Privacy Policy

Effective Date: April 26, 2026 Last Updated: April 26, 2026 IMPORTANT — PHI & HIPAA This Privacy Policy governs information collected through the BioProRx™ website (bioprorx.com) and non-PHI account data associated with the BioProRx™ platform. Protected Health Information ("PHI") processed through the BioProRx™ platform on behalf of healthcare providers—including patient demographics, diagnoses, insurance information, and clinical documentation submitted in connection with prior authorization requests, resubmissions, and appeals—is governed by the Health Insurance Portability and Accountability Act (HIPAA) and the Business Associate Agreement ("BAA") executed between BioProRx™ and each subscribing provider, not by this Privacy Policy. Patients should direct privacy inquiries to their treating provider, who serves as the HIPAA Covered Entity. CONTENTS 01. Scope & Who We Are 02. Information We Collect 03. PHI & HIPAA Carve-Out 04. How We Use Information 05. How We Share Information 06. Service Providers & Subprocessors 07. Cookies & Tracking 08. Security 09. Data Retention 10. Your Privacy Rights 11. California Residents (CCPA/CPRA) 12. Children's Privacy 13. Changes to This Policy 14. Contact Us 01. Scope & Who We Are BioProRx™, LLC ("BioProRx™," "we," "us," or "our") operates a multi-specialty biologic prior authorization platform and the bioprorx.com website. This Privacy Policy describes how we collect, use, disclose, and safeguard information that we obtain in our capacity as the operator of the website and the provider of the BioProRx™ platform—excluding PHI handled in our capacity as a HIPAA Business Associate, which is addressed under Section 03. This Policy applies to: Website visitors who browse bioprorx.com or submit inquiries through our contact form. Prospective customers evaluating BioProRx™ for their practice or organization. Authorized users of the BioProRx™ platform (providers, prescribers, clinical staff, and administrators), with respect to their account, billing, and usage data—not patient PHI. 02. Information We Collect Information You Provide Contact form submissions: name, email address, organization, role/title, phone number (if provided), and the content of your message. Account registration: name, work email, professional credentials (e.g., NPI, specialty), practice name, and authentication credentials. Billing information: practice name, billing contact, billing address, payment method details (processed by our payment processor; we do not store full card numbers). Communications with us: emails, support tickets, and any other correspondence. Information Collected Automatically Device and log data: IP address, browser type, operating system, referring URL, pages viewed, timestamps, and similar diagnostic information. Cookies and similar technologies: see Section 07 for details. Information from Third Parties We may receive limited information about you from third parties such as professional credentialing services, our authentication provider (for single sign-on if used), and payment processors—solely as needed to verify identity, process transactions, or maintain account security. 03. PHI & HIPAA Carve-Out The BioProRx™ platform processes Protected Health Information (PHI) on behalf of subscribing healthcare providers in connection with prior authorization workflows, including patient demographics, diagnoses, insurance and benefits data, clinical documentation, prescribed therapies, and supporting attachments submitted with initial authorization requests, resubmissions, and appeals. With respect to such PHI: BioProRx™ acts as a HIPAA Business Associate of the subscribing provider, who is the Covered Entity. The collection, use, disclosure, storage, and safeguarding of PHI is governed by the Business Associate Agreement (BAA) executed between BioProRx™ and each subscribing provider, together with applicable provisions of HIPAA, the HITECH Act, and implementing regulations. BioProRx™ does not use, sell, share, or process PHI for marketing, advertising, or any purpose outside the scope authorized by the BAA and applicable law. BioProRx™ does not use PHI to train artificial intelligence or machine learning models. Patients seeking to exercise rights under HIPAA (such as access, amendment, or accounting of disclosures) should contact their treating provider, who maintains the patient's designated record set. This Privacy Policy does not create rights or obligations with respect to PHI; those are established exclusively by the BAA and applicable law. 04. How We Use Information We use the information described in Section 02 for the following purposes: To respond to inquiries submitted through the website or by email. To provide and operate the platform, including authentication, account management, customer support, and service delivery. To process billing and payments for subscription fees and related charges. To send service-related communications such as security alerts, billing notices, and product updates. To improve and secure our services, including diagnosing technical issues, monitoring for abuse, and enhancing functionality. To comply with legal obligations and enforce our agreements. For marketing and outreach to current and prospective customers, where permitted (you may opt out of non-transactional marketing at any time). 05. How We Share Information We do not sell personal information. We share information only as described below: Service providers and subprocessors that perform functions on our behalf (see Section 06), under written agreements that limit their use of information to providing services to BioProRx™. Integration partners as necessary to operate the platform's prior authorization workflows on behalf of subscribing providers (subject, where PHI is involved, to the BAA framework described in Section 03). Legal and compliance: in response to valid legal process, to protect our rights and safety, or as required by law. Corporate transactions: in connection with a merger, acquisition, financing, reorganization, or sale of assets, with appropriate confidentiality protections. With your consent: for any other purpose disclosed to you at the time of collection. 06. Service Providers & Subprocessors BioProRx™ engages third-party service providers in categories including, but not limited to: Cloud infrastructure and hosting Drug intelligence and formulary data (e.g., FDB) Real-time benefit and electronic prior authorization networks (e.g., CoverMyMeds, Surescripts, Interra Health) Medical-benefit prior authorization gateways (e.g., Availity) Identity verification and authentication providers AI inference providers for prior authorization letter drafting (subject to data-use restrictions; PHI is processed only in accordance with the BAA, and certain licensed datasets are excluded from AI/ML processing in compliance with vendor licensing terms) Payment processing Email, communications, and customer support tools A current list of subprocessors is available to subscribing providers on request to info@bioprorx.com. 07. Cookies & Tracking The BioProRx™ website and platform use cookies and similar technologies that are strictly necessary for site operation (such as session management and security) and, where applicable, functional cookies that remember your preferences. We do not use third-party advertising cookies. If we add web analytics or other non-essential tracking in the future, this Policy will be updated and, where required, consent mechanisms will be implemented before such tracking is activated. Most browsers allow you to refuse or delete cookies; however, certain features of the website or platform may not function correctly without them. 08. Security BioProRx™ implements administrative, physical, and technical safeguards designed to protect information from unauthorized access, disclosure, alteration, and destruction. Safeguards for PHI are governed by HIPAA Security Rule requirements and detailed in the BAA. No method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security. Suspected security incidents should be reported promptly to info@bioprorx.com. 09. Data Retention We retain personal information only as long as necessary for the purposes described in this Policy, to comply with legal and regulatory obligations, to resolve disputes, and to enforce our agreements. PHI retention is governed by the BAA and applicable HIPAA requirements. When information is no longer needed, it is securely deleted or de-identified. 10. Your Privacy Rights Subject to applicable law, you may have the right to: Request access to the personal information we hold about you. Request correction of inaccurate or incomplete information. Request deletion of personal information. Opt out of non-transactional marketing communications. Lodge a complaint with a supervisory authority where applicable. To exercise these rights with respect to information governed by this Privacy Policy (i.e., non-PHI), contact us at info@bioprorx.com. We will respond within the timeframes required by applicable law. Requests concerning PHI must be directed to the patient's treating provider. 11. California Residents (CCPA/CPRA) If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"), provides additional rights regarding your personal information. In the prior 12 months, BioProRx™ has collected the categories of personal information described in Section 02 for the purposes described in Section 04, and has disclosed such information to the categories of recipients described in Section 05 and Section 06. BioProRx™ does not sell or share personal information for cross-context behavioral advertising as those terms are defined under the CCPA. California residents may request to know, delete, correct, or limit the use of their personal information by contacting info@bioprorx.com. We will not discriminate against you for exercising these rights. You may designate an authorized agent to make a request on your behalf, subject to verification. Note: PHI is exempt from CCPA to the extent it is governed by HIPAA. 12. Children's Privacy The BioProRx™ website and marketing services are not directed to children under 13, and we do not knowingly collect personal information from children under 13 through the website. The platform processes pediatric patient PHI only on behalf of treating providers under the BAA, in accordance with HIPAA. 13. Changes to This Policy We may update this Privacy Policy from time to time. The "Last Updated" date at the top reflects the most recent revision. Material changes will be communicated by posting a prominent notice on the website or, where appropriate, by direct notice to subscribing providers. Continued use of the website or platform after changes take effect constitutes acceptance of the revised Policy. 14. Contact Us For questions about this Privacy Policy or our privacy practices, contact: BioProRx™, LLC Email: info@bioprorx.com Web: bioprorx.com © 2026 BioProRx™, LLC. All rights reserved.