HIPAA Notice

Revela Holdings, Inc. and its affiliated healthcare providers (collectively, "Revela") are required by law to maintain the privacy of your Protected Health Information ("PHI"), to provide you with this Notice of Privacy Practices ("Notice"), and to abide by the terms of this Notice currently in effect. This Notice explains our legal duties and privacy practices regarding your PHI and describes your rights concerning your health information.

1. How We May Use and Disclose Your Protected Health Information

We may use and disclose your PHI without your written authorization for the following purposes:

Treatment

• We may use and disclose your PHI to provide, coordinate, and manage your healthcare and related services. For example, we may share your medical information with the licensed providers treating you, with compounding pharmacies fulfilling your prescriptions, and with laboratory or diagnostic services if ordered by your Provider.

Payment

• We may use and disclose your PHI to obtain payment for services provided to you. This may include verifying eligibility, processing claims, and communicating with billing and payment processors.

Healthcare Operations

• We may use and disclose your PHI to support our healthcare operations, including quality assessment and improvement activities, provider training and evaluation, business management, compliance activities, and customer service functions.

Other Permitted Uses and Disclosures Without Your Authorization

• As Required by Law: We will disclose your PHI when required to do so by federal, state, or local law.

• Public Health Activities: We may disclose your PHI to public health authorities authorized by law to collect or receive the information for purposes such as preventing or controlling disease, injury, or disability.

• Health Oversight Activities: We may disclose your PHI to federal or state agencies that oversee the healthcare system or government programs.

• Law Enforcement: We may disclose your PHI to law enforcement officials as required or permitted by law.

• Serious Threats to Health or Safety: We may disclose your PHI to prevent or lessen a serious and imminent threat to your health or safety or to the health or safety of another person or the public.

• Workers' Compensation: We may disclose your PHI for workers' compensation or similar programs as authorized by law.

• Judicial and Administrative Proceedings: We may disclose your PHI in response to a court or administrative order, or in response to a valid subpoena or discovery request.

2. Uses and Disclosures Requiring Your Written Authorization

We will not use or disclose your PHI for the following purposes without your written authorization:

• Marketing communications that constitute marketing under HIPAA.

• Sale of your PHI.

• Psychotherapy notes (if applicable).

• Most other uses and disclosures not described in this Notice.

You have the right to revoke any authorization you have given us at any time, except to the extent that we have already acted in reliance on your authorization. To revoke an authorization, please contact us in writing at [email protected].

3. Your Rights Regarding Your Protected Health Information

You have the following rights regarding your PHI:

• Right to Access: You have the right to inspect and obtain a copy of your PHI maintained in a designated record set. We will provide access within 30 days of your request. A reasonable fee may be charged for copies. Requests should be submitted in writing to [email protected].

• Right to an Electronic Copy: If your PHI is maintained electronically, you have the right to request an electronic copy in a format that is readable by you.

• Right to Request Amendment: You have the right to request that we amend your PHI if you believe it is incorrect or incomplete. We may deny your request under certain circumstances. If we deny your request, we will explain the reason in writing.

• Right to an Accounting of Disclosures: You have the right to request an accounting of disclosures of your PHI that we have made for purposes other than treatment, payment, healthcare operations, or those made with your authorization, for the six years prior to your request.

• Right to Request Restrictions: You have the right to request restrictions on how we use or disclose your PHI for treatment, payment, or healthcare operations, or to restrict disclosures to individuals involved in your care. We are not required to agree to your request, but if we do, we will abide by that agreement unless the information is needed for emergency treatment.

• Right to Request Confidential Communications: You have the right to request that we communicate with you about your PHI in a specific way or at a specific location. For example, you may ask that we contact you only by email. We will accommodate reasonable requests.

• Right to a Copy of This Notice: You have the right to receive a paper copy of this Notice upon request.

• Right to Receive Notification of Breaches: You have the right to receive notification in the event of a breach of your unsecured PHI, as required by the HITECH Act.

4. Our Duties

Revela is required by law to:

• Maintain the privacy of your PHI.

• Provide you with this Notice of our legal duties and privacy practices.

• Notify you following a breach of unsecured PHI.

• Abide by the terms of this Notice currently in effect.

5. Changes to This Notice

We reserve the right to change the terms of this Notice. We may make the revised Notice effective for PHI we already maintain about you as well as for PHI we create or receive in the future. We will post a copy of the current Notice on our website and make a copy available upon request. If we make a material change to our privacy practices, we will provide notice to you.

6. How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with Revela or with the Secretary of the U.S. Department of Health and Human Services ("HHS"). To file a complaint with HHS, visit www.hhs.gov/ocr/privacy/hipaa/complaints. To file a complaint with Revela, contact our Privacy Officer:

• Email: [email protected]

• Mailing Address: Privacy Officer, Revela Holdings, Inc., 1309 Coffeen Ave Ste 1200, Sheridan, WY, 82801

We will not retaliate against you for filing a complaint.

7. Contact Our Privacy Officer

For questions about this Notice or to exercise your rights, please contact our Privacy Officer at [email protected] or at the mailing address above.