Privacy Policy

INSTITUTE FOR HUMAN OPTIMIZATION – PRIVACY POLICY

```

The Institute for Human Optimization (“Institute for Human Optimization,” “IFHO,” “we,” “our,” or “us”) is committed to protecting the privacy and security of your personal information and Protected Health Information (“PHI”). This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our website, use our online forms, communicate with us by telephone, email, or text message, or engage with our precision medicine and clinical services.

By accessing our website or submitting information through our online platforms, you acknowledge the practices described in this Privacy Policy.

1. Definitions

Protected Health Information (PHI)

Information that identifies you and relates to your past, present, or future physical or mental health or conditions, healthcare services, or payment for healthcare.

Personal Information

Information that identifies, relates to, describes, or could reasonably be linked with an individual, such as a name, email address, telephone number, or mailing address.

De-Identified Information

Information that has been de-identified in accordance with applicable HIPAA requirements and cannot reasonably be used to identify an individual.

Cookies and Tracking Technologies

Small data files or web-based identifiers used to operate, analyze, secure, and improve website performance and user experience.

Mobile Information

For purposes of this Policy, “Mobile Information” includes your mobile telephone number, SMS/text messaging opt-in information, messaging consent, and related consent records.

2. Information We Collect

A. Information You Voluntarily Provide

We may collect information that you voluntarily provide, including:

• Contact information, such as name, email address, telephone number, and mailing address;
• Appointment requests and inquiry form submissions;
• Health-related information submitted through online forms;
• Insurance or billing information;
• Patient intake and medical history information provided electronically; and
• Communication preferences, including whether you have consented to receive SMS/text messages.

B. PHI Collected During Clinical Interactions

If you become a patient, we collect PHI necessary to provide healthcare services, including:

• Information used for precision medicine and longevity evaluations;
• Information used in clinical decision-making;
• Information required for laboratory ordering and interpretation;
• Information required for diagnosis, treatment planning, and follow-up; and
• Information used for secure communication and care coordination.

C. Automatically Collected Information

When you visit our website, we may automatically collect certain technical information, such as:

• IP address;
• Device type, operating system, and browser type;
• Pages visited, time spent on pages, and referring URLs; and
• Cookies, tracking pixels, and analytics logs.

We may use analytics tools, such as Google Analytics, to collect device-based and usage-based information. We configure these technologies so that they are not intended to collect PHI.

3. How We Use Your Information

A. Uses of PHI

We may use and disclose PHI as permitted or required by HIPAA and other applicable laws, including for:

• Treatment, diagnosis, and care coordination;
• Payment processing and insurance-related activities;
• Healthcare operations, quality improvement, and compliance;
• Secure patient communications; and
• Other purposes permitted or required by applicable law.

B. Uses of Personal Information

We may use non-PHI personal information to:

• Respond to inquiries and requests;
• Schedule and manage appointments;
• Provide requested services and communications;
• Improve website performance, content, and user experience; and
• Maintain, secure, and troubleshoot our online services.

C. Marketing & Communications

We may send educational materials, practice updates, or promotional communications when you have provided the appropriate consent or when otherwise permitted by law.

We will not use PHI for marketing purposes without authorization where such authorization is required by HIPAA.

4. SMS/Text Messaging Privacy & Consent

The Institute for Human Optimization may offer SMS/text messaging for appointment-related communications, patient communications, service updates, informational messages, and, where separately authorized, marketing or promotional communications.

A. SMS Consent

By voluntarily providing your mobile telephone number and affirmatively opting in to SMS/text messaging, you consent to receive text messages from the Institute for Human Optimization at the mobile number you provide.

Consent to receive SMS/text messages is voluntary and is not a condition of purchasing goods or services or receiving clinical care from the Institute for Human Optimization.

Where SMS consent is collected through an online form, consent will be requested separately from acceptance of other terms or policies.

B. Mobile Information and SMS Consent Will Not Be Shared for Marketing

We do not sell, rent, trade, or share your mobile telephone number, SMS/text messaging opt-in information, or SMS consent with third parties or affiliates for their marketing or promotional purposes.

Mobile information and messaging consent will not be shared with third parties or affiliates for marketing or promotional purposes.

We may disclose Mobile Information to service providers that assist us in delivering text messages or supporting our communications infrastructure, but only to the extent necessary for them to perform services on our behalf. Such providers are not authorized to use your Mobile Information for their own marketing or promotional purposes.

SMS consent is specific to communications from the Institute for Human Optimization and is not transferred to another business for that business's independent marketing or promotional use.

C. Message Frequency

Message frequency may vary depending on your interactions with us, appointments, requested services, and communication preferences.

D. Message and Data Rates

Message and data rates may apply.

Your wireless carrier's standard messaging and data rates may apply to messages sent or received in connection with our SMS/text messaging program.

E. Opting Out

You may opt out of SMS/text messages at any time by replying STOP to a message you receive from us.

After you submit an opt-out request, you may receive a final confirmation message indicating that you have been unsubscribed. You will no longer receive SMS messages covered by that consent unless you subsequently opt in again.

Opting out of SMS communications does not prevent you from receiving communications through other appropriate channels, including telephone, email, secure patient portal, or mail.

