PRIVACY POLICY

Effective Date: October 15, 2026
Website: https://www.revivmd.com

1. Introduction and Commitment to Privacy

RevivMD, Inc. (“RevivMD,” “we,” “our,” or “us”) is committed to respecting individual privacy and safeguarding personal information, including sensitive health-related information.

We recognize that individuals entrust our organization and affiliated service partners with confidential information when seeking access to healthcare and wellness services.

This Privacy Policy explains how information may be collected, used, maintained, shared, and protected through our website, administrative services, patient coordination activities, and associated technology platforms.

RevivMD is committed to complying with applicable privacy and data protection laws, including the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), where applicable, and relevant federal and state consumer privacy laws.

2. Our Business Model and Healthcare Relationships

RevivMD operates as a Management Services Organization (MSO).

RevivMD provides nonclinical administrative, technology, patient coordination, customer support, marketing, and business management services that facilitate access to independent healthcare providers.

RevivMD maintains a contractual relationship with Beluga Health, which facilitates access to a national network of independently licensed healthcare professionals and licensed pharmacy partners.

Healthcare professionals participating through this network operate independently of RevivMD and retain sole authority and responsibility for medical evaluations, diagnoses, treatment recommendations, prescribing decisions, and clinical care.

Prescriptions, when medically appropriate, are issued by authorized healthcare professionals and transmitted to appropriately licensed pharmacies.

RevivMD does not independently practice medicine, diagnose medical conditions, prescribe medications, or exercise control over independent providers’ clinical judgment.

Depending on the services performed and the information involved, RevivMD may act as a business associate or subcontractor under HIPAA, or as an independent business subject to other applicable privacy laws.

Independent healthcare providers and other HIPAA-covered entities are responsible for their respective legal obligations, including providing required HIPAA Notices of Privacy Practices.

3. Information We Collect

Depending on how an individual interacts with RevivMD and its service partners, information collected may include:

1. Personal identification information
   • Full name and date of birth
   • Mailing and residential address
   • Email address and telephone number
   • Identity verification information
   • Account registration details

1. Health-related information

Information submitted through healthcare intake and coordination processes may include:

• Medical history and current health concerns
• Height, weight, and health goals
• Allergies and medication history
• Information related to GLP-1 therapies
• Information related to peptide therapies
• Men’s and women’s health concerns
• Hormone-related health information
• Wellness and longevity objectives
• Laboratory results and other medical information, where applicable

Clinical information is evaluated by appropriately licensed healthcare professionals, not by RevivMD in its capacity as an MSO.

1. Transaction and administrative information

Information may include payment details, billing records, purchase histories, shipping addresses, service requests, refunds, and administrative correspondence.

Payment card information may be processed by authorized third-party payment processors.

1. Website and technical information

Information collected automatically may include IP address, browser type, device characteristics, operating system, website activity, and cookie preferences.

The collection and use of this information are subject to applicable privacy laws and the restrictions described in this Policy.

4. How We Use Information

RevivMD may use personal information for legitimate and legally permitted business purposes, including:

1. Facilitating patient registration and administrative onboarding.
2. Coordinating access to independent licensed healthcare providers.
3. Supporting appointment scheduling and patient communications.
4. Facilitating prescription fulfillment coordination when directed by authorized healthcare professionals.
5. Providing billing, payment, shipping, and customer support services.
6. Maintaining and improving website and administrative platform functionality.
7. Addressing customer inquiries and resolving service issues.
8. Protecting systems against fraud, misuse, and unauthorized access.
9. Meeting legal, regulatory, contractual, and compliance obligations.
10. Conducting marketing activities where permitted by law and applicable authorization requirements.

When RevivMD handles protected health information (“PHI”) as a HIPAA business associate, it uses and discloses such information only as permitted by its applicable Business Associate Agreements, HIPAA, and other governing laws.

5. HIPAA and Protected Health Information

Certain health information handled in connection with healthcare services may qualify as PHI under HIPAA.

RevivMD recognizes the importance of safeguarding PHI and complying with applicable HIPAA Privacy, Security, and Breach Notification requirements when acting in a regulated capacity.

RevivMD’s permitted access to and use of PHI is determined by its role, applicable contractual agreements, and relevant legal requirements.

