RYSO Privacy Notice

Interim effective date: September 8, 2026 Operator: RYSO CORPORATION, a Florida company ("RYSO," "we," "us," or "our") Address: 15241 NW 88th Ave, Miami Lakes, FL 33018 Privacy contact: info@rysohealth.com

This Privacy Notice explains how RYSO collects, uses, discloses, and retains personal information through its physician and business-to-business distribution website, account portals, ordering tools, and related support interactions (collectively, the “Services”).

1. Scope

This Notice applies to business contacts, healthcare professionals, authorized customer representatives, prospective customers, website visitors, and others who use the Services. It does not apply to workforce records or information governed by a separate written agreement that expressly supersedes this Notice.

The Services are not designed to receive patient records or protected health information (“PHI”). Do not enter patient names, diagnoses, treatment records, insurance information, or other PHI into free-text fields, support messages, or uploads. RYSO does not agree to act as a HIPAA business associate unless RYSO signs a separate written Business Associate Agreement before receiving PHI.

2. Information We Collect

Depending on how you interact with the Services, we may collect:

• Account and identity information: name, business email, telephone number, organization, job title, login credentials or authentication identifiers, and account role.
• Professional and business information: practice or facility details, professional credentials or license information where needed for account review, billing and shipping addresses, tax or resale documentation, and authorized purchaser information.
• Order and transaction information: products requested or ordered, order history, fulfillment status, invoices, credits, returns, and related business records. Public pages display only active product names and descriptions that RYSO has approved for publication. Prices, account pricing, quantities, availability, inventory locations, and inventory status remain private.
• Payment information: payments may be processed by a third-party payment processor. RYSO may receive transaction identifiers, payment status, card brand, and limited masked payment details, but does not intend to store complete payment-card numbers or security codes.
• Communications: messages, support requests, feedback, and records of interactions with RYSO.
• Device and usage information: IP address, device and browser information, timestamps, authentication and security events, requested pages, and diagnostic logs.
• Cookies and similar technologies: strictly necessary technologies used for authentication, security, preferences, and core operation. Analytics remain disabled at launch unless RYSO affirmatively enables them and updates this Notice and any required consent controls.
• Information from service providers and business partners: identity/authentication results, payment status, fulfillment information, and other information needed to operate the Services.

3. How We Use Information

We may use personal information to:

• create, authenticate, secure, and administer accounts;
• determine whether an organization or representative is eligible to use restricted business features;
• process and fulfill orders, payments, invoices, returns, and customer-service requests;
• communicate about accounts, transactions, security, service changes, and requested information;
• maintain product, customer, order, inventory, and audit records;
• detect, investigate, and prevent fraud, abuse, unauthorized access, and security incidents;
• comply with law, regulatory requests, tax obligations, contractual duties, and internal compliance requirements;
• establish, exercise, or defend legal claims; and
• improve the reliability, accessibility, and operation of the Services using information reasonably necessary for those purposes.

RYSO will not use account or order information to make patient treatment decisions. The Services do not provide medical advice.

4. How We Disclose Information

We may disclose personal information:

• to hosting, database, authentication, communications, payment, security, professional-advisory, and fulfillment providers that process information for RYSO;
• to a customer organization and its authorized administrators regarding activity within that organization’s account;
• to manufacturers, distributors, carriers, or other counterparties as reasonably necessary to complete an authorized transaction;
• when required by law, legal process, or a lawful government request;
• when reasonably necessary to protect the rights, safety, systems, customers, or property of RYSO or others;
• in connection with a merger, financing, acquisition, restructuring, bankruptcy, or transfer of all or part of the business, subject to appropriate protections; or
• with your direction or consent.

At launch, RYSO does not knowingly sell personal information for money or share it for cross-context behavioral advertising. If that practice changes, RYSO will update this Notice and provide legally required choices before the change applies.

5. Payment Processing

Payment transactions may be handled by Stripe or another disclosed payment processor. The processor’s own privacy notice governs information it collects directly. RYSO receives only the information reasonably needed to confirm and administer the transaction.

6. Data Retention — Proposed Schedule Requiring Owner Approval

RYSO proposes to retain information only as reasonably necessary for the purposes described above, including legal, tax, accounting, security, dispute, and contractual requirements. The proposed launch schedule is:

• account profile and credential records: while the account is active and generally three years after closure;
• orders, invoices, payments, tax, fulfillment, and material business records: generally seven years after the relevant transaction;
• routine support communications: generally three years after resolution;
• authentication, security, and diagnostic logs: generally up to 24 months;
• marketing contact information: until opt-out or deletion where applicable, while retaining a minimal suppression record to honor the opt-out; and
• records subject to litigation hold, regulatory inquiry, fraud investigation, or another legal duty: for the period reasonably required by that duty.

RYSO may retain deidentified or aggregated information that cannot reasonably identify an individual. These periods may be shortened or extended when required by law, contract, a documented security need, or a legal hold.

7. Security

RYSO uses administrative, technical, and physical safeguards designed to protect personal information. No system is completely secure. Users must protect their credentials, use only authorized accounts, and promptly report suspected unauthorized access to info@rysohealth.com.

8. Your Choices and Requests

Subject to applicable law and appropriate identity verification, you may ask RYSO to access, correct, or delete personal information associated with you, or object to certain nonessential uses. Some information cannot be deleted when retention is necessary for an order, security, tax, legal, or contractual obligation.

To make a request, email info@rysohealth.com with the subject “Privacy Request.” RYSO may request information reasonably necessary to verify identity and authority. Authorized agents must provide proof of authority where required.

You may opt out of marketing email using the unsubscribe mechanism in the message or by contacting RYSO. Transactional, security, and account-administration communications are not marketing messages.

9. Children

The Services are intended for businesses and professionals and are not directed to children under 18. RYSO does not knowingly collect personal information from children through the Services.

10. State and Other Privacy Rights

Residents of certain jurisdictions may have additional rights under applicable law. RYSO will honor rights that apply to its processing and will not discriminate against a person for making a valid request. This Notice does not state that a particular comprehensive state privacy law applies when its statutory thresholds or other requirements are not met.

11. International Use

The Services are operated from the United States. If you access them from another country, information may be processed in the United States, where laws may differ from those in your location. International availability is not promised unless RYSO expressly authorizes it in writing.

12. Changes to This Notice

RYSO may update this Notice to reflect legal, operational, or service changes. RYSO will post the revised version with a new effective date and provide additional notice when required by law. Material changes will not be applied retroactively where prohibited.

13. Contact

Questions or privacy requests may be sent to:

RYSO CORPORATION 15241 NW 88th Ave Miami Lakes, FL 33018 info@rysohealth.com

Outstanding owner/counsel review items for final policy

• Approve or revise the proposed retention schedule in Section 6.
• Confirm whether RYSO will accept any PHI and, if so, implement a separate HIPAA/BAA program before doing so.
• Confirm the complete vendor list and whether any analytics or advertising technology will be enabled.
• Confirm whether the launch will accept users outside the United States or in comprehensive state-privacy jurisdictions.
• Confirm the privacy-request workflow and responsible operator.