Privacy Policy

This Privacy Policy describes how Suros Rx LLC ("Suros Rx," "SUROS Rx," "we," "our," or "us") collects, uses, discloses, and protects information when you visit surosrx.com, use other Suros Rx websites or applications that expressly link to this Privacy Policy, communicate with us, or use the services covered by this Privacy Policy. We refer to these websites, applications, and services collectively as the "Services."

This Privacy Policy also applies to an affiliate's activities only where that affiliate expressly identifies this Privacy Policy as applying to those activities. It does not automatically apply to another website or brand solely because it has common ownership.

This Privacy Policy should be read together with our Terms and Conditions and any additional privacy or consent notices presented when you use a particular service. Please read it carefully to understand how we handle information. Certain information is necessary to provide the Services; declining to provide it or requesting its deletion may limit the Services available to you.

1. Relationship to Our HIPAA Notice and Health Information

Suros Rx connects patients with independent licensed healthcare providers. Clinical decisions are made by the treating provider, and prescription medications are dispensed by pharmacy partners when prescribed and where available.

Our separate HIPAA Privacy Policy / Notice of Privacy Practices describes the uses and disclosures of protected health information ("PHI"), associated privacy duties, and your medical-privacy rights. Healthcare providers and pharmacies may also furnish their own notices.

This general Privacy Policy supplements that notice; it does not replace, amend, or reduce the protections described in it. For PHI, the applicable HIPAA notice and applicable health-privacy law govern. The general provisions below concerning marketing, analytics, affiliates, advertising, research, and business transfers do not authorize a use or disclosure of PHI that is prohibited by law or the applicable HIPAA notice.

Some information related to health may be protected by state privacy or consumer-health-data laws even when HIPAA does not apply. We handle that information subject to applicable requirements, including any required separate notices, consents, or authorizations. Neither using our Services nor accepting a cookie banner, by itself, constitutes a HIPAA authorization or other separately required authorization to disclose health information.

2. Information We Collect and Its Sources

The information collected depends on the Services you use, the features available, and what you choose to provide. References below to optional features apply only when those features are offered and used.

Information you provide

We collect information provided when you register or manage an account, purchase products or services, request treatment, complete intake materials, communicate with us or a provider through the Services, request support, or submit forms. Where offered, we also collect information from surveys, research participation, reviews, uploads, public contributions, promotions, and employment applications.

This information may include:

• Identifiers and contact details: name, mailing or shipping address, telephone number, email address, date of birth, and account identifiers.
• Account and verification information: login credentials and information needed to verify your identity or administer your account.
• Health information: information about medical conditions, physical or emotional characteristics, treatment requests, physician referrals, prescriptions, laboratory results, photographs submitted for care, and other health information you provide in connection with the Services.
• Billing and payment information: billing address, transaction details, and payment information processed by payment providers, such as card number, expiration date, and verification information.
• Commercial information: purchases, orders, subscriptions, payment status, and related transactions.
• Demographic information: age, gender, and other information supplied in connection with a service.
• Communications and support information: messages, questions, feedback, and information supplied during customer-support interactions.
• Voluntary submissions: survey responses, application materials, images, reviews, and other content you choose to provide.

Information submitted directly to an independent healthcare provider, pharmacy, or payment processor may also be subject to that party's privacy notice. See Section 7.

Information collected automatically

When you access the Services, we and providers supporting the Services collect technical and usage information. Depending on the service and tools in use, this may include IP address, browser type and language, operating system, device identifiers, referring and exit pages, pages viewed, clicks, downloads, time spent, search terms entered on the site, dates and times of access, and diagnostic or error logs.

If we offer an application covered by this Privacy Policy, its technical information may also include application version, device type, update activity, and interactions with application features.

We may derive approximate location, such as city, state, or country, from an IP address. If a feature requests precise device location, we request permission before collecting it. You may manage device-location permissions in your device settings. Health and sensitive-information protections still apply to location information where applicable.

Cookies and similar technologies

We and providers supporting the Services may use cookies, server logs, pixels, tags, software development kits, and similar technologies for the purposes described in Sections 3 and 4.

Cookies are small files stored on your browser or device. Pixels and similar technologies can record interactions such as page views, clicks, or email opens. Software development kits provide functions within an application and may collect associated technical information.

Depending on the tools in use, these technologies support essential functionality, security, account sessions, preferences, performance measurement, analytics, and permitted marketing activities. Their use remains subject to applicable consent requirements and your privacy choices.

Social media and other sources

When you interact with our social media pages or submit information through a social platform, we may receive information made available through that interaction, such as your name, profile information, comments, messages, and contact details.

We may also receive information from healthcare providers, pharmacies, technical and support providers, payment processors, analytics or marketing providers, and other sources involved in delivering the Services, as permitted by law. Such information may be combined with information we already hold, subject to the same applicable protections and choices.

3. How We Use Information

Subject to Section 1 and applicable law, we use information to:

• Operate, administer, maintain, and improve the Services.
• Create and manage accounts, verify identity, process payments, fulfill orders, and provide customer service.
• Facilitate access to independent healthcare providers and pharmacies, including appointment coordination, communications, treatment-related support, and permitted payment and healthcare operations.
• Respond to questions and send service, account, order, security, and administrative communications.
• Understand use of the Services, troubleshoot problems, evaluate performance, and improve content and functionality.
• Conduct internal analysis, surveys, and research, subject to applicable health-information and research requirements.
• Send permitted communications about our products, services, surveys, promotions, and events, and, where lawful and applicable, those of affiliates or partners, subject to your choices and required consent.
• Measure and improve permitted marketing and advertising, subject to the limitations in Sections 1 and 4.
• Detect and prevent fraud, misuse, security incidents, and unauthorized activity.
• Comply with legal obligations, respond to valid legal requests, and establish, exercise, or defend legal rights.

Information collected for one purpose is not automatically available for every other purpose described here. Where an additional consent, authorization, or notice is required, we obtain or provide it before the relevant processing.

Aggregated and de-identified information

We may create aggregated or de-identified information for analysis, service improvement, research, and other lawful purposes. Information is treated as de-identified only when it meets the requirements of applicable law. We maintain it in de-identified form and do not attempt to reidentify it except as permitted by law.

Where permitted, we may share appropriately aggregated or de-identified results with service providers, research partners, or other third parties. Removing a name, hashing an email address, or substituting a device identifier does not, by itself, establish that information is legally de-identified. Any use of PHI to create de-identified information remains subject to applicable health-privacy requirements.

4. Online Analytics, Advertising, and Tracking Choices

Analytics

We may use service providers to help understand website performance, usage patterns, and the effectiveness of communications. Depending on the tools in use, this may involve cookies, device identifiers, and similar technologies.

Marketing emails may contain tools that measure opens or link clicks. Email application privacy settings may affect these measurements. You may unsubscribe from marketing email as described in Section 6.

Advertising

Where used and permitted, advertising technologies may help deliver or measure advertisements for Suros Rx on our Services or other websites and applications. Such technologies may process online identifiers, device and browser information, and interactions with content.

Advertising services may involve activity across websites or devices. Depending on applicable law and the actual data flow, making information available to advertising partners may constitute a "sale," "sharing," or processing for targeted advertising even if no money is exchanged.

Any audience matching or similar advertising activity involving contact information remains subject to applicable law, your choices, and the health-information restrictions in Section 1. We do not treat hashed contact information as automatically anonymous or de-identified. This Privacy Policy does not grant advertising partners unrestricted access to intake information, patient communications, medical records, or other protected information.

Your controls

You may use browser settings to block or delete cookies and device settings to manage location or advertising permissions. Blocking cookies may affect account access, preferences, or other functionality. If a Service presents additional cookie or privacy controls, those controls provide choices for that Service.

You may also contact us at support@surosrx.com to request applicable privacy choices, including opting out of sale, sharing, or targeted advertising. Applicable rights are described in Sections 10 and 11. An advertising opt-out does not necessarily stop all advertisements; it limits the relevant use of information.

Third-party browser and advertising controls may apply only to a particular device or browser. Clearing cookies or changing devices can affect saved preferences. Industry advertising opt-outs do not replace rights or mechanisms required by applicable law.

Browser privacy signals

Traditional "Do Not Track" signals are distinct from legally recognized opt-out preference signals such as Global Privacy Control. The Services do not generally respond to traditional Do Not Track signals. Where applicable law requires recognition of an opt-out preference signal, such a signal must be treated as a request to opt out of the processing covered by that law. You may contact us with questions about a signal or an opt-out request.

Additional health-information safeguards

Information collected through tracking technologies can be subject to health-privacy protections. Where HIPAA or other applicable health-privacy law applies, disclosures to analytics, advertising, or technology providers must satisfy those requirements. Listing a technology in a policy or obtaining general cookie consent does not replace a required authorization, agreement, or other legal basis for disclosure.

5. How We Share Information

Subject to Section 1 and applicable law, information may be disclosed as follows:

Healthcare providers and pharmacies. We share information as needed to facilitate services you request, coordinate appointments, route communications, support prescription fulfillment, and carry out permitted treatment, payment, and healthcare operations.

Service providers. Providers may process information on our behalf for hosting, storage, technology, security, payment processing, customer support, delivery, analytics, permitted marketing, research support, auditing, and professional services. Access is limited to the information appropriate to the services performed and applicable legal and contractual requirements. Where a business associate agreement or other agreement is required, that requirement applies.

Affiliates. We may share information with affiliates involved in providing or supporting the Services, subject to applicable law, confidentiality obligations, and your choices. Common ownership does not remove restrictions on sharing health or other sensitive information or authorize its use for another brand's marketing.

Advertising and analytics partners. Where permitted and used, we may disclose information for the purposes described in Section 4, subject to applicable opt-out, consent, and health-information requirements.

Legal, safety, and security purposes. We may disclose information when required or permitted by law to respond to valid legal process, prevent fraud or security threats, enforce agreements, or protect legal rights and safety. A request from a third party or authority does not by itself eliminate applicable confidentiality or authorization requirements.

Business transactions. Information may be disclosed or transferred in connection with a proposed or completed merger, acquisition, financing, reorganization, sale of assets, or similar transaction, subject to applicable confidentiality, notice, consent, and health-information restrictions.

Public content. If a Service offers public reviews, comments, or similar features, information you choose to make public may be visible to other people and search engines. Avoid posting sensitive information. Any reuse of a submission in testimonials or marketing remains subject to applicable permissions and law; posting content does not waive health-privacy protections.

Your direction or consent. We may disclose information when you direct us to do so or provide the required consent or authorization.

Aggregated or de-identified information. We may share information meeting the standards and restrictions described in Section 3.

6. Marketing and Communication Choices

You can opt out of promotional email by following the unsubscribe instructions in the message or contacting support@surosrx.com. You may also contact us about promotional postal mail or telephone communications.

If you separately enroll in text communications, follow the opt-out instructions provided with that program. Any applicable messaging terms and consent requirements continue to apply.

Opting out of marketing does not prevent necessary communications about an active account, transaction, care coordination, security, legal notices, or a request you made. Marketing preferences do not change any separate rights concerning confidential medical communications.

7. Third-Party Services and Healthcare Partners

Our Services may link to or interact with services operated by independent providers, pharmacies, payment processors, social platforms, and other third parties. Their handling of information may be described in their own privacy notices, terms, and consents. Please review those materials when using their services.

This Privacy Policy describes our handling of information. It does not replace an independent provider's HIPAA notice or make us responsible for every unrelated third-party practice. Equally, use of a vendor or link to another service does not remove our responsibilities for information we disclose or for processing performed on our behalf.

8. Security, Secure Communications, and Breach Notices

We use technical, administrative, and organizational safeguards designed to protect information against unauthorized access, disclosure, alteration, loss, or destruction. For electronic transmission of PHI, we use SSL/TLS or equivalent encryption and applicable security safeguards, consistent with the commitments in our HIPAA notice.

No internet transmission or storage system can be guaranteed completely secure. This limitation does not waive our legal responsibilities. Protect your account credentials and notify us if you suspect unauthorized account access.

Please do not include sensitive medical information, passwords, or full payment details in ordinary email. Use the patient portal or an appropriate secure channel for medical communications, or contact support for instructions.

Sending an email request for medical records does not automatically authorize us or a healthcare partner to return those records by unencrypted email. Record delivery is arranged through the applicable identity-verification and release process. If you request an unencrypted delivery method, any necessary discussion of risks and confirmation of your choice will occur separately.

If a breach or security incident requires notice under applicable law, we will provide the required notices. Your rights concerning a breach of PHI are also addressed in the HIPAA notice.

9. Your Health-Information Rights and Complaints

The detailed medical-privacy provisions remain in our HIPAA Privacy Policy / Notice of Privacy Practices. Subject to applicable law and the circumstances, those rights include:

• Accessing and obtaining a copy of medical information, including an available electronic copy.
• Requesting an amendment to inaccurate or incomplete medical information.
• Requesting an accounting of certain disclosures.
• Requesting restrictions on uses or disclosures, including applicable restrictions involving services paid in full out of pocket.
• Requesting confidential communications through an alternative method or location.
• Obtaining a paper copy of the HIPAA notice.
• Receiving required notice of a breach affecting PHI.
• Filing a privacy complaint without retaliation.

Medical uses and disclosures—including treatment, payment, healthcare operations, and legally permitted public-interest disclosures—remain governed by the HIPAA notice and applicable law. This general policy does not expand those permissions.

Additional state protections may apply to medical information, including mental health, HIV-related, genetic, substance-use, and other sensitive records, as well as certain services provided to minors. The HIPAA notice contains state-specific provisions, including provisions addressing California, New York, Texas, Florida, Illinois, and Massachusetts. Those provisions and applicable law remain in effect; they are not displaced by this general policy.

To ask about medical records or exercise a medical-privacy right, contact us using Section 14. We may direct your request to the treating provider, pharmacy, or other record custodian where appropriate. We may need to verify your identity, authority, and the scope of the request.

You may complain to our Privacy Officer using the contact information below. For concerns within HIPAA's scope, you may also complain to the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a privacy complaint.

10. Privacy Information for California Residents

This section describes California privacy rights to the extent the California Consumer Privacy Act, as amended ("CCPA"), applies to us and the information involved. Certain medical information and other information may qualify for specific legal exemptions. The existence of a health-information exemption does not mean all information collected through the Services is exempt.

Information categories

Depending on your use of the Services, the categories described in Section 2 may include the following. Disclosures remain limited by Sections 1 and 5.

The sources, purposes, and retention criteria for these categories are described in Sections 2, 3, 5, and 12. Not every category is collected from every person, and not every listed recipient receives every item in a category.

Your rights

Where the CCPA applies, you may have the right to:

• Know about and access personal information collected about you, including categories, sources, purposes, and recipients.
• Obtain a copy of covered personal information in a usable format.
• Request deletion, subject to legal exceptions.
• Request correction of inaccurate personal information.
• Opt out of a sale or sharing of personal information.
• Limit certain uses and disclosures of sensitive personal information.
• Exercise your rights without unlawful discrimination.

Sale, sharing, and sensitive information

We do not sell names, email addresses, telephone numbers, or postal addresses for money. However, disclosures of online identifiers or other information for advertising can constitute a sale or sharing under California law without a monetary payment, as explained in Section 4.

Where applicable, you may request an opt-out of sale or sharing by contacting support@surosrx.com, and you may use a legally recognized opt-out preference signal as provided by applicable law. Any additional privacy controls displayed on a Service may also be used. These rights apply alongside, and do not replace, stricter protections for health information.

Uses of sensitive personal information remain subject to applicable restrictions and any required consent. Where a right to limit applies, you may submit a request using the contact information below.

Requests and authorized agents

Submit requests to support@surosrx.com or write to the address in Section 14. Please identify the right you want to exercise and provide enough account or contact information for us to locate the relevant records. Do not include sensitive medical information or identity documents in an ordinary email.

We may need to verify identity or authority for requests involving access, correction, or deletion. We will request only information reasonably necessary for that purpose and explain an appropriate submission method. An authorized agent may submit a request where permitted by law; we may require proof of authorization and any legally permitted verification.

We will respond within applicable legal time limits and explain a denial or limitation where required. Deletion may be limited by requirements to retain medical, transaction, security, or other records. Requests for medical records follow the applicable medical-record process; they do not constitute consent to unencrypted email delivery.

California "Shine the Light"

We do not share personal information with third parties for their own direct marketing purposes. California residents may contact us for information concerning applicable rights under California's Shine the Light law.

11. Nevada and Other State Privacy Rights

Nevada

We do not sell personally identifiable information for monetary consideration to a person for that person to license or sell it to additional persons in the manner addressed by Nevada's online-privacy sale opt-out law. Nevada consumers may nevertheless submit an opt-out request concerning any future covered sale to support@surosrx.com. We may verify the request as permitted by law and will maintain applicable requests if our practices change.

This paragraph concerns that particular sale definition. It does not limit any separate rights under Nevada consumer-health-data law or other applicable law.

Other states

Depending on your state of residence, the information involved, and whether a particular law applies, you may have rights to access, correct, delete, or obtain a copy of personal information; opt out of certain sales, targeted advertising, or profiling; limit or withdraw consent to certain processing of sensitive or consumer health data; or appeal a decision on a privacy request.

Submit a request using Section 14. If an applicable law gives you an appeal right, contact us with the subject "Privacy Request Appeal" and identify the request and decision you wish to appeal. We will handle requests and appeals within applicable legal time limits and provide information about further complaint options where required.

Healthcare and consumer-health-data laws may require protections or separate notices beyond this general policy. Nothing in this policy removes those requirements or limits applicable rights.

12. Retention of Information

We retain information for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing requested Services, maintaining account and transaction records, meeting healthcare and other legal obligations, preventing fraud, resolving disputes, and enforcing agreements.

Retention depends on the type and sensitivity of information, the reason for collection, ongoing service needs, applicable recordkeeping requirements, and legal claims or holds. Different categories may have different retention periods. Healthcare providers and pharmacies may have independent obligations to retain medical and dispensing records.

When information is no longer needed, it is deleted or de-identified as appropriate, subject to applicable law and secure backup or archival processes. A deletion request does not override a legal requirement to retain a record.

13. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our Services, information practices, or applicable law. The current version will be posted on this page with its effective and last-updated dates.

We will provide additional notice of material changes and obtain consent where required by law. Posting an updated policy or your continued use of the Services does not substitute for a separate consent or authorization required by law.

Updates to this general Privacy Policy do not themselves change our separate HIPAA Privacy Policy / Notice of Privacy Practices.

14. Contacting Us

For questions, privacy requests, or complaints, contact:

Suros Rx LLC — Attn: Privacy Officer7901 4TH ST N STE 300St. Petersburg, FL 33702

Email: support@surosrx.comWebsite: surosrx.com

Please do not send sensitive medical information through ordinary email. Contact us for the appropriate secure method or use the patient portal for medical communications.