Privacy Policy & Notice of Privacy Practices

2.3 · Effective September 27, 2026 · Last Updated September 27, 2026

Part 1 — Privacy Policy

1. Introduction

This Privacy Policy explains how Biomarker Health Holdings Inc., doing business as Biomarker Health ("Biomarker Health," "we," "us," or "our"), collects, uses, shares, and protects information when you visit biomarkerhealth.com, use our applications and patient portal, or interact with the services we operate (collectively, the "Services").

Important — two sets of rules apply to your information, from two different companies. Your medical care is provided by Biomarker Health Winter Garden FL 1 LLC (the "Practice"), a medical practice and HIPAA covered entity. Health information created or received in the course of your care is "protected health information" (PHI) governed by the Health Insurance Portability and Accountability Act (HIPAA) and by the Practice's Notice of Privacy Practices in Part 2 of this page. Where Biomarker Health Holdings Inc. stores, transmits, or processes PHI in operating the platform, it does so as a business associate of the Practice under a written Business Associate Agreement. For any information that is PHI, the Notice of Privacy Practices controls in any conflict with this Policy. This Privacy Policy covers our broader data practices, including website and app information and information that is not PHI.

By using the Services, you agree to this Policy. If you do not agree, do not use the Services.

2. Information We Collect

Information you provide to us:

Account and identity information: name, date of birth, email, phone, mailing and billing address, and login credentials.
Health information: the medical history, symptoms, medications, lifestyle details, and intake responses you submit; biomarker and laboratory results; and information generated during consultations and treatment, including hormone and peptide plans. This information is collected on behalf of the Practice and handled as PHI under Part 2.
Payment information: payment-card or other payment details, processed by our payment provider (we do not store full card numbers).
Communications: messages you send to us or to clinicians through the Services, and records of support interactions.

Information we collect automatically:

Device and usage data: IP address, device type, browser, operating system, pages viewed, and interactions with the Services.
Cookies and similar technologies: as described in Section 7.

Information from third parties:

Laboratories and pharmacies that process your tests or prescriptions.
Service providers and identity-verification or fraud-prevention vendors.
Referral sources, if you were referred to us.

3. How We Use Information

We use information to:

Provide, operate, and improve the Services, including scheduling, lab ordering, consultations, and treatment-plan management, in support of the Practice;
Verify your identity and eligibility and prevent fraud and misuse;
Process payments and administer memberships;
Communicate with you about appointments, results, your account, and service updates;
Provide customer support and respond to your requests;
Maintain the security and integrity of our systems;
Comply with legal, regulatory, and professional obligations;
With your consent where required, send you marketing or educational communications (you can opt out at any time).

We do not sell your personal information, and we do not use or disclose PHI for marketing except as permitted by HIPAA and described in the Notice of Privacy Practices.

We share information only as needed to run the Services and as permitted by law:

With the Practice and your treating clinicians to deliver care.
With laboratories and pharmacies to fulfill testing and prescriptions.
With service providers (for example, cloud hosting and infrastructure, payment processing, communications, and scheduling) who act on our behalf under contracts that require them to protect your information. Where these vendors handle PHI, they do so as HIPAA "business associates" under a Business Associate Agreement.
For legal and safety reasons: to comply with applicable law, subpoenas, or government requests; to enforce our Terms; or to protect the rights, safety, or property of you, us, or others.
In a business transaction: in connection with a merger, financing, acquisition, or sale of assets, subject to appropriate confidentiality protections and applicable law.
With your direction or consent: when you ask us to share information with a third party.

5. Our Technology Stack and Data Location

We use cloud infrastructure (including Google Cloud Platform and Firebase) and other reputable service providers to host and operate the Services within the United States. We require our infrastructure and service providers to maintain appropriate security and, where they handle PHI, to sign Business Associate Agreements.

6. Automated and AI Processing of Uploaded Documents

What this section covers. This section applies when you upload a laboratory report to Biomarker Health and ask us to read it — the service offered at Upload Your Labs. It does not apply to laboratory panels ordered through Biomarker Health and resulted directly to us by the performing laboratory; those results reach your record without this process.

A digital system reads your document. If you upload a laboratory report to us, an automated system reads it — not a person. Software, including artificial intelligence models, extracts the biomarker names, values, units, and reference ranges printed on your document so we can display them back to you. No clinician reviews your uploaded document as part of this process, and no clinician is assigned to you by uploading it.

Who processes it. This processing runs on Google Cloud Platform's AI services (Vertex AI), operated by Google LLC as our subprocessor within the United States and covered by our Business Associate Agreement with Google. Your uploaded document and the health information in it are not used to train Google's models, and are not sold, shared, or used for advertising by us or by Google.

Extraction can be wrong. Automated extraction makes mistakes. It can misread a number, attach a value to the wrong marker, misread a unit or a reference range, or miss a result on your report entirely. Photographs, scans, faxed copies, and reports that place several draw dates in one table are more likely to produce errors. Before your results are saved, we show you the values we extracted so you can confirm or correct them against your own copy of the report, and where our two independent reading methods disagree about a value we show you both readings and ask you to choose. Confirming those values is your confirmation that they match your source document. Biomarker Health does not warrant that extraction is complete or accurate, and the values in your account are the values you confirmed. Your original laboratory report, and the laboratory that produced it, remain the authoritative record of your results.

What you receive is educational information. What we show you is educational information about your own laboratory values. It is not a diagnosis, not treatment advice, and not a clinician's opinion. We display each value against two things: the reference interval printed by the laboratory that ran your test, and, where our clinical team has defined one, an optimal range reflecting optimization-medicine framing. Where no optimal range has been defined for a marker, we say so and show the value without any status rather than implying one. Comparing a value to a range is not a clinical assessment — it does not account for your medical history, medications, symptoms, other conditions, or anything else about you. A value outside a range is not a finding, and a value inside every range is not a clearance. Uploading a report does not create a patient relationship with Biomarker Health or with any clinician, does not constitute a clinical encounter, and is not a substitute for care.

When to seek care. Discuss your laboratory results with a licensed healthcare professional who knows your history. Do not start, stop, or change any medication, supplement, or treatment based on what you see here. If you believe you are having a medical emergency, call 911 or go to the nearest emergency department. This service is not monitored, and uploading a report will not alert anyone to an urgent result — including a critical value.

Your document and your data. This processing happens only for documents you choose to upload. We keep your uploaded document and the values extracted from it as part of your health record, and retain them in line with the retention period described in Section 8. Uploaded reports and the values extracted from them become part of your health record and are retained as described in Section 8. If you believe an uploaded report is wrong or was uploaded in error, contact us and we will review it, subject to the law that governs record retention. How your information is protected, who may access it, and what rights you have over it are described in this Policy and in the Notice of Privacy Practices.

7. Cookies and Tracking Technologies

We and our service providers use cookies and similar technologies to keep you logged in, remember preferences, measure performance, and improve the Services. On our public marketing pages only, we use analytics tools to understand how visitors find and use our website. We do not run third-party analytics or advertising trackers on authenticated patient-portal pages. You can control cookies through your browser settings, and you can opt out of certain analytics collection using the opt-out mechanisms those vendors provide. Disabling some cookies may affect functionality.

8. Data Retention

We retain personal information for as long as needed to provide the Services and for legitimate business and legal purposes. Medical records are retained by the Practice for the period required by applicable Florida and federal law, which may be longer than the period for other data. When information is no longer required, we securely delete or de-identify it.

9. How We Protect Information

We maintain administrative, technical, and physical safeguards designed to protect your information, including encryption in transit and at rest, access controls, and monitoring. No system is perfectly secure, and we cannot guarantee absolute security. If a breach affecting your information occurs, we will notify you as required by law.

10. Your Privacy Choices and Rights

Depending on where you live, you may have rights regarding your personal information, such as the right to:

Access a copy of the personal information we hold about you;
Correct inaccurate information;
Delete certain information;
Opt out of marketing communications;
Opt out of certain processing such as targeted advertising or the "sale" or "sharing" of personal information (we do not sell personal information).

Florida residents have rights under the Florida Digital Bill of Rights, and residents of other states may have similar rights under their state laws. Note: rights regarding PHI are governed separately by HIPAA and described in the Notice of Privacy Practices below. To exercise a right, contact us using Section 13. We will verify your identity before responding and will not discriminate against you for exercising your rights. You may also designate an authorized agent where the law allows.

11. Children's Privacy

The Services are intended for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected such information, we will delete it.

12. Changes to This Policy

We may update this Policy from time to time. We will post the updated version with a new effective date and, for material changes, provide additional notice through the Services. Your continued use after the update constitutes acceptance.

13. Contact Us

Biomarker Health Holdings Inc. d/b/a Biomarker Health Attn: Privacy Orlando, Florida Email: legal@biomarkerhealth.com

For questions specifically about protected health information, see the Notice of Privacy Practices below or contact the Practice's Privacy Officer listed there.

Part 2 — Notice of Privacy Practices

NPP Version 1.3 · Effective September 24, 2026 · Issued by Biomarker Health Winter Garden FL 1 LLC

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our Commitment to Your Privacy

Biomarker Health Winter Garden FL 1 LLC ("the Practice," "we," "us," or "our") is required by law to maintain the privacy of your protected health information ("PHI"), to provide you with this Notice of our legal duties and privacy practices regarding PHI, and to notify you following a breach of unsecured PHI. We are required to follow the terms of the Notice currently in effect. PHI is information that identifies you and relates to your past, present, or future health, the care you receive, or payment for that care.

This Notice applies to all PHI created or maintained by the Practice and by the licensed providers and workforce members who deliver care through our clinic and telehealth platform.

How We May Use and Disclose Your Health Information Without Your Authorization

We may use and disclose your PHI for the following purposes:

Treatment. We use and share your PHI to provide, coordinate, and manage your care. For example, a nurse practitioner may review your biomarker lab results to develop a hormone or peptide plan, and we may share information with a laboratory, pharmacy, or another provider involved in your care.

Payment. We use and share your PHI to bill and collect payment for the Services. For example, we may share information with a payment processor or document the services provided for billing purposes.

Health Care Operations. We use and share your PHI to run our practice and improve care. For example, we may use information for quality review, training, scheduling, business planning, and administration.

Business Associates. We may share PHI with third parties ("business associates") that perform services for us — such as Biomarker Health Holdings Inc. (which operates our technology platform), cloud-hosting and infrastructure providers, laboratories, and software vendors — under written agreements requiring them to protect your PHI.

Appointment Reminders and Health Information. We may contact you to provide appointment reminders or information about treatment alternatives or health-related benefits and services that may interest you.

As Required or Permitted by Law. We may use or disclose PHI when required or permitted by law, including for:

Public health activities (for example, reporting to public-health authorities to prevent disease);
Reporting suspected abuse, neglect, or domestic violence as required by law;
Health oversight activities (audits, investigations, inspections, and licensure);
Judicial and administrative proceedings (for example, in response to a court order, subpoena, or lawful discovery request);
Law enforcement purposes as permitted by law;
Coroners, medical examiners, and funeral directors;
Organ, eye, and tissue donation;
Research, subject to required approvals and protections;
Averting a serious and imminent threat to health or safety;
Specialized government functions (such as military and veterans' activities and national security);
Workers' compensation as authorized by law.

Uses and Disclosures That Require Your Written Authorization

Other uses and disclosures of your PHI will be made only with your written authorization, including:

Marketing that requires authorization under the law;
Sale of PHI;
Psychotherapy notes, where applicable;
Most other uses not described in this Notice.

You may revoke an authorization in writing at any time, except to the extent we have already acted in reliance on it.

Special Protections for Certain Information

Substance use disorder records. If we receive or create records protected by federal substance use disorder confidentiality rules (42 C.F.R. Part 2), those records receive additional protections. Such records generally may not be used or disclosed in legal proceedings against you without your written consent or a court order, and other special restrictions may apply.

State law. Some information may receive greater protection under Florida law or the law of the state where you receive care, and we will follow the more protective rule.

Your Rights Regarding Your Health Information

You have the following rights regarding PHI we maintain about you:

Right to access and obtain a copy. You may inspect and obtain a copy of your PHI, including in electronic form where we maintain it electronically. We may charge a reasonable, cost-based fee. We may deny access in limited circumstances, some of which are reviewable.
Right to request an amendment. You may ask us to amend PHI you believe is inaccurate or incomplete. We may deny your request under certain conditions, and you may submit a statement of disagreement.
Right to an accounting of disclosures. You may request a list of certain disclosures we made of your PHI, subject to legal limits.
Right to request restrictions. You may request restrictions on certain uses and disclosures. We are not required to agree, except that we must agree to your request to restrict disclosure to a health plan for a service you paid for in full out of pocket, where the disclosure is for payment or operations and not otherwise required by law.
Right to request confidential communications. You may ask us to communicate with you in a specific way or at a specific location (for example, by a particular phone number or address). We will accommodate reasonable requests.
Right to a paper copy of this Notice. You may request a paper copy at any time, even if you agreed to receive it electronically.
Right to be notified of a breach. You have the right to be notified following a breach of your unsecured PHI.
Right to revoke an authorization in writing, as described above.

To exercise any of these rights, contact us using the information below. We may ask you to submit your request in writing.

Our Duties

We are required to:

Maintain the privacy and security of your PHI;
Provide you this Notice of our legal duties and privacy practices;
Follow the terms of the Notice currently in effect;
Notify you if we are unable to agree to a requested restriction;
Notify affected individuals following a breach of unsecured PHI as required by law.

Changes to This Notice

We reserve the right to change this Notice and to make the revised Notice effective for PHI we already have as well as for information we receive in the future. We will post the current Notice on biomarkerhealth.com with its effective date, and a copy will be available at our clinic and upon request.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us by contacting our Privacy Officer, or with the U.S. Department of Health and Human Services, Office for Civil Rights:

U.S. Department of Health and Human Services Office for Civil Rights 200 Independence Avenue, S.W., Washington, D.C. 20201 1-877-696-6775 | www.hhs.gov/ocr/privacy/hipaa/complaints/

We will not retaliate against you for filing a complaint.

Contact / Privacy Officer

Privacy Officer: Robert O'Hara Biomarker Health Winter Garden FL 1 LLC Winter Park, Florida Email: legal@biomarkerhealth.com

Acknowledgment of Receipt of Notice of Privacy Practices

I acknowledge that I have received, or have been given the opportunity to receive, a copy of the Notice of Privacy Practices of Biomarker Health Winter Garden FL 1 LLC.

Patient name: ______________________________

Signature: ______________________________ Date: ____________

(For telehealth, this acknowledgment may be captured electronically. We are required to make a good-faith effort to obtain acknowledgment; if we cannot, we will document the good-faith effort and the reason it was not obtained.)