Legal

HIPAA Notice

Version 2 · Effective: February 17, 2026

HIPAA-Aligned Privacy Practices Notice

Function Bone Health — A Project of BioX Unlimited LLC

Effective Date: February 13, 2026 Last Updated: February 13, 2026

Important Clarification

Function Bone Health is a wellness education and screening center, not a covered healthcare provider, health plan, or healthcare clearinghouse as defined by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). Because we may collect health-related screening data as part of our educational services, we voluntarily adopt privacy and security practices aligned with HIPAA standards to ensure the highest level of protection for your information. This notice describes those practices.

This notice does not create HIPAA-covered entity obligations for BioX Unlimited LLC where such obligations do not exist under federal law.

1. Our Commitment to Your Privacy

BioX Unlimited LLC, doing business as Function Bone Health and operating Strength Lab Plus wellness studios, is committed to maintaining the privacy and security of your health-related screening information ("Health Screening Information" or "HSI"). This notice describes how your HSI may be used and disclosed, and how you can access your information.

2. What Health Screening Information We Collect

HSI may include:

REMS bone health screening results (density measurements, quality indicators, fragility score estimates, fracture risk estimates)
BioDy body composition analysis measurements
Health questionnaire responses you voluntarily provide
Wellness consultation notes and educational plan details
Screening history and follow-up records
Any other health-related information you voluntarily share with us during the course of our services

3. How We May Use and Disclose Your HSI

3.1 Uses That Do Not Require Your Authorization

We may use and disclose your HSI without your written authorization for the following purposes:

Service Delivery: To provide our screening services, deliver results, prepare wellness education plans, and manage your account and service history.

Payment and Billing: To process payments, manage deposits, handle HSA/FSA transactions, and manage billing-related activities.

Operations: To improve our services, conduct quality assurance, train staff (using de-identified data), audit internal practices, and ensure compliance with our standards.

Legal Requirements: When required by applicable law, regulation, or legal process, including responding to valid subpoenas, court orders, or government investigations.

Public Safety: When necessary to prevent or lessen a serious and imminent threat to your health or safety or to the health or safety of the public.

Required by Law: We will disclose HSI when required to do so by federal, state, or local law.

3.2 Uses That Require Your Written Authorization

The following uses and disclosures require your written authorization:

Marketing communications using your HSI (other than face-to-face communications and promotional gifts of nominal value)
Sale of your HSI (we do not sell HSI)
Most other uses and disclosures not described in this notice

You may revoke your authorization at any time by submitting a written request to our Privacy Officer. Revocation will not affect any actions taken in reliance on your authorization prior to revocation.

4. Your Rights Regarding Your HSI

4.1 Right to Access

You have the right to request access to and obtain a copy of your HSI maintained by us. Requests must be submitted in writing. We will respond within thirty (30) days of receiving your request. We may charge a reasonable, cost-based fee for copies.

4.2 Right to Amendment

You have the right to request an amendment to your HSI if you believe it is inaccurate or incomplete. Requests must be submitted in writing with a reason supporting the amendment. We will respond within sixty (60) days. We may deny amendment requests in certain circumstances and will provide a written denial with an explanation.

4.3 Right to Restriction

You have the right to request that we restrict certain uses and disclosures of your HSI. We are not required to agree to all restriction requests. However, if you pay for a service entirely out-of-pocket and request that we not disclose HSI related to that service, we will honor that restriction.

4.4 Right to Accounting of Disclosures

You have the right to receive an accounting of certain disclosures of your HSI made during the six (6) years prior to your request (or from our effective date, whichever is shorter). This accounting will not include disclosures made for service delivery, payment, operations, or disclosures you authorized.

4.5 Right to Confidential Communications

You have the right to request that we communicate with you about your HSI in a certain way or at a certain location. For example, you may request that we contact you only by email or only at a specific phone number. We will accommodate reasonable requests.

4.6 Right to a Copy of This Notice

You have the right to obtain a paper or electronic copy of this notice at any time by contacting our Privacy Officer.

5. Our Responsibilities

We are committed to:

Maintaining the privacy and security of your HSI
Providing you with this notice of our privacy practices
Following the terms of this notice currently in effect
Notifying you if a breach of your unsecured HSI occurs

6. Breach Notification

In the event of a breach of your unsecured HSI, we will notify you in writing within sixty (60) days of discovering the breach. The notification will include:

A description of what happened, including the date(s) of the breach and the date of discovery
The types of HSI involved
Steps you should take to protect yourself
What we are doing to investigate, mitigate, and prevent future breaches
Contact information for further questions

7. Safeguards

We maintain administrative, technical, and physical safeguards to protect your HSI, including:

Role-based access controls limiting access to authorized personnel
Encryption of electronic HSI in transit and at rest
Secure physical storage for any paper records
Regular security training for all staff who handle HSI
Business associate agreements with third-party service providers who access HSI
Regular review and updating of security practices

8. Business Associates

We require any third-party service providers who access, maintain, or process HSI on our behalf to enter into agreements requiring them to maintain the privacy and security of your information. These third parties include our payment processor (Stripe), booking platform (GoHighLevel), and any other service providers with access to HSI.

9. Complaints

If you believe your privacy rights have been violated, you may:

File a complaint with our Privacy Officer at the contact information below
File a complaint with the U.S. Department of Health and Human Services Office for Civil Rights at www.hhs.gov/ocr/complaints or by calling 1-877-696-6775

You will not be retaliated against for filing a complaint.

10. Changes to This Notice

We reserve the right to change the terms of this notice at any time. Changes will be effective for all HSI we maintain. The revised notice will be posted on our Website and available at our locations.

11. Contact Information

Privacy Officer: Nataliya Koval Organization: BioX Unlimited LLC d/b/a Function Bone Health Address: 3341 N Tamiami Trail, Naples, FL 34103 Phone: (239) 544-4114 Email: info@functionbonehealth.com

For rights requests, please submit in writing and include your full name, contact information, and a clear description of your request.