Health Data Privacy Notice

Effective Date: August 19, 2026

This Health Data Privacy Notice ("Notice") explains Hollis Health LLC's role when we handle health information that you voluntarily share with Hollis Health, or authorize an independent licensed physician, laboratory, imaging provider, or other healthcare provider to share with us, so that it can be displayed and organized in your coaching dashboard. It also covers reports you export from your own account with an independent third-party health-testing company and choose to share with us. See Section 1.4.

This Notice is narrower than our general Privacy Policy. It is intended to address health information that Hollis Health may receive, maintain, or display when you, or an independent provider at your direction, shares it with us.

This Notice does not serve as a Notice of Privacy Practices ("NPP") for Hollis Health or for any independent provider. Hollis Health is not a medical provider and does not practice medicine. Each independently licensed physician, laboratory, or other Covered Entity remains responsible for its own NPP and its own direct clinical privacy obligations.

---

1. Hollis Health's Health Data Role

1.1 Health Information Handling Role. When you share health information with Hollis Health directly, or authorize an independent provider to share it with us, Hollis Health may receive, maintain, or display that information. If displaying or storing that information requires additional privacy contracts, Hollis Health will use the appropriate contractual protections before doing so.

1.2 Limited Scope. This Notice applies only to health information handled in that manner. Information you provide directly to Hollis Health through consumer-facing wellness features may be governed by our general Privacy Policy and by laws other than HIPAA.

1.3 No Direct Clinical Practice Representation. Nothing in this Notice means that Hollis Health is itself your physician or a Covered Entity for all Services. Hollis Health's role depends on the workflow and the relationship under which the information was collected or received.

1.4 Sponsored Third-Party Testing Programs. Hollis Health may pay for, or reimburse the cost of, a membership or subscription with an independent third-party health-testing company on your behalf as a benefit of certain membership tiers. Where Hollis Health does so, the account is yours — established in your name, governed by that company's own terms and privacy practices. That company and its own independent licensed providers order, arrange, and perform any testing and are solely responsible for interpretation of results and clinical follow-up. Hollis Health does not select your test panel, does not arrange or schedule your specimen collection, does not receive your results from that company, and has no access to your account with that company. Hollis Health's payment of a subscription fee on your behalf does not make Hollis Health the provider of, or responsible for, any testing, laboratory, or clinical service.

Health information generated under such a program comes into Hollis Health's hands only where you export it yourself from your own account with that company and voluntarily share it with us. Hollis Health receives and displays it only after you have given written consent, and handles it thereafter as described in this Notice.

---

2. Categories of PHI We May Handle

When received from you or from an independent provider with your consent or as otherwise permitted by law, health information handled by Hollis Health may include categories such as:

• laboratory and biomarker results;
• body composition or imaging summaries transmitted by an independent provider;
• diagnoses, impressions, and clinician-authored directives;
• medication, supplement, or protocol instructions issued by an independently licensed clinician;
• appointment confirmations, intake forms, or other administrative records you choose to share with us from your independent provider visits;
• biomarker panel or other results reports you export from your own account with an independent third-party health-testing company and provide to us;
• secure messages or records that you or an independent provider transmit to us with your consent.

---

3. How We Use and Disclose PHI

Where Hollis Health handles health information that you, or an independent provider at your direction, shares with us, we may use or disclose that information only as permitted by:

• your written consent or authorization;
• the applicable service, privacy, or data-sharing agreement;
• HIPAA and other applicable law where applicable; and
• instructions of the Covered Entity where required.

Examples may include:

• displaying and organizing records you, or an independent provider at your direction, share with us;
• using shared information as non-clinical context for training, nutrition, and recovery programming;
• technical hosting, security, storage, and access management;
• audit logging, incident response, and lawful compliance activities.

Hollis Health receives and displays health information under this Notice only after you have given written consent to share it.

No review or monitoring. Hollis Health does not review or monitor health information handled under this Notice for urgent, abnormal, or clinically significant findings, and has no duty to identify, flag, interpret, or notify you or any other person of any finding. Interpretation of results and clinical follow-up remain the responsibility of the provider who ordered the testing or rendered the care.

Hollis Health does not use health information handled in this manner for unrelated advertising or data sale.

---

4. Your Rights

4.1 Rights Through the Covered Entity. If your request concerns PHI maintained by an independently licensed physician, laboratory, or other Covered Entity, your HIPAA rights are generally exercised through that Covered Entity.

4.2 Requests We May Route or Coordinate. For convenience, you may send an access, amendment, accounting, restriction, or confidential communications request to Hollis Health. We may forward, route, or coordinate the request with the appropriate Covered Entity rather than responding independently where the law or applicable agreement requires that workflow.

4.3 Direct-to-Consumer Data Is Different. If your request concerns information you provided directly to Hollis Health in a consumer-facing wellness workflow, that request may instead be handled under our general Privacy Policy and other applicable law.

---

5. Safeguards

Hollis Health applies administrative, technical, and physical safeguards designed to protect health information that you, or an independent provider at your direction, share with us, which may include:

• encryption in transit and at rest where appropriate;
• role-based access controls;
• audit logging and access monitoring;
• identity and authentication controls;
• vendor contractual controls where applicable;
• incident response and workforce training.

No safeguard can guarantee absolute security, but Hollis Health is committed to using commercially reasonable and legally appropriate measures for health information handled as described in this Notice.

---

6. Subcontractors and Vendors

Hollis Health may use subcontractors and vendors to support health-information workflows, including cloud hosting, secure communications, infrastructure, monitoring, and other operational services. Where a vendor creates, receives, maintains, or transmits regulated health information for Hollis Health in a workflow requiring additional contractual protections, Hollis Health will seek to have appropriate protections in place.

---

7. Breach and Incident Handling

If Hollis Health discovers a breach of unsecured PHI or other regulated health information in a covered workflow, we will respond in accordance with applicable law and the governing service or data-sharing arrangement, including notice to the affected Covered Entity where required.

Where a single incident affects both:

• PHI maintained by or shared from a Covered Entity; and
• direct-to-consumer data collected by Hollis Health,

different notification laws may apply to different parts of the incident. In that situation, Hollis Health may provide or support multiple notice workflows under HIPAA, state breach law, consumer privacy law, or other applicable law.

---

8. Complaints

If you believe your HIPAA rights have been violated in connection with PHI handled in a Covered Entity workflow, you may:

• contact the applicable Covered Entity directly;
• contact Hollis Health so that we can route or coordinate the concern where appropriate; or
• file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights.

HHS OCR complaint information is available at:

https://www.hhs.gov/hipaa/filing-a-complaint

Hollis Health will not retaliate against any person for making a good-faith privacy complaint.

---

9. Contact Information

For questions or requests related to this Notice, please contact:

Hollis Health LLC
Attn: Privacy Team
818 Knights Cross Dr, Suite 5104
San Antonio, TX 78258
(Studio location; opening October 17, 2026.)

Email: admin@hollis.health
Phone: (210) 891-9005

---

This Health Data Privacy Notice was last updated on August 19, 2026.