Privacy Policy

1. Introduction

At Biosum, we take your privacy seriously. This Privacy Policy explains how Biosum LLC ("Biosum," "we," "us") collects, uses, shares, and protects your personal information when you visit biosum.com or my.biosum.com, use our mobile applications or social media channels (collectively, the "Site"), or receive our services, including body composition scans, nutrition consultations, metabolic tests, and related offerings (collectively, the "Services").

We collect and use your information for three reasons:

• To provide, analyze, and improve our Services.
• To comply with applicable laws and regulations.
• To protect the security and safety of our company, employees, customers, and others.

We do not sell your personal information, and we do not share your individual-level health information with third parties for their own marketing purposes. Section 5 describes the limited circumstances in which we share information, including with the service providers who help us operate, our supervising physician, and a successor business if Biosum is ever sold or merged.

By using our Site or Services, you agree to the practices described in this Policy.

2. Information We Collect

Information you provide directly

• Contact information: Your name, email address, postal address, and phone number, used to create your account, deliver Services, and communicate with you.
• Health information: Health assessments, fitness test results, medical history, and related details you provide so we can deliver Services appropriate to your goals and ensure they are safe for you.
• Demographic information, including ethnicity: DEXA body composition results are interpreted against published reference populations that differ by age, sex, and ethnicity. We ask for your ethnicity so that your report compares you to the most relevant reference group. This information is used only to generate and display your results and is never used for advertising.
• Form submissions: Any information you type into a form on the Site and submit to us (for example, intake questionnaires, booking requests, and support messages). We do not record keystrokes, mouse movements, or unsubmitted form entries.

Information collected during Services

• Body composition and metabolic data: Our testing equipment (such as DEXA scanners and metabolic analyzers) generates measurements of your body composition and breath metrics. This data is stored in encrypted, access-controlled systems built to HIPAA security standards so you can track changes over time.

Information collected automatically

• Server and log data: Our servers automatically record technical information such as your IP address, browser type, operating system, referring and exit pages, and the date and time of your visit.
• Device and location data: If you access the Site from a mobile device, we may collect device type and approximate geographic location to present relevant information.
• Cookies: We use session cookies (which expire when you close your browser) and persistent cookies (which remain until deleted) to keep you signed in, remember your preferences, and understand how the Site is used.
• Analytics and advertising pixels: See Section 3, "Analytics and Advertising."

Google sign-in

You may sign in to the Site using your Google account. When you do, Google shares with us the basic profile information you have made available, which may include your name, email address, profile picture, and phone number. We use this information only to create and authenticate your account. Your use of Google sign-in is governed by Google's privacy policy, and you can revoke our access at any time from your Google account settings.

3. How We Use Your Information

We use your personal information to:

• Deliver Services: Schedule appointments, perform tests, generate and deliver your results, and provide nutrition consultations and other offerings.
• Operate your account: Authenticate your visits, maintain your history, and process payments.
• Communicate with you: Send appointment confirmations, results notifications, account alerts, service updates, and, with your consent, promotional messages (see Section 4).
• Provide support: Connect your account information with your data so we can resolve support and technical requests.
• Protect and comply: Detect fraud or misuse, maintain the integrity of our systems, and meet legal obligations.
• Improve our Services: Use de-identified and aggregated information to enhance our Services, develop new features, conduct research, and understand how customers use the Site.

Analytics and advertising

We use Google Analytics, the Google Ads tag, and the Meta (Facebook) Pixel on our public website and checkout pages. These tools tell us which pages are visited, how visitors arrive at the Site, and whether a visit results in a booking or purchase, so we can measure our marketing and show relevant ads to people who have visited biosum.com.

These tools do not have access to your health information. They are not installed in the areas of the Site where scan results, intake questionnaires, or other health data are displayed or entered, and we do not send health information, results, or medical history to Google, Meta, or any other advertising platform. What they receive is limited to standard web browsing data (such as pages viewed, device type, and IP address) and purchase events (such as the fact that a service was booked and its price).

You can opt out of advertising cookies at any time using the methods described in Section 8.

Data retention

We keep your information for as long as needed to provide Services and meet our legal, regulatory, and professional obligations:

• Scan and test records: Body composition and metabolic results, along with the identifying information needed to associate them with you, are retained indefinitely so you can track your history across visits and so we can meet record-keeping requirements that apply to radiation-producing equipment. You may request deletion as described in Section 6.
• Account information: Retained while your account is active and for a reasonable period afterward for backup, archival, and audit purposes.
• Transaction records: Retained as required by tax and accounting laws.
• Marketing and analytics data: Retained for the periods set by the respective platforms, subject to your opt-out choices.

When information is no longer needed, it is securely deleted or de-identified.

4. Electronic Communications

When you provide your contact information, you agree that we may send you transactional and account-related emails and text messages, such as appointment confirmations, results notifications, and receipts. You may also choose to receive promotional communications.

SMS / text messaging consent

By providing your mobile phone number and opting in, you consent to receive text messages from Biosum LLC, including appointment reminders, results notifications, account alerts, and, if you opt in separately, promotional offers. Consent to receive promotional text messages is not a condition of purchasing any Services.

Message frequency varies. Message and data rates may apply.

Reply STOP at any time to cancel. After you send STOP, we will send a final confirmation message and you will no longer receive texts from us. Reply HELP for assistance, or contact us at support@biosum.com.

Carriers are not liable for delayed or undelivered messages.

We do not share your mobile number or SMS opt-in status with third parties for their own marketing purposes. Mobile information will not be sold or shared with third parties or affiliates for marketing or promotional purposes.

Opting out of email

You can stop receiving promotional emails by clicking the unsubscribe link in any message or by contacting privacy@biosum.com. You will still receive transactional and account-related messages that are necessary to provide your Services.

Third-party communication providers

We use third-party platforms to send email and text messages on our behalf. These providers may access your contact information only to deliver our communications and are contractually prohibited from using it for any other purpose.

5. How We Share Your Information

We share personal information only in the following circumstances:

• Service providers. We work with companies that help us operate the Site and deliver Services. They may access personal information only as needed to perform their work for us and are bound by contractual confidentiality and security obligations. Our current categories of providers include: cloud hosting, database, and file storage; client intake and forms; payment processing; voice and text messaging; email delivery and marketing; and website analytics and advertising.
• Payments. Payments are processed by Stripe. Your payment card information is provided directly to Stripe, and Biosum does not store card numbers. Stripe's use of your data is governed by the Stripe Privacy Policy.
• Physician oversight. Biosum's Services are provided under the supervision of a licensed physician who serves as our Medical Director. Your health and contact information is shared with the Medical Director as part of the Services.
• Legal requirements. We may disclose information when required by law, subpoena, court order, or governmental request, or when we believe disclosure is necessary to protect the rights, property, or safety of Biosum, our customers, or the public.
• Business transfers. If Biosum is involved in a merger, acquisition, financing, reorganization, or sale of all or part of its business or assets, customer information (including your account, contact, and scan records) may be transferred to the acquiring or successor organization so that it can continue to provide your Services. Any successor will be required to honor the commitments made in this Privacy Policy or to notify you of any material changes before applying a different policy to your information.
• With your consent. We may share information for any other purpose with your explicit consent.

We do not sell your personal information, and we do not share your health information with third parties for their own marketing or advertising purposes.

6. Accessing, Correcting, and Deleting Your Information

You can review and update much of your information directly in your client area at my.biosum.com. For anything you can't change online, contact support@biosum.com.

Deletion. You may request deletion of your personal information at any time. We will honor your request except where we are required by law or regulation to retain certain records (such as radiation-equipment usage records or financial records). Deleted information is removed from our active databases promptly and may persist in encrypted backups for a limited period before being purged.

De-identified data. After deletion, we may continue to use de-identified and aggregated data derived from your information for research, analysis, and improvement of our Services. De-identified data cannot reasonably be used to identify you.

7. How We Protect Your Information

We have designed our systems and processes around the HIPAA Security Rule's administrative, physical, and technical safeguards, including segregation of health information from other systems. We regularly review these safeguards and require our service providers to maintain comparable protections.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You also play an important role: protect your login credentials and contact us immediately if you suspect unauthorized access to your account.

Breach notification. If we discover a security incident affecting your personal information, we will investigate, take steps to contain it, and notify you and the appropriate authorities without unreasonable delay and in accordance with applicable law.

8. Your Privacy Rights and Choices

We extend the following rights to all of our customers, regardless of where you live. You have the right to:

• Access the personal information we hold about you and receive a copy of it in a portable format.
• Correct inaccurate or incomplete information.
• Delete your personal information, subject to the retention exceptions in Section 6.
• Opt out of targeted advertising and of any use of your information for profiling that produces legal or similarly significant effects.
• Withdraw consent for any processing that is based on your consent, including consent to process health or demographic information, without affecting the lawfulness of processing before withdrawal.
• Appeal a decision we make about your request.

How to exercise these rights. Email privacy@biosum.com or write to the address in Section 11. We may need to verify your identity before responding, and we will respond within 45 days (extendable once by 45 days if reasonably necessary, in which case we will let you know). If we deny your request, we will explain why, and you may appeal by replying to our response. We will not discriminate against you for exercising any of these rights.

Authorized agents. You may designate an authorized agent to make requests on your behalf. We may require proof that the agent has been authorized to act for you.

Opting out of advertising cookies and Global Privacy Control. You can control cookies through your browser settings and opt out of Google and Meta advertising through their respective ad settings pages. We also honor the Global Privacy Control (GPC) browser signal: if your browser or extension sends a GPC signal, we treat it as a request to opt out of targeted advertising on our Site for that browser. Because opt-out signals are tied to the browser and device, you may need to enable GPC on each browser you use.

State-specific notices. Biosum serves customers primarily in North Carolina and South Carolina. If your state's law provides additional privacy rights, you may exercise them by contacting us as described above.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, Services, or applicable law. When we do, we will update the "Last revised" date at the top of this page. For material changes, we will notify you by email or by a prominent notice on the Site before the changes take effect. Your continued use of the Site or Services after an update constitutes acceptance of the revised Policy.

10. Users Outside the United States

Biosum's Sites and Services are operated and hosted in the United States and are intended for U.S. customers. If you access the Site from outside the United States, your information will be transferred to and stored in the United States, where data protection laws may differ from those in your home country.

11. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, or wish to exercise your privacy rights, please contact us: