Privacy Policy

Personal information that you may provide to us

We may collect personal information that you voluntarily provide, including:

• Contact information, such as your first and last name, business name, job title, phone number, mailing address, and email address.
• Account information, such as the username, password, authentication information, and other credentials you use to access your account.
• identification information, such as your date of birth, business information, government-issued identification, photographs, and other information used to verify your identity or business.
• Business information, such as company name, business address, ownership information, business type, websites, tax information, licensing information, and information concerning your business operations.
• Payment information needed to complete transactions with us, including your name, billing information, transaction information, and payment method information. Payment card and banking information may be collected and processed directly by our payment processors.
• Feedback or correspondence, such as information you provide when you contact us with questions, feedback, technical support requests, or otherwise correspond with us.
• Marketing information, such as your preferences for receiving communications from us and information regarding your interaction with our marketing communications.
• Integration information, such as information necessary to configure or maintain integrations between the Services and third-party systems selected or authorized by you.
• Other data not specifically listed here that we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

Personal information we collect automatically

We, our service providers, and our business partners may automatically collect information about you, your computer or mobile device, and your interactions with our Services and communications.

We may collect this information using cookies, pixels, software development kits, local storage, and other similar technologies.

This information may include:

• Device data, such as your computer or mobile device operating system and version, manufacturer and model, browser type, screen resolution, device type, IP address, unique identifiers, language settings, and general geographic information such as city, state, or geographic region.
• Online activity data, such as pages or screens viewed, referring websites, navigation paths, actions performed within the Services, access times, login activity, interactions with our communications, and links or les accessed.
• Session and diagnostic information, which may include information regarding how authorized users interact with portions of our Services for troubleshooting, security, product improvement, or support purposes.
• Location information. With your consent or where otherwise permitted by law, we may collect location information through the device used to access the Services. Location permissions can generally be controlled through your device settings.

Personal information we obtain from third parties

We may receive personal information from third parties, including:

• Social media platforms. We may maintain pages on platforms such as Facebook, Instagram, LinkedIn, X, YouTube, and other third-party platforms. When you interact with us through those platforms, the applicable platform's privacy policy governs its collection and processing of your information. Information provided to VirtualClinicOS through those platforms will be processed in accordance with this Privacy Policy.
• Third-party login providers. If you access the Services through a third-party identity or authentication provider, you may direct that provider to send us information necessary to authenticate your account. Information we receive depends upon your settings, permissions, and the applicable provider's policies.
• Business partners and service providers. We may receive information from business partners, identity-verification providers, payment processors, technology vendors, professional service providers, and other parties involved in providing or supporting the Services.
• Public and commercial sources. We may obtain business contact, company, demographic, or other information from publicly available sources, marketing partners, data providers, or other lawful sources.
• Healthcare ecosystem partners. In connection with providing technology infrastructure to our Customers, we may interact with healthcare providers, professional medical entities, pharmacies, laboratories, electronic prescribing platforms, identity-verification services, payment processors, and other healthcare or technology organizations.

Patient information processed through such integrations is handled on behalf of the applicable

Customer or healthcare provider and is not governed by this Privacy Policy to the extent stated above.

We use personal information for the following purposes or as otherwise disclosed at the time of collection.

To provide, operate, and maintain the Services

We may use personal information to:

• provide access to the Services;
• operate our software and technology infrastructure;
• provide administrative dashboards;
• configure Customer accounts;
• facilitate integrations;
• process payments;
• provide technical support;
• maintain Platform functionality; and
• optimize the user experience.

To establish and maintain your account

We may use personal information to facilitate the creation, authentication, operation, security, and maintenance of your account.

To facilitate third-party authentication and identity verification

We may use personal information to allow you to access the Services through third-party identity and access-management providers and to verify authorized users.

To communicate with you

We may use personal information to:

• respond to requests;
• answer questions;
• provide customer support;
• send administrative communications;
• provide security alerts;
• provide account notifications;
• communicate Platform updates; and
• provide other information relating to the Services.

To improve, monitor, personalize, and protect the Services

We may use personal information to:

• undefirstand how Customers use the Services;
• personalize user experiences;
• troubleshoot technical issues;
• conduct testing;
• improve Platform functionality;
• maintain security;
• detect unauthorized access;
• prevent abuse; and
• improve our products and services.

For research and development

We may use personal information for research and development purposes, including analyzing

and improving our Services and business.

As part of these activities, we may create aggregated, de-identified, anonymized, or statistical information by removing or modifying information that reasonably identi es an individual.

We may use and disclose aggregated or de-identified information for lawful business purposes, including:

• analyzing Platform performance;
• developing new functionality;
• conducting research;
• measuring business performance;
• improving the Services; and
• promoting our business,

provided that such use complies with applicable law and contractual restrictions.

For marketing and advertising

We, our service providers, and our marketing partners may process personal information for

marketing and advertising purposes.

This may include:

Direct marketing. We may send newsletters, announcements, product information, promotions, offers, invitations, and other marketing communications as permitted by applicable law.

You may opt out of marketing communications as described below.

Interest-based advertising. We may engage third-party advertising platforms and social media

companies to display advertisements for VirtualClinicOS.

These companies may use cookies, pixels, and similar technologies on our public-facing

Websites to collect information regarding interactions with our Websites and other online services and use that information to provide advertising that may be relevant to you.

VirtualClinicOS does not use PHI processed on behalf of our Customers for interest-based

advertising.

Surveys and promotions

We may collect and use information when you participate in surveys, promotions, events, webinars, or similar activities.

For compliance and protection

We may use personal information to:

• comply with applicable laws;
• comply with lawful requests and legal processes;
• respond to subpoenas, court orders, or government requests;
• protect our rights, privacy, safety, or property;
• protect the rights, privacy, safety, or property of Customers or others;
• establish, exercise, or defend legal claims;
• audit internal processes;
• enforce agreements governing the Services;
• comply with contractual obligations;
• prevent fraud;
• detect cyberattacks;
• investigate unauthorized activity;
• prevent identity theft; and
• identify or prevent illegal or unethical activity.

We may disclose personal information as follows.

affiliates and Subsidiaries

We may disclose information among VirtualClinicOS affiliates, subsidiaries, parent companies, or entities under common control for purposes consistent with this Privacy Policy.

Service Providers

We may disclose personal information to third-party companies and individuals that provide

services on our behalf or help operate the Services.

These may include providers of:

• cloud hosting;
• data storage;
• information technology;
• cybersecurity;
• identity verification;
• authentication;
• communications;
• customer support;
• email delivery;
• SMS services;
• payment processing;
• analytics;
• software development;
• infrastructure; and
• other operational services.

Advertising Partners

We may disclose information concerning visitors to our public-facing Websites to third-party

advertising and analytics companies for the advertising purposes described above.

We do not intentionally disclose PHI processed on behalf of our Customers to advertising

platforms for their independent advertising purposes.

Professional Advisors

We may disclose personal information to professional advisors such as:

• attorneys;
• accountants;
• auditors;
• consultants;
• bankers; and
• insurers

where reasonably necessary in connection with the professional services they provide.

Authorities and Others

We may disclose personal information to law enforcement, government authorities, regulators, courts, and other parties when we believe in good faith that disclosure is necessary or appropriate for the compliance and protection purposes described in this Privacy Policy.

Business Transferees

We may disclose or transfer personal information in connection with an actual or proposed:

• merger;
• acquisition;
• nancing;
• corporate restructuring;
• consolidation;
• divestiture;
• sale of assets;
• sale of equity;
• change of control;
• bankruptcy; or
• similar corporate transaction.

With Your Instruction or Permission

We may disclose personal information to another party when you direct us or give us permission

to do so.

VirtualClinicOS provides technology infrastructure that may enable Customers to facilitate healthcare services through independent healthcare providers and other healthcare organizations.

