Privacy Policy

Introduction

This Privacy Policy (“Privacy Policy”) describes the data protection practices of Prime Point Health and its affiliates (collectively, “Prime Point Health,” “we,” “our,” or “us”), including when you visit any Prime Point Health website that links to this Privacy Policy, including joinprimepoint.com (collectively, our “Websites”), use any affiliated mobile applications (the “Apps”), or otherwise provide data to Prime Point Health. We refer to the Websites, Apps, and other services provided by Prime Point Health together in this Privacy Policy as the “Services.” This Privacy Policy is incorporated into our Terms of Use. All capitalized terms used in this Privacy Policy but not defined herein have the meanings assigned to them in the Terms of Use.

PLEASE READ THIS PRIVACY POLICY CAREFULLY TO UNDERSTAND HOW WE HANDLE YOUR INFORMATION. IF YOU DO NOT AGREE TO THIS PRIVACY POLICY, PLEASE DO NOT USE THE SERVICES.

Health information and HIPAA privacy practices

Effective date of these health-information provisions: October 11, 2026.

These provisions describe how Protected Health Information (“PHI”) may be used and disclosed, the privacy rights that apply to that information, and the responsibilities applicable to our handling of PHI. PHI is individually identifiable health information protected by the Health Insurance Portability and Accountability Act (“HIPAA”). Information collected through a general website is not automatically PHI; its legal protection depends on the information, who holds it, and the circumstances.

Prime Point Health provides a technology and administrative platform. Clinical care is provided by Beluga Health, P.A. or other affiliated professional entities, as described in our Terms of Service. The treating provider, pharmacy, or other covered healthcare entity is responsible for its own Notice of Privacy Practices. That notice identifies the organization responsible for your clinical records and explains its uses, disclosures, duties, and patient rights. You may request that notice from the organization providing your care or contact our Privacy Team for assistance identifying the appropriate privacy contact.

When we create, receive, maintain, or transmit PHI on behalf of a covered healthcare entity, our handling of that information is subject to the HIPAA requirements applicable to our role, our business associate obligations, and that entity’s privacy practices. We are required to safeguard PHI, limit its use and disclosure to permitted purposes, and meet applicable breach-reporting obligations. A covered entity must maintain the privacy of PHI, provide notice of its legal duties and practices, and follow its effective Notice of Privacy Practices. These website provisions supplement, and do not replace, the treating entity’s notice.

For PHI, these health-information provisions and applicable law control over any broader website, advertising, analytics, sharing, or business-transfer language elsewhere in this policy. Acceptance of this Privacy Policy does not by itself authorize a use or disclosure of PHI that requires a separate authorization.

Uses and disclosures of PHI

The following categories describe uses and disclosures that may be permitted or required under HIPAA. A category listed here is not unrestricted permission to disclose information. Each disclosure must satisfy applicable legal conditions, any more protective state law, and the responsible covered entity’s notice. When Prime Point Health acts on behalf of a covered entity, we may handle PHI only as allowed by our role and applicable agreements or as required by law.

• Treatment. PHI may be used or shared to provide, coordinate, or manage healthcare and related services, including communications among treating providers, referrals, and pharmacy coordination.
• Payment. PHI may be used or shared to obtain payment for healthcare services, including billing, collection, and, when relevant to the service, coverage verification and communications with health plans or other providers. This provision does not mean that a particular Prime Point Health service accepts insurance.
• Healthcare operations. PHI may be used or shared for quality assessment and improvement, case management, accreditation, licensing, credentialing, medical review, audits, and legal or administrative services.
• As required by law. PHI may be disclosed when required by applicable federal, state, or local law, within the limits of that requirement.
• Public health and safety. Permitted disclosures may include preventing or controlling disease, injury, or disability; reporting abuse or neglect; reporting medication reactions or product problems; and notifying people of a communicable-disease exposure or risk, when legally authorized.
• Health oversight activities. PHI may be disclosed to authorized oversight agencies for audits, investigations, inspections, licensure, and other legally authorized oversight.
• Judicial and administrative proceedings. PHI may be disclosed in response to a court or administrative order or other lawful process. A subpoena or discovery request is subject to applicable notice, protective-order, authorization, or other legal requirements; it does not automatically permit release of all records.
• Law enforcement. PHI may be disclosed for legally permitted law-enforcement purposes, including required reporting of certain wounds or injuries and compliance with qualifying legal process.
• Research. PHI may be used or disclosed for research with your authorization or another legally permitted basis, such as an approved institutional review board or privacy board waiver, with required privacy protections.
• Organ and tissue donation. PHI may be disclosed to authorized organizations involved in organ procurement, transplantation, or donation as permitted by law.
• Workers’ compensation. PHI may be disclosed as authorized for workers’ compensation or similar programs addressing work-related injuries or illnesses.
• Military and veterans. PHI of members of the armed forces may be disclosed to appropriate military authorities for purposes permitted by law.
• Inmates and persons in custody. PHI may be disclosed to a correctional institution or official with lawful custody when permitted for healthcare, health and safety, or other authorized correctional purposes.

Where the minimum-necessary standard applies, the information used, requested, or disclosed must be limited to what is reasonably necessary for the permitted purpose. Additional protections for sensitive records are described below.

Authorization and sensitive records

Uses or disclosures of PHI that are not otherwise permitted or required by law require your written authorization. This includes uses or disclosures for marketing, sales of PHI, and most disclosures of psychotherapy notes when HIPAA requires authorization. General website consent, a cookie preference, or a marketing opt-out is not a substitute for a required HIPAA authorization.

You may revoke an authorization in writing by contacting the organization that obtained it or our Privacy Team for help routing the request. Revocation applies prospectively, subject to actions already taken in reliance on the authorization and other applicable legal exceptions.

HIV-related information, mental health records, genetic information, reproductive-health information, and substance use disorder records may have additional federal or state protections. When applicable law requires a separate or more specific consent, that consent must be obtained before disclosure unless a legal exception applies. Substance use disorder records covered by 42 CFR Part 2 are subject to that law’s additional restrictions, including restrictions on use in proceedings against the patient.

Your rights regarding PHI

The following rights apply to PHI under HIPAA, subject to the law’s exceptions and any additional protections that apply. Send a written request to the provider or other covered entity maintaining the records, or contact our Privacy Team for assistance. We may verify your identity and authority and will handle requests within our responsibility or help route them to the appropriate privacy officer or records custodian.

Inspect and obtain a copy

You may request access to, or an electronic or paper copy of, PHI in the designated record set maintained about you, with certain exceptions. An electronic copy may be requested in a readily producible format or another agreed format. Any copying or delivery fee must be reasonable, cost-based, and permitted by applicable law. The responsible entity must explain a denial and any available review rights as required by law.

Request an amendment

You may request correction or amendment of PHI you believe is inaccurate or incomplete. Identify the information and explain why it should be changed. Requests may be denied on grounds allowed by law, such as when the information is accurate and complete or was created by another entity that remains available to address the request. A denial must include the required explanation and information about your right to submit a statement of disagreement.

Obtain an accounting of disclosures

You may request an accounting of certain disclosures of your PHI during the preceding six years, or a shorter period you specify. Disclosures for treatment, payment, or healthcare operations and certain other disclosures are excluded as permitted by HIPAA. The responsible entity must apply the applicable rules governing the first free accounting and any permitted fees for additional requests.

Request restrictions

You may request limits on the use or disclosure of PHI for treatment, payment, or healthcare operations, specifying the information, restriction, and recipient involved. A covered entity generally is not required to agree, except where the law requires it. If you pay for a healthcare item or service out of pocket in full, you may require the provider to restrict disclosure of that information to your health plan for payment or healthcare operations, unless disclosure is required by law. This HIPAA protection applies nationwide, not only in California.

Request confidential communications

You may request communications about your PHI by a particular method or at a particular location, such as a different telephone number or mailing address. Tell the responsible provider or privacy contact how or where you wish to be contacted. Covered healthcare providers must accommodate reasonable requests.

Receive a paper copy of the notice

You may request a paper copy of this policy and the applicable healthcare entity’s Notice of Privacy Practices even if you previously agreed to receive information electronically. Contact our Privacy Team for this policy or help obtaining the treating entity’s notice.

Receive breach notification

You have the right to receive notice of a breach of your unsecured PHI when notification is required by HIPAA or applicable state law. We will meet the reporting and notification duties applicable to our role, including notifying the responsible covered entity when we handle PHI on its behalf. The responsible entity must provide required individual notices within the time limits imposed by law.

Exercise rights through an authorized representative

A legally authorized personal representative may exercise rights on your behalf, subject to verification of authority and applicable exceptions. You may also use the complaint process described below without retaliation.

Transmission and protection of PHI

Our handling of electronic PHI is subject to the HIPAA Privacy, Security, and Breach Notification Rules, including applicable provisions of 45 CFR Parts 160 and 164, and other applicable privacy and security laws. PHI must be protected with the administrative, physical, and technical safeguards required for our role.

Our policy is to use protected transmission methods for PHI, including encryption through current Transport Layer Security (TLS), the successor to SSL, or equivalent safeguards appropriate to the transmission and applicable security requirements. Access controls, recipient verification, and other reasonable safeguards are also important to protect confidentiality and integrity. No technology can guarantee that every transmission or storage system will be free from security risks.

Ordinary email and text messaging may not be encrypted. You may request a confidential or more secure communication method. If you specifically request a copy of your PHI by unencrypted email, the responsible entity must first explain the risk that another person could read or access the information and confirm that you still want that delivery method. Merely emailing a records request does not automatically authorize unencrypted delivery. See HHS guidance on requested delivery methods.

Please use the clinical provider’s secure patient communication channel for sensitive health details where available. You can contact our Privacy Team to request assistance arranging a suitable delivery method.

State-specific medical-privacy protections

HIPAA protections apply to covered information throughout the United States. Applicable state laws may impose additional limits on uses and disclosures, additional consent requirements, faster access rights, or stronger security and breach-notification protections. Where a more protective law applies, we follow that requirement for information within our responsibility. Applicability depends on the information, the entity holding it, the service, and the relevant jurisdiction, rather than residence alone.

The following examples supplement the PHI provisions above. They are distinct from the consumer-privacy rights described in the California and Nevada sections below. Written consent will be obtained when the applicable law requires it, including for treatment, payment, or operations disclosures when those purposes do not qualify for a legal exception.

California

The Confidentiality of Medical Information Act (CMIA) and other applicable California laws may protect medical information in addition to HIPAA. These protections include limits on disclosure and on certain marketing uses or sales of medical information. Required authorization must be obtained before those uses or disclosures unless an applicable legal exception permits them. California patients may also have additional rights to inspect records and obtain copies, including an available electronic format, under applicable law.

The right to restrict disclosure to a health plan when an item or service has been paid for out of pocket in full is described in Your rights regarding PHI and is not limited to California. Where California law allows a minor to consent to sensitive services, including certain reproductive-health, mental-health, or substance use disorder services, parental access to the related records may be restricted. Required consent and legally permitted exceptions govern those disclosures.

New York

New York provides additional confidentiality protections for HIV-related information, certain mental health records, and genetic test records, including under Public Health Law Article 27-F, Mental Hygiene Law Section 33.13, and Civil Rights Law Section 79-l, when applicable. Disclosures must meet the relevant consent, confidentiality, and redisclosure rules. Written consent will be obtained where required, including when an otherwise permitted treatment, payment, or operations disclosure does not satisfy the applicable state-law exception.

Texas

The Texas Medical Records Privacy Act, including Health and Safety Code Chapter 181, may impose additional obligations concerning PHI, including notice and authorization requirements for electronic disclosure, with statutory exceptions. PHI may be disclosed electronically for the permitted purposes described in this policy; a separate authorization will be obtained when Texas law requires one. Applicable Texas protections for mental health records and applicable substance use disorder confidentiality rules also apply. Required safeguards extend to handling, storage, and disposal of protected information.

Florida

Applicable Florida laws provide confidentiality protections for medical records, mental health records, HIV/AIDS-related information, and substance use disorder treatment records. We follow the authorization requirements and disclosure exceptions applicable to the information we handle. Written consent will be obtained when required, including for treatment, payment, or operations disclosures that do not fall within a permitted exception. Electronic records are subject to applicable privacy and security safeguards.

Illinois

Applicable Illinois laws provide additional protection for mental health and developmental disability records, HIV/AIDS-related information, and genetic testing information. Required written consent and limits on use and redisclosure apply unless a statutory exception permits disclosure. We also comply with applicable Illinois breach-notification requirements when an incident involving information within our responsibility triggers those requirements.

Massachusetts

Applicable Massachusetts laws provide additional protections for mental health records, HIV test information, and genetic testing information. We obtain the specific written consent required for disclosure unless a legal exception applies. Applicable Massachusetts requirements for protecting personal information and electronic records also govern information within their scope.

Other states may provide additional protections. Contact our Privacy Team or the privacy officer of the organization maintaining your clinical records for assistance with rights that apply to your information. Further guidance on the relationship between HIPAA and more protective state laws is available from HHS.

Privacy complaints and non-retaliation

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Team or the privacy officer of the covered healthcare entity responsible for the information. Include a description of the concern and how we can contact you. You may request a secure method for providing sensitive details.

You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services through the Office for Civil Rights (OCR), without first filing a complaint with us. Visit HHS: Filing a Health Information Privacy Complaint, call 1-877-696-6775, or write to HHS Office for Civil Rights, 200 Independence Avenue, S.W., Washington, D.C. 20201.

We will not retaliate against you for filing a privacy complaint or exercising your privacy rights.

The information we collect and the sources of such information

We obtain information about you through the means discussed below when you use the Services. Please note that we need certain types of information so that we can provide the Services to you. If you do not provide us with such information, or ask us to delete it, you may no longer be able to access or use part or all of our Services.

Information you provide to us

We collect a variety of information that you provide directly to us. For example, we collect information from you through:

• Account and product registration and administration of your account.
• Processing your orders and requests for treatment.
• Questions, communications, or feedback you submit to us via forms or email.
• Your participation in research and surveys.
• Requests for customer support and technical assistance, including through online chat functionalities.
• Uploads or posts to the Services.
• Employment applications you submit.

The specific types of information we collect will depend upon the Services you use, how you use them, and the information you choose to provide. The types of data we collect directly from you include:

• Name, address, telephone number, date of birth, and email address.
• Information about your medical conditions, treatment options, physician referrals, prescriptions, and lab results or other related health information, such as your physical and emotional characteristics.
• Log-in credentials, if you create an account.
• Billing information, such as shipping address, credit or debit card number, verification number, expiration date, and identity verification information, collected by our payment processors on our behalf.
• Information about purchases or other transactions with us.
• Information about your customer service and maintenance interactions with us.
• Demographic information such as your gender and age.
• User-generated content you post in public online forums on our Services.
• Any other information you choose to directly provide to us in connection with your use of the Services.

Information we collect through automated means

We collect certain information about your use of the Services and the devices you use to access the Services, as described in this section. As discussed further below, we and our service providers, which are third-party companies that work on our behalf, may use a variety of technologies, including cookies and similar tools, to assist in collecting this information.

Our Websites. When you use our Websites, we collect and analyze information such as your IP address, browser types, browser language, operating system, the state or country from which you accessed the Services, software and hardware attributes (including device IDs), referring and exit pages and URLs, platform type, the number of clicks, files you download, domain names, landing pages, pages viewed and the order of those pages, the amount of time spent on particular pages, the terms you use in searches on our sites, the date and time you used the Services, error logs, and other similar information.

Our Apps. When you use our Apps, we automatically receive certain information about the mobile phone, tablet, or computer used to access the Apps, including a mobile device identifier, IP address, operating system, version, Internet service provider, browser type, domain name and other similar information, whether and when you update the Apps, date and time of use, and how you use the Apps, including time spent in different portions of the Apps.

Location information. When you use the Services, we and our service providers may automatically collect general location information, such as IP address, city/state, or postal code associated with an IP address, from your computer or mobile device. This information allows us to enable access to content that varies based on a user’s general location, for example, to provide you with accurate sales tax information and to deliver content customized to your location.

We will ask your permission before collecting your precise GPS location information. In such instances, we will use your precise geolocation information to provide customized services, content, promotional offers, and other information that may be of interest to you. If you no longer wish for us and our service providers to collect and use GPS location information, you may disable the location features on your device. Please see your device manufacturer’s settings.

Our use of cookies and similar online tools. To collect the information discussed in this section, we and our service providers use web server logs, cookies, tags, SDKs, tracking pixels, and other similar tracking technologies. We use these technologies to offer you a more tailored experience.

• Web server logs: Files where website activity is stored.
• SDKs: Sets of tools and/or code that we embed in our Apps and software to allow third parties to collect information about how users interact with the Services.
• Cookies: Small text files placed on your computer or mobile device when you visit a site. They enable us to recognize your computer or device; store your preferences and settings; understand the parts of the Services you have visited and used; enhance your experience by delivering and measuring the effectiveness of content and advertising tailored to your interests; perform searches and analytics; and assist with security and administrative functions.
• Tracking pixels: Sometimes referred to as web beacons or clear GIFs, these are tiny electronic tags with a unique identifier embedded in websites, online ads, and/or email. They are designed to collect usage information like ad impressions or clicks and email open rates, measure the popularity of the Services and associated advertising, and access user cookies.

As we adopt additional technologies, we may also gather information through other methods.

You can change your settings to notify you when a cookie is being set or updated, or to block cookies altogether. Please consult the Help section of your browser for more information. By blocking, disabling, or managing any or all cookies, you may not have access to certain features or offerings of the Services.

Information we collect from social media and other content platforms

When you “like” or “follow” us on Facebook, Instagram, Twitter, or other social media sites, we may collect some information from you, including your name, email address, and any comments or content you post relevant to us. We also collect your information if you sign up for one of our promotions or submit information to us through social media sites.

Information we receive from other sources

We work closely with third parties, including intermediaries such as the physicians, medical professionals, and pharmacies with whom we partner to provide you with the Services and their healthcare services, technical subcontractors, advertising networks, analytics providers, and search information providers. Such third parties will sometimes provide us with additional information about you.

Purposes for how we use your information

In connection with providing you with the Services, we may use your information for our business purposes to:

• Carry out, improve, and manage the Services and, as applicable, facilitate the provision of healthcare services to you by physicians or other healthcare providers and ensure that the physicians or healthcare providers have the services and support necessary for healthcare operations.
• Engage in internal research to understand the effectiveness of our Services, improve our Services, and better understand our user base. If we publish or provide the results of this research to others, such research will be presented in a de-identified and aggregate form such that individual users cannot be identified.
• Communicate with you about the Services, your use of the Services, or your inquiries related to the Services and send you communications on behalf of physicians or other healthcare providers utilizing the Services to meet your needs.
• Communicate with you by email, postal mail, or phone about surveys, promotions, special events, or our products and Services and those of our subsidiaries, affiliates, and parent companies and any of their related businesses and those of our third-party partners.
• Provide you with technical support and customer service.
• Verify your identity and administer your account, including processing your payments and fulfilling your orders.
• Ensure that content from our Services is presented in the most effective manner for you and for your computer or device, allow you to participate in interactive features of our Services when you choose to do so, and help keep our Services safe and secure.
• Measure or understand the effectiveness of advertising and content we serve to you and others, and deliver and customize relevant advertising and content to you.
• Help us better understand your interests and needs, such as by engaging in analysis and research regarding use of the Services.
• Comply in good faith with any procedures, laws, and regulations which apply to us where it is necessary for our legitimate interests or the legitimate interests of others.
• Establish, exercise, or defend our legal rights where it is necessary for our legitimate interests or the legitimate interests of others.

Combined information. For the purposes discussed in this Privacy Policy, we may combine the information that we collect through the Services with information that we receive from other sources, both online and offline, and use and share such combined information in accordance with this Privacy Policy.

Aggregate/De-Identified Data. We may aggregate and/or de-identify any information collected through the Services so that such information can no longer be linked to you or your device (“Aggregate/De-Identified Information”). We may use Aggregate/De-Identified Information for any purpose, including for research and marketing purposes, and may also share such data with any third parties, including advertisers, promotional partners, and sponsors.

Online analytics and advertising

The advertising and analytics practices described here are subject to the health-information provisions above. They do not authorize the disclosure of PHI to advertising or analytics providers without the permissions and safeguards required by applicable law.

Online analytics

We may use third-party web analytics services, such as Google Analytics (including Google Signals, Google User-ID, and other Google Analytics features) and Mixpanel, on our Services to collect and analyze usage information through cookies and similar tools; engage in auditing, research, or reporting; assist with fraud prevention; try to locate the same unique users across multiple browsers or devices to better tailor services and features; and provide certain features to you. If you have a Google account with personalized advertising enabled, through Google Signals, Google will also be able to gather for us analytics and engagement information from across the various devices you use to access the Services.

To prevent Google from using your information for analytics on supported websites, you may install the Google Analytics Opt-out Browser Add-on. You can manage Google advertising personalization through Google My Ad Center. You may also be able to disable cross-device tracking through your Android or Apple device-based settings.

If you receive email from us, we may use certain analytics tools, such as clear GIFs, to capture data such as when you open our message or click on any links or banners our email contains. This data allows us to gauge the effectiveness of our communications and marketing campaigns.

Online advertising

The Services may integrate third-party advertising technologies, such as ad networks and ad servers including Facebook, Google Ads, Criteo, and others, that use cookies and other technologies to deliver relevant content and advertising for Prime Point Health products on the Services, as well as on other websites you visit and other applications you use. The ads may be based on various factors, such as the content of the page you are visiting, information you enter such as your searches, demographic data, and other information we collect from you. These ads may be based on your current activity or your activity over time and across other websites and online services.

We sometimes provide our customer information, such as email addresses, to service providers, who may “match” this information in de-identified form to cookies or mobile ad identifiers and other proprietary IDs, in order to provide you with more relevant ads when you visit other websites and mobile applications.

We neither have access to, nor does this Privacy Policy govern, the use of cookies or other tracking technologies that may be placed on the device you use to access the Services by non-affiliated third-party advertising network services.

For more information about tailored browser advertising and how you can generally control cookies used to deliver tailored advertising, visit the Network Advertising Initiative’s opt-out resources, the Digital Advertising Alliance’s Consumer Opt-Out tool, or Your Online Choices to review options for participating companies. For more information about Criteo’s privacy practices or opting out of Criteo’s advertising services, view Criteo’s Privacy Policy. To customize Google advertising, visit Google My Ad Center.

We do not control these opt-out links or whether any particular company chooses to participate in these opt-out programs. We are not responsible for any choices you make using these mechanisms or the continued availability or accuracy of these mechanisms.

If you exercise the opt-out choices above, you will still see advertising when you use the Services, but it will not be tailored to you based on your online behavior over time.

Mobile advertising

When using mobile applications from us or others, you may also receive tailored in-application advertisements. We may use third-party service providers to deliver advertisements on mobile applications or for mobile application analytics. Each operating system provides its own instructions on how to prevent the delivery of tailored in-application advertisements. We do not control how the applicable platform operator allows you to control receiving personalized in-application advertisements; contact the platform provider for further details. You may review the support materials and/or device settings for the respective operating systems to opt out of tailored in-app advertisements.

Notice concerning Do Not Track

Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers. We are committed to providing you with meaningful choices about the information collected on our website for third-party purposes, and that is why we provide the variety of opt-out mechanisms listed above. However, we do not currently recognize or respond to browser-initiated DNT signals.

How we share and disclose your information

We may share your information for our business purposes in the following ways:

Affiliates and subsidiaries

We may share information we collect within any Prime Point Health member or group, including our subsidiaries and affiliates, our ultimate holding company, and its subsidiaries, to deliver products and services to you, ensure a consistent level of service across our products and services, and enhance our products, services, and your customer experience.

Healthcare providers and services

We share your information with healthcare providers to schedule and fulfill appointments and provide healthcare services as part of the Services; with providers to whom you send messages through our Services; and for other treatment, payment, or healthcare operations purposes, including pharmacy services, upon your request.

Service providers

We provide access to or share your information with select third parties who use the information to perform services on our behalf. They provide a variety of services to us, including billing, sales, marketing, advertising, analytics, research, customer service, shipping and fulfillment, data storage, IT and security, fraud prevention, payment processing, and auditing and legal services. These entities may also include healthcare organizations, pharmacies, and other third parties we use to support our business or in connection with the administration and support of the Services.

Protection of Prime Point Health and others

By using the Services, you acknowledge and agree that we may access, retain, and disclose the information we collect and maintain about you if required to do so by law or in a good-faith belief that such access, retention, or disclosure is reasonably necessary to:

• Comply with legal process, such as a subpoena or court order.
• Enforce our Terms of Use, this Privacy Policy, or other contracts with you, including investigation of potential violations.
• Respond to claims that any content violates the rights of third parties.
• Respond to your requests for customer service.
• Protect the rights, property, or personal safety of Prime Point Health, its agents and affiliates, its users, and/or the public.

This includes exchanging information with other companies and organizations for fraud protection, spam/malware prevention, and similar purposes.

Business transfers

As we continue to develop our business, we may buy, merge, or partner with other companies. In such transactions, including in contemplation of such transactions, user information may be among the transferred assets. If a portion or all of our assets are sold or transferred to a third party, customer information, including your email address, would likely be one of the transferred business assets. If such transfer is subject to additional mandatory restrictions under applicable laws, we will comply with such restrictions.

Public forums

Certain features of our Services make it possible for you to share comments publicly with other users. Any information that you submit through such features is not confidential, and we may use it for any purpose, including in testimonials or other marketing materials. For example, if you submit a product review on one of our sites, we may display your review, along with the name provided, if any, on other Prime Point Health websites and on third-party websites. Any information you post openly in these ways will be available to the public at large and potentially accessible through third-party search engines. Please take care when using these features.

Consent

We may also disclose your information in other ways you direct us to and when we have your consent.

Aggregate/De-Identified Information

We reserve the right to create Aggregate/De-Identified Data from the information we collect through the Services, and our sharing of such Aggregate/De-Identified Data is in our discretion.

Your marketing choices

You may instruct us not to use your contact information to contact you by email, postal mail, or phone regarding products, services, promotions, and special events that might appeal to your interests by contacting us using the information below. In commercial email messages, you can also opt out by following the instructions located at the bottom of such emails.

Regardless of your request, we may still use and share certain information as permitted by this Privacy Policy or as required by applicable law. For example, you may not opt out of certain operational emails, such as those reflecting our relationship or transactions with you.

Third-party services and notice about health information

Our responsibilities for PHI we handle, including information handled by vendors acting on our behalf, are described in Health information and HIPAA privacy practices. The discussion of independent third parties below does not limit those responsibilities.

This Privacy Policy does not address, and we are not responsible for, the privacy, information, or other practices, including data privacy and security processes and standards, of any third parties. These include physicians and other healthcare providers using the Services, the manufacturer of your mobile device and other IT hardware and software, and any other third-party mobile application, website, or service to which our Services may contain a link.

These third parties may at times gather information from or about you. We have no control over the privacy practices of these third parties. The collection, use, and disclosure of your information will be subject to the privacy policies of the third-party websites or services, and not this Privacy Policy. We urge you to read the privacy and security policies of these third parties.

How we protect your information

Prime Point Health takes a variety of technical and organizational security measures to protect your information against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure, or access. However, no method of transmission over the Internet, and no means of electronic or physical storage, is absolutely secure. As such, you acknowledge and accept that we cannot guarantee the security of your information transmitted to, through, or on our Services or via the Internet, and that any such transmission is at your own risk.

Where we have given you, or where you have chosen, a password that enables you to access the Services, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. The information you share in public areas may be viewed by any user of the Services.

Privacy information for California residents

For California medical-information protections, including CMIA, sensitive-service confidentiality, and additional record-access rights, see State-specific medical-privacy protections. The consumer-privacy provisions below apply within their statutory scope.

If you are a California resident, California law requires us to provide you with some additional information regarding how we collect, use, and share your “personal information” as defined in the California Consumer Privacy Act (“CCPA”).

Categories of personal information we collect and disclose

Throughout this Policy, we discuss in detail the specific pieces of personal information we collect from and about our users. Under the CCPA, we are also required to provide you with the categories of personal information we collect and the categories of third parties to which we disclose personal information.

Some of the information we collect through the Services, such as medical information, is subject to various health data privacy laws and is therefore not subject to the CCPA. The following table describes the categories of personal information we collect that are subject to the CCPA and the third parties to which we disclose it.

The business purposes for which we use the personal information we collect are: manage, facilitate, and improve the Services; research, marketing, and analytics; communicate with users; technical support and customer service; security and fraud prevention; and legal compliance and defense. For more detailed information about how we use and share your personal information, please see Purposes for how we use your information and How we share and disclose your information above.

Your California privacy rights

CCPA rights disclosure. If you are a California resident, the CCPA allows you to make certain requests about your personal information. Specifically, the CCPA allows you to request that we:

• Inform you about the categories of personal information we collect or disclose about you; the categories of sources of such information; the business or commercial purpose for collecting your personal information; and the categories of third parties with whom we share or disclose personal information.
• Provide access to and/or a copy of certain information we hold about you.
• Delete certain information we have about you.

The CCPA further provides you with the right to not be discriminated against, as provided for in applicable law, for exercising your rights.

