Clinic Terms of Use & Privacy Notice

Effective Date: August 27, 2025

These Terms of Use and Privacy Notice (the "Agreement") govern your clinic’s access to and use of the Miora Health platform, and describe the permissible uses and required safeguards when handling Protected Health Information ("PHI") provided through the platform by patients.

By accessing the Miora Health platform, your clinic agrees to comply with all applicable laws and the terms set forth in this Agreement. Failure to comply may result in suspension or termination of access.

1. Purpose and Scope

Miora Health offers a digital platform enabling patients to share microbiome-related screening results and health information with their chosen clinics. Clinics may access this information solely when granted access by the patient and must use it exclusively to support patient care.

This Agreement does not create a referral, employment, partnership, agency, or joint venture relationship between your clinic and Miora Health.

2. Patient Consent and Access Mechanism

Clinics may only access patient information when:

• A patient voluntarily enters the clinic’s unique access code on the Miora Health portal
• The patient has acknowledged and agreed to Miora Health’s Patient Terms of Use and Privacy Policy
• Access is granted solely at the discretion of the patient and may be revoked at any time

3. Information You May Access

Upon receiving patient consent, your clinic may access the following:

• Patient’s name, email address, and phone number
• Patient health questionnaire responses
• Microbiome test kit results generated by Miora Health

This information may not be supplemented, inferred, or cross-matched with other patient data sources without explicit patient authorization.

4. Permitted Uses of Patient Information

Your clinic may only use patient data for the following:

• Clinical decision-making in support of the consenting patient
• Communication with the patient regarding test results and recommendations
• Compliance with your clinic’s own recordkeeping obligations under law

Your clinic may not use patient data for:

• Marketing or advertising purposes
• Research or publication
• Resale or data monetization
• Any other purpose outside of direct clinical care without written patient consent

5. Data Security and Protection Requirements

Your clinic is legally obligated to:

• Maintain the privacy and security of all accessed patient data in accordance with HIPAA, HITECH, and applicable state laws
• Store downloaded or printed data securely and limit access only to personnel who require it for direct patient care
• Monitor access logs and usage to prevent unauthorized use or disclosure
• Notify Miora Health immediately at privacy@miorahealth.com in the event of any data breach or suspected breach

6. Retention and Audit Rights

Clinics must not retain any downloaded PHI for longer than required to fulfill its clinical purpose, unless otherwise required by law.

Miora Health reserves the right to audit clinic usage and access logs to ensure compliance with this Agreement.

7. Independent HIPAA Responsibility

Each clinic is independently responsible for compliance with HIPAA. Miora Health is not a Business Associate of any clinic under HIPAA, as all PHI is shared by the patient directly and voluntarily. Miora Health functions as a conduit facilitating patient-authorized sharing.

Should the nature of the clinic’s access evolve, a separate Business Associate Agreement (BAA) may be required and executed.

8. Indemnification

Your clinic agrees to indemnify, defend, and hold harmless Miora Health and its officers, directors, employees, and affiliates from and against any and all liabilities, claims, actions, damages, or expenses (including reasonable attorney’s fees) arising out of:

• Unauthorized use or disclosure of patient data
• Failure to comply with HIPAA, state laws, or these Terms
• Misrepresentation of your clinic’s legal or licensing status

9. Termination of Access

Miora Health reserves the right to suspend or revoke a clinic’s access to the platform without prior notice if:

• Any misuse, breach, or violation of this Agreement is detected
• A complaint from a patient is substantiated
• Required compliance actions are not promptly fulfilled

10. Compliance with Laws

Clinics must comply with all federal, state, and local laws and regulations applicable to the collection, use, and disclosure of patient health information, including:

• HIPAA and the HITECH Act
• Applicable state privacy laws
• Professional medical licensing and recordkeeping laws

11. Modifications to Terms

Miora Health reserves the right to amend these Terms at any time. Clinics will be notified of changes via email or the platform dashboard. Continued use of the platform after notice of changes constitutes acceptance of the new terms.

12. Acknowledgment and Acceptance

By accessing the Miora Health platform, your clinic:

• Acknowledge that you have read and understood this Agreement
• Affirm that you are authorized to accept these terms on behalf of your clinic
• Agree to abide by all obligations herein
• Consent to the use and disclosure of PHI as described

13. Questions or Concerns?

For questions, concerns, or to report a potential breach, contact: