Notice of Privacy Practices

This Notice of Privacy Practices applies to Protected Health Information ("PHI") created or maintained by Wellday Medical Affiliates — the licensed clinicians and clinical entities that contract with Wellday to provide medical care to patients on the Wellday platform.

Wellday Medical Affiliates and Wellday Health LLC operate together as an Organized Health Care Arrangement under HIPAA. Wellday Medical Affiliates are HIPAA covered entities. Wellday Health LLC operates as a Business Associate, providing technology and operational services that support the delivery of your care under HIPAA-required Business Associate Agreements.

This Notice describes how Wellday Medical Affiliates may use and share your PHI, and how you can exercise your rights regarding it.

Wellday Medical Affiliates are required by law to:

• Maintain the privacy and security of your PHI
• Provide you with this Notice
• Notify you if a breach of unsecured PHI occurs
• Follow the terms of the Notice currently in effect

For treatment: To provide healthcare services to you. For example, your clinician may share your migraine history with a pharmacist filling your prescription.

For payment: To receive payment and coordinate insurance, prior authorization, and savings card programs.

For healthcare operations: Quality assessment, care coordination, training, and business management.

With your written authorization: For uses beyond treatment, payment, and healthcare operations — including marketing, sale of PHI, or most uses of psychotherapy notes. You can revoke authorization in writing anytime, except for actions already taken.

Without your authorization (where permitted by law):

• Public health activities (communicable disease reporting, FDA-regulated product issues)
• Health oversight (audits, investigations by regulators)
• Legal proceedings (court orders, subpoenas)
• Law enforcement (subpoenas, certain investigations)
• Serious threats to safety
• Workers' compensation
• Research with IRB approval
• National security purposes
• Coroners and funeral directors

To people involved in your care: With your verbal agreement, we may share PHI with family members or others involved in your care.

Sharing with the Wellday platform: Wellday Medical Affiliates share your PHI with Wellday Health LLC (operating as a Business Associate) to enable the technology and operational support that make your care possible. This is governed by Business Associate Agreements requiring Wellday to protect your PHI to HIPAA standards.

Right to access: Request a copy of your medical records. Submit requests to privacy@welldayhealth.com.

Right to amend: Request corrections to records you believe are incorrect. We may deny requests in certain circumstances; if so, we'll explain in writing.

Right to an accounting of disclosures: Request a list of certain disclosures of your PHI in the past 6 years.

Right to request restrictions: Request limits on how we use or share your PHI. We must agree if you ask us not to share PHI with your health plan for services you paid for in full out-of-pocket.

Right to confidential communications: Request specific communication methods (email but not phone, for example). We'll accommodate reasonable requests.

Right to a paper copy: Available on request, even if you've received electronic versions.

Right to file a complaint: With us at privacy@welldayhealth.com, or with the U.S. Department of Health and Human Services Office for Civil Rights at hhs.gov/hipaa/filing-a-complaint or 1-877-696-6775. We will not retaliate against you for filing.

We may change this Notice. The new Notice will apply to all PHI we maintain. We'll post updates on the Wellday website and make paper copies available on request.

Wellday Privacy Officer Wellday Medical Affiliates privacy@welldayhealth.com