1. Introduction

This Privacy Notice describes how MD Health Now collects and uses Personal Data about you through your use of our website, and through email, text, and other electronic communications between you and MD Health Now.

MD Health Now ("MD Health Now," "we," or "us") respects your privacy and is committed to protecting it through compliance with this Privacy Notice ("Privacy Notice"). This Privacy Notice describes the types of information we may collect from you, or that you may provide, when you visit www.mdhealthnow.com (the "Website"), and our practices for collecting, using, maintaining, protecting, and disclosing that information.

This policy applies to information we collect:

• On our Website;
• In email, text, and other electronic messages between you and our Website; and
• When you interact with our advertising and applications on third-party websites and services, if those applications or advertising include links to this policy.

It does not apply to information collected by:

• Us offline or through any other means, including on any other website operated by MD Health Now or any third party (including our affiliates and subsidiaries);
• Us or our affiliates or subsidiaries in connection with your or any other individual's employment or potential employment with us; or
• Any third party (including our affiliates and subsidiaries), including through any application or content (including advertising) that may link to or be accessible from the Website.

Please read this Privacy Notice carefully. If you do not agree with our policies and practices, your choice is not to use our Website. By accessing or using the Website, you agree to this Privacy Notice. We may change this Privacy Notice from time to time, and your continued use of the Website after we make changes constitutes your acceptance of those changes, so please check this Privacy Notice periodically.

2. Children Under the Age of 13

Our Website is not intended for children under 13, and children under 13 are not permitted to use our Website. We do not knowingly collect Personal Data from children under 13. If you are under 13, do not use or provide any information on or through the Website, including your name, address, telephone number, email address, or any screen name or user name.

If we learn we have collected or received Personal Data from a child under 13 without verification of parental consent, we will delete that information. If you believe we might have collected information directly from a child under 13, please contact us at GetWell@MdHealthNow.com.

3. Information We Collect About You and How We Collect It

We collect several types of information from and about users of our Website ("Personal Data"), including information that may directly identify you, information that does not by itself identify you, and information we combine with data from our other users. We collect this information directly from you, automatically as you navigate the Website, and from third parties such as business partners and service providers.

Information You Provide to Us

• Information you provide by filling in forms on our Website, including intake, scheduling, and health history information provided when you request wellness or IV therapy services;
• Records and copies of your correspondence, including email, if you contact us;
• Your responses to surveys we may ask you to complete; and
• Details of transactions you carry out through our Website, including financial information you may be required to provide before placing an order.

The Personal Data we collect from you, including relevant health information, is necessary for us to enter into a contract with you and to provide the services you request. If you decline to provide it, we may not be able to provide certain products or services to you.

Information We Collect Through Automatic Data Collection Technologies

As you navigate and interact with our Website, we may use automatic data collection technologies to collect information about your equipment, browsing actions, and patterns, including traffic data, location data, referring and exit pages, date and time of visit, error information, clickstream data, IP address, operating system, and browser type. This information helps us operate, secure, and improve the Website and deliver a more personalized experience.

Cookies

Our Website may use session cookies (which expire once you close your browser) and persistent cookies (which remain until deleted) to provide a more personal and interactive experience. We place cookies with your consent where required by law. You can set your browser to refuse cookies or alert you when cookies are sent, though some parts of the Website may not function properly without them. More information about cookies is available at http://www.allaboutcookies.org.

Third-Party Use of Cookies and Other Tracking Technologies

Some content or applications on the Website, including advertisements, may be served by third parties, including advertisers and service, content, and application providers. These third parties may use cookies, web beacons, or other tracking technologies to collect information about you when you use the Website, which may be associated with your Personal Data or used to provide interest-based advertising. We do not control these third parties' tracking technologies or how they use the information they collect. Questions about a specific advertisement should be directed to the responsible provider.

4. Health Information and Special Categories of Data

Because MD Health Now facilitates wellness and IV therapy services administered by licensed practitioners, we and our affiliated practitioners may collect health-related information from you, including medical history, allergies, current medications, and information you provide during intake and screening ("Health Information"). Health Information may also constitute a special category of Personal Data under applicable law, along with data revealing racial or ethnic origin where applicable.

We process Health Information only as necessary to schedule and facilitate the services you request, to enable licensed practitioners to safely provide those services, to comply with our legal and recordkeeping obligations, and to protect our legitimate interests. Where a licensed practitioner providing your service is a covered entity or business associate under the Health Insurance Portability and Accountability Act ("HIPAA"), your Health Information may also be subject to a separate HIPAA Notice of Privacy Practices provided by that practitioner, which governs in addition to this Privacy Notice. We do not sell Health Information.

5. How We Use Your Information

We use information that we collect about you or that you provide to us, including Personal Data and Health Information:

• To present our Website and its contents to you;
• To schedule, confirm, and facilitate the wellness and IV therapy services you request;
• To provide you with information, products, or services you request from us;
• To provide notices about your account, including expiration and renewal notices;
• To carry out our obligations and enforce our rights arising from any contract between you and us, including for billing and collection;
• To notify you about changes to our Website or the services we offer;
• To administer surveys, promotions, and other contests;
• To send newsletters and similar communications;
• To comply with applicable law, including recordkeeping obligations related to health services; and
• For any other purpose disclosed to you at the time of collection, or with your consent.

We may also use your information, other than Health Information, to contact you about our own and third parties' goods and services that may interest you, where permitted by law.

6. Disclosure of Your Information

We do not sell your Personal Data or Health Information. We do not share or otherwise disclose your Personal Data for purposes other than those outlined in this Privacy Notice, except as described below. We may disclose aggregated or de-identified information that does not identify any individual without restriction.

We may disclose Personal Data that we collect or you provide:

• To our subsidiaries and affiliates;
• To the licensed practitioners who provide the services you request, and to contractors and service providers who support our business, including IT and infrastructure support, payment processing, and marketing software providers (our payment processor's privacy policy is available at http://stripe.com/us/privacy);
• To a potential or actual buyer or successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of MD Health Now's assets, including as part of a bankruptcy or similar proceeding;
• To fulfill the purpose for which you provided it, or for any other purpose disclosed by us at the time you provide the information;
• To comply with any court order, law, or legal process, including responding to a government or regulatory request or as required under Florida law;
• To enforce or apply our Terms of Service and other agreements, including for billing and collection; and
• If we believe disclosure is reasonably necessary to protect the rights, property, or safety of MD Health Now, our patients and users, or others, including for fraud protection.

7. Your Rights Regarding Your Information

Depending on where you live, you may have rights under applicable data protection law with respect to your Personal Data, including the right to access, correct, or request deletion of your Personal Data, and the right to restrict certain processing.

Access and Update

You may review and update your Personal Data by logging into your account on the Website, or by contacting us at GetWell@MdHealthNow.com. We may decline a request if we believe it would violate a legal requirement or cause the information to become inaccurate.

Right to Restrict Processing

You may request that we restrict our use of your Personal Data if you contest its accuracy, if you believe our processing is unlawful, or if we no longer need it for the purposes described here but are required to retain it by law.

Right to Deletion

You may request that we delete your Personal Data. Because certain Health Information must be retained under Florida and federal recordkeeping requirements applicable to healthcare services, we may be unable to delete records related to services you received, even if you close your account, until the applicable retention period has expired. Backup copies of deleted data may also persist for a limited time in accordance with our disaster recovery procedures.

How to Exercise Your Rights

You may exercise these rights by contacting us at GetWell@MdHealthNow.com. We may ask you to verify your identity before acting on a request, and we reserve the right to decline requests that are unfounded, excessive, or repetitive, subject to any limits imposed by applicable law. Before contacting a supervisory or regulatory authority about our handling of your Personal Data, we ask that you first contact us so we can attempt to resolve your concern directly.

8. Jurisdiction-Specific Privacy Rights

The law in some jurisdictions, including Florida and other states, may provide residents with additional rights regarding our use of their Personal Data. To the extent applicable, we comply with the Florida Digital Bill of Rights and other Florida privacy and data breach notification laws, including Section 501.171, Florida Statutes, governing notification in the event of a data breach.

For Individuals Located in the European Economic Area

If you are located in the European Economic Area, you may have additional rights under the General Data Protection Regulation.

Your California Privacy Rights

If you are a California resident, you may have additional rights under the California Consumer Privacy Act and related California law.

9. Do Not Track Signals

We may use automated data collection technologies to collect information about your online activities over time and across third-party websites. Some browsers allow you to send a "do not track" signal. We do not currently honor such signals, and we do not change our data collection or use practices based on whether a signal is received.

10. Data Security

We have implemented administrative, technical, and physical safeguards designed to protect your Personal Data and Health Information from accidental loss and from unauthorized access, use, alteration, or disclosure, consistent with applicable Florida law. Where Health Information is subject to HIPAA, our affiliated practitioners maintain safeguards required under the HIPAA Security Rule.

The security of your information also depends on you. If we have given you, or you have chosen, a password to access parts of the Website, you are responsible for keeping it confidential and should not share it with anyone.

No method of transmission over the internet, and no method of electronic storage, is completely secure. Although we use commercially reasonable efforts to protect your Personal Data, we cannot guarantee its absolute security, and any transmission of Personal Data is at your own risk. To the fullest extent permitted under Florida law, MD Health Now is not responsible for the circumvention of any privacy settings or security measures on the Website, except as required by applicable law, including any Florida data breach notification obligations that apply to us in the event of a security incident.

11. Data Retention Periods

We retain your Personal Data for as long as your account remains open, and for a period afterward as described below. After you close your account, we retain your Personal Data only as long as reasonably necessary, including:

• On our backup and disaster recovery systems, for the period described in our internal retention procedures;
• For as long as necessary to protect our legal interests, including in connection with a dispute; and
• To comply with applicable legal, tax, and recordkeeping requirements.

We retain Health Information for at least seven (7) years from the date of the last service provided, or longer if required by applicable Florida or federal law governing medical or health records, whichever is longer, after which it will be securely deleted or de-identified unless a longer retention period is required by law.

12. Changes to Our Privacy Notice

We may change this Privacy Notice at any time. Any changes will be posted to this page, and the "Last Updated" date at the top will reflect the most recent revision. If we make material changes to how we treat Personal Data, we will provide notice through the Website or through your contact information on file. You are responsible for keeping your contact information current and for periodically reviewing this Privacy Notice.

13. Governing Law

This Privacy Notice, and any dispute arising out of or relating to it, is governed by the laws of the State of Florida, without regard to its conflict-of-laws principles, except to the extent superseded by applicable federal law, including HIPAA, or by the law of another jurisdiction that applies to you and cannot be superseded by agreement.

14. Contact Information

If you have questions, concerns, complaints, or suggestions regarding this Privacy Notice, or requests related to your Personal Data, please contact us at GetWell@MdHealthNow.com.