Privacy Policy & Notice of Privacy Practices

1. Introduction

vyrarx, Inc. ("vyrarx," "we," "us," or "our") respects your privacy and is committed to protecting your personal and health information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and telehealth services. It also serves as our Notice of Privacy Practices for Protected Health Information ("PHI") under applicable health privacy laws.

2. Information We Collect

We may collect the following types of information:

• Personal Information: Name, email address, phone number, mailing address, date of birth, and other identifiers.
• Health Information: Medical history, symptoms, diagnoses, prescriptions, and treatment information provided during telehealth consultations.
• Payment Information: Billing address and payment method details processed through our secure payment providers.
• Usage Data: IP address, browser type, device information, pages visited, and other analytics data.

3. Protected Health Information (PHI)

Protected Health Information, or PHI, is any information about your health or health care that can be used to identify you. This includes information that relates to:

• Your past, present, or future physical or mental health condition.
• The provision of health care to you, including diagnoses, treatment plans, prescriptions, and communications with our providers.
• Payment for the health care services or medications you receive.

PHI may include, but is not limited to, your name, address, date of birth, email address, phone number, medical history, symptoms, lab results, photographs, prescription information, and any other health-related information that can reasonably identify you.

This information may be created, received, maintained, or transmitted by vyrarx, our affiliated physicians, pharmacies, labs, and business associates in the course of providing services to you.

4. How We Use and Disclose PHI

We may use and disclose your PHI for the following purposes without obtaining your written authorization:

• Treatment: We use your PHI to provide, coordinate, and manage your health care. This includes sharing information with the licensed physicians, pharmacies, laboratories, and other health care professionals involved in your care. For example, your medical intake responses may be shared with your assigned provider so they can evaluate whether a treatment is appropriate for you.
• Payment: We may use and disclose your PHI to process payments, verify coverage, obtain reimbursement, and collect amounts owed for services or medications. This may include sharing information with payment processors, health plans, or other entities responsible for payment.
• Health Care Operations: We may use your PHI to evaluate and improve the quality of our services, conduct training and education, perform audits, resolve complaints, conduct compliance and quality assurance reviews, and manage our business operations.
• As Required by Law: We will use or disclose your PHI when required to do so by federal, state, or local law, including to comply with court orders, subpoenas, or other legal process, and to report abuse, neglect, domestic violence, or threats to public health or safety as required by law.
• Public Health Activities: We may disclose your PHI to public health authorities authorized by law to collect information for purposes such as preventing or controlling disease, injury, or disability.
• To You or Your Personal Representative: We will disclose your PHI to you or to someone you authorize to act on your behalf, upon verification of identity.
• Business Associates: We may share PHI with trusted service providers (such as hosting, payment, shipping, analytics, and telehealth platform vendors) who perform functions on our behalf. These business associates are contractually required to safeguard your PHI and may only use or disclose it as permitted by their agreements with us and by law.

For any use or disclosure of your PHI that is not described above, we will obtain your written authorization before using or disclosing your PHI. You may revoke that authorization at any time in writing, except to the extent that we have already acted in reliance upon it.

5. How We Use Your Information

We use your information to:

• Provide telehealth services and connect you with licensed physicians
• Process prescriptions and coordinate medication delivery
• Process payments and manage your account
• Communicate with you about your care, orders, and account
• Improve our services and user experience
• Comply with legal and regulatory obligations

6. How We Share Your Information

We do not sell your personal information. We may share information with:

• Healthcare Providers: Licensed physicians and pharmacies involved in your care
• Service Providers: Payment processors, shipping partners, and technology vendors who assist in operating our services
• Legal Authorities: When required by law, court order, or to protect our rights and safety

7. Data Security

We implement appropriate technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. This includes encryption, access controls, and regular security assessments.

8. Your Rights Regarding Your Health Information

You have the following rights with respect to your PHI. To exercise any of these rights, please contact us at privacy@vyrarx.com. We will respond within the timeframe required by law and may ask you to verify your identity before processing your request.

• Right to Inspect and Copy: You have the right to inspect and obtain a copy of your PHI contained in a designated record set, such as your medical and billing records. We may charge a reasonable fee for copies as permitted by law. In certain limited circumstances, we may deny your request, and we will explain any denial in writing.
• Right to Amend: If you believe your PHI is incorrect or incomplete, you may request that we amend it. We may deny your request if the information was not created by us, is not part of the designated record set, is not subject to amendment under law, or is accurate and complete. We will provide a written explanation of any denial within 60 days of your request.
• Right to an Accounting of Disclosures: You may request a list of certain disclosures of your PHI that we made in the past six years (or a shorter period if required by law). This list will not include disclosures made for treatment, payment, or health care operations, or disclosures made to you or with your authorization, among other exceptions.
• Right to Request Restrictions: You may request that we restrict how we use or disclose your PHI for treatment, payment, or health care operations, or to restrict disclosures to family members or others involved in your care. We are not required to agree to all restriction requests, but if we do agree, we will comply with the agreed-upon restrictions except in emergency situations.
• Right to Confidential Communications: You may request that we communicate with you about your PHI at a specific address or by a specific method. We will accommodate reasonable requests.
• Right to a Paper Copy: You may request a paper copy of this Notice of Privacy Practices at any time, even if you previously agreed to receive it electronically.
• Right to Be Notified of a Breach: You have the right to be notified promptly if a breach occurs that may have compromised the privacy or security of your PHI.

9. How to File a Complaint

If you believe your privacy rights have been violated, you have the right to file a complaint. You may file a complaint with us directly and/or with the U.S. Department of Health and Human Services Office for Civil Rights (OCR). There will be no retaliation against you for filing a complaint.

To file a complaint with vyrarx: Contact our Privacy Officer by email at privacy@vyrarx.com. Please include your full name, contact information, a description of the concern, and the date(s) the issue occurred. We will investigate and respond in accordance with applicable law.

To file a complaint with OCR: You may file a complaint online through the OCR Complaint Portal at https://ocrportal.hhs.gov/ocr/portal/lobby.jsf, by mail, or by telephone. OCR can be reached at:

• Phone: 1-800-368-1019
• TDD: 1-800-537-7697
• Mail: U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Washington, D.C. 20201

10. Our Legal Duties

vyrarx is required by applicable federal and state health privacy laws to:

• Maintain the privacy and security of your PHI.
• Provide you with this Notice of Privacy Practices describing our legal duties and privacy practices with respect to your PHI.
• Follow the terms of the notice currently in effect.
• Notify you promptly if a breach of your unsecured PHI occurs and may have compromised the privacy or security of your information.
• Abide by any restrictions on the use or disclosure of your PHI to which we have agreed.
• Not use or disclose your PHI in a manner inconsistent with this notice, except with your written authorization or as otherwise required or permitted by law.

We reserve the right to change our privacy practices and the terms of this notice. Any revised notice will apply to all PHI we maintain, including information created or received before the effective date of the revised notice. We will post the updated notice on our website with a new effective date and, upon request, provide you with a copy.

11. Cookies and Tracking

We use cookies and similar technologies to enhance your experience, analyze site traffic, and understand user behavior. You can manage cookie preferences through your browser settings.

12. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on our website and updating the effective date. Your continued use of our services after changes indicates your acceptance of the revised policy.

14. Contact Us

If you have questions or concerns about this Privacy Policy, our privacy practices, or your PHI, please contact us at privacy@vyrarx.com.