Legal

LEGACY MD CLUB Privacy Policy Member Portal Effective Date: October 26, 2026 | Last Updated: October 29, 2026 1. Introduction and Scope Legacy MD Club Inc. ("Legacy MD Club," "we," "us," or "our") is committed to protecting the privacy and security of our members' personal and health information. This Privacy Policy describes how we collect, use, disclose, and protect information about members of the Legacy MD Club member portal (the "Portal"). This Policy applies to all information collected through the Portal, including information you provide during enrollment, health intake, clinical interactions, laboratory coordination, pharmacy fulfillment, member support, and all other Portal activities. It does not apply to information collected offline or through any third-party website, application, or service not operated by Legacy MD Club. This Policy applies to members whose state of residence is Florida or Massachusetts. Massachusetts members are also subject to the Massachusetts Member Addendum to the Legacy MD Club Membership Agreement (the 'Massachusetts Addendum'), executed at enrollment, which describes additional privacy rights, data security obligations, and Massachusetts statutory protections applicable to Massachusetts residents. In the event of any conflict between this Privacy Policy and the Massachusetts Addendum with respect to a Massachusetts member's privacy or data security rights, the Massachusetts Addendum controls. HIPAA Notice: To the extent Legacy MD Club or its clinical partners, if any, qualify as a Covered Entity or Business Associate under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), your protected health information ("PHI") is also governed by our Notice of Privacy Practices ("NPP"), which is provided separately. The NPP controls with respect to PHI in the event of any conflict with this Policy. 2. Information We Collect We collect the following categories of information: 2.1 Information You Provide Identity and contact information: name, date of birth, email address, mailing address, phone number, and portal login credentials. Health and medical information: medical history, current medications and supplements, allergies, diagnoses, laboratory results, vital signs, prior treatments, family history, pregnancy or fertility status, and other health information you provide during intake, clinical review, or portal interactions. Lifestyle and wellness information: exercise habits, diet, sleep, substance use, and other information relevant to your health optimization goals. Payment information: billing address and payment method details. Full payment card numbers are processed by our third-party payment processor and are not stored by Legacy MD Club. Communications: messages, questions, and other content you submit through the Portal's secure messaging or support features. Consents and acknowledgments: records of your acceptance of the Membership Agreement, informed consents, and other agreements. 2.2 Information Collected Automatically When you access and use the Portal, we automatically collect certain technical information, including: Log data: IP address, browser type and version, operating system, pages accessed, date and time of access, and referring URL. Device information: device type, unique device identifiers, and screen resolution. Session data: duration of Portal sessions, features used, and navigation paths within the Portal. Cookies and similar technologies: the Portal uses session cookies and persistent cookies to maintain your login session, remember your preferences, and support Portal functionality. See Section 5 for details. 2.3 Information from Third Parties Clinical and laboratory partners: licensed clinical providers, laboratories, and pharmacies may share information with us in connection with your care, including clinical assessments, laboratory results, and prescription records. Analytics providers: we may receive aggregated, de-identified usage data from analytics tools used to monitor and improve Portal performance. See Section 5. 3. How We Use Your Information We use the information we collect for the following purposes: Providing services: to operate the Portal, administer your membership, coordinate clinical review, facilitate laboratory testing, coordinate pharmacy fulfillment, and deliver the services described in your Membership Agreement. Clinical care coordination: to share your health information with licensed clinical providers, pharmacies, and laboratories as necessary to evaluate your requests, issue prescriptions, and monitor your health in connection with services provided through Legacy MD Club. Communications: to send you portal notifications, secure messages, clinical updates, renewal notices, service announcements, and responses to your inquiries. Founding member list: if you join our founding member list, we'll use your name, email and state to send you updates about the Legacy Membership launch. You can unsubscribe anytime. Billing and payment: to process membership fees, product and service charges, and other payments, and to maintain billing records. Compliance and legal obligations: to comply with applicable federal and state law, including HIPAA, Florida law, Massachusetts law, DEA requirements, FDA regulations, and any applicable professional licensing requirements. Safety and security: to detect, investigate, and prevent fraudulent, unauthorized, or illegal activity; to enforce our agreements; and to protect the safety of our members and clinical partners. Quality and improvement: to evaluate and improve Portal functionality, service quality, and member experience using aggregated and de-identified data. Record retention: to maintain records required by law, including clinical records, consent records, and transaction records. We do not sell your personal information or PHI to third parties. We do not use your personal or health information for behavioral advertising or share it with advertising networks. 4. Disclosure of Your Information We may disclose your information in the following circumstances: 4.1 Clinical and Operational Partners We may share your information with licensed clinical providers, supervising physicians, compounding pharmacies, clinical laboratories, contractors and technology and administrative service providers as necessary to provide the services described in your Membership Agreement. All such partners who handle your PHI are required to conform to Legacy MD Club policies consistent with HIPAA requirements and with applicable law. Partners who handle Massachusetts personal information are subject to data security requirements consistent with 201 CMR 17.00. 4.2 Payment Processors Payment transactions are processed by a third-party payment processor. We share billing information with our payment processor solely for the purpose of processing your payment. Our payment processor is not authorized to use your payment information for any other purpose. 4.3 Legal and Regulatory Requirements We may disclose your information when required by applicable law, regulation, court order, or legal process, including disclosures required by HIPAA, state health department requirements, DEA reporting obligations, or lawful requests from government authorities. We will provide notice of such disclosures to the extent permitted by law. 4.4 Protection of Rights and Safety We may disclose information where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Legacy MD Club, our members, our clinical partners, or the public, or to detect, prevent, or address fraud, unauthorized activity, or security incidents. 4.5 Business Transfers In the event of a merger, acquisition, reorganization, or sale of all or substantially all of our assets, your information may be transferred to the successor entity, subject to the same privacy protections described in this Policy. We will provide notice of any such transfer and any material changes to this Policy that result from it. 4.6 With Your Consent We may share your information for other purposes with your express prior consent. 5. Cookies, Analytics, and Tracking Technologies The Portal uses cookies and similar tracking technologies to support Portal functionality, maintain your login session, and monitor Portal performance. We do not use advertising cookies, behavioral tracking cookies, or third-party advertising networks. 5.1 Types of Cookies We Use Session cookies: temporary cookies that expire when you close your browser. Used to maintain your authenticated session within the Portal. Persistent cookies: cookies that remain on your device for a set period. Used to remember your preferences and support Portal functionality across sessions. Analytics cookies: we use privacy-respecting analytics tools to collect aggregated, non-personally-identifiable data about Portal usage, including page views, session duration, and feature usage, to monitor Portal performance and identify improvements. 5.2 Your Cookie Choices You may configure your browser to refuse all cookies or to alert you when cookies are being sent. Please note that disabling session cookies will prevent you from logging into the Portal. We do not respond to browser "Do Not Track" signals at this time. 6. Data Security We implement administrative, technical, and physical safeguards designed to protect your personal and health information from unauthorized access, use, disclosure, alteration, or destruction. These measures include: Encryption of PHI and personal information in transit using TLS/SSL protocols. Encryption of PHI and sensitive personal information at rest. Access controls limiting Portal and system access to authorized personnel with a documented business need. Multi-factor authentication for Portal access. Logging and monitoring of access to PHI and sensitive data. Vendor management requirements, including data security contractual provisions, for all third-party partners who process PHI or personal information on our behalf. A Written Information Security Program ("WISP") governing data security practices for Massachusetts personal information, as required by 201 CMR 17.00. No data transmission over the internet or electronic storage system can be guaranteed to be completely secure. If you believe your account or information has been compromised, please contact us immediately at help@legacyhealth.club. 7. Data Retention We retain your personal information and PHI for as long as your membership is active and for such additional period as is required or permitted by applicable law, including applicable clinical record retention requirements, tax and financial record retention requirements, and legal hold obligations. Florida law requires retention of patient health records for a minimum of five (5) years from the date of the last entry (or, for minors, until the patient reaches the age of majority plus four (4) years). Massachusetts law requires retention of medical records for a minimum of seven (7) years from the date of the last entry (M.G.L. c. 111, § 70). We apply the longer retention period as the default for members in both states. Upon membership termination, we will retain your records for the legally required period and will delete or de-identify personal information that is no longer required to be retained, consistent with applicable law. 8. Your Privacy Rights As a Legacy MD Club member, you have the following rights with respect to your information: 8.1 HIPAA Rights (PHI) To the extent your information constitutes PHI under HIPAA, you have the rights described in our Notice of Privacy Practices, including the right to: Access and obtain a copy of your PHI. Request amendment of inaccurate or incomplete PHI. Request an accounting of disclosures of your PHI. Request restrictions on certain uses and disclosures of your PHI. Request confidential communications of your PHI. File a complaint with the U.S. Department of Health and Human Services Office for Civil Rights ("OCR") if you believe your HIPAA rights have been violated. 8.2 Florida Rights As a Florida member, you have the right to access your health records under § 456.057, Florida Statutes, and the rights described in the Florida Patient's Bill of Rights and Responsibilities (§ 381.026, F.S.). 8.3 Massachusetts Rights As a Massachusetts member, you have additional rights under Massachusetts law as described in the Massachusetts Addendum, including your rights under M.G.L. c. 111, § 70 (health record access), M.G.L. c. 93H (data security breach notification), and applicable Massachusetts Department of Public Health regulations. The Massachusetts Addendum is the controlling document with respect to your Massachusetts privacy and data security rights and should be read together with this Privacy Policy. 8.4 Exercising Your Rights To exercise any of the rights described in this Section, please submit a written request to help@legacyhealth.club. We will respond to all valid requests within the timeframe required by applicable law (generally thirty (30) days, with a possible thirty (30)-day extension upon notice). We may require verification of your identity before processing a request. 9. Minors The Portal is intended solely for use by adults aged 18 and older. We do not knowingly collect personal information from individuals under the age of 18. If we become aware that a minor has provided personal information through the Portal, we will delete such information promptly. If you believe a minor has accessed the Portal or provided information through it, please contact us at help@legacyhealth.club. 10. Changes to This Privacy Policy We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or Portal features. We will notify you of material changes by posting the updated Policy on the Portal and, where required by applicable law, by sending you a direct notification. The "Last Updated" date at the top of this Policy reflects the most recent revision. Your continued use of the Portal after the effective date of an updated Policy constitutes your acceptance of the updated terms, to the extent permitted by applicable law. If you do not agree to the updated Policy, you should discontinue use of the Portal and contact Legacy MD Club to discuss your membership. 11. Contact Information For privacy-related questions, requests, or concerns, please contact: Legacy MD Club Inc. Email: help@legacyhealth.club If you are a Massachusetts resident and believe your rights under M.G.L. c. 93A have been violated, you may also contact the Massachusetts Office of the Attorney General, Consumer Protection Division, at www.mass.gov/ago. If you have concerns about the privacy of your PHI, you may file a complaint with the HHS Office for Civil Rights at www.hhs.gov/ocr without retaliation. END OF PRIVACY POLICY