When acting as a business associate, RevivMD is required to use appropriate safeguards and comply with applicable limitations on PHI uses and disclosures.

RevivMD does not acquire independent authority to use clinical information for unrelated business purposes merely because the information is accessible through an administrative system.

6. Sharing and Disclosure of Information

Information may be shared with authorized parties when legally permitted and reasonably necessary to provide services.

Such parties may include:

Independent healthcare providers: For patient onboarding, clinical evaluation, treatment coordination, and related healthcare services.

Beluga Health: For authorized technology, administrative, provider-network, and healthcare coordination functions consistent with applicable contractual and legal requirements.

Licensed pharmacies: For prescription processing, dispensing, delivery, and related services when authorized by an independent prescribing healthcare professional.

Administrative service providers: For payment processing, secure technology hosting, communications, customer support, and other authorized functions.

Regulatory and legal authorities: When disclosure is required or permitted by applicable law.

Other authorized recipients: When an individual provides a valid authorization or when another lawful basis permits disclosure.

RevivMD requires applicable contractual privacy and security protections from vendors handling regulated health information, including Business Associate Agreements when required by HIPAA.

RevivMD does not sell PHI or disclose PHI for advertising or marketing purposes except where specifically permitted by applicable law, including any required HIPAA authorization.

7. Information Security

RevivMD maintains a commitment to administrative, physical, and technical safeguards appropriate to the sensitivity of information it handles and the legal obligations applicable to its operations.

Security controls may include, as appropriate:

• Role-based access restrictions
• User authentication and account controls
• Encryption of sensitive information in transit and at rest
• Secure communications and technology platforms
• Vendor security reviews and contractual protections
• Workforce privacy and security training
• Security monitoring and incident response procedures
• Appropriate information retention and disposal practices

No internet-based transmission or electronic storage system can be guaranteed to be completely secure.

Individuals should use appropriate precautions when accessing online accounts and communicating sensitive information.

8. Patient Privacy Rights

Individuals may have rights concerning their PHI under HIPAA, including the right to:

Access information: Request access to or a copy of eligible health records.

Request corrections: Request an amendment to inaccurate or incomplete information in a designated record set.

Request restrictions: Ask that certain uses or disclosures of PHI be restricted. Some restrictions are mandatory under specific circumstances, while others may be declined as permitted by law.

Request confidential communications: Request communications through alternative means or at alternative locations, subject to applicable legal requirements.

Receive an accounting of disclosures: Request an accounting of certain disclosures of PHI.

Receive a privacy notice: Obtain a copy of the applicable healthcare provider’s Notice of Privacy Practices.

Submit complaints: File a complaint concerning a potential violation of applicable privacy rights without retaliation.

Because RevivMD is an MSO rather than the treating healthcare provider, certain HIPAA requests may need to be directed to the independent provider or other covered entity maintaining the relevant records.

RevivMD will assist with or appropriately route requests consistent with its contractual responsibilities and applicable law.

Individuals may also have additional rights under applicable state consumer privacy laws, including rights concerning access, correction, deletion, and certain uses of personal information.

9. Communications by Email, Telephone, and Text Message

RevivMD may communicate with individuals regarding account registration, appointments, administrative requests, service updates, payment matters, and other authorized purposes.

Electronic communications may involve privacy risks, including access by persons who share a device, telephone number, or email account.

RevivMD and its partners should use appropriately safeguarded communication methods when transmitting PHI.

Marketing text messages and emails will be subject to applicable consent, authorization, and opt-out requirements.

Consent to receive promotional communications is not a condition of receiving medically necessary care.

Individuals may opt out of eligible promotional messages using the unsubscribe instructions provided or by contacting RevivMD.

10. Website Cookies, Analytics, and Tracking Technologies

RevivMD may use cookies and similar technologies to support website functionality, security, performance measurement, and permitted analytics.

Some website technologies may collect identifiers or information about visitors’ interactions with the website.

RevivMD will not intentionally disclose PHI to advertising or analytics providers without an appropriate legal basis and any required HIPAA authorization or Business Associate Agreement.

Cookie acceptance or consent to ordinary website tracking does not substitute for a valid HIPAA authorization when one is legally required.

Tracking technologies must be evaluated and configured in accordance with applicable healthcare privacy requirements, including restrictions applicable to patient portals, medical intake forms, and authenticated healthcare pages.

Individuals may manage certain cookies through available website controls and browser settings.

11. Marketing and Promotional Communications

RevivMD may provide information about its administrative services, available healthcare access programs, wellness resources, educational materials, and promotional offerings.

Where required, marketing involving PHI will occur only with a valid authorization or another applicable legal permission.

RevivMD will not use confidential medical diagnoses, treatment histories, or prescription information for unauthorized targeted advertising.

Individuals may withdraw marketing consent or authorization in accordance with applicable law. Withdrawal does not affect actions already lawfully taken in reliance on a valid authorization.

12. Data Retention

RevivMD retains personal information for periods reasonably necessary to fulfill legitimate business purposes and comply with applicable legal, regulatory, and contractual obligations.

Where information is subject to HIPAA, retention and documentation requirements will be addressed in accordance with applicable HIPAA rules, governing agreements, and relevant state laws.

Clinical record retention obligations generally remain with the applicable healthcare provider or other responsible record custodian.

When information is no longer required, RevivMD will use appropriate procedures for secure disposal or de-identification, as applicable.

13. Data Breaches and Security Incidents

RevivMD maintains procedures intended to identify, assess, investigate, and respond to suspected privacy and security incidents.

When an incident involves PHI, RevivMD will follow applicable HIPAA requirements, including obligations to notify the appropriate covered entity when acting as a business associate.

Affected individuals and regulatory authorities will receive notifications when required by applicable law and within legally prescribed timeframes.

RevivMD will cooperate with responsible healthcare providers, service partners, and regulatory authorities in addressing reportable incidents.

14. Children’s Privacy

RevivMD’s services are intended for individuals who satisfy the eligibility requirements of the relevant healthcare program.

RevivMD does not knowingly collect personal information from children under 13 through its general website in violation of applicable law.

Where healthcare services involving minors are lawfully available, the collection, use, and disclosure of information will be governed by applicable federal and state laws, including rules concerning parental authority and minors’ confidentiality rights.

15. State Privacy Laws

RevivMD recognizes that certain states impose additional requirements concerning consumer personal information, sensitive health data, biometric information, reproductive and sexual health information, and other protected categories.

Where applicable, RevivMD will honor state-specific rights and requirements, including those concerning access, deletion, correction, consent, and limitations on disclosure.

State-law rights may differ depending on the individual’s residency, the information involved, and RevivMD’s legal role.

16. Third-Party Websites and Services

RevivMD’s website may contain links to independently operated websites, healthcare platforms, payment services, pharmacy resources, and other third-party services.

These organizations may maintain separate privacy notices and legal obligations.

RevivMD is not responsible for the independent privacy practices of third parties except to the extent responsibility is imposed by applicable law or contractual agreement.

Individuals are encouraged to review the privacy notices of external services.

17. Changes to This Privacy Policy

RevivMD may revise this Privacy Policy to reflect changes in its services, technology, business operations, or applicable legal requirements.

The current version will be made available on our website with an updated effective date.

Where applicable law requires additional notice or consent concerning material changes, RevivMD will provide such notice or obtain such consent.

18. Contact Information and Privacy Complaints

For questions about this Privacy Policy, requests concerning personal information, or privacy-related complaints, please contact:

RevivMD, Inc.
Privacy Officer
Website: https://www.revivmd.com
Email: support@revivmd.com
Mailing Address: 30 N. Gould Street, Suite R Sheridan, WY 82801

Individuals may also submit HIPAA complaints to the U.S. Department of Health and Human Services, Office for Civil Rights, when the matter involves an entity or activity subject to HIPAA.

HHS Office for Civil Rights:
https://www.hhs.gov/ocr/privacy/hipaa/complaints/

RevivMD prohibits retaliation for making a good-faith privacy complaint or exercising legally protected privacy rights.

19. Our Commitment

At RevivMD, protecting personal information is an important part of supporting patient confidence and responsible access to healthcare.

We are committed to respecting patient privacy, maintaining appropriate security safeguards, supporting independent healthcare professionals, and operating our administrative services in accordance with applicable privacy and healthcare laws.

RevivMD — Restore Your Health. Reviv Your Life.