Privacy Policy

Effective date: September 10, 2026
Last updated: October 20, 2026

This Privacy Policy explains how Benthos Holdings, Inc., doing business as Benthos Health ("Benthos Health," "we," "us," or "our"), collects, uses, discloses, and protects information about you when you visit benthoshealth.com, use our tools and educational resources, complete a health intake, or otherwise interact with our services (together, the "Services").

Benthos Health is a health information and technology company. We are not a medical practice and we do not practice medicine or pharmacy. Medical services are provided by independent, licensed healthcare professionals, and prescriptions are dispensed by independent, licensed pharmacies. Section 5 explains how information you share with those providers is handled differently from information you share with us.

Please read this policy carefully. By using the Services, you agree to the practices described here. If you do not agree, please do not use the Services.

1. Summary

The short version, for people who want it before the details:

• We collect what you give us (contact details, health intake answers, payment information) and standard technical information about how you use the site.
• We use it to run the Services, to connect you with licensed clinicians and pharmacies when you ask us to, to support you, and to improve what we build.
• We do not sell your personal information, and we do not sell or share your health information for advertising. We do not disclose the answers you give in a health intake, your medications, or your treatment status to advertising networks or data brokers.
• We do use ordinary web analytics and advertising tools on our public pages. We take steps to keep health information out of them, and Section 8 explains how to opt out.
• You have rights over your information — access, correction, deletion, and opt-outs — described in Section 10. They are available to everyone who uses the Services, not only residents of states that require them.
• Questions go to privacy@benthoshealth.com.

This summary is for convenience only. The full policy below governs.

2. Scope of this policy

This policy applies to information we collect through the Services. It does not apply to:

• Information held by treating providers. Independent clinicians and pharmacies that treat you maintain their own records and privacy practices, including their HIPAA Notice of Privacy Practices. See Section 5.
• Third-party sites. We link to outside resources — clinical guidelines, manufacturer pages, government sources. Their privacy practices are their own.
• Employment and business contacts. Information collected from job applicants, vendors, and partners in a business capacity is handled separately.

3. Information we collect

3.1 Information you give us

• Contact and account information — name, email address, phone number, mailing address, date of birth, password or login credentials, and any preferences you set.
• Health information you enter — the answers you provide in an online health intake or eligibility questionnaire. Depending on the questions, this may include height and weight, body mass index, medical history, current and past medications, allergies, prior weight-loss treatments, laboratory results you choose to share, pregnancy status, and other clinical details. It may also include photographs or documents you upload.
• Payment information — billing name and address, and the details needed to process a payment. Card numbers are collected and processed by our payment processors; we receive a token, the card type, and the last four digits, and we do not store full card numbers on our systems.
• Communications — messages you send to support, contact-form submissions, survey and feedback responses, and records of calls or chats with us, which may be recorded or transcribed where permitted by law and where we tell you in advance.
• Tool inputs — figures you enter into our BMI calculator, cost calculator, and similar tools. Where a tool runs entirely in your browser, we say so on the page and those numbers are not transmitted to us.
• Marketing sign-ups — the email address or phone number you give us to receive newsletters, educational content, or updates.

3.2 Information we collect automatically

• Device and connection data — IP address, browser type and version, operating system, device identifiers, language, and general location inferred from IP address (typically city or region, not a precise location).
• Usage data — pages viewed, links clicked, referring and exit pages, search terms used on our site, time spent, and dates and times of access.
• Cookies and similar technologies — cookies, pixels, tags, local storage, and SDKs used to keep you signed in, remember preferences, measure traffic, and understand which content and campaigns are useful. See Section 8.
• Email engagement — whether an email we send was opened and which links were clicked, unless you block remote images.

3.3 Information we receive from others

• Clinical and pharmacy partners — where you have authorized it or where the arrangement permits, we may receive limited information such as whether a consultation was completed, order and shipment status, refill timing, and support issues. We receive clinical detail only as necessary and as permitted by law.
• Payment processors — confirmation of payment, authorization results, chargeback and refund information, and fraud signals.
• Service providers — hosting, email, customer support, identity verification, and fraud-prevention vendors acting on our behalf.
• Advertising and analytics partners — aggregate campaign and traffic measurement, and, where a marketing partner referred you, the fact of the referral.
• You, indirectly — if you interact with us on social platforms or refer a friend, we may receive the information those platforms or that person provide.

