Last Updated: March 23, 2026

This Consumer Health Data Privacy Policy ("Consumer Health Data Privacy Policy") explains how beHuman Corp. and its affiliated medical groups (“beHuman,” “we,” “us,” or “our”) collect, use, and protect consumer health data as defined under applicable U.S. state laws (“Consumer Health Data”).

This policy applies to data collected through our website, applications, and services (collectively, the “Service”), including when you interact with our platform, schedule care, complete forms, or receive services through beHuman.

This policy supplements our general Privacy Policy. Where there is a conflict, this policy applies to Consumer Health Data as required by applicable law.

Our role in healthcare data

beHuman operates as both a healthcare provider organization and a technology platform.

• Our affiliated medical groups are Covered Entities under the Health Insurance Portability and Accountability Act (HIPAA)

• We handle protected health information (PHI) in accordance with HIPAA privacy and security requirements

• We participate in national health data exchange networks, including those aligned with TEFCA (Trusted Exchange Framework and Common Agreement), to support treatment, care coordination, and access to longitudinal patient records

Health information accessed through these networks is used only for permitted purposes such as treatment, care coordination, and healthcare operations, in accordance with applicable law.

What we collect

We collect information necessary to provide care, coordinate services, and operate our platform.

Information you provide

• Contact information — name, email, phone, address

• Account information — login details, preferences, profile data

• Health information — medical history, conditions, medications, lab results, imaging, clinical notes

• Genetic information — where applicable through testing

• Insurance and payment information — for billing and eligibility

• Communications — messages, support requests, and interactions with our team

Information collected automatically

When you use our platform, we may collect:

• Device and browser information

• General location (city/state)

• Usage activity (pages viewed, interactions)

This helps us improve performance, security, and user experience.

Information from healthcare partners and networks

We may receive health information from:

• Laboratories, imaging centers, and treating providers

• Health information networks and exchanges, including TEFCA-aligned networks

• Systems that support interoperability and clinical data exchange

This enables us to build a more complete, longitudinal view of your health to support screening and care decisions.

Derived and de-identified data

We may analyze data to:

• Identify screening needs

• Generate clinical insights

• Improve care delivery

Where possible, data may be de-identified or aggregated and used for research, analytics, and platform improvement in accordance with applicable law. We do not attempt to re-identify de-identified data.

How we use your data

We use Consumer Health Data to:

Provide care and clinical services

• Coordinate screenings, labs, and follow-up care

• Support clinical decision-making

• Maintain medical records

Enable care coordination through data exchange

• Access and incorporate relevant clinical history through secure data exchange networks

• Support continuity of care across providers

Personalize screening and recommendations

• Identify risk and appropriate screening pathways

• Apply evidence-based guidelines to your clinical data

Improve the platform

• Analyze outcomes and usage

• Develop new features and services

Maintain security and compliance

• Protect against fraud and misuse

• Comply with HIPAA and other applicable regulations

How we share your data

We share data only as necessary for care delivery, operations, or legal requirements.

Healthcare providers and partners

• Physicians, labs, imaging centers, and care teams involved in your treatment

Health information networks

• Secure data exchange for treatment, care coordination, and healthcare operations under TEFCA and related frameworks

Service providers

• Infrastructure, hosting, and payment processing partners operating under strict data protection agreements

Legal and regulatory requirements

• When required by law or to protect safety and integrity of systems

We do not sell your health data to advertisers or data brokers.

Your rights

Depending on your state and applicable law, you may have the right to:

• Access your data

• Correct inaccuracies

• Request deletion (subject to medical record retention laws)

• Withdraw consent where applicable

• Request information about data sharing

To exercise your rights:

privacy@behuman.health

We may verify your identity before fulfilling requests.

Data security

beHuman uses security measures designed for healthcare-grade data protection, including:

• Encryption of data in transit and at rest

• Identity and access controls

• Continuous monitoring and threat detection

• Secure cloud infrastructure

Our systems are designed to align with HIPAA security standards and support secure participation in national data exchange frameworks.

Changes to this policy

We may update this policy from time to time. Updates will be posted with a revised effective date.

Contact

For questions about this policy or your data:

privacy@behuman.health