Privacy Policy

Beema Health, Inc. ("Beema Health," "we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit our websites, use our applications, or interact with our weight-management telehealth services (collectively, the "Service").

This Policy applies alongside our Terms of Service and Telehealth Consent. Where clinical care is delivered by independent Providers or medical groups, those parties may also maintain their own privacy notices for information they control as covered entities or custodians under applicable law.

The information we collect depends on how you use the Service. It may include:

Information you provide. Name, email, phone number, date of birth, sex, address, account credentials, intake and health-history responses, photos or documents you upload, payment details, communications with clinicians and support, and preferences you set in your account.

Health and clinical information. Weight, BMI, symptoms, medication history, allergies, lab results, prescription and refill status, progress logs, and other data needed to evaluate eligibility and deliver care.

Information collected automatically. Device identifiers, browser type, IP address, general location derived from IP, pages viewed, referral URLs, session timestamps, and diagnostic data about app or site performance.

Information from third parties. Payment confirmation from processors, identity or fraud-prevention signals, pharmacy or laboratory fulfillment updates, and information you authorize us to receive from other healthcare sources.

We use personal information to:

• Provide, operate, and improve the Service, including intake, clinical coordination, billing, and refill support.
• Connect you with licensed Providers and Care Partners in your state.
• Verify identity, prevent fraud, and maintain the security of accounts and systems.
• Communicate about appointments, prescriptions, lab orders, billing, and support requests.
• Send service-related notices and, where permitted, marketing about Beema Health products and features.
• Analyze usage to improve performance, accessibility, and patient experience.
• Comply with legal obligations, respond to lawful requests, and enforce our agreements.
• Create de-identified or aggregated data that does not reasonably identify you.

We do not use your protected health information with third-party AI services unless there is a signed business associate agreement and an approved, compliant architecture. Where automated tools assist with non-clinical tasks, human review is required before clinical or compliance-sensitive content is sent externally.

We may share information with:

• Providers, medical groups, pharmacies, and laboratories involved in your care.
• Vendors that help us operate the Service, such as hosting, payment, messaging, analytics, and customer-support providers bound by contractual confidentiality and security obligations.
• Professional advisors, auditors, or insurers where reasonably necessary.
• Law enforcement, regulators, or others when required by law or to protect rights, safety, and security.
• A successor entity in connection with a merger, acquisition, or asset sale, subject to this Policy.

We do not sell your personal information for money. We do not share PHI with advertisers.

Some information you provide may be PHI under the Health Insurance Portability and Accountability Act ("HIPAA") when handled by a covered entity or business associate. Beema Health may act as a business associate to certain Care Partners and, in that role, use and disclose PHI only as permitted by HIPAA and our agreements.

HIPAA does not apply to every organization that handles health-related data. Information that is not PHI or otherwise protected under applicable law may be handled as described in this Policy. De-identified information created in accordance with HIPAA is not PHI.

Residents of certain states with consumer health data laws may have additional rights regarding "consumer health data" or similarly defined sensitive health information.

Depending on your state, you may have the right to confirm whether we process consumer health data, access a copy, request deletion, withdraw consent for certain processing, or obtain a list of categories of third parties with whom data has been shared. We may need to verify your identity before fulfilling a request.

Some data is required to provide the Service. If you delete required information or withdraw consent for essential processing, we may be unable to continue your care through Beema Health.

We use cookies, local storage, and similar technologies to keep you signed in, remember preferences, measure traffic, and improve the Service. You can control cookies through browser settings, but disabling them may limit functionality.

We may use analytics providers to understand how the Service is used. Where required, we will obtain consent before using non-essential cookies or similar tracking technologies.

Depending on where you live, you may have the right to:

• Access personal information we maintain about you.
• Correct inaccurate information.
• Request deletion of certain information, subject to legal and clinical record-retention requirements.
• Opt out of promotional communications.
• Receive a portable copy of information you provided.
• Appeal or lodge a complaint if we decline a request, where applicable.

To exercise these rights, contact support@beemahealth.com. We will respond within the timeframe required by applicable law.

We retain information for as long as needed to provide the Service, comply with legal and regulatory obligations, resolve disputes, and enforce agreements. Clinical and billing records may be kept for longer periods as required by healthcare, tax, or licensing laws. When data is no longer needed, we delete or de-identify it using reasonable safeguards.

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest for sensitive systems, role-based access controls, and audit logs for clinical and administrative actions. We avoid logging PHI in application logs.

No method of transmission or storage is completely secure. You are responsible for maintaining the confidentiality of your account credentials and for using secure channels when communicating with us.

The Service is intended for adults 18 and older unless a parent or legal guardian provides consent where permitted by law. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, contact us so we can delete it.

Beema Health is based in the United States and the Service is directed to U.S. residents. If you access the Service from outside the United States, you understand that information may be processed in the U.S. and other locations where we or our vendors operate.

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated Policy on the Service and revise the "Last updated" date. Your continued use after changes become effective means you accept the updated Policy.

For privacy questions or requests, contact:
Beema Health, Inc.
Email: support@beemahealth.com