Effective Date: October 24, 2026

BAM HEALTH (“BAM HEALTH,” “we,” “our,” or “us”) respects your privacy and is committed to protecting your personal information and healthcare information. This Privacy Policy explains how we collect, use, disclose, store, and safeguard your information when you visit BAMHEALTH.org, utilize our services, communicate with us, purchase products, participate in tele-health consultations, enroll in memberships, receive SMS communications, or otherwise interact with BAM HEALTH.

By accessing or using our website and services, you consent to the practices described in this Privacy Policy.

We may collect the following categories of information:

Personal information may include:

• Name
• Address
• Email address
• Telephone number
• Date of birth
• Payment information
• Account credentials
• Emergency contact information
• Other identifying information you voluntarily provide

Healthcare information may include:

• Medical history
• Current health conditions
• Medications
• Laboratory results
• Treatment information
• Consultation records
• Provider notes
• Prescription information
• Wellness assessments
• Healthcare communications
• Protected Health Information (“PHI”) as defined by HIPAA

We may automatically collect:

• IP address
• Browser type
• Device information
• Operating system
• Pages viewed
• Referring websites
• Date and time of visits
• Website interaction data
• Cookies and similar technologies

We may collect information associated with:

• Email communications
• SMS communications
• Customer support interactions
• Recorded phone calls
• Online chat communications
• Contact form submissions

We may use information for the following purposes:

• Providing healthcare services
• Conducting telehealth consultations
• Processing prescriptions
• Coordinating patient care
• Scheduling appointments
• Processing payments
• Delivering products and services
• Managing memberships and subscriptions
• Responding to inquiries
• Improving website functionality
• Maintaining security
• Complying

BAM HEALTH — HIPAA NOTICE OF PRIVACY PRACTICES & PRIVACY POLICYEffective Date: October 24, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

1. OUR LEGAL DUTY & COMMITMENT TO YOUR PRIVACYBAM HEALTH ("we," "our," or "us") is committed to protecting the privacy and security of your Protected Health Information ("PHI"). We are required by federal and state law, including the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), to maintain the privacy and security of your PHI, to provide you with this Notice of Privacy Practices explaining our legal duties and privacy practices, to notify you promptly following a breach of unsecured PHI, and to follow the terms of this Notice currently in effect.

2. HOW WE MAY USE AND DISCLOSE YOUR HEALTH INFORMATION (WITHOUT WRITTEN AUTHORIZATION)In accordance with HIPAA and applicable state laws, we may use and disclose your PHI for the following core healthcare purposes:

For Treatment: We can use your health information and share it with licensed physicians, nurse practitioners, physician assistants, partner compounding and retail pharmacies (including via our pharmacy fulfillment and asynchronous care routing partners), and diagnostic laboratories (such as Quest Diagnostics and LabCorp) who are treating you or fulfilling your prescriptions and lab orders.

For Payment: We can use and share your health information to bill and process payments for your medical memberships, consultations, laboratory panels, and prescription programs (including through HSA/FSA processors, Stripe, and patient financing partners such as Cherry), or to provide documentation if you submit out-of-network claims.

For Healthcare Operations: We can use and share your health information to run our telehealth practice, improve your care, conduct quality assessment and provider credentialing, coordinate digital health software (including the BAM HEALTH Patient Portal & Mobile App and the JOURNEYS AI lab interpretation platform under strict Business Associate Agreements), and contact you when necessary regarding appointments, refills, and care updates.

Other Permitted or Required Disclosures: We are also permitted or required to share your information in specific public interest and safety situations when strict legal conditions are met, including: to prevent a serious and imminent threat to your health and safety or the safety of the public; for public health and FDA adverse-event reporting (such as reporting medication reactions or product recalls); for health oversight audits and licensing boards; to report suspected abuse, neglect, or domestic violence as required by law; for workers' compensation claims; to coroners or medical examiners; and in response to valid court or administrative orders or as otherwise required by federal or state law.

3. SPECIAL PROTECTIONS FOR SENSITIVE & SUBSTANCE USE DISORDER (SUD) RECORDS (2026 FEDERAL COMPLIANCE)If we receive, maintain, or create any records protected by federal confidentiality rules for Substance Use Disorder (SUD) treatment (42 CFR Part 2) or sensitive reproductive or behavioral health records, those records are subject to heightened federal privacy protections. Specifically, SUD treatment records, or testimony relaying the content of such records, shall not be used or disclosed in any civil, criminal, administrative, or legislative proceedings against you unless based on your specific written consent, or a court order accompanied by a subpoena or other legal mandate issued only after you have been provided notice and an opportunity to be heard. A subpoena alone is never sufficient to compel disclosure of these protected records.

4. USES AND DISCLOSURES THAT REQUIRE YOUR WRITTEN AUTHORIZATIONWe will never use or share your PHI for marketing purposes, the sale of your health information, or the disclosure of psychotherapy notes without your explicit written authorization. If you provide written authorization for us to share your PHI with a third party, you may revoke that authorization in writing at any time, except to the extent that we have already taken action in reliance on it.

5. NOTICE OF POTENTIAL REDISCLOSUREPlease be advised that when your Protected Health Information is disclosed to a third party pursuant to your authorization or as otherwise permitted by HIPAA, the information disclosed may be subject to redisclosure by the recipient and may no longer be protected by the federal HIPAA Privacy Rule (unless another federal or state privacy law applies to that recipient).

6. YOUR RIGHTS REGARDING YOUR HEALTH INFORMATIONWhen it comes to your health information, you have the following legal rights:

Right to Inspect and Get an Electronic or Paper Copy of Your Medical Record: You can ask to see or obtain an electronic or paper copy of your medical record, lab results, and other health information we have about you. We will provide a copy or a summary of your health information, usually within 30 days of your request. 

Right to Ask Us to Correct Your Medical Record: You can ask us to correct health information about you that you think is incorrect or incomplete. We may say "no" to your request, but we will tell you why in writing within 60 days. 

Right to Request Confidential Communications: You can ask us to contact you in a specific way (for example, via secure portal message, email, or a specific phone number) or to send mail to a different address. We will accommodate all reasonable requests.

Right to Ask Us to Limit What We Use or Share: You can ask us not to use or share certain health information for treatment, payment, or our operations. While we are not required to agree to all requests, if you pay for a healthcare service or item out-of-pocket in full (such as BAM HEALTH cash-pay telehealth programs), you have the right to demand that we do not share that information for payment or healthcare operations with your health insurer, and we will honor that request unless a law requires us to share that information.

Right to Get a List of Those With Whom We Have Shared Information: You can ask for a list (an "accounting") of the times we have shared your health information for six (6) years prior to the date you ask, who we shared it with, and why, excluding disclosures for treatment, payment, healthcare operations, and certain other disclosures you authorized.

Right to a Paper or Electronic Copy of This Notice: You can ask for a paper or PDF copy of this Notice at any time, even if you have agreed to receive the Notice electronically.

Right to Choose Someone to Act for You: If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information after we verify their legal authority.

7. WEBSITE PRIVACY, COOKIES & DIGITAL COMMUNICATIONSWhen you visit our website or mobile applications, basic technical analytics (such as IP address, browser type, and session cookies) may be collected to ensure site security and functionality. No mobile opt-in data, SMS consent, or patient contact information is ever sold or shared with third parties or affiliates for third-party promotional or marketing purposes.

8. CHANGES TO THE TERMS OF THIS NOTICEWe can change the terms of this Notice at any time, and the changes will apply to all information we have about you. The new Notice will be available upon request and posted directly on our website and patient portal.

9. HOW TO CONTACT US OR FILE A PRIVACY COMPLAINTIf you have any questions about this Notice, wish to exercise any of your privacy rights, or believe your privacy rights have been violated, you may contact our Privacy Officer at:

BAM HEALTH — Privacy OfficerPhone: 1 (855) 432-1226 Email: admin@bamhealth.org Physical Address: [Insert Your Physical Clinic Street Address, City, State, ZIP]

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/. We will never retaliate against you for filing a complaint.

BAM HEALTH — TERMS OF SERVICE, AUTO-SHIP CANCELLATION, REFUND & ADVERSE EVENT POLICYEffective Date: October 24, 2026

1. TELEHEALTH MEDICAL SERVICES & OPERATING STATESBAM HEALTH coordinates synchronous and asynchronous telehealth medical evaluations provided by independent, licensed healthcare professionals (MDs, DOs, NPs, and PAs). BAM HEALTH is not a pharmacy or health insurance company. Medical consultations, diagnostic laboratory testing, and prescription fulfillment are available only to patients physically located in United States jurisdictions where our affiliated medical providers and partner pharmacies are actively licensed to practice. Our asynchronous intake and pharmacy routing software (including Refill.co) automatically verifies state-by-state medication availability prior to order processing; if a specific compounded or commercial formulation is unavailable in your state of residence, a BAM HEALTH representative or clinician will notify you and coordinate an approved alternative pharmacy or treatment option where clinically appropriate.

