Expert Opinion MD Privacy Policy

1. Overview and Acceptance

By using this website (the "Site") and the services provided by Expert Opinion MD, Inc. ("Company," "Expert Opinion," "EO," "we," "our," or "us"), you accept the practices described in this Privacy Policy. If you do not agree, please do not use the Site or our services.

This Privacy Policy addresses only the information we collect and how we use and disclose it. The Site may link to third-party sites we do not control; we are not responsible for their privacy practices. We recommend you review the privacy policy of any website you interact with.

2. Who We Are and What We Do

Expert Opinion MD operates an on-demand, peer-to-peer clinical consultation platform. Our clients are pharmaceutical, biotechnology, and medical technology companies ("Partners"). Through white-labeled portals, a healthcare professional or a Partner's field representative (collectively, "Users") submits a consult request describing a clinical scenario. We match that request to a vetted key opinion leader physician (an "Expert") from the Partner's approved faculty, who provides peer-to-peer clinical guidance.

3. Information We Collect

3.1 Account and User Information

When you register, we collect your email address, a password, your first and last name, professional role or credential, organization, and other contact details needed to provide the service. We use this information to authenticate you, communicate with you, and deliver the specific services you request.

3.2 Consult Information (Including Health Information)

To enable an Expert to provide clinical guidance, a User submits information about a clinical case. Users are instructed to submit de-identified case details wherever possible. However, consult submissions and related communications may contain patient-identifiable protected health information ("PHI"), which can include patient name, contact details, date of birth, and clinically relevant history. We handle such information as described in Section 6 (Protected Health Information).

3.3 Communications

If you correspond with us by email or through our secure portal, we retain those communications for the period described in Section 7 (Data Retention).

3.4 Information Collected Automatically

As is standard for websites, we collect information about how Users navigate the Site, including IP address and general device and usage data, to secure, operate, and improve the service. We use cookies for purposes such as remembering your preferences and improving our service. If you reject cookies, some features of the Site may not function properly. None of these cookies personally identifies you.

3.5 Mobile and SMS Opt-In

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All of the categories described in this policy exclude text-messaging originator opt-in data and consent; this information will not be shared with any third parties.

4. How We Use Information

We use the information we collect to:

• Match consult requests to appropriate Experts and facilitate the consultation;
• Authenticate Users and secure the platform;
• Communicate with Users about consults, scheduling, and service updates;
• Provide Partners with de-identified and aggregated reporting and analytics;
• Meet our legal, regulatory, and compliance obligations, including transparency reporting on behalf of Partners where applicable; and
• Operate, maintain, and improve the Site and our services.

5. How We Disclose Information

We do not license, sell, or rent the personally identifiable information we collect about you. We may disclose information in the following limited circumstances:

• To the matched Expert, to the extent necessary to conduct the requested consult;
• To the Partner sponsoring the program, primarily in de-identified or aggregated form (for example, that a given percentage of consults concerned a particular therapeutic area, or that Users are concentrated in a particular region);
• To service providers who process information on our behalf under contractual confidentiality and security obligations;
• To comply with a subpoena, court order, or other legal process, or in the stages leading to possible legal action arising from misuse of the Site;
• To law enforcement or government officials where we, in our reasonable discretion, believe disclosure is necessary or appropriate, to the extent permitted by law; and
• As part of a merger, acquisition, financing, or sale or transfer of assets, in which case we will seek to require the recipient to honor this policy but cannot guarantee it will.

User names and passwords are never disclosed to any third party, even in aggregate form.

6. Protected Health Information (HIPAA / HITECH)

Where Expert Opinion processes PHI in connection with services provided to a Partner or a healthcare provider, we do so consistent with the U.S. Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and the Health Information Technology for Economic and Clinical Health Act ("HITECH").

6.1 Your Health Information Rights

Where applicable, individuals whose PHI we maintain have the following rights. Requests should be directed to our Compliance Office (see Section 14).

• Right to access: to review or obtain copies of health information records, submitted in writing. We may charge a reasonable, cost-based fee, disclosed in advance.
• Right to amend: to request correction of information believed to be inaccurate or incomplete, in writing and with a reason. We may deny the request in limited circumstances and will explain any denial; you may then submit a statement of disagreement.
• Right to an accounting of disclosures: to request an accounting of certain disclosures of PHI, in writing and specifying a time period. The first accounting in any 12-month period is free.
• Right to request restrictions: to request limits on how we use or disclose PHI; we are not required by law to agree to all such requests.
• Right to confidential communications: to request that we communicate with you by a particular method or at a particular location.
• Right to a paper copy: to request a paper copy of this policy at any time.
• Right to file a complaint: to file a complaint with us, or with the Secretary of the U.S. Department of Health and Human Services, if you believe your privacy rights have been violated. Complaints to us may be anonymous, and we will not retaliate for filing one.

7. Data Retention

We retain personal information for as long as needed to provide the service, and thereafter for the period required to meet our legal, regulatory, tax, accounting, compliance-reporting, and contractual obligations, after which we delete or de-identify it. We retain PHI in accordance with applicable law and the governing BAA. PHI is deleted within 60 days.

8. Security

To protect against unauthorized release of information, Expert Opinion uses unique identifiers (email and password) to authenticate Users and verify authorization before granting access to sensitive data. Information transmitted to and from the Site is encrypted in transit using Transport Layer Security (TLS) or a comparable industry-standard method. We also encrypt stored data, verify credentials before access to sensitive data, and log and alert on suspicious or unauthorized access attempts.

No method of transmission or storage is completely secure. While we use industry-standard practices, we cannot guarantee absolute security, and any component of our systems may occasionally require maintenance or experience issues beyond our control.

9. Data Location and International Users

Our services are operated from, and information is stored on, servers located in the United States. The European Union / European Economic Area is not currently a defined service area under our Terms of Use. If you access the Site or services from outside the United States, you consent to the transfer and processing of your information in the United States.

10. Children's Privacy

The Site is directed to healthcare and industry professionals. We do not knowingly collect or maintain personally identifiable information from persons under 18, and no part of the Site is directed to persons under 18. If we learn that such information has been collected without verifiable parental or guardian consent, we will take appropriate steps to delete it. This provision governs Users of the Site and does not limit the handling of patient health information submitted within a consult, which is addressed in Section 6.

11. Third-Party Links

The Site may contain links to websites we do not operate or control. We are not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policy of any site you visit.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the Effective Date above and post the updated policy on this page. Please review it periodically. Your continued use of the Site or services after an update constitutes acceptance of the revised policy.

13. Governing Law

By choosing to visit this Site, use our services, or otherwise provide information to the Company, you agree that any dispute over privacy or the terms of this Privacy Policy will be governed by the laws of the State of Washington, without regard to its conflict-of-laws principles. You also agree to abide by any limitation on damages contained in our Terms of Use or other agreement between us. This policy has been prepared based on multiple legal frameworks, including HIPAA, HITECH, and the CCPA.

14. Contact / Compliance Office

For questions about this Privacy Policy, or to exercise any right described above, contact: