Precisionbio Clinic (“**Precisionbio**”, “**we**”, “**our**”, or “**us**”) is committed to protecting your privacy and the confidentiality of your health information. This Privacy Policy and Notice of Privacy Practices describes how we collect, use, disclose, and protect your information when you receive services from us in the United States and Mexico and when you use our website at https://precisionbioclinic.com.

By using our services or our Site, you acknowledge that you have read and understood this Policy and Notice.

1. Scope and Legal Framework

This Policy applies to all personal information and health information we handle in connection with:

- Medical and dental care, diagnostics, telehealth/telemedicine, and related services provided by Precisionbio in the United States and Mexico.

- Use of our Site, online forms, patient portals, telehealth platforms, messaging tools, and digital marketing channels operated by Precisionbio.

Precisionbio acts as a healthcare provider and, when applicable, as a covered entity or business associate under US law and as a data controller and/or data processor under Mexican law.

This Policy is designed to comply with, as applicable:

- US Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations, including the Privacy, Security, and Breach Notification Rules, as amended.

- US Health Information Technology for Economic and Clinical Health (HITECH) Act and subsequent regulations and guidance.

- Mexico’s Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP) and its regulations, as updated.

- Applicable Mexican Official Standards (Normas Oficiales Mexicanas), including health record and confidentiality standards.

- Guidelines and requirements issued by COFEPRIS and relevant Mexican authorities.

- Other applicable federal, state, and local privacy, consumer protection, and health laws.

If there is a conflict between this Policy and applicable law, the stricter standard will apply to protect your information.

2. Types of Information We Collect

We may collect the following categories of information:

2.1. Personal Identification Information

- Full name, date of birth, age, gender.

- Government-issued identification (e.g., passport, driver’s license, CURP, other IDs).

- Contact information such as physical address, email address, and telephone numbers.

2.2. Health and Medical Information (Protected Health Information / PHI)

- Medical history, diagnoses, treatment plans, medications, allergies, laboratory and imaging results.

- Dental, surgical, and procedural records.

- Clinical notes, progress notes, and physician/dentist/nurse documentation.

- Insurance information, policy numbers, and payer details.

- Photographs, videos, or other images used for diagnosis, treatment, or clinical documentation.

2.3. Technical and Usage Information

- IP address, device identifiers, browser type, operating system, and access times.

- Pages visited, interactions with forms, clicks on links, and preferences on the Site.

- Cookies, pixels, and similar technologies, including analytics and tracking tools, when permitted by law and your consent.

2.4. Financial and Billing Information

- Billing addresses and payment-related information (handled via secure payment processors).

- Insurance claims and payment history related to your care.

2.5. Sensitive Personal Data

Certain information we handle is considered sensitive personal data or specially protected information, including:

- Health and genetic data.

- Biometric data (e.g., photographs used for clinical purposes).

- Information about disability.

Where required by law, we will request your express written consent for processing sensitive personal data, especially for secondary purposes such as marketing.

3. How We Obtain Your Information

We collect information in several ways, including:

- Directly from you, when you complete forms, book appointments, communicate with staff, participate in telehealth visits, or provide information in person, by phone, or electronically.

- From other healthcare providers, laboratories, diagnostic centers, and pharmacies involved in your care.

- From insurers, payers, or other entities involved in billing, claims, or case management.

- From our website and digital tools through cookies, pixels, and similar technologies.

- From authorized third parties, referral partners, and, when allowed, from public or commercial sources.

4. How We Use Your Information

4.1. Uses for Treatment, Payment, and Healthcare Operations (HIPAA)

We may use and disclose your PHI, without additional authorization, for:

- Treatment:

- Providing, coordinating, and managing your medical and dental care.

- Sharing information among our clinicians, specialists, and staff.

- Referrals to other providers, hospitals, or diagnostic centers.

- Payment:

- Billing you or your insurance company for services.

- Verifying insurance eligibility and coverage.

- Managing claims, reimbursements, and collections.

- Healthcare Operations:

- Quality assessment, improvement, and patient safety activities.

- Training of healthcare professionals and staff.

- Accreditation, licensing, auditing, and regulatory compliance.

- Internal administration, risk management, and cybersecurity.

4.2. Uses Required or Permitted by Law

We may use or disclose your information when required or permitted by law, including:

- Public health reporting, disease control, and reporting adverse events.

- Reporting abuse, neglect, or domestic violence as required.

- Responding to court orders, subpoenas, or legal processes.

- Cooperating with health authorities, regulators, and oversight agencies.

- Meeting national security, law enforcement, or other government requirements, when allowed.

4.3. Uses With Your Authorization

For uses and disclosures not described above, we will obtain your written authorization, including:

- Most marketing communications that use your PHI.

- Sale of PHI, where prohibited without authorization.

- Certain research activities that require explicit consent.

You may revoke your authorization at any time in writing, except where we have already relied on it.

4.4. Use for Marketing and Communications

When allowed by law and consent requirements, we may use your contact information to:

- Send appointment reminders, pre- and post-procedure instructions, and patient education.

- Inform you of new services, programs, or promotions that may be relevant to your care.

You may opt out of non-essential marketing communications at any time by following the instructions in the communication or contacting us directly. Opting out will not affect necessary clinical or administrative communications.

5. How We Share Your Information

We may share your information only as permitted by law and for the purposes described in this Policy:

- With other healthcare providers and facilities involved in your treatment.

- With insurers, payers, and third-party administrators for billing and payment.

- With laboratories, imaging centers, and diagnostic providers.

- With our vendors and service providers (e.g., IT providers, cloud hosting, analytics, telehealth platforms, SMS/email services), who are contractually obligated to protect your data and use it only for authorized purposes.

- With legal, financial, and regulatory authorities when required.

- With family members, guardians, or caregivers when you authorize it or when allowed by law (e.g., emergencies or incapacity).

- We do not sell your PHI.

6. International Data Transfers: US–Mexico and Other Countries

Precisionbio may transfer your personal data across borders, including between the United States and Mexico and, where applicable, to other countries where our service providers operate.

When we transfer

- We only do so when necessary for medical care, diagnostics, billing, or healthcare management, or in other cases permitted by law.

- We implement appropriate safeguards such as contractual commitments, minimum necessary standards, and technical and organizational security measures.

- We comply with HIPAA, LFPDPPP, and other applicable data transfer rules, including consent and notification requirements when required.

By receiving our cross-border services or using our Site, you acknowledge that your data may be processed in countries with different privacy laws than your home country; however, we will protect your information as described in this Policy.

7. Your Rights Under US Law (HIPAA)

Under HIPAA, you have certain rights with respect to your PHI:

7.1. Right to Access

You have the right to request access to and obtain copies of your PHI in a designated record set.

- Requests must be submitted in writing to the contact in Section 13.

- We will provide access within the timeframe required by law, subject to limited exceptions.

7.2. Right to Request Amendments

If you believe your information is inaccurate or incomplete, you have the right to request an amendment.

- We may deny your request in specific situations and will explain the reason in writing.

7.3. Right to an Accounting of Disclosures

You may request a list (“accounting”) of certain disclosures of your PHI made during a specified period, excluding disclosures for treatment, payment, healthcare operations, and certain other exceptions.

7.4. Right to Request Restrictions

You may request restrictions on how we use or disclose your PHI for treatment, payment, or healthcare operations.

- We are not required to agree to all requested restrictions, but if we do agree, we will comply except in emergencies or as required by law.

7.5. Right to Request Confidential Communications

You may request that we communicate with you through alternative means (e.g., a different phone number or address) or in a particular format. We will accommodate reasonable requests.

7.6. Right to a Paper or Electronic Copy of this Notice

You have the right to obtain a paper copy of this Notice at any time, even if you previously agreed to receive it electronically.

To exercise these rights, contact us using the information in Section 13.

8. Your Rights Under Mexican Law (LFPDPPP and Related Norms)

If your data is processed in Mexico or under Mexican jurisdiction, you have the following ARCO rights:

8.1. Right of Access

You may request confirmation of whether we process your personal data and, if so, access to such data and information about its processing.

8.2. Right of Rectification

You may request that we correct your data if it is inaccurate or incomplete, providing documentation as necessary.

8.3. Right of Cancellation

You may request that your data be canceled when you consider it is not required for the purposes stated in this Policy, or when you withdraw consent, subject to legal and medical record retention requirements.

8.4. Right of Opposition

You may oppose the processing of your data for specific purposes (e.g., marketing), or when you have a legitimate and justified reason, in accordance with law.

8.5. Exercising ARCO Rights

To exercise ARCO rights, please send a written request to the contact in Section 13 that includes:

- Your full name and contact information.

- Proof of identity (and, where applicable, legal representation).

- A clear description of the data and right you wish to exercise.

- Any supporting documents.

We will respond within the timeframes and procedures established by Mexican law.

9. Cookies, Tracking Technologies, and Online Data

Our Site and digital services may use cookies, pixels, and similar technologies to:

- Enable core functionality such as session management and security.

- Analyze Site usage and improve performance and user experience.

- Deliver or measure digital communications and campaigns, where permitted.

Some cookies are strictly necessary; others (e.g., analytics or advertising cookies) may require your consent depending on applicable law. You can manage your browser settings to limit or block cookies; however, some features of the Site may not function properly.

When tracking tools interact with health-related data, we apply heightened safeguards to avoid improper disclosure of PHI and to comply with HIPAA and other privacy requirements.

10. Data Security Measures

Precisionbio uses a combination of administrative, technical, and physical safeguards designed to protect your information against

unauthorized access, loss, misuse, or disclosure. These measures include, as appropriate:

- Access controls and role-based permissions for staff and providers.

- Multi-factor authentication (MFA) for systems containing electronic PHI, where applicable.

- Encryption of data in transit and at rest, using industry-standard cryptography where feasible.

- Secure networks, firewalls, anti-malware tools, and intrusion detection systems.

- Regular security assessments, audits, and vulnerability management.

- Secure backup and disaster recovery processes.

- Policies and training for staff on confidentiality, data protection, and incident response.

No system can be guaranteed to be 100% secure, but we strive to maintain robust safeguards and continuously improve our security posture.

11. Data Retention and Record Storage

We retain your information for as long as necessary to:

- Provide medical and dental care and related services.

- Comply with legal, regulatory, and professional requirements for medical record retention in the US and Mexico.

- Resolve disputes, enforce our agreements, and support our legitimate business interests.

When data is no longer needed, we will securely delete, anonymize, or archive it in accordance with applicable law and industry standards.

12. How to Contact Us, File a Complaint, or Exercise Your Rights

If you have questions about this Policy, wish to exercise your rights, or have a concern about how your information has been handled, you may contact:

Zitroz Medical S.A.P.I. de C.V., (in Mexico)

Zitroz, Inc. (In USA).

12.1. Complaints Under US Law

If you believe your privacy rights under HIPAA have been violated, you may file a complaint:

- Directly with Precisionbio using the contact details above.

- With the US Department of Health and Human Services, Office for Civil Rights (OCR).

You will not be retaliated against for filing a complaint.

12.2. Complaints Under Mexican Law

If you believe your rights under Mexican data protection law have been violated:

- You may first contact Precisionbio using the details above so we can review and respond.

- You may also contact the competent Mexican authority responsible for supervising personal data protection, according to current law.

We do not retaliate against any person who asserts their privacy rights.

13. Children’s Privacy

Our services are primarily directed to adults and legally competent individuals. When we provide care to minors:

- We obtain consent from parents or legal guardians as required by law.

- We protect the confidentiality of minors’ health information in accordance with US and Mexican legal requirements.

If you believe a child has provided personal data on our Site without appropriate consent, please contact us so we can take appropriate measures.

14. Changes to This Privacy Policy and Notice

We may update or modify this Privacy Policy and Notice from time to time to reflect:

- Changes in our practices or services.

- Changes in legal or regulatory requirements.

- Improvements in our privacy and security measures.

When we make material changes, we will update the “Last Updated” date at the top of this document and, when required, notify you through appropriate channels (for example, via our Site, by email, or in-clinic notices).

Your continued use of our services or Site after changes become effective will constitute acknowledgment of the updated Policy.

15. Language and Interpretation

This Policy may be available in multiple languages. In case of any inconsistency between language versions, the version designated by Precisionbio as the official version will prevail, except where local law requires otherwise.

If you have questions about any section or need assistance understanding this Policy, please contact us using the details in Section 13.