2. NO EMERGENCY CARE & ADVERSE EVENT / SIDE EFFECT REPORTINGBAM HEALTH telehealth programs and memberships are not intended for medical emergencies or acute life-threatening conditions. If you are experiencing a medical emergency—including chest pain, shortness of breath, severe allergic reaction, suicidal thoughts, or severe abdominal pain—immediately call 911 or proceed to the nearest hospital emergency room.

How to Report a Side Effect, Adverse Event, or Patient Complaint: If you experience a non-emergency medication side effect, adverse reaction, pharmacy fulfillment issue, or wish to submit a clinical or customer service complaint, immediately contact BAM HEALTH at 1 (855) 432-1226 or email admin@bamhealth.org to be connected with a licensed medical provider or clinic administrator. You or your clinician may also report adverse prescription drug events directly to the U.S. Food and Drug Administration (FDA) MedWatch program at 1-800-FDA-1088 or online at www.fda.gov/medwatch.

3. PHARMACY FULFILLMENT, COMPOUNDED MEDICATIONS & PRESCRIPTION REFUND POLICYWhen medically indicated, prescriptions are transmitted to either the patient's preferred local retail pharmacy or a licensed, LegitScript-certified / NABP-accredited United States partner pharmacy (including via the Refill.co pharmacy network).

Strict No-Return Rule on Dispensed Medications: In accordance with federal and state board of pharmacy regulations, once a prescription order has been approved by a clinician and processed or dispensed by a pharmacy, it cannot be returned, exchanged, or refunded for any reason. If a medication shipment arrives damaged or compromised in transit, the patient must notify BAM HEALTH at admin@bamhealth.org or 1 (855) 432-1226 within forty-eight (48) hours of delivery with photographic documentation so we can coordinate a replacement review with the dispensing pharmacy. If a patient is determined by a BAM HEALTH medical provider during initial evaluation to be clinically ineligible for a paid specialty program prior to any prescription being sent to the pharmacy or laboratory requisition being drawn, the patient may request a refund less any applicable medical consultation or administrative intake fee.

4. AUTO-SHIP PROGRAMS (REFILL.CO) & MONTHLY MEMBERSHIP CANCELLATION POLICYBy enrolling in the BAM HEALTH Virtual Primary Care & Annual Lab Membership ($49/month Solo or $65/month Husband & Wife) or enrolling in an automated prescription refill/auto-ship program (including via Refill.co and Stripe), you authorize recurring monthly or scheduled billing to your designated payment method (including credit/debit cards, HSA/FSA cards, or approved patient financing accounts).

How to Cancel or Pause Auto-Ship / Memberships: You may cancel or pause your recurring Virtual Primary Care membership or Refill.co auto-ship subscription at any time by either:

1. Logging directly into your BAM HEALTH / Refill.co Patient Portal to manage your subscription settings; OR
2. Submitting a cancellation request via email to admin@bamhealth.org or calling 1 (855) 432-1226 at least five (5) business days prior to your next scheduled billing or refill processing date.

Cancellations submitted less than five (5) business days before a scheduled pharmacy auto-ship order that has already been transmitted to the compounding pharmacy for fulfillment will take effect on the following billing cycle. Monthly membership fees already billed for the current billing cycle and laboratory panels already requisitioned or drawn at Quest Diagnostics are non-refundable.

5. CHERRY PATIENT FINANCING & HSA/FSA PAYMENTSPatients utilizing third-party installment financing (such as Cherry Financing) are subject to the terms, credit approvals, and repayment schedules set forth directly in their agreement with the financing provider. Utilizing HSA or FSA cards is permitted for eligible medical consultations, laboratory panels, and prescription treatments; patients are responsible for retaining their itemized receipts inside the BAM HEALTH portal for personal tax or HSA/FSA administrator substantiation.

6. CLINIC CONTACT & PHYSICAL ADDRESS DISCLOSURE BAM HEALTH Toll-Free Phone: 1 (855) 432-1226 Email: admin@bamhealth.org Physical Business Address: 515 E Las Olas Blvd Ste 1301 Fort Lauderdale, FL 33301

7. Physical Address for BAM HEALTH: 515 E Las Olas Blvd Suite 1301 Fort Lauderdale, Fl, 33301