F. Help

For assistance with SMS/text messaging, reply HELP to a message or contact the Institute for Human Optimization using the contact information provided below.

G. Carrier Disclaimer

Wireless carriers are not liable for delayed or undelivered messages.

5. How We Share Your Information

A. Sharing of PHI in Compliance with HIPAA

We may disclose PHI as permitted or required by law and as necessary to provide healthcare services and operate our practice, including disclosures to:

• Healthcare providers involved in your care;
• Laboratories, pharmacies, and imaging centers;
• HIPAA-compliant software and cloud service providers;
• Billing services, insurance companies, and payment processors; and
• Business Associates that perform services on our behalf and are subject to appropriate Business Associate Agreements (“BAAs”) where required.

B. PHI Is Not Shared for Third-Party Advertising

We do not sell PHI or disclose PHI to advertisers, data brokers, social media platforms, or other third parties for their independent marketing or advertising purposes except where expressly authorized by the individual and permitted by applicable law.

C. Mobile Information

Notwithstanding anything else in this Privacy Policy concerning information sharing, mobile telephone numbers, SMS opt-in information, and SMS consent will not be shared, sold, rented, or otherwise provided to third parties or affiliates for marketing or promotional purposes.

This restriction does not prevent us from using service providers solely to facilitate communications on our behalf, subject to appropriate privacy, security, and contractual protections.

D. Sharing of Non-PHI Personal Information

We may share non-medical website information with service providers that help us operate, secure, and improve our website and communications, such as:

• Analytics providers;
• Web hosting and security vendors; and
• Email communication platforms.

These service providers may use information only as permitted by applicable agreements, privacy requirements, and law.

6. Cookies, Tracking Technologies & Pixels

Our website may use cookies and similar technologies to enhance your experience and analyze website usage. These may include:

• Functional and preference cookies;
• Analytics tools, such as Google Analytics;
• Tag-management technologies, such as Google Tag Manager; and
• Advertising or measurement technologies, where appropriately configured.

We configure these technologies so that they are not intended to collect PHI or SMS consent information.

Mobile telephone numbers, SMS opt-in information, and SMS consent are not provided to advertising platforms for their marketing or promotional purposes.

You can control cookie settings through your browser or device settings and may use available opt-out mechanisms where applicable.

7. Your Rights Under HIPAA

As a patient, you have specific rights regarding your PHI under HIPAA and applicable law. These may include the right to:

• Request access to and copies of your medical records;
• Request corrections or amendments to your PHI;
• Request restrictions on certain uses or disclosures of your PHI;
• Request alternative or confidential means of communication;
• Obtain an accounting of certain disclosures of your PHI; and
• Receive our Notice of Privacy Practices.

To exercise these rights, please contact us using the information provided at the end of this Policy.

8. Data Security Measures

We implement administrative, technical, and physical safeguards designed to protect your information, including:

• Use of HIPAA-compliant electronic health record systems where applicable;
• Encryption of data in transit, such as SSL/TLS, where appropriate;
• Secure systems and restricted, role-based access to PHI;
• Staff training and confidentiality obligations; and
• Ongoing monitoring and periodic security reviews.

While we strive to protect your information, no electronic system, storage system, or method of transmission can be guaranteed to be 100% secure.

9. Data Retention

We retain information for as long as reasonably necessary to fulfill the purposes described in this Policy and to comply with applicable legal and regulatory requirements.

This may include:

• PHI and medical records retained for the period required under applicable federal and state law;
• Inquiry and contact-form submissions retained for as long as reasonably necessary to respond to the inquiry and maintain appropriate business records;
• SMS consent and opt-out records retained as reasonably necessary to document messaging preferences and regulatory compliance; and
• Email marketing information retained until you unsubscribe or as otherwise required for compliance and recordkeeping.

10. Third-Party Services & Business Associates

We may use third-party vendors and Business Associates to support our operations, such as:

• Electronic health record and practice-management systems;
• Telehealth platforms and secure messaging tools;
• Scheduling and patient-intake systems;
• SMS/text messaging and telecommunications providers;
• Cloud storage and data-backup providers; and
• Billing, insurance, and payment-processing services.

When an entity handles PHI on our behalf and qualifies as a Business Associate under HIPAA, we enter into a Business Associate Agreement where required.

Service providers that process Mobile Information on our behalf may use that information only as necessary to provide services to the Institute for Human Optimization and are not authorized to use Mobile Information or SMS consent for their independent marketing or promotional purposes.

11. No Services for Minors

We do not provide clinical services to, or intentionally collect information from, individuals under 18 years of age. Our website and clinical services are intended for adults.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, services, or legal requirements.

When we make changes, we will post the updated Privacy Policy on our website and update the effective date above.

13. Contact Information

If you have questions about this Privacy Policy, our privacy practices, SMS/text messaging, or your rights, or if you wish to exercise your rights under HIPAA, please contact:

Privacy Officer
Institute for Human Optimization
7030 Hi Tech Drive, Suite 101
Hanover, MD 21076
Phone: 410-858-4086
Email: [email protected]

Patients may also submit complaints regarding HIPAA privacy rights directly to the U.S. Department of Health and Human Services, Office for Civil Rights.

```