Privacy Policy

1. Introduction & Overview

MoveFitRx, Inc. ("MoveFitRx," "we," "us," or "our") operates a clinical technology platform facilitating remote therapeutic monitoring (RTM), exercise prescription fulfillment, and connected medical exercise infrastructure. This Privacy Policy describes how we collect, use, protect, and disclose information when you access or use the MoveFitRx web platform, mobile applications, connected equipment integrations, and associated clinical services (collectively, the "Platform").

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our data practices, please do not use the Platform.

2. Information We Collect

We collect several types of information to deliver, maintain, and secure our clinical exercise prescription and monitoring services:

• Personal Account Information: Name, email address, and enrollment identifiers provided during patient onboarding or clinician referral. Clinician accounts may additionally include a phone number.
• Protected Health Information (PHI) & Clinical Data: Clinical diagnoses (e.g., hypertension, osteoporosis, Type 2 diabetes), medical parameters provided by your treating clinician, prescribed exercise protocols, and clinical adherence records.
• Telemetry & Remote Therapeutic Monitoring (RTM) Data: Session duration, equipment type, resistance levels, repetitions, sets, distance, estimated calories, average and maximum heart rate (where a compatible heart rate monitor is connected), facility name, and equipment integration source. This telemetry reaches us from three sources, described in Sections 4 and 5: the operator of the gym equipment you use, the MoveFitRx mobile app, and — on iOS, with your permission — Apple Health.
• Apple Health (HealthKit) Data (iOS only, permission-gated): Where you grant permission, workouts, heart rate, active energy burned, step count, exercise time, and walking or running distance read from Apple Health. See Section 5, which also describes the only data we write back.
• Device & Technical Data: IP addresses, device identifiers, operating system versions, browser types, log files, and cryptographic execution timestamps required for platform security and HIPAA audit logs.

3. HIPAA Safeguards & Encryption Standards

As a software platform handling health-related telemetry and clinical data, MoveFitRx maintains technical, administrative, and physical safeguards consistent with the HIPAA Security Rule (45 C.F.R. Part 164, Subpart C):

• Federal Encryption Standards: All data in transit is encrypted using Transport Layer Security (TLS) 1.2 or higher, following NIST Special Publication 800-52 Rev. 2 guidelines. Data at rest is encrypted using AES-256 cryptographic standards consistent with NIST FIPS 140-2 guidelines.
• Access & Audit Controls: Role-based authorization controls and row-level security policies restrict access to patient data. Detailed audit logging records access and modifications to protected health information.
• Third-Party Cloud Infrastructure: MoveFitRx utilizes SOC 2 Type II certified cloud infrastructure providers operating under executed HIPAA Business Associate Agreements (BAAs).

4. How We Use Information

MoveFitRx uses collected information exclusively for clinical coordination, RTM fulfillment, and platform security:

• Delivering Exercise Prescriptions: Translating clinical parameters into individualized exercise programs designed by qualified Exercise Physiologists or Physical Therapists.
• Remote Therapeutic Monitoring (RTM): Transmitting exercise adherence telemetry to your treating clinician to support remote clinical evaluation and CPT billing support (CPT 98975–98981).
• Equipment Integration: Receiving your exercise telemetry from the operator of the commercial gym equipment you use. This is a server-to-server transfer from the equipment provider to MoveFitRx, identified by the access fob issued to you; the MoveFitRx app does not connect to gym equipment directly.
• Heart Rate Monitors: Connecting over Bluetooth to a third-party heart rate monitor you choose to pair (for example, a Garmin or Xiaomi chest strap or watch) so that heart rate can be recorded during a session. This Bluetooth connection is to your own monitor, not to gym equipment.
• Regulatory & Compliance Reporting: Maintaining HIPAA audit trails, processing FSA/HSA billing documentation, and fulfilling legal obligations.

5. Apple Health (HealthKit) — iOS Only

On iPhone, the MoveFitRx app can exchange data with Apple Health if — and only if — you grant permission when the app asks. Permission is requested separately for reading and for writing, you may grant one without the other, and you can change or revoke either at any time in the Health app under Sharing → Apps. The app has no Apple Health access on Android, where no equivalent integration exists.

What we read, with your permission: workouts, heart rate, active energy burned, step count, exercise time, and walking or running distance. This is how a session recorded by your Apple Watch or another connected device can count toward the exercise your clinician prescribed.

What we write, with your permission: workouts, and nothing else. When you record a session in the MoveFitRx app, we save that workout to Apple Health so it appears alongside the rest of your activity. We do not write heart rate, energy, step, distance, or any other sample type back to Apple Health, and we never modify or delete data written by other apps.

• Apple Health data is used only to deliver and monitor your prescribed exercise programme, as described in Section 4.
• We do not use Apple Health data for advertising, marketing, or any form of data mining, and we do not sell it.
• We do not disclose Apple Health data to third parties except to your treating clinician as described in Section 6, and where you have asked us to.
• Declining Apple Health permission does not prevent you from using the Platform. Sessions recorded on gym equipment continue to reach your clinician by the route described in Section 4.

6. Data Sharing & Disclosures

MoveFitRx does not sell, rent, or trade your personal or health data to advertisers or third parties. We share information only under the following limited circumstances:

• Treating Clinicians & Practices: Sharing RTM compliance logs, exercise completion data, and telemetry metrics with the licensed clinician who issued your exercise prescription.
• Payment Processing: Transmitting your name, email address, and an opaque account identifier to our PCI-compliant payment processor solely to process enrollment payments. No diagnosis, clinical, or telemetry data is shared with the payment processor.
• HIPAA Business Associates: Securely transferring data to audited technology infrastructure partners operating under signed BAAs.
• Legal Obligations: Disclosing information if required by law, subpoena, court order, or applicable federal or state regulations.

7. User Rights & Data Retention

In accordance with applicable privacy laws and HIPAA regulations, you have the right to request access to, correction of, or copies of your personal health data processed through the Platform.

You may request deletion of your MoveFitRx account at any time by contacting our Privacy Officer at the address below. Upon request we will close your account and delete personal account information that we are not required to retain. Clinical records, telemetry audit logs, and executed agreement records are retained for the statutory period described below, as required by healthcare record retention and HIPAA obligations, and are then securely archived or sanitized.

MoveFitRx retains patient records, telemetry audit logs, and executed agreement records for a minimum of seven (7) years to comply with healthcare record retention mandates and HIPAA requirements. After the applicable retention period, records are securely archived or sanitized.

8. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in legal requirements, technical capabilities, or our clinical workflows. When updates are made, we will update the "Effective Date" at the top of this Policy and make the updated Policy available on the Platform.

9. Contact & Privacy Inquiries

If you have questions, concerns, or requests regarding this Privacy Policy or MoveFitRx data protection practices, please contact our Privacy Officer at:

MoveFitRx, Inc. · Email: privacy@movefitrx.com · Reference: MFRx-PRIVACY-v1.2