contractual and legal obligations.
• Vendors that handle PHI on our behalf. Where a service provider receives, creates, maintains, or transmits PHI on behalf of Rejuvyx, we implement safeguards appropriate to the nature of the information and the services provided, including contractual protections and, where required by HIPAA, Business Associate Agreements.
• Healthcare providers, pharmacies, and laboratories. When necessary to respond to your request or facilitate care, information may be provided to licensed clinicians, laboratories, pharmacies, and other health care entities involved in the requested service. These providers, laboratories, and pharmacies are independent and handle your information under their own privacy policies and, where applicable, their Notices of Privacy Practices.
• Advertising partners, such as Meta, Google, TikTok, and LinkedIn, through the website technologies described in Cookies and Tracking Technologies. These partners may use the information under their own policies. Under some US state laws, this may be considered "sharing" personal information for targeted advertising. You can opt out using the "Your Privacy Choices" link in our website footer.
• Platform lead forms and messaging. If you submit a lead form or message us through a platform such as Meta, Google, TikTok, or LinkedIn, that platform may collect and use information about your interaction under its own privacy policy. We receive the information you submit so we can respond to you.
• Professional advisers, such as lawyers, accountants, and auditors, when necessary.
• Business transfers, in connection with a merger, acquisition, financing, reorganization, or sale of assets, including as part of a bankruptcy or similar proceeding.
• Legal and safety, to comply with law, respond to lawful requests, and protect the rights, property, and safety of you, us, and others.
• With your consent or at your direction.
• Aggregated or de-identified information that is not reasonably capable of identifying you.

Links to our providers' privacy policies are for your information only; those policies aren't part of this Website Privacy Notice, and those providers are independent companies, not our agents.

6. Payments

Payments are processed by Stripe and by Wizpay, a payment service of Wizlo. We don't receive or store your full payment card number; our payment processors handle it under their own privacy policies. We receive limited information such as your name, billing address, the last four digits of your card, and transaction details.

If you save a payment method or buy a plan that renews, our payment processors store it securely so future payments can be charged. We and our payment processors may receive updated card information from your card issuer to keep your saved payment method current. You may contact us at support@rejuvyxhealth.com for assistance managing a saved payment method, subject to any payment method requirements associated with an active subscription, outstanding balance, or pending transaction.

Our payment processors may also use your payment and device information to detect and prevent fraud, under their own privacy policies.

7. Marketing Communications

Email. We send marketing emails to people who sign up or buy from us, with consent where required. You can unsubscribe using the link in any marketing email or by contacting us.

Order updates and service texts. If you give us your mobile number for your account or orders, we may text you about your account, orders, shipping, and support. Reply STOP to stop these messages.

Promotional texts. We send promotional text messages only with your express written consent, which we collect when you opt in. Message frequency varies. Msg & data rates may apply. Reply STOP to cancel, HELP for help; we also honor other reasonable requests to opt out. Consent to receive promotional texts isn't a condition of purchase. See the SMS Program Terms in our Terms of Service. Opting out of promotional texts doesn't stop order updates and service texts.

We do not share mobile numbers or SMS opt-in data with third parties for their marketing purposes.

Calls. If we call you for marketing purposes, you can ask us to stop during the call or by emailing support@rejuvyxhealth.com with "Do Not Call."

Opting out of marketing doesn't stop messages necessary for your account, transactions, care, safety, or security.

8. Health Information and HIPAA

HIPAA does not apply to all health-related information. The fact that information relates to healthcare does not necessarily mean that it constitutes Protected Health Information ("PHI") under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA").

Rejuvyx is a marketing and technology platform, not a healthcare provider, and is not a HIPAA covered healthcare provider. Healthcare services available through the Rejuvyx platform are provided by independent licensed healthcare providers and other third parties, which may include medical groups, pharmacies, laboratories, and other healthcare organizations. Their handling of PHI is governed by applicable law and, where applicable, their respective Notices of Privacy Practices.

When you use certain healthcare-related features or services, you may provide health or medical information that is protected under applicable federal or state privacy laws. Depending on the circumstances and the entities involved, certain information may constitute PHI under HIPAA.

