Terms and privacy.

01Who we are

This Privacy Policy explains how Profile Health, Inc. (“Profile,” “we,” “us,” or “our”) collects, uses, discloses, and protects information in connection with:

• our website
• our software platform
• patient intake flows
• any data shared with us by clinics, healthcare providers, or via HIE networks

We are a Delaware C-Corp registered in California. We are a Business Associate to our clinic customers.

02Who this Policy applies to

This Policy applies to:

• Clinics / Covered Entities
• Patients whose data is processed by our platform
• Website visitors

Clinics remain responsible for obtaining patient consent as required by law.

03The types of data we collect

We may collect personal information, including Protected Health Information (PHI), such as:

• name, contact information, demographics
• genomics / DNA data
• blood biomarkers
• specialty lab results
• medication + supplement history
• Carequality / HIE data imports
• symptoms, health history, past medical notes
• appointment + intake information
• communications and form submissions

We also collect non-PHI technical information such as:

• browser type
• device
• IP
• usage logs
• pages visited

04How we use information

We use the information we collect to:

• provide and improve our Services
• support care coordination for clinics
• enable intake, triage, chart review, and decision support workflows
• send notifications and reminders (including SMS and email)
• respond to support requests
• maintain platform security and integrity
• comply with legal obligations

We do not sell PHI. We do not use PHI for advertising.

05SMS / texting

By providing a mobile number, you consent that:

• we may send automated SMS related to intake, scheduling, or account use
• message frequency may vary
• standard carrier rates may apply

06HIPAA + Business Associate role

We acknowledge that we process PHI on behalf of Covered Entities.

Our permitted uses and disclosures of PHI are governed by our Business Associate Agreement (BAA) with each clinic.

If these terms conflict with a BAA, the BAA controls.

07How we share information

We may share information with:

• clinics and healthcare providers who manage the patient relationship
• vendors or subprocessors who support our infrastructure (e.g., secure hosting, SSO, communications, analytics)

Vendors are only permitted to use PHI to support our services on our behalf, not for their own purposes.

We may also disclose information when required by law (e.g., court order).

08Data retention

We retain information as long as necessary to:

• provide the Services
• comply with legal / regulatory requirements
• fulfill BAAs

Clinics may request deletion or export consistent with their legal rights.

09Data security

We maintain administrative, technical, and physical safeguards designed to protect information.

However, no system is completely secure. We cannot guarantee absolute security of information transmitted to or from us.

10Your rights

If you are a patient, your rights regarding your PHI (including access, amendment, and restrictions) are governed primarily by your healthcare provider’s policies.

Requests must generally go through the clinic.

11Children’s privacy

We do not knowingly collect information from children under 13 unless authorized by a clinic under applicable law.

12Changes to this Policy

We may update this Privacy Policy. When we do, we will revise the “Effective Date” at the top.

13Contact

Questions about these Terms may be sent to: legal@profilehealth.com

01Who we are

These Terms of Service (“Terms”) are a legal agreement between you and Profile Health, Inc., a Delaware C-Corp registered to do business in California (“Profile,” “we,” “us,” or “our”). We provide a software platform (“Services”) to healthcare clinics and licensed healthcare providers.

We are a Business Associate to our clinic customers and operate under Business Associate Agreements (BAAs) where required by law.

We do not provide medical services. Providers are solely responsible for medical decisions.

02Who these Terms apply to

These Terms apply to:

• Clinics / Covered Entities who license our SaaS
• Patients who interact with our intake flows on behalf of the clinic
• Website visitors browsing our public site

If you are a patient, you acknowledge that your healthcare provider — not Profile — is responsible for your care.

03Using our Services

You agree to:

• use the Services only for lawful purposes
• not attempt to reverse engineer, scrape, or misuse the platform
• not use the Services to harm or disrupt others, the platform, or networks

Clinics are responsible for:

• obtaining patient consent
• providing accurate and lawful data
• ensuring that PHI shared with us is authorized and permitted

04Data and PHI

We ingest and process health information — including but not limited to:

• genomics
• blood and biomarker data
• specialty labs
• Carequality / HIE imported records
• clinical history + structured + unstructured data

HIPAA-lite: We acknowledge that PHI is protected health information under HIPAA.

Detailed roles, permitted uses, and obligations are defined in our Business Associate Agreement (BAA), which governs in the event of conflict.

05SMS and Email

You agree that we may send automated:

• emails
• SMS messages (including reminders related to intake)

Message frequency may vary. Standard carrier rates may apply.

06Intellectual property

Profile owns all rights in and to the Services, including:

• software
• workflows
• machine learning models
• analytics
• user interface design

You may not copy or reuse these without written permission.

07Disclaimer

We do not provide medical or diagnostic services. Clinics and providers remain solely responsible for clinical decisions.

08Limitation of liability

To the fullest extent allowed by law:

• Profile is not liable for indirect, special, punitive, or consequential damages
• Total liability is capped at fees paid to Profile in the prior 12 months
• Some jurisdictions do not allow these limitations — where prohibited, the limitation applies to the minimum extent permitted

09Termination

We may suspend or terminate accounts that:

• violate these Terms
• abuse the platform
• present security risk

Clinics may terminate access according to their Subscription Agreement or BAA.

10Changes to these Terms

We may update these Terms at any time. When we do, we will revise the “Effective Date.”

11Governing law

These Terms are governed by the laws of the State of Delaware, without regard to conflict-of-law principles.

12Contact

Questions about these Terms may be sent to: legal@profilehealth.com