Privacy Policy

1. Who We Are and Scope of This Policy

This Privacy Policy applies to the Thymos Health website, mobile applications, patient-facing digital services, communications, and other services that link to this Privacy Policy, collectively, the "Services."

Thymos Provider Group, PC is the medical practice through which licensed healthcare professionals provide clinical services.

Thymos Health, Inc. is the non-clinical management and technology company that provides administrative, technology, operational, and other support services to Thymos Provider Group.

Thymos Health, Inc. may access Protected Health Information on behalf of Thymos Provider Group as its Business Associate pursuant to a written Business Associate Agreement.

Both entities may be contacted at:

679 S. Eliseo Dr.
Greenbrae, CA 94904

Clinical services are available only in jurisdictions where the applicable Thymos healthcare professional is licensed, registered, or otherwise legally authorized to provide care.

The Services are designed for patients who ordinarily reside in the United States. An established patient who is temporarily traveling outside the United States may be able to receive limited follow-up or support where legally permissible. Thymos does not currently market or offer its clinical services to residents of foreign countries.

2. Relationship to Our HIPAA Notice of Privacy Practices

Certain information collected, created, maintained, or transmitted in connection with healthcare provided by Thymos Provider Group is Protected Health Information ("PHI") under the Health Insurance Portability and Accountability Act and its implementing regulations, or HIPAA.

Thymos Provider Group's separate Notice of Privacy Practices describes how PHI may be used and disclosed and explains your HIPAA rights.

Where information is governed by HIPAA, 42 C.F.R. Part 2, state medical privacy laws, or other healthcare privacy requirements, those laws and the Notice of Privacy Practices govern as applicable.

This Privacy Policy addresses both healthcare information and other information that may fall outside HIPAA, including information collected through public portions of the Thymos website.

3. Information We Collect

The information we collect depends on your relationship with Thymos and how you use the Services.

A. Identity, Contact, and Account Information

We may collect:

• name
• email address
• telephone number
• date of birth
• residential or mailing address
• account credentials
• authentication and multi-factor authentication information
• emergency contact information
• other information used to identify, authenticate, or communicate with you.

B. Demographic Information

To support appropriate medical care, we may collect information such as:

• age
• sex assigned at birth
• gender identity
• race or ethnicity
• preferred language
• state of residence
• physical location that you manually provide in connection with care
• other demographic information relevant to healthcare.

Thymos does not currently collect continuous or background GPS location through its mobile application.

C. Health and Medical Information

Because Thymos provides comprehensive healthcare, we may collect a broad range of medical and health information, including:

• symptoms and patient-reported outcomes
• diagnoses and health conditions
• past medical and surgical history
• medications, supplements, allergies, and treatment history
• treatment response and disease activity
• laboratory and biomarker information
• imaging and diagnostic results
• pathology information
• genetic information
• family medical history
• mental and behavioral health information
• reproductive and sexual health information
• nutrition and dietary information
• sleep information
• activity and exercise information
• environmental exposures and environmental health information
• social and lifestyle information relevant to care
• vital signs and other health measurements
• prescriptions and pharmacy information
• referrals and specialist information
• clinical notes and care plans
• uploaded records, photographs, and files
• information derived from or generated in connection with your care.

D. Health Information from Other Providers

At your request or authorization, Thymos may obtain records from outside healthcare providers.

Records may be received through:

• patient upload
• direct transfer from a healthcare provider
• fax
• direct patient-authorized retrieval from the patient's clinical provider.

Thymos does not use ordinary email as an approved method for receiving medical records.

Records temporarily received through upload, fax, or similar staging systems are transferred into the official electronic health record and temporary copies are deleted following successful import.

E. Insurance, Eligibility, Billing, and Payment Information

We may collect:

• insurance information
• employer or benefit eligibility information
• membership information
• payment status
• amount and date of payment
• reimbursement-related information
• information necessary to prepare medical insurance reimbursement documentation.

Stripe is currently Thymos's payment processor.

Thymos does not receive or store your full payment-card number. Payment-card credentials are handled by the payment processor.

Patients currently pay membership fees directly. Thymos may support HSA/FSA payments and employer-sponsored membership arrangements in the future.

F. Communications and Uploaded Content

We may collect information that you submit through:

• secure messages
• intake forms
• questionnaires
• telehealth encounters
• customer-support communications
• surveys
• uploaded documents or photographs
• feedback
• other communications with Thymos.

Clinical communications between patients and clinicians occur through secure clinical systems rather than ordinary SMS or email.

G. Telehealth Audio and AI-Assisted Documentation

With your affirmative consent, Thymos may record audio from a telehealth encounter.

Video is not recorded.

Consent to audio recording is obtained during onboarding and again before each recorded visit. You may decline recording and still receive the telehealth visit.

Audio may be processed by a healthcare technology provider acting as a Business Associate to create a transcript and AI-assisted draft summary to help the clinician prepare clinical documentation.

The clinician remains responsible for reviewing, editing, and approving the final clinical note.

Thymos generally retains:

• raw encounter audio for 90 days
• temporary transcripts for 90 days
• AI-generated draft summaries for 90 days.

These temporary materials are then automatically deleted, except where a valid legal hold or other legal requirement requires retention.

After the clinician signs the final note, Thymos does not use these temporary materials to make or change decisions about that patient's diagnosis, medications, treatment plan, eligibility for care, or other individual clinical management.

Temporary recordings and related materials may be used by authorized personnel for:

• quality assurance
• documentation quality
• clinician-performance evaluation
• audit
• internal validation
• internal improvement of Thymos systems and algorithms consistent with applicable law.

Access is limited to authorized personnel with a legitimate role-based need, including selected clinical leadership, quality personnel, administrators, and engineers.

Identifiable patient recordings are not provided to third parties to train their general-purpose artificial intelligence models.

The signed clinician-authored or clinician-approved clinical note is the permanent clinical documentation produced through this workflow.

H. Device, Application, and Technical Information

When you use the Services, we may collect technical information such as:

• device and browser type
• operating system
• application version
• authentication activity
• dates and times of access
• crash and diagnostic information
• security events
• network and connection information
• IP address or IP-derived information where processed as part of website, security, or infrastructure operations
• application performance information
• information reasonably necessary to protect and maintain our systems.

Within the clinical mobile application, Thymos uses HIPAA-appropriate reliability, security, and observability technology under appropriate contractual protections and configured for data minimization.

Thymos does not use advertising SDKs or marketing trackers within patient registration, intake, symptom questionnaires, scheduling, payment, or authenticated patient functionality.

4. Mobile Application Permissions

The Thymos mobile application may request the following device permissions when necessary for features you choose to use:

• Camera — to participate in telehealth video visits.
• Microphone — to participate in telehealth visits and, with separate consent, support audio-based clinical documentation.
• Photos and files — to allow you to upload medical records, images, and other information.
• Notifications — for appointment reminders and administrative or care-related reminders, such as completing required intake materials.
• Calendar — to allow you to add medical appointments to your device calendar.
• Bluetooth — to support telehealth audio and connected devices such as headphones.
• HealthKit or Health Connect — if enabled in the future, to allow you to choose to share activity, health, or wellness information with Thymos.

Thymos does not currently use biometric authentication.

If device-based biometric authentication such as Face ID, Touch ID, or Android biometric authentication is offered in the future, authentication will be performed by the device or operating system. Thymos will not receive or store the user’s biometric template solely as a result of that authentication.

5. How We Collect Information

We may collect information:

• directly from you
• from Thymos clinicians and care-team members
• from healthcare providers and organizations at your request or authorization
• from laboratories, pharmacies, imaging providers, and other healthcare entities involved in requested care
• from health plans, employers, or benefit administrators where needed to establish eligibility
• from service providers acting on our behalf
• automatically from your browser, device, or application
• from information generated in connection with providing requested Services.

6. How We Use Information

We may use information to:

• create, authenticate, and administer accounts
• verify identity
• determine eligibility for Services
• provide medical care
• evaluate symptoms, history, diagnoses, laboratory information, and treatment response
• create and maintain medical records
• coordinate care among healthcare professionals
• conduct telehealth encounters
• facilitate prescriptions, laboratories, imaging, referrals, and other healthcare services
• communicate with you
• process membership and payment transactions
• prepare reimbursement documentation
• provide customer and technical support
• improve healthcare quality and clinical operations
• support clinical documentation
• conduct audits and quality assurance
• evaluate clinician performance
• maintain and improve our technology
• develop and validate Thymos systems and algorithms as permitted by law
• protect accounts and systems from fraud, abuse, or unauthorized access
• investigate and respond to security incidents
• comply with legal, regulatory, licensing, medical-record, and professional requirements
• establish, exercise, or defend legal rights
• create and use de-identified or aggregated information as permitted by law.

We seek to limit collection, access, and use to information reasonably necessary and proportionate to the applicable purpose.

7. Artificial Intelligence and Automated Technology

Thymos may use artificial intelligence, automation, deterministic algorithms, and other computational technologies to support clinical and administrative workflows.

These tools may assist with activities such as organizing records, creating temporary transcripts or summaries, extracting information, supporting documentation, analyzing information, and improving internal workflows.

Artificial intelligence does not replace the professional judgment of a licensed Thymos clinician.

Clinically meaningful decisions concerning diagnosis, medication, treatment, and care remain the responsibility of licensed healthcare professionals.

Service providers that process PHI on behalf of Thymos are subject to appropriate privacy, security, and contractual requirements, including Business Associate Agreements where required.

Thymos does not permit identifiable patient information to be used by third-party service providers to train general-purpose artificial intelligence models for their own independent purposes.

8. How We Disclose Information

A. Between Thymos Provider Group and Thymos Health

Thymos Provider Group may disclose PHI to Thymos Health, Inc. for authorized management, technology, operational, administrative, and support functions pursuant to a Business Associate Agreement.

B. Healthcare Providers and Healthcare Organizations

We may disclose information to healthcare professionals and organizations involved in your care, including:

• physicians and specialists
• laboratories
• pharmacies
• imaging providers
• hospitals
• health information exchange or interoperability providers
• other entities involved in requested healthcare.

C. Service Providers and Business Associates

We use service providers to support functions including:

• electronic health records
• cloud hosting
• telehealth
• secure communications
• authentication
• cybersecurity
• observability and system reliability
• clinical documentation
• payment processing
• customer support
• records transfer
• other operational services.

Service providers may access information only as appropriate for the services they perform and are subject to contractual privacy, security, confidentiality, and data-use restrictions.

Where required by HIPAA, vendors that process PHI enter into Business Associate Agreements.

D. At Your Direction

We may disclose information when you request or authorize us to do so, such as when you ask us to send records to another provider.

E. Employers and Program Sponsors

If access to Thymos is sponsored by an employer or another organization, the sponsor may receive information necessary to establish eligibility and administer the program.

Thymos does not provide employers with identifiable diagnoses, symptoms, medications, treatment information, messages, medical records, or other clinical information absent patient authorization or another specific lawful basis.

Employer reporting is aggregated or de-identified.

Thymos's internal reporting standard requires at least 40 eligible members and 10 active members, and reporting is designed to suppress small cells or other information that could reasonably permit identification of an individual.

Business Associate Agreements are used where appropriate.

F. Payment and Reimbursement

Information may be disclosed to payment processors, health plans, or other entities where necessary to process payments, provide reimbursement documentation, or perform other lawful payment-related activities.

G. Legal, Regulatory, and Safety Purposes

We may use or disclose information where permitted or required to:

• comply with law or legal process
• satisfy mandatory healthcare reporting obligations
• respond to valid regulatory or governmental requests
• address serious threats to health or safety
• investigate security incidents or fraud
• establish or defend legal claims
• protect patients, clinicians, Thymos, or others.

Additional restrictions may apply to specially protected health information, including records protected by 42 C.F.R. Part 2.

H. Corporate Transactions

Information may be transferred in connection with a merger, financing, acquisition, restructuring, bankruptcy, or sale of some or all of a business, subject to applicable privacy and healthcare-law restrictions.

9. Cookies, Analytics, and Public Website Technologies

Public portions of thymoshealth.com currently use technologies including Google Analytics and Google Tag Manager for website analytics and infrastructure purposes.

Thymos maintains a cookie-consent mechanism that allows visitors to reject non-essential cookies.

Thymos recognizes applicable browser-based opt-out preference signals, including Global Privacy Control ("GPC"), where required by law.

Thymos may use advertising technologies on public-facing portions of the website subject to applicable consent and opt-out requirements.

Thymos does not permit advertising or marketing trackers in:

• patient registration
• clinical intake
• symptom questionnaires
• clinical appointment scheduling
• payment-for-care workflows
• authenticated patient functionality.

Public website forms may be measured for website analytics, but Thymos does not configure analytics or advertising technologies to capture the values users enter for fields such as name, email, phone number, or state.

10. Advertising and Health-Derived Audiences

Thymos does not sell PHI or Consumer Health Data.

