kalteramso.com, the KALTERA Partner Portal and the Patient Intake

Kaltera Management Group LLC

Version 1. Effective date: October 26, 2026

1. WHO WE ARE AND WHAT THIS POLICY COVERS

1.1 This Privacy Policy explains how Kaltera Management Group LLC, a Delaware limited liability company doing business as KALTERA (“KALTERA”, “we”, “us” or “our”), collects, uses, shares and protects personal information. It covers kalteramso.com, the KALTERA Partner Portal (the “Portal”), the practice application, the Patient Intake, our emails and text messages, and the information our account managers and independent sales representatives collect from practices in the course of our business (together, the “Services”). Section 3 is our Consumer Health Data Privacy Policy; it is also published as a separate page linked from the Site’s home page and from the Patient Intake form, and the separate page controls if the two differ.

1.2 This Policy does not cover the practices of the pharmacies, outsourcing facilities, manufacturers, laboratories, carriers, payment processors and independent healthcare providers with which we work. Each of them has its own privacy policy. Where we handle patient information on behalf of a practice under a business associate agreement or a data protection agreement, that agreement governs the information and controls over this Policy.

1.3 Questions about this Policy, and requests under Sections 3.6 and 9, may be sent to info@kalteramso.com with the subject line “Privacy”, or by mail to Kaltera Management Group LLC, Attention: Privacy, 401 SW 1st Ave Unit 1709, Fort Lauderdale, FL 33301.

2. INFORMATION WE COLLECT

2.1 Entry confirmation. When you enter the practice side of the Site, we collect the email address, phone number and category you select, together with the date, time, IP address and browser of your visit, as a record of your acceptance of the Terms and Conditions, this Policy and the Full Disclaimer.

2.2 Practice applications. When you apply for access we collect: your name, title, work email and phone number; the legal name, address and state of your practice; your license type, license number and state of licensure; your National Provider Identifier; any Drug Enforcement Administration registration number you choose to provide; any dispensing practitioner registration and, for nurse practitioners and physician assistants, supervising or collaborating physician details; the laboratory address and responsible individual you designate for Research Products, if any; your specialty and practice type; your current supplier, approximate monthly spend range, product categories of interest and timeline; and any documents you upload, such as a copy of a license, a business registration or a sales tax exemption certificate.

2.3 Portal accounts and orders. When you hold a Portal account we collect: your sign-in credentials; the names, roles and contact details of your Authorized Users; your verified shipping addresses; your order history, including products, lot numbers and quantities; prescriber orders you submit for Practice Products; shipment and delivery records; and your support requests and correspondence. Payment card details are collected and processed by our payment processor; we receive only a payment token, the card type, the last four digits and the transaction result.

2.4 Patient information in orders. An order for a patient-specific compounded preparation may include a patient’s name, date of birth and prescription details to the extent the supplying pharmacy and applicable law require. We receive that information only on the practice’s behalf, use it only to transmit the order to the pharmacy and to support the order and its shipment, and do not use it for any other purpose. Section 6 describes how it is protected. Practices should not send any other patient information through the Portal or by email.

2.5 Patient Intake. When you submit the patient intake form we collect your first and last name, email address, state of residence, the area of care you are interested in, your confirmation that you are at least eighteen (18) years of age, and anything else you choose to type. The area of care you select can reveal information about your health, so we treat the whole intake submission as Consumer Health Data and protect it as described in Section 3.

2.6 Communications. When you communicate with us, our account managers or our independent sales representatives by email, phone, text, video call, in person or through the Site, we keep the communication and notes of it, including in our customer relationship management system.

2.7 Information collected automatically. Our web servers log the IP address, date and time, pages requested, referring page and browser type of each visit for security, fraud prevention and troubleshooting. The public pages of the Site set only the cookies needed to record your entry confirmation and to protect the Site, and we do not use advertising pixels or third-party analytics on any page, including the Patient Intake page. The Portal sets cookies to keep you signed in and to protect your session; these expire when you sign out or, if you choose to stay signed in, after fourteen (14) days. Some pages load security, font or content services from third parties that receive your IP address to deliver those services; they are listed in Section 5.1. While you complete the practice application, the details you enter in the first step are held in your browser for that tab only and are cleared when the application is submitted. Patient intake details are not stored in your browser. If we add analytics or similar tools in future, we will update this Policy before they take effect and will give you the choices the law requires.

2.8 Information from others. We receive information about practices and prescribers from: state licensing boards and the National Plan and Provider Enumeration System; the OIG List of Excluded Individuals and Entities, the SAM exclusion list and state Medicaid exclusion lists; Drug Enforcement Administration records; secretary of state and business registration records; identity verification and fraud prevention services; our payment processor; the pharmacies, outsourcing facilities, manufacturers and laboratories that supply products, which share order status, shipment and quality information; and our independent sales representatives, who record prospects and accounts in our customer relationship management system.

3. CONSUMER HEALTH DATA PRIVACY POLICY

3.1 Scope. This Section applies to information that identifies your past, present or future physical or mental health status, including the area of care you select in the Patient Intake form and anything you tell us about your health (“Consumer Health Data”). It is provided to meet the requirements of the Washington My Health My Data Act, the Nevada consumer health data law and the Connecticut consumer health data provisions, and it applies to everyone whose Consumer Health Data we collect, wherever they live.

3.2 What we collect and why. We collect the Consumer Health Data described in Section 2.5 only because you submit it to us, and we use it only to contact you by email about the care you asked about, to identify an independent licensed provider to you if you ask us to, to respond to your questions, and to meet legal obligations. We do not use Consumer Health Data for marketing of any other product or service, for profiling, or for advertising, and Sections 4.1 and 4.4 do not apply to it.

3.3 Sources. We collect Consumer Health Data only from you.

3.4 Sharing. We share Consumer Health Data only with: service providers that host our forms, email and customer relationship management systems, under contracts that restrict them to our instructions; an independent licensed healthcare provider, with your consent, when you ask to be connected with one; and authorities where the law requires. We have no affiliates with whom Consumer Health Data is shared. We do not sell Consumer Health Data, and we do not share it for advertising. We receive no payment or other consideration from any provider for connecting you, and whether a provider purchases from KALTERA plays no part in which provider we identify to you. Our independent sales representatives do not have access to Consumer Health Data.

3.5 Geofencing. We do not use geofencing or any other location technology to identify, track or collect data about individuals near healthcare facilities.

3.6 Your rights. You may ask us to confirm whether we collect, share or sell your Consumer Health Data, to give you a list of the third parties and affiliates with whom we have shared it, with an email address or other online contact for each, to give you access to it, to delete it, and to withdraw your consent to our collection or sharing of it. Submit requests to info@kalteramso.com with the subject line “Consumer Health Data”. We will respond within forty-five (45) days, extendable once by forty-five (45) days where reasonably necessary, and we will not discriminate against you for exercising these rights. If we deny a request, you may appeal by replying to our response with the word “Appeal”; we will respond to the appeal within forty-five (45) days and will tell you how to contact your state attorney general if you are not satisfied.

4. HOW WE USE INFORMATION

4.1 Sections 3 and 6 limit our use of Consumer Health Data and patient information notwithstanding this Section. We use personal information to: (a) review and verify applications, confirm licensure and screen for exclusions, and decide whether to grant, limit, suspend or end access; (b) open and administer Portal accounts and manage Authorized Users; (c) accept, process, transmit, fulfill, ship, invoice and support orders, including sharing practice credentials and order details with the supplying pharmacy, outsourcing facility, manufacturer or laboratory; (d) relay certificates of analysis, safety data sheets, recall and quality notices and adverse event information; (e) communicate with you about your application, account, orders, supply continuity, compliance requirements and our services; (f) provide onboarding and training materials; (g) for the Patient Intake, follow up with you about the care you asked about; (h) maintain the security and integrity of the Site, detect and prevent fraud, diversion, resale and misuse, and enforce our Terms and agreements; (i) comply with legal, regulatory, licensing, recordkeeping and reporting obligations, including responding to lawful requests from regulators and licensing boards; (j) manage our relationships with independent sales representatives, including calculating commissions on assigned accounts from product, quantity and account data with patient identifiers removed; and (k) operate, analyze and improve our business.

4.2 Marketing. We may send practices marketing emails about products, categories and services relevant to their accounts. You may opt out at any time as described in Section 9.6. We do not use patient intake information or Consumer Health Data for marketing beyond the care you asked about.

4.3 No sale, no targeted advertising. We do not sell personal information, and we do not share it with third parties for cross-context behavioral advertising or targeted advertising.

4.4 Aggregated information. We may create aggregated or de-identified information that cannot reasonably be linked to you and may use it for any purpose, and we commit not to attempt to re-identify it.

5. HOW WE SHARE INFORMATION

5.1 Service providers. We share personal information with service providers that act on our instructions and are bound by contract to protect it, including providers of website hosting, form processing, email delivery, customer relationship management, electronic signature, payment processing, text messaging, identity verification and fraud prevention, document storage and IT support, and the security, font and content services referred to in Section 2.7. A current list of our principal service providers is available on request. Providers that handle Consumer Health Data or patient information are required to sign business associate or equivalent data protection agreements where applicable.

5.2 Supply facilities. We share practice names, addresses, license and registration details, prescriber information, exclusion screening results and order details with the pharmacies, outsourcing facilities, manufacturers, distributors and laboratories that supply or test products, as needed for them to verify the licensed end user, open an account, fulfill and ship orders, issue certificates of analysis, and manage recalls and quality matters. Each practice authorizes this sharing in the Terms and Conditions and the Sourcing Authorization Addendum to its Partner Agreement.

5.3 Independent sales representatives. Our independent sales representatives have access, through our customer relationship management system, to the contact, account and order information for the prospects and accounts assigned to them, so that they can serve those accounts and so that we can calculate commissions. Representatives do not have access to patient information in orders or to Patient Intake submissions; commissions are calculated from product, quantity and account data with patient identifiers removed. Representatives are bound by written confidentiality obligations and are prohibited from using the information for any other purpose or from retaining it after their engagement ends.

5.4 Independent healthcare providers. For the Patient Intake, we share your intake information with an independent licensed healthcare provider only when you ask us to connect you with one, and that provider’s own privacy practices then apply. We receive no payment or other consideration from any provider for connecting you, and whether a provider purchases from KALTERA plays no part in which provider we identify to you.

5.5 Professional advisors and successors. We may share personal information with our attorneys, accountants, auditors, insurers and other professional advisors under confidentiality obligations, and with a successor that assumes control of all or part of our business in a merger, acquisition, reorganization or sale of assets and is bound by this Policy. Consumer Health Data and patient information in orders are not shared with a prospective acquirer or investor for evaluation; they are transferred only to a successor that assumes control of the business.

5.6 Legal. We may disclose personal information where we believe in good faith that disclosure is required by law, regulation, subpoena, court order or governmental request, including requests from the FDA, the Drug Enforcement Administration, state boards of pharmacy and medicine and other regulators; where necessary to establish, exercise or defend legal claims; or where necessary to protect the rights, property or safety of KALTERA, our users, patients or others, including to investigate fraud, diversion or misuse.

5.7 With your direction. We share personal information with others when you ask us to or direct us to.

6. HEALTH INFORMATION AND HIPAA

6.1 Practices. Where a practice is a covered entity under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the practice is the covered entity for patient information in its orders and KALTERA acts as its business associate under the business associate agreement between us; we use and disclose that information only as that agreement and the law permit, apply the minimum necessary standard, and require our subcontractors to do the same. Where a practice is not a covered entity, we protect patient information in its orders under a written data protection agreement with the practice, treat it as consumer health data and sensitive personal information where state law so provides, and apply this Policy to it. In either case, patient information in orders is used only to transmit and support the order, is not disclosed to our sales representatives, and is not used for marketing.

6.2 Patient Intake. KALTERA is not a healthcare provider, and the Patient Intake form is not a medical record. If you become a patient of an independent provider, that provider’s Notice of Privacy Practices describes how your medical information is used and disclosed and the rights you have over it. If KALTERA later provides services that make it a covered entity, we will publish a Notice of Privacy Practices before doing so.

7. SECURITY

7.1 We use administrative, technical and physical safeguards designed to protect personal information against unauthorized access, use, alteration and disclosure, including encryption of data in transit, access controls and role-based permissions, logging of Portal and administrative access, and contractual obligations on service providers. No system is completely secure, and we cannot guarantee the security of information transmitted over the internet. If we become aware of a security incident affecting your personal information, we will notify you and the authorities as the law requires.

8. RETENTION

8.1 We keep personal information for as long as needed for the purposes described in this Policy, to comply with our legal, regulatory, licensing and recordkeeping obligations, to resolve disputes and to enforce our agreements. Our standard retention periods, subject to any longer period the law requires, are: entry confirmation records, for the life of the account plus seven (7) years, or seven (7) years if no account is opened; declined or abandoned applications, twenty-four (24) months; prospect records held by our sales representatives that never become applications, twenty-four (24) months after last contact; account, order, shipment, certificate of analysis and compliance records, for the life of the account plus seven (7) years, or any longer period required by federal or state drug supply, pharmacy, tax or recordkeeping laws, except that patient identifiers in order records are removed or returned as the business associate agreement or data protection agreement requires and the order record is otherwise retained for that period; Patient Intake submissions, twenty-four (24) months after the last contact if you are not connected with a provider; server logs, twelve (12) months; communications that relate to orders, adverse events, recalls or compliance, for the period that applies to those records; and other communications, for the life of the relationship plus three (3) years. When a retention period ends we delete or de-identify the information.

9. YOUR CHOICES AND RIGHTS

9.1 Rights. Depending on where you live, you may have the right to: know whether we process your personal information and to access it; obtain a copy of it in a portable format; correct inaccurate information; delete it; opt out of the sale of personal information, of targeted advertising and of profiling in furtherance of decisions that produce legal or similarly significant effects (we do none of these); withdraw consent where our processing is based on consent; and appeal a decision we make about a request. We extend these rights to everyone whose information we hold, regardless of state of residence, except where providing them would conflict with a legal obligation.

9.2 How to submit a request. Send your request to info@kalteramso.com with the subject line “Privacy Request”, or by mail to the address in Section 1.3, stating which right you are exercising and the email address or account associated with your information. You may also submit a request through an authorized agent, in which case we will require evidence of the agent’s authority and may require you to confirm the request directly.

9.3 Verification. We will verify your identity before acting on a request, by matching the information you provide against the information we hold or, for Portal account holders, by requiring you to make the request from your account email address. We will not require you to create an account to make a request.

9.4 Timing and appeals. We will confirm receipt of a request within ten (10) business days and will respond within forty-five (45) days of receiving a verifiable request, extendable once by forty-five (45) days where reasonably necessary, in which case we will tell you why. If we deny a request, we will explain why and how to appeal. You may appeal by replying to our response with the word “Appeal”; we will respond to the appeal within forty-five (45) days and, if the appeal is denied, will tell you how to contact your state attorney general or privacy regulator.

9.5 No discrimination. We will not deny services, charge different prices or provide a different level of service because you exercised any privacy right.

9.6 Marketing choices. You may opt out of marketing emails by using the unsubscribe link in any marketing email or by writing to info@kalteramso.com. You may stop text messages at any time by replying STOP or by telling us in any other reasonable way, and we will honor the request within ten (10) business days. We will continue to send transactional, account, compliance, recall and legal communications.

9.7 Global Privacy Control and Do Not Track. We treat an opt-out preference signal such as Global Privacy Control as a request to opt out of the sale and sharing of personal information; because we do neither, honoring the signal requires no change to our processing. We do not respond to browser Do Not Track signals.

9.8 Limits. Some rights are limited. We must keep records of licenses, orders, prescriptions, shipments and compliance for the periods the law requires, so a request to delete that information will be honored only to the extent the law permits, and we may keep information needed to complete a transaction, to detect and prevent fraud and misuse, to comply with law, and to establish or defend legal claims.

10. CALIFORNIA NOTICE AT COLLECTION

10.1 This Section provides the notice required by the California Consumer Privacy Act, as amended, for California residents, and is linked from the entry confirmation, the application, the Portal registration and the Patient Intake form at the point of collection. In the preceding twelve (12) months we have collected the following categories of personal information: identifiers, such as name, email address, phone number, IP address and account credentials; professional information, such as license type and number, National Provider Identifier, specialty and practice details; commercial information, such as orders, order history and payment tokens; internet activity, such as server logs and Portal session records; health information, limited to the area of care selected in the Patient Intake and to patient information in orders handled on a practice’s behalf; and communications. We collect them from the sources in Section 2 for the purposes in Section 4, share them with the recipients in Section 5, and retain them for the periods in Section 8. The sensitive personal information we collect is limited to Portal sign-in credentials, which we use only to authenticate you, and the health information described above, which we use only for the purposes in Sections 3 and 6 and not to infer characteristics about you; we do not use or disclose sensitive personal information for any purpose that would give rise to a right to limit. We have not sold or shared personal information in the preceding twelve (12) months and do not do so. We do not knowingly sell or share the personal information of anyone under sixteen (16) years of age. California residents may exercise the rights in Section 9 using the methods there, and we will not discriminate against you for doing so. We may not meet the statutory thresholds for the California Consumer Privacy Act; where we do not, we provide this notice and these rights voluntarily.

11. CHILDREN

11.1 The Services are for adults. The Patient Intake requires users to be at least eighteen (18) years of age, and the practice side of the Site requires users to be at least twenty-one (21). We do not knowingly collect personal information from anyone under eighteen (18). If you believe we have collected information from a minor, contact us at info@kalteramso.com and we will delete it.

12. WHERE WE OPERATE

12.1 The Services are offered in the United States, personal information is stored and processed in the United States, and the Services are not directed to persons outside the United States. If you contact us from outside the United States, you understand that your information will be transferred to and processed in the United States.

13. CHANGES TO THIS POLICY

13.1 We may update this Policy from time to time. We will post the updated Policy on the Site with a new effective date, and for material changes we will give notice to Portal account holders by email at least thirty (30) days before the change takes effect. Changes do not reduce the protection of information collected before the change without your consent where the law requires it.