Privacy Policy

Erchonia Corporation, LLC ("Erchonia," "we," "our," or "us") respects the privacy and security of information collected through the Erchonia-DPN website, provider portal, and related device fulfillment and logistics services.

This Privacy Policy explains how we collect, use, disclose, protect, and retain information in connection with the Erchonia-DPN website and program.

Erchonia is a medical device manufacturer and fulfillment and logistics provider. Erchonia does not practice medicine, diagnose patients, prescribe treatment, determine whether treatment is medically appropriate for a patient, or provide medical advice. Those responsibilities remain solely with the patient's licensed healthcare provider and clinic.

1. Information We Collect

The information we collect depends on how you interact with the Erchonia-DPN website and program.

Website and Account Information

When a healthcare provider, clinic representative, authorized user, or website visitor creates an account, contacts us, or uses the website, we may collect information such as:

• Name
• Email address
• Telephone number
• Practice or business name
• Practice address
• Professional information
• Account credentials
• Communications with Erchonia
• Other information voluntarily provided to us

Provider and Clinic Information

For participating clinics and healthcare providers, we may collect:

• Provider or clinic name
• Practice information and address
• Contact information
• Professional credentials or licensure information where required
• Account and authorized-user information
• Billing and transaction information
• Device orders
• Fulfillment and shipping records
• Device serial numbers
• Payment information
• Communications with Erchonia
• Other information reasonably necessary to administer the clinic's participation in the program

Limited Patient Information Provided by Clinics

The Erchonia-DPN program is designed to minimize the amount of identifiable patient information provided to Erchonia.

For an ordinary fulfillment order, the participating clinic provides Erchonia with:

• A Patient Reference Identifier assigned by the clinic
• Patient name
• Patient delivery address

The Patient Reference Identifier must not contain or reveal the patient's name, initials, date of birth, address, telephone number, or other patient-identifying information.

The participating clinic maintains the relationship between the Patient Reference Identifier and the applicable patient in the clinic's own records.

In the ordinary fulfillment process, Erchonia does not request, receive, or record the length or prescribed end date of the patient's Course of Treatment and does not request or require patient diagnosis information, medical history, symptoms, medications, treatment notes, medical records, or other clinical information.

Additional patient-identifiable information may be received when reasonably necessary for complaint handling, adverse-event reporting, Medical Device Reporting, recalls, corrections, removals, field safety actions, product safety, or compliance with applicable law.

Portal Record

For each Device fulfilled through the Erchonia-DPN program, Erchonia maintains a Portal Record associated with the applicable Patient Reference Identifier.

The Portal Record may include:

• Device serial number
• Shipment date
• "Return by" date
• Carrier-confirmed delivery date
• Return receipt date
• Other shipment or return information permitted under the applicable agreement

To the extent the Portal Record can be associated with an identifiable patient, it may constitute Protected Health Information ("PHI") and will be handled accordingly.

Shipping and Return Information

Patient names and delivery addresses may be used to generate outbound and return shipping labels.

The Return Kit may display the patient's name and delivery address as shipper-of-record information required for carriage, together with the Patient Reference Identifier. No other patient information is intended to appear on the Return Kit.

Payment Information

Participating clinics may pay Erchonia through third-party payment processors.

Erchonia does not receive payment from patients for Devices furnished through the Erchonia-DPN fulfillment program.

Payment processors may collect and process payment information according to their own terms and privacy practices. Erchonia does not store complete payment card numbers on its own servers unless expressly stated otherwise.

Technical and Website Information

When the website or provider portal is used, certain information may be collected automatically, including:

• IP address
• Browser type
• Device information
• Operating system
• Login and session information
• Cookies and similar technologies
• Website usage and activity
• Log files
• Security and fraud-prevention information

2. How We Use Information

Erchonia may use information collected through the website and Erchonia-DPN program to:

• Create and administer provider and clinic accounts
• Process clinic orders
• Process payments from participating clinics
• Fulfill clinic requests for Devices
• Generate outbound and return shipping labels
• Ship Devices to delivery addresses designated by clinics
• Provide shipment and delivery notifications
• Track shipment, delivery, and returns
• Maintain the Portal Record
• Associate Device serial numbers with Patient Reference Identifiers
• Receive and process returned Devices
• Confirm or correct a patient's delivery address when a shipment cannot be delivered
• Reship an undeliverable Device as authorized by the clinic
• Provide replacement Return Kits or prepaid shipping labels
• Schedule carrier pickups
• Assist with recovery of Erchonia-owned Devices where permitted
• Receive and handle reports of shipping damage, missing items, or Device malfunctions
• Arrange permitted replacement and return logistics
• Investigate complaints and product issues
• Perform adverse-event and Medical Device Reporting
• Conduct recalls, corrections, removals, and field safety actions
• Maintain product and Device traceability
• Provide customer and technical support relating to fulfillment, shipping, returns, and Device malfunctions
• Protect the security and integrity of the website and program
• Prevent fraud, misuse, or unauthorized access
• Maintain legally and regulatorily required records
• Comply with applicable laws, regulations, court orders, and governmental requirements
• Improve the operation, quality, security, and functionality of our website and program

Erchonia does not use patient-identifiable information received through the Erchonia-DPN program for advertising, marketing, solicitation, or unrelated commercial purposes.

3. Healthcare Provider and Patient Relationship

All patient evaluation, diagnosis, patient selection, prescribing, treatment decisions, treatment instructions, contraindication screening, monitoring, follow-up, informed consent, clinical documentation, and other clinical services are the responsibility of the patient's healthcare provider and clinic.

Erchonia does not:

• Determine whether a patient qualifies for treatment
• Evaluate or diagnose patients
• Review patient medical information for treatment eligibility
• Prescribe or authorize treatment
• Determine the length or prescribed end date of a patient's Course of Treatment
• Direct a patient's clinical care
• Provide medical advice
• Provide treatment instruction
• Establish or control the clinic's professional fees
• Collect payment from patients for clinical services or Devices
• Act as the patient's healthcare provider

A participating clinic may direct Erchonia to ship a Device directly to a patient's residence. Erchonia performs that shipment as the clinic's shipping agent and as a fulfillment and logistics service for the clinic.

Shipment of a Device by Erchonia does not create a physician-patient relationship between Erchonia and the patient.

4. Protected Health Information and HIPAA

For purposes of the Erchonia-DPN fulfillment program, participating clinics may be Covered Entities under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), and Erchonia may act as their Business Associate.

Before a participating clinic submits an order containing patient information, Erchonia and the clinic are required to enter into an applicable Business Associate Agreement ("BAA").

Under the BAA, PHI Erchonia is expected to receive in the ordinary course may include:

• Patient name
• Patient delivery address
• Patient Reference Identifier
• The Portal Record, to the extent associated with an identifiable patient
• PHI received in connection with complaint handling
• PHI received in connection with adverse-event or Medical Device Reporting
• PHI necessary for recalls, corrections, removals, or field safety actions
• PHI required for compliance with applicable law

Erchonia will request, use, and disclose only the minimum PHI reasonably necessary for the applicable permitted purpose.

Erchonia does not use or disclose PHI received through this program for marketing and does not sell PHI as those terms are defined under HIPAA.

5. Permitted Uses and Disclosures of PHI

Subject to HIPAA and the applicable BAA, Erchonia may use or disclose PHI as necessary to perform services on behalf of the participating clinic, including:

Shipment, Delivery, and Return Logistics

This may include:

• Generating outbound shipping labels
• Generating return shipping labels
• Shipping Devices
• Sending shipment and delivery notifications
• Tracking delivery and returns
• Confirming or correcting a Delivery Address when a shipment cannot be delivered
• Reshipping an undeliverable Device
• Providing replacement Return Kits
• Scheduling carrier pickups
• Receiving returned Devices
• Performing permitted Device-recovery activities

Portal Administration and Fulfillment Records

Erchonia may maintain the Portal Record and provide participating clinics with information concerning:

• Device serial numbers
• Shipment dates
• Return-by dates
• Delivery dates
• Return receipt dates
• Failed deliveries
• Returns
• Damage, missing-item, or malfunction reports
• Other fulfillment notices required under the program

Product Complaints and Safety

Erchonia may receive, use, and disclose information reasonably necessary to investigate:

• Product complaints
• Device malfunctions
• Shipping damage
• Missing Device components
• Injuries or adverse events
• Other product-safety issues

Regulatory Compliance

Erchonia may use or disclose information as reasonably necessary for:

• Medical Device Reporting
• FDA reporting
• Product complaints
• Recalls
• Corrections and removals
• Field safety actions
• Regulatory inspections or investigations
• Other legal or regulatory obligations

Management and Legal Responsibilities

Erchonia may use PHI for its proper management and administration or to carry out its legal responsibilities as permitted by HIPAA and the applicable BAA.

6. Communications With Patients

Erchonia's communications with patients are limited to permitted non-clinical purposes.

Erchonia may communicate directly with a patient when reasonably necessary for:

• Shipment notifications
• Delivery notifications
• Return logistics
• Confirming or correcting an undeliverable shipping address
• Providing or replacing a prepaid Return Kit or return label
• Scheduling a carrier pickup
• Addressing shipping damage, missing items, or Device malfunctions
• Arranging permitted replacement or return logistics
• Product complaints or safety matters
• Recalls, corrections, removals, or field safety actions
• Other communications required by law

Erchonia does not use PHI to communicate to a patient any Erchonia charge, fee, price, late-return charge, purchase consequence, or other financial consequence.

Erchonia does not communicate with patients for marketing or solicitation using information received through the Erchonia-DPN program.

Questions regarding treatment, treatment duration, medical conditions, injuries, adverse events, medications, or other clinical matters should be directed to the patient's healthcare provider.

7. Information Sharing and Disclosure

Erchonia may share information as reasonably necessary to operate the website and Erchonia-DPN program and as permitted by applicable law.

Participating Clinics

Erchonia may provide participating clinics with information concerning:

• Accounts
• Orders
• Payments
• Device serial numbers
• Shipment dates and status
• Return-by dates
• Delivery confirmation
• Returns
• Failed deliveries
• Shipping damage
• Missing items
• Device malfunctions
• Complaints
• Recalls
• Safety matters
• Other program-related matters

Shipping Carriers

Patient names and delivery addresses may be disclosed to shipping carriers as necessary to transport outbound and return packages.

A common carrier transporting a sealed package may act as a conduit rather than as Erchonia's HIPAA Business Associate where applicable.

Only information reasonably necessary for shipment and carriage should appear on shipping materials.

Service Providers and Subcontractors

Erchonia may use third parties to provide services including:

• Provider-portal hosting
• Cloud infrastructure
• Information technology
• Cybersecurity
• Payment processing
• Communications
• Shipping and logistics
• Device tracking
• Customer support
• Professional services

Any subcontractor that creates, receives, maintains, or transmits PHI on Erchonia's behalf will be required, where applicable, to agree in writing to HIPAA-related restrictions and protections consistent with Erchonia's obligations.

Legal and Regulatory Authorities

Information may be disclosed when permitted or required to:

• Comply with federal, state, or local law
• Respond to lawful court orders or governmental requests
• Cooperate with FDA or other regulatory authorities
• Fulfill medical-device reporting requirements
• Conduct recalls or field safety actions
• Protect product or patient safety
• Carry out other legally required responsibilities

8. No Sale, Marketing, or Financial Use of PHI

Erchonia does not sell PHI received through the Erchonia-DPN program.

Erchonia does not use PHI received from participating clinics to:

• Market or advertise Erchonia products to patients
• Solicit patients
• Add patients to marketing lists
• Communicate Erchonia pricing or charges to patients
• Communicate a financial consequence relating to Device possession or return
• Re-identify information that has been properly de-identified

Patient-identifiable information supplied for fulfillment will be used only for purposes permitted by the applicable agreement, BAA, and law.

9. De-Identified Information

Erchonia may de-identify PHI in accordance with applicable HIPAA requirements.

Once information has been properly de-identified so that it is no longer PHI, Erchonia may use that information for purposes such as:

• Device quality
• Product safety
• Program operations

De-identified information will not be used to re-identify an individual or for patient marketing.

10. Data Minimization

The Erchonia-DPN program is structured to limit identifiable patient information received by Erchonia.

Participating clinics are instructed to transmit only the information permitted under the applicable agreement and BAA.

In the ordinary fulfillment process, clinics should not provide Erchonia with additional identifiable information concerning:

• Diagnosis
• Medical history
• Symptoms
• Medications
• Clinical treatment notes
• Medical records
• Treatment duration
• Prescribed end date
• Other clinical information

Additional identifiable information should be provided only when required for complaint or adverse-event reporting, product safety, regulatory compliance, or another permitted or legally required purpose.

11. Patient Medical Records and HIPAA Requests

The participating clinic maintains the patient's medical record and the mapping between each Patient Reference Identifier and the applicable patient.

Erchonia does not maintain a HIPAA Designated Record Set on behalf of participating clinics under the current program structure.

If Erchonia receives a patient request to access or amend PHI maintained on behalf of a participating clinic, Erchonia will forward the request to the applicable clinic and reasonably cooperate with the clinic as required by the applicable BAA.

Patients seeking access to, amendment of, or other HIPAA rights relating to their medical records should generally contact their healthcare provider or clinic directly.

12. Cookies and Website Technologies

The website may use cookies and similar technologies to:

• Operate website functionality
• Maintain secure login sessions
• Remember preferences
• Protect accounts
• Detect fraud or security threats
• Analyze website performance and usage
• Improve website functionality and user experience

Browser settings may allow users to restrict or disable certain cookies. Some website functionality may not operate properly if necessary cookies are disabled.

Erchonia does not knowingly use PHI received through the Erchonia-DPN fulfillment program for behavioral advertising.

13. Data Security

Erchonia maintains reasonable and appropriate administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of PHI and other personal information within its control.

Erchonia limits access to patient-identifiable information to personnel and service providers who require access for authorized fulfillment, logistics, safety, regulatory, legal, security, or other permitted purposes.

Where required, subcontractors handling PHI on Erchonia's behalf are contractually required to maintain appropriate protections.

No electronic transmission, storage system, or internet service can be guaranteed to be completely secure.

14. Security Incidents and Breaches

Erchonia will investigate suspected unauthorized uses, disclosures, or security incidents involving PHI in accordance with applicable law and its contractual obligations.

Where required by HIPAA, applicable state law, or the applicable BAA, Erchonia will provide required notice to the participating clinic concerning a reportable Security Incident or Breach of Unsecured PHI.

Erchonia will take reasonable steps to mitigate harmful effects of an impermissible use or disclosure of PHI of which it becomes aware, as required by applicable law and the applicable BAA.

15. Data Retention

Erchonia retains information for periods reasonably necessary to perform its permitted functions and satisfy contractual, safety, legal, and regulatory obligations.

The Portal Record for a Device is maintained for at least six (6) years after the Device is returned or, if the Device is never returned, for the period required under the applicable program agreement.

Other information may be retained as necessary for:

• Device fulfillment and return
• Device traceability
• Clinic account administration
• Transaction and financial records
• Product complaint investigation
• Medical Device Reporting
• Recalls, corrections, removals, and field safety actions
• FDA or quality-system recordkeeping
• Security and fraud prevention
• Compliance with applicable laws
• Dispute resolution
• Protection of legal rights

Upon termination of a participating clinic's agreement, Erchonia will return or destroy PHI as required by the applicable BAA, except where continued retention is permitted or required for outstanding Devices, the Portal Record, FDA or quality-system obligations, or where return or destruction is otherwise infeasible.

Any PHI retained following termination remains subject to applicable privacy and security protections and may be used or disclosed only for the purposes that justify continued retention.

16. Your Privacy Rights

Depending on the applicable law and the information involved, individuals may have rights concerning their personal information, including rights to:

• Request access to certain information
• Request correction of inaccurate information
• Request deletion where legally available
• Obtain information regarding certain uses or disclosures
• Exercise other privacy rights provided by applicable law

These rights may be subject to exceptions relating to HIPAA, medical-device regulation, product safety, recordkeeping, contractual obligations, or other legal requirements.

Because Erchonia generally holds PHI as a Business Associate on behalf of a participating clinic, HIPAA requests concerning medical records should generally be submitted to the patient's clinic or healthcare provider.

Erchonia will cooperate with participating clinics in responding to applicable HIPAA requests as required by the BAA.

17. Patient Custody Acknowledgment

Before a participating clinic submits an order, the clinic is responsible for obtaining the applicable Patient Custody Acknowledgment from the patient.

That acknowledgment is an agreement between the participating clinic and its patient. Erchonia is not a party to it.

The acknowledgment informs patients, among other things, that:

• Erchonia may ship the Device directly to the patient's home at the clinic's direction
• Erchonia may contact the patient to confirm or correct a Delivery Address if a shipment cannot be delivered
• Return materials may contain the patient's name and address as required by the carrier
• Patients may contact Erchonia regarding shipping damage, missing items, Device malfunction, replacement return materials, or carrier pickup
• Clinical questions and treatment decisions must be directed to the clinic
• Erchonia does not provide medical advice or treatment instruction

18. Third-Party Websites and Services

The Erchonia-DPN website may contain links to independent third-party websites or services.

Erchonia is not responsible for the privacy practices of independent third parties that are not acting on Erchonia's behalf.

Users should review the privacy policies of third-party websites before providing information to them.

This provision does not limit Erchonia's responsibilities for Business Associates, subcontractors, or other service providers acting on its behalf where applicable law imposes such obligations.

19. Children's Privacy

The Erchonia-DPN website and provider fulfillment portal are not directed to children.

Erchonia does not independently determine whether treatment is medically appropriate or legally permitted for any particular patient. Those determinations are the responsibility of the patient's licensed healthcare provider.

Erchonia does not knowingly solicit personal information directly from children through the provider fulfillment program.

If Erchonia learns that personal information has been collected directly from a child in violation of applicable law, it will take appropriate action.

20. Regulatory, Safety, and Product Reporting

As a medical device manufacturer, Erchonia may be required to collect, use, maintain, or disclose information concerning:

• Product complaints
• Device malfunctions
• Shipping damage or missing components
• Serious injuries or adverse events
• Medical Device Reporting
• Post-market surveillance
• Product recalls
• Corrections and removals
• Field safety actions
• Regulatory inspections or investigations
• Quality-system obligations

Information used for these purposes will be limited to information reasonably necessary for Erchonia's applicable safety, legal, and regulatory responsibilities.

21. Changes to This Privacy Policy

Erchonia may update this Privacy Policy periodically to reflect changes in applicable law, technology, privacy or security practices, website functionality, or the operation of the Erchonia-DPN program.

When this Privacy Policy is revised, the updated version will be posted on the website with a revised Effective Date.

Where additional notice or consent is required by applicable law, Erchonia will provide such notice or obtain such consent as required.

22. Contact Information

Questions regarding this Privacy Policy, privacy requests, or Erchonia's privacy practices may be directed to:

Erchonia Corporation, LLC
112 Southchase Boulevard
Fountain Inn, South Carolina 29644

Email: info@erchonia.com
Phone: (888) 242-0571

Effective Date: August 24, 2026