Bomi Health, Inc. Client Portal Privacy Policy

1. Scope of This Policy

Bomi Health, Inc. (“Bomi,” “we,” “us,” or “our”) provides a client portal to participating healthcare professionals and practices (“Providers”). This Client Portal Privacy Policy describes how Bomi handles personal information when an adult Provider patient or client uses the Bomi client portal for themselves or when a Provider-verified adult parent or legal guardian uses it for an unemancipated minor (“you” or “your”) (the “Client Portal”).

The “Patient” is the person whose Provider record is associated with the portal profile. If you use the Client Portal for yourself, you are also the Patient. A “Guardian User” is an adult parent or legal guardian authorized by the Provider to use a separate portal account for an unemancipated minor Patient. For a Guardian User, information about the portal account, authority, activity, and contact destination relates to the Guardian User, while clinical, demographic, appointment, document, billing, and care information generally relates to the minor Patient.

“Bomi EHR” means Bomi’s hosted electronic health record and its related clinical, scheduling, documentation, communication, practice-administration, claims, billing, payments, and Client Portal software features. The Client Portal is the client-facing component of Bomi EHR. This Policy applies to the Client Portal, related authentication and service communications, support Bomi provides directly to portal users, and any future Bomi mobile application that links to this Policy.

“Bomi Managed Billing” means Bomi’s separately purchased managed billing service. It is not part of Bomi EHR or the Client Portal, even if your Provider directs an exchange of Portal Data between Bomi EHR and Bomi Managed Billing. This Policy applies to Portal Data within the Client Portal, including data received through such an exchange, but does not make Bomi Managed Billing part of the Client Portal or govern that managed service as a whole. A different Bomi privacy notice may apply to another website, product, or relationship. If a Bomi feature presents a more specific privacy notice, that notice controls only for the feature and information it covers. The Client Portal Terms of Service govern use of the Client Portal.

The Client Portal is offered to adult Patients acting for themselves through their own private email address and to separately verified Guardian Users acting for unemancipated minor Patients through the Guardian User’s own private email address. It is available through participating United States healthcare Providers, including Providers that use Bomi for records subject to 42 C.F.R. Part 2 (“Part 2 Records”) under their agreement with Bomi. Availability of a particular Provider service, record, feature, or access right may depend on applicable federal and state law, the Provider’s professional obligations, and the Provider’s configuration. These legal or Provider-specific limitations do not mean that Bomi excludes a particular United States state from general Client Portal availability. The Guardian User feature is technically available only where enabled by the Provider; availability does not mean that guardian access is lawful in a particular state or circumstance, and the Provider must make and document that determination before enabling access. The Client Portal does not currently support a minor-controlled account, adult delegate or other proxy access, or a shared mailbox.

A Provider may configure a profile as a couple profile that two adults share. Each member is a separate adult Patient acting only for themselves through their own private email address; one account may not represent both members, and the members may not share an email address. Within a shared couple profile, some information is shared with the other member and some remains private to the member it concerns, as described in Sections 6 and 12.

2. The Provider Controls the Health Record

This Policy is not your Provider’s HIPAA Notice of Privacy Practices and does not replace it. Your Provider determines why and how patient records are created, used, disclosed, retained, and made available through the Client Portal, subject to applicable law. Contact your Provider about its privacy practices, your care, the contents of your record, amendments, copies, restrictions, portal access, or other patient rights.

Bomi primarily processes clinical and portal information on the Provider’s behalf. When HIPAA applies, Bomi acts as the Provider’s business associate or subcontractor business associate under the applicable Business Associate Agreement (“BAA”). Bomi’s agreement with the Provider governs this processing. The BAA controls if this Policy conflicts with it concerning Protected Health Information (“PHI”). Bomi’s processing may also be subject to state medical-information and health-privacy laws, including the California Confidentiality of Medical Information Act, depending on the information, Provider, Patient, and circumstances.

For Provider-controlled patient and clinical records, Bomi generally acts as the Provider’s business associate, subcontractor business associate, service provider, or processor. For limited account-administration, direct-support, agreement-acceptance, security, fraud-prevention, and legal-compliance information for which Bomi independently determines the purposes and means of processing, Bomi may act as an independent business or controller to the extent applicable law uses those terms. Those activities remain subject to this Policy, applicable law, and any governing agreement.

If your Provider separately purchases Bomi Managed Billing, the Provider may direct Bomi to exchange information between Bomi EHR and Bomi Managed Billing to keep records consistent and support its separate clinical-software and managed-billing workflows. That exchange does not make Bomi Managed Billing part of Bomi EHR or the Client Portal. The exchange remains subject to the Provider’s instructions, the applicable BAA, this Policy, and law. When Part 2 applies, Bomi processes Part 2 Records as the Provider’s qualified service organization and, where applicable, Business Associate under the BAA. The Provider determines whether Part 2 applies, provides required notices, obtains and honors required consents and written revocations, and directs disclosures. Bomi does not automatically classify or segment Part 2 Records or decide whether a particular disclosure is permitted. If Bomi learns that other portal eligibility requirements are no longer satisfied, it may restrict portal access while the Provider retains and handles its underlying records as required by law.

3. Information We Handle

“Portal Data” means personal information, records, files, communications, images, audio, video, payment information, and other content submitted to, received from, or generated through the Client Portal. The Portal Data Bomi handles depends on the features your Provider enables and how you use the Client Portal. It may include:

• Identity, contact, and profile information: name, preferred name, date of birth, pronouns, email, phone number, address, emergency contacts, and identity-verification information;
• Account and authentication information: profile associations, authentication events, agreement acceptances, notification preferences, records used to verify or secure access, and, if single sign-on is offered and you choose it, identifiers and authentication tokens supplied by the selected identity provider;
• Guardian authority and access information: the Guardian User’s identity and contact information, relationship to the Patient, the Provider user who approves portal access and the time of approval, the Provider’s portal-disclosure approval, access status, invitation and account association, and separately attributed messages and audit events. Bomi may also retain prior authority details or evidence that a Provider recorded through an earlier version of the service;
• Health and care information: health history, symptoms, diagnoses, medications, treatment information, clinical notes made available by the Provider, consents, referrals, questionnaires, assessments, forms, signatures, and other PHI or sensitive health information;
• Appointment and telehealth information: Provider, service type, date, time, location, scheduling requests, attendance, telehealth connection information, and information exchanged during a session where the relevant feature supports it;
• Communications and files: secure messages, attachments, documents, images, audio, video, support requests, and other communications sent through or about the Client Portal;
• Billing and insurance information: insurer, member and group identifiers, claims-related information, invoices, balances, transaction history, payment tokens, and limited payment method details handled through payment providers;
• Device, log, and security information: IP address, browser and operating system, device and session identifiers, mobile-app installation and push-notification tokens, permissions you grant, approximate location derived from IP address, pages and features used, timestamps, authentication and audit events, crash data, and security signals; and
• Support and legal information: correspondence with Bomi, privacy or legal requests, records used to verify identity or authority, and information needed to investigate and resolve an issue.

Payment card numbers and card-verification values are collected directly by a payment processor in processor-hosted fields; Bomi does not receive or retain them. Bomi receives payment tokens, the card brand, the last four digits of the card number, the expiration date, and payment status.

If a mobile app allows device-based biometric authentication, the operating system performs the biometric match and Bomi does not receive the device’s fingerprint, face scan, or biometric template. Before Bomi directly collects a biometric identifier or offers a different biometric-verification feature, Bomi will provide any separate notice, consent process, and public retention and destruction schedule required by law.

Bomi does not record telehealth audio or video by default. If Bomi or a Provider later enables recording, Bomi will provide separate notice and obtain all permissions required by law before recording. Any recording Bomi maintains for the Provider becomes Portal Data subject to the Provider’s instructions, the applicable BAA, and this Policy.

4. Where Information Comes From

We may receive personal information:

• from you when you use the Client Portal or contact us;
• from your Provider and its authorized workforce members when they create, maintain, or share a profile or record;
• from Bomi EHR, Bomi Managed Billing if separately purchased by your Provider, and Provider-selected integrations, payers, clearinghouses, payment processors, laboratories, pharmacies, and other healthcare or service organizations, at the Provider’s direction; and
• automatically from your browser, device, and interaction with the Client Portal.

5. Why We Handle Information

Subject to the Provider’s instructions, the BAA, and applicable law, Bomi handles personal information as reasonably necessary to:

• provide the Client Portal and Provider-enabled Bomi EHR software features, including appointments, forms, documents, messages, telehealth access, claims and billing information, and payments;
• create and associate profiles, authenticate users, apply the Provider’s authorization decisions, manage sessions, and prevent unauthorized access;
• transmit information and instructions between you, your Provider, and Provider-selected services;
• exchange information between Bomi EHR and separately purchased Bomi Managed Billing when your Provider directs the exchange to support its separate clinical-software and managed-billing workflows;
• send access links, reminders, receipts, security alerts, support responses, legal notices, and other service communications;
• operate, maintain, support, debug, test, analyze, secure, develop, and improve the Client Portal and Bomi EHR for you and the Provider, consistent with the data-use limitations in Section 7;
• detect and address fraud, abuse, security incidents, technical problems, and violations of applicable terms;
• comply with law, respond to lawful process, protect legal rights and safety, and establish, exercise, or defend legal claims; and
• carry out another purpose with legally sufficient permission.

Bomi does not make treatment decisions or determine how your Provider uses your health information to provide care. Automated security and fraud tools may flag activity for review, but Bomi does not use portal information to make decisions about your eligibility for healthcare, insurance, employment, credit, housing, or another similarly significant service.

6. When We Disclose Information

Bomi may disclose personal information only as permitted by the Provider’s instructions, the BAA, this Policy, and applicable law:

• To your Provider: to make the Client Portal and its contents available to the Provider and its authorized workforce;
• To you and authorized Provider users: to present portal information to the adult Patient or Guardian User associated with the account and to Provider workforce members authorized to use it;
• To separately authorized Guardian Users: to present the minor Patient’s portal-visible information to each Guardian User whom the Provider has independently verified and authorized. Guardian Users do not share credentials or a message identity. Because the Client Portal does not apply record-level confidentiality restrictions separately for different Guardian Users, the Provider must not make a record or other item portal-visible unless the Provider has determined that it may lawfully be disclosed to each Guardian User who can access that profile;
• To the other member of a couple profile: within a shared couple profile, to present shared-profile information, such as the couple’s appointments, to both currently authorized members. We do not present a member’s private information, such as that member’s documents, intake answers, insurance details, private messages, transactional-text choices, contact details, or notifications, to the other member, and we present the couple’s billing information only to the member the Provider designates as financially responsible;
• To Bomi service providers: for hosting, security, support, communications, payment processing, and other services they perform for Bomi under written privacy, security, and confidentiality obligations, including a downstream BAA where HIPAA requires one;
• To Provider-selected services: when the Provider directs Bomi to exchange information with an integration, payer, clearinghouse, payment processor, telehealth service, or another recipient;
• Between Bomi EHR and Bomi Managed Billing: when the Provider has separately purchased Bomi Managed Billing and directs an exchange for its separate clinical-software and managed-billing workflows, subject to the applicable agreements, BAA, and access controls;
• For legal, security, and safety reasons: when required by law or lawful process, or when reasonably necessary to investigate fraud, protect the Client Portal, defend legal rights, or prevent a serious threat, in each case subject to applicable legal and contractual limits; and
• In a business transaction: in connection with a merger, financing, reorganization, bankruptcy, or sale of relevant assets, subject to continuing legal and contractual protections and required notice.

An independent service selected by you or your Provider is governed by its own privacy practices after receiving information at that direction. A service provider Bomi selects to operate the Client Portal is Bomi’s subprocessor; Bomi does not disclaim its own contractual or HIPAA obligations merely because it uses a subprocessor.

7. Data-Use Commitments

Bomi does not sell or license Portal Data, whether identifiable or deidentified, to data brokers, advertisers, employers, insurers, or unrelated third parties. Bomi does not use identifiable Portal Data for targeted or cross-context behavioral advertising or unrelated marketing.

Bomi may create or use information that has been properly deidentified or aggregated only when the Provider agreement and law permit it. Deidentified PHI must satisfy HIPAA’s deidentification standard, and Bomi will not attempt to reidentify it or attribute it to you or the Provider. Bomi contractually requires a recipient of deidentified information to maintain it in deidentified form, take reasonable measures against reidentification, and not attempt to reidentify it except where law expressly permits testing of the deidentification process. Product improvement and benchmarking across Providers use only properly deidentified or aggregated information.

Bomi may use properly deidentified or aggregated information for internal security, analytics, benchmarking, research, product development and improvement, and development of insights and tools. Bomi may disclose that information only to contracted service providers acting for Bomi under written use and reidentification restrictions or in benchmark, research, or similar outputs that do not identify and cannot reasonably be linked to an individual or Provider.

AI and Machine Learning

Identifiable Portal Data may be used as reasonably necessary to support, debug, test, secure, analyze, and improve Provider-specific functions for you and your Provider only when the Provider’s agreement, BAA, and law permit that processing. Cross-Provider analytics, benchmarking, research, and product development use only properly deidentified or aggregated information.

Bomi does not use PHI or other identifiable Portal Data to train, fine-tune, evaluate, or improve any general-purpose, cross-Provider, product-specific, or Provider-specific artificial-intelligence or machine-learning model unless the Provider has expressly agreed in an applicable Order Form or other feature-specific writing and all required legal bases and individual authorizations have been obtained. This restriction does not prohibit the use of properly deidentified or aggregated information described above, provided it remains deidentified and cannot reasonably be linked to you or a Provider.

Bomi may process identifiable Portal Data through an approved model solely for ordinary inference, Provider-specific retrieval, summarization, transcription, or workflow processing needed to provide a Provider-specific feature expressly ordered by the Provider and governed by an applicable Order Form or other feature-specific written terms. Each applicable model provider must be bound by appropriate privacy and security obligations, including a downstream BAA when required, and contractually prohibited from retaining inputs or outputs beyond the permitted processing or using them to train, fine-tune, evaluate, or improve its own or any third party’s models.

AI-generated output is draft output, may be incomplete or inaccurate, and must be reviewed and approved by an appropriately qualified Provider user before it is used for clinical care, documentation, coding, claims, or patient communications.

The applicable Order Form or other feature-specific written terms will address recording and transcription consent; model and provider identity; prompt, transcript, and output retention; clinician review; prohibited autonomous decisions and patient-facing communications; state-specific restrictions; incident handling; and whether the feature is beta or production.

Under Bomi’s BAA, your Provider may opt out by written notice to [email protected] from future use of its source data in cross-Provider product-improvement analytics. The opt-out takes effect within thirty days and survives termination. Bomi may retain properly deidentified information, statistics, and non-reversible aggregate results created before the opt-out takes effect, but will not create new cross-Provider analytics from the Provider’s source data afterward.

No mobile information, including phone numbers and SMS opt-in data, will be shared with third parties or affiliates for marketing or promotional purposes. Bomi may provide that information to the Provider, messaging providers, and carriers only as necessary to honor your choices, deliver requested messages, and support messaging operations, not for their own marketing or promotion.

If you affirmatively opt in to transactional text messages, message frequency varies based on your Client Portal and account activity. Message and data rates may apply.

8. Cookies, Analytics, and Similar Technologies

The Client Portal uses cookies and similar technologies that are reasonably necessary for authentication, session continuity, preferences, security, fraud prevention, load balancing, and core operation. Bomi may also use limited first-party or contracted analytics, performance, and error-reporting technologies to understand and improve reliability. Bomi does not permit those providers to use authenticated Client Portal information for their own advertising or unrelated purposes.

Bomi does not permit third-party advertising or social-media pixels, cross-site behavioral tracking, session-replay technology, or keystroke capture on authenticated Client Portal pages. Other parties do not collect information there about your activities over time and across unrelated websites for advertising. Browser controls may allow you to block or delete necessary technologies, but doing so may prevent authentication or other Client Portal features from working.

Because Bomi does not track authenticated Client Portal users over time across unrelated websites for advertising, the Client Portal does not respond to legacy browser “Do Not Track” signals. Global Privacy Control and similar legally recognized opt-out signals address different covered activities; Bomi honors them where applicable law requires and a covered activity applies.

9. Your Choices and Privacy Requests

You may update information and communication preferences through available Client Portal features. Essential access, transaction, security, legal, and service communications are not marketing and may continue while relevant. Contact your Provider to change the email or phone number used by the Provider, correct a patient record, change portal access, or stop using the Client Portal.

Depending on applicable law and Bomi’s role, you may have rights to know, access, correct, delete, or obtain a copy of personal information; restrict or object to processing; opt out of sale, targeted advertising, or certain profiling; appeal a decision; or use an authorized agent. Bomi does not discriminate against a person for exercising a privacy right. We may verify identity and authority before acting and may deny or limit a request where law permits, with an explanation and appeal instructions where required.

A Guardian User may make a request concerning the minor Patient only to the extent permitted by current legal authority and applicable law. The Provider or Bomi may reverify authority, limit a response, or direct the request to the Provider. Guardian portal access does not determine the Patient’s, Guardian User’s, or another person’s rights to the underlying health record.

For information controlled by the Provider, contact the Provider first. Bomi will forward or assist with an authenticated request as required by its agreement and law but generally cannot alter, release, or delete the Provider’s record without the Provider’s instruction. For limited information Bomi controls directly, email [email protected] and describe your Provider relationship and the right you wish to exercise.

Bomi responds within the period applicable law requires. Where a forty-five-day response period applies, Bomi may take a legally permitted extension after notifying you of the reason and revised due date.

Whether a state consumer-privacy or consumer-health law applies depends on statutory thresholds, exemptions, Bomi’s role, and the information involved. Any supplemental notice Bomi provides for a particular state, product, or data type controls if it conflicts with this general Policy for that information.

10. Retention and Deletion

The Provider controls retention of its patient and clinical records, subject to applicable law, professional duties, and its agreement with Bomi. Bomi retains Portal Data while directed by the Provider and as reasonably necessary to provide the Client Portal, and then deletes or returns it under the Provider agreement, BAA, and documented retention procedures.

Information remaining in protected backups is isolated from ordinary use, remains protected, and ages out under the ordinary backup lifecycle. A legal hold may preserve only affected information for as long as necessary. If PHI cannot feasibly be returned or destroyed, the BAA governs continued protection and restricted use.

Bomi may retain limited account, agreement-acceptance, transaction, security, support, privacy-request, and audit information under separate schedules based on legal, fraud-prevention, dispute, and operational needs. Properly deidentified information may be retained where the Provider agreement and law permit it. Loss of portal access does not necessarily mean the Provider’s underlying record has been deleted.

11. Security

Bomi maintains reasonable administrative, technical, and physical safeguards designed to protect personal information in light of its sensitivity and applicable law. These safeguards include encryption at rest and in transit, access controls, secure authentication, and audit logging. We limit access to personnel and providers with an appropriate need and confidentiality obligations. No system is completely secure, and Bomi cannot guarantee absolute security.

You can help protect information by securing your email account, devices, and authentication links; signing out of shared devices; not forwarding access links; and promptly reporting suspected unauthorized access to your Provider and [email protected]. Security incidents concerning PHI are handled under the BAA and applicable law.

12. Portal Eligibility and Children

A minor Patient may have a Client Portal profile. The user account associated with that profile is created, accepted, and controlled by a Provider-verified adult parent or legal guardian acting as the Guardian User. The minor Patient is not the account holder, does not accept the Client Portal Terms, and is not issued separate credentials. Each Guardian User must use their own private email address and account; Providers must not invite a shared mailbox or allow guardians to share one account.

A Provider may configure a profile as a couple profile that two adults share. Each member is a separate adult using their own private email address; one account may not represent both members, and the two members may not share an email address. A Provider may end one member’s access without ending the other member’s access. Within a shared couple profile, shared-profile information such as the couple’s appointments is visible to both currently authorized members, while a member’s documents, intake answers, insurance details, private messages, transactional-text choices, contact details, and notifications remain private to that member, and the couple’s billing information is shown only to the member the Provider designates as financially responsible. A couple profile is for two adults and is not the Guardian User feature.

For guardian access, Bomi processes the authority and access information described in Section 3 and applies the Provider’s portal authorization decision. Multiple guardians are represented by separate memberships, accounts, audit attribution, and Provider message threads. Access fails closed if the guardian relationship, Patient date of birth, or applicable patient-or-practice state is missing, if access is revoked, or when the Patient reaches the applicable age of majority or is no longer an unemancipated minor.

Because the current Client Portal does not apply record-level confidentiality restrictions separately for different Guardian Users, the Provider must not make a record or other item portal-visible unless the Provider has determined that it may lawfully be disclosed to each Guardian User who can access that profile. If that is not true, the Provider must not enable, or must disable, guardian access. Portal availability does not expand a guardian’s legal rights or reduce a minor’s confidentiality rights.

Disabling or limiting Client Portal access does not limit any right the Guardian User or minor Patient may have to receive particular records through another legally required method or electronic format. The Provider remains responsible for responding to record-access requests and furnishing legally required access outside the Client Portal when the Client Portal cannot present the permitted information without also disclosing restricted information.

The Client Portal is not offered for a minor to create, control, or independently operate an account. Bomi may process information about a minor Patient that is supplied by or generated at the direction of the Provider or Guardian User, including through Provider-enabled care and portal features. If Bomi learns that a minor has obtained or is independently using Guardian User credentials, Bomi may restrict that access and coordinate with the Provider and Guardian User. Restricting portal access does not delete the Provider’s underlying record.

The Client Portal does not yet support an adult personal representative, delegate, or other proxy. Contact the Provider through another available method with questions about a minor’s records, confidential information, authority, access changes, or unsupported represented access.

13. United States Use and Processing

The Client Portal is intended for use only in connection with United States Providers and United States-based care. Information may be processed in the United States and in other locations used by authorized service providers, subject to applicable contractual, privacy, security, and legal protections. Bomi does not offer or represent that the Client Portal is available for use by Providers located outside the United States.

14. Changes to This Policy

Bomi may update this Policy to reflect changes in its practices, law, or the Client Portal. We will post the updated date and provide appropriate advance notice of material changes through the Client Portal or by email. We will obtain consent where law requires it. A policy update does not retroactively authorize a materially different use of personal information or reduce protections promised by the BAA or another governing agreement.

15. Contact Us

Contact your Provider first for questions about its privacy practices, your care, your health record, or portal access. For questions about this Policy or a privacy request concerning information Bomi controls, email [email protected]. For technical support, email [email protected]. Written correspondence may be sent to Bomi Health, Inc., Attn: Privacy, 1111B S Governors Ave STE 6453, Dover, DE 19904.

Bomi’s official email domain is billwithbomi.com. Bomi will not ask you by unsolicited email or text to disclose a Client Portal authentication link, full payment-card number, password, or one-time security code.