Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices (this "Notice") describes how MDI Medical Group, P.C., together with its physicians, nurse practitioners, physician assistants, other licensed clinicians, and workforce members (collectively, the "Medical Group," "we," "us," or "our"), may use and disclose your protected health information, the rights you have with respect to that information, and the duties we owe you under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA") and applicable state law. In this Notice, "medical information" means individually identifiable health information that we create, receive, maintain, or transmit in the course of providing care to you, including information about your health conditions, the treatment you receive, and payment for that treatment.

About the Medical Group and Soha. The Medical Group provides telehealth services to patients who access care through the Soha website and related applications (the "Soha Platform"), which are owned and operated by Soha Health LLC ("Soha"). Soha is not a health care provider, does not practice medicine, and does not make clinical decisions about your care. Soha provides technology, administrative, customer support, and related services to the Medical Group under a written agreement that requires Soha to safeguard your medical information and to use and disclose it only as permitted by that agreement and by law. Information you provide to Soha that is not part of your relationship with the Medical Group (for example, information collected when you browse the Soha website before becoming a patient, or marketing preferences you set with Soha) is governed by Soha's Privacy Policy rather than this Notice.

1. Our Obligations

We are required by law to:

• Maintain the privacy and security of your medical information;
• Provide you with this Notice of our legal duties and privacy practices with respect to your medical information;
• Follow the terms of the version of this Notice that is currently in effect;
• Notify you, and where required other parties, following a breach of unsecured medical information, to the extent required by state and federal law; and
• Obtain your written authorization before using or disclosing your medical information for any purpose not described in this Notice, and honor your revocation of that authorization.

2. How We May Use and Disclose Your Medical Information

How we will communicate with you. Because the Medical Group provides care through telehealth, most of your interactions with us will take place electronically through the Soha Platform. With your agreement, we (and Soha acting on our behalf) may contact you by email, text message (SMS), telephone, and in-app or in-platform notifications for purposes such as:

• Collecting the information we need to evaluate and treat you, including your intake questionnaire responses, medical history, answers to follow-up questions, and any photographs or lab results you provide;
• Communicating with you about your evaluation, diagnosis, treatment plan, and prescriptions, and responding to messages you send to your provider;
• Sending visit reminders, follow-up check-ins, and requests to update your health information so that we can continue to treat you safely;
• Providing customer service updates related to your care, such as the status of a prescription, order issues, or delayed shipments;
• Confirming when a prescription has been sent to the pharmacy, has shipped, or is expected to arrive; and
• Informing you about treatment alternatives and other health-related products, services, and benefits that may be of interest to you in connection with your care.

Email and text messages are convenient but are not always secure, and there is some risk that they could be read by an unintended third party. If you would prefer that we communicate with you in a different way, you may make that request as described under "Right to Request Confidential Communications" in Section 4.

Uses and disclosures that do not require your authorization. The categories below describe the ways we typically use and disclose medical information without your written authorization. They are general descriptions and are not intended to list every possible use or disclosure within each category.

• For Treatment. We may use and disclose your medical information to provide, coordinate, and manage your care. For example, when your provider prescribes a medication, we will send your prescription and relevant medical information to the pharmacy that fills it (including compounding pharmacies) so that the pharmacist can dispense your medication safely. We may also disclose your medical information to laboratories, to other physicians or clinicians involved in your care, and to other health care providers with whom you have asked us to coordinate.
• For Payment. We may use and disclose your medical information to bill and collect payment for the services we provide, including through Soha, which processes payments on our behalf. This may include disclosures to a payment processor, to a health plan if you choose to seek reimbursement, or to a third party who is paying for your care. If you pay for an item or service in full out of pocket and ask us not to disclose the related medical information to your health plan, we will honor that request as described in Section 4, unless the disclosure is otherwise required by law.
• For Health Care Operations. We may use and disclose your medical information for activities necessary to run the Medical Group and to ensure that our patients receive quality care. Examples include quality assessment and improvement activities, evaluating the performance of our clinicians, training, licensing and accreditation, business planning and management, legal and audit functions, and general administration.
• Quality Assurance and Utilization Review. We may use and disclose your medical information in our internal processes for evaluating the quality and appropriateness of the care we provide, including reviewing whether the services you receive are appropriate for your condition and diagnosis.
• Credentialing and Peer Review. We may use and disclose your medical information in order to review the qualifications, credentials, and performance of our health care providers.
• Health Information Exchanges. We may participate in one or more health information exchanges ("HIEs") that allow health care providers who are treating you to share medical information securely and electronically. If you do not wish to have your medical information shared through an HIE, you may object in writing by emailing us at legal@joinsoha.com.
• Treatment Alternatives and Health-Related Benefits and Services. We may use your medical information to tell you about treatment options, health-related products or services, and other benefits that we believe may be of interest to you in connection with your care. For example, if your provider believes that a different formulation or delivery method of a prescribed therapy may better suit your needs, we may contact you about it.
• Appointment Reminders. We may use and disclose your medical information to remind you of scheduled visits, follow-up check-ins, and other steps required to continue your treatment, including by leaving a voicemail or sending a text message or email.
• Business Associates and Vendors. Some services are provided to or on behalf of the Medical Group by third parties under contract, including Soha and its service providers, and vendors that provide technology, electronic health record, communications, payment processing, legal, accounting, and similar services. We may disclose your medical information to these business associates so that they can perform the services we have engaged them to perform. Each business associate is required by written agreement to appropriately safeguard your medical information.
• Individuals Involved in Your Care or Payment for Your Care. We may disclose your medical information to a family member, friend, or other person you identify as being involved in your care or in paying for your care, but only as permitted by state and federal law and, where the law requires it, after giving you an opportunity to agree or object.
• As Required by Law. We will disclose your medical information when federal, state, or local law requires us to do so.
• Public Health and Safety. We may disclose your medical information for public health activities, such as reporting adverse reactions to medications or problems with products to the U.S. Food and Drug Administration or a manufacturer, reporting communicable diseases, and reporting suspected abuse or neglect as required by law. We may also disclose medical information when necessary to prevent or lessen a serious and imminent threat to the health or safety of you or another person.
• Health Oversight Activities. We may disclose your medical information to government agencies that oversee the health care system, such as state medical boards and licensing authorities, for activities including audits, investigations, inspections, and licensure.
• Legal Proceedings and Law Enforcement. We may disclose your medical information in response to a court or administrative order, or in some cases in response to a subpoena, discovery request, or other lawful process, subject to the protections required by law. We may also disclose medical information to law enforcement officials in the limited circumstances permitted by law.
• Other Permitted Uses and Disclosures. Subject to applicable legal requirements, we may also use or disclose your medical information (i) to coroners, medical examiners, and funeral directors; (ii) for organ, eye, or tissue donation purposes; (iii) for research that has been approved through a process that protects your privacy, or that uses de-identified or limited data; (iv) to appropriate military authorities if you are a member of the armed forces; (v) for national security and intelligence activities as authorized by law; (vi) to correctional institutions or law enforcement officials having lawful custody of you; and (vii) for workers' compensation or similar programs.
• Electronic Disclosures of Medical Information. The law of certain states requires us to notify you if your medical information is subject to electronic disclosure. This Notice serves as general notice that we may disclose your medical information electronically for treatment, payment, or health care operations, or as otherwise authorized or required by state or federal law.
• De-Identified Information. We may remove identifying information from your medical information so that it can no longer reasonably be used to identify you. Once information has been de-identified in accordance with HIPAA, it is no longer medical information and is not subject to this Notice.

Special protections for certain types of information. Some categories of information receive additional protection under federal or state law, including, depending on where you live, information relating to reproductive and sexual health, mental health, substance use disorder treatment, HIV or other sexually transmitted infection testing, and genetic testing. Where a law that applies to you is more protective of your medical information than HIPAA, we will follow the more protective law, which may mean obtaining your specific written consent before using or disclosing that information even for the purposes described above.

3. Uses and Disclosures That Require Your Written Authorization

• Marketing. With limited exceptions permitted by law (such as a face-to-face communication with your provider or a promotional gift of nominal value), we will not use or disclose your medical information for marketing purposes without your written authorization. Communications about treatment options and about the health-related products and services available to you as a patient of the Medical Group, as described in Section 2, are not considered marketing under HIPAA.
• Sale of Medical Information. We will not sell your medical information without your written authorization. The Medical Group does not sell medical information and does not anticipate doing so.
• Psychotherapy Notes. If a provider ever creates psychotherapy notes about you, most uses and disclosures of those notes require your written authorization. The Medical Group does not anticipate creating psychotherapy notes in the course of the services it provides through the Soha Platform.
• Other Uses and Disclosures. Any use or disclosure of your medical information not described in this Notice will be made only with your written authorization.
• Right to Revoke. If you give us a written authorization, you may revoke it in writing at any time by contacting us as described in Section 7. Once we receive your revocation, we will stop using or disclosing your medical information for the purposes covered by the authorization, except to the extent we have already acted in reliance on it. Revoking an authorization does not affect our obligation to retain records of the care we provided to you.

4. Your Rights Regarding Your Medical Information

You have the following rights with respect to the medical information we maintain about you. To exercise any of these rights, please submit your request in writing to the Medical Group as described in Section 7 of this Notice.

• Right to Inspect and Copy. You have the right to inspect and obtain a copy of the medical information we maintain about you in a "designated record set," which generally includes your medical and billing records. We will respond to your request within the time required by law, generally no later than 30 days after we receive it. If you request a copy, we may charge a reasonable, cost-based fee as permitted by law. If your medical information is maintained electronically and you request an electronic copy, we will provide it in the form and format you request if it is readily producible in that form and format, and otherwise in a readable electronic form and format that we agree on with you. You may also direct us to send a copy of your medical information to another person or entity you designate in a clear, signed, written request. In limited circumstances permitted by law, we may deny your request, in which case we will tell you in writing why your request was denied and how you may request a review of that denial. If a review is available, it will be conducted by a licensed health care professional chosen by the Medical Group who did not participate in the original decision, and we will comply with the outcome of that review.
• Right to Amend. If you believe that medical information we maintain about you is incorrect or incomplete, you may ask us to amend it for as long as we maintain the information. Your request must be in writing and must explain why you believe the information should be amended. We may deny your request if it is not in writing, does not include a reason, or asks us to amend information that (i) was not created by us, unless the person or entity that created it is no longer available to act on the request; (ii) is not part of the medical information we maintain; (iii) is not information you would be permitted to inspect and copy; or (iv) is accurate and complete. If we deny your request, we will tell you in writing and explain how you may submit a statement of disagreement to be included with your record.
• Right to an Accounting of Disclosures. You have the right to receive a list of certain disclosures we have made of your medical information during the six years before the date of your request. This list will not include disclosures made for treatment, payment, or health care operations, disclosures made to you, disclosures made pursuant to your authorization, or certain other disclosures excluded by law. Your request must state the time period you want covered, which may not be longer than six years, and the form in which you would like to receive the list. The first accounting you request in any 12-month period is free. For additional requests within the same period, we may charge a reasonable, cost-based fee, and we will tell you the cost in advance so that you can modify or withdraw your request before any costs are incurred.
• Right to Request Restrictions. You have the right to ask us to limit how we use or disclose your medical information for treatment, payment, or health care operations, and to limit what we disclose to family members or others involved in your care. Your request must be in writing and must specify what information you want limited, whether you want to limit our use, our disclosure, or both, and to whom you want the limits to apply. We are not required to agree to most requested restrictions. If we do agree, we will honor the restriction unless the information is needed to provide you with emergency treatment or we are required by law to disclose it. However, if you or someone on your behalf (other than a health plan) pays for an item or service in full out of pocket and you ask us not to disclose the related medical information to a health plan for payment or health care operations purposes, we must honor that request unless the disclosure is required by law. Please be aware that such a restriction may have unintended consequences, for example if another provider such as a pharmacy needs the information to treat you, and it will be your responsibility to inform other providers of the restriction.
• Right to Request Confidential Communications. You have the right to ask us to communicate with you about medical matters in a particular way or at a particular location, for example only by email to a personal address rather than a work address, or only by telephone rather than text message. Your request must be in writing and must specify how or where you wish to be contacted. We will not ask you the reason for your request, and we will accommodate all reasonable requests.
• Right to Choose Someone to Act for You. If you have given someone a medical power of attorney, or if someone is your legal guardian or otherwise your personal representative under applicable law, that person may exercise your rights and make choices about your medical information. We will confirm the person's authority before taking any action.
• Right to a Copy of This Notice. You have the right to receive a paper copy of this Notice at any time, even if you have previously agreed to receive it electronically. You may also view the current version of this Notice at any time on the Soha Platform.
• Right to Breach Notification. You have the right to be notified if we discover that your unsecured medical information has been accessed, acquired, used, or disclosed in a manner that constitutes a breach under applicable law.

5. Changes to This Notice

We reserve the right to change this Notice and our privacy practices at any time. Any revised Notice will apply to medical information we already maintain about you as well as to information we receive in the future. We will post the current version of this Notice, along with its effective date, on the Soha Platform and make it available in any physical location where the Medical Group provides care. You may request a copy of the current Notice at any time by contacting us as described in Section 7.

6. Complaints

If you believe your privacy rights have been violated, you may file a complaint with the Medical Group by contacting us as described in Section 7. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights, by mail at 200 Independence Avenue, S.W., Washington, D.C. 20201, by phone at 1-800-368-1019, or online at www.hhs.gov/ocr/privacy/hipaa/complaints/. We will not retaliate against you for filing a complaint.

7. How to Contact Us

To exercise any of the rights described in this Notice, to file a complaint, or to ask questions about this Notice or our privacy practices, please contact:

Privacy Officer

MDI Medical Group, P.C.

Email: legal@joinsoha.com

For questions about your care or your account on the Soha Platform, you may also contact patient support at care@joinsoha.com.