Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

1. Who We Are

This Notice of Privacy Practices ("Notice") describes the privacy practices of GEVITIX LAB [CONFIRM legal entity name] and its affiliates, including the affiliated professional entities through which care is delivered (such as OpenLoop Health and its network of US-licensed clinicians [CONFIRM affiliated professional entity names per MSA]), together with their physicians, healthcare practitioners and personnel ("we" or "us").

2. Our Privacy Obligations

We are required by law to maintain the privacy of your health information ("Protected Health Information" or "PHI"), to provide you this Notice of our legal duties and privacy practices with respect to your PHI, and to notify you following a breach of unsecured PHI. When we use or disclose your PHI, we must abide by the terms of this Notice (or the notice in effect at the time of the use or disclosure).

3. Uses and Disclosures Permitted Without Your Written Authorization

A. Treatment, payment and healthcare operations. We may use and disclose your PHI — but not your Highly Confidential Information (defined in Section 4.B) — to treat you, to obtain payment for services provided to you, and for our healthcare operations:

• Treatment — for example, to diagnose and treat your condition, and to share PHI with other providers involved in your care.
• Payment — in most cases, to obtain payment for services we provide to you.
• Healthcare operations — internal administration and planning, and activities that improve the quality and cost-effectiveness of care, such as evaluating the quality and competence of our clinicians, resolving complaints, and disclosing PHI to your other providers where required for their treatment, payment or certain operations (quality assessment, professional review, fraud and abuse detection, compliance).

B. Relatives, close friends and caregivers. We may disclose your PHI to a family member, relative, close friend or other person you identify when you are present and agree, are given the chance to object and do not, or we reasonably infer no objection. If you are not present or are incapacitated, or in an emergency, we may use professional judgment to determine whether disclosure is in your best interest, limited to information directly relevant to that person's involvement in your care or payment. We may also disclose PHI to notify such persons of your location, general condition or death.

C. Public health activities. Including reporting to public health authorities to prevent or control disease, injury or disability; reporting child abuse and neglect; reporting to the FDA about regulated products; alerting persons exposed to or at risk of communicable disease; and reporting work-related illness or injury under workplace-surveillance laws.

D. Victims of abuse, neglect or domestic violence. If we reasonably believe you are such a victim, we may notify a governmental authority authorized to receive these reports.

E. Health oversight activities. To agencies overseeing the healthcare system and government health programs such as Medicare or Medicaid.

F. Judicial and administrative proceedings. In response to a court order or other lawful process.

G. Law enforcement. As required or permitted by law, or in compliance with a court order, grand jury subpoena or administrative subpoena.

H. Decedents. To a coroner, medical examiner or funeral director as authorized by law.

I. Research. Where an Institutional Review Board or Privacy Board approves a waiver of authorization.

J. Health or safety. To prevent or lessen a serious and imminent threat to a person's or the public's health or safety.

K. Specialized government functions. To government units with special functions, such as the US military or Department of State, in certain circumstances.

L. Workers' compensation. As authorized by and necessary to comply with workers' compensation or similar state programs.

M. As required by law. When any other law not listed above requires it.

4. Uses and Disclosures Requiring Your Written Authorization

A. Your authorization. We must obtain your written authorization for uses and disclosures of PHI for marketing purposes and for any disclosure that constitutes a sale of PHI. Any other use or disclosure not described in this Notice will be made only with your written permission on an authorization form — for example, sending PHI to your life insurer or to opposing counsel in litigation.

B. Highly Confidential Information. Federal and state law gives special protection to certain categories of PHI ("Highly Confidential Information"), which may include information about: (1) mental health and developmental disability services; (2) alcohol and drug abuse prevention, treatment and referral; (3) HIV/AIDS testing, diagnosis or treatment; (4) sexually transmitted diseases; (5) genetic testing; (6) child abuse and neglect; (7) domestic abuse of an adult with a disability; and (8) sexual assault. We must have your authorization to disclose Highly Confidential Information for any purpose other than those permitted by law.

C. Revoking your authorization. You may revoke any written authorization (except to the extent we have already relied on it) by delivering a written statement to the Privacy Officer identified below. A revocation form is available on request.

5. Your Rights Regarding Your PHI

A. Information and complaints. For more about your privacy rights, if you believe we have violated them, or if you disagree with a decision about access to your PHI, contact our Privacy Officer at fc@gevitixlab.com [CONFIRM compliance phone line]. You may also file a written complaint with the Director, Office for Civil Rights, US Department of Health and Human Services; on request, the Privacy Officer will provide the Director's correct address. We will not retaliate against you for filing a complaint.

B. Right to request restrictions. You may request restrictions on uses and disclosures of your PHI for treatment, payment and healthcare operations, and to persons involved in your care. Where the request concerns disclosure to a health plan for payment or operations purposes and the PHI pertains solely to an item or service paid in full out of pocket, we must comply unless the law requires otherwise. For all other restriction requests we are not required to agree, but will try to accommodate reasonable requests. Request forms are available from the Privacy Officer, and we will respond in writing.

C. Right to confidential communications. We will accommodate any reasonable written request to receive your PHI by alternative means or at alternative locations.

D. Right to inspect and copy. You may request access to your medical and billing records to inspect and obtain copies. In limited circumstances we may deny access to a portion of the records. To request access, obtain a Release of Information form from the Privacy Officer and submit it to fc@gevitixlab.com. For copies, we may charge a cost-based fee covering labor, supplies or portable media, postage, and — if agreed in advance — preparation of a summary or explanation.

E. Right to amend. You may request amendment of PHI in your medical or billing records using an Amendment Request form from the Privacy Officer, submitted to fc@gevitixlab.com. We will comply unless we believe the information is accurate and complete or other special circumstances apply.

F. Right to an accounting of disclosures. On request, you may receive an accounting of certain disclosures of your PHI made during a period of up to six years before your request. If you request more than one accounting in a 12-month period, we may charge a reasonable fee and will inform you of it in advance so you can withdraw or modify the request.

G. Right to a copy of this Notice. On request, you may obtain this Notice by email or on paper from [CONFIRM legal entity name and registered address] · fc@gevitixlab.com.

6. Effective Date and Changes to This Notice

This Notice is effective on the date shown above. We may change its terms at any time; new terms may apply to all PHI we maintain, including information created or received before the change. Updated notices will be posted at gevitixlab.com and are available by contacting fc@gevitixlab.com.

7. Privacy Officer

[CONFIRM Privacy Officer name]
GEVITIX LAB [CONFIRM legal entity name]
[CONFIRM registered address]
fc@gevitixlab.com