Privacy Policy

Effective: October 6, 2026

INTRODUCTION

Primary Diagnostics, Inc. d/b/a Primary.Health (referred to as “Primary.Health,” “Primary,” “we,” “us,” or “our”) owns and operates the website located at https://primary.health and its subdomains (the “Website”); its accompanying mobile application (the “Mobile Application”); the secure portals (our patient portal at my.primary.health) through which users access test results, vaccination records, and other services and records (the “Secure Portals”); our testing services and the programs we offer through employers, schools, public health agencies, and other organizations; and our tools for health care providers and public health agencies, including Health by Primary.Health (my.primary.health) and Vax by Primary.Health (the “Provider Tools”) (collectively, the “Services”). The Services enable users (“you” or “User”) to receive access to several types of healthcare information and services.

APPLICABILITY OF THIS PRIVACY POLICY

This privacy policy (“Privacy Policy”) describes the information Primary collects from Users of the Services and how we use and disclose it. Users include consumers and patients, administrators of organizations that offer our programs, health care professionals who use our Provider Tools, and visitors to our Website. Our California Privacy Notice includes definitions and content consistent with California law.

Our roles and how HIPAA applies

Our role, and therefore the rules that apply to your information, depends on the Service:

• When we provide Services on behalf of an organization. If we are providing the Services to you on behalf of an organization (such as your employer, health care provider, school, or a public health agency), whether or not that organization pays for you to use the Services, we will abide by the terms of our agreement with that organization related to the use of the information we collect. When the organization is a health care provider or other HIPAA covered entity, we act as its “business associate,” and HIPAA, our agreement with the organization, and the organization’s own notice of privacy practices govern that information. When the organization is a public health agency, we act as its contractor under the agency’s legal authority, and our agreement with the agency and applicable public health law (together with HIPAA, if the agency is a covered entity) govern the information we process for it. If you have any questions about the organization’s privacy practices, please contact the organization or contact us using the contact information below.
• When Primary provides health care services to you directly. For some Services, such as testing that you purchase directly from us and telehealth visits with clinicians of Primary Diagnostics Medical Group P.A. d/b/a Primary.Health Medical (the “Medical Group”), Primary and the Medical Group provide the health care service rather than acting on behalf of another organization. When they do, our joint Notice of Privacy Practices (https://www.primary.health/privacy-practices-notice-of/) describes how we use and disclose your health information, and that information is protected by HIPAA and, for California residents, the Confidentiality of Medical Information Act, to the extent those laws apply. This Privacy Policy describes our other privacy practices.
• All other information. This Privacy Policy governs all other information we collect, including information about visitors to our Website, administrators of organizations that offer our programs, and health care professionals who use our Provider Tools.

We do not use or disclose PHI for marketing, advertising, or any other purpose that HIPAA prohibits without your authorization.

RELATIONSHIP TO OUR TERMS

Your access to and use of the Services is subject to our Terms of Service (https://www.primary.health/terms-of-service/) or, for the Provider Tools, our Provider Tools Terms of Service (https://www.primary.health/terms-of-service-provider-tools/).

PRIVACY POLICY UPDATES

We may need to update our Privacy Policy as we and our customers grow and evolve. If we make material changes, we will notify you at least thirty (30) days before they take effect by email (sent to the email address specified in your account), by posting a notice on the Services, or, for users of the Provider Tools, through the Provider Tools, as well as inform you of any choices you may have with respect to these changes.

Other changes take effect when we post them unless we state otherwise. We will not apply a material change to personal information we collected before the change takes effect in a way that is inconsistent with the Privacy Policy in effect when we collected it, unless we first obtain your consent or the change is required by law.

COLLECTION, USE AND DISCLOSURE OF INFORMATION

What we collect

Information you give us

We collect and store information you provide through our Services.

When you register to use the Services, we may collect the following information from you:

• Name
• Postal address
• Email address
• Phone number

In certain situations, we may also collect things like:

• Driver’s license number
• Social Security Number
• Location information
• Demographic and lifestyle information, for example to determine eligibility for health programs
• Medical and health insurance information
• Survey responses
• Payment information, which our third-party payment processors collect and process
• Information about a dependent, such as a minor child, whom you register for the Services

Information about organization administrators

If you administer one of our programs on behalf of an employer, school, public health agency, or other organization, we collect your name, work contact information, organization, role, account credentials, and records of your activity in our administrator tools.

Information about health care professionals who use our Provider Tools

If you use a Provider Tool, such as Vax by Primary.Health, we collect information from you, your organization, and the platform through which you access the Provider Tool (such as Vim). This includes your name, email address, user and organization identifiers, role, National Provider Identifier (“NPI”), licensure, credentials, specialty, and prescriptive authority; your practice’s name, address, and taxpayer identification number; your settings and preferences; and records of your activity, including audit logs of the records you access. If you enroll in e-prescribing, we collect the information needed to verify your identity, and we receive your enrollment status from Surescripts.

Information collected automatically online

We collect information about your interactions with us including, for example:

• The type of device or browser you’re using
• Your IP address
• Your Operating System version
• Phone carrier and manufacturer
• Application installations
• Push notification tokens
• Your browsing behavior while on our Services.
• The URLs of the website you visited before visiting our Services (these are called “referring URLs”)
• Dates and times of user visits.

We use cookies and similar technologies to operate and secure the Services, remember your preferences, and, on our public Website and marketing pages, analyze how visitors use those pages. You can control cookies through your browser settings, although some features may not work without them. We do not respond to browser “Do Not Track” signals.

Information from other sources

We may receive information about you from organizations that offer our programs, health care providers, laboratories and other partners, platforms through which you access the Services (such as Vim), Surescripts, identity verification providers, and public sources such as the National Plan and Provider Enumeration System and state licensing databases.

How we use the information we collect

• To provide, maintain, improve, and enhance our Services;
• To personalize your experience on our Services such as by providing tailored content and recommendations;
• To understand and analyze how you use our Services and develop new products, services, features, and functionality;
• To communicate with you, provide you with updates and other information relating to our Services, provide information that you request, respond to comments and questions, and otherwise provide customer support;
• For marketing purposes, such as developing and providing promotional materials that may be relevant, valuable or otherwise of interest to you;
• To create de-identified and aggregated information, including information de-identified in accordance with HIPAA where it applies, that we may use to publish reports, support research and public health, and improve our services;
• To send you text messages and push notifications;
• To fulfill orders and requests for products, services, or other information;
• To process refunds, returns, and exchanges;
• To track and confirm online orders;
• To verify the identity, credentials, and authority of health care professionals and organization administrators, including for e-prescribing enrollment;
• To identify health care professionals as the ordering, prescribing, or administering provider in prescriptions, immunization registry reports, and appointment requests made through the Provider Tools;
• To find and prevent fraud, maintain audit logs, secure the Services, and respond to trust and safety issues that may arise;
• For compliance purposes, including enforcing our Terms of Service or other legal rights, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency; and
• For other purposes for which we provide specific notice at the time the information is collected.

Information we process for health care providers and other organizations

When we provide Services on behalf of a health care provider or other organization, including through the Provider Tools, we process information about the organization’s patients or participants (“Patient Information”) on its behalf and use and disclose it only as our agreement with the organization and, where it applies, HIPAA permit: for example, to maintain the organization’s records, transmit orders and prescriptions, report to public health authorities, give patients access to their records, and send appointment communications on the organization’s behalf. Where a provider does not have its own immunization registry access, our affiliated medical group’s registry access may be used to retrieve records on the provider’s behalf.

We do not sell Patient Information. As our agreements and applicable law permit, we may de-identify Patient Information in accordance with HIPAA and use and disclose de-identified information to operate and improve our services, support research and public health, and publish aggregated insights; we do not re-identify it, and our contracts prohibit recipients from doing so. If a provider’s access to our Provider Tools is sponsored by another organization, we share Patient Information with the sponsor only as the provider authorizes and the law permits; sponsors otherwise receive information about use of the Provider Tools only in aggregate, never at the patient level. We do not share Patient Information with life sciences sponsors.

Immunization information systems are operated by public health jurisdictions under their own laws. Patients who wish to access, correct, or restrict their information should contact their health care provider or health department; we refer any request we receive to the appropriate organization.

How we share your information

We may combine or share information among current or future Primary.Health companies, including affiliates and subsidiaries.

We may share any information we receive with vendors and service providers retained in connection with the provision of our Services, which are bound by contract to protect it.

We share information with laboratories and other partners that help us provide testing and other health services, and we report information to public health authorities as required by law, such as reportable test results and immunizations.

If you participate in a program offered through your employer, school, or another organization, we share your test results and other information with that organization with your consent, as described when you enroll in the program.

If you use our Provider Tools, we share information with your organization (including administrators, who can see your activity and settings); with the platform through which you access the Provider Tools, such as Vim; with pharmacies, immunization registries, clinics, and other recipients as needed to provide the Provider Tools, such as by including your name, credentials, and NPI in prescriptions, registry reports, and registry query logs; and, at your direction when you enroll in e-prescribing, with Surescripts to enroll you, list you in its prescriber directory, and route your prescriptions, which Surescripts may use as its agreements permit. If your access is sponsored by another organization, we share with that sponsor your enrollment status and the usage information the program is set up to report, in aggregate form that does not identify any patient; we share prescribing information only as our agreement with Surescripts permits and never share prescribing or administration data about identifiable providers with life sciences sponsors.

We also may share personal information other than health information in connection with co-branded product or service offerings (including sharing such information with business partners to validate offers). We never share PHI or information about users of the Provider Tools for these purposes.

On our public Website and marketing pages, we use analytics services such as Google Analytics to understand how visitors use those pages. We do not use Google Analytics or any other third-party analytics or advertising technology on logged-in pages of the Services, on pages where you enter health information before logging in, such as test registration, scheduling, or intake forms, or on any page that displays PHI. We have configured Google Analytics so that Google processes this data only on our behalf, with Google’s advertising features turned off. Learn more about Google’s privacy practices.

Sometimes we may be required to share personal information for legal reasons, for example, if we are required to do so by a regulation, court order, subpoena or other legal process. We may also share information when we believe it is necessary to comply with the law or to respond to a government request, or when we believe disclosure is necessary or appropriate to protect Primary.Health, our customers, or others. We disclose PHI for these purposes only as HIPAA permits.

We may share personal information in the event of a corporate sale, merger, acquisition, joint venture, reorganization, divestiture, dissolution, liquidation, or similar event.

We may also disclose your information with your permission.

We may also disclose aggregated or de-identified information that cannot reasonably be used to identify you.

How we protect your information

We use a variety of administrative, technical, and physical security measures designed, under a risk-based approach, to protect the confidentiality of your information, including safeguards consistent with HIPAA where it applies. However, as set forth in our Terms of Service, we cannot and do not guarantee the security of information transmitted to us.

You also can do your part to help protect the information you provide to us, create a strong password, use that password only on our Services, and not share your password with anyone – especially anyone claiming to work with us. We would never contact you and ask for your password – ever.

How long we keep your information

We retain your information for a time period specifically required or allowed by applicable regulations or laws and as needed to fulfill legitimate business purposes, including providing you products and services, complying with our legal obligations, resolving disputes, and enforcing our agreements. Our retention of information is based on many factors such as your relationship with Primary.Health or our customers, the nature of the information, compliance with our legal obligations, and defending or resolving actual or anticipated legal claims. For example, we retain audit logs and records of acceptance of our agreements for at least six years, and records of e-prescribing transactions for at least five years. We retain PHI as described in our agreements with the organizations we serve and as the law requires.

Your choices

You may at any time:

• Unsubscribe from our marketing or promotional emails, direct mail, phone, and mobile marketing communications. However, even if you opt out of receiving promotional messages from us, you will continue to receive administrative messages from us
• Update and correct your personal information
• Deactivate your account
• Control cookies on our public Website through your browser settings
• If you use a Provider Tool, ask your organization to disable it or contact us (we will retain information that we are required to keep)

To do any of these, let us know by one of these methods:

• To unsubscribe from marketing or promotional emails, follow the directions in a marketing email, direct mail, or mobile communication that you receive from us
• For other requests, provide your request and current contact information through our Privacy Center or one of the contact methods listed under “Contact Us” below

Protecting children’s privacy

Our Services are not directed to children under 13, and we do not knowingly collect personal information from a child under 13 without parental consent; if you believe a child has provided it, contact us as described below. A parent or guardian may register a minor and manage the minor’s information, and minors may participate in programs offered through schools and other organizations with the consent the program and applicable law require. Where state law allows a minor who is at least 13 to consent to certain health services on the minor’s own, we handle the minor’s information as that law requires.

Links to other Websites

Our Services may link to or interoperate with third-party websites and services (for example, the Provider Tools interoperate with Vim, electronic health record systems, immunization registries, e-prescribing networks, and scheduling systems). This Privacy Policy does not apply to those third parties, and we are not responsible for their privacy practices; please review their policies.

Text Message Alerts

1. By supplying your phone number when you register or schedule a service, you consent to receive transactional text messages regarding your appointments, test results, and related logistics. If a health care provider uses our Provider Tools to schedule an appointment for you, you may also receive messages about that appointment that we send on the provider’s behalf.

2. You can cancel the SMS service at any time. Just text “STOP” to the short code, or tell us in any other reasonable way that you no longer want to receive messages. After you send the SMS message “STOP” to us, we will send you an SMS message to confirm that you have been unsubscribed. After this, you will no longer receive SMS messages from us. If you want to join again, just sign up as you did the first time and we will start sending SMS messages to you again.

3. If you are experiencing issues with the messaging program you can reply with the keyword HELP for more assistance, or you can get help directly at support@primary.health or 1-855-970-3223.

4. Carriers are not liable for delayed or undelivered messages

5. As always, message and data rates may apply for any messages sent to you from us and to us from you. You will receive 5-6 messages per appointment. If you have any questions about your text plan or data plan, it is best to contact your wireless provider.

6. Consent to receive marketing text messages is not a condition of any purchase, and we will honor opt-out requests as the law requires.

Where We Process Data

Our Services are intended for Users located within the United States. We store and process personal information in the United States, and we require the service providers that handle it for us to do the same. If you choose to use the Services from outside the United States, your information will be transferred to and processed in the United States.

Your privacy rights

Depending on where you live, you may have rights under applicable law regarding your personal information, which may include the right to know or access the personal information we have collected about you, to correct inaccurate information, to delete your information, to obtain a portable copy, and to opt out of the sale or sharing of personal information or its use for targeted advertising or certain profiling. To submit a request, visit our Privacy Center at https://privacy.primary.health, email privacy@primary.health, or call 1-855-970-3223. We will verify your request, may accept requests from authorized agents where the law permits, and will not discriminate against you for exercising your rights. If we deny your request, you may appeal by replying to our response or by emailing privacy@primary.health with the subject line “Privacy Request Appeal.” These rights do not apply to PHI or other Patient Information that we process on behalf of a health care provider or other organization; please direct requests about that information to the provider or organization. Our Consumer Health Data Privacy Notice (https://www.primary.health/privacy-notice-consumer-health-data/) describes our practices for consumer health data under the laws of Washington, Nevada, Connecticut, and similar states.

California residents

If you are a California resident, please review our California Privacy Notice below.

Contact Us

If you have questions regarding this policy, please email us at privacy@primary.health, visit our Privacy Center at https://privacy.primary.health, or contact us using the information below.

Primary Diagnostics, Inc. d/b/a Primary.Health

Attn: Privacy Officer

595 Pacific Ave, Floor 4

San Francisco, CA 94133

1-855-970-3223

Primary Diagnostics © 2026. All rights reserved.

California Privacy Notice

If you are a California resident, the information below applies to you in addition to our Privacy Policy.

This privacy notice for California residents (“California Privacy Notice”) supplements the information contained in the Privacy Policy and applies to: California residents from whom we collect Personal Information as a business under the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (California Civil Code §§ 1798.100 to 1798.199) and its implementing regulations, as amended or superseded from time to time (“CCPA”).

Please be aware that this California Privacy Notice only applies to information covered by the CCPA. It does not apply to information that is covered by other state and federal privacy laws, for example, PHI governed by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) or medical information governed by California’s Confidentiality of Medical Information Act, or to personal information that we process as a service provider or business associate on behalf of the organizations we serve, as described in “Our roles and how HIPAA applies” above.

This Notice uses certain terms that have the meanings given to them by the CCPA.

For purposes of this section, “Personal Information” means information that identifies, or could reasonably be associated with, you, your device or household, or as otherwise defined by the CCPA. Personal Information does not include information that is:

• Publicly available, as defined by the CCPA.
• Deidentified or aggregated.
• Otherwise excluded from the scope of the CCPA.

a. Categories of Personal Information We Collect and Disclose to Third Parties

We collect and disclose for a business purpose each of the categories of personal information described in the chart below.

Over the previous twelve months, we have collected each of the categories of personal information described above.

Primary.Health discloses Personal Information to government entities, including public health authorities and law enforcement, only in the following circumstances: (1) when required to do so as a matter of law, including for public health reporting; (2) to assist in the investigation of a potential crime impacting Primary.Health, its employees, its customers, or the communities we serve; or (3) when required in response to legal process (e.g., subpoena, warrant).

b. We have collected, used, or disclosed personal information about you for the following business or commercial purposes

• Performing services you have purchased from or contracted for with us, including maintaining or servicing accounts (e.g., your Primary.Health account), as well as providing customer service, processing or fulfilling orders and transactions, and verifying customer information,
• Providing advertising and marketing services (other than cross-context behavioral advertising), analytics services, or similar services
• Auditing related to a current interaction with you and concurrent transactions, and auditing compliance
• Detecting and responding to security incidents, protecting against and responding to malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity
• Debugging to identify and repair errors that impair existing intended functionality
• Undertaking internal research for technological development and demonstration
• Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us
• Customizing your experience on our Website or Mobile Applications
• Verifying the identity, credentials, and authority of health care professionals and organization administrators
• Complying with and enforcing applicable legal requirements, relevant industry standards and our policies

In the past twelve months, we have collected, used, and disclosed personal information about you for the above purposes. We do not sell or share personal information, including sensitive personal information. We have never sold sensitive personal information, and we have not sold or shared any personal information in the preceding twelve months. We do not have actual knowledge of selling or sharing the personal information of consumers under the age of 16. Information that health care professionals direct us to provide to Surescripts when they enroll in e-prescribing is disclosed at their direction.

c. We have collected personal information about you from the following sources

• You
• Our affiliates
• Device(s) You Used
• Service Providers
• Organizations that offer our programs or use our Provider Tools
• Health care providers and laboratories
• Platforms through which you access our Services, such as Vim
• Surescripts and identity verification providers
• Public sources, such as the National Plan and Provider Enumeration System and state licensing databases

d. California Consumer Privacy Rights

You have certain choices regarding our use and disclosure of your personal information, as described below.

• Access: You have the right to request, twice in a 12-month period, that we disclose to you the personal information related to you we have collected during the past 12 months. This may include:
  • The categories and specific pieces of personal information we have collected about you
  • The categories of sources from which we collected the personal information
  • The business or commercial purpose for which we collected or sold the personal information
  • The categories of third parties with whom we shared the personal information
  • The categories of personal information about you that we sold or disclosed for a business purpose, and the categories of third parties to whom we sold or disclosed that information for a business purpose
• Deletion: You have the right to request that we delete certain personal information we have collected from you, unless an exception applies. Such exceptions include, but are not limited to, when the personal information is necessary to complete a transaction or provide goods or services to you, detect security incidents, comply with the law, and for internal uses reasonably aligned with your expectations.
• Correction: You have the right to correct inaccurate Personal Information that we maintain about you.
• Opt-Out of Sale or Sharing: You have the right to opt-out of the sale or sharing of your personal information.
• Limit Use of Sensitive Personal Information: You have the right to limit certain uses of sensitive personal information. We use sensitive personal information only for purposes permitted by the CCPA, so this right does not currently apply.
• Right to Non-Discrimination: If you choose to exercise any of your rights under the CCPA, as amended by the California Privacy Rights Act (“CPRA”), you have the right not to receive, and will not receive, discriminatory treatment by us. We will not charge a fee to process your request unless it is manifestly unfounded or excessive, as the CCPA permits. Employees and contractors are provided notice via different statements.

e. How to Submit a Request

Submit requests to access, correct, or delete personal information, or to opt out of any sale or sharing, through our Privacy Center at https://privacy.primary.health, by sending an email to privacy@primary.health, or by calling 1-855-970-3223. We treat Global Privacy Control signals as a request to opt out of any sale or sharing. If we deny your request, you may appeal by replying to our response or by emailing privacy@primary.health with the subject line “Privacy Request Appeal.”

f. Verifying Requests

To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to your personal information or complying with your request. If you have an account with us, we may verify your identity by requiring you to sign into your account. If you request access to, correction or deletion of your personal information and do not sign into an account with us, we require you to provide the following information: name, email address, phone number, and postal address. In addition, if you do not have an account and you ask us to provide you with specific pieces of personal information, we reserve the option to require you to sign a declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request. If you designate an authorized agent to make an access, deletion or opt-out of sale request on your behalf (1) we may require you to provide the authorized agent written permission to do so, and for access, correction and deletion requests, we may require you to verify your own identity directly with us (as described above).

g. How Your Information Is Retained

We retain each category of personal information as described in “How long we keep your information” above.

h. Additional Information

This Notice is available in alternative formats upon request. Please submit a request to privacy@primary.health to request this Notice in an alternative format. California residents may also request information about disclosures of personal information to third parties for their direct marketing purposes under California Civil Code § 1798.83; we do not make such disclosures.

Last Updated: October 6, 2026