HIPAA Notice of Privacy Practices

1. Who This Notice Applies To

This Notice describes the privacy practices of the licensed healthcare providers affiliated with StratusMD (the "Clinical Partner") who provide medical services to you through the Reach Peak Life Inc. platform. The Clinical Partner is a HIPAA covered entity and is responsible for the privacy of your protected health information (PHI).

Reach Peak Life Inc. provides technology and administrative support services to the Clinical Partners and acts as a HIPAA business associate, bound by Business Associate Agreements that require Reach Peak Life Inc. to protect your PHI under HIPAA standards.

2. Our Responsibilities

• We are required by law to maintain the privacy and security of your protected health information
• We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information
• We must follow the duties and privacy practices described in this Notice and give you a copy of it
• We will not use or share your information other than as described here unless you tell us we can in writing; you may revoke that permission in writing at any time

3. Uses and Disclosures for Treatment, Payment, and Healthcare Operations

Treatment. We use and disclose your PHI to provide, coordinate, and manage your care. For example, your provider may share your medical history and lab results with a partner laboratory ordering tests, or with a 503A compounding pharmacy filling a prescription.

Payment. We use and disclose your PHI to bill and obtain payment for services. For example, we may share information with payment processors to process credit card transactions, or with HSA/FSA administrators when you request reimbursement substantiation.

Healthcare Operations. We use and disclose your PHI for operational activities, including quality assessment, provider training and credentialing, business management, customer service, and compliance. We use the minimum information necessary for these purposes.

4. Other Uses and Disclosures We May Make Without Your Authorization

We may use or disclose your PHI without your written authorization in the following circumstances, as permitted or required by law:

• Public health activities — including reporting communicable diseases, adverse drug events to the FDA, and public health surveillance
• Victims of abuse, neglect, or domestic violence — to appropriate authorities
• Health oversight activities — audits, investigations, inspections, and licensure actions
• Judicial and administrative proceedings — in response to a court order, subpoena, or discovery request, with required notice to you where applicable
• Law enforcement — for limited purposes, such as identifying a suspect, victim, or fugitive, or reporting certain wounds or injuries
• Coroners, medical examiners, and funeral directors — as required by law
• Organ, eye, and tissue donation — to facilitate donation if applicable
• Research — only with appropriate institutional review and privacy protections, or with de-identified data
• Serious threat to health or safety — to prevent or lessen a serious and imminent threat
• Specialized government functions — military, veterans, national security, and protective services
• Workers' compensation — for claims processing as authorized by state law
• Required by law — when state or federal law mandates disclosure

5. Uses and Disclosures Requiring Your Written Authorization

The following uses and disclosures require your written authorization, which you may revoke in writing at any time (except where we have already acted in reliance on it):

• Marketing communications beyond face-to-face communications, promotional gifts of nominal value, or treatment- and operations-related communications permitted by HIPAA
• Sale of PHI — Reach Peak Life Inc. and our Clinical Partners do not sell PHI
• Psychotherapy notes — most uses and disclosures of psychotherapy notes (where applicable) require written authorization
• Disclosures to third parties not described in this Notice

6. Your Rights Regarding Your PHI

You have the following rights with respect to your protected health information:

• Right of Access. You have the right to inspect and obtain a copy of your medical and billing records, in paper or electronic format. We may charge a reasonable, cost-based fee. We will respond within thirty (30) days.
• Right to Amend. You may request that we correct PHI you believe is inaccurate or incomplete. We may deny your request in certain circumstances and will explain our reasons in writing if we do.
• Right to an Accounting of Disclosures. You may request a list of certain disclosures of your PHI made in the six (6) years prior to the date you request. The first accounting in any 12-month period is free; we may charge a reasonable, cost-based fee for additional requests.
• Right to Request Restrictions. You may request that we restrict the use or disclosure of your PHI for treatment, payment, or healthcare operations. We are not required to agree, except that we must agree to restrict disclosures to a health plan when you have paid out-of-pocket in full for the relevant service.
• Right to Request Confidential Communications. You may request that we contact you at a specific address, phone number, or by a specific means (for example, via email rather than phone). We will accommodate reasonable requests.
• Right to a Paper Copy of This Notice. You have the right to receive a paper copy of this Notice upon request, even if you have agreed to receive it electronically.
• Right to Be Notified of a Breach. You have the right to be notified following a breach of your unsecured PHI.
• Right to Choose Someone to Act for You. If you have given someone medical power of attorney or if there is a legal guardian, that person can exercise your rights and make decisions about your PHI. We will verify the person's authority before taking action.

To exercise any of these rights, contact our Privacy Officer at the address in Section 9.

7. How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with:

Reach Peak Life Inc. Privacy Officer
Email: privacy@reachpeaklife.com

U.S. Department of Health and Human Services, Office for Civil Rights
200 Independence Avenue, S.W.
Washington, D.C. 20201
Toll-free: 1-877-696-6775
Web: www.hhs.gov/ocr/complaints

You will not be retaliated against for filing a complaint.

8. Changes to This Notice

We may change the terms of this Notice at any time. The new Notice will apply to all PHI we have about you, including PHI created or received before the change. The current Notice will be posted on the platform with an updated Effective Date, and a paper copy will be available upon request.

9. Contact Information

For questions about this Notice, to exercise your rights, or to file a complaint, contact:

Reach Peak Life Inc.
Attn: Privacy Officer
Email: privacy@reachpeaklife.com

For clinical questions, please contact your treating provider through the platform.

10. Acknowledgment

By using the Reach Peak Life Inc. platform and receiving services from our Clinical Partners, you acknowledge receipt of this Notice of Privacy Practices.