PRIVACY POLICY

Last updated: August 12, 2026

1. Who We Are and What This Policy Covers

This Privacy Policy describes how Ivologist Weight Loss Center, LLC, doing business as Ivologist ("Ivologist," "we," "us," or "our"), collects, uses, and shares information through our website at https://ivologist.com, our mobile application, our patient portal, and the services we provide (collectively, the "Services"). Ivologist is a telehealth and medical wellness provider based at 26331 Tawny Way, Boerne, TX 78015, United States. You can reach us at 210-436-8822 or info@ivologist.com.

By using the Services, you acknowledge the practices described in this Privacy Policy. If you receive medical care through Ivologist, our handling of your health information is additionally governed by our Notice of Privacy Practices, described below.

2. Health Information and HIPAA

When we provide healthcare services, the health information we collect and maintain about you is protected health information ("PHI") under the Health Insurance Portability and Accountability Act ("HIPAA"). Our use and disclosure of PHI is governed by our Notice of Privacy Practices ("NPP"), which describes your rights with respect to your PHI and how we may use and disclose it. A copy of the NPP is available upon request.

In summary, we may use and disclose PHI for treatment, payment, and healthcare operations as permitted by HIPAA. Any use or disclosure of your PHI for other purposes — including marketing, publication, research, or testimonials — requires your separate, written authorization, which you may revoke at any time (revocation is not retroactive).

Vendors that create, receive, maintain, or transmit PHI on our behalf — including our hosting providers and our analytics platform, Freshpaint — do so under written business associate agreements as required by HIPAA.

3. Information We Collect

Identity and contact information: name, mailing address, email address, phone number, date of birth, and government-issued identification used to verify your identity for telehealth visits.

Health information: medical history, symptoms, current medications, allergies, height and weight, laboratory results, photographs you submit, prescription and treatment records, and the contents of your communications with your care team.

Payment information: billing details and payment card information, collected and processed through our payment processors to complete transactions.

Guardian information: for patients aged 13 to 17, the identity, contact information, and consent records of a parent or legal guardian.

Technical information: IP address, browser and device type, access times, pages visited, and referring website addresses, collected through our HIPAA-compliant analytics platform as described in Section 5.

4. How We Use Your Information

• To provide healthcare services, including evaluations, treatment plans, prescriptions, laboratory orders, and follow-up care;
• To operate the Services, including scheduling, account management, customer support, and delivery coordination;
• To process payments and maintain billing records;
• To send service communications such as appointment reminders, order updates, and account notices;
• To send marketing communications, only as permitted by law and, where PHI is involved, only with your written authorization;
• To comply with legal obligations, protect patient safety, and secure the Services.

5. Analytics, Cookies, and Tracking

We use Freshpaint, a healthcare-focused analytics and consent-management platform, operating under a business associate agreement, to measure how the Services are used. Freshpaint is configured to prevent the disclosure of identifiable health information to third-party advertising platforms.

We do not use third-party advertising pixels or session-recording tools on pages where users enter health information, and we do not disclose PHI to advertising platforms without a HIPAA-compliant authorization. You can manage your cookie preferences at any time through the consent banner on our website. For details about the specific cookies we use, see our Cookie Policy at https://ivologist.com/cookie-policy.

6. How We Share Information

• Care delivery: with the licensed clinicians involved in your care, and with pharmacies, laboratories, and IV-therapy personnel involved in fulfilling your treatment;
• Corporate affiliates (Affiliated Covered Entity): Ivologist and its affiliated healthcare entities under common ownership or control (the "Affiliates") have designated themselves as a single Affiliated Covered Entity under HIPAA (45 CFR § 164.105). This means the Affiliates operate under a joint Notice of Privacy Practices and may share your health information with one another for treatment, referrals, care coordination, payment, and healthcare operations as permitted by HIPAA. Affiliates protect your information under the same standards described in this Privacy Policy. We do not use your health information to market Affiliate products or services without your written authorization (except as HIPAA permits, such as face-to-face communications), and we do not share mobile opt-in information with Affiliates for marketing or promotional purposes;
• Service providers: with vendors that perform services for us (hosting, analytics, communications, payment processing, shipping) under contracts that restrict their use of your information and, where PHI is involved, under business associate agreements;
• Legal compliance and safety: when required by law, legal process, or to protect the safety of patients, users, or the public;
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to notice to you and continued protection of your information.

We do not sell your personal information, and we do not share your personal information for cross-context behavioral advertising.

7. Your Privacy Rights

HIPAA rights. With respect to your PHI, you have the right to access and obtain a copy of your records, request amendments, request an accounting of disclosures, request restrictions on certain uses and disclosures, request confidential communications, obtain a copy of our NPP, and file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights, without retaliation.

State privacy rights. Depending on where you live, you may have additional rights under state law — including the Texas Data Privacy and Security Act, the California Consumer Privacy Act (as amended), the Washington My Health My Data Act, and similar laws in other states — such as the right to know what personal information we hold about you, to correct it, to delete it, to obtain a portable copy, and to opt out of targeted advertising, sale, or profiling. We do not discriminate against you for exercising these rights. If we deny a request, you may appeal by contacting us as described below.

Exercising your rights. To exercise any of these rights, email info@ivologist.com or call 210-436-8822. We will verify your identity before acting on a request and respond within the time required by applicable law.

8. Deletion and Retention

We will honor verified requests to delete personal information where required by applicable law. However, certain records are exempt from deletion because we are legally required to retain them. In particular, medical records are retained for a minimum of seven years from the date of last treatment (and, for patients who are minors, at least until the patient’s 21st birthday or seven years from last treatment, whichever is longer), and billing and tax records are retained as required by law. When retention is required, we will tell you which information we must keep and delete the remainder.

9. Security

We maintain administrative, technical, and physical safeguards designed to protect your information, including encryption of data in transit (TLS) and at rest, access controls, and workforce training. No method of transmission or storage is completely secure; if a breach affecting your information occurs, we will notify you as required by HIPAA and applicable state law.

10. Minors

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn we have collected information from a child under 13, we will delete it. Patients aged 13 to 17 may receive care only with the consent of a parent or legal guardian, who must establish and manage the patient’s account; information about these patients is collected and used with guardian consent and as permitted by law.

11. Email and Text Communications

We may send you service-related emails and, with your consent, marketing emails. You may opt out of marketing emails at any time using the unsubscribe link in any message. Text messaging is governed by the SMS terms in our Terms of Service; you may opt out of texts at any time by replying STOP.

Mobile Information and SMS Consent

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All other categories described in this Privacy Policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. Mobile opt-in data is used solely to deliver the messages you have requested.

12. Links to Other Sites

The Services may contain links to third-party websites. We are not responsible for the privacy practices of those sites, and we encourage you to review their privacy policies.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email to the address on your account and by posting a prominent notice on our website before the change takes effect, and we will update the "Last updated" date above.