Direct Preventive Care Effective Date: February 16, 2026 

Direct Preventive Care (“DPC,” “we,” “us,” or “our”) operates the website located at www.directpreventive.com (the “Site”) and provides preventive medicine, hormone optimization, weight management, IV therapy, aesthetics, peptide therapy, NAD+, and related services (the “Services”). This Privacy Policy explains how we collect, use, disclose, and protect information when you visit our Site, submit a form, book an appointment, or otherwise interact with us online.

This Privacy Policy applies to our website and related digital communications. It does not replace and is not a substitute for our HIPAA Notice of Privacy Practices, which separately governs how we use and disclose your protected health information (“PHI”) as a HIPAA-covered health care provider. If you are an existing or prospective patient, please also review our Notice of Privacy Practices, available at our office and upon request.

1. Information We Collect

a. Information you provide directly, such as when you fill out a contact form, request an appointment, join our email list, complete an intake or consultation form, or communicate with us by phone, text, email, or chat: – Name, email address, phone number, mailing address, date of birth – Health-related information you choose to share (e.g., symptoms, medical history, current medications, goals for treatment) submitted through intake forms, consultation requests, or messages – Payment and billing information (processed by a third-party payment processor; see Section 4) – Any other information you voluntarily provide

b. Information collected automatically, when you visit the Site: – IP address, browser type, device type, operating system – Pages viewed, time on page, referring/exit pages, and general clickstream data – Approximate geographic location (derived from IP address) – Cookies, pixels, and similar tracking technologies (see Section 3)

c. Information from third parties, such as scheduling platforms, marketing and CRM platforms, payment processors, or advertising partners (e.g., Meta/Facebook, Google) that help us communicate with you or measure ad performance.

We do not knowingly collect information from children under 13, and our Site is not directed to children. See Section 10.

2. How We Use Information

We use the information we collect to: – Respond to inquiries, schedule appointments, and communicate with you about our Services – Provide, maintain, and improve the Site and our Services – Send appointment reminders, follow-ups, newsletters, and promotional communications (with the ability to opt out at any time) – Process payments and manage billing – Analyze Site usage and improve marketing effectiveness, including through advertising platforms – Comply with legal, regulatory, and licensing obligations, including Florida Board of Medicine and related health care regulations – Detect, prevent, and address fraud, security incidents, or technical issues

We do not sell your personal information to third parties, and we do not use health information you submit through the Site for purposes beyond those disclosed here and in our Notice of Privacy Practices.

3. Cookies and Tracking Technologies

We and our service providers use cookies, pixels, and similar technologies for: – Essential functions — Site security, load balancing, and basic functionality – Analytics — understanding how visitors use the Site (e.g., Google Analytics or similar tools) – Marketing — measuring and optimizing advertising (e.g., Meta/Facebook Pixel, Google Ads) and email engagement (e.g., through our email marketing platform)

You can control cookies through your browser settings, and where available, through an on-site cookie preference banner. Declining non-essential cookies will not affect your ability to browse the Site, but may affect certain personalization features. Our Site does not currently respond to browser “Do Not Track” signals.

If we display third-party advertising or run retargeting campaigns, you may opt out of interest-based advertising through the Digital Advertising Alliance at optout.aboutads.info or through individual platform settings (e.g., Meta Ads Preferences, Google Ads Settings).

4. How We Share Information

We disclose information only as follows:

• Service providers / business associates — vendors who perform functions on our behalf (scheduling, hosting, email/SMS marketing, payment processing, IT support, cloud storage). Where a vendor may access PHI, we maintain a HIPAA Business Associate Agreement with that vendor.
• Payment processors — to complete transactions. We do not store full payment card numbers on our own servers.
• Legal and safety purposes — to comply with a subpoena, court order, or other legal obligation; to protect the rights, property, or safety of DPC, our patients, or others; or as otherwise permitted or required by law (including HIPAA and Florida law).
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to standard confidentiality protections.
• With your consent — for any other purpose you specifically authorize.

We do not sell or rent your personal information to third parties for their own independent marketing purposes.

5. Protected Health Information and HIPAA

Direct Preventive Care is a “covered entity” under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”). Any information that identifies you and relates to your past, present, or future physical or mental health, health care, or payment for health care — whether submitted through the Site, by phone, by email, or in person — may constitute “protected health information” (“PHI”) and is handled according to HIPAA, not merely this Privacy Policy.

• This Privacy Policy governs our website. Our separate Notice of Privacy Practices (“NPP”) governs how we use and disclose PHI, and is the controlling document for that purpose. You will receive our NPP at your first appointment (or upon request), and it is also available at our office and, upon request, electronically.
• Permitted uses without your authorization. Consistent with HIPAA, we may use or disclose PHI without a separate written authorization for treatment, payment, and health care operations, and in other limited circumstances required or permitted by law (e.g., public health reporting, responding to a valid legal process). Any other use or disclosure of PHI — including for most marketing purposes — requires your written authorization, which you may revoke at any time.
• Minimum necessary. We limit our use, disclosure, and request of PHI to the minimum necessary to accomplish the intended purpose, except where HIPAA does not require this limitation (e.g., disclosures to you or your treatment providers).
• Business associates. Where a vendor (e.g., our EHR/scheduling platform, IT support, or a lab) creates, receives, maintains, or transmits PHI on our behalf, we maintain a HIPAA Business Associate Agreement with that vendor.
• Text, email, and online communications. If you choose to communicate with us by unencrypted email, text message, or online form about your health, please understand that these channels may not be fully secure. By initiating contact through these channels, you accept this risk; we recommend using our secure patient portal or calling our office for sensitive matters.
• Your HIPAA rights. As a patient, you generally have the right to: request access to and a copy of your medical records; request corrections/amendments to your records; request an accounting of certain disclosures; request restrictions on certain uses or disclosures; request confidential communications by an alternative means or at an alternative location; be notified of a breach of unsecured PHI; and receive a paper copy of the NPP even if you agreed to receive it electronically. These rights, and how to exercise them, are described fully in our NPP.
• Complaints. If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer using the contact information in Section 12, or directly with the U.S. Department of Health and Human Services, Office for Civil Rights, at www.hhs.gov/ocr/complaints or 1-800-368-1019. We will not retaliate against you for filing a complaint.

6. Data Security

We maintain administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, disclosure, alteration, or destruction, consistent with our obligations under HIPAA and the Florida Information Protection Act (FIPA), Fla. Stat. § 501.171. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Breach notification. In the event of a breach of security involving unencrypted personal information, we will notify affected individuals and, where required, the Florida Department of Legal Affairs and/or the U.S. Department of Health and Human Services, within the timeframes required by applicable law (generally within 30 days under FIPA for qualifying breaches affecting Florida residents, and consistent with HIPAA Breach Notification Rule timeframes for PHI).

7. Data Retention

We retain personal information collected through the Site only as long as reasonably necessary for the purposes described in this Policy, to comply with our legal, regulatory, licensing, and medical recordkeeping obligations (Florida medical record retention rules generally require adult patient records to be kept for a minimum period after the last patient contact), and to resolve disputes and enforce agreements. When information is no longer needed, we take reasonable steps to securely delete or de-identify it.

8. Your Choices and Rights

• Marketing communications — You may opt out of promotional emails using the unsubscribe link in any email, and opt out of promotional texts by replying STOP. You may still receive non-promotional communications related to your care (e.g., appointment reminders) unless you request otherwise directly with our office.
• Access/correction — You may request access to or correction of personal information we hold about you by contacting us using the information in Section 11. Patients also have rights under HIPAA to access and request amendment of their medical records, as described in our Notice of Privacy Practices.
• Florida residents — Florida’s comprehensive consumer privacy statute (the Florida Digital Bill of Rights) applies only to a narrow category of very large businesses (generally those with over $1 billion in global annual revenue) and does not currently apply to DPC. As a matter of practice, however, we honor reasonable requests from Florida residents to access, correct, or delete personal information submitted through the Site, subject to our recordkeeping obligations as a health care provider.
• California/other state residents — If you are a resident of a state with its own comprehensive privacy law, and that law applies to us, we will honor applicable rights requests submitted to the contact information below.

9. Third-Party Links

The Site may contain links to third-party websites (e.g., social media, scheduling tools, payment portals). We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies separately.

10. Children’s Privacy

Our Site and Services are intended for individuals 18 years of age and older. We do not knowingly collect personal information from children under 13 (or process it in a manner that would trigger COPPA obligations). If you believe a child has provided us with personal information, please contact us so we can delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will post the updated version on this page with a revised “Last Updated” date. Material changes will be reflected here; continued use of the Site after changes are posted constitutes acceptance of the updated Policy.

12. Contact Us

If you have questions about this Privacy Policy or wish to exercise any of the rights described above, please contact:

Direct Preventive Care Attn: Dr. Manuel Omar Cruz Orlando, Florida Website: www.directpreventive.com Phone: (321) 844-3820 Email: support@directpreventive.com