Consumer Health Data Addendum

Breast Imaging Finder (BIF)
Consumer Health Data Addendum

Supplement to the Breast Imaging Finder Privacy Policy and Terms of Use

Effective Date	March 22, 2026
Applies To	Breast Imaging Finder ("BIF"), including BIF websites, apps, provider dashboards, claim flows, reviews, inquiry tools, and related services.

1. Scope and Purpose

This Consumer Health Data Addendum supplements the BIF Privacy Policy. It explains how BIF collects, uses, discloses, protects, and honors rights relating to certain health-related information that may be treated as "consumer health data" under applicable U.S. state privacy laws, including laws that may apply to Washington, Nevada, Connecticut, and other jurisdictions that regulate consumer health data outside traditional HIPAA frameworks.

This Addendum is intended to give consumers a clear, stand-alone explanation of BIF's practices in plain English. Where this Addendum conflicts with another privacy notice for consumer health data, this Addendum controls for the subject matter addressed here.

2. Important Context About BIF

BIF is a directory and discovery platform for breast imaging facilities and related educational content. Depending on how you interact with BIF, we may collect information you provide directly, information generated by your use of the service, and certain health-related inferences or categories that may be considered consumer health data.

BIF is not a medical provider, health insurer, or emergency-response service. In many cases, information collected by BIF will not be protected health information subject to HIPAA. Even so, BIF treats health-related information with heightened care and limits collection and use to what is reasonably necessary for the services requested, legal compliance, security, and the other purposes described in this Addendum.

If BIF ever acts as a vendor to a HIPAA covered entity or business associate in a manner that requires a business associate agreement, the parties' written business associate agreement will govern the use and disclosure of protected health information within that specific relationship. This Addendum does not expand BIF's rights to use HIPAA-regulated data for independent purposes.

3. What We Mean by Consumer Health Data

For purposes of this Addendum, "consumer health data" means personal information that identifies your past, present, or future physical or mental health status, conditions, services, treatment, or care, or that can reasonably be used to infer such information. The exact legal definition may vary by state.

Examples may include information such as breast imaging search activity, facility inquiries that reveal interest in mammography or related services, appointment or scheduling requests, accessibility needs, information you include in open-text submissions, review content that discusses your care experience, certain location data associated with health-related searches, and technical identifiers or interaction data that can reasonably be linked to an interest in obtaining breast imaging services.

4. Categories of Consumer Health Data We May Collect

Contact and inquiry information, such as your name, email address, telephone number, city or ZIP code, and the content of messages you send through contact or inquiry tools.
Search and usage information, such as searches for mammography, breast imaging services, hours, accreditation indicators, accessibility options, languages, or facility comparisons.
Review and user-generated content, such as ratings, comments, survey responses, reports, or support requests that describe a health-related experience or preference.
Scheduling or referral-related information, if you voluntarily provide it through intake fields, uploads, support requests, or facility inquiry workflows.
Device, cookie, and online activity information that may reveal or help infer a health-related interest when you use BIF pages, search tools, or provider profile features.
Approximate or precise location information, where enabled by your device settings or browser permissions and where relevant to show nearby facilities or localized search results.
Sensitive information you choose to provide in free-text fields or uploads. We ask that you do not provide unnecessary medical details through open forms, public reviews, or general contact channels.

5. Sources of Consumer Health Data

Directly from you when you search, contact BIF or a facility, create an account, submit a review, fill out forms, request support, or otherwise interact with the platform.
Automatically from your browser, device, cookies, analytics tools, session logs, and similar technologies, subject to your settings and applicable law.
From providers, facilities, or integration partners if you direct them to share information with us or if the information is necessary to respond to a request you initiated.
From public or licensed sources where permitted by law, such as facility data sources, public business records, or accreditation-related information.

6. Why We Collect and Use Consumer Health Data

BIF collects and uses consumer health data only as reasonably necessary and proportionate to provide the services you request, operate the platform, protect users, comply with law, and support the limited business purposes described below.

To provide search, comparison, directory, and educational features you choose to use.
To help you locate breast imaging facilities and display relevant listings, badges, hours, geographic proximity, and provider-managed information.
To process and route facility inquiries, support requests, and communications you ask us to send or facilitate.
To maintain accounts, dashboards, and user preferences.
To detect, prevent, investigate, and address fraud, abuse, spam, platform misuse, security incidents, and other harmful activity.
To moderate reviews, enforce policies, and maintain the integrity of public-facing content and provider listings.
To comply with legal obligations, respond to lawful requests, protect rights and safety, and establish, exercise, or defend legal claims.
To perform analytics, debugging, quality assurance, and service improvement using data that is deidentified, aggregated, or otherwise used in a legally permissible manner.

Where applicable law requires consent for the collection or sharing of consumer health data for a particular purpose, BIF will seek the required consent or will refrain from the practice unless another lawful basis applies.

7. What We Do Not Do

We do not sell consumer health data for money.
We do not use consumer health data to make medical diagnoses or treatment decisions.
We do not knowingly publish private health details in public profile areas except to the extent a user voluntarily includes such details in public-facing content such as a review.
We do not permit facilities to access your private consumer health data unless doing so is necessary to carry out a request you initiated or another disclosure is authorized by law and this Addendum.

BIF may disclose consumer health data only as described in this Addendum, with your direction or consent, as reasonably necessary to provide requested services, or as otherwise permitted or required by law.

Service providers and processors that perform hosting, security, analytics, customer support, communications, payment processing, moderation support, or similar operational services on our behalf, subject to contractual restrictions.
Facilities or providers when you use BIF to send an inquiry, request contact, share information with a listing, or take another action that reasonably requires us to transmit your information.
Professional advisors, auditors, insurers, lenders, investors, or transaction counterparties, subject to confidentiality obligations and only where reasonably necessary for legitimate business operations.
Government authorities, regulators, courts, law enforcement, or other third parties when required to comply with law, protect rights or safety, investigate misconduct, or enforce our agreements.
A successor or affiliate in connection with a corporate transaction such as a merger, financing, acquisition, reorganization, sale of assets, or bankruptcy, subject to applicable law.

BIF will not share consumer health data with third parties for targeted advertising, cross-context behavioral advertising, or other purposes requiring affirmative consent unless and until such consent has been validly obtained where required by law.

BIF does not permit third parties to place tracking technologies on consumer-health-data pages for their own independent use except as disclosed in our Privacy Policy and implemented in compliance with applicable consent requirements.

Where required by applicable law, BIF will obtain consent before collecting or sharing consumer health data for a specified purpose, and we will provide additional notice where law requires enhanced disclosures.

You may withdraw consent for a future practice where consent is the basis for processing, subject to legal and operational limits. Withdrawal will not affect conduct that occurred before withdrawal became effective.

You may also manage certain data practices through browser settings, cookie preferences, device permissions, account settings, or by contacting us using the request methods described below.

10. Consumer Rights

Depending on your state of residence and applicable law, you may have one or more of the following rights with respect to consumer health data:

To confirm whether we are collecting, using, or sharing consumer health data about you.
To access the consumer health data we maintain about you, subject to lawful exceptions.
To delete consumer health data, subject to retention obligations and other lawful exceptions.
To withdraw consent for collection or sharing where consent is required.
To appeal a denial of your request, where an appeal right applies under law.
To receive a list of categories of third parties or specific third parties with whom we have shared consumer health data, where required by law.
To request correction of inaccurate information where correction rights apply under law.

To submit a request, contact us at hello@breastimagingfinder.com. We may need to verify your identity before processing a request. If we deny a request, we will explain how to appeal where an appeal right is available.

11. Data Security

BIF uses administrative, technical, and physical safeguards designed to protect consumer health data from unauthorized access, acquisition, use, modification, disclosure, or destruction. These safeguards include role-based access controls, vendor management, monitoring, incident response procedures, and other measures appropriate to the nature of the data and the size and complexity of our operations.

No system can be guaranteed to be completely secure. If we become aware of a breach involving consumer health data, we will respond in accordance with applicable law, contractual obligations, and our incident-response procedures.

12. Data Retention

We retain consumer health data only for as long as reasonably necessary for the purposes described in this Addendum, including to provide requested services, maintain records, comply with legal obligations, resolve disputes, enforce agreements, and protect against fraud or abuse. Retention periods may vary based on the type of data, the context of collection, and legal requirements.

When consumer health data is no longer needed, we will delete, deidentify, aggregate, or otherwise handle it in accordance with applicable law and our records-management practices.

13. Public Content and User Caution

Some BIF features may allow you to post content that can be viewed by others, such as ratings, reviews, comments, or public profile interactions. Please do not include diagnoses, test results, detailed medical histories, insurance numbers, or other sensitive information in public-facing fields.

If you choose to publish health-related information in a public area, you are directing that information to be disclosed publicly, and it may be viewed, copied, or retained by others. BIF may moderate, remove, or redact public content in accordance with its policies, but we cannot guarantee that all copies will be removed from the internet or third-party systems.

14. Minors

BIF is not directed to children under 13 and does not knowingly collect consumer health data from children under 13 through general public-facing features. If you believe a child has provided personal information to us in violation of applicable law, contact us so we can investigate and take appropriate action.

If a different age threshold applies under local law for certain services or data practices, BIF will apply that threshold where required.

15. State-Law Notices

Washington. If you are a Washington consumer, this Addendum is intended to serve as BIF's consumer health data privacy notice under Washington's My Health My Data Act. BIF will not collect or share consumer health data except as necessary to provide a product or service you requested, with your consent where required, or as otherwise permitted by law.

Nevada. If Nevada's consumer health data law applies, BIF will provide the rights, notices, consent practices, processor controls, and appeal process required by applicable law.

Connecticut and other states. If a state consumer health data law gives you additional rights or imposes different notice requirements, BIF will honor those requirements to the extent they apply to your interaction with the service.

Because privacy laws continue to evolve, BIF may update this Addendum from time to time to reflect changes in law, guidance, or platform practices.

16. Geofencing and Sensitive Tracking

BIF does not use geofencing around health care facilities to identify, track, or target consumers for health-related advertising or to collect consumer health data in a manner prohibited by law.

If BIF introduces a feature that relies on precise location information, we will provide the notices and obtain the permissions required by applicable law before activating the feature.

17. International Users

BIF is intended primarily for users in the United States. If you access the service from outside the United States, you understand that your information may be transferred to and processed in the United States or other jurisdictions, subject to applicable law.

18. Changes to This Addendum

We may update this Addendum from time to time. When we do, we will revise the Effective Date above and provide any additional notice required by law. Your continued use of the service after an updated Addendum becomes effective is subject to applicable law and does not waive any rights that cannot be waived by law.

19. Contact Us

If you have questions about this Addendum or would like to exercise your rights, contact BIF at:

Entity	I/O Trak, Inc. d/b/a Breast Imaging Finder (BIF)
Contact	hello@breastimagingfinder.com
Mailing Address	830 Sunshine Lane, Altamonte Springs, FL 32714