HIPAA Notice & Privacy Practices

1. Omigenix's HIPAA Status

Omigenix LLC is a management services organization (MSO) that provides administrative, operational, and technology services to licensed healthcare providers. In this capacity, Omigenix is not a covered entity under the Health Insurance Portability and Accountability Act (HIPAA).

The Platform is a business-to-business (B2B) ordering tool designed exclusively for licensed healthcare providers. It is not a patient-facing platform and is not designed to collect, store, or process patient-specific protected health information (PHI).

2. What Information We Handle

The Platform collects and processes the following provider-level information only:

• Provider name, license number, and practice information;
• Shipping address for product delivery to the provider's practice;
• Order history and product selections;
• Payment and billing information.

None of the above constitutes protected health information (PHI) under HIPAA. Omigenix does not collect, request, or store patient names, patient identifiers, diagnoses, treatment information, or any other patient-specific data.

3. Provider Responsibilities Regarding PHI

As a licensed healthcare provider, you are a covered entity or business associate under HIPAA and are solely responsible for:

• Ensuring that no patient PHI is submitted through the Platform at any time;
• Maintaining HIPAA compliance in your own practice and clinical operations;
• Obtaining all required patient consents before administering any compounded products ordered through the Platform;
• Maintaining appropriate clinical documentation in accordance with HIPAA and applicable state law.

4. Business Associate Agreements

Because Omigenix does not handle PHI in the course of its standard platform operations, a Business Associate Agreement (BAA) is not required for standard use of the Platform. However, if at any point the nature of our services requires Omigenix to access, process, or store PHI on your behalf, we will enter into a mutually acceptable BAA before doing so.

If you believe a BAA is required for your specific use case, please contact us at info@synagenix.com to discuss.

5. Data Security Practices

Although Omigenix is not subject to HIPAA as a covered entity, we apply high standards of data security to all information handled through the Platform, including:

• Encrypted data transmission using industry-standard SSL/TLS protocols;
• Secure, PCI-compliant payment processing through third-party processors;
• Access controls limiting data access to authorized personnel only;
• Regular security assessments and platform monitoring.

6. Incident Notification

In the event of a data security incident that may affect provider information stored on the Platform, Omigenix will notify affected providers promptly and take appropriate remediation steps in accordance with applicable law.

7. Questions and Contact

If you have questions about this HIPAA Notice, our data practices, or wish to request a Business Associate Agreement, please contact us: