Notice of Privacy Practices

RETA MD is required by law to: • Maintain the privacy and security of your protected health information (PHI) • Provide you with this Notice of our legal duties and privacy practices regarding your PHI • Notify you following a breach of your unsecured PHI • Follow the terms of this Notice currently in effect • Abide by all applicable federal and state health information privacy laws We reserve the right to change the terms of this Notice and to make the new Notice provisions effective for all PHI that we maintain. If we make a material change to this Notice, we will post the revised Notice on our website and make it available upon request.

We may use and disclose your protected health information for the following purposes: For Treatment: We may use and disclose your PHI to provide, coordinate, or manage your healthcare. For example, sharing information with your prescribing physician, consulting specialists, or transmitting prescription information to our partner pharmacy. For Payment: We may use and disclose your PHI for billing and payment activities. This includes verifying payment information, processing credit card transactions, and coordinating HSA/FSA eligibility. For Healthcare Operations: We may use and disclose your PHI for our healthcare operations, including quality improvement, staff training, compliance programs, and auditing functions. As Required by Law: We will disclose your PHI when required to do so by federal, state, or local law. Public Health Activities: We may disclose PHI for public health activities including reporting adverse events, product defects, or to notify individuals of recalls. Health Oversight: We may disclose PHI to health oversight agencies for audits, investigations, inspections, and licensure activities. Judicial & Administrative Proceedings: We may disclose PHI in response to a court order, subpoena, or other lawful process. Law Enforcement: We may disclose PHI to law enforcement officials as required by law or in response to a valid legal process. To Avert Serious Threat: We may use and disclose PHI when necessary to prevent a serious threat to your health and safety or the health and safety of the public.

The following uses and disclosures of your PHI require your written authorization: • Marketing purposes (except for face-to-face communications and promotional gifts of nominal value) • Sale of your PHI • Most uses of psychotherapy notes (if applicable) • Other uses and disclosures not described in this Notice You may revoke your authorization at any time in writing. Revocation will not affect any actions we took in reliance on your authorization before receiving your revocation.

You have the following rights regarding your protected health information: Right to Inspect and Copy: You have the right to inspect and obtain a copy of your PHI maintained by us. Requests must be made in writing. We may charge a reasonable fee for copying costs. Right to Amend: You have the right to request that we amend your PHI if you believe it is inaccurate or incomplete. Requests must be made in writing with a reason for the amendment. We may deny the request in certain circumstances. Right to an Accounting of Disclosures: You have the right to request a list of certain disclosures we have made of your PHI. The first request in a 12-month period is free; subsequent requests may incur a fee. Right to Request Restrictions: You have the right to request restrictions on how we use or disclose your PHI for treatment, payment, or healthcare operations. Right to Request Confidential Communications: You have the right to request that we communicate with you about your health information through a particular means or at a certain location. Right to a Paper Copy: You have the right to obtain a paper copy of this Notice upon request. Right to Be Notified of a Breach: You have the right to be notified if there is a breach of your unsecured PHI.

If you believe that your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint. To file a complaint with RETA MD: Privacy Officer RETA MD, Reta MD Holdings LLC 9201 W Sunset Blvd, Suite 912 Los Angeles, CA 90069 Email: privacy@retamd.com To file a complaint with the U.S. Department of Health and Human Services: Office for Civil Rights https://www.hhs.gov/hipaa/filing-a-complaint/index.html

For questions about this Notice or to exercise any of your rights, contact: Privacy Officer RETA MD, Reta MD Holdings LLC 9201 W Sunset Blvd, Suite 912 Los Angeles, CA 90069 Email: privacy@retamd.com Business Hours: Monday to Friday, 9:00 AM to 5:00 PM PST