HeliosRx

HeliosRx LLC ("HeliosRx," "we," "us," or "our") is a state-licensed 503A compounding pharmacy located in Tempe, Arizona. We prepare and dispense compounded medications for human and animal patients only pursuant to a valid prescription issued by a licensed prescriber following a legitimate practitioner-patient relationship. We do not sell prescription medications without a prescription.

We are committed to protecting the privacy and security of your information. This Privacy Policy explains how we collect, use, share, and safeguard information when you visit our website, submit forms, communicate with us by phone, email, or text message, and use our pharmacy services.

Relationship to Our HIPAA Notice of Privacy Practices

This Privacy Policy is not a HIPAA Notice of Privacy Practices. Protected health information about you is governed by our separate Notice of Privacy Practices, which is available at [INSERT NOTICE OF PRIVACY PRACTICES URL], on request, and in our pharmacy. Where this Privacy Policy and that Notice address the same information, the Notice of Privacy Practices controls with respect to protected health information.

This Privacy Policy does not apply to third-party websites that may be linked from or otherwise accessible through our website.

Information We Collect

Information you provide to us

• First and last name, date of birth, and contact information, including email address, telephone number, and mailing or delivery address.

• Prescription and medication information, prescriber information, and health information you choose to provide in connection with your care.

• Insurance carrier and coverage information.

• Payment card or bank account details used to pay for your order.

• Account login credentials, if you create an account or use a patient portal.

• Support communications, form submissions, and other correspondence with us.

• For veterinary prescriptions, the animal patient’s information and the contact and billing information of the animal’s owner and prescribing veterinarian.

Information collected automatically

When you use our website, we and our service providers may collect information through cookies, pixels, web beacons, scripts, and similar technologies, including your IP address, device and browser type, operating system, the date and time of your visit, pages and content viewed, referring and exit pages, files downloaded, errors encountered, and whether you open or click links within emails we send.

Information from third parties

We may receive information from prescribers and their staff, other pharmacies, insurers and pharmacy benefit managers, payment processors, and analytics or advertising providers that assist us in operating our website and services.

How We Use Your Information

• To receive, verify, prepare, dispense, ship, and deliver prescriptions, and to contact you about your order or prescription.

• To establish and manage your account and provide customer and technical support.

• To process payments and, where applicable, to bill insurers or other payers.

• To send service and treatment-related communications, including refill reminders and order status notifications.

• To send marketing or promotional communications where you have consented or where we are otherwise permitted to do so.

• To operate, maintain, analyze, secure, and improve our website and services.

• To detect and prevent fraud, abuse, and other unlawful activity.

• To comply with our legal, licensing, accreditation, and regulatory obligations, including those of the Arizona State Board of Pharmacy, other state boards of pharmacy in which we are licensed, the U.S. Food and Drug Administration, and the U.S. Drug Enforcement Administration.

• To establish, exercise, or defend legal claims and to address disputes.

How We Share Information

We do not sell or rent your personal information. We share information only as reasonably necessary to operate our pharmacy, provide services to you, comply with law, or as you direct or authorize.

Prescribers and other health care providers

We share information with your prescriber and with other pharmacies, providers, or facilities involved in your care, including where a prescription is transferred to or from our pharmacy or filled through a backup or outsourcing arrangement.

Affiliated companies

We may share information with our parent companies, subsidiaries, and other entities under common control with us, subject to this Policy and applicable law.

Service providers and business associates

We engage vendors to perform services on our behalf. Vendors that create, receive, maintain, or transmit protected health information on our behalf are business associates and are bound by written business associate agreements requiring them to safeguard that information and to use it only as permitted.

Third Party Sharing

We work with third parties that help us provide and support our services and our internal operations. We presently work with the following categories of third parties:

• Technology application licensors and providers, including our pharmacy management and patient engagement platforms;

• Information hosting, storage, and cloud service providers;

• Payment processing companies;

• Shipping, courier, and delivery providers;

• Security service providers;

• Technical and customer support providers;

• Survey and analytics providers; and

• Marketing and promotions providers.

We respect your privacy. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Professional advisors, regulators, and law enforcement

We may share information with our legal, accounting, compliance, insurance, and similar advisors, and with regulators, licensing boards, or law enforcement, in order to comply with legal and regulatory obligations, respond to a subpoena, court order, or lawful request, protect our rights, property, or the safety of any person, or exercise or defend legal claims.

Corporate transactions

In connection with a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, information may be transferred as a business asset, subject to applicable law and, with respect to protected health information, to HIPAA.

Text Messaging (SMS) Program

Consent

By providing your mobile telephone number to HeliosRx and agreeing to receive text messages, you consent to receive recurring automated text messages from HeliosRx relating to your prescriptions and account, and, where you have separately agreed, promotional messages. Consent to receive text messages is not a condition of receiving pharmacy services or of any purchase. Message frequency varies. Message and data rates may apply. You may opt out at any time by replying STOP. For help, reply HELP or contact us at (480) 219-5974 or [email protected].

Types of messages

• Service and treatment messages: order status, prescription-ready and pickup notices, refill reminders, delivery updates, and account or billing notifications.

• Promotional messages: information about products, services, and offers. These are sent only to individuals who have separately opted in to promotional messaging.

How we obtain consent

• Website opt-in: an affirmative checkbox with clear disclosure placed adjacent to the mobile telephone number field on our web forms, with links to this Privacy Policy and our Terms of Use.

• Written opt-in: a signed patient intake or communication preference form.

• Verbal opt-in: consent obtained by telephone or in person, with the disclosure read aloud and the individual’s express agreement documented in our records and confirmed in the first message sent.

Program practices

• All messages clearly identify HeliosRx as the sender.

• Messages are sent only to individuals who have affirmatively opted in.

• Messages are sent between 8:00 AM and 9:00 PM in the recipient’s local time zone, except for urgent messages concerning your medication or your health.

• Standard opt-in, opt-out (STOP), and HELP protocols are honored; a single confirmation message is sent following an opt-out request.

• Text messages are not a secure or encrypted channel. We limit the health information included in text messages, and you should not send sensitive health information to us by text.

• Message delivery is not guaranteed and is subject to carrier and network conditions. Carriers are not liable for delayed or undelivered messages.

Relationship to HIPAA authorization

Your consent to receive text messages is a communications preference. It is not an authorization under HIPAA. We will not use or disclose your protected health information for marketing purposes that require authorization, or sell your protected health information, without your separate written HIPAA authorization as described in our Notice of Privacy Practices.

Mobile information and third parties

We respect your privacy. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Cookies, Analytics, and Advertising

Most browsers accept cookies automatically, but you can modify your browser settings to be notified of cookie placement or to decline cookies. If you decline cookies, some features of our website may not function properly. We do not use tracking technologies to disclose protected health information to advertising platforms.

Your Choices

• Update your information. Contact us to review or correct the contact information we hold. We may decline a change that would render our records inaccurate or that is prohibited by law or by our recordkeeping obligations.

• Marketing email. Use the unsubscribe link in any marketing email or contact us. You may continue to receive non-marketing communications about your prescriptions and account.

• Text messages. Reply STOP to any message, or contact us.

• Telephone. Contact us to be removed from promotional calling lists.

Your State Privacy Rights

Depending on your state of residence, you may have rights to request access to, correction of, or deletion of certain personal information, to obtain a copy of that information, and to opt out of certain processing. Medical information governed by HIPAA and pharmacy records we are required by law to retain are generally exempt from these rights. To make a request, contact us using the information below. We will not discriminate against you for exercising these rights.

Children’s Privacy

Our website is intended for adults. We do not knowingly collect personal information online from children under 13. We do dispense prescriptions for pediatric patients when ordered by a licensed prescriber; that information is handled as described in our Notice of Privacy Practices.

Data Security

We maintain administrative, physical, and technical safeguards designed to protect your information against unauthorized access, use, disclosure, alteration, and destruction. Information submitted through our website, including any transaction, customer, patient, or medical information, is transmitted using SSL/TLS encryption, and payment card transactions are processed by PCI DSS compliant payment providers. No system is entirely secure, and we cannot guarantee absolute security.

Adverse Events, Product Concerns, and Complaints

If you experience an adverse reaction or suspect a quality problem with a medication compounded by HeliosRx, stop using the medication, contact your prescriber or seek medical attention if warranted, and notify us at (480) 219-5974 or [email protected]. We document and investigate all reports and report to the U.S. Food and Drug Administration and other authorities as required. You may also report directly to the FDA MedWatch program at www.fda.gov/medwatch or 1-800-FDA-1088.

Veterinary Client Information

Information relating to animal patients is not protected health information under HIPAA. We nonetheless treat information about animal owners and prescribing veterinarians as confidential, use it only to fill and support veterinary prescriptions, and protect it using the safeguards described in this Policy.

Retention

We retain prescription and dispensing records for the period required by Arizona law, the laws of the other states in which we are licensed, and federal law, and we retain other information for as long as needed for the purposes described in this Policy.

Changes to This Policy

We may update this Policy from time to time. If we make changes, we will revise the Last Updated date above and post the revised Policy on our website.

Contact Us

If you have questions about this Policy or our privacy practices, or wish to exercise any right described here, contact:

HeliosRx LLC

1711 W University Dr, Suite 159, Tempe, AZ [INSERT ZIP]

Telephone: (480) 219-5974

Toll-Free: (844) 402-5974

Facsimile: (480) 272-9649

Email: [email protected]

Hours of Operation: 9am-5pm MST-Arizona

Arizona Pharmacy Permit No.: [INSERT LICENSE NUMBER] Pharmacist-in-Charge: [INSERT NAME]

HeliosRx is licensed as a 503A compounding pharmacy. A list of the states in which we hold nonresident pharmacy licenses is available on request.

Privacy Officer: [INSERT NAME], [INSERT EMAIL], [INSERT PHONE]

APPENDIX A — SMS PROGRAM REFERENCE (CARRIER AND CAMPAIGN REGISTRATION)

This Appendix is provided to support 10DLC brand and campaign registration and carrier review. It documents internal program standards and is not a description of patient rights.

Sample messages

• Opt-in confirmation: "You have signed up to receive texts from HeliosRx about your prescriptions, account notifications, and updates. Msg & data rates may apply. Msg frequency varies. Reply HELP for help, STOP to cancel. Privacy Policy: https://helios-rx.com/privacy-policy."

• Service message: "HeliosRx: Your order is ready. Reply HELP for help, STOP to cancel."

• Opt-out confirmation: "You are unsubscribed from HeliosRx texts. No more messages will be sent. Reply START to rejoin."

• Help message: "This is HeliosRx. For HELP call (480) 219-5974. Msg & data rates may apply. Text STOP to stop receiving messages."

Prohibited message content

HeliosRx does not send messages containing content prohibited by the CTIA Messaging Principles and Best Practices or by carrier policy, including:

• SHAFT content: sex, hate, alcohol, firearms, and tobacco or vaping products.

• Cannabis, CBD, hemp, or other controlled substances offered outside a valid prescription.

• High-risk financial services, including payday loans, debt relief, credit repair, cryptocurrency, and securities offers.

• Gambling, sweepstakes, and lottery offers.

• Get-rich-quick schemes, unapproved affiliate marketing, phishing, fraud, and deceptive health claims.

Marketing of prescription medications complies with FDA advertising and promotion requirements, and HeliosRx does not advertise compounded preparations as safer or more effective than commercially available FDA-approved products.