3.4 Information we do not want

Please do not send us health information, government identification numbers, or other sensitive details through unsecured channels such as social media messages or general contact forms. Use the secure intake or your account when one is available. If you send us information we did not ask for, we will handle it under this policy and may delete it.

4. How we use information

We use the information described above to:

• Operate, maintain, and secure the Services, including creating and managing your account.
• Determine, at a preliminary and non-clinical level, whether our offerings may be relevant to you, and route your intake to an independent licensed clinician for clinical review where you ask us to.
• Facilitate treatment you request — transmitting your information to the clinician and, if a prescription is issued, to a dispensing pharmacy, and coordinating fulfillment and shipping.
• Process payments, issue refunds, and manage subscriptions and billing disputes.
• Communicate with you about your account, orders, appointments, and support requests. These are transactional messages and are not marketing.
• Send educational content, newsletters, and promotional messages where you have opted in or where otherwise permitted, with an opt-out in every message.
• Provide customer support and respond to your questions and complaints.
• Understand how the Services are used, measure and improve content, tools, and site performance, and develop new features.
• Measure the effectiveness of our marketing, using traffic and conversion data rather than health information.
• Detect, investigate, and prevent fraud, abuse, security incidents, and other unlawful or prohibited activity.
• Comply with legal obligations, including recordkeeping, tax, healthcare, pharmacy, telehealth, consumer protection, and advertising requirements, and to establish, exercise, or defend legal claims.
• Create de-identified or aggregated information that cannot reasonably be used to identify you. We may use and disclose such information for any lawful purpose, including research and reporting, and we will not attempt to re-identify it.

We do not use your health information to train advertising models, to build advertising profiles, or to make automated decisions that produce legal or similarly significant effects about you without human involvement. Clinical decisions are made by licensed clinicians, not by algorithms.

5. Health information, HIPAA, and how the two are different

This section matters, so we have kept it plain.

Some of the information you provide is protected by HIPAA and some is not. The federal Health Insurance Portability and Accountability Act ("HIPAA") applies to healthcare providers, health plans, healthcare clearinghouses, and their business associates. It does not apply to every company that holds health information.

• Information you provide to a treating clinician or pharmacy through the Services — your intake answers once they are transmitted for clinical review, your consultation, your prescription, and your pharmacy records — becomes part of that provider's medical or pharmacy record. Those providers are independent covered entities under HIPAA. Their use and disclosure of that information is governed by HIPAA and by their own Notice of Privacy Practices, which they provide to you directly. Requests to access, amend, or obtain an accounting of those records should be directed to the provider that holds them; we will help you route the request.
• Our own role. Benthos Health is not a healthcare provider, health plan, or healthcare clearinghouse. Under our written agreement with our clinical network, the parties have expressly agreed that we do not act as a HIPAA business associate of those providers with respect to the information we collect. We may have limited operational access to certain information through our clinical partner's platform — for example, to confirm whether a consultation was completed or an order was placed — and we are contractually required to keep any such information strictly confidential, use it only to support the Services, and promptly report any suspected unauthorized access or disclosure to our clinical partner. If our role changes for any part of the Services, we will handle the affected information as HIPAA requires and update this policy.
• Information you provide to Benthos Health directly — a newsletter sign-up, a cost-calculator entry, a support email, the fact that you visited a page about tirzepatide — is not HIPAA-protected in our hands. It is nonetheless health-related, and we treat it as sensitive: it is subject to this policy, to the consumer health data protections in Section 11, and to the restriction that we do not sell it or disclose it for advertising.

Our commitment, regardless of which rules apply: we do not sell health information, we do not disclose it to advertising networks, data brokers, or social media platforms for advertising or marketing purposes, and we do not use it for cross-context behavioral advertising.

We design our systems and vendor configurations to prevent this, including the technical controls described in Section 8. No configuration is perfect; if a technical error nonetheless results in an unintended disclosure, we will investigate and correct it promptly upon discovery, consistent with applicable law.

Your treating clinician's Notice of Privacy Practices

As explained above, the clinicians and pharmacies in our network — not Benthos Health — are the HIPAA covered entities responsible for your medical and pharmacy records. Each provides its own HIPAA Notice of Privacy Practices directly once a clinical relationship begins. The summary below describes what that notice covers, so you know what to expect and how to exercise your rights even before you have received it.

How protected health information may be used and disclosed. Your treating clinician and pharmacy may use and disclose your protected health information ("PHI") without your separate authorization for:

• Treatment — to provide, coordinate, or manage your care, including consulting with other clinicians or pharmacies involved in your treatment.
• Payment — to bill for and collect payment for the care you receive, including through Benthos Health as a billing intermediary where applicable.
• Health care operations — for quality assessment, training, licensing, and other activities needed to run their practice.
• As required or permitted by law — for example, to public health authorities, in response to a court order or subpoena, to avert a serious threat to health or safety, or for other purposes HIPAA specifically allows.

Any other use or disclosure of your PHI requires your written authorization, which you may revoke at any time, except to the extent action has already been taken in reliance on it.

Your rights regarding your health information. With respect to the medical and pharmacy records your treating providers hold, you have the right to:

• Inspect and copy your record — review and receive a copy of your health and billing records, with limited exceptions.
• Request an amendment — ask that information you believe is incomplete or incorrect be corrected.
• Request an accounting of disclosures — receive a list of certain disclosures made of your PHI.
• Request restrictions — ask for limits on how your PHI is used or shared for treatment, payment, or operations.
• Request confidential communications — ask to be contacted in a specific way or at a specific location.
• Receive a paper copy of the Notice of Privacy Practices, even if you agreed to receive it electronically.
• Be notified of a breach of your unsecured PHI.

To exercise any of these rights, contact your treating clinician or pharmacy directly using the contact information they provide, or email privacy@benthoshealth.com and we will help route your request to the right place.

How to file a complaint. If you believe your privacy rights have been violated, you may file a complaint with your treating clinician's or pharmacy's privacy official (contact information is in the notice they provide you), or directly with the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr/privacy/hipaa/complaints or by calling 1-800-368-1019. You will not be retaliated against for filing a complaint.

Legal duty. Each covered entity in our clinical network is required by law to maintain the privacy of your protected health information, to provide you with notice of its legal duties and privacy practices, to notify you following a breach of unsecured PHI, and to abide by the terms of its notice currently in effect.

6. How we share information

We share personal information only as described here:

• Clinical partners. When you request a consultation, we transmit the information you submit to the independent professional entity and licensed clinicians responsible for reviewing it, and to the telehealth platform they use to deliver care. Their handling of that information is governed by their own privacy notices and terms, which they or their platform may present to you directly.
• Pharmacies and fulfillment. If a clinician issues a prescription, the prescription and the information needed to dispense and deliver it go to the dispensing pharmacy and to shipping carriers.
• Laboratories and diagnostic partners, where testing is part of the care you request.
• Service providers that perform work for us under contract — hosting and cloud infrastructure, data storage, email and messaging delivery, customer support tooling, analytics, payment processing, identity verification, fraud prevention, and professional advisers. They may use the information only to perform services for us and must protect it.
• Payment processors, which handle your payment details under their own privacy policies and security obligations.
• At your direction. We share information with anyone you ask us to, including a caregiver, another provider, or an app you connect, with your authorization.
• Legal and safety. We may disclose information where we believe in good faith that it is required by law, subpoena, court order, or other legal process; to cooperate with regulators and law enforcement; to enforce our Terms of Use; to protect the rights, property, or safety of Benthos Health, our users, or others; or to address fraud or security issues. Where we may lawfully do so, we will attempt to notify you before disclosing information in response to legal process.
• Business transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction, subject to this policy or a successor policy that provides comparable protection, and subject to any notice or consent the law requires.
• Affiliates, meaning entities under common ownership with Benthos Holdings, Inc., for the purposes described in this policy.
• Aggregated or de-identified information, which is not personal information and may be shared for any lawful purpose.

We do not sell your personal information for money. We do not disclose health information for cross-context behavioral advertising. Certain uses of standard analytics and advertising cookies on our public marketing pages may be considered "sharing" or "targeted advertising" under some state privacy laws even where no money changes hands; Sections 8 and 10 explain how to opt out.

7. Legal bases and consent

We collect and use information where you have given consent, where it is necessary to provide a service you requested or to perform a contract with you, where we have a legitimate interest that is not overridden by your rights (such as securing the Services and preventing fraud), and where processing is required to comply with law. Where consent is the basis, you may withdraw it at any time as described in Section 10, and withdrawal does not affect processing that already occurred.

8. Cookies, analytics, and advertising

We use the following categories of technology:

• Strictly necessary — required to load pages, keep you signed in, remember your cookie choices, balance load, and protect against fraud and abuse. These cannot be turned off through our site.
• Functional — remember preferences such as language, saved calculator inputs, and dismissed banners.
• Analytics — help us understand traffic, which content is read, where people get stuck, and how the site performs.
• Advertising — used on our public marketing pages to measure campaigns and, in some cases, to show our ads to people who have visited the site.

What we do to keep health information out of these tools. We take reasonable measures to prevent analytics and advertising technologies from collecting health information, including configuring them not to run on intake, account, and checkout pages; avoiding health-identifying details in page titles, URLs, and event names sent to those tools; and disabling advertising features on pages where health information could be observed. No configuration is perfect, and we review these settings periodically.

Your controls. You can manage non-essential cookies through the "Your Privacy Choices" link in the footer of every page, and through your browser settings. Most browsers let you block or delete cookies; blocking strictly necessary cookies may break parts of the site. You can also opt out of certain interest-based advertising through the Digital Advertising Alliance at optout.aboutads.info and the Network Advertising Initiative at optout.networkadvertising.org.

Global Privacy Control. We honor the Global Privacy Control ("GPC") and similar browser-level opt-out signals. When we detect a GPC signal, we treat it as a request to opt out of the sale or sharing of personal information and of targeted advertising for that browser or device. Because the signal is tied to a browser, it may not apply to your account across devices unless you are logged in.

9. Email and text messages

Email. We send transactional email about your account, orders, and requests. We send marketing email only where you have signed up or otherwise permitted it. Every marketing email includes an unsubscribe link. Unsubscribing from marketing does not stop transactional messages, which are necessary to provide the Services.

Text messages. If you provide a mobile number and consent to receive text messages, we or our partners may send messages about your account, appointments, orders, refills, or, where you separately opted in, promotions. Message frequency varies. Message and data rates may apply. Consent to receive marketing texts is not a condition of purchase. Reply STOP to any message to opt out and HELP for help. Carriers are not liable for delayed or undelivered messages.

Phone. We may call you about your account or a request you made. We do not sell your phone number to third-party marketers.

10. Your privacy rights and choices

Subject to verification and legal limits, you may:

• Know and access — request confirmation of whether we process personal information about you, the categories and specific pieces we hold, the sources, the purposes, and the categories of recipients.
• Correct — ask us to fix inaccurate personal information.
• Delete — ask us to delete personal information we hold about you.
• Obtain a copy — receive a portable copy of information you provided to us, in a usable format, where technically feasible.
• Opt out — of targeted advertising, of any sale or sharing of personal information, and of profiling that produces legal or similarly significant effects.
• Limit the use of sensitive personal information to what is necessary to provide the Services.
• Withdraw consent you previously gave, including consent to collect or share consumer health data.
• Be free from retaliation — we will not deny you goods or services, charge you a different price, or provide a lesser quality of service because you exercised these rights.

This includes information you submitted through our referral page or early-access waitlist — if you'd rather we didn't keep it, email privacy@benthoshealth.com and we'll remove it.

We make these rights available to all users, regardless of where you live, though some obligations and deadlines vary by state.

How to exercise them. Email privacy@benthoshealth.com with the request and the email address associated with your use of the Services, or write to us at the address in Section 17. We will acknowledge receipt and respond within the time the applicable law requires — generally 45 days, extendable once where permitted, with notice to you.

Verification. To protect your information, we must verify your identity before acting on a request. We will ask for information that matches what we already hold, and we will not use it for any other purpose. If we cannot verify you, we will tell you why.

Authorized agents. You may use an authorized agent to submit a request. We may require written authorization signed by you and may still verify your identity directly.

Appeals. If we decline a request, our response will explain why. You may appeal by replying to that response or by emailing privacy@benthoshealth.com with "Appeal" in the subject line. We will respond to an appeal within the time the applicable law requires and, if we deny it, tell you how to contact your state attorney general.

Limits. We may decline all or part of a request where the law permits — for example, where we must keep records under medical, pharmacy, tax, or other legal requirements; where the information is a treating provider's HIPAA record, in which case we will route the request to that provider; where honoring the request would compromise another person's privacy or our security; or where the request is manifestly unfounded or excessive.

California residents may also request the categories of personal information disclosed to third parties for direct marketing purposes under California's "Shine the Light" law. We do not currently disclose personal information for that purpose.

11. Consumer health data

This section applies to consumer health data as defined by the Washington My Health My Data Act, the Nevada consumer health data law, and similar laws, and serves as our consumer health data privacy notice.

What we collect. Consumer health data we may collect includes: information about weight, height, and body mass index; medical conditions, symptoms, and history; medications, including GLP-1 medications, dosages, and treatment history; allergies; pregnancy status; laboratory or biometric results you share; interactions with clinicians and pharmacies arranged through the Services; information that identifies you as seeking healthcare services; and inferences drawn from the above.

Where it comes from. Directly from you; from clinicians, pharmacies, and laboratories involved in your care, with your authorization; and from our own service records of your use of the Services.

Why we collect it. To provide the Services you request, to route your information to licensed clinicians and pharmacies at your direction, to support you, to secure our systems and prevent fraud, and to meet legal obligations. We do not collect consumer health data for advertising purposes.

Who we share it with. The categories in Section 6 — clinical partners, pharmacies and fulfillment providers, laboratories, service providers under contract, recipients you direct, and legal or regulatory recipients where required. We do not sell consumer health data, and we do not share it with advertisers or data brokers. Any sale of consumer health data would require your separate, written, revocable authorization, which we do not currently seek.

Your rights. You may confirm whether we collect, share, or sell your consumer health data; obtain a list of the third parties and affiliates with whom we have shared it, including how to contact them; withdraw consent to its collection and sharing; and request its deletion, including deletion from backups on our regular deletion schedule and notice to our service providers, processors, and third parties that received it. To exercise these rights, email privacy@benthoshealth.com. You may appeal a denial as described in Section 10. Washington residents also have a private right of action under the Consumer Protection Act.

Geofencing. We do not use geofences around healthcare facilities or any other location to identify, track, collect data from, or send notifications to consumers related to their health.

12. How long we keep information

We keep personal information for as long as needed for the purposes described in this policy, and then delete or de-identify it. In practice:

• Account information is kept while your account is active and for a reasonable period afterward.
• Transaction and billing records are kept as long as tax, accounting, and audit rules require, typically several years.
• Medical and pharmacy records held by treating providers are kept under the retention periods that apply to those providers under state and federal law, which are often longer than our own periods and which we cannot shorten.
• Support communications are kept as long as needed to resolve issues and to defend against claims.
• Marketing preferences and suppression lists are kept indefinitely so that we can honor your opt-out.
• Analytics and log data is kept for a limited period, generally no more than 24 months, and is often aggregated sooner.

Backups are overwritten on a rolling schedule; information deleted from live systems persists in backups until that cycle completes.

13. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption of data in transit and at rest, access controls and least-privilege permissions, logging and monitoring, vendor security review, and staff training. We restrict access to health information to people who need it to do their jobs.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Protect your own account by using a strong, unique password and not sharing your login. If you believe your account has been compromised, or if you discover a vulnerability in our systems, contact us immediately at security@benthoshealth.com. If a breach affecting your information occurs, we will notify you and the appropriate authorities as required by law.

14. Children's privacy

The Services are intended for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a person under 18, we will delete it. A parent or guardian who believes a child has provided us information may contact privacy@benthoshealth.com.

15. Third-party links and content

Our educational library links to outside sources, and some pages may embed third-party content such as videos or forms. We do not control those services, and this policy does not apply to them. Review their privacy policies before providing information.

16. Users outside the United States

The Services are intended for people in the United States, and our clinical and pharmacy partners are licensed in U.S. jurisdictions. If you access the Services from outside the United States, your information will be transferred to, stored, and processed in the United States, where privacy laws may differ from those in your country. Where required, we rely on appropriate safeguards for such transfers.

17. Changes to this policy

We may update this policy as our Services change or as the law requires. We will post the updated version here and revise the "Last updated" date. If the changes are material, we will provide more prominent notice, such as a notice on the site or an email to the address associated with your account, before the changes take effect. Where the law requires your consent to a change, we will ask for it. Your continued use of the Services after an update means you accept the revised policy.

18. Contact us

For privacy questions, requests, or complaints:

Benthos Holdings, Inc. (d/b/a Benthos Health)
Attn: Privacy
6903 Rockledge Drive, Suite 1250
Bethesda, MD 20817
Email: privacy@benthoshealth.com
General support: support@benthoshealth.com