Privacy

Last Updated: March 18, 2026

Basal Health Privacy Policy

Effective Date: March 1, 2026

Introduction

Basal Health, Inc. ("Basal" or "we") respects your privacy and is committed to protecting it. Please read this Privacy Policy carefully to understand how Basal collects and uses your personal information and data. This Privacy Policy covers all Personal Information that we receive from various sources, as outlined below. By using or accessing Basal's website, including https://basal.health in any way, or by engaging in transactions with Basal through any other means including via mobile applications, you acknowledge that you accept the practices and policies outlined in this Privacy Policy, and you hereby consent to our collection, use and disclosure of your information in the manner described herein. If you do not agree with this Privacy Policy, please do not use the Websites, our mobile applications, or otherwise transact business with Basal.

For purposes of this Privacy Policy, "Personal Information" may include any information that can be used to identify or locate you, such as your name, address, IP address, mailing address, contact information, email address, phone number and other information you may produce to us or that we may receive from a third party in the course of such third party's provision of services to you. Basal prohibits use of its Websites, mobile applications or other services outside of the United States, so with respect to Basal's processing of Personal Information, federal and state law in the United States define Personal Information. This Privacy Policy is intended to include the most expansive definition that applies to you. Please recognize that your rights related to Personal Information, and how Personal Information is defined, differs somewhat from state to state. For example, a California resident likely has different rights than a Utah resident.

Changes to Privacy Policy.

We review this Privacy Policy regularly, and may update it from time to time. We will post any changes on this page and may also provide notice of material changes to our Privacy Policy on our website home page and/or through our online subscription service or mobile applications. If you object to any changes to this Privacy Policy, you may close your account and discontinue use of our Websites, mobile applications, and all other Basal services. Each time you use any service of Basal, you agree that the current version of this Privacy Policy applies to such use.

This policy describes the types of Personal Information Basal may collect from you or that you may provide when you visit the Websites and use our mobile applications, and explains our practices for collecting, using, maintaining, protecting and disclosing that information.

This policy applies to Personal Information Basal collects:

- On the Websites.
- In e-mail, text and other electronic messages between you and the Website, mobile applications or Basal.
- Through mobile and desktop applications you download from the Website or a mobile application store, which provide dedicated non-browser-based interaction between you and the Website or between you and the mobile application. Basal's online scheduling app provides widgets to customers and patients for their use in scheduling, and Personal Information is collected through these widgets.

It does not apply to information collected by:

- Basal offline or through any other means, including on any other website operated by Basal or any third party (including Basal's affiliates and subsidiaries); or
- Any third party (including Basal affiliates and subsidiaries), including through any application or content (including advertising) that may link to or be accessible from, or on, the Website.

Please read this policy carefully to understand our policies and practices regarding your Personal Information and how Basal will treat such information. If you do not agree with Basal's policies and practices, you must not use the Websites, mobile applications or other Basal services. By accessing or using the Websites, the mobile applications or other Basal services, you agree to this Privacy Policy. This policy may change from time to time. Your continued use of the Website after Basal makes changes is deemed to be acceptance of those changes, so please check the policy periodically for updates. If you are registering an account or using the services on behalf of an individual or entity other than yourself, you represent that you are authorized by such individual or entity to agree to this Privacy Policy on such individual's or entity's behalf.

Information We Collect About You and How We Collect It

Basal collects several types of Personal Information from and about users of the Website, including information:

- By which you may be personally identified, such as your name, postal address, e-mail address or telephone number, date of birth, medical or health care history, and/or current medical issues or health care issues ("Personal Information");
- That is about you but individually does not identify you, such as age, gender, and internet browser;
- Details of transactions you carry out through the Website and of the fulfillment of your requests. You will be required to provide Personal Information before using certain services on or through the Website;
- If you choose to purchase a Basal product or service, our payment processing vendor collects your credit card information and billing address; and/or
- Your search queries and questions and comments posted on the Website;
- About your internet connection, the equipment you use to access the Website and usage details.

If you communicate with Basal by, for example, chat, e-mail or letter, any information provided in such communication may be collected as Personal Information.

Basal collects this information:

- Directly from you when you provide it to Basal or on or through the Website, mobile applications or other Basal services. This includes:
- Information that you voluntarily provide to Basal when you choose to purchase products or services on the Website, and completing medical history forms prior to Provider appointments.
- Information you provide voluntarily in free-form text boxes on the Website and through responses to forms, surveys, feedback requests, questionnaires, contests, and the like. Some of the products and services on the Website ask for your health-related Personal Information.
- Information that you provide in email or other correspondence with Basal.
- You may elect to use certain services on or through the Website which require you to download and install software on your computer or mobile device ("Downloaded Software"). The Downloaded Software may collect and transmit information from your computer system or mobile device solely relating to the Downloaded Software and for the purpose of providing you with the relevant services.
- Automatically as you navigate through the Website. Information collected automatically may include usage details, IP addresses and information collected through cookies, web beacons and other tracking technologies.
- From third parties, for example, our business partners.

Children Under the Age of 18

Where we process the Personal Information of minors we require the subscriber or person inputting the Personal Information to be the parent or guardian of the minor or to obtain their consent. No one under age 18 may provide any information to, or on the Website. Basal does not knowingly collect personal information from children under 18. If you are under 18, do not use or provide any information on the Website or on or through any of its features, register on the Website, attempt to make any purchases through the Website, use any of the interactive or public comment features of this Website or provide any information about yourself to Basal or on the Website, including your name, address, telephone number, e-mail address or any screen name or user name you may use. If Basal learns that it has collected or received Personal Information from or about a child under 18 without verification of parental consent, Basal will delete that information. If you believe Basal might have any information from or about a child under 18, please contact us as set forth in the Contact Information section at the end of this Privacy Policy.

California Consumer Privacy Act Notice

Pursuant to § 1798.110 of the California Consumer Privacy Act ("CCPA"), the categories of personal information that we have collected about individual consumers in the preceding twelve months are:

- Identifiers such as name, email address, address, telephone number, and medical information.
- Commercial information: records of services purchased
- Internet activity
- Geolocation data

Usage Details, IP Addresses, Cookies and Other Technologies

As you navigate through and interact with the Website or mobile application, Basal may automatically collect certain information about your equipment, browsing actions and patterns, including:

- Details of your visits to the Website or mobile application, including traffic data, location data, logs and other communication data and the resources that you access and use on the Website.
- Information about your type of computer and internet connection or your mobile device, including your IP address, domain servers, operating system, web browser type, referring source which may have sent you to the Website, and other information associated with the interaction of your browser and the Website (collectively, "Traffic Data").

The information Basal collects automatically is analytical and statistical data. It helps Basal to improve the Website and mobile applications and to deliver a better and more personalized service by enabling it to:

- Estimate our audience size and usage patterns.
- Store information about your preferences, allowing us to customize our Website and mobile applications according to your individual interests.
- Speed up your searches.
- Recognize you when you return to the Website or mobile application.

The technologies Basal uses for this automatic data collection may include:

COOKIES (or BROWSER COOKIES).A cookie is a small file placed on the hard drive of your computer. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting you may be unable to access certain parts of the Website. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you direct your browser to the Website.
FLASH COOKIES. Certain features of the Website may use local stored objects (or Flash cookies) to collect and store information about your preferences and navigation to, from and on the Website. Flash cookies are not managed by the same browser settings as are used for browser cookies.
WEB BEACONS. Pages of the Website and Basal's e-mails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags and single-pixel gifs) that permit Basal, for example, to count users who have visited those pages or opened an e-mail and for other related website statistics (for example, recording the popularity of certain website content and verifying system and server integrity).

Additionally, Basal may use third party website analytics services in connection with the Website, for example, to record mouse clicks, mouse movements, scrolling activity, as well as any text that you type into the Website. These website analytics services do not collect Personal Information that you do not voluntarily enter into the Website. These services do not track your browsing habits across websites which do not use their services. Basal uses the information collected from these services to find usability problems to make the Website easier to use. The recordings will not identify you or your account; they only record anonymous user information.

How Basal Uses Your Information

Basal uses information that Basal collects about you or that you provide to us, including any Personal Information:

- To present the Website and/or mobile application and its contents to you.
- To provide you with information, products or services that you request from Basal or the Website, mobile application or otherwise.
- To fulfill any other purpose for which you provide it.
- To provide you with notices about your account.
- To enable us to develop, customize and improve the Website, mobile application, and our publications, products and services.
- To carry out Basal's obligations and enforce Basal's rights arising from any contracts entered into between you and Basal.
- To notify you about changes to the Website, mobile applications, or any products or services Basal offers or provides.
- To allow you to participate in interactive features on the Website or in the mobile application.
- To connect you with applicable Providers, including Telegra MD as our network provider, where appropriate.
- To remind you of upcoming or follow-up appointments with Providers.
- In any other way we may describe when you provide the information.
- For any other purpose, with your consent.

