This Privacy Policy explains how Prestige Health Worldwide, LLC, doing business as the CrossFit Medical Society (“CFMS,” “we,” “us,” or “our”), collects, uses, and shares information when you visit www.crossfitmedicalsociety.com], engage with our programs and events, or use the Coach Graici Health Hub Portal (the “Portal”) and related services (collectively, the “Services”). If you do not agree, please do not use the Services.

Important: CFMS is not a healthcare provider. Clinical services are delivered by McCoy Medical and other independently licensed providers (“Affiliated Providers”). Health information you share with an Affiliated Provider may be protected health information governed by HIPAA and that provider’s own Notice of Privacy Practices — see “Health information and HIPAA” below.

Who we are and related parties

CFMS is a health navigation, education, and coordination organization. Several parties are relevant to how your information is handled:

• CrossFit, LLC licenses the CrossFit® and CrossFit Medical Society™ marks to us. CFMS is independent and not endorsed by CrossFit, LLC, which is not responsible for our data practices.

• McCoy Medical and Affiliated Providers deliver clinical services (provider review, lab interpretation, treatment). They act as independent providers and, where applicable, as separate controllers of your protected health information.

• CrowdHealth, Inc. powers CommunityCare, a healthcare cost-sharing community that is not insurance. If you engage with CommunityCare, CrowdHealth processes your information under its own terms and privacy policy.

• Catalina Health, Inc operates the Coach Graici Health Hub Portal as our technology provider, processing information on our and the member’s behalf.

What information we collect

Information you provide

In Short: We collect information you give us when you register, communicate with us, purchase, or use the Portal.

This may include your name, email address, phone number, password and authentication data, affiliate or gym information, billing details, event and course registrations, communications you send us, and information you choose to submit through the Portal (such as goals, health interests based on the 8 Pillars of Health, and historical records you elect to consolidate). Where you request laboratory panels or provider review, related health information may be collected and made available to you and to Affiliated Providers.

Sensitive and health information

With your consent or as permitted by law, we and our providers process health-related information, which may include laboratory results, biomarker and Health Index data, and information you enter about your health. We treat this information as sensitive. See “Health information and HIPAA” below.

Payment information

If you make a purchase, payment-card information is collected and processed by our third-party payment processor (for example, Stripe). We do not store full payment-card numbers.

Information collected automatically

In Short: Like most websites, we automatically collect technical and usage data through cookies and similar technologies.

This may include your IP address, device and browser characteristics, operating system, referring URLs, pages viewed, and how you interact with the Services. We use this to operate, secure, and improve the Services and for analytics. Learn more in our Cookie Notice and control choices through our cookie banner.

How we use your information

In Short: To provide and improve the Services, coordinate your Health Hub experience, communicate with you, process payments, maintain security, and comply with law.

• Create and manage your account and the Portal experience.

• Facilitate lab ordering, requisitions, result delivery, visualizations, and scheduling of provider review with Affiliated Providers.

• Coordinate designations, events, courses, and memberships.

• Educate members about, and support enrollment in, CommunityCare (attributing activity to the originating affiliate for revenue-share).

• Communicate administrative and, where permitted, marketing information; you can opt out of marketing.

• Provide support, request feedback, and improve the Services.

• Detect and prevent fraud, protect security, and comply with legal obligations.

Health information and HIPAA

CFMS is not a healthcare provider and generally is not a HIPAA-covered entity with respect to the general website. When you receive clinical services, the health information created or received by McCoy Medical or another Affiliated Provider is protected health information (PHI) governed by HIPAA and by that provider’s Notice of Privacy Practices, which controls how your PHI is used and disclosed for treatment, payment, and healthcare operations. Where CFMS or its technology provider (2Be-Human, LLC) handles PHI on behalf of an Affiliated Provider, we do so as a service provider/business associate under appropriate agreements. You own your health information and control what you share. This Privacy Policy governs non-PHI information and the general website; where a conflict exists as to PHI, the Affiliated Provider’s HIPAA notice controls.

How we share information

In Short: We share with the related parties above and with service providers, and as required by law. We do not sell your health information.

• Affiliated Providers (including McCoy Medical) to enable clinical services you request.

• Catalina Health, Inc / Coach Graici Portal to operate the Portal and coordinate your experience.

• CrowdHealth where you choose to learn about or enroll in CommunityCare.

• Your affiliate / Health Hub engagement and enrollment activity is attributed to the originating affiliate for reporting and revenue-share; affiliates do not receive your PHI except as permitted and necessary.

• Service providers payment processors (e.g., Stripe), cloud hosting, laboratories, email, and analytics vendors, under contracts limiting their use of your information.

• Legal and safety to comply with law, enforce our Terms, or protect rights, property, and safety.

• Business transfers in connection with a merger, financing, or sale of assets, subject to this Policy.

We do not sell your personal information, and we do not share health information for cross-context behavioral advertising.

Cookies and tracking

We use cookies and similar technologies for essential functionality, analytics, and (where enabled) advertising. You can accept or reject non-essential cookies through our cookie banner and manage preferences as described in our Cookie Notice. Because there is no common standard, we do not currently respond to browser “Do Not Track” signals; where required, we honor recognized opt-out preference signals.

How long we keep information

We keep information for as long as necessary to provide the Services and for legitimate business or legal purposes, then delete or de-identify it. Clinical records held by Affiliated Providers are retained according to those providers’ legal and professional obligations.

How we protect information

We use reasonable administrative, technical, and organizational safeguards designed to protect information, and the Portal is designed to support HIPAA-aligned handling of health data. No system is 100% secure; transmission is at your own risk, and you should use the Services in a secure environment.

Children’s privacy

The Services are intended for adults and are not directed to children under 18. We do not knowingly collect information from children under 18. If you believe a child has provided us information, please contact us and we will take reasonable steps to delete it.

Your privacy rights

In Short: Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your information, and to opt out of certain processing.

Residents of certain U.S. states (including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Montana, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia) and regions such as Canada may have rights to request access to, correction of, a copy of, or deletion of their personal information; to opt out of targeted advertising, sale, or certain profiling; to limit the use of sensitive information; and to appeal a declined request. We do not discriminate against you for exercising these rights. To exercise any right, contact us using the details below; we will verify your request as required by law. You may also designate an authorized agent where permitted.

For clinical/PHI held by an Affiliated Provider, direct HIPAA rights requests (such as access or amendment of medical records) to that provider.

Changes to this Policy

We may update this Privacy Policy from time to time. The “Last updated” date reflects the latest version, and material changes will be communicated as required. Your continued use of the Services after changes take effect constitutes acceptance.

Contact us

For privacy questions or to exercise your rights:

Prestige Health Worldwide, LLC, d/b/a CrossFit Medical Society

10 Center Street, Chagrin Falls, OH 44022

info@crossfitmedicalsociety.com

© 2026 Prestige Health Worldwide, LLC, d/b/a CrossFit Medical Society. CrossFit® is a trademark of CrossFit, LLC, used under license. Highlighted fields are placeholders to complete before publishing. Reviewed by legal counsel is recommended before publication. Because this Policy involves health data and HIPAA, legal review is strongly recommended.