Effective Date: November 12, 2025

Entity: Personomics, LLC

Contact: [email protected]

THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, AND HOW YOU CAN ACCESS THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

1. Introduction & Scope

Personomics, LLC ("Personomics," "we," "us," or "our") is committed to protecting the privacy of your health information. This HIPAA Notice of Privacy Practices ("Notice") describes how we may use and disclose your Protected Health Information ("PHI") and informs you of your rights regarding that information.

This Notice applies to all services provided by Personomics, including:

-Concierge health coaching services provided by Personomics coaches and care team members

-Integrative health lab ordering, coordination, specimen collection, and results management

-Member portals, health assessments, programs, and any other services through which PHI is collected, stored, or processed

"Protected Health Information" or "PHI" means any information that relates to your past, present, or future physical or mental health, the provision of health-related services to you, or payment for such services, that can reasonably be used to identify you.

We are required by law to:

-Maintain the privacy of your PHI

-Provide you with this Notice of our legal duties and privacy practices

-Notify you if a breach of your unsecured PHI occurs

-Abide by the terms of the Notice currently in effect

2. How We May Use and Disclose Your PHI

We may use and disclose your PHI for the following purposes without your written authorization:

2.1 Treatment

We may use and disclose your PHI to provide, coordinate, or manage your health coaching and wellness services. This includes sharing information with:

-Personomics health coaches, concierge coordinators, and care team members involved in your program

-Third-party integrative labs, phlebotomy providers, or diagnostic service providers we partner with to process your lab orders

-Telehealth clinicians or licensed healthcare professionals who may review, order, or interpret your lab results

-Other healthcare providers to whom you have been referred, to ensure they have the information necessary to support your care

2.2 Payment

We may use and disclose your PHI to obtain payment for services, including billing, invoicing, collections, and payment processing through our third-party payment processors. This may include confirming your eligibility for programs and verifying payment methods.

2.3 Health Care Operations

We may use and disclose your PHI for internal business operations, including:

-Quality assurance reviews, program improvement, and member experience evaluation

-Training of coaches, coordinators, and staff

-Legal, compliance, audit, and risk management activities

-De-identified and aggregated data analysis for health research and program development (all identifying information is removed before any such use)

2.4 As Required by Law

We will disclose your PHI when required to do so by applicable federal, state, or local law, including mandatory reporting obligations to public health authorities, regulatory agencies, or law enforcement.

2.5 Public Health Activities

We may disclose your PHI to authorized public health authorities for activities such as preventing or controlling disease, injury, or disability; reporting births and deaths; or reporting reactions to medications or product defects as required by law.

2.6 Health Oversight Activities

We may disclose your PHI to health oversight agencies authorized by law to conduct audits, investigations, inspections, licensure, and other oversight activities related to the health care system.

2.7 Judicial and Administrative Proceedings

We may disclose your PHI in response to a valid court order, subpoena, discovery request, or other lawful legal process, subject to applicable legal protections and privacy safeguards.

2.8 Law Enforcement

We may disclose your PHI to law enforcement officials under limited, legally defined circumstances, including to identify a suspect or missing person, or to report certain injuries or wounds as required by law.

2.9 Serious Threats to Health or Safety

We may use or disclose your PHI when we believe, in good faith, that doing so is necessary to prevent or lessen a serious and imminent threat to your health or safety, or the health or safety of the public or another person.

2.10 Business Associates

We share your PHI with our Business Associates — third-party vendors and service providers who perform functions on our behalf.

These include, but are not limited to:

-Accredited laboratories and specimen collection services

-Scheduling and telehealth platforms

-Electronic health record and member portal providers

-Billing, payment processing, and collections vendors

-IT, cybersecurity, and cloud hosting providers

-AI-powered coaching or support tools used in service delivery

All Business Associates are required by law to enter into a Business Associate Agreement with us and to protect your PHI. They may only use or disclose your PHI as permitted by that agreement and applicable law.

2.11 Uses and Disclosures Requiring Your Written Authorization

The following uses and disclosures of your PHI require your separate written authorization:

-Most uses or disclosures of psychotherapy notes

-Use or disclosure of your PHI for marketing purposes (with limited exceptions permitted by HIPAA)

-Sale of your PHI for remuneration

-Any other use or disclosure not described in this Notice

You may revoke any written authorization you have provided to us at any time by submitting a written revocation to our Privacy Officer (see Section 6). Revocation will not apply to any actions already taken in reliance on your prior authorization.

3. Your Rights Regarding Your PHI

You have the following rights with respect to your PHI. To exercise any of these rights, please submit a written request to our Privacy Officer using the contact information in Section 6.

3.1 Right to Access and Inspect Your PHI

You have the right to inspect and obtain a copy of your PHI maintained in a designated record set, which may include coaching records, lab results, health assessments, and billing records. We will respond to your request within 30 days. We may charge a reasonable, cost-based fee for copies. We may deny access in limited circumstances permitted by law.

3.2 Right to Request an Amendment

You have the right to request that we amend your PHI if you believe it is inaccurate or incomplete. Your request must be in writing and must state the reason for the amendment. We may deny your request in certain circumstances (for example, if we did not create the information). If we deny your request, you have the right to submit a written statement of disagreement, which we will include in your record.

3.3 Right to an Accounting of Disclosures

You have the right to request an accounting of certain disclosures of your PHI that we have made in the six (6) years prior to your request. This right does not apply to disclosures made for treatment, payment, or health care operations; disclosures made pursuant to your authorization; or certain other disclosures permitted or required by law.

3.4 Right to Request Restrictions

You have the right to request restrictions on our use or disclosure of your PHI for treatment, payment, or health care operations. You also have the right to request that we restrict disclosure to a health plan if you have paid for the service entirely out-of-pocket and in full. We are required to honor qualifying out-of-pocket payment restriction requests. We are not required to agree to other restriction requests, but if we agree, we will honor the restriction except in emergencies.

3.5 Right to Request Confidential Communications

You have the right to request that we communicate with you about your PHI in a specific way or at a specific location (for example, only via email or only at a designated phone number). We will accommodate all reasonable requests submitted in writing.

3.6 Right to a Paper Copy of This Notice

You have the right to receive a paper copy of this Notice at any time, even if you previously agreed to receive it electronically. To request a paper copy, please contact our Privacy Officer.

3.7 Right to Be Notified of a Breach

You have the right to be notified in the event of a breach of your unsecured PHI. See Section 4 for full details on our breach notification obligations.

3.8 Right to File a Complaint Without Retaliation

You have the right to file a complaint if you believe your privacy rights have been violated. See Section 5 for details. We will not retaliate against you in any way for filing a complaint with us or with HHS.

4. Breach Notification

In the event that we discover a breach of your unsecured PHI, we are required by law to notify you. We will provide written notification to you no later than sixty (60) calendar days after discovery of the breach. Our breach notification will include:

-A brief description of what happened, including the date of the breach and the date of discovery, if known

-A description of the types of PHI involved in the breach (e.g., name, lab results, health history)

-Any steps you should take to protect yourself from potential harm resulting from the breach

-A brief description of the steps we are taking to investigate the breach, mitigate harm, and prevent future occurrences

Contact information for our Privacy Officer so you may ask questions or receive additional information

If the breach affects 500 or more residents of a state or jurisdiction, we will also notify prominent media outlets and submit notification to the U.S. Department of Health and Human Services (HHS) as required by the HITECH Act and applicable HIPAA regulations.

5. How to File a Complaint

If you believe that your privacy rights under HIPAA have been violated, you may file a complaint with Personomics or directly with the federal government. We will not retaliate against you for filing a complaint.

File a complaint with Personomics: Privacy Officer, Personomics LLC 6671 W Indiantown Rd, STE 50-403 Jupiter, FL 33458 Email: [email protected]

File a complaint with the U.S. Department of Health and Human Services:

Office for Civil Rights (OCR) Website:

www.hhs.gov/ocr/privacy/hipaa/complaints

Phone: 1-800-368-1019

6. Privacy Officer Contact

Personomics has designated a Privacy Officer responsible for overseeing compliance with this Notice and applicable privacy laws. For questions, concerns, record requests, or to exercise any of your rights described in this Notice, please contact:

Privacy Officer, Personomics LLC 6671 W Indiantown Rd, STE 50-403 Jupiter, FL 33458, United States Email: [email protected]

Website: personomics.io/hipaa-notice

7. Changes to This Notice

We reserve the right to change the terms of this Notice at any time, including with respect to PHI we already maintain. Any material revisions will be:

-Posted on our website at personomics.io/hipaa-notice with an updated effective date

-Made available in paper form upon request from our Privacy Officer

-Communicated to active members via email where required by applicable law

You are entitled to a copy of the Notice currently in effect at any time. Your continued use of our services after a revised Notice is posted constitutes your acknowledgment of the updated terms.

8. Additional State Law Protections

In some states, applicable state laws may provide additional privacy protections for your health information beyond those required by HIPAA. Where state law is more stringent than HIPAA, we will comply with the more protective standard. This may apply to, among other things:

-Mental health and substance use disorder records

-HIV/AIDS-related health information

-Genetic information and testing results

-Reproductive and sexual health data

-Consumer health data as defined under state-specific laws (see our separate Consumer Health -Data Privacy Policy at personomics.io/consumer-health-data)

If you are a resident of California, Colorado, Washington, Connecticut, Nevada, or another state with a specific consumer health data or general privacy law, additional rights and protections may apply to you. Please refer to our Consumer Health Data Privacy Policy and Privacy Policy for further details.

9. Lab & Diagnostic Services — Special Notice

Because Personomics facilitates integrative health lab testing on behalf of members, the following additional disclosures apply to your PHI in connection with lab services:

-Your lab results constitute PHI and are subject to all protections described in this Notice

-Results may be shared with accredited third-party laboratories, specimen collection providers, and, where applicable, licensed clinicians who order or review tests on your behalf

-Critical or abnormal results will be flagged and communicated to you.

It is your responsibility to consult a licensed healthcare provider regarding any results and to take appropriate action.

Personomics does not diagnose, treat, or prescribe based on lab results. Lab services facilitated through Personomics are for informational and wellness education purposes only and do not constitute medical care or create a physician-patient relationship.

In certain states, lab results may be required to be reported to state or local health authorities (e.g., for infectious disease surveillance). We will make such disclosures as required by law.

By using our lab services, you authorize Personomics and its lab partners to collect, process, analyze, and report your specimen and results as further described in our Lab & Diagnostic Consent Form at personomics.io/lab-consent.

10. Acknowledgment of Receipt

By using Personomics services — whether by enrolling online, signing up for a coaching program, or ordering lab services — you acknowledge that you have received, or been given the opportunity to receive, this HIPAA Notice of Privacy Practices.

If you are a parent or legal guardian acting on behalf of a minor or dependent, your acknowledgment covers them as well.

By checking the box at checkout, you acknowledge that you have received, read, and had the opportunity to review this HIPAA Notice of Privacy Practices. This acknowledgment will be recorded with your account at the time of enrollment.

If you have questions about this Notice before completing your enrollment, please contact us at [email protected] before proceeding.