Part I: Privacy Policy

1. Scope and Application

1.1 This Part I applies to Personal Information collected by the Company through the Company website, member portal, and mobile application (collectively, the "Platform"), through electronic and telephonic communications with the Company, and in connection with retail transactions conducted at the Mart.

1.2 This Part I does not apply to Protected Health Information, which is governed exclusively by Part II and by applicable law. Certain information collected through the Platform constitutes Protected Health Information at the moment of collection; where a category of information is subject to both Parts, the more protective provision controls.

1.3 This Part I does not apply to information collected by third parties, including payors, pharmacy benefit managers, benefit administrators, laboratories, and independent providers, whose practices are governed by their own privacy notices.

2. Definitions

"Personal Information"

Information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household.

"Protected Health Information" or "PHI"

Individually identifiable health information, as defined at 45 C.F.R. § 160.103, that is created or received by the Company and that relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual.

"Sensitive Personal Information"

Personal Information revealing government identifiers, financial account credentials, precise geolocation, racial or ethnic origin, health status, or the contents of communications, as such term is defined under applicable state privacy law.

"De-Identified Information"

Health information from which identifiers have been removed in accordance with the safe harbor method at 45 C.F.R. § 164.514(b)(2) or as to which a qualified expert has determined that the risk of re-identification is very small pursuant to 45 C.F.R. § 164.514(b)(1). De-Identified Information is not PHI.

"Messaging Program"

The Company program for the transmission of short message service and multimedia messaging service text messages to a mobile telephone number you have furnished, as described at Section 6.

"Mobile Information"

Your mobile telephone number together with your Messaging Consent Data.

"Messaging Consent Data"

The record of your enrollment in and withdrawal from the Messaging Program, comprising the mobile telephone number enrolled, your current enrollment status, and the date and time of any opt-out.

3. Categories of Information Collected

3.1 Biometric Information. Where you elect to enable biometric authentication on a personal device, the biometric template is created and retained by your device operating system and is not transmitted to or retained by the Company. The Company receives only a cryptographic assertion of successful authentication.

4. Sources of Information

The Company obtains information from the following sources:

• Directly from you, through account registration, appointment requests, intake forms, clinical encounters, pharmacy interactions, retail transactions, and correspondence;
• From your authorized representative, including a parent, legal guardian, health care agent, or designated proxy;
• From Associated Physicians and Clinical Personnel, in the course of the documentation of care;
• From payors, pharmacy benefit managers, and benefit administrators, including eligibility, coverage, and adjudication data;
• From referring and treating providers, laboratories, imaging centers, and other pharmacies, including through health information exchanges and interoperability networks;
• From service providers and business associates acting on the Company's behalf; and
• Automatically, through the operation of the Platform and its supporting infrastructure.

5. Purposes of Collection and Use

The Company uses Personal Information for the following purposes:

• to establish, authenticate, and administer your account;
• to receive, triage, schedule, confirm, and remind you of appointments;
• to facilitate the delivery of Clinical Services, pharmacy services, and urgent care services;
• to verify benefit eligibility, adjudicate claims, and process payment;
• to complete retail transactions and administer returns and recalls;
• to communicate with you concerning your care, your account, and your transactions;
• to operate the Messaging Program described at Section 6, including the transmission of the messages there described, the maintenance of Messaging Consent Data, and the honoring of your opt-out;
• to conduct quality assessment and improvement, care coordination, credentialing, training, and other health care operations as defined at 45 C.F.R. § 164.501;
• to secure the Platform, detect and prevent fraud, and investigate suspected misuse;
• to comply with legal, regulatory, accreditation, licensure, and public health obligations; and
• to conduct research and analytics using De-Identified Information or Limited Data Sets, subject to the safeguards required by 45 C.F.R. § 164.514.

5.1 No Sale of Personal Information. The Company does not sell Personal Information, does not sell Protected Health Information, and does not share Personal Information for cross-context behavioral advertising. The Company does not disclose PHI to any third party for that party's independent marketing purposes absent a valid written authorization satisfying 45 C.F.R. § 164.508. With respect to Mobile Information specifically, see Section 6.6.

5.2 No Automated Decision-Making Producing Legal Effects. The Company does not employ solely automated processing, including profiling, to render decisions producing legal or similarly significant effects concerning you. Clinical decisions are made by licensed professionals exercising independent judgment. Where the Company employs clinical decision support or algorithmic tooling, such tooling functions in an advisory capacity to a licensed professional and does not substitute for professional judgment.

6. Text Messaging Program (SMS and MMS)

6.1 Description of the Program. The Company operates a text messaging program under which the Company transmits short message service ("SMS") and multimedia messaging service ("MMS") text messages to a mobile telephone number you have furnished to the Company. The Messaging Program is operated by the Company for its own account and is not operated on behalf of, and is not made available to, any other person.

6.2 Categories of Message. Messages transmitted under the Messaging Program fall within the following categories:

• acknowledgment that an appointment request has been received;
• confirmation of a scheduled appointment, including the date, time, location, and rendering provider;
• notice that a scheduled appointment has been rescheduled, relocated, or cancelled;
• reminders in advance of a scheduled appointment;
• notice that a prescription is ready for collection, refill reminders, and recall notices;
• notice concerning your account, including security and authentication messages; and
• responses to a message you send to the Company.

Messages are transactional and relate to your care and your account. The Company does not transmit promotional or advertising messages under the Messaging Program. Should the Company elect in the future to transmit marketing messages by text message, it will do so only with your separate, prior, express written consent obtained for that purpose, and, where the message constitutes marketing of PHI within the meaning of 45 C.F.R. § 164.501, only pursuant to an authorization satisfying 45 C.F.R. § 164.508.

6.3 Information Collected in Connection with the Messaging Program. The Company collects and maintains the following in connection with the Messaging Program:

• the mobile telephone number you furnish;
• your Messaging Consent Data, comprising your current enrollment status and the date and time of any opt-out;
• delivery, failure, and opt-out logs for messages transmitted to your number;
• the mobile carrier associated with your number, as reported to the Company by its messaging service provider; and
• the category of each message transmitted, as enumerated at Section 6.2.

The Company collects this information from you directly, at the point at which you furnish your mobile telephone number, and from its messaging service provider in the form of delivery and carrier metadata. The Company uses this information solely to transmit the messages described at Section 6.2, to maintain a record of your consent and of your opt-out as required by applicable law, to diagnose delivery failures, and to demonstrate compliance. The Company does not use this information for any marketing or promotional purpose and does not use it to build any advertising profile or audience segment.

6.4 Message Frequency. Message frequency varies; the Company does not anticipate transmitting more than fifty (50) messages per month to any member in the ordinary course. The number of messages you receive depends upon your use of the Services and upon your care activity, including the number of appointments you request and attend and the number of prescriptions dispensed to you. You will not receive recurring messages on a fixed schedule.

6.5 Opt-Out and Assistance.

• You may opt out of the Messaging Program at any time by replying STOP to any message you receive from the Company. The Company also honors the replies END, CANCEL, UNSUBSCRIBE, QUIT, and STOPALL. Upon receipt, the Company will transmit a single confirmation of your opt-out and will thereafter send no further messages under the Messaging Program to that number.
• You may obtain assistance at any time by contacting member support at (888) 505-4814.
• You may additionally manage your communication preferences through your account settings on the Platform, or by contacting the Company by any means set forth at Section 27.
• Opting out of the Messaging Program does not withdraw any consent you have given to be contacted by telephone, by electronic mail, or by postal mail, and does not withdraw any authorization relating to your Protected Health Information.

The Company will continue to transmit communications necessary to your care, to the administration of your account, and to compliance with legal obligation by other means, and, where the law requires a communication to be delivered notwithstanding your opt-out, by text message.

6.6 No Sharing or Sale of Mobile Information.

The Company does not share, sell, rent, lease, trade, or otherwise provide your mobile telephone number or your Messaging Consent Data to any third party or to any affiliate of the Company for marketing or promotional purposes. No mobile information is shared with third parties or affiliates for marketing or promotional purposes.

This restriction is absolute as to marketing and promotional purposes. Your mobile telephone number and Messaging Consent Data are disclosed only as follows, and in each case only to the extent necessary to transmit a message you have consented to receive or to comply with law:

• to the Company's messaging service provider and to mobile carriers, solely for the technical transmission and delivery of a message described at Section 6.2, under written contract restricting use of the information to the performance of that service and prohibiting any use of the information for the provider's or carrier's own purposes; and
• where disclosure is required by law, subpoena, court order, or other lawful process.

6.7 Consent Is Not a Condition. Consent to receive text messages is not a condition of the receipt of Clinical Services, of the dispensing of any prescription, of the purchase of any good, or of the receipt of any benefit. You may use the Services in full without enrolling in the Messaging Program.

6.8 Carriers. Mobile carriers are not liable for delayed or undelivered messages. The Messaging Program is available on most, but not all, mobile carriers in the United States. Carrier support may change without notice to the Company.

6.9 Charges. Message and data rates may apply. Any charge for a message you send to or receive from the Company is assessed by your mobile carrier under your plan with that carrier, and the Company is not responsible for it. Consult your carrier for the charges applicable to your plan.

6.10 Your Mobile Number. You represent that you are the subscriber to, or the customary user of, the mobile telephone number you furnish, and that you are authorized to consent to the receipt of messages at that number. You shall notify the Company promptly upon relinquishing or changing that number, so that the Company does not transmit messages concerning your care or your account to a person who has since been assigned it. You may update the number through your account settings on the Platform.

6.11 Security of Text Messaging. Short message service is not an inherently secure medium. Where you consent to the receipt of messages, you acknowledge the risk that a message may be intercepted, misdirected, or read by a person with access to your device, and you accept that risk. The Company limits the content of messages transmitted under the Messaging Program to what is necessary and makes available secure messaging functionality within the Platform, which you are encouraged to use for any communication containing Protected Health Information. See also Section 12 of the Terms and Conditions of Use.

6.12 Minors. The Messaging Program is not available to individuals under the age of eighteen (18) except through a parent, legal guardian, or other authorized representative who furnishes the number and consents on the individual's behalf.

7. Cookies and Online Tracking Technologies

7.1 Categories Employed. The Platform employs the following categories of technologies:

• Strictly necessary technologies, which enable authentication, session management, load balancing, security, and fraud prevention. These technologies cannot be disabled without rendering the Platform inoperable.
• Functional technologies, which preserve your language, accessibility, and display preferences.
• Performance and diagnostic technologies, which enable the Company to measure availability, diagnose defects, and improve reliability.

7.2 Restriction on Third-Party Tracking in Authenticated Environments. The Company is mindful of the guidance issued by the United States Department of Health and Human Services, Office for Civil Rights, concerning the use of online tracking technologies by covered entities. The Company does not deploy third-party advertising, analytics, or social media tracking technologies within authenticated areas of the Platform, and does not transmit Protected Health Information to any third party through tracking technologies for advertising or marketing purposes. Where any analytics technology is employed in an authenticated context, the vendor is engaged under a written business associate agreement, is contractually prohibited from using the information for its own purposes, and is subject to configuration controls limiting the data transmitted.

7.3 Your Controls. Most browsers permit you to refuse or delete cookies. The Company honors the Global Privacy Control signal and comparable opt-out preference signals transmitted by your browser to the extent required by applicable state law. Refusal of strictly necessary technologies will impair or prevent the operation of the Platform.

7.4 Do Not Track. Because no uniform industry standard for the interpretation of "Do Not Track" browser signals has been adopted, the Platform does not respond to such signals other than as described in Section 7.3.

8. Disclosure of Non-PHI Personal Information

8.1 The Company discloses non-PHI Personal Information only to the following categories of recipients and only for the purposes identified:

• Service providers and processors, including hosting, telecommunications, payment processing, identity verification, and customer support vendors, each engaged under written contract restricting use of the information to the performance of contracted services;
• Professional advisors, including counsel, auditors, and insurers, subject to duties of confidentiality;
• Governmental authorities, where disclosure is required by law, subpoena, court order, or other lawful process, and subject to the Company's right to object;
• Successors in interest, in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to the requirement that the successor be bound by privacy commitments no less protective than those set forth herein; and
• Any recipient you direct, pursuant to your express instruction.

8.2 The Company does not disclose Personal Information to data brokers and does not participate in any information exchange for advertising purposes.

Notwithstanding the foregoing, no disclosure permitted by this Section shall be construed to permit the disclosure of Mobile Information for marketing or promotional purposes, whether to a third party or to an affiliate of the Company. Disclosure of Mobile Information is limited to the two circumstances enumerated at Section 6.6. Where Mobile Information is transferred to a successor in interest under Section 8.1, the successor shall be bound by the restriction set forth at Section 6.6.

9. Retail Mart Transaction Data

9.1 Purchases of over-the-counter products, health and wellness merchandise, and convenience grocery items at the Mart generate transaction records. Where a purchase is made anonymously and paid by cash, the Company does not associate the transaction with your identity.

9.2 Where a purchase is associated with your account, is funded through a health benefit allowance, or involves a product subject to statutory recordkeeping requirements, the resulting record may be associated with your identity. Retail purchase records that reflect your health status, condition, or treatment may constitute PHI and are handled in accordance with Part II.

9.3 The Company does not use retail purchase history to target advertising, does not disclose retail purchase history to advertisers or data brokers, and does not employ retail purchase history to make inferences that are disclosed to third parties.

9.4 Records maintained in connection with the sale of products regulated under the Combat Methamphetamine Epidemic Act or under comparable state law are maintained and disclosed solely as required by that law.

10. Your Choices and State Privacy Rights

10.1 Communication Preferences. You may elect to discontinue non-essential electronic mail and text message communications at any time through your account settings, by replying STOP to any text message, or by contacting the Company. The Company will continue to transmit communications necessary to your care, to the administration of your account, and to compliance with legal obligation. Opt-out of the Messaging Program is governed in full by Section 6.5.

10.2 Access and Correction. You may review and update your account profile information at any time through the Platform. Requests to amend clinical records are governed by Section 22.2.

10.3 State Consumer Privacy Statutes. Residents of certain states possess statutory rights with respect to Personal Information, including rights of access, correction, deletion, portability, and opt out of sale, sharing, and targeted advertising, together with the right to be free from retaliation for the exercise of such rights. Protected Health Information governed by HIPAA, and information maintained in a designated record set by a covered entity, is expressly exempted from most such statutes; with respect to that information, the rights conferred by Part II apply. To exercise a state statutory right with respect to non-exempt Personal Information, contact the Company at privacy@avantanetwork.com or (888) 505-4814. The Company will verify your identity prior to fulfilling any request and will respond within the period prescribed by the applicable statute.

10.4 Authorized Agents. You may designate an authorized agent to submit a request on your behalf. The Company will require proof of the agent's authority and may require that you directly verify your identity.

10.5 Appeals. Where a state statute confers a right of appeal from the denial of a privacy request, you may appeal by written notice to the Privacy Officer at 600 City Parkway West, Orange, CA 92868. The Company will respond in writing within the statutory period and will advise you of your right to contact the applicable state attorney general.

11. Information Security

11.1 The Company maintains administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of Personal Information and of electronic Protected Health Information, in accordance with the HIPAA Security Rule at 45 C.F.R. Part 164, Subpart C. Such safeguards include:

• encryption of electronic Protected Health Information in transit and at rest using industry standard cryptographic algorithms;
• role-based access control enforcing the minimum necessary standard;
• multifactor authentication for access to systems containing Protected Health Information;
• audit logging of access to and disclosure of Protected Health Information;
• periodic risk analysis and risk management pursuant to 45 C.F.R. § 164.308(a)(1);
• workforce training, sanction policies, and confidentiality obligations;
• secure disposal of media in accordance with recognized standards; and
• a documented incident response and contingency plan, subject to periodic testing.

11.2 Limitations. Notwithstanding the foregoing, no method of transmission over the internet and no method of electronic storage is entirely secure. The Company cannot and does not warrant absolute security. You bear responsibility for safeguarding your credentials and for the security of the devices from which you access the Platform.

11.3 Reporting. If you believe your account has been compromised or that your information has been accessed without authorization, notify the Company immediately at (888) 505-4814 or privacy@avantanetwork.com.

12. Data Retention

12.1 The Company retains Personal Information for the period necessary to fulfill the purposes for which it was collected, to comply with legal, regulatory, accreditation, and professional recordkeeping obligations, to resolve disputes, and to enforce agreements.

12.2 Medical records, including records pertaining to minors, are retained for not less than the minimum periods prescribed by applicable federal law and by California law, which impose a longer period for the records of minors than for those of adults. Pharmacy dispensing records are retained for the period prescribed by federal law and by the California Board of Pharmacy. Documentation of HIPAA compliance is retained for six (6) years pursuant to 45 C.F.R. § 164.530(j)(2).

12.3 Upon expiration of the applicable retention period, records are destroyed in a manner rendering the information unreadable, indecipherable, and incapable of reconstruction.

12.4 The closure of your account does not effect the destruction of your medical record, which the Company is legally obligated to retain.

12.5 Messaging Consent Data. Messaging Consent Data is retained for the period during which you are enrolled in the Messaging Program and for not less than four (4) years following your opt-out or the closure of your account, in order to evidence the consent obtained and the opt-out honored. A record of your opt-out is retained indefinitely for the sole purpose of ensuring that no further message is transmitted to that number.

13. Children and Minors

13.1 The Platform is not directed to children under the age of thirteen (13), and the Company does not knowingly collect Personal Information from such children through the Platform other than through a parent or legal guardian acting on the child's behalf. The Company complies with the Children's Online Privacy Protection Act, 15 U.S.C. § 6501 et seq.

13.2 A parent or legal guardian generally possesses the right to access the PHI of an unemancipated minor as the minor's personal representative. Such right does not extend to categories of care for which the minor may lawfully consent independently under the law of the State of California, to circumstances in which the minor is emancipated, or to circumstances in which the Company reasonably determines, in the exercise of professional judgment, that access would endanger the minor. The Company administers minor access in accordance with 45 C.F.R. § 164.502(g) and applicable state law.

13.3 If you believe the Company has collected Personal Information from a child in contravention of this Section, contact the Privacy Officer at privacy@avantanetwork.com so that the information may be deleted.

14. Third-Party Services and Territorial Scope

14.1 The Platform may link to or interoperate with services operated by third parties. The Company does not control and is not responsible for the privacy practices of such third parties. You should review the privacy notice of any third-party service prior to furnishing information to it.

14.2 The Company operates within the United States, and information is stored and processed within the United States. The Company does not knowingly transfer Protected Health Information outside the United States except where necessary to furnish care to an individual located abroad and subject to appropriate safeguards.

14.3 The Platform is not directed to individuals located in the European Economic Area, the United Kingdom, or Switzerland, and the Company makes no representation as to compliance with the privacy law of any jurisdiction outside the United States.

15. Amendment of This Policy

The Company may amend Part I of this document at any time. The revised Part I shall be posted to the Platform bearing an updated "Last Updated" date and shall take effect upon posting, except where applicable law requires advance notice or affirmative consent. Amendment of Part II is governed by Section 26.

Where an amendment materially alters the Messaging Program described at Section 6, including the categories of message transmitted or the restriction set forth at Section 6.6, the Company will furnish reasonable advance notice by electronic mail, in-Platform notification, or text message, and will obtain your renewed consent where applicable law requires it.

Part II: Notice of Privacy Practices

This Notice of Privacy Practices (the "Notice") is issued by Avanta pursuant to 45 C.F.R. § 164.520 and describes the privacy practices of the Company and of the Associated Physicians, Clinical Personnel, pharmacy personnel, urgent care personnel, students, trainees, and volunteers who furnish services at or on behalf of the Facility. The Company and its affiliated clinical practices participate in an organized health care arrangement within the meaning of 45 C.F.R. § 160.103, and this Notice is issued jointly on behalf of the participants in that arrangement. Participants may share Protected Health Information with one another as necessary to carry out treatment, payment, and health care operations relating to the arrangement.

16. Our Legal Obligations

The Company is required by law to:

• maintain the privacy and security of your Protected Health Information;
• provide you with this Notice of our legal duties and privacy practices with respect to your Protected Health Information;
• notify you promptly following a breach of unsecured Protected Health Information affecting your information;
• abide by the terms of the Notice currently in effect; and
• obtain your written authorization for uses and disclosures not described in this Notice, and honor the revocation of any such authorization.

The Company will not use or disclose your Protected Health Information without your written authorization except as described in this Notice or as otherwise permitted or required by law. The Company will apply the minimum necessary standard set forth at 45 C.F.R. § 164.502(b), except with respect to disclosures to or requests by a health care provider for treatment purposes, disclosures to you, disclosures made pursuant to your authorization, and other disclosures for which the standard does not apply.

17. Uses and Disclosures for Treatment, Payment, and Health Care Operations

17.1 Treatment. The Company uses and discloses your Protected Health Information to furnish, coordinate, and manage your health care. By way of illustration, an Associated Physician may review your medication history maintained by the Pharmacy prior to prescribing; the Urgent Care may transmit records of an acute encounter to your primary care physician; and the Company may disclose your information to a specialist, laboratory, imaging center, or hospital to which you are referred. The Company may also participate in health information exchanges and interoperability networks that make your information available to your other treating providers, subject to your right to request a restriction under Section 22.4.

17.2 Payment. The Company uses and discloses your Protected Health Information to obtain payment for services rendered. By way of illustration, the Company may transmit claims and supporting documentation to your health plan or pharmacy benefit manager, obtain prior authorization, verify eligibility, conduct utilization review, and engage collection activity consistent with applicable law.

17.3 Health Care Operations. The Company uses and discloses your Protected Health Information for health care operations as defined at 45 C.F.R. § 164.501, including quality assessment and improvement, outcomes evaluation, case management and care coordination, provider credentialing and peer review, training of students and trainees, accreditation and licensure activity, medical review, legal services, auditing, business planning, and general administration.

17.4 Appointment Reminders and Health-Related Communications. The Company may contact you to furnish appointment reminders, notice that a prescription is ready, recall and refill notices, results notifications, and information concerning treatment alternatives or health-related benefits and services that may be of interest to you. You may request that such communications be furnished by an alternative means or at an alternative location pursuant to Section 22.5.

Where such a communication is furnished by text message, it is transmitted under the Messaging Program described at Part I, Section 6, and constitutes a treatment or health care operations communication and not marketing within the meaning of 45 C.F.R. § 164.501.

17.5 Individuals Involved in Your Care. Unless you object, the Company may disclose to a family member, relative, close personal friend, or other individual identified by you the Protected Health Information directly relevant to that person's involvement in your care or payment for your care. Where you are not present or are incapacitated, the Company may exercise professional judgment to determine whether such disclosure is in your best interest. The Company may also disclose your information to a disaster relief organization for the purpose of notifying a family member of your location and condition.

17.6 Facility Directory. The Company does not maintain a facility directory of the type maintained by an inpatient institution. Where the Company maintains any listing of individuals present at the Facility for operational or safety purposes, such listing is not disclosed to the public.

18. Other Permitted or Required Uses and Disclosures Without Your Authorization

The Company may use or disclose your Protected Health Information without your authorization in the following circumstances, in each case subject to the conditions and limitations prescribed by 45 C.F.R. §§ 164.512 and 164.514:

• As required by law, including by statute, regulation, or court order.
• Public health activities, including reporting of disease, injury, vital events, adverse events, product defects, and recalls to public health authorities and to the Food and Drug Administration, and notification of persons who may have been exposed to a communicable disease.
• Victims of abuse, neglect, or domestic violence, where reporting is required or authorized by law.
• Health oversight activities, including audits, investigations, inspections, licensure actions, and civil, administrative, or criminal proceedings conducted by health oversight agencies.
• Judicial and administrative proceedings, in response to a court or administrative order, or in response to a subpoena, discovery request, or other lawful process where satisfactory assurance of notice to you or of a qualified protective order has been furnished.
• Law enforcement purposes, including to identify or locate a suspect, fugitive, material witness, or missing person; concerning a victim of crime under specified conditions; concerning a death that may have resulted from criminal conduct; and concerning criminal conduct occurring on the premises.
• Decedents, to coroners, medical examiners, and funeral directors as necessary to the performance of their duties.
• Organ and tissue donation, to organizations engaged in procurement, banking, or transplantation.
• Research, where the use or disclosure has been approved by an institutional review board or privacy board pursuant to a waiver of authorization, where the activity is preparatory to research, or where the research involves the information of decedents.
• Serious threat to health or safety, where the disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, and the disclosure is made to a person reasonably able to prevent or lessen the threat.
• Specialized government functions, including military and veterans activities, national security and intelligence activities, protective services for the President, and the provision of care to inmates by correctional institutions.
• Workers' compensation, as authorized by and to the extent necessary to comply with workers' compensation law.
• Health plan sponsors and underwriting, subject to the prohibition at 45 C.F.R. § 164.502(a)(5)(i) against the use or disclosure of genetic information for underwriting purposes.

19. Uses and Disclosures Requiring Your Written Authorization

19.1 The following uses and disclosures require your prior written authorization satisfying the requirements of 45 C.F.R. § 164.508:

• Psychotherapy notes, except in the limited circumstances specified at 45 C.F.R. § 164.508(a)(2);
• Marketing communications, other than face-to-face communications and the provision of a promotional gift of nominal value;
• Any disclosure constituting a sale of Protected Health Information, as defined at 45 C.F.R. § 164.502(a)(5)(ii);
• Use of your information or likeness in testimonials, advertising, or promotional material; and
• Any other use or disclosure not described in this Notice.

19.2 Revocation. You may revoke an authorization at any time by written notice to the Privacy Officer. Revocation is effective prospectively and does not affect any use or disclosure made in reliance upon the authorization prior to its revocation, nor does it affect any right the Company may have to contest a claim under a policy where the law provides the insurer with the right to contest.

19.3 No Conditioning. The Company will not condition treatment, payment, enrollment, or eligibility for benefits upon your execution of an authorization, except as permitted by 45 C.F.R. § 164.508(b)(4).

20. Specially Protected Categories of Information

20.1 Substance Use Disorder Records. Records of the identity, diagnosis, prognosis, or treatment of any patient maintained in connection with a federally assisted substance use disorder program are subject to the additional protections of 42 U.S.C. § 290dd-2 and 42 C.F.R. Part 2. Such records are generally not disclosed without your written consent, including for the purposes of criminal investigation or prosecution, and any permitted disclosure is accompanied by the notice prohibiting redisclosure required by 42 C.F.R. § 2.32.

20.2 Reproductive Health Care. Consistent with 45 C.F.R. § 164.502(a)(5)(iii), the Company will not use or disclose Protected Health Information for the purpose of conducting a criminal, civil, or administrative investigation into, or imposing liability upon, any person for the mere act of seeking, obtaining, providing, or facilitating lawful reproductive health care, nor for the purpose of identifying any person for such purpose. Where a request for such information is received, the Company will obtain the attestation required by 45 C.F.R. § 164.509 before making any disclosure for health oversight, judicial or administrative proceedings, law enforcement, or decedent purposes.

20.3 Mental Health, HIV, Genetic, and Other Sensitive Information. Information concerning mental health treatment, HIV and other communicable disease status, genetic testing, and sexually transmitted infection may be subject to heightened protection under the law of the State of California. Where state law affords greater protection than HIPAA, the Company adheres to the more protective standard.

20.4 Immigration Status and Related Information. The Company does not condition the provision of care upon immigration status and does not disclose information concerning immigration status except where compelled by valid legal process.

21. Business Associates

The Company engages third parties to perform functions on its behalf that involve the use or disclosure of Protected Health Information, including electronic health record vendors, hosting providers, claims clearinghouses, transcription services, billing and collection agencies, and professional advisors. Each such party is a business associate within the meaning of 45 C.F.R. § 160.103 and is engaged under a written business associate agreement satisfying 45 C.F.R. § 164.504(e) that obligates the party to safeguard your Protected Health Information, to limit its use and disclosure to the purposes of the engagement, to report security incidents and breaches, and to impose equivalent obligations upon its subcontractors.

The Company's messaging service provider, through which messages described at Part I, Section 6 are transmitted, is engaged under such an agreement and is contractually prohibited from using any information it receives for its own purposes, including any marketing purpose.

22. Your Rights With Respect to Protected Health Information

You possess the following rights with respect to Protected Health Information maintained by the Company in a designated record set. To exercise any right, submit a written request to the Privacy Officer at the address set forth in Section 27. Forms are available upon request and through the Platform.

22.1 Right of Access. You have the right to inspect and to obtain a copy of your Protected Health Information, in the form and format you request if readily producible, including in electronic form where the information is maintained electronically. You may direct the Company to transmit a copy to a third party you designate in a signed, written request identifying that party. The Company will act upon your request within thirty (30) days, subject to a single thirty (30) day extension upon written notice stating the reason for the delay. The Company may impose a reasonable, cost-based fee as permitted by 45 C.F.R. § 164.524(c)(4). Access may be denied in the limited circumstances specified by regulation, and certain denials are subject to review by a licensed health care professional designated by the Company who did not participate in the original decision.

22.2 Right to Request Amendment. You have the right to request that the Company amend Protected Health Information you believe to be inaccurate or incomplete. Your request must be submitted in writing and must state the reason supporting the requested amendment. The Company will act within sixty (60) days, subject to a single thirty (30) day extension. The Company may deny the request where the information was not created by the Company, is not part of the designated record set, would not be available for inspection under Section 22.1, or is accurate and complete. If the request is denied, you may submit a written statement of disagreement, which will be appended to the record and included in future disclosures.

22.3 Right to an Accounting of Disclosures. You have the right to receive an accounting of disclosures of your Protected Health Information made by the Company during the six (6) years preceding your request, excluding disclosures for treatment, payment, and health care operations, disclosures made to you, disclosures made pursuant to your authorization, and other categories excepted by 45 C.F.R. § 164.528. The first accounting requested within any twelve (12) month period is furnished without charge; the Company may impose a reasonable, cost-based fee for subsequent requests, and will advise you of the fee in advance so that you may modify or withdraw your request.

22.4 Right to Request Restrictions. You have the right to request a restriction upon the use or disclosure of your Protected Health Information for treatment, payment, or health care operations, or to an individual involved in your care. The Company is not obligated to agree to a requested restriction, except that the Company must agree to restrict disclosure to a health plan for purposes of carrying out payment or health care operations where the disclosure pertains solely to a health care item or service for which you, or a person other than the health plan on your behalf, have paid the Company in full out of pocket, in accordance with 45 C.F.R. § 164.522(a)(1)(vi). Where the Company agrees to a restriction, it will abide by that restriction except in a medical emergency.

22.5 Right to Request Confidential Communications. You have the right to request that the Company communicate with you concerning medical matters by alternative means or at an alternative location. The Company will accommodate reasonable requests and will not require you to state the reason for the request.

A request that the Company not communicate with you by text message, or that it communicate with you at a different mobile telephone number, is such a request and will be accommodated.

22.6 Right to a Paper Copy of This Notice. You have the right to obtain a paper copy of this Notice upon request, notwithstanding that you may have agreed to receive it electronically.

22.7 Right to Notification of a Breach. You have the right to be notified in the event of a breach of your unsecured Protected Health Information, as set forth in Section 23.

22.8 Right to Designate a Personal Representative. A person authorized under applicable law to make health care decisions on your behalf may exercise your rights under this Notice. The Company may decline to treat a person as your personal representative where it reasonably believes that doing so would endanger you, or where it determines in the exercise of professional judgment that doing so is not in your best interest.

22.9 Right to Complain Without Retaliation. You have the right to file a complaint as set forth in Section 25. The Company will not retaliate against you, and will not condition your treatment or the payment of your claims, on the filing of a complaint or the exercise of any right described in this Notice.

23. Breach Notification

23.1 In the event of a breach of unsecured Protected Health Information, the Company will notify affected individuals without unreasonable delay and in no case later than sixty (60) calendar days following discovery of the breach, in accordance with 45 C.F.R. Part 164, Subpart D.

23.2 Notification will describe the nature of the breach, the types of information involved, the steps you should take to protect yourself, the measures the Company is taking to investigate and mitigate the incident, and the means by which you may obtain further information.

23.3 The Company will additionally notify the Secretary of the United States Department of Health and Human Services and, where the breach affects more than five hundred (500) residents of a state or jurisdiction, prominent media outlets serving that jurisdiction, as required by regulation, together with such notifications as the law of the State of California may require.

24. Pharmacy Privacy Practices

24.1 The Pharmacy maintains dispensing records as required by federal law and by the California Board of Pharmacy. Such records constitute Protected Health Information and are governed by this Notice.

24.2 The Pharmacy reports dispensing data for controlled substances to the California prescription drug monitoring program as required by law. Access to that program by authorized prescribers and dispensers is governed by state law and not by this Notice.

24.3 The Pharmacy maintains counseling areas and operational safeguards designed to limit incidental disclosure of Protected Health Information to other patrons of the Facility. You may request a private counseling area at any time.

24.4 Where you designate an agent to collect a dispensed prescription on your behalf, the Pharmacy will disclose to that agent only the information necessary to effect the transfer, subject to verification of identity.

24.5 The Pharmacy does not sell prescription data to third parties for marketing purposes. Refill reminders and communications concerning a currently prescribed drug are treated as treatment communications and not as marketing, consistent with 45 C.F.R. § 164.501, provided that any financial remuneration received in connection with such communication is reasonably related to the cost of making it.

25. Complaints

25.1 If you believe your privacy rights have been violated, you may file a complaint with the Company Privacy Officer at the address set forth in Section 27. Complaints must be submitted in writing and should describe the conduct at issue and the date on which it occurred. The Company will investigate and will respond in writing.

25.2 You may also file a complaint with the Secretary of the United States Department of Health and Human Services, Office for Civil Rights. Complaints must generally be filed within one hundred eighty (180) days of the date on which you knew or should have known of the alleged violation.

25.3 You may additionally file a complaint with the Attorney General of the State of California or with the applicable state licensing authority.

26. Revisions to This Notice

26.1 The Company reserves the right to amend this Notice and to make the amended Notice effective with respect to Protected Health Information the Company already maintains as well as information it receives in the future.

26.2 A revised Notice will be posted prominently at the Facility and on the Platform, and copies will be made available upon request at the point of service, in accordance with 45 C.F.R. § 164.520(c). Each Notice bears the date on which it takes effect.

27. Contact Information

Text Messaging Program enquiries: call (888) 505-4814.

Language assistance services and auxiliary aids and services are available without charge to individuals with limited English proficiency and to individuals with disabilities. To request such services, or to request a paper copy of this Notice, contact the Company at (888) 505-4814. This document is also available in alternative formats upon request.