Privacy Policy

01Information We Collect

Personal Information

When you join ALYZE, register for our waitlist, or interact with our services, we may collect:

• Full name, email address, phone number, and mailing address
• Date of birth, gender, and government-issued ID when required for clinical services
• Payment and billing information
• Emergency contact details
• Membership preferences and account credentials
• Electronic signatures captured on consent forms, waivers, and the Membership Agreement

Health & Medical Data

As a comprehensive health club with precision medicine, CLIA-certified laboratory, and recovery services, we collect health-related information including:

• Medical history, family health history, current medications, allergies, and contraindications
• Bloodwork results and biomarker data from our CLIA-certified lab
• DEXA body composition scan results
• VO2 max and physical performance data
• Mental performance assessment results
• Vitals and biometric measurements
• Treatment records from precision medicine, recovery, and MedSpa services
• Prescriptions, Protocols, clinical notes, injection / infusion logs, and dosing history
• Treatment-Specific Consents, photography or clinical imaging authorized for charting or outcome tracking, and before / after images where you have separately consented
• Incident and Adverse Event reports generated during your care

Practice-Management & Records Platforms

Clinical and membership records are maintained in industry-standard, HIPAA-aligned platforms — including our practice-management and member-experience system (Zenoti) and our clinical record-keeping system — under Business Associate Agreements where applicable. These systems store your demographics, consent forms, e-signatures, appointment history, Protocols, and clinical notes.

Communications & Telehealth

We may collect and retain records of your communications with ALYZE, including:

• Email, SMS, and in-app messages exchanged with staff or your Clinician
• Telehealth encounter recordings or summaries, where separately consented
• Voicemails and call logs to our main line

Usage Data

We automatically collect certain information when you visit our website or use our digital services:

• IP address, browser type, and operating system
• Pages visited, time spent, and referral sources
• Device identifiers and interaction data
• Facility check-in and service usage patterns (including access-control badge events for 24/7 facility entry)

Cookies & Similar Technologies

Our website uses cookies and similar tracking technologies to enhance your experience. See Section 6 for details.

02How We Use Your Information

We use the information we collect for the following purposes:

• Service delivery: To provide fitness, precision medicine, recovery, mental performance, MedLab, and MedSpa services as part of your membership
• Personalization: To create and maintain your personalized health protocols, including your anALYZE Assessment, quarterly reassessments, and ongoing care plans
• Communication: To send membership updates, appointment reminders, health insights, and service-related notifications
• Analytics & improvement: To understand how members use our facility and services, improve our offerings, and develop new programs
• Safety & compliance: To maintain clinical records as required by law, ensure facility safety, and comply with healthcare regulations
• Marketing: To send promotional materials, with your consent, about ALYZE services, events, and offers (you may opt out at any time)

03HIPAA & Protected Health Information

ALYZE operates a CLIA-certified medical laboratory and provides precision medicine services through licensed healthcare practitioners. Certain health information we collect qualifies as Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA).

PHI is handled in accordance with HIPAA regulations and our separate Notice of Privacy Practices, which is provided to all members at enrollment. Key protections include:

• PHI is stored in HIPAA-compliant, encrypted systems
• Access to PHI is restricted to authorized healthcare personnel on a need-to-know basis
• We maintain Business Associate Agreements (BAAs) with all third-party vendors who handle PHI
• PHI is only disclosed as permitted or required by law, for treatment purposes, or with your written authorization
• You have the right to request an accounting of PHI disclosures

Categories of Disclosure

As permitted by HIPAA for Treatment, Payment, and Health Care Operations (TPO), PHI may be disclosed to the following categories of recipients:

• Treating Clinicians, supervising physicians, and credentialed staff within ALYZE and our MedSpa partner
• Licensed 503A and 503B compounding pharmacies that prepare or dispense your Protocols — limited to the prescription, demographics, allergies, and clinical data necessary to compound and dispense safely
• Reference laboratories and diagnostic partners for specialized testing beyond our in-house CLIA capabilities
• Emergency medical services (EMS), hospitals, and on-call providers in the event of an Adverse Event or medical emergency on premises
• Legal counsel, professional liability carriers, and supervising physicians in connection with Adverse Event review, incident reporting, or regulatory compliance
• Regulatory agencies (FDA, DEA, state licensing boards, CLIA / CMS) where reporting is required by law

In the event HIPAA regulations and this Privacy Policy conflict, HIPAA regulations and our Notice of Privacy Practices shall prevail with respect to PHI.

04Data Sharing & Third Parties

We do not sell your personal information. We may share your information with the following categories of third parties:

The Plastics Clinic (MedSpa Partner)

MedSpa services at ALYZE are delivered in partnership with The Plastics Clinic, located within our Bountiful facility. Relevant treatment and medical information is shared with The Plastics Clinic's licensed practitioners to deliver your MedSpa services. This sharing is governed by a Business Associate Agreement.

Laboratory & Clinical Partners

When specialized testing or referrals are necessary beyond our in-house CLIA-certified lab capabilities, we may share relevant medical data with accredited laboratory partners and referring healthcare providers, subject to HIPAA requirements and BAAs.

Compounding Pharmacies (503A & 503B)

Where your Clinician prescribes a Compounded Product, we share the minimum necessary information — prescription, demographics, allergies, weight where relevant to dosing, and clinical context — with the licensed 503A or 503B compounding pharmacy responsible for preparing and dispensing your Protocol. These pharmacies are independently licensed, maintain their own privacy and security programs, and are engaged under a Business Associate Agreement or a functionally equivalent confidentiality arrangement.

Adverse Event Reporting Recipients

In the event of an Adverse Event, incident, or near-miss related to a service received at ALYZE, PHI may be disclosed to the following to support clinical response, documentation, and regulatory reporting:

• The treating Clinician and supervising physician
• The compounding pharmacy or product manufacturer, where the event may relate to a dispensed product
• Emergency medical services and receiving hospitals in the case of an acute medical emergency
• ALYZE's legal counsel and professional liability carrier
• Applicable regulatory bodies (FDA MedWatch, state licensing boards, DEA, CLIA / CMS) where such reporting is required or authorized by law

Service Providers

We work with trusted service providers who assist in operating our business, including:

• Payment processing and billing systems
• Electronic health record (EHR) and practice management platforms
• Email and communication platforms (e.g., HubSpot)
• Website analytics (e.g., Google Analytics)
• Cloud hosting and data storage providers

These providers are contractually obligated to protect your information and use it only for the purposes we specify.

Legal Requirements

We may disclose information when required by law, regulation, legal process, or governmental request, or to protect the rights, safety, or property of ALYZE, our members, or the public.

05Data Security

We implement administrative, technical, and physical safeguards designed to protect your information, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Role-based access controls and multi-factor authentication for staff systems
• Regular security audits and vulnerability assessments
• HIPAA-compliant infrastructure for medical and laboratory data
• Employee training on data privacy and security procedures
• Secure disposal of physical and electronic records

While we strive to protect your information, no method of transmission or storage is 100% secure. If you have reason to believe your interaction with us is no longer secure, please contact us immediately.

06Cookies & Tracking Technologies

Our website uses the following cookies and tracking technologies:

Essential Cookies

Required for basic website functionality, such as session management and security. These cannot be disabled.

Analytics Cookies

We use Google Analytics to understand how visitors interact with our website. Google Analytics collects information such as pages visited, time on site, and referral sources. This data is aggregated and anonymized. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

Marketing & Lead Capture

We use HubSpot for lead capture forms (such as our waitlist signup) and marketing automation. HubSpot may place cookies to track form submissions, email engagement, and website activity to personalize your experience and communications. You may manage your cookie preferences through your browser settings.

Managing Cookies

Most web browsers allow you to control cookies through their settings. Note that disabling certain cookies may limit your experience on our website.

07Telehealth, Recordings & Virtual Encounters

Certain Good Faith Exams, follow-ups, and coaching sessions may be conducted via synchronous telehealth (video or phone). By participating in a telehealth encounter with ALYZE, you acknowledge the following:

• Telehealth services are provided only in states where the treating Clinician holds an active, unrestricted license.
• We use HIPAA-aligned video platforms with encryption in transit; however, no electronic communication is 100% secure.
• Telehealth visits may be documented in your medical record; any audio or video recording of a visit will occur only with your separately-obtained consent and will be stored as part of your PHI.
• Still images and clinical photography captured to document treatment response (for example, MedSpa before / after or injection-site monitoring) are maintained in your chart and are not used for marketing without a separate, written photo-release.

08Messaging Consent (TCPA / SMS)

By providing your mobile phone number to ALYZE — whether at enrollment, on a waitlist form, during booking, or in your member profile — you expressly consent to receive calls and text messages from ALYZE related to your care, your membership, and, where you separately opt in, marketing communications. This is done in compliance with the Telephone Consumer Protection Act (TCPA).

• Message types: appointment reminders, schedule changes, clinical follow-up, billing notices, facility alerts, and (with opt-in) promotional messages about ALYZE services and events.
• Frequency: message frequency varies based on your activity and enrollment.
• Cost: standard message and data rates may apply per your wireless carrier.
• Opt-out: you may reply STOP to any marketing SMS from ALYZE to unsubscribe, or HELP for assistance. Opting out of marketing SMS does not stop essential treatment, billing, or safety messages related to active care.
• Carriers: wireless carriers are not liable for delayed or undelivered messages.

09Data Retention Periods

We retain personal information and PHI only as long as necessary to fulfill the purposes described in this Policy, to comply with our legal and regulatory obligations, and to support the ongoing clinical relationship. General retention periods include:

• Adult medical records: retained for a minimum of seven (7) years after the last date of service, or longer where required by Utah law or applicable federal regulation.
• Minor medical records (where applicable to covered persons under 18): retained until the patient reaches the age of majority plus the applicable statutory period.
• CLIA laboratory records and quality-control data: retained for the period required by CLIA regulations (generally at least two years for test records and longer for pathology or cytology).
• Adverse Event and incident reports: retained for a minimum of ten (10) years and consistent with our liability-carrier requirements.
• Signed consents, waivers, and Membership Agreements: retained for the duration of membership plus the applicable statute-of-limitations period.
• Billing and financial records: retained in accordance with applicable tax and accounting rules (typically seven years).
• Marketing and website analytics data: retained in aggregated or anonymized form for as long as necessary for business analysis; identifiable marketing data is deleted upon opt-out request.

Upon expiration of the applicable retention period, records are securely destroyed in a manner designed to prevent re-identification.

10Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information, subject to legal retention requirements
• Opt-out: Unsubscribe from marketing communications at any time
• Data portability: Request your data in a commonly used, machine-readable format
• Restrict processing: Request that we limit how we use your data in certain circumstances

For PHI-related requests, additional rights may apply under HIPAA, including the right to request amendments, obtain an accounting of disclosures, and request restrictions on certain uses. Please refer to our Notice of Privacy Practices or contact our Privacy Officer.

To exercise any of these rights, please contact us at privacy@alyze.health. We will respond within 30 days.

11Children's Privacy

ALYZE does not provide services to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a minor, please contact us immediately at privacy@alyze.health, and we will promptly delete such information.

12Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. When we make material changes, we will notify members via email and update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

13Contact Information

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

ALYZE Holdings LLC
155 W 500 S #3
Bountiful, UT 84010
privacy@alyze.health
alyze.health