Privacy Policy

Last updated: November 4, 2026

This Privacy Policy explains how Tomova Health, Inc. (“Tomova,” “we,” “us,” or “our”) collects, uses, discloses, and protects information in connection with our website, our progressive web application (the “Tomova App”), and our SMS-based patient outreach service (collectively, the “Service”). This Policy applies to visitors to our website, patients who receive SMS messages from Tomova or use the Tomova App, and prospective business partners. This Policy should be read together with our Terms of Service, which govern your use of the Tomova App and the Service generally. In the event of any conflict between this Policy and the Terms of Service https://tomova.com/terms with respect to privacy or data practices, this Policy controls.

Tomova is a patient health companion offered in connection with independent primary care practices. When a patient enrolls in Tomova, Tomova connects to the patient’s insurance benefit information through a payer-connectivity partner, identifies potential prescription savings opportunities and preventive care gaps, and communicates that information to the patient by SMS text message and through the Tomova App. Tomova also shares these findings with the patient’s physician practice, subject to the practice’s agreement with Tomova, so that the practice can factor this information into the patient’s care.

1. Notice Regarding Protected Health Information

Tomova provides its Service to physician practices that are “covered entities” under the Health Insurance Portability and Accountability Act (“HIPAA”). With respect to protected health information (“PHI”) that Tomova creates, receives, maintains, or transmits on behalf of a participating physician practice, Tomova acts as a “business associate” of that practice, and Tomova’s handling of that PHI is governed by a Business Associate Agreement (“BAA”) between Tomova and the practice, not by this Policy.

This Policy describes Tomova’s own data practices, including the personal information Tomova collects directly from and about patients in operating the Tomova App and SMS service, information collected through our public website, and information Tomova receives from a patient’s health plan through our payer-connectivity partner in order to provide the Service. If you are a patient and have questions about how your physician practice handles your health information generally, please contact your healthcare provider directly and refer to that practice’s Notice of Privacy Practices.

2. Information We Collect

2.1 Information Collected From Physician Practices and Health Plans

When you enroll in the Service, you provide Tomova with limited identifying information directly (such as your name, contact information, and date of birth) so that Tomova can identify you and initiate the consent process. Your physician practice may make you aware of the Service. If you agree at your practice to receive text messages from Tomova, practice staff record your consent and your mobile number in Tomova's system on Tomova's behalf.

Once you consent to connect your insurance information, Tomova, through its payer-connectivity partner, Flexpa USA Inc. (“Flexpa”), requests and receives insurance eligibility and benefit information and related claims and pharmacy benefit data from your health plan using the FHIR (Fast Healthcare Interoperability Resources) data-sharing standard. This connection relies on a federal right you already have as a patient: under the CMS Interoperability and Patient Access Final Rule, patients may direct their health plan to make their claims, encounter, and clinical data available through a standardized, FHIR-based Patient Access API to a third-party application of the patient’s choosing. Tomova, through Flexpa, uses this same standardized channel, at your direction, to retrieve the information described below.

• Insurance eligibility and coverage information

• Pharmacy benefit and prescription claims information relevant to identifying potential drug savings opportunities

• Preventive care and screening information relevant to identifying potential care gaps

• Medical and pharmacy claims, including diagnosis and procedure codes

Tomova requests only the specific categories of insurance and benefit information needed to identify savings opportunities and care gaps. By default, Tomova does not request or receive your full electronic health record, clinical notes, or treatment history from your physician practice or health plan. 

2.2 Information You Provide Directly

• Contact information, such as your name, phone number, email address, and insurance card images provided during enrollment or through the Tomova App

• Your consent and communication preferences, including your SMS opt-in and any opt-out requests

• Information you submit through the Tomova App, such as confirming or responding to a savings opportunity or care gap alert

• Communications you send to us, such as replies to SMS messages or emails to our support address

2.3 Information Collected Automatically

• Technical information such as device type, browser type, IP address, and app usage information, collected when you use the Tomova App. We do not use third-party analytics, advertising, or tracking tools, and information stored in your browser is used only to keep you signed in

• SMS delivery and engagement information (such as phone number and carrier information necessary for message delivery, delivery confirmation, and whether a message was opened or clicked), provided by our SMS delivery partner

3. How We Use Information

We use the information described above to:

• Identify and communicate potential prescription savings opportunities and preventive care gaps to you, and share these findings with your physician practice, as described in Section 5 below

• Send you SMS text messages and Tomova App notifications in accordance with your consent

• Operate, maintain, secure, and improve the Service

• Communicate with you about your enrollment, the Service, or your account

• Comply with applicable law, respond to legal process, and enforce our agreements

Tomova does not use your health information to make treatment decisions, and the Service does not diagnose, treat, or prescribe. Tomova surfaces informational and educational content for you and your physician’s consideration; all clinical decisions remain with your physician.

4. SMS Communications and Your Consent

Tomova sends SMS text messages only to patients who have provided express consent to receive them, consistent with the Telephone Consumer Protection Act (“TCPA”). Your consent to receive SMS messages is captured at the time of enrollment.

• Message frequency will vary based on your prescription and preventive care information.

• Message and data rates may apply.

• You may opt out of SMS messages at any time by replying STOP or similar verbiage permitting you to revoke consent, or by contacting us using the information in Section 14 below. Replies of STOP and HELP are processed automatically by our SMS delivery provider.

• You may request help by replying HELP, or by contacting your physician practice or Tomova directly.

Your mobile opt-in information and consent status will not be shared with any third party or affiliate for their own marketing purposes, and will not be sold or provided to lead generators. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Consenting to receive text messages is not a condition of receiving care or any service from your physician practice.

Additional terms specific to our SMS program, including the types of messages you may receive and how to manage your preferences, are set out in our Messaging Terms & Conditions, available at https://tomova.com/messaging-terms.

5. How We Share Information

We do not sell your personal information. We may share information as follows:

• With your physician practice, subject to the Practice Agreement between Tomova and your physician practice;

• With Flexpa, our payer-connectivity partner, to request and receive insurance and benefit information on your behalf, pursuant to your consent, which Flexpa may share with its own subcontractors to provide the connectivity described herein;

• With service providers who help us operate the Service, including our software development partner (Topflight Apps), our cloud hosting provider (Amazon Web Services), our SMS delivery provider (Twilio). We obtain drug-pricing information from NeedyMeds and Cost Plus Drugs, but we do not share your personal information with them;

• If and when we use artificial intelligence as described in Section 6 below, with our artificial intelligence provider, subject to a Business Associate Agreement;

• With professional advisors, such as legal, accounting, or compliance advisors, as needed;

• With government authorities, if required by law;

• With a successor entity in the event of a merger, acquisition, financing, or sale of assets, subject to applicable law.

6. Artificial Intelligence

During our current pilot program, Tomova does not use artificial intelligence to generate, draft, or otherwise produce any content that is sent to you, including savings-opportunity alerts, care-gap alerts, or appointment-related communications. All patient-facing content during the pilot is prepared and reviewed by the Tomova team without AI assistance.

In the future, and outside of the pilot program described above, we may use Anthropic’s Claude models to assist with limited, specific functions, including preparing draft appointment-related content and drafting the copy used in savings-opportunity and care-gap alert messages. If and when we do so, a member of the Tomova team will configure and review how these AI features operate before they are used to communicate with you, and AI-generated content will not be sent to you without that review and configuration. These AI-assisted outputs are not used to make clinical decisions or generate medical advice.

We do not use your health information, insurance information, or other identifiable patient information to train, fine-tune, retrain, or otherwise improve any large language model, foundation model, or other artificial intelligence or machine learning model that is generally available to the public or to other Tomova customers, whether operated by Tomova or by a third-party AI provider. Any AI vendor we engage to process identifiable patient information is contractually prohibited from using that information for its own model-training or model-improvement purposes, and must execute a Business Associate Agreement with us before processing any protected health information.

We monitor developments in state and federal law applicable to the use of artificial intelligence in healthcare-related communications and will update our practices and this Policy as necessary to remain consistent with applicable requirements. 

7. De-Identified Information and Aggregate Statistics

Tomova may create de-identified information from the insurance, claims, and health information described in Section 2, using methods that satisfy the de-identification standard under HIPAA (45 C.F.R. § 164.514). Once information has been de-identified in accordance with this standard, it is no longer protected health information and is not subject to your physician practice’s Business Associate Agreement with Tomova. 

We use de-identified information solely for internal purposes, such as improving the Service, evaluating the accuracy of our savings and care-gap identification logic, security, and analytics. We do not sell de-identified information, and we do not license, share, or otherwise make de-identified information available to any third party in a manner that identifies, or could reasonably be used to identify, you, your physician practice, or Tomova’s other customers. We do not use de-identified information to train any foundation model or other artificial intelligence or machine learning model that is generally available to the public.

Tomova may also create aggregate statistics derived from de-identified information, provided that such statistics are reported in a manner, that does not identify, and could not reasonably be used to identify, any individual patient or any specific physician practice. We may share aggregate statistics meeting this standard with business partners, prospective business partners, and investors, including in connection with evaluating or promoting the Service.

8. Data Retention

When you first connect your insurance information, the amount of claims and benefit history we receive depends on what your health plan makes available through the Patient Access API, which may include several years of history. We retain this information on a rolling basis and delete or de-identify it once it is more than five years old. Dates of past tests or screenings derived from your claims (for example, the date of your last screening) are kept after the underlying claim is removed under this schedule, until you request deletion of your record.

Your record and payer connection are tied to your own authorization, not to your physician practice’s relationship with Tomova. If your physician practice discontinues its use of the Service, the practice will no longer be able to view your information through its dashboard, but your record and payer connection will remain in place under your own authorization unless and until you disconnect it or request deletion as described in Section 9 below.

At the point of enrollment, your payer(s) will return records for your connected insurance as well as for dependents on the same group plan, including children. Please understand that Tomova will discard all such dependent records immediately upon receipt. No such dependent records will ever be stored.

Certain records, such as audit logs reflecting access to your information, are retained for six years regardless of any deletion request, consistent with standard recordkeeping practices for HIPAA-regulated information.

9. Your Choices and Controls

You may sign in to your Tomova account directly at tomova.com to manage your information. Through your account, or by contacting us using the information in Section 14 below, you may:

Disconnect your payer connection at any time

Request deletion of the information we hold about you, subject to the audit-log retention described in Section 8

Ask questions about what information we have collected and how it is used

At this time, some of these requests are processed manually by our team rather than through fully automated, self-service tools. We are working to expand automated self-service functionality, and this Policy will be updated to reflect those capabilities as they become available.

10. Your Privacy Rights

10.1 Virginia Residents (Virginia Consumer Data Protection Act)

If you are a Virginia resident, the Virginia Consumer Data Protection Act (“VCDPA”) may give you the right to:

• Confirm whether we are processing your personal data and access that data

• Correct inaccuracies in your personal data

• Delete personal data you have provided or that we have obtained about you

• Obtain a copy of your personal data in a portable format

• Opt out of the processing of your personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects

To exercise these rights, please contact us using the information in Section 14 below. We will respond within the timeframe required by the VCDPA. You may appeal a decision regarding your request by contacting us; if we deny your appeal, you may contact the Virginia Attorney General.

10.2 Other States 

Additional states have enacted comprehensive consumer privacy laws that may apply to residents of those states. We will update this Policy as necessary to reflect our obligations under those laws as our operations expand. 

11. Data Security

We maintain administrative, technical, and physical safeguards designed to protect the information described in this Policy, consistent with standard practices for health technology companies of our size and stage. These safeguards currently include: 

Encryption of data in transit and, by our infrastructure providers, at rest 

Role-based access controls limiting internal access to identifiable patient information to personnel who need it to operate the Service 

Use of reputable, established infrastructure and subprocessors (including Amazon Web Services) that maintain their own independent security programs, with your information stored and processed in the United States 

Confidentiality obligations applicable to our personnel and contractors who may access patient information 

A process for responding to and investigating suspected security incidents 

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We are in the process of formalizing a more comprehensive security compliance program, and this Policy will be updated as that program matures.

12. Children’s Privacy

The Service is not directed to children under 18, and we do not knowingly collect personal information from children under 18 through our public website. Patients enrolled in the Service are expected to be adult patients. Enrollment in the Service requires an affirmative representation that the enrolling patient is at least 18 years of age, consistent with the age representation captured as part of SMS consent.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date above reflects the most recent revision. Material changes will be reflected on this page.

14. Contact Us

Questions about this Privacy Policy, or requests to exercise your privacy rights, can be directed to:

Tomova Health, Inc.

42841 Creek View Plaza, Ste 120 PMB 1043, Ashburn, VA 20147

privacy@tomova.com