Notice of Privacy Practices

Contents

1. 1. Who Issues This Notice
2. 2. Our Legal Duties
3. 3. Treatment, Payment & Operations
4. 4. Other Permitted Disclosures
5. 5. Uses Requiring Authorization
6. 6. Disclosures You Can Object To
7. 7. Your Rights
8. 8. Email and Text Messages
9. 9. How We Protect Information
10. 10. Complaints
11. 11. Changes to This Notice
12. 12. How to Contact Us

1. 1. Who Issues This Notice
2. 2. Our Legal Duties
3. 3. Treatment, Payment & Operations
4. 4. Other Permitted Disclosures
5. 5. Uses Requiring Authorization
6. 6. Disclosures You Can Object To
7. 7. Your Rights
8. 8. Email and Text Messages
9. 9. How We Protect Information
10. 10. Complaints
11. 11. Changes to This Notice
12. 12. How to Contact Us

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Who Issues This Notice

This Notice is issued by OpenLoop Healthcare Partners, PC (“the Practice,” “we,” “us,” or “our”), the professional entity through which licensed clinicians provide telehealth services to patients using the Living Plus Rx platform. It describes how the Practice may use and disclose your protected health information (“PHI”) and the rights you have regarding that information.

Living Plus Rx LLC is a technology and administrative services company. It is not a medical practice and does not provide medical care. Where Living Plus Rx handles protected health information on our behalf, it does so as a business associate under a written agreement that requires it to protect your information and limits how it may be used.

Your medical record is created and held by the Practice, not by Living Plus Rx. Requests concerning your medical record should be directed to us using the contact information in Section 12.

Living Plus Rx maintains a separate Privacy Policy covering the account, billing, and website information it collects as a business. That policy is not this Notice and does not govern your medical record.

Our Pledge and Our Legal Duties

We understand that information about your health is personal, and we are committed to protecting it. We are required by law to:

• Maintain the privacy and security of protected health information that identifies you;
• Provide you with this Notice describing our legal duties and privacy practices;
• Follow the terms of the Notice currently in effect; and
• Notify you promptly if a breach occurs that may have compromised the privacy or security of your information.

Some states provide stronger protection than federal law for certain categories of information, including mental health records, substance use disorder treatment records, HIV and other communicable disease information, and genetic information. Where state law is more protective, we follow the state law.

Treatment, Payment, and Health Care Operations

We may use and disclose your PHI without your written authorization for the following purposes.

For treatment. To provide, coordinate, and manage your care. This includes sharing information with the clinicians who evaluate you, with pharmacies that prepare and dispense your prescriptions, and with laboratories that perform testing your clinician orders. For example, we transmit your prescription and relevant clinical details to a dispensing pharmacy so that your medication can be prepared correctly.

For payment. To bill and collect for the services provided to you. This includes sharing limited information with payment processors and, if you choose to use one, with an HSA or FSA administrator. For example, we confirm that a service was rendered so that a charge can be processed.

Our services are entirely self-pay. We do not submit claims to commercial health plans, Medicare, Medicaid, or any other third-party payor, and we do not disclose your PHI to health insurers for payment purposes.

For health care operations. To run the Practice — including quality assessment, clinical review, provider credentialing and evaluation, training, compliance auditing, and business planning. Wherever practical we use de-identified or aggregated information for these purposes rather than information that identifies you.

With business associates. We share PHI with vendors who perform functions on our behalf, including Living Plus Rx, our clinical platform provider, and secure messaging and hosting services. Each is bound by a written agreement requiring it to safeguard your information.

Appointment and care reminders. To contact you about scheduling, refills, follow-up, and treatment alternatives or health-related services that may be of interest to you.

Other Uses and Disclosures Permitted or Required by Law

Subject to conditions set by law, we may use or disclose your PHI without your authorization:

• When required by federal, state, or local law;
• For public health activities, including reporting disease, injury, births and deaths, and adverse events or product defects to the FDA;
• To report suspected abuse, neglect, or domestic violence;
• For health oversight activities such as audits, investigations, licensure, and inspections by government agencies;
• In response to a court or administrative order, subpoena, discovery request, or other lawful process;
• For law enforcement purposes as permitted by law;
• To coroners, medical examiners, and funeral directors as necessary to carry out their duties;
• For organ, eye, or tissue donation;
• For research, where an institutional review board has approved a protocol with privacy protections;
• To avert a serious and imminent threat to the health or safety of you or another person;
• For specialized government functions, including military, national security, and protective services; and
• As authorized by workers’ compensation laws.

Uses That Require Your Written Authorization

Other than the uses described above, we will not use or disclose your PHI without your written authorization. Your authorization is specifically required for:

• Sale of your PHI. We do not sell protected health information.
• Marketing. Most marketing communications that involve your PHI require your authorization. We do not use your PHI for third-party marketing.
• Psychotherapy notes, in the limited circumstances where such notes exist.

We do not conduct fundraising and will not use your information for that purpose. We will never use or disclose genetic information for underwriting purposes.

You may revoke an authorization in writing at any time. Revocation stops future uses and disclosures but does not affect any action we already took in reliance on the authorization.

Disclosures You Can Object To

Unless you tell us otherwise, we may share information directly relevant to a person’s involvement in your care with a family member, friend, or other person you identify. We may also share limited information with a disaster relief organization so that your family can be notified of your location and condition.

You may ask us to stop these disclosures at any time. If you are unable to express a preference — for example, in an emergency — we will use our professional judgment about what is in your best interest.

Your Rights Regarding Your Health Information

Right to inspect and copy. You may inspect and obtain a copy of your medical and billing records. We will provide the copy in the electronic form and format you request if we can readily produce it, and we will respond within 30 days. You may also direct us to send a copy to a person or entity you designate. We may charge a reasonable, cost-based fee for copies.

Right to amend. If you believe information in your record is incorrect or incomplete, you may request an amendment in writing, with the reason supporting your request. We may deny the request in certain circumstances, and if we do, we will explain why and you may submit a statement of disagreement to be included in your record.

Right to an accounting of disclosures. You may request a list of disclosures we made of your PHI during the six years before your request, other than disclosures for treatment, payment, health care operations, and certain other exceptions. The first accounting in any twelve-month period is free.

Right to request restrictions. You may ask us to limit how we use or disclose your PHI for treatment, payment, or health care operations, or to limit what we share with someone involved in your care. We are not required to agree to every request.

If you pay for a service in full, out of pocket, you have the right to require that we not disclose information about that service to a health plan for payment or health care operations purposes, and we must agree. Because our services are entirely self-pay, this protection applies to your care with us by default.

Right to confidential communications. You may ask us to contact you in a particular way or at a particular address or number — for example, only by secure message, or only at a specific email. We will accommodate reasonable requests and will not ask why.

Right to a paper copy of this Notice. You may request a paper copy at any time, even if you agreed to receive it electronically.

Right to be notified of a breach. We will notify you if a breach occurs that may have compromised the privacy or security of your information.

Right to choose someone to act for you. If you have given someone medical power of attorney, or if someone is your legal guardian, that person can exercise these rights on your behalf. We will verify their authority before acting.

Email and Text Messages

Standard email and SMS are not encrypted end-to-end. We limit these channels to appointment, refill, shipping, and account messages, and we do not send detailed clinical information over them. Substantive clinical communication takes place through the platform’s secure messaging.

If you prefer that we not contact you by email or text at all, tell us and we will accommodate that request under your right to confidential communications.

How We Protect Your Information

We maintain administrative, physical, and technical safeguards required by the HIPAA Security Rule. PHI is stored and transmitted on encrypted, access-controlled systems. Access is limited to workforce members and business associates who need the information to do their jobs, and only to the minimum necessary for that purpose. Administrative support personnel — including Living Plus Rx staff — see only limited information such as your name, contact details, billing status, and program type. They do not have access to your clinical record.

We do not sell your protected health information.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with the Practice’s Privacy Officer using the contact information in Section 12, or directly with the U.S. Department of Health and Human Services, Office for Civil Rights. You do not have to raise the matter with us first.

Complaints to OCR may be filed at hhs.gov/ocr/complaints, by mail to 200 Independence Avenue SW, Washington, D.C. 20201, or by phone at 1-800-368-1019.

We will not retaliate against you, deny you care, or treat you differently in any way for filing a complaint or exercising any right described in this Notice.

Changes to This Notice

We may change the terms of this Notice, and any change will apply to all protected health information we maintain, including information created or received before the change. The current Notice will always be posted on livingplusrx.com with its effective date, and you may request a copy at any time.

How to Contact Us

The fastest way to exercise any right described in this Notice, ask a question, or raise a concern is to contact the Living Plus Rx support team. We will route your request to the Practice’s Privacy Officer and follow up with you.

Living Plus Rx LLC — Patient Support

1501 South Greeley Hwy

Ste C #1542

Cheyenne, WY 82007

Email: support@livingplusrx.com

Phone: +1 307-394-4014

You may also send a message to your provider directly through the platform’s secure messaging.

Formal address of record. Because OpenLoop Healthcare Partners, PC is the covered entity responsible for your medical record, you may contact its Privacy Officer directly at any time. You are never required to go through Living Plus Rx.

OpenLoop Healthcare Partners, PC

Attn: Privacy Officer

Mailing address available on request

(or contact via Living+ Patient Support above)

Email: admin@livingplusrx.com

Requests to access or amend your medical record must ultimately be handled by the Practice, since Living Plus Rx does not hold clinical records. Routing a request through our support team does not extend the deadlines described in Section 7 — we forward requests to the Privacy Officer promptly on receipt.

This Notice is issued by the professional entity providing your medical care. Living Plus Rx LLC is a technology and administrative services company acting as a business associate. It is not a medical practice or a pharmacy and does not maintain patient medical records.