Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our Promise to You

Your health information is personal, and protecting it is part of how we support you. This Notice explains, in plain language, how health information is handled when you use Ucardia, how the Health Insurance Portability and Accountability Act (HIPAA) applies, and how to use your rights.

This Notice works together with our Privacy Policy, Consumer Health Data Privacy Policy, and Terms of Service.

How Ucardia Fits In

Ucardia, Inc. ("Ucardia," "we," "us," or "our") is a technology and wellness company. We do not bill health insurance, and we are not a HIPAA "covered entity" ourselves. How HIPAA applies to you depends on how you came to Ucardia.

• Through your doctor, hospital, health system, health plan, or employer health plan. These organizations are covered entities under HIPAA. When we provide the Ucardia app, Continuum, or our Care Team to you on their behalf, Ucardia is their "business associate." Your information is protected health information (PHI), we follow HIPAA and our Business Associate Agreement with that organization, and that organization's own Notice of Privacy Practices applies to you. You can ask them for a copy.
• Through a gym, personal trainer, employer wellness program, or on your own. HIPAA generally does not apply. Your information is still protected under our Privacy Policy, our Consumer Health Data Privacy Policy, and state and federal laws, including the Federal Trade Commission's Health Breach Notification Rule.

How We Use and Share HIPAA Information

When we work for a healthcare organization, we use and share PHI only as our Business Associate Agreement and HIPAA allow, including to:

• Support your care. We provide the app, Continuum, and Care Team services your healthcare organization uses to treat you and coordinate your care. Example: your health coach sees your blood pressure trends so your care team can follow the same plan.
• Support the organization's operations. We help with scheduling, messaging, reminders, documentation, session recordings and transcripts, quality review, and reporting to the organization.
• Use secure technology and AI. We use secure technology, including Arny (our AI coach) and AI tools that transcribe and summarize sessions, draft notes, and highlight trends, within our HIPAA-compliant environment or through service providers who have signed Business Associate Agreements. People remain responsible for your care. Our Privacy Policy describes our AI features in more detail.
• Work with our own service providers. Companies that help us, such as hosting, video sessions, text messaging, and e-prescribing providers, must sign agreements to protect your information and may use it only to help us.
• Create de-identified information. Where our agreement allows, we may remove information that identifies you, following HIPAA's de-identification standard, and, except where prohibited by law or our agreements, use the resulting information for any purpose, including to improve our services, support research, and develop technology. We may also use limited data sets under data use agreements where HIPAA permits.
• Meet legal requirements. We share PHI when the law requires it, including with the U.S. Department of Health and Human Services to show we are complying with HIPAA.

We do not sell PHI, and we do not use PHI for marketing without your written authorization.

Your HIPAA Rights

If HIPAA applies to your information, you have these rights. Because your healthcare organization controls your records, please send requests to them. If you contact us instead, we will forward your request to the organization promptly and help it respond.

• Get a copy of your health records, in paper or electronic form.
• Ask to correct health information you think is incorrect or incomplete.
• Request confidential communications, such as being contacted at a different phone number or address.
• Ask to limit what is used or shared.
• Get a list of certain disclosures of your information.
• Get a copy of your healthcare organization's Notice of Privacy Practices.
• Choose someone to act for you, such as a person with medical power of attorney or a legal guardian.
• File a complaint if you believe your rights were violated, with your healthcare organization, with us, or with the U.S. Department of Health and Human Services Office for Civil Rights at 200 Independence Avenue, S.W., Washington, D.C. 20201, 1-877-696-6775, or www.hhs.gov/ocr/privacy/hipaa/complaints/. No one will retaliate against you for filing a complaint.

Your Rights When HIPAA Does Not Apply

If you use Ucardia through a gym, trainer, employer wellness program, or on your own, you can ask us to access, correct, or delete your information, opt out of marketing, and withdraw consent, as described in our Privacy Policy and Consumer Health Data Privacy Policy. You may also contact the Federal Trade