Certain information may be exempt from such requests under California law. For example, we need certain information in order to provide the Services to you. We also will take reasonable steps to verify your identity before responding to a request.

If you are a California resident and would like to exercise any of your data rights under California law, email us at Care@Joinprimepoint.com.

Please include your full name, email address, and residential address associated with your use of our Services, along with the rights you would like to exercise, so that we can process your request in an efficient manner. If you would like to receive a copy of your medical record in connection with your request, please indicate that in your email message. Sending a request by email does not automatically authorize delivery of your medical record by unencrypted email. If you request that delivery method, the responsible entity will explain the transmission risks and confirm your choice, as described in Transmission and protection of PHI.

Sale of personal information

Prime Point Health does not, and will not, sell information that identifies you, such as your name, email address, phone number, or postal address. Like many companies with an Internet presence, we do work with third parties that provide marketing and advertising services to us, including interest-based advertising services, and these third parties may place tags, pixels, cookies, beacons, and other similar tracking mechanisms on our Website and App and collect your online identifiers.

Because of the CCPA’s broad definitions of “sale” and “personal information,” making certain online identifiers available to these companies so that they can provide marketing and advertising services to Prime Point Health may be considered a “sale” under the CCPA.

To opt out of sharing your information with participating third parties for interest-based advertising, please visit the Network Advertising Initiative’s opt-out resources, the Digital Advertising Alliance’s Consumer Opt-Out tool, and Your Online Choices. These opt-outs are device and browser based, so you will need to opt out on each of your devices and browsers. For more information, see Online analytics and advertising above.

Shine the Light disclosure. The California “Shine the Light” law gives residents of California the right under certain circumstances to request information from us regarding the manner in which we share certain categories of personal information, as defined in the Shine the Light law, with third parties for their direct marketing purposes. We do not share your personal information with third parties for their own direct marketing purposes.

Privacy information for Nevada residents

Under Nevada law, certain Nevada consumers may opt out of the sale of “personally identifiable information” for monetary consideration, as those terms are defined under Nevada law, to a person for that person to license or sell such information to additional persons.

We do not engage in such activity; however, if you are a Nevada resident who has purchased services from us, you may submit a request to opt out of any potential future sales under Nevada law by emailing Care@Joinprimepoint.com. We will take reasonable steps to verify your identity and the authenticity of the request. Once verified, we will maintain your request in the event our practices change.

Retention of your information

We keep your information for no longer than necessary for the purposes for which it is processed. The length of time for which we retain information depends on the purposes for which we collected and use it and/or as required to comply with applicable laws.

Revisions to our Privacy Policy

We reserve the right to change this Privacy Policy at any time to reflect changes in the law, our data collection and use practices, the features of our Services, or advances in technology. We will make the revised Privacy Policy accessible through the Services, so you should review it periodically. The date this Privacy Policy was last revised is identified at the top of the document.

You are responsible for periodically monitoring and reviewing any updates to the Privacy Policy. If we make a material change to the Privacy Policy, we will provide you with appropriate notice in accordance with legal requirements. Your continued use of our Websites or Apps after such amendments, and notice where applicable, will be deemed your acknowledgment of these changes to this Privacy Policy.

Changes to the health-information provisions

We may revise these health-information provisions when our lawful privacy practices change. To the extent permitted by law and our applicable obligations, revised provisions may apply to PHI we already maintain as well as information received in the future. A policy revision does not itself authorize a new use or disclosure that requires your authorization or exceeds our authority under a provider agreement.

We will post the current policy and its effective date on this page and provide a paper copy on request. The responsible covered healthcare entity must revise and make available its own Notice of Privacy Practices, including posting at its office and on its website and providing notice to patients where required. Contact our Privacy Team for help obtaining the current notice for your care provider.

Contacting us

For questions, privacy complaints, requests to exercise rights, or a paper copy of this policy, contact our Privacy Team. For a request intended for your healthcare provider’s Privacy Officer or clinical records custodian, we can help identify the appropriate contact.

Prime Point Health Privacy Team
4425 Military Trail
Jupiter, Florida
Care@Joinprimepoint.com
joinprimepoint.com

When submitting a request, describe the right you wish to exercise and provide a way for us to reach you. We may need to verify your identity or authority before releasing information or acting on a request. You may ask for confidential communications or a secure method to provide supporting information.