Healthcare Privacy Policy & PHI Disclosures

Alpha 1 Labs ("Alpha 1 Labs," "we," "us," or "our") is a Veteran-owned, United States–based healthcare coordination platform facilitating access to qualified medical professionals, independent clinical diagnostic laboratories, and state-licensed 503A compounding pharmacies.

We understand the sensitive nature of your medical data. This Privacy Policy details our operational practices regarding the collection, transmission, and processing of Protected Health Information (PHI) and Personally Identifiable Information (PII) across our website, electronic intake portals, telehealth consultations, and SMS communications.

1. Categories of Information We Collect

We collect only the information necessary to facilitate clinical evaluations, fulfill prescription orders, process payments, and ensure compliance with healthcare statutes.

2. Permitted Uses & Disclosures of Information

Subject to applicable HIPAA and state privacy requirements, your PHI is used exclusively for treatment, payment, and healthcare operations:

• Treatment: Facilitating medical intake reviews by qualified healthcare professionals and transmission of valid prescriptions to licensed domestic 503A compounding pharmacies.
• Payment: Processing transactions for telehealth reviews, blood panels, and cold-chain prescription delivery.
• Healthcare Operations: Monitoring quality of care, verifying clinician licensure, auditing compliance with state pharmacy boards, and coordinating service administration. Clinical records and PHI are maintained by the applicable healthcare provider, laboratory, or other authorized healthcare partner.

3. HIPAA Compliance & Business Associate Agreements

Where applicable under U.S. federal law (45 CFR Parts 160 and 164), the healthcare partners Alpha 1 Labs coordinates with maintain formal Business Associate Agreements (BAAs) with technology infrastructure providers, telehealth software vendors, diagnostic laboratories, and pharmacy fulfillment partners. These agreements obligate all partners to implement appropriate administrative, physical, and technical safeguards required under applicable HIPAA requirements.

Health information submitted through clinical intake, medical evaluation, or laboratory workflows is transmitted directly to OutfitMD and/or applicable laboratory partners responsible for providing medical or laboratory services. Alpha 1 Labs does not maintain patients' clinical records or laboratory results in its own systems. Clinical records and Protected Health Information are maintained by the applicable healthcare provider, laboratory, or other authorized healthcare partner in accordance with applicable privacy and security requirements.

Alpha 1 Labs may process limited administrative information necessary for scheduling, customer support, payment coordination, and general service administration, but does not use its own systems as the system of record for clinical documentation or laboratory results.

4. SMS Messaging & CTIA A2P 10DLC Compliance

Alpha 1 Labs utilizes Application-to-Person (A2P) 10-digit long code (10DLC) text messaging to communicate vital clinical updates and order notifications.

5. Sharing with Authorized Third Parties

Your information is shared only with partners essential to your healthcare continuum:

• Licensed Healthcare Prescribers: Independent physicians and nurse practitioners conducting clinical reviews.
• Partner Compounding Pharmacies: Licensed domestic pharmacies compounding and dispatching your prescription.
• Diagnostic Laboratories: Clinical laboratories performing blood biomarker panels.
• Legal Compliance: When required by subpoena, court order, state medical board inquiry, or federal statute.

6. Technical Security & 256-Bit Encryption

Alpha 1 Labs employs robust technical security measures to prevent unauthorized access, disclosure, or alteration of patient data:

• All data transmitted between your browser and our servers uses 256-bit Secure Socket Layer (SSL) / TLS 1.3 encryption.
• Alpha 1 Labs may process limited administrative information necessary for scheduling, customer support, payment coordination, and general service administration, but does not use its own systems as the system of record for clinical documentation or laboratory results.
• Clinical records and PHI are maintained by the applicable healthcare provider, laboratory, or other authorized healthcare partner in accordance with applicable privacy and security requirements.
• Continuous vulnerability scanning and automated threat detection.

7. Your Rights Regarding Health Information

Under federal and state law, you have the right to:

• Request a copy of your electronic health and consultation records.
• Request amendments to inaccurate or incomplete medical intake data.
• Request restrictions on how your health information is shared for healthcare operations.
• Receive a accounting of disclosures of your health records.
• Request that your prescription be directed to an alternative state-licensed retail pharmacy.

8. Medical Record Retention & Disposal

Alpha 1 Labs does not retain or store Protected Health Information (PHI). PHI is submitted directly to OutfitMD/lab systems and not retained by Alpha 1. Patient records are retained by the applicable healthcare providers and laboratory partners in accordance with applicable state record-retention requirements and federal privacy and security requirements. Records are securely disposed of in accordance with applicable legal and organizational data-retention requirements.

9. Children's Privacy Disclosure

Our website, telehealth services, and medical protocols are strictly intended for adults aged 18 and older. We do not knowingly solicit, collect, or store personal or health data from minors under 18 years of age.