In certain circumstances, Rejuvyx may provide services to a healthcare provider or other covered entity as a "business associate" under HIPAA. When Rejuvyx receives, creates, maintains, or transmits PHI in its capacity as a business associate, we handle that information in accordance with applicable HIPAA requirements and our contractual obligations to the applicable covered entity.

9. Your Choices and Rights

• Account information: you can review and update some account information in the patient portal or app. For other changes, contact us.
• Deleting your account: contact us at support@rejuvyxhealth.com to request deletion of your account.
• Marketing: unsubscribe from emails using the link in any email, reply STOP to texts, or contact us.
• Cookies and advertising: see Cookies and Tracking Technologies.

Depending on where you live, you may have additional rights — see Additional Regional Information below.

How to make a request. Email support@rejuvyxhealth.com. We'll verify your request by confirming control of the email address on your account and, where needed, other information we have about you. You may use an authorized agent where the law allows; we may ask for proof of authorization. We don't require verification for requests to opt out of the sale or sharing of personal information or targeted advertising.

Rights relating to PHI maintained by an independent healthcare provider may be subject to HIPAA and the applicable provider's Notice of Privacy Practices. Please refer to the provider's Notice of Privacy Practices for information about exercising those rights.

We may decline or limit a privacy rights request where permitted by applicable law. For example, we may do so if we cannot reasonably verify your identity, if a legal exception applies, or if we are required or permitted to retain certain information for legal, regulatory, security, fraud-prevention, or other legitimate purposes.

As permitted by law, we aren't required to re-identify data, keep information we'd otherwise not retain (such as from a one-time transaction), or respond to access requests more than twice in a 12-month period.

We'll respond within the time required by applicable law.

10. Data Retention

We keep personal information only for as long as reasonably necessary for the purposes described in this Website Privacy Notice — for example, to provide the Services, maintain your account, complete transactions, and comply with our legal, tax, and accounting obligations — and then delete or de-identify it. When deciding how long to keep information, we consider the type of information, why we collected it, and any legal requirements that apply. We may keep information longer where required by law, or to resolve disputes and enforce our agreements.

Marketing lists: until you unsubscribe, though we keep a record of your opt-out so we don't contact you again.

Third-party providers such as Stripe, Meta, Google, TikTok, and LinkedIn keep information they collect under their own privacy policies and retention schedules, which we don't control.

11. Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect personal information, such as encryption in transit and access controls. No method of transmission or storage is completely secure, so we can't guarantee absolute security. Our security measures may change over time.

If you have an account, you're responsible for keeping your password confidential and for activity under your account. We won't ask for your password by email.

12. Location of Processing

We are based in the United States. If you access our Services from outside the U.S., your information will be processed in the U.S., where data protection laws may differ from those in your country.

13. Children's Privacy

Our Services are not directed to children under 18, and we don't knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we'll delete it. We do not sell or share the personal information of consumers we know to be under 16.

Our description of these practices is voluntary and isn't an admission that any particular law applies to us.

14. Mobile App

Our mobile app lets you sign in to your account and view updates about your orders, labs, and support. It collects the account information and device and usage information described in this Website Privacy Notice. You can manage any app permissions in your device settings. App store privacy labels for our app should be read together with this Website Privacy Notice.

15. Third-Party Links and Services

The Services may link to or include content from third parties, such as social media sites. Those third parties' own privacy policies govern information they collect.

16. Changes to This Website Privacy Notice

We may update this Website Privacy Notice from time to time. When we do, we'll post the updated version on this page and change the "Last updated" date above. If we make material changes, we'll notify you before they take effect — for example, by email or by a notice on our website — where required by law.

17. Contact Us

Rejuvyx Health, LLC
701 Gervais St, Ste 150, Box 117
Columbia, SC 29201
support@rejuvyxhealth.com

For questions regarding your medical care, medical records, or other information maintained by your healthcare provider, please contact your healthcare provider through the patient portal or other communication methods made available through the Services. You may also refer to the applicable provider's Notice of Privacy Practices for additional information about your privacy rights and how to contact the provider.

If you have a disability and need this Website Privacy Notice in another format, contact us at support@rejuvyxhealth.com.

18. Additional Regional Information

The following sections apply to residents of specific jurisdictions and supplement the rest of this Website Privacy Notice.