Thymos does not upload patient lists or health-derived prospect lists to advertising platforms for:

• Customer Match
• Custom Audiences
• lookalike audiences
• retargeting
• similar audience-building or cross-context behavioral advertising.

Thymos does not use patient information or health-derived prospect information to create advertising audiences on third-party advertising platforms.

Thymos does not send advertising platforms conversion events that disclose or strongly imply a person's interaction with specific disease content, Autoimmune Guide activity, guide-form submissions, commencement of the patient intake journey, or similar health-derived activity.

Thymos may measure non-health-sensitive advertising or acquisition activity where permitted by law and platform rules, provided that the measurement does not disclose PHI or Consumer Health Data and is not used to create health-derived advertising audiences.

11. Global Privacy Control and Opt-Out Signals

Where applicable law requires recognition of universal opt-out preference signals, Thymos honors qualifying signals such as Global Privacy Control.

When an applicable signal is received, Thymos treats it as a request to opt out of processing that constitutes a sale, sharing, or targeted advertising under applicable law.

Thymos's systems are designed to prevent applicable advertising or sale/share technologies from operating contrary to such a preference.

12. Email, SMS, and Push Notifications

We may use email, SMS, and push notifications for administrative and service-related communications, such as:

• authentication
• appointment reminders
• required intake reminders
• account information
• billing or payment communications
• security notices
• other administrative messages.

Clinical communication is conducted through secure clinical systems, not ordinary SMS or email.

We avoid including sensitive diagnosis, medication, laboratory, or similar clinical details in ordinary SMS, email, or lock-screen push notifications.

Marketing communications are subject to any consent required by applicable law.

Where applicable, promotional email recipients may unsubscribe through the communication, and promotional SMS recipients may withdraw consent using mechanisms such as replying STOP.

You may manage push-notification permissions through your device settings.

13. De-Identified and Aggregated Information

Where permitted by law, Thymos may create information that has been aggregated or de-identified so that it no longer identifies an individual as required by applicable law.

We may use de-identified or aggregated information for:

• healthcare quality improvement
• analytics
• internal operations
• outcomes analysis
• technology development
• algorithm development and validation
• research
• publication of aggregate findings.

Thymos may work with qualified research partners to verify or analyze aggregate or de-identified outcomes.

Thymos does not currently license or sell de-identified patient datasets to third parties.

If this practice changes materially in the future, we will evaluate the change under applicable law and update our disclosures before implementing it.

Where required, Thymos maintains de-identified information in de-identified form and does not attempt to re-identify it except as permitted by law for purposes such as validating the de-identification process.

14. Research

Thymos may conduct or participate in research in the future.

Thymos's current policy is not to use identifiable PHI for formal research.

Research and published outcomes are intended to use appropriately aggregated or de-identified information and may be conducted or verified with appropriate research partners.

If Thymos later proposes research involving identifiable PHI, it will implement any authorization, Institutional Review Board, Privacy Board, or other process required by applicable law before such research begins.

15. Security

We maintain administrative, technical, organizational, and physical safeguards designed to protect personal and health information.

These safeguards may include:

• encryption
• multi-factor authentication
• role-based access controls
• access logging
• data minimization
• workforce privacy and security training
• vendor oversight
• security monitoring
• incident-response procedures
• other measures appropriate to the sensitivity of the information.

No electronic system can guarantee absolute security.

Where a breach or security incident triggers notification obligations under HIPAA, the Federal Trade Commission Health Breach Notification Rule, or applicable state law, Thymos will provide required notifications.

16. Data Retention

Thymos retains information only as long as reasonably necessary for the applicable purpose and as required by healthcare, legal, regulatory, tax, contractual, security, or professional obligations.

The official adult medical record is generally retained for at least 10 years following the last date of service, subject to longer retention where applicable state law, payer requirements, legal holds, or other obligations require it.

Temporary telehealth documentation materials are generally retained as follows:

• raw audio: 90 days
• transcript: 90 days
• AI-assisted draft summary: 90 days.

Other categories are retained according to Thymos's internal retention schedule and applicable law.

When information is no longer required, we delete, securely dispose of, or de-identify it as appropriate.

Backup copies may remain until deleted through ordinary backup cycling, except where applicable law requires faster deletion.

17. Account Deletion

Patients may initiate deletion of their Thymos user account directly through the iOS or Android application.

Information about account deletion is also available through Thymos's public Account Deletion page.

Deleting a Thymos user account is not the same as deleting a medical record.

When a verified deletion request is received:

• Thymos will delete or de-identify account and other information that it is not legally required or permitted to retain
• Thymos Provider Group will retain medical records and other information for periods required or permitted by healthcare, legal, regulatory, professional, billing, security, and other obligations.

A former patient may request reactivation of an account. Reactivation may be possible only where applicable information remains lawfully retained, technically available, and appropriate to restore.

18. Your Privacy Rights

Depending on your state of residence and the information involved, you may have rights to:

• know or confirm whether we process information about you
• access information
• obtain a portable copy of certain information
• correct inaccurate information
• request deletion
• withdraw consent
• opt out of sale
• opt out of sharing or targeted advertising
• limit certain uses of sensitive information
• obtain information about certain recipients of your data
• appeal certain privacy-request decisions
• exercise privacy rights without unlawful discrimination.

These rights are subject to applicable exemptions.

Rights concerning PHI and medical records may be governed by HIPAA and state healthcare law rather than general consumer privacy law.

To exercise a privacy right, contact:

privacy@thymoshealth.com
(415) 379-0745

We may take reasonable steps to authenticate your identity before fulfilling a request.

Where applicable law permits an authorized agent to act on your behalf, we may require evidence of the agent's authority and may separately verify your identity.

19. California Privacy Rights

California residents may have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and other California privacy and medical-information laws.

Where applicable and where information is not otherwise exempt, rights may include:

• knowing categories and specific pieces of personal information collected
• knowing sources and purposes of collection
• knowing categories of recipients
• access
• correction
• deletion
• portability
• opting out of sale or sharing
• limiting certain uses of sensitive personal information
• freedom from unlawful discrimination for exercising rights.

PHI governed by HIPAA and medical information governed by the California Confidentiality of Medical Information Act may be subject to separate statutory treatment.

Thymos does not currently sell personal information.

Thymos recognizes qualifying opt-out preference signals such as Global Privacy Control where required.

20. Washington Consumer Health Data

Certain information involving Washington consumers may be subject to Washington's My Health My Data Act.

That law contains significant exemptions for PHI and other healthcare information.

For Consumer Health Data that is subject to the law, please review the separate Washington Consumer Health Data Privacy Policy prominently linked from our website.

21. Nevada

Nevada's consumer health data law contains an exemption for persons and entities subject to HIPAA.

Thymos Provider Group is a HIPAA covered healthcare provider, and Thymos Health, Inc. performs HIPAA-regulated Business Associate functions.

Thymos nevertheless provides a supplemental Nevada Privacy Notice for transparency regarding its practices.

22. Other State Privacy Rights

Residents of other U.S. states may have additional rights under applicable comprehensive privacy, medical privacy, genetic privacy, biometric privacy, consumer-health-data, or other laws.

Where applicable, Thymos will honor rights required by those laws and will obtain consent for sensitive-data processing where legally required.

If state or federal healthcare privacy law provides greater protection than a general consumer privacy law, Thymos follows the more protective applicable requirement.

23. Children and Minors

The Services are currently intended for adults 18 years of age or older.

Thymos does not currently offer patient accounts or routine medical services to minors.

Thymos may offer care to minors in the future. Before doing so, Thymos will implement appropriate parental, guardian, adolescent-confidentiality, proxy-access, consent, and privacy procedures required by applicable law and will update relevant policies and notices.

If you believe information concerning a minor has been submitted improperly, contact privacy@thymoshealth.com.

24. Third-Party Services

The Services may link to or interact with third-party websites, applications, laboratories, pharmacies, healthcare providers, or other services that Thymos does not control.

When you independently interact with a third party outside the Thymos Services, that third party’s privacy practices may apply.

This Privacy Policy does not govern the independent practices of unrelated third parties.

25. Changes to This Privacy Policy

We may update this Privacy Policy as our Services, technology, business practices, or legal requirements change.

The "Last Updated" date indicates when the Policy was most recently revised.

Where required by law, we will provide additional notice of material changes and obtain consent before materially different processing of sensitive or Consumer Health Data where consent is required.

26. Contact Us

Thymos Health Privacy Office
Thymos Health, Inc.
Thymos Provider Group, PC
Attn: Nilesh Bhandari, COO and Privacy/Security Officer
679 S. Eliseo Dr.
Greenbrae, CA 94904
Phone: (415) 379-0745
Email: privacy@thymoshealth.com

Questions concerning PHI or HIPAA rights may also be addressed through the procedures described in the Thymos Provider Group Notice of Privacy Practices.