Privacy notice

Effective November 1, 2026

About this notice

Open Lab Solutions, Inc. ("OLS," "we," "us," "our"), 7780 E. 106th Street, Tulsa, OK 74133, operates the Wellness Reporting Suite. This notice explains what information we collect, how we use and share it, how long we keep it, how we protect it, and the choices and rights you have. It covers:

• this website, www.wellnessreportingsuite.com (the "website");
• the portal at app.wellnessreportingsuite.com that laboratories, and the clinicians and facility staff they authorize, use to work with reports (the "laboratory portal"); and
• the patient portal at app.wellnessreportingsuite.com/patient (the "patient portal").

1. The two roles we play

For laboratories, we are a business associate. Clinical laboratories engage us to turn their test results into reports for the clinicians who ordered the tests. When we handle patients' information for a laboratory, the laboratory is a "covered entity" under HIPAA, the federal health privacy law, and we are its "business associate." We have a signed Business Associate Agreement with each laboratory whose patient information we handle [OWNER CONFIRM: a signed Business Associate Agreement that sets out its permitted uses covers every laboratory whose data the service has received, Wellness Health Group included], and we use and disclose patient information only as that agreement and the law permit. Your laboratory's own notice of privacy practices explains how the laboratory handles your health information and your rights under HIPAA; this notice does not replace it. Section 6 explains how patients exercise those rights.

For everything else, this notice describes our own practices. That includes what you send us through this website and the account and activity information of people who use the portals.

2. Information we collect

What you send us through the website's forms. Our Get started, Contact and BAA request forms ask for your organization, your name and your work e-mail address and, if you choose to give them, your phone number, your role and your state or region. They also ask what you are interested in, your approximate testing volume, the panels you run, how your laboratory receives results, and an optional message. We record which page you sent the form from. Our staff add a status and notes as we follow up.

Please do not send patient information or other health information through the website's forms. The forms are for laboratories and clinicians. If you are a patient, please contact the laboratory or clinician who ordered your test. If health information about you reaches us outside our work for a laboratory, our Consumer Health Data Privacy Policy explains how we handle it.

Information collected automatically on the website. Like other web servers, ours records each request it receives: the network (IP) address it came from, the date and time, the page or file requested (including any query in the web address), the result, the description your browser sends of itself (its "user agent") and the address of the page that linked to ours. We do not keep your network address or browser details with what you send us through a form. The website sets no cookies, uses no browser storage, and loads no outside scripts, fonts, analytics, tracking pixels or advertising.

In the laboratory portal. Portal accounts are created by a laboratory's administrator for the laboratory's staff and for the clinicians and facility staff the laboratory authorizes. We collect:

• Account details: your name, work e-mail address, roles and the facilities you may see, which your laboratory's administrator gives us.
• Sign-in security information: your password, which we store only as a one-way hash; the secret for your authenticator app, which we store encrypted; and single-use recovery codes, which we store only as one-way hashes.
• Sessions and devices: the network address and browser type of each signed-in session, so that you can see and end your sessions.
• Activity records: each sign-in, view, download, export and administrative action, with the network address and browser type it came from (the "audit trail").
• What you create and choose: messages you exchange with other portal users (message text is encrypted; subject lines are not), favorites, saved filter views, notifications, a list of recently visited pages (stored as record identifiers, not names), whether patient identifiers are shown to you unmasked (they are masked by default, and changing this setting is recorded), and your light or dark display preference if you set one.

Patient and test information, and the patient portal

Patient and test information from laboratories. To produce reports, laboratories send us information about their patients' tests, including the patient's name and date of birth, record and accession numbers, the specimen, the test results, details that affect treatment choices when the laboratory provides them (such as sex, pregnancy status and drug allergies), and the ordering clinician and facility. This is protected health information that we hold for the laboratory as its business associate.

In the patient portal. A laboratory decides whether to offer the patient portal. If yours does and you set up an account, we collect the e-mail address you use to sign in; your password (stored only as a one-way hash); your authenticator secret (stored encrypted); recovery codes (stored only as one-way hashes); the date and version of the patient portal terms you accepted; the network address and browser type of each signed-in session; messages you exchange with your laboratory (message text is encrypted; subject lines are not); and a record of each sign-in, view and download. All of this is protected health information that we hold for your laboratory. Who may use the patient portal, including the rules for minors and for parents, guardians and other representatives, is explained in Section 9.

Sensitive information. We do not ask for sensitive information through the website, such as health information, precise location or government identification numbers, and we ask you not to send it. In the portals, the sensitive information we hold is limited to (a) sign-in credentials, which we use only to sign you in and protect your account, and (b) the patient health information we hold for laboratories under HIPAA.

3. How we use information

We use information:

• to answer your inquiry and, if your organization becomes a customer, to set up and support its laboratory account, including sending you the information you asked for and following up about it;
• to provide the portals: to verify who you are when you sign in, keep you signed in, show you the information your role allows, deliver messages and notifications, and send sign-in codes and service notices (for example, notices to laboratory administrators about updates to the report engine);
• to produce, review and deliver reports for laboratories. Our reports are produced by applying clinical rules to the laboratory's test results. They are clinical decision support for licensed clinicians, who make every treatment decision. As each laboratory's Business Associate Agreement permits, we also use patient information to check the accuracy and safety of the reports we produce for that laboratory, and to improve the service using information from which identifying details have been removed as HIPAA requires;
• to keep the website, the portals and the people who use them safe: to detect and stop abuse and unauthorized access, investigate incidents, and keep the audit trail;
• to run our business with laboratories: for example, to keep the records we need to bill a laboratory and to meet our obligations under its agreement; and
• to comply with law, respond to lawful requests, and establish, exercise or defend legal claims.

What we never do with information

We use patient information only as the laboratory's Business Associate Agreement and HIPAA allow. We do not use any personal information for advertising, and we do not sell it.

4. Who receives information

We disclose information only to the following kinds of recipients:

• Service providers that work for us, under written contracts that limit what they may do with the information to providing their service to us. Today these are our e-mail delivery provider, [OWNER CONFIRM: name of the e-mail delivery provider], which delivers the e-mails we send [OWNER CONFIRM: and any other provider that hosts or operates part of our systems]. A service provider that handles patient information signs a business associate agreement with us before it does. [launch gate: site PC-9, PC-10]
• Have I Been Pwned (its "Pwned Passwords" service), which helps us check new passwords against passwords exposed in known data breaches. We send it only the first five characters of a one-way (SHA-1) hash of the new password and ask it to pad its answer so that the size of the answer reveals nothing; the comparison happens on our own servers. The service never receives your password, your e-mail address or your name.
• Your laboratory and the people it authorizes. In the portals, information is visible according to the roles a laboratory assigns. For example, laboratory staff see their laboratory's reports, ordering clinicians and facility staff see the reports of their own facilities, and a laboratory's administrators can see the audit trail for their laboratory's accounts.
• Computer systems a laboratory connects to the service, such as its own laboratory information system, at the laboratory's direction.
• Our own team. Our staff receive the details of each website form submission by e-mail. A short notice of each submission, containing only the organization, its interest and its volume range, with no contact details, is also posted in our internal team chat.
• Authorities and others when the law requires it, for example in response to a subpoena or court order, or to protect the rights, safety or security of people or of our service. For patient information, we make such disclosures only as HIPAA and the laboratory's agreement permit.
• A successor business, if OLS is involved in a merger, acquisition or sale of assets, subject to this notice and, for patient information, to the laboratory's agreement.

What we do not do

We do not sell personal information. We do not share it for cross-context behavioral advertising, use it for targeted advertising, or disclose it to others for their own marketing. We do not let other companies collect information about your activities on our website or portals over time and across other websites.

5. Cookies, browser storage, Do Not Track and Global Privacy Control

• Website: nothing. The website sets no cookies and uses no browser storage.
• Laboratory portal: one session cookie, protected so that the page's scripts cannot read it, sent only over secure connections and only with requests that start on our own site. It keeps you signed in and ends when you close your browser or your session ends.
• Laboratory portal: one browser-storage entry recording light or dark display, created only if you choose a display. It remembers your display choice until you change it or clear your browser's storage.
• Patient portal: one session cookie with the same protections, sent only with the patient portal's own requests. It keeps you signed in and ends when you close your browser or your session ends.

Sessions, Do Not Track and Global Privacy Control

Portal sessions end after a period of inactivity or after a maximum length, whichever comes first (by default, 15 minutes of inactivity or 12 hours).

Do Not Track. We do not track you across other websites, and we do not allow others to track you through ours. Because there is no such tracking to switch off, our website and portals work the same way whether or not your browser sends a Do Not Track signal.

Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of the sale and sharing of your personal information and of targeted advertising. Because we do none of those things, you are already opted out and no further step is needed. If we ever change that, we will update this notice first and honor the signal.

6. Patients: your health information and your HIPAA rights

• Your laboratory is in charge of your health information. We hold it on the laboratory's behalf and follow the laboratory's instructions and its Business Associate Agreement with us.
• To use your HIPAA rights, including the rights to see and get a copy of your information, to ask for corrections, to get a list of certain disclosures, to ask for restrictions or confidential communications, and to get a notice of privacy practices, contact the laboratory that performed your test. If you send such a request to us, we will pass it to your laboratory promptly.
• "Download my data" in the patient portal gives you a file with your account details and a list of your reports. Download each report from its page. For your messages or other records, ask your laboratory. It is a convenience and does not replace your laboratory's process for HIPAA requests.
• Questions about what a result means for your care should go to the clinician who ordered your test.
• E-mails from the patient portal never include your test results or details about your tests. They carry sign-in and activation codes, a notice that a new or updated result is ready (sign in to see it), a notice that a result you received is being corrected, a notice that your laboratory replied to your message, and notices about changes to your account. A "result is ready" e-mail does show that you have a result from a laboratory, so anyone who can read your e-mail can see that. You can turn off the e-mails about results on your Account page, or ask your laboratory to turn them off, without ending your access.
• Ending your access. Your laboratory can turn your patient portal access off or reset it. Turning access off stops anyone from signing in to your account; it does not delete your reports, which are part of your laboratory's records.

7. How long we keep information

• Website inquiries (what you sent us and our follow-up notes): if your inquiry does not lead to an agreement with your organization, we delete it 24 months after our last contact with you. If it does, it becomes part of that customer's records, and we keep it while the agreement lasts and afterward for as long as the agreement or the law requires.
• Web server records (network address, browser type, pages requested): deleted within 30 days.
• Copies of the e-mails we send (recipient, subject and text): 90 days. Any sign-in or activation code is removed from the copy once the e-mail has been sent.
• Records that slow down repeated failed sign-ins (account and network address): deleted after 30 days without activity.
• Session and device records (network address and browser type): deleted 30 days after the session ends.
• Laboratory portal account details: while your laboratory's agreement with us is in effect; then as described below for patient information.
• Recently visited pages, favorites, saved views and notifications: while your account exists, unless you remove them sooner.
• Messages between portal users, and between patients and their laboratory: while the laboratory's agreement with us is in effect; then as described below for patient information.
• Patient and test information, reports and patient portal accounts: as long as the laboratory's agreement with us requires. When the agreement ends, we return or destroy the information as our Business Associate Agreement requires or, where that is not feasible, keep protecting it and use it only for the purposes that make return or destruction infeasible.
• Audit trail (who did what, when, and from which network address and browser): at least six years. Because it is a tamper-evident security record, entries are not changed or deleted on request.
• Health information that reaches us outside our work for laboratories: deleted within 30 days after we reply (see our Consumer Health Data Privacy Policy). [launch gate: site PC-6(c)]
• Display preference in your browser: until you change it or clear your browser's storage.
• Backups: information deleted from our systems may remain in encrypted backups until those backups are replaced, which takes up to [OWNER CONFIRM: longest period a backup or prior backup version is kept; six months or less].

8. How we protect information

We use administrative, technical and physical safeguards suited to the sensitivity of the information, including:

• two-step sign-in with an authenticator app for every portal account, for staff and patients alike;
• passwords stored only as one-way hashes, and new passwords checked against breached and common passwords;
• additional encryption of especially sensitive values, such as message text and authenticator secrets, before they are stored;
• encrypted connections between your browser and our service and between our own systems [launch gate: G1, G2];
• encrypted storage [launch gate: G3], and encrypted backups whose decryption key is kept offline [launch gate: backups running];
• limits on repeated sign-in attempts and other abuse;
• a tamper-evident audit trail of portal activity, copied every day to storage that cannot be altered [launch gate: G4];
• e-mails from the portals that never include test results or details about tests (a "result is ready" e-mail shows only that a result exists), and web addresses and system logs that never contain patient names, dates of birth or results; and
• patient identifiers hidden by default in the laboratory portal.

No system is perfect

No method of transmitting or storing information is completely secure, and we cannot promise that information will never be accessed without permission. Please keep your password and authenticator to yourself, and tell your laboratory's administrator or us promptly if you think your account has been misused.

9. Children and minors

Our website. Our website is for laboratories, clinicians and other health care professionals, and for adults looking for information about our services. It is not directed to children. We do not knowingly collect personal information online from children under 13. If we learn that a child under 13 has sent us personal information through a form on our website, we will delete it. [launch gate: MC-17] If you think this has happened, contact us (Section 14).

The laboratory portal. Laboratory portal accounts are only for adults whom a laboratory authorizes.

The patient portal. The patient portal is only for patients who are 18 or older, and each account belongs to one patient. It does not offer accounts to children or teenagers. Parents, guardians and other representatives cannot use it to see another person's results at this time; they can ask the laboratory or the provider who ordered the test. If the date of birth in a laboratory's records is missing, looks wrong, or shows a person under 18, the patient portal does not allow an account, and turns off any existing account, until the laboratory checks the record.

Information about children that comes from laboratories. Laboratories we serve test patients of every age, including newborns and children. Information about a child's test comes to us from the laboratory, not from the child. We hold it for the laboratory as protected health information under HIPAA, and we use and share it only as our agreement with the laboratory and HIPAA allow (Sections 3 and 6). A parent or guardian with questions about a child's information, or who wants to use the child's health privacy rights, should contact the laboratory or the provider who ordered the test (Section 6).

Young people. We do not sell personal information or use it for targeted advertising, whatever a person's age.

10. Your privacy rights and choices

Website inquiries. You can ask us to show you, correct or delete what you sent us through the website. If we ever send you marketing e-mail, each message will tell you how to stop receiving it.

Laboratory portal users. Your laboratory controls your account. Ask your laboratory's administrator to change your account details or close your account, or contact us and we will work with your laboratory.

Patients. Your laboratory decides on requests about your health information; see Section 6.

State privacy rights. Depending on where you live, state law may give you the right to: confirm whether we process your personal information and see it; get a copy in a portable format; correct inaccurate information; have information deleted; get a list of the specific third parties to which we have disclosed it; and opt out of the sale of personal information, of targeted advertising, and of profiling that produces legal or similarly significant effects. Several of these laws do not apply to information about people acting for their employer or another business, or to health information governed by HIPAA, which is handled through your laboratory as described in Section 6. Wherever you live, we will respond to requests about the personal information this notice describes as our own, subject to the exceptions the law allows (for example, we keep the audit trail as a security record, and we keep information that a laboratory's agreement requires us to keep). We do not sell personal information or use it for targeted advertising, and we do not use it to make decisions about anyone that produce legal or similarly significant effects (our reports support clinicians, who make the decisions). There is therefore nothing to opt out of; if that ever changes, we will update this notice and give you a way to opt out first.

How to make a request. E-mail [OWNER CONFIRM: privacy contact e-mail], use our contact form, call [OWNER CONFIRM: privacy telephone number], or write to us at the address at the end of this notice. Tell us what you are asking for and how we can reach you. We will confirm that a request comes from you, usually by checking that it comes from the e-mail address we have on file or from your signed-in account, and we may ask for more information if we need it. You do not need to create an account. You may use an authorized agent; we may ask the agent for proof of your permission and may ask you to confirm your identity directly with us, as the law allows. We will confirm that we received your request within 10 business days and respond within 45 days. If we need more time, we will tell you why within those 45 days and take no more than 45 more days. Requests are free, unless they are clearly unfounded or excessive as the law allows. [launch gate: site PC-8]

Appeals. If we decline your request, in whole or in part, you can appeal by replying to our decision with the word "Appeal." Within 45 days of receiving your appeal, we will tell you in writing what we decided and why. If we deny your appeal, we will tell you how to contact your state's attorney general.

No discrimination. We will not deny you service or treat you differently because you exercised a privacy right.

Nevada residents. We do not sell covered information as Nevada law defines it. You may still send a request that we not sell it to [OWNER CONFIRM: privacy contact e-mail], our designated request address, and we will respond within 60 days.

California residents: "Shine the Light." We do not disclose personal information to third parties for their own direct marketing purposes.

Consumer health data. Our Consumer Health Data Privacy Policy describes how we handle health information that reaches us outside our work for laboratories, and how to exercise the rights that Washington, Nevada and other states give you over it.

11. Security incidents

If a security incident affects information that this notice describes as our own, we will notify affected people, laboratories and government authorities as required by applicable law. For patient information we hold for a laboratory, we notify the laboratory, which under HIPAA is responsible for notifying affected patients, and we support the laboratory as our agreement with it requires.

12. Where we operate

We store and process information in the United States, and our services are intended for use in the United States.

13. Changes to this notice

We will post any change to this notice on this page with a new effective date. If a change materially affects how we handle information we already hold about you, we will also tell portal users in the portal or by e-mail before the change takes effect.

14. How to contact us

Open Lab Solutions, Inc. · 7780 E. 106th Street, Tulsa, OK 74133 · Privacy e-mail: [OWNER CONFIRM: privacy contact e-mail] · Telephone: [OWNER CONFIRM: privacy telephone number] · Contact form

Open Lab Solutions, Inc. · 7780 E. 106th Street · Tulsa, OK 74133