Your U.S. State Privacy Rights

This section applies to residents of California and other U.S. states with comprehensive consumer privacy laws. Your specific rights may depend on your state of residence, and certain exceptions may apply. Our description of these rights and practices is voluntary and is not an admission that any particular law applies to us.

Categories of Personal Information We Collect and Disclose

Depending on how you interact with the Services, we may collect and disclose the following categories of personal information:

• Identifiers, such as your name, email address, phone number, shipping address, IP address, account identifiers, device identifiers, and cookie identifiers.
• Customer and transaction information, such as contact information, payment-related information, products or services purchased, and transaction history.
• Protected classification characteristics, such as age or date of birth and sex.
• Commercial information, such as products, plans, or services purchased and order history.
• Internet or other electronic network activity, such as pages viewed, links clicked, referring URLs, device information, cookie identifiers, and approximate location derived from an IP address.
• Sensitive personal information, such as health-related information, government identification information, and account login credentials.

We may collect this information directly from you, automatically from your device or use of the Services, from our records, and from service providers, healthcare providers, pharmacies, laboratories, payment processors, analytics providers, advertising partners, and other parties involved in providing or supporting the Services.

We may use these categories of information to provide and operate the Services; facilitate services you request; process transactions; verify identity and eligibility; communicate with you; provide customer support; maintain security and prevent fraud; understand how the Services are used; measure and improve our Services and marketing; comply with legal obligations; and for other purposes described in this Website Privacy Notice.

We may disclose personal information to service providers and other parties as described in the "How We May Share Information" section of this Website Privacy Notice.

Sale and sharing. We don't sell your personal information for money. We may use advertising and analytics partners that receive certain information, such as device identifiers, cookie identifiers, or referral information. Some state privacy laws may consider this a "sale," "sharing," or targeted advertising, even when no money is exchanged. Where required by law, you may opt out through the privacy choices available on our website.

We do not sell or share sensitive personal information for targeted advertising. We do not knowingly sell or share the personal information of consumers under 16.

Sensitive personal information. We use sensitive personal information for purposes reasonably necessary to provide and support the Services, verify identity or eligibility, maintain security, facilitate services you request, and comply with applicable law. We don't use or disclose sensitive personal information for purposes that would give California residents the right to limit its use.

We do not use sensitive personal information for the purpose of inferring characteristics about you for advertising or targeted advertising purposes.

Your rights. Depending on your state of residence and subject to applicable exceptions, you may have the right to:

• Know and access the personal information we've collected about you.
• Request deletion of certain personal information.
• Correct inaccurate personal information.
• Obtain a portable copy of your personal information.
• Opt out of the sale or sharing of personal information and certain uses of personal information for targeted advertising.
• Not be discriminated against for exercising applicable privacy rights.

How to exercise your rights. You may submit a privacy request by emailing support@rejuvyxhealth.com.

To opt out of the sale or sharing of personal information or targeted advertising, where applicable, use the "Your Privacy Choices" link in our website footer or enable Global Privacy Control in your browser.

We may need to verify your identity before processing certain requests. We may decline or limit a privacy rights request where permitted by applicable law. For example, we may do so if we cannot reasonably verify your identity, if a legal exception applies, or if we are required or permitted to retain certain information for legal, regulatory, security, fraud-prevention, or other legitimate purposes.

For questions regarding your medical care, medical records, or other information maintained by your healthcare provider, please contact your healthcare provider through the patient portal or other communication methods made available through the Services. You may also refer to the applicable provider's Notice of Privacy Practices for additional information about your privacy rights and how to contact the provider.

Appeals. If we decline a privacy request and applicable law provides you with a right to appeal, you may appeal our decision by emailing support@rejuvyxhealth.com with the subject "Privacy Request Appeal." We will respond within the time required by applicable law. Where applicable, you may also have the right to contact your state Attorney General regarding the result of an appeal.

Nevada

We do not sell covered information as "sale" is defined under applicable Nevada privacy law. Nevada residents may nevertheless submit a request regarding the sale of covered information by emailing support@rejuvyxhealth.com.

Minnesota, Oregon, and other states

Where required by applicable law, residents of Minnesota, Oregon, and other states that provide this right may request information regarding the specific third parties to which we have disclosed their personal data.

California "Shine the Light"

We do not share personal information with third parties for their own direct marketing purposes as contemplated by California's "Shine the Light" law.