In connection with those Services, VirtualClinicOS may process information concerning patients

on behalf of Customers, healthcare providers, professional medical entities, pharmacies, laboratories, or other authorized organizations.

Such information may include PHI protected under HIPAA.

Where applicable, VirtualClinicOS processes PHI as a business associate pursuant to a BAA with

the applicable covered entity.

VirtualClinicOS does not independently determine:

• diagnoses;
• treatment plans;
• medical necessity;
• prescribing decisions;
• medication eligibility; or
• other clinical decisions.

Those decisions are made by appropriately licensed healthcare providers.

If you are a patient seeking:

• access to medical records;
• correction of medical information;
• deletion where legally available;
• information regarding disclosures;
• restrictions on uses or disclosures; or
• another right concerning your health information,

you should generally contact the healthcare brand or healthcare provider through which you received healthcare services.

VirtualClinicOS will assist its Customers with applicable privacy requests as required by law and applicable agreements.

Opt Out of Marketing Communications You may opt out of marketing-related emails by following the unsubscribe instructions contained in the communication or by contacting us using the information provided in the “Contact Us” section.

Even after opting out of marketing communications, you may continue receiving non-marketing

communications concerning:

• your account;
• security;
• transactions;
• support requests;
• Services you use; and
• other administrative matters.

Personal Information Requests

Depending upon your location and the nature of your relationship with VirtualClinicOS, you may

have the right to request:

• Information regarding how we collect and use your personal information.
• Access to personal information we maintain concerning you.
• Correction of inaccurate or outdated personal information.
• Deletion of certain personal information.
• Portability of certain personal information in a portable and readily usable format.
• Opt-out of certain sharing or processing for interest-based advertising where applicable.

To submit a request, contact us using the information in the “Contact Us” section below.

We may request information necessary to verify your identity before processing a request.

Where permitted by applicable law, an authorized agent may submit a request on your behalf. We

may require verification of the agent's identity and authority.

You will not be unlawfully discriminated against for exercising applicable privacy rights.

Account Deactivation and Deletion

If you maintain an account with VirtualClinicOS, you may request account deactivation or

deletion by contacting us.

Deactivating an account does not necessarily result in deletion of all associated personal

information.

We may retain information where necessary to:

• comply with law;
• maintain security;
• prevent fraud;
• enforce agreements;
• satisfy contractual obligations; or
• establish, exercise, or defend legal claims.

Limits on Your Choices

Privacy rights may be subject to exceptions under applicable law.

For example, we may be unable to fulfill a deletion request where retaining information is

necessary to satisfy legal obligations or where the information is maintained on behalf of a Customer subject to separate legal requirements.

You can limit certain online tracking through browser and device settings.

Browser Controls

Most browsers allow users to remove or reject cookies.

Disabling certain cookies may affect the functionality of the Services.

Information about managing cookies is available through the settings and support documentation

for browsers including:

• Firefox;
• Google Chrome;
• Microsoft Edge;
• Safari; and
• other modern browsers.

Advertising Controls

Certain advertising platforms and industry organizations provide mechanisms for limiting

interest-based advertising.

Available choices may include controls provided by:

• Google;
• Meta;
• the Digital Advertising Alliance; and
• the Network Advertising Initiative.

Opt-out mechanisms are often specific to the browser or device on which they are exercised, meaning you may need to apply your preferences separately on each device and browser.

Google Analytics

We may use Google Analytics or similar analytics technologies to better undefirstand how users

interact with our public-facing Websites.

Google provides additional information and tools for controlling the collection of analytics

information through its privacy and advertising settings.

Do Not Track

Certain browsers may transmit “Do Not Track” signals.

Because there is not currently a universally accepted technical or legal standard for recognizing these signals, our Websites may not respond to all Do Not Track signals.

Where applicable law requires recognition of a specific opt-out preference signal, we will

process such signals as required by law.

Our Services may contain links to websites, applications, or other online services operated by

third parties.

Our technology may also be integrated into websites or services operated by our Customers or

other third parties.

A link or integration does not necessarily constitute an endorsement of or af liation with the

third party.

VirtualClinicOS does not control third-party websites and services and is not responsible for

their privacy practices.

This Privacy Policy does not govern information collected independently by third-party websites or services.

If you apply for employment or another professional opportunity with VirtualClinicOS, we may collect information submitted in connection with your application.

This may include:

• name and contact information;
• employment history;
• education;
• professional credentials;
• skills;
• résumé or curriculum vitae;
• references;
• interview information; and
• other information voluntarily provided during the application process.

We may use this information to:

• evaluate candidates;
• conduct recruitment activities;
• communicate regarding employment opportunities;
• maintain recruitment records;
• conduct legally permissible background or reference checks;
• comply with applicable law; and
• establish or defend legal claims.

VirtualClinicOS uses reasonable organizational, technical, and administrative safeguards designed to protect personal information against unauthorized access, misuse, loss, disclosure, alteration, and destruction.

Depending upon the Services involved, safeguards may include:

• encryption;
• authentication;
• access controls;
• role-based permissions;
• logging;
• monitoring;
• secure infrastructure;
• cybersecurity controls;
• multi-factor authentication; and
• vendor security requirements.

However, no method of transmission over the Internet and no method of electronic or physical

storage is completely secure.

Accordingly, VirtualClinicOS cannot guarantee absolute security.

Where you have credentials that enable access to the Services, you are responsible for keeping

those credentials confidential and should not share passwords or authentication codes with unauthorized persons.

Where required by applicable law, we retain personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected and processed, consistent with:

• our retention policies;
• applicable law;
• contractual obligations;
• regulatory requirements; and
• legitimate business requirements.

When determining an appropriate retention period, we may consider:

• the amount of information;
• the nature of the information;
• the sensitivity of the information;
• potential risks associated with unauthorized use or disclosure;
• the purposes for which information is processed;
• whether those purposes can be achieved through other means;
• contractual requirements; and
• applicable legal or regulatory obligations

The Services are not intended for use by individuals under eighteen (18) years of age unless access is specifically authorized through an applicable healthcare program and permitted by law.

VirtualClinicOS does not knowingly collect personal information directly from children under

eighteen (18) through its general business-facing Services without appropriate authorization.

If we learn that we have collected personal information from a child in violation of applicable law, we will take reasonable steps to delete or otherwise appropriately handle the information.

Patient information concerning minors may be processed through the Services on behalf of

Customers or healthcare providers where legally permitted and where appropriate consent or authorization has been obtained.

In those circumstances, the applicable Customer or healthcare provider is responsible for

determining the legal basis for the collection and use of the minor’s information.

We may update this Privacy Policy from time to time to re ect changes in:

• applicable law;
• our data practices;
• the features or functionality of the Services;
• our business operations;
• our service providers;
• our security practices; or
• advances in technology.

When we update this Privacy Policy, we will revise the “Date of Last Revision” at the top of the Policy.

If we make a material change, we may provide additional notice where required by applicable

law.

You should periodically review this Privacy Policy for updates.

Your continued use of the Services after an updated Privacy Policy becomes effective is subject to the revised Policy to the extent permitted by law.

If you have questions about this Privacy Policy, our privacy practices, or wish to submit a privacy-related request, please contact us at:

VirtualClinicOS LLC

700 S Rosemary Ave, Suite 204

West Palm Beach, Florida 33401

United States

Attn: Privacy / Legal

Legal: admin@virtualclinicos.com

Support: support@virtualclinicos.com

If you are a patient requesting information concerning medical records, prescriptions, treatment information, laboratory results, or other patient information processed by VirtualClinicOS on behalf of a healthcare organization, you should first contact the healthcare brand or healthcare provider through which you received the applicable healthcare services.

VirtualClinicOS will cooperate with its Customers and healthcare partners in responding to valid patient privacy requests as required by applicable law and contractual obligations.

If you are a California resident, California law may require us to provide additional information concerning how we collect, use, disclose, sell, or share “personal information,” as that term is defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”).

This Section applies only to personal information subject to the CCPA.

Certain information processed through the Services may be exempt from the CCPA or subject to

separate healthcare privacy laws, including certain medical information or PHI processed pursuant to HIPAA.

14.1 Categories of Personal Information We Collect and Disclose The following summarizes categories of personal information we may collect and categories of recipients to whom such information may be disclosed for business purposes.

Category of Personal Information Categories of Recipients

identifiers and contact information, such as name, Service providers; affiliates; professional business address, email address, telephone number, advisors; entities involved in legal, account Customeridenti and ers, and IP address commercial information, such as compliance, and fraud-prevention Service providers; affiliates; payment information regarding subscriptions, Services used, providers; professional advisors; entities purchases, and business transactions involved in legal and fraud prevention

Financial information, such as billing information Payment processors; nancial service

and limited transaction data providers; service providers; affiliates; Internet or electronic network activity, such as IP legal andproviders; Service fraud-prevention analyticsentities providers; address, browser information, login activity, pages affiliates; cybersecurity providers; legal viewed, and use Geolocation of the Services information, such as general location and fraud-prevention Service entities providers; security providers; derived from IP address and, where authorized, affiliates; legal and fraud-prevention device location Professional and employment information, such entities Service providers; affiliates; professional as job title, employer, business ownership, advisors; business partners where Visual information, such as photos or identification applicable credentials, and other professional information Identity-verification providers; service images submitted for account or identity-verification providers; affiliates where appropriate purposes Communications and customer-service data, such Service providers; affiliates; professional as support requests, emails, chat communications, advisors; legal and fraud-prevention and correspondence Inferences, such as information regarding interests entities Analytics providers; advertising partners; in VirtualClinicOS products or Services derived service providers; affiliates from interactions with our public-facing Websites Patient PHI processed by VirtualClinicOS on behalf of Customers or healthcare providers is not included in the above table to the extent it is exempt from the CCPA or governed by separate healthcare privacy requirements.

14.2 Business Purposes for Using Personal Information We may collect, use, and disclose personal information for business purposes including:

• providing and maintaining the Services;
• administering Customer accounts;
• facilitating payments;
• providing technical support;
• authenticating authorized users;
• conducting security and fraud prevention;
• managing business relationships;
• maintaining and improving the Services;
• conducting analytics and research;
• communicating with Customers and prospective Customers;
• marketing VirtualClinicOS products and Services;
• complying with applicable law;
• enforcing agreements;
• conducting audits;
• protecting legal rights; and
• defending against legal claims.

For more detail, see the sections titled “Personal Information We Collect” and “How We Use

Personal Information.”

14.3 Your California Privacy Rights Subject to applicable exceptions, California residents may have the right to request that we:

• disclose the categories of personal information we collect;
• disclose the categories of sources from which personal information is collected;
• disclose the business or commercial purposes for collecting, selling, or sharing personal information;
• disclose the categories of third parties to whom personal information is disclosed;
• provide access to specific pieces of personal information;
• correct inaccurate personal information;
• delete certain personal information;
• provide certain information in a portable format;
• opt out of the sale or sharing of personal information;
• limit certain uses of sensitive personal information where applicable; and
• provide information concerning our privacy practices.

You also have the right not to receive discriminatory treatment for exercising applicable rights under the CCPA.

Certain information may be exempt from these rights under California law.

For example, we may retain information where necessary to:

• provide requested Services;
• maintain security;
• prevent fraud;
• exercise or defend legal claims;
• comply with contractual obligations;
• maintain business records required by law; or
• comply with other legal requirements.

We may take reasonable steps to verify your identity before processing a request.

14.4 How to Exercise California Privacy Rights To submit a California privacy request, contact:

VirtualClinicOS LLC

Email: admin@virtualclinicos.com

Or write to:

Attn: Privacy / Legal

VirtualClinicOS LLC 700 S Rosemary Ave, Suite 204 West Palm Beach, Florida 33401 United States

Please include sufficient information for us to identify and verify your request.

Depending on the nature of the request, we may ask for:

• your full name;
• email address;
• telephone number;
• business af liation;
• account information; or
• other information necessary to verify your identity.

Authorized agents may submit requests where permitted by law. We may require documentation

establishing the agent’s authority to act on your behalf.

14.5 Sale and Sharing of Personal Information VirtualClinicOS does not sell personal information in exchange for monetary compensation in the ordinary meaning of the word “sell.”

However, we may use third-party analytics, advertising, or social media technologies on our

public-facing Websites.

Certain disclosures involving cookies, advertising identifiers, pixels, or similar technologies may be considered a “sale” or “sharing” of personal information for cross-context behavioral advertising under the CCPA.

Where required by law, California residents may opt out of such sale or sharing through available privacy controls or by contacting us.

VirtualClinicOS does not sell PHI or patient medical records.

VirtualClinicOS does not use PHI processed on behalf of Customers for cross-context

behavioral advertising.

Any opt-out mechanism may be specific to the browser or device through which it is exercised.

14.6 Sensitive Personal Information VirtualClinicOS may collect certain information that could be considered sensitive personal information under California law, including account credentials, government identification information, and certain information used for security or identity verification.

We use sensitive personal information only for purposes permitted by applicable law, including:

• authenticating users;
• securing accounts;
• preventing fraud;
• complying with law;
• providing requested Services; and
• protecting the security and integrity of the Services.

We do not use sensitive personal information to infer characteristics about individuals in a

manner that would require a right to limit under the CCPA unless otherwise disclosed.

14.7 Shine the Light California’s “Shine the Light” law permits California residents to request certain information concerning disclosure of personal information to third parties for those third parties’ own direct marketing purposes.

VirtualClinicOS does not disclose personal information to third parties for their own direct

marketing purposes in the manner contemplated by California’s Shine the Light law.

Residents of certain other U.S. states may have privacy rights under applicable comprehensive state privacy laws.

Depending on your state of residence, these may include rights to:

• con rm whether we process your personal information;
• access personal information;
• correct inaccuracies;
• delete certain personal information;
• obtain a portable copy of personal information;
• opt out of targeted advertising;
• opt out of the sale of personal information;
• opt out of certain pro ling activities; and
• appeal a decision concerning a privacy request.

The exact rights available to you depend upon the law applicable in your state and whether

VirtualClinicOS is subject to that law with respect to the information involved.

To exercise an applicable state privacy right, contact us at:

admin@virtualclinicos.com

If applicable law provides a right to appeal our response to a privacy request, you may submit an appeal using the same email address and clearly identify your communication as a Privacy Appeal.

VirtualClinicOS is a technology and administrative services provider.

In certain arrangements, VirtualClinicOS may receive or maintain PHI on behalf of healthcare

providers or other HIPAA-covered entities.

Where VirtualClinicOS acts as a business associate, the covered entity generally remains

responsible for determining how PHI is used and disclosed for treatment, payment, healthcare operations, and other legally permitted purposes.

Accordingly, if you are a patient seeking to exercise rights involving PHI, you should generally submit your request to your applicable healthcare provider or health/wellness brand.

Depending on applicable law, rights concerning PHI may include:

• inspecting or obtaining copies of certain health information;
• requesting amendments;
• requesting restrictions on certain uses or disclosures;
• requesting confidential communications;
• obtaining an accounting of certain disclosures; and
• ling a privacy complaint.

VirtualClinicOS will support applicable Customers in responding to valid requests as required by law and applicable Business Associate Agreements.

VirtualClinicOS does not sell patient medical records or PHI.

VirtualClinicOS does not sell information regarding:

• diagnoses;
• prescriptions;
• treatment plans;
• laboratory results;
• medical histories;
• provider consultations; or
• other PHI

for advertising or data-broker purposes.

Where VirtualClinicOS processes such information on behalf of a Customer or healthcare

provider, it does so only for purposes permitted by applicable agreements and law.

VirtualClinicOS may support healthcare-related Websites and technology environments.

We recognize that information concerning a person’s interaction with healthcare-related

webpages may be sensitive.

Accordingly, VirtualClinicOS seeks to distinguish between:

1. general public-facing marketing Websites; and

2. authenticated patient-facing environments or areas where health information may be processed.

Advertising technologies may be used on general public-facing Websites where legally

appropriate.

VirtualClinicOS does not intentionally use PHI maintained within authenticated healthcare

workflows for targeted or cross-context behavioral advertising.

Customers using the VirtualClinicOS technology are responsible for configuring their own

advertising and analytics practices in compliance with applicable law and their own privacy policies.

VirtualClinicOS Customers are responsible for their own privacy practices and for complying with privacy laws applicable to their businesses.

Customers using the Services to collect or process patient information are responsible for:

• providing applicable privacy notices;
• providing Notices of Privacy Practices where legally required;
• obtaining legally required consents and authorizations;
• maintaining appropriate healthcare-provider relationships;
• determining permissible uses and disclosures of patient information;
• configuring user access appropriately;
• managing patient privacy requests; and
• complying with applicable state and federal privacy and healthcare laws.

VirtualClinicOS’s provision of technology infrastructure does not transfer a Customer’s

independent legal obligations to VirtualClinicOS.

When VirtualClinicOS processes information solely on behalf of a Customer, VirtualClinicOS may act as a processor, service provider, contractor, or business associate, depending upon the applicable law and contractual relationship.

In such circumstances, VirtualClinicOS may process information:

• according to the Customer’s documented instructions;
• as necessary to provide the Services;
• as required by applicable law;
• to maintain security;
• to prevent fraud or abuse; and
• as otherwise permitted under applicable contracts.

Customer data may be subject to additional contractual protections contained in:

• Master Services Agreements;
• Data Processing Agreements;
• Business Associate Agreements;
• platform agreements; or
• other agreements between VirtualClinicOS and the applicable Customer.

VirtualClinicOS is based in the United States and primarily provides Services in connection with U.S.-based business and healthcare operations.

If you access the Services from outside the United States, your information may be transferred

to, stored in, or processed in the United States or other jurisdictions in which our service providers operate.

Those jurisdictions may have privacy laws that differ from those in your country.

Where required by applicable law, we will use appropriate mechanisms relating to cross-border

transfers of personal information.

Although VirtualClinicOS uses safeguards designed to protect personal information, no system can be guaranteed to be completely secure.

You acknowledge that electronic communications and data storage inherently involve security

risks.

You are responsible for maintaining the security of your own:

• usernames;
• passwords;
• authentication codes;
• devices;
• email accounts; and
• administrative-user permissions.

You should promptly notify VirtualClinicOS if you reasonably believe your account or

credentials have been compromised.

This Privacy Policy is intended to describe VirtualClinicOS’s privacy practices and does not create contractual rights beyond those provided by applicable law or an applicable written agreement.

Where this Privacy Policy conflicts with a Business Associate Agreement, Data Processing

Agreement, or other written agreement governing VirtualClinicOS’s processing of information on behalf of a Customer, the applicable written agreement will control to the extent of the conflict.

For questions, complaints, or requests regarding this Privacy Policy or VirtualClinicOS’s privacy practices, contact:

VirtualClinicOS LLC

700 S Rosemary Ave, Suite 204 West Palm Beach, Florida 33401 United States

Legal / Privacy: admin@virtualclinicos.com

Support: support@virtualclinicos.com

© 2026 VirtualClinicOS LLC. All rights reserved.