HIPAA Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices ("Notice") is provided to you by the independently practicing, US-licensed physicians and the professional corporations (collectively, the "Provider") that deliver clinical care through the Protocol MD platform. The Provider is the HIPAA-covered entity. Protocol MD is a technology and marketing platform that supports the Provider but does not itself practice medicine.

The Provider is required by law to maintain the privacy of your protected health information ("PHI"), to provide you with this Notice of its legal duties and privacy practices, and to abide by the terms of this Notice currently in effect.

1. How the Provider may use and disclose your PHI

The Provider may use and disclose your PHI without your written authorization for the following purposes:

• Treatment. To provide, coordinate, or manage your healthcare. For example, your physician may review your intake, prescribe a peptide protocol, send the prescription to a 503A compounding pharmacy, and order bloodwork through a partner laboratory.
• Payment. To bill and obtain payment for services. For example, the Provider may share information with your payment processor to process a charge for your prescribed protocol.
• Healthcare operations. To support the business activities of the Provider's practice, including quality assessment, training, credentialing, and audits.
• Business associates. To organizations that perform services on the Provider's behalf (including Protocol Studios LLC), under a written Business Associate Agreement that requires them to protect your PHI consistent with HIPAA.

Other uses and disclosures permitted or required by law include: as required by law; for public health activities; for health oversight activities; for judicial and administrative proceedings; for law enforcement purposes; for research (with appropriate authorization or waiver); to coroners, funeral directors, and organ procurement organizations; to avert a serious threat to health or safety; for specialized government functions; and for workers' compensation.

2. Uses and disclosures requiring your authorization

Most uses and disclosures of psychotherapy notes, uses and disclosures for marketing purposes, and disclosures that constitute a sale of PHI require your written authorization. Other uses and disclosures not described in this Notice will be made only with your written authorization. You may revoke an authorization at any time, in writing, except to the extent the Provider has already acted in reliance on it.

3. Your rights regarding your PHI

You have the following rights with respect to your PHI:

• Right of access. Request a copy of your medical record. We may charge a reasonable fee for the cost of producing the copy.
• Right to amend. Request that we amend information you believe is incorrect or incomplete.
• Right to an accounting of disclosures. Request a list of certain disclosures we have made of your PHI in the six years prior to your request.
• Right to request restrictions. Request restrictions on certain uses or disclosures of your PHI. We are not required to agree, except in the case of disclosures to a health plan for items or services for which you paid in full out of pocket.
• Right to request confidential communications. Request that we communicate with you about medical matters in a certain way or at a certain location.
• Right to a paper copy of this Notice. Request a paper copy of this Notice at any time, even if you have agreed to receive it electronically.
• Right to be notified of a breach. You will be notified if there is a breach of unsecured PHI that affects you.

To exercise any of these rights, contact us at hello@protocolmd.com.

4. Complaints

If you believe your privacy rights have been violated, you may file a complaint with the Provider by contacting us at hello@protocolmd.com, or with the US Department of Health and Human Services Office for Civil Rights. You will not be retaliated against for filing a complaint.

HHS Office for Civil Rights · 200 Independence Avenue SW · Washington, DC 20201 · 1-877-696-6775 · www.hhs.gov/ocr

5. Changes to this Notice

The Provider reserves the right to change the terms of this Notice and to make the new provisions effective for all PHI it maintains. The current Notice will always be available on this website, and a copy will be posted in any physical care location operated by the Provider, if applicable.

6. Effective date and contact information

This Notice is effective as of the date listed above. For questions, contact hello@protocolmd.com.