Privacy Policy

OMNIBIO LLC, a Wyoming limited liability company (OMNIBIO, we, us or our). Document version: October 28, 2026. The publication effective date is displayed with this exact version on the Platform and retained in its publication history. Every published version remains readable on the Platform, and signed-in users can see the versions they accepted in Settings.

1. Scope and Our Role

This Policy applies to personal information handled through OMNIBIO websites and professional platform features that link to it, including professional account enrollment, inquiries, ordering, payment and fulfillment support, authorized prescription-routing services, and patient accounts and clinic storefronts (Section 13).

OMNIBIO's technology and commercial role is distinct from a treating clinician's or dispensing pharmacy's role. When we process protected health information (PHI) on behalf of a clinic or other covered entity, applicable law, the executed business associate agreement (BAA) and lawful service instructions govern that information. This Policy does not replace a BAA, a clinician's or pharmacy's Notice of Privacy Practices, or an authorization required for a particular disclosure.

Only services actually enabled for an account are within its authorized scope. This Policy does not establish that a prescription-routing integration, controlled-substance function or clinical service is available.

2. Information We Process

The information involved depends on your relationship with OMNIBIO, what you submit and the features you use. We will limit collection to information reasonably needed for the stated purpose or another lawful, specifically disclosed purpose.

Professional and account information: name, business contact details, organization, role, professional credentials or identifiers, account permissions and information submitted for eligibility verification.

Order and transaction information: products and quantities requested, clinic or authorized recipient details, shipping and billing information, order status, payment confirmations and related communications. Payment information handled by a payment service is distinct from the transaction references or status made available to OMNIBIO.

Communications: information you provide when requesting access, contacting support, raising an issue, supplying documents or communicating with OMNIBIO.

Technical and account activity: technical records associated with using a service, such as IP address, browser or device details, access times, session events, transaction logs and document-acceptance records, to the extent generated or collected by the relevant feature.

Patient and prescription information: only where an authorized service requires it, information supplied by an authorized provider or other permitted source for the specified routing or support function. This may include patient identifiers, contact or delivery information and prescription details. A professional account is not permission to upload unrelated medical records.

3. Sources and Purposes

Information may come directly from you, from an organization administering your account, from an authorized prescriber or pharmacy, from payment or fulfillment partners involved in your transaction, or from operation of the feature you use. Credential verification may involve appropriate professional or public sources.

We will use applicable information to evaluate and administer professional access; perform the requested ordering, payment, fulfillment or routing service; provide support and necessary communications; maintain appropriate transaction and acceptance records; protect accounts and investigate fraud or security issues; meet legal obligations; and resolve legitimate disputes.

Optional communications, analytics or other uses require the disclosure, lawful basis and choices applicable to that activity. A general service-improvement purpose does not authorize unrelated use of patient information, profiling for advertising or a disclosure prohibited by a BAA.

4. Disclosures

We will disclose information only within the applicable lawful purpose, role and permissions. Depending on the service, recipients may include the clinic administering the account; the selected pharmacy or facility; a payment processor; a fulfillment or shipping provider; and service providers performing hosting, authentication, communications, support, security or another specifically authorized function, named in Section 14.

Information provided to a service provider must be limited to its authorized task and subject to the protections required for the information and relationship, including downstream BAA requirements where applicable. A supplier does not receive unrelated patient information merely because it supplies a catalog product.

A clinic, pharmacy or other independent professional may process information under its own legal responsibilities and privacy notices. Sharing information for a transaction does not transfer every party's responsibilities to OMNIBIO or remove OMNIBIO's own duties.

Information may also be disclosed as required by applicable law or lawful process; to address a legitimate security incident or legal claim within applicable restrictions; or in a lawful merger, financing, reorganization or asset transaction with required protections and notices. These circumstances do not authorize a sale or disclosure of health information otherwise prohibited by law.

5. Sale, Advertising, Marketing and AI

We will not sell personal information or disclose it for cross-context behavioral advertising under this Policy. We will not use patient or prescription information for advertising audiences or unrelated marketing. A change to those commitments requires a lawful basis, revised disclosures and any legally required consent; it cannot override an executed BAA.

Any optional marketing communications must follow applicable permission and opt-out requirements. You may request that optional marketing stop without losing necessary order, account, security or legal communications.

Approved AI use is limited to non-patient business tasks. Patient or prescription information must not be submitted to AI services or used for model training under this Policy. Any future patient-data AI use requires separate approval, an appropriate lawful basis, role-specific contracts and safeguards, and updated disclosures or consent where required; this Policy alone does not authorize it.

Approved non-patient AI use must protect confidential business information and remain within applicable service instructions, data protections and lawful purpose. This Policy does not grant a third-party AI provider independent rights to patient, clinic or account information or imply that an AI tool has been deployed or clinically validated.

6. Cookies and Similar Technologies

Where a feature uses cookies, session storage or similar technology for sign-in, security, user preferences or transaction continuity, that use must remain within the relevant function. Optional analytics or other nonessential tracking may be enabled only with the notices, controls and consent required for the activity.

Patient and prescription information must not be transmitted to advertising trackers. Tracking must not be configured to circumvent PHI restrictions or other health-data protections.

You can use available browser controls to manage cookies, although blocking essential functions may affect account access or transactions. We will honor legally required privacy preference signals and opt-outs. A browser's Do Not Track setting is not a substitute for exercising a specific right or managing available cookie choices. We do not promise that every browser signal has the same legal or technical effect.

7. Health Information

For PHI processed on behalf of a covered entity, we will act within the applicable BAA, lawful instructions and law. Technology/intermediary status does not establish a blanket conduit exception. Required agreements and safeguards must be in place before the affected PHI service begins.

Health-related personal information may be protected by state or other laws even when it is not PHI under HIPAA. The applicable information and context, rather than a product label or website disclaimer, determine those protections.

Where applicable, we will collect and disclose consumer health data only with the required consent or as otherwise permitted for a service you request. Relevant information may include prescription or order details linked to an individual, health information supplied for an authorized service, and information revealing a person's request for health-related services. We will not use a general account acknowledgment as blanket consent to unrelated health-data collection or disclosure.

For clinical-record access or correction, contact the responsible clinician or pharmacy. We will assist within our actual role and obligations. Do not submit patient information through a general inquiry form, unapproved email channel or other feature not authorized for that information.

8. Retention and Security

We will retain personal information only as long as reasonably necessary for the applicable service, account relationship, security, legal recordkeeping, dispute or preservation requirement. Retention decisions will take account of the information's sensitivity, purpose, applicable agreements and legal obligations. Backup and preservation copies remain subject to appropriate restrictions. Section 15 lists the retention periods by category.

Closing an account or requesting deletion does not authorize destruction of records that must be preserved, including required transaction, clinical, prescription or audit records. Information no longer needed must be deleted, de-identified where lawfully appropriate, or retained only under a valid remaining requirement.

We will maintain administrative, technical and physical safeguards appropriate to our actual role, services and legal obligations. No storage or transmission method guarantees absolute security. This Policy is not a certification of a particular system or vendor. Applicable incident response and breach notices remain governed by law and, where relevant, the executed BAA.

9. Your Rights and Choices

Depending on your location, the information and our role, applicable law may give you rights to know about processing, access or obtain a copy of information, correct inaccuracies, request deletion, withdraw consent, limit certain sensitive-information uses, or opt out of specified processing or disclosures. Applicable exceptions and verification requirements may apply.

You may make a request, exercise an applicable appeal or ask about an authorized agent by contacting us using Section 12. We will respond within the applicable legal period and provide any required explanation of a denial and appeal mechanism. We will not unlawfully discriminate against you for exercising a privacy right.

We may need information reasonably necessary to verify and fulfill a request. Do not send full card details, medical records or identity documents through an unapproved channel. Withdrawing consent does not invalidate earlier lawful processing and may affect a feature that requires the information.

Where a clinic or pharmacy controls the relevant information, we may direct the request to that organization and assist it as required. You may contact the appropriate regulator or state attorney general where applicable law provides that option.

10. Audience and Processing Locations

Professional accounts are intended for adult authorized users acting for a clinic, professional practice, laboratory or other eligible organization. They are not intended for children to enroll independently. Patient accounts are opened only by invitation from the patient's clinic (Section 13). Where an authorized service involves a minor patient's information, the responsible parties must follow the permissions, roles and protections applicable to that service.

OMNIBIO is a U.S. company. Data location is determined by the actual providers, systems and authorized access involved, not by the origin of catalog products. If processing involves another country, we will apply the disclosures, transfer arrangements and protections required for that processing. This Policy does not assert that all data remains in the United States.

11. Changes and Other Documents

We will identify changes by an updated version and effective date and give notice or obtain consent as required for the actual change. A revised notice does not retroactively authorize an incompatible purpose, expand a signed BAA or amend a provider agreement's commercial rights.

The Privacy Policy is a notice of information practices, not a waiver of privacy rights or an agreement to optional data uses. Any acknowledgment records the version provided; it does not replace a separately required consent.

12. Contact

For privacy questions, requests or appeals, write to: OMNIBIO LLC, Attention: Privacy, 1309 Coffeen Avenue, Suite 1200, Sheridan, WY 82801.

Electronic privacy contact: support@omnibio.com.

Identify your relationship with OMNIBIO and the nature of the request without including unnecessary sensitive information. A clinical emergency should be directed to appropriate emergency services, not to this privacy contact.

13. Patients

A patient account is opened only by invitation from the patient's clinic. For a patient, OMNIBIO processes the name, email address, phone number and delivery address the clinic or the patient provides; the items the clinic approves for the patient and the carts it prepares; the patient's storefront requests and orders, with their prices and status; text-message consent; sign-in and two-step verification records; and a record of who viewed or changed the patient's information. OMNIBIO processes this information on the clinic's behalf as its business associate, under the BAA, and the HIPAA Notice describes how.

A patient signs in with a single-use link sent by email and may add two-step verification. A clinic's storefront, on the Platform or on the clinic's own domain, is operated by OMNIBIO for the clinic: the same practices apply on either address, and a clinic's own domain does not give the clinic's domain provider access to patient information.

14. Service Providers

OMNIBIO uses these service providers, each limited to its task and bound by written terms, including a business associate agreement where it handles PHI:

• Google Cloud (Google LLC): hosting, databases, file storage and logs.
• Resend: delivery of email.
• Twilio: delivery of text messages.
• Authorize.Net or NMI, the card gateway in use, through OMNIBIO's merchant account with Luqra: card payments. Card details are entered in the gateway's own form and never reach OMNIBIO.
• Entri: connecting a clinic's own domain to the Platform.

OMNIBIO also reads the public NPI Registry (NPPES) of the Centers for Medicare & Medicaid Services to verify clinicians' NPI numbers and to find practices for its sales team, and may forward a request submitted on its landing page to its own sales systems.

15. Retention Periods

Records are kept for these periods, then deleted:

• Sign-in sessions and sign-in links: until they expire. Rate-limit records: until their window ends. Storefront sign-in hand-offs: one day after they expire unused, or eight days after use.
• Event records from the payment, email, domain and text-message providers: 90 days; a text reply that confirms consent is kept as long as the consent.
• Invitations: 90 days after they are accepted, revoked or expire. Unsent draft carts prepared by a clinic, and idle carts: 90 days.
• In-app notifications: one year. Back-in-stock alerts: one year after they close.
• Email and text-message delivery logs, which never hold the message content: two years. Lifted email and text-message suppressions: two years after they are lifted.
• Leads not onboarded, lead and catalog imports, unlinked provider records, sales candidates, archived territories and removed clinic domains: two years.
• Revoked text-message consents: five years after revocation.
• Closed user, membership and patient records: six years after closing; a patient's record not before the patient's orders reach their own period.
• Orders with their items, payments, refunds, disputes and discount redemptions, and price changes: seven years after closing. Closed clinics and sales accounts: seven years, after their orders.
• The audit log, the payment ledger, issued commission statements, product revisions, legal acceptance records and the do-not-call list are kept for at least six or seven years and are not deleted without a separate review.

16. Text Messages

OMNIBIO sends text messages only to patients, for an invitation from their clinic or a cart their clinic prepared, and only to a United States number whose owner has confirmed consent by replying YES to OMNIBIO's request. That request is sent when the patient confirms the number in their profile, or when the clinic records that the patient asked for texts, and at most once per number every seven days. Message frequency varies; message and data rates may apply.

No text is sent between 9 pm and 8 am in the recipient's local time. Reply STOP to any message to stop all texts from OMNIBIO to that number, for every clinic; reply START to allow texts again, after which consent must be given again before OMNIBIO texts; reply HELP for help. A text carries only a short notice and a link: never health details. Phone numbers and text-message consent are not sold or shared for marketing.