Privacy Policy

KoHealth Labs ("we," "us," or "our") is committed to protecting the privacy and security of your personal and health information. This Privacy Policy describes how we collect, use, disclose, and safeguard information obtained through our website, provider portal, and laboratory services. By accessing our website or using our services, you consent to the practices described in this policy.

We collect several types of information depending on how you interact with us: • Personal Information: Name, email address, phone number, practice or organization name, and mailing address. • Health Information: Patient names, dates of birth, insurance details, test orders, and laboratory results, collected only when authorized by a referring provider or the patient. • Technical Information: IP address, browser type, device information, and usage data collected through cookies and analytics tools. • Form Submissions: Information submitted through our Order a Test, Schedule a Pickup, Request a Phlebotomist, and Become a Provider forms.

We use the information we collect to: • Process laboratory test orders and deliver accurate results • Schedule specimen pickups and coordinate mobile phlebotomy services • Communicate with providers about orders, results, and account matters • Onboard new provider practices and configure portal access • Improve our website, services, and customer experience • Comply with legal, regulatory, and accreditation requirements • Send service updates, newsletters, or marketing communications (you may opt out at any time)

KoHealth Labs operates in compliance with the Health Insurance Portability and Accountability Act (HIPAA). All Protected Health Information (PHI) is handled according to federal privacy and security regulations. We maintain administrative, physical, and technical safeguards that protect the confidentiality, integrity, and availability of your health information. Access to PHI is restricted to authorized personnel who require it to perform their job duties.

KoHealth Labs maintains Cybersecurity Maturity Model Certification (CMMC) Level 2 compliance, demonstrating our commitment to safeguarding Controlled Unclassified Information (CUI) and federal contract data. This certification ensures our cybersecurity practices meet the rigorous standards required by the Department of Defense and other federal agencies.

We do not sell your personal or health information. We may share information in the following circumstances: • With referring providers and their authorized staff for the purpose of delivering test results • With insurance companies for billing and claims processing • With laboratory partners and subcontractors who assist in performing specialized testing • With federal, state, or local authorities when required by law or regulation • With your written consent or authorization All third parties with whom we share information are bound by confidentiality and data protection agreements.

We employ industry-standard security measures to protect your information, including encrypted data transmission (TLS/SSL), secure data storage, access controls, regular security assessments, and employee training. Our provider portal uses multi-factor authentication and role-based access to ensure only authorized users can view sensitive information. Despite these measures, no system is completely secure, and we cannot guarantee absolute protection of your data.

Our website uses cookies and similar technologies to enhance your browsing experience, analyze website traffic, and understand how visitors use our site. You can control cookies through your browser settings, but disabling them may affect certain website functionality. We use Google Analytics to collect anonymized usage data.

Depending on your location, you may have the following rights regarding your personal information: • Access: Request a copy of the personal information we hold about you • Correction: Request that we correct inaccurate or incomplete information • Deletion: Request that we delete your personal information (subject to legal retention requirements) • Restriction: Request that we limit the processing of your information • Portability: Request a machine-readable copy of your data • Opt-Out: Unsubscribe from marketing communications at any time To exercise any of these rights, please contact us using the information provided below.

We retain personal and health information for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required by law, regulation, or accreditation standards. Laboratory test records are typically retained for a minimum of two (2) years in accordance with CLIA and CAP requirements, though certain records may be retained longer based on state and federal regulations.

Our website and services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can take appropriate steps to delete it.

Our website may contain links to third-party websites or services. We are not responsible for the privacy practices or content of these external sites. We encourage you to review the privacy policies of any third-party sites you visit.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will post the updated policy on this page and update the "Last Updated" date below. We encourage you to review this policy periodically to stay informed about how we protect your information.

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us: KoHealth Labs Email: info@kohealthlabs.com Director of Business Development: amyp@kohealthlabs.com We are committed to resolving any privacy-related concerns promptly and transparently.