Notice of Privacy Practices

Pamoja Holistic Health ("Pamoja," "we," "us," or "our") is a digital holistic health platform committed to serving Black and Brown communities, caregivers, foster and adoptive youth, and families. We operate at pamojaholistic.health. This Notice of Privacy Practices describes how we may use and disclose health-related information about you and how you can get access to this information. Please review it carefully.

We may collect the following categories of information:

• Contact information — name, email address, phone number, and mailing address. • Health and wellness information — information you voluntarily share when using our platform, including wellness goals, health conditions, dietary preferences, and caregiver status. • Provider information — credentials, specialties, and practice details submitted by practitioners applying to join our network. • Usage data — pages visited, features used, and interactions with our platform (collected only with your consent via our cookie consent banner). • Communications — messages you send through our contact form or community forum.

We do not collect Social Security numbers, insurance information, or clinical medical records. Pamoja is not a covered entity under HIPAA in the traditional clinical sense; however, we treat all health-related information you share with us with the same level of care and respect that HIPAA requires.

We use the information we collect to:

• Provide, operate, and improve our platform and services. • Connect you with holistic health practitioners and community resources. • Send you wellness content, event announcements, and community updates (with your consent). • Respond to your inquiries and support requests. • Facilitate caregiver support services and foster youth resources. • Comply with applicable laws and regulations.

We do not sell, rent, or trade your personal or health information to third parties for marketing purposes.

We may share your information in the following limited circumstances:

• With practitioners you choose to contact — when you request a consultation or connect with a provider in our network, we share only the information necessary to facilitate that connection. • With service providers — we work with trusted vendors who are contractually obligated to protect your information and use it only to provide services on our behalf. • For legal compliance — we may disclose information when required by law, court order, or government regulation, or to protect the rights, property, or safety of Pamoja, our users, or the public. • With your consent — we will share your information for any other purpose only with your explicit consent.

We do not share health information with employers, insurers, or data brokers.

We implement administrative, technical, and physical safeguards designed to protect your information from unauthorized access, use, or disclosure. These measures include:

• Encrypted data transmission (HTTPS/TLS) for all information exchanged with our platform. • Access controls limiting who within our organization can view sensitive information. • Regular review of our security practices and vendor agreements. • Secure storage of any health-related information you share with us.

While we take these precautions seriously, no internet transmission or electronic storage is 100% secure. We encourage you to use strong passwords and to contact us immediately if you suspect unauthorized access to your account.

You have the following rights regarding your information:

• Right to access — you may request a copy of the personal information we hold about you. • Right to correction — you may request that we correct inaccurate or incomplete information. • Right to deletion — you may request that we delete your personal information, subject to certain legal exceptions. • Right to restrict processing — you may ask us to limit how we use your information. • Right to withdraw consent — where we rely on your consent to process information, you may withdraw it at any time without affecting the lawfulness of prior processing. • Right to opt out of communications — you may unsubscribe from marketing emails at any time by clicking the unsubscribe link in any email or contacting us directly.

To exercise any of these rights, please contact us using the information below. We will respond within 30 days.

Our platform is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected information from a child under 13, please contact us immediately and we will take steps to delete it. For foster and adoptive youth services, we work only with authorized caregivers and case managers acting on behalf of minors.

We may update this Notice of Privacy Practices from time to time to reflect changes in our practices or applicable law. When we make material changes, we will post the updated notice on this page with a revised effective date and, where appropriate, notify you by email. Your continued use of our platform after any changes constitutes your acceptance of the updated notice.