Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our Commitment

Jupiter Health, Inc., a Delaware corporation doing business as Wellward ("Wellward," "we," "us," or "our") is committed to protecting the privacy of your health information. This Notice of Privacy Practices ("Notice") describes how we may use and disclose your Protected Health Information ("PHI") to carry out the Services we provide, to obtain payment, for our operations, and for other purposes permitted or required by law. It also describes your rights with respect to your PHI.

We are required by law to maintain the privacy of your PHI, to provide you with this Notice of our legal duties and privacy practices, to abide by the terms of the Notice currently in effect, and to notify you in the event of a breach of unsecured PHI. We reserve the right to change this Notice. The revised Notice will apply to all PHI we maintain, including PHI created or received before the change. We will post the current Notice on our website at wellwardhealth.com/notice-of-privacy-practices and will make a paper copy available upon request.

How We May Use and Disclose Your Health Information Without Your Authorization

Treatment

We may use and disclose your PHI to assist in your treatment or the coordination of your care. For example, with your permission, we may share information about your medications or chronic conditions with a primary care physician we have helped you select, or with a pharmacy where you fill a prescription.

Payment

We may use and disclose your PHI to obtain or facilitate payment for the Services or for healthcare items or services you receive. For example, we may help you and your provider obtain payment from your health plan for a service you received.

Healthcare Operations

We may use and disclose your PHI for our healthcare operations, such as quality assessment and improvement, training of our care navigators, conducting reviews of care navigator performance, evaluating the effectiveness of the Services, internal audits, compliance activities, and care management. For example, we may review records of concierge interactions to evaluate quality and to train staff.

Business Associates

We engage third-party service providers ("Business Associates") to perform certain functions on our behalf. We may disclose your PHI to a Business Associate that is contractually obligated by a Business Associate Agreement to protect your PHI in accordance with HIPAA.

Individuals Involved in Your Care

With your verbal or written agreement, or where we infer your agreement from the circumstances and the absence of objection, we may disclose to a family member, other relative, close personal friend, or any other person you identify, the PHI directly relevant to that person's involvement in your care or payment for your care.

Required by Law

We will use and disclose your PHI when required to do so by federal, state, or local law.

Public Health Activities

We may disclose your PHI for public health activities, including to prevent or control disease, injury, or disability; to report births and deaths; to report child abuse or neglect; to report reactions to medications or product problems; to notify people of recalls; and to notify a person who may have been exposed to a disease or may be at risk of contracting or spreading a disease.

Victims of Abuse, Neglect, or Domestic Violence

We may disclose your PHI to a government authority authorized to receive reports of abuse, neglect, or domestic violence.

Health Oversight Activities

We may disclose your PHI to a health oversight agency for activities authorized by law, such as audits, investigations, inspections, and licensure.

Judicial and Administrative Proceedings

We may disclose your PHI in response to a court or administrative order, subpoena, discovery request, or other lawful process, subject to the requirements of HIPAA.

Law Enforcement

We may disclose your PHI to law enforcement officials for specified law enforcement purposes, including to comply with a court order, subpoena, or warrant; to identify or locate a suspect, fugitive, material witness, or missing person; about a crime victim; about a death we suspect may be the result of criminal conduct; about criminal conduct on our premises; or in an emergency.

Coroners, Medical Examiners, and Funeral Directors

We may disclose your PHI to coroners, medical examiners, and funeral directors to carry out their duties.

Organ and Tissue Donation

If you are an organ donor, we may disclose your PHI to organizations that procure or transplant organs, eyes, or tissue.

Research

We may use or disclose your PHI for research subject to applicable safeguards, including waiver of authorization by an institutional review board or privacy board.

To Avert a Serious Threat to Health or Safety

We may use or disclose your PHI when necessary to prevent or lessen a serious and imminent threat to your health or safety, or to the health or safety of the public or another person.

Military, Veterans, and Specialized Government Functions

We may disclose your PHI as required by military command authorities for members of the armed forces; for national security purposes; or for the provision of protective services to the President and other officials.

Workers' Compensation

We may disclose your PHI as authorized by workers' compensation or similar laws.

Uses and Disclosures Requiring Your Written Authorization

Except as described above, we will not use or disclose your PHI without your written authorization. In particular, the following uses and disclosures require your written authorization:

• Most uses and disclosures of psychotherapy notes, where we maintain them.
• Uses and disclosures of PHI for marketing purposes (other than face-to-face communications and gifts of nominal value).
• Any sale of PHI.

You may revoke an authorization in writing at any time. Revocation will not affect any use or disclosure made in reliance on the authorization before we received the revocation.

Your Rights With Respect to Your PHI

Right to Inspect and Copy

You have the right to inspect and obtain a copy of your PHI maintained by us in a designated record set, in the form and format you request if readily producible, including an electronic copy. We may charge a reasonable, cost-based fee. We will respond within 30 days of receiving your request (with a possible 30-day extension on notice to you). In limited circumstances we may deny your request; if we do, we will explain why and how you may appeal the denial.

Right to Request an Amendment

If you believe PHI we maintain about you is inaccurate or incomplete, you have the right to ask us to amend it. We may deny your request in certain circumstances, in which case we will give you a written explanation and tell you how to respond.

Right to an Accounting of Disclosures

You have the right to receive an accounting of certain disclosures of your PHI made by us in the six years before your request, other than disclosures for treatment, payment, healthcare operations, disclosures made to you, and certain other disclosures excluded by law. The first accounting in any 12-month period is free; we may charge a reasonable, cost-based fee for additional requests in the same 12-month period.

Right to Request Restrictions

You have the right to request that we restrict our uses or disclosures of your PHI for treatment, payment, or healthcare operations, or to family members or others involved in your care. We are not required to agree to your request, except that we must agree to restrict disclosures to a health plan for payment or healthcare operations if you (or someone on your behalf, other than the health plan) have paid for the item or service in full out of pocket.

Right to Confidential Communications

You have the right to request that we communicate with you about your PHI by alternative means or at alternative locations (for example, by mail to a different address, or only by encrypted email). We will accommodate reasonable requests.

Right to a Paper Copy of this Notice

You have the right to obtain a paper copy of this Notice at any time, even if you have agreed to receive it electronically.

Right to Be Notified of a Breach

You have the right to be notified following a breach of unsecured PHI affecting your information, as required by 45 CFR §164.404.

Right to File a Complaint

You may file a complaint with us by contacting our Privacy Officer at the address below. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights, by mail at 200 Independence Avenue, S.W., Washington, D.C. 20201, by phone at 1-877-696-6775, or online at https://www.hhs.gov/ocr/complaints/. We will not retaliate against you for filing a complaint.

Changes to this Notice

We reserve the right to change the terms of this Notice and to make the new terms effective for all PHI we maintain, including PHI we created or received before the change. We will post the revised Notice on our website and provide a copy upon request. We will distribute the revised Notice (or information about the revision and how to obtain it) in our next material communication with you.

Contact

If you have any questions about this Notice, want to exercise your rights, or wish to file a complaint, please contact:

Jupiter Health, Inc. d/b/a Wellward
Attn: Reynold Strossen, HIPAA Privacy Officer
860 Broadway, 6th Floor, New York, NY 10003
Email: hello@wellwardhealth.com