NOTICE OF PRIVACY PRACTICES

Effective Date: September 8, 2026
Document Version: 1.0

Privacy Contact: PepMed Privacy Officer
Email: privacy@pepmed.net

YOUR INFORMATION. YOUR RIGHTS. OUR RESPONSIBILITIES.

PLEASE REVIEW THIS NOTICE CAREFULLY

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, HOW YOU CAN GET ACCESS TO THIS INFORMATION, AND YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices ("Notice") describes the privacy practices applicable to protected health information ("PHI") maintained in connection with healthcare services provided through PepMed.

"Health information" or "PHI" generally means individually identifiable information about your health, healthcare, or payment for healthcare that is protected by applicable law.

This Notice explains:

• your rights regarding your health information;

• how your health information may be used and disclosed;

• circumstances in which your authorization may be required;

• our responsibilities for protecting your health information; and

• how to contact us or file a complaint regarding your privacy rights.

1. YOUR RIGHTS

You have rights regarding your health information. The availability and scope of particular rights may be subject to HIPAA and other applicable law.

Get an Electronic or Paper Copy of Your Health Information

You may ask to inspect or obtain an electronic or paper copy of your medical record and other health information we maintain about you that is subject to your right of access.

We will provide access or a copy as required by applicable law, generally within the time period required by HIPAA.

If permitted by law, we may charge a reasonable, cost-based fee associated with providing the requested copy.

Where functionality is available, you may also be able to access certain health information electronically through the PepMed patient portal.

Certain information may be excluded from the right of access as permitted by law.

Ask Us to Correct Your Health Information

If you believe health information we maintain about you is incorrect or incomplete, you may ask us to amend it.

We may deny the request in certain circumstances permitted by law, but if we do, we will explain the reason in writing and describe any rights you may have regarding that decision.

Request Confidential Communications

You may ask us to contact you regarding your health information in a particular way or at a particular location.

For example, you may request that we communicate with you using a particular telephone number, email address, mailing address, or other available method.

We will accommodate reasonable requests as required by law.

Ask Us to Limit What We Use or Share

You may ask us not to use or disclose certain health information for treatment, payment, or healthcare operations.

We are generally not required to agree to such a request unless applicable law requires us to do so.

If you pay in full out-of-pocket for a particular healthcare item or service and ask us not to disclose information about that item or service to a health plan for payment or healthcare operations, we will honor that request when HIPAA requires us to do so.

Receive an Accounting of Certain Disclosures

You may request a list, known as an "accounting of disclosures," of certain disclosures of your health information made during the period permitted by law.

The accounting will not include certain disclosures that HIPAA excludes from this right, such as many disclosures made for treatment, payment, or healthcare operations.

We will provide one accounting within a 12-month period without charge. We may charge a reasonable, cost-based fee for additional requests during the same period when permitted by law, after informing you of the cost and giving you an opportunity to withdraw or modify the request.

Get a Copy of This Notice

You may request a paper or electronic copy of this Notice at any time, even if you previously agreed to receive the Notice electronically.

The current Notice will also be made available through PepMed's website as required by applicable law.

Choose Someone to Act for You

If you have given another person medical power of attorney or if someone is otherwise legally authorized to act as your personal representative, that person may exercise applicable privacy rights on your behalf.

We may verify the person's identity and authority before allowing that person to act for you.

You may also identify a family member, spouse, caregiver, or other person whom you would like involved in your care or with whom certain health information may be shared, subject to your direction, professional judgment, HIPAA, and other applicable law.

File a Complaint if You Believe Your Rights Were Violated

If you believe your privacy rights have been violated, you may contact:

PepMed Privacy Officer
Email: privacy@pepmed.net

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights (OCR).

Information about filing a complaint is available from HHS at its Office for Civil Rights website.

PepMed will not retaliate against you for filing a privacy complaint or exercising your privacy rights.

2. YOUR CHOICES

For certain health information, you may tell us your preferences regarding what we share.

Family Members, Friends, and Others Involved in Your Care

You may tell us whether you want us to share relevant health information with a family member, spouse, caregiver, close friend, or another person involved in your care or payment for your care.

Where appropriate, we may share information based upon your instructions, your agreement, circumstances indicating that you do not object, or as otherwise permitted by applicable law.

If you are unable to tell us your preference, such as during an emergency, we may disclose relevant information when permitted by law and when, in our professional judgment, disclosure is in your best interest.

We will limit such disclosures to information reasonably relevant to the person's involvement unless broader disclosure is authorized or permitted by law.

Disaster Relief

We may share relevant information with an organization assisting in a disaster-relief effort when permitted by law, including for purposes such as notifying family members or others involved in your care about your location, condition, or status.

Marketing

PepMed does not sell your PHI.

PepMed does not disclose your PHI to third parties for their own advertising or marketing purposes except with your valid authorization where such authorization is required by law.

For uses and disclosures of PHI for marketing that require authorization under HIPAA, we will obtain your authorization before using or disclosing the information.

This does not prevent PepMed from communicating with you regarding your treatment, care, health-related services, account, or other communications permitted by law.

Separate consent may be requested for optional promotional email or text communications.

Declining optional marketing communications will not affect your ability to receive healthcare through PepMed.

Sale of Health Information

PepMed does not sell your PHI.

If PepMed were ever to propose a use or disclosure that constitutes a sale of PHI for which HIPAA requires authorization, we would obtain the required authorization before doing so.

Fundraising

PepMed does not currently use PHI to conduct fundraising activities.

3. HOW WE TYPICALLY USE OR SHARE YOUR HEALTH INFORMATION

HIPAA permits us to use and disclose health information without your written authorization for certain purposes.

Treatment

We may use and disclose your health information to provide, coordinate, or manage your healthcare.

For example, your Provider may use your medical history, medications, laboratory results, and other health information when evaluating you and determining an appropriate treatment plan.

Information may also be shared, as permitted by law, with other healthcare professionals, pharmacies, laboratories, specialists, or other persons involved in your treatment.

Payment

We may use and disclose health information as necessary for payment-related activities.

Although PepMed currently operates primarily on a self-pay basis, payment activities may include processing healthcare-related transactions, coordinating payment for products or services involved in your care, responding to billing questions, or other payment activities permitted by law.

Only information reasonably necessary for the applicable payment activity should be used or disclosed.

Healthcare Operations

We may use and disclose your health information to operate and improve healthcare-related activities.

Examples may include:

• quality assessment and improvement;

• patient-safety activities;

• provider credentialing and review;

• compliance activities;

• auditing;

• training;

• legal and risk-management activities;

• healthcare administration;

• customer or patient support relating to healthcare;

• technology and security operations; and

• other healthcare operations permitted by law.

Business Associates and Service Providers

We may use third-party service providers to assist with healthcare or administrative functions.

When a third party performs functions involving PHI on behalf of a HIPAA covered entity and qualifies as a "business associate" under HIPAA, appropriate contractual and privacy safeguards are required.

Such services may include, where applicable:

• electronic health record technology;

• patient-portal infrastructure;

• healthcare communications;

• technology hosting or support;

• pharmacy or laboratory coordination;

• payment and administrative services;

• security and compliance services; and

• other healthcare-support functions.

Third-party access to PHI is limited according to the applicable service, contractual requirements, and law.

4. OTHER WAYS WE MAY USE OR SHARE HEALTH INFORMATION

We may also use or disclose health information without your authorization in circumstances permitted or required by law.

When Required by Law

We may disclose health information when federal, state, or local law requires us to do so.

Public Health and Safety Activities

We may disclose health information for legally permitted public-health and safety purposes, which may include:

• preventing or controlling disease;

• reporting adverse events or product problems;

• reporting suspected abuse, neglect, or domestic violence when authorized or required by law;

• preventing or reducing a serious and imminent threat to health or safety; and

• other authorized public-health activities.

Health Oversight Activities

We may disclose health information to authorized health-oversight agencies for activities permitted by law, such as audits, investigations, inspections, licensure activities, and other governmental oversight.

Workers' Compensation

We may disclose health information as authorized by and to the extent necessary to comply with workers' compensation or similar programs.

Law Enforcement

We may disclose health information to law-enforcement officials in circumstances permitted or required by law.

These circumstances are limited by HIPAA and may be further limited by other federal or state privacy laws.

Judicial and Administrative Proceedings

We may disclose health information in response to a valid court or administrative order or other lawful process when permitted or required by law.

Where additional legal protections apply to particular categories of health information, we will comply with those requirements.

Coroners, Medical Examiners, and Funeral Directors

We may disclose health information to coroners, medical examiners, or funeral directors when permitted or required by law.

Organ and Tissue Donation

We may disclose health information to organizations involved in organ, eye, or tissue donation and transplantation when permitted by law.

Government Functions and National Security

We may disclose health information for certain specialized government functions, including lawful national-security, protective-service, military, or correctional activities, when permitted by law.

Serious Threat to Health or Safety

We may use or disclose health information when necessary and permitted by law to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.

5. USES AND DISCLOSURES REQUIRING YOUR AUTHORIZATION

Some uses and disclosures of PHI require your written authorization.

Examples may include:

• certain uses or disclosures for marketing;

• a sale of PHI;

• many uses and disclosures of psychotherapy notes, if applicable;

• certain disclosures not otherwise permitted by HIPAA or other applicable law; and

• other circumstances for which authorization is legally required.

When authorization is required, we will ask you to provide a valid authorization describing the information and permitted use or disclosure.

PepMed will not require you to execute a blanket authorization for unrelated disclosures simply as a condition of establishing care, except where permitted by law.

If you provide an authorization, you generally may revoke it in writing at any time, except to the extent that action has already been taken in reliance on the authorization or another legal exception applies.

6. SUBSTANCE USE DISORDER RECORDS

PepMed does not currently operate a federally assisted substance use disorder treatment program subject to 42 CFR Part 2.

However, certain substance use disorder treatment records created by or received from a federally assisted Part 2 program may receive additional confidentiality protections under federal law.

If PepMed creates or maintains records subject to Part 2, we will use and disclose those records only as permitted by applicable law and will honor additional restrictions applicable to those records.

Part 2 records may be subject to restrictions beyond the protections ordinarily applicable under HIPAA, including restrictions concerning certain uses or disclosures in civil, criminal, administrative, or legislative proceedings against the patient.

Where patient consent is legally required for the use or disclosure of Part 2 records, the required consent will be obtained.

7. SENSITIVE HEALTH INFORMATION AND MORE PROTECTIVE LAWS

Some categories of health information may receive protections under federal or state law that are more restrictive than HIPAA.

Depending upon the circumstances and applicable jurisdiction, these may include certain information relating to:

• substance use disorder treatment;

• mental or behavioral health treatment;

• HIV/AIDS or other communicable diseases;

• genetic information;

• reproductive or sexual health;

• minors; or

• other specially protected health information.

Where another applicable law provides greater privacy protection than HIPAA, we will comply with the more protective requirement to the extent applicable.

8. OUR RESPONSIBILITIES

We are required by law to maintain the privacy and security of PHI as required by applicable law.

We are required to:

• protect the privacy and security of your PHI;

• provide you with this Notice describing our legal duties and privacy practices;

• follow the terms of the Notice currently in effect; and

• notify affected individuals following a breach of unsecured PHI when notification is required by law.

We maintain administrative, technical, and physical safeguards designed to protect PHI.

However, no electronic information system or method of communication can be guaranteed to be completely secure.

9. WE DO NOT SELL YOUR PHI

PepMed does not sell PHI.

PepMed does not provide PHI to advertising platforms, data brokers, or other third parties for their independent advertising purposes without a valid authorization when authorization is required by law.

Information used for treatment, payment, healthcare operations, or other purposes permitted by HIPAA is handled in accordance with applicable privacy requirements.

10. RESEARCH

PepMed does not currently operate a program that uses identifiable patient PHI for clinical research.

If PepMed participates in research in the future, PHI will be used or disclosed for research only in accordance with applicable law, including obtaining patient authorization or appropriate institutional/privacy approval where required.

Acceptance of this Notice does not constitute consent to participate in research.

11. CHANGES TO THIS NOTICE

We may change the terms of this Notice and our privacy practices as permitted by law.

Changes may apply to health information we already maintain as well as information created or received after the change, to the extent permitted by law.

When we make a material change requiring revision of this Notice, we will make the revised Notice available as required by law.

The current version will be available through PepMed's website and upon request.

The effective date appearing at the beginning of this Notice identifies the version currently in effect.

12. QUESTIONS OR PRIVACY REQUESTS

For questions regarding this Notice, requests to exercise your privacy rights, or complaints regarding our privacy practices, contact:

PepMed Privacy Officer
Email: privacy@pepmed.net

Additional contact methods may be added as PepMed's operations develop.

You may also contact the U.S. Department of Health and Human Services Office for Civil Rights to file a HIPAA complaint.

We will not retaliate against you for filing a complaint or exercising a privacy right.

ACKNOWLEDGMENT OF RECEIPT

This acknowledgment confirms that you received PepMed's Notice of Privacy Practices. It does not constitute a blanket authorization for PepMed to use or disclose your health information.

By selecting "I Acknowledge Receipt," I acknowledge that:

1. I have been provided access to PepMed's Notice of Privacy Practices.

2. I understand that the Notice describes how my health information may be used and disclosed and explains my privacy rights.

3. I understand that I may obtain an electronic or paper copy of the Notice.

4. I understand that I may contact the PepMed Privacy Officer with questions or to exercise applicable privacy rights.

5. I understand that acknowledging receipt of this Notice does not authorize uses or disclosures of my health information that otherwise require separate authorization under applicable law.

6. I understand that PepMed may revise its Notice as permitted or required by law and that the current version will be made available through PepMed's website and upon request.

Patient: [Automatically populated by Canvas]
Date/Time: [Automatically recorded by Canvas]
Document Version: 1.0
Acceptance: ☐ I Acknowledge Receipt