Telemedicine Provider Information And State Licensure Disclosures

Basal partners with Telegra MD and affiliated licensed medical professionals to facilitate access to telehealth services. In certain states, applicable telemedicine guidance requires public disclosure of provider information, including provider names, license numbers, and types of licenses held. The following providers may deliver telehealth services through the Basal platform, subject to availability, licensure, and scope of practice:

Massachusetts (MA)

- Kimberli Hastings, NP — License #RN2379884 — NPI: 1942850862
- Theresa Vergara, NP — License #RN2381153 — NPI: 1144870056
- Laurie Mercier, MD — License #10233001 — NPI: 1174549505
- Daniel Funsch, MD — License #1017082 — NPI: 1023471547

Rhode Island (RI)

- Kimberli Hastings, NP — License #3470 — NPI: 1942850862
- Theresa Vergara, NP — License #APRN03619 — NPI: 1144870056
- Edilberto Atienza, MD — License #MD17115 — NPI: 1356729040

Vermont (VT)

- Kimberli Hastings, NP — License #101.0135472 — NPI: 1942850862
- Laurie Mercier, MD — License #42.0017422 — NPI: 1174549505
- Theresa Vergara, NP — License #101.0136313 — NPI: 1144870056

Provider availability may vary by state and over time. Basal may update this list from time to time to reflect changes in provider participation or licensure.

Telehealth services made available through Basal are not intended for medical emergencies. If you are experiencing a medical emergency, call 911 or go to the nearest emergency room.

Electronic messages and other communications submitted through the Basal platform are reviewed during normal business operations and should not be used for urgent or emergent issues.

As described in this Privacy Policy, patient information may be disclosed to affiliated providers, network partners, pharmacies, laboratories, and service providers as reasonably necessary to provide requested services, fulfill legal obligations, and support platform operations.

Storage of Personal Information

Basal stores all Traffic Data and review postings indefinitely, even after "deletion", and may archive such information elsewhere. Basal stores all Personal Information until you request that Basal modify or delete it, in which case Basal may still retain certain Personal Information for the reasons described herein.

We store Personal Information that we have collected (through the means described above) on our premises and in our information system at our facilities, in third party data centers that provide our hosting services, in the systems of third party service providers, and in cloud storage solutions. Basal is located in the United States.

Basal stores all information in state-of-the-art physical storage facilities and cloud storage. In doing so, Basal uses appropriate physical, organizational and technological measures to protect the Personal Information you provide to us against loss or theft, and unauthorized access, disclosure, copying, use, or modification. This includes limiting access on a "need-to-know" basis. Where third parties (such as AWS) are used to host our products, we use third parties who meet required privacy and security standards.

However, no electronic data transmission can be guaranteed to be secure from access by unintended recipients and Basal will not be responsible for any breach of security unless this breach is due to its negligence. Although we are committed to employing reasonable technology in order to protect the security of our website, even with the best technology, no website is 100% secure. In transacting business with us through our website, you assume the risk inherent in transacting business online.

To offer our website, products and services to you, Basal relies on plugins and services from third parties such as internet service providers, email service providers and plugins, calendar plugins, Customer Relationship Management (CRM) systems, credit card processors, and third party data storage. To the extent these providers have access to your Personal Information, we will require that they are legally or contractually committed to comply with applicable privacy laws. In the case of credit card processors, we require that they be PCI DSS-compliant. However, we cannot guarantee with certainty that the computer systems and storage systems whereon these services are offered will not be accessed by unauthorized parties. This is a risk inherent in providing any information or conducting any business online. In transacting business with us through our website, you assume the risk inherent in transacting business online.

Disclosure of Your Information

Basal does not sell or rent any Personal Information to third parties. Basal may disclose Personal Information that it collects or you provide as described in this Privacy Policy:

- To Basal's subsidiaries and affiliates as part of delivering its products and service offerings.
- To contractors, service providers and other third parties Basal uses to support its business and who are bound by contractual obligations to keep personal information confidential and use it only for the purposes for which we disclose it to them.
- To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution or other sale or transfer of some or all of Basal's assets, whether as a going concern or as part of bankruptcy, liquidation or similar proceeding.
- To fulfill the purpose for which you provide it.
- To Providers you select to receive your Personal Information, including providers in our network such as Telegra MD.
- For any other purpose disclosed by Basal when you provide the information.
- With your consent.

Basal may also disclose your Personal Information:

- To comply with any court order, law or legal process, including to respond to any government or regulatory request.
- To enforce or apply our terms of use and other agreements.
- If Basal believes disclosure is necessary or appropriate to protect the rights, property, or safety of Basal Health, LLC, Basal's customers or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction.
- To respond to claims that any posting or other content violates the rights of third-parties.

Basal partners with Telegra MD as our network provider to facilitate access to licensed medical professionals. Your Personal Information may be shared with Telegra MD and its affiliated providers as necessary to deliver these services.

Aggregate Data

Our definition of Personal Information does not include "aggregate" data. Aggregate data is information we collect about a group or category of services or users from which individual user identities have been removed. In other words, no personal information is included in aggregate data. Aggregate data helps us understand trends in our users' needs so that we can better consider new features or otherwise tailor our services. This Privacy Policy in no way restricts or limits our collection and use of aggregate data, and we may share aggregate data about our users with third parties for various purposes, including to help us better understand our customer needs and improve our services and for advertising and marketing purposes.

Notice to Doctors and Licensed Medical Professionals

Doctors, licensed medical professionals, their employees, and their agents should be particularly aware of their obligations of patient confidentiality, including without limitation, their obligations under the Health Insurance Portability and Accountability Act ("HIPAA"), both in communicating with Basal and in responding to a review of their services posted on the Website or via mobile applications. Basal does not have, and will not accept, any obligations of confidentiality with respect to any such communications other than those expressly stated in this Privacy Policy or in the terms of use for the Website.

Public Information

Any information that you may reveal in a review posting or other online discussion or forum is intentionally open to the public and is not in any way private. You should not disclose any Personal Information, health or financial related data, or personally identifiable information in any public forum.

Retention of Personal Information

Basal processes Personal Information for a reasonable period of time to fulfill the purposes mentioned above. Personal Information is then archived for time periods as required or necessitated by law or legal considerations. Basal reserves the right to delete a customer's data, including Personal Information provided by that customer, from its system after 30 days from the date of termination of its agreement with the applicable customer. Basal may also delete Personal Information in response to an individual's request, as set forth in the Your Rights and Choices section below.

Basal reserves the right to retain usage data relating to our products and services, as well as data that has been anonymized and/or aggregated, to the extent permitted by applicable laws. With respect to any Personal Information collected by us for marketing or for our own internal purposes, we will retain that data for a reasonable time in order to fulfill those purposes.

We regularly review our retention policy to ensure compliance with our obligations under data protection laws and other regulatory requirements. We regularly audit our databases and archived information to ensure that Personal Information is only stored and archived in alignment with our retention policy.

Your Rights and Choices About How Basal Uses And Discloses Your Information

Basal strives to provide you with choices regarding the Personal Information you provide to us. Basal has created mechanisms to provide you with the following control over your information:

- **Changing and Correcting Your Personal Information.** If your Personal Information changes in any way, we invite you to correct or update your information as soon as possible. You can make updates to your profile information by logging into your account on Basal at any time. You can also request changes or access to your information by emailing live@basal.health.

SMS Communications

Basal Health offers an SMS/text message program to keep you informed about your care. By providing your phone number and opting in, you consent to receive text messages from us regarding appointment reminders, order updates, prescription status, and other care-related communications.

How to opt in: You may opt in to receive SMS messages by checking the consent box during registration or account setup, or by submitting your phone number at basal.health/communications.

Message frequency: Message frequency varies based on your activity and care status.

How to opt out: Reply STOP at any time to unsubscribe. You will receive a one-time confirmation message and no further texts will be sent.

Help: Reply HELP for assistance or contact us at support@basal.health

Rates: Message and data rates may apply depending on your carrier and plan.

Opting Out of Marketing Communications.

Basal may send you communications or data regarding our Web sites and services, including but not limited to (i) notices about your use of our Web sites and services, including any notices concerning violations of use, (ii) updates, and (iii) promotional information and materials regarding our products and services. You may opt out of receiving promotional emails from Basal by following the opt-out instructions provided in those emails. You may also opt out of receiving promotional emails and other promotional communications from us at any time by contacting us as described in the Contact Information section below, with your specific request. Opt-out requests will not apply to transactional service messages, such as security alerts and notices about your current account and services.

Opting Out of Other Uses of Your Personal Information.

If you wish to opt out from any of the other uses of Personal Information that are specified in this Privacy Policy, except in the case of legal proceedings or where your data is required for tax and transactional purposes, please contact us as described in the Contact Information section below. Please note that your subsequent disclosure of Personal Information to us may override prior opt-out requests. Company does not discriminate against those who opt out. However, opting out may prevent us from conveniently and efficiently providing further product support services and information to you.

Deleting Your Personal Information.

Upon your request, Basal will use commercially reasonable efforts to delete your account and the Personal Information in your profile. However, it may be impossible to remove your account without some residual information being retained by Basal. Basal has no obligation to delete any data or information you provide on a medical history form following termination of your account or the account of any dental or medical services provider to whom your medical history form was submitted through the Website or the services offered on or through the Website. If you wish to have your Personal Information deleted, please contact us as set forth in the Contact Information section below.

Tracking Technologies and Advertising.

You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. To learn how you can manage your Flash cookie settings, visit the Flash player settings page on Adobe's website. If you disable or refuse cookies, please note that some parts of the Website may then be inaccessible or not function properly.

Basal does not control third parties' collection or use of your information to serve interest-based advertising. However, these third parties may provide you with ways to choose not to have your information collected or used in this way. You can opt out of receiving targeted ads from members of the Network Advertising Initiative ("NAI") on the NAI's website.

Your California Privacy Rights

*This section applies to California residents only.*

Shine the Light Law

Pursuant to Section 1798.83 of the California Civil Code, residents of California have the right to request from a business, with whom the California resident has an established business relationship, certain information with respect to the types of Personal Information the business shares with third parties for direct marketing purposes by such third party and the identities of the third parties with whom the business has shared such information during the immediately preceding calendar year. Basal does not presently share any information with third parties for direct marketing purposes. However, to submit such a request, you can contact us as set forth in the Contact Information section below.

California Consumer Privacy Act (CCPA)

Beginning January 1, 2020, pursuant to the CCPA (Section 1798.100 et seq. of the California Civil Code), residents of California have the following rights:

- **Right of access** to your personal information, up to twice a year at no charge, including:
- The categories of personal information Basal collects about the consumer,
- The categories of sources of the consumer's personal information,
- The business or commercial purpose for collecting or selling the consumer's personal information,
- The categories of any third parties with whom the business shares the consumer's personal information, and
- The specific pieces of personal information collected about the consumer.
- **Right to request deletion** of data, subject to certain exceptions, such as where the information is needed to provide services to the consumer, or for security or legal reasons.
- **Right to not be discriminated against** for exercising your rights under the CCPA, such as denial of services or higher pricing.
- **Right to opt out** of having your personal information sold.

You can exercise your rights under the CCPA by calling our toll-free number set forth in the Contact Information section below.

Company may require you to provide sufficient information to permit us to provide an account of the existence, use, and disclosure of Personal Information. The information provided shall only be used for this purpose.

Data Security

Basal has implemented technical and organizational measures designed to secure your Personal Information from accidental loss or destruction, and from unauthorized access, use, alteration and disclosure. All information you provide to us is stored on our secure servers behind firewalls. Any medical or health care information will be encrypted in transit and at rest. Payment card information, such as account numbers, is processed via a third-party vendor that specializes in payment processing and has committed to PCI DSS compliance. All Basal employees are contractually obligated to maintain the confidentiality of Personal Information accessible through their employment.

Basal follows accepted industry standards to protect the Personal Information submitted, both during transmission and once Basal receives the Personal Information. However, you should understand that there is no such thing as complete security, and Basal does not guarantee that there will be no unintended disclosures of your Personal Information. If Basal becomes aware that your Personal Information has been disclosed in a manner not in accordance with this Privacy Policy, Basal will use reasonable efforts to notify you of the nature and extent of the disclosure (to the extent Basal knows that information) as soon as reasonably possible.

The safety and security of your information also depends on you. Where Basal has given you (or where you have chosen) a password for access to certain parts of the Website, you are responsible for keeping this password confidential. Basal asks you not to share your password with anyone. You must promptly notify Basal if your contact data is lost, stolen, or used without your permission. In such an event, we will remove that contact data from your account and update our records accordingly.

Basal further urges you to be careful about giving out information in public areas of the Website like message boards. The information you share in public areas may be viewed by any user of the Website.

Unfortunately, the transmission of information via the internet is not completely secure. Although Basal uses commercially reasonable efforts to protect your Personal Information, Basal cannot guarantee the security of your Personal Information transmitted to the Website. Any transmission of Personal Information is at your own risk. Basal is not responsible for circumvention of any privacy settings or security measures contained on the Website.

Links To Other Websites

The Website may contain links to third party websites to which Basal has no affiliation. Basal does not share your Personal Information with those websites and is not responsible for their privacy policies or practices. Please be aware that you may be on a different site and that this Privacy Policy only contains the policies for the Website. A link to a third party website does not constitute or imply endorsement by Basal. Additionally, Basal cannot guarantee the quality or accuracy of any information contained on any third party website. If you decide to visit any third party website, you should read that website's privacy policy.

No Sharing Statement

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted.