ALPHA REFINERY

Privacy Policy

Effective date: September 13, 2026   |   Last updated: September 13, 2026

1. Who we are

Alpha Refinery Medical is the assumed name of Wesley Nahm, M.D. of Illinois, P.C. (the “Practice”), a physician-owned professional corporation organized under Illinois law. The Practice provides all clinical services, and all clinical decisions are made by the Practice’s licensed providers.

Alpha Refinery Management LLC (the “Management Company”) provides non-clinical administrative, technology, and marketing services, and operates this website. The Management Company does not provide or direct clinical care.

In this policy, “we,” “us,” and “our” refer to both entities acting within their respective roles. “You” means a visitor to this website or to any landing page we operate.

2. What this policy covers, and what it does not

This policy describes how we handle information collected through this website, our landing pages, our forms, and our advertising.

It is separate from the Practice’s HIPAA Notice of Privacy Practices, which governs protected health information created or received in the course of treatment, payment, and health care operations. Where the two address the same protected health information and conflict, the Notice of Privacy Practices controls. A copy is available at our clinic on request and at www.alpharefinery.com/notice-of-privacy-practices.

3. Information we collect

Information you give us

When you request a consultation, book an assessment, complete a form, or contact us, we collect what you enter. This typically includes your name, email address, telephone number, appointment preferences, and anything you choose to tell us about why you are contacting us.

Information collected automatically

When you visit, we and our service providers collect technical information through cookies and similar technologies: IP address, device and browser type, operating system, the page that referred you, the pages you view, and how long you spend on them.

Information from our service providers

We receive information from the vendors that support scheduling, communications, payment processing, and laboratory services, limited to what each needs to perform its function.

4. How we use information

We use the information described above to schedule and deliver care, to communicate with you, to process payment, to operate and improve this website, to measure and improve our advertising, to keep our systems secure, and to meet our legal obligations.

5. Advertising and measurement

We advertise on Google and Meta, and we measure which advertisements lead to booked appointments. Neither platform will enter into a HIPAA business associate agreement with us. We have therefore built our measurement so that identifying and health-related information is never transmitted to them.

Specifically:

• Conversion events are transmitted from our own server rather than directly from your browser. This means we control precisely what is sent, instead of relying on a platform script to decide.
• What we transmit is limited to: a pseudonymous external identifier, advertising platform click identifiers (such as fbc, fbp, gclid, gbraid and wbraid), IP address, browser user agent, an event identifier, an event value and currency, and a timestamp.
• We do not transmit your name, email address, telephone number, or the address of the page you were viewing to Google or Meta.
• We do not build or use advertising audiences based on health conditions, and we do not run remarketing based on health-related browsing activity.

The providers involved are Google LLC (Google Ads, Google Analytics, and Google Tag Manager), Meta Platforms, Inc. (the Meta Pixel and Conversions API), and Stape, which hosts our server-side tagging. Each maintains its own privacy policy governing the information it receives.

6. Cookies and your choices

Cookies are small files placed on your device. We use them to keep the site working properly, to understand aggregate site performance, and to measure advertising.

You can control cookies through your browser settings. You can also limit advertising personalization directly:

• Google: myadcenter.google.com
• Google Analytics opt-out browser add-on: tools.google.com/dlpage/gaoptout
• Meta: accountscenter.facebook.com/ads
• Industry opt-outs: optout.networkadvertising.org and optout.aboutads.info

Limiting cookies will not prevent you from using this website or booking an appointment. We honor Global Privacy Control signals where required by law.

7. Text messages and telephone calls

If you give us your mobile number and agree to receive text messages, we may send appointment confirmations, reminders, and messages relating to your care. If you separately opt in, we may also send occasional messages about our services.

• Consent to receive marketing text messages is not a condition of receiving care or of purchasing anything from us.
• Reply STOP to any message to opt out. Reply HELP for assistance. Message and data rates may apply, and message frequency varies.
• We do not sell, rent, or share mobile telephone numbers or text message consent with third parties or affiliates for their own marketing purposes.

Calls to and from the clinic may be monitored or recorded for quality and training purposes, where permitted by law and where you have been notified.

8. How we share information

• With service providers who perform functions on our behalf, under contracts restricting their use of the information. These include GoHighLevel, which supports our patient communications and customer relationship management; Boulevard, which supports scheduling; Stape, which hosts our server-side tagging; and our payment processor. Where a vendor handles protected health information, we enter into a business associate agreement as HIPAA requires.
• With laboratories, pharmacies, and other health care providers involved in your care.
• With professional advisors, including our attorneys and accountants, under duties of confidentiality.
• Where required by law or legal process, or to protect the rights, safety, or property of any person.
• In connection with a merger, acquisition, financing, or sale of assets, subject to the protections described in this policy.

9. We do not sell your information

We do not sell personal information, and we do not sell or license protected health information. We do not share personal information with third parties for their own independent marketing.

10. Security

We maintain administrative, technical, and physical safeguards designed to protect the information we hold, including access controls, encryption in transit, and vendor diligence. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. How long we keep information

We retain medical records for the period Illinois law requires. We retain other information for as long as it is needed for the purpose it was collected, and then dispose of it securely.

12. Your rights and choices

You may request access to, correction of, or a copy of your medical record through the process described in our Notice of Privacy Practices.

You may opt out of marketing email using the unsubscribe link in any message, and out of marketing text messages by replying STOP. You cannot opt out of transactional messages about an appointment you have booked without contacting us directly.

Residents of states with comprehensive consumer privacy laws may have additional rights to access, correct, delete, or port personal information, and to opt out of targeted advertising. To exercise a right, contact us using the details in Section 18. We will verify your identity before acting, and we will not discriminate against you for making a request.

13. Illinois disclosures

• Genetic information. Under the Illinois Genetic Information Privacy Act, we will not use or disclose genetic testing information except as that Act permits, and we will obtain your separate written authorization before any genetic testing is performed.
• Biometric information. We do not collect fingerprints, voiceprints, retina or iris scans, or scans of hand or face geometry. Body composition analysis performed in the clinic measures body composition and is not used to identify you.
• Breach notification. If a breach of unsecured personal information occurs, we will notify affected individuals as the Illinois Personal Information Protection Act and, where applicable, HIPAA require.

14. Children

Our services are intended for adults. We do not knowingly collect information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.

15. Links to other websites

This website may link to sites we do not control. We are not responsible for their content or their privacy practices, and we encourage you to read their policies.

16. Governing law

This policy is governed by the laws of the State of Illinois, without regard to its conflict of laws principles. Any dispute arising out of it shall be resolved exclusively in the state or federal courts located in DuPage County, Illinois.

17. Changes to this policy

We may update this policy from time to time. We will post the revised version on this page and update the “Last updated” date above. Where changes are material, we will highlight them on the website for a reasonable period.

18. How to contact us

For questions about this policy, or to exercise a privacy right:

Ron DeRosa, Privacy Officer

Alpha Refinery Medical

12 Salt Creek Lane, Suite 350

Hinsdale, Illinois 60521

Telephone: (630) 242-1330

Email: [email protected]

For questions specific to protected health information, contact the Practice’s Privacy Officer at the address above. You also have the right to file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr/privacy/hipaa/complaints. We will not retaliate against you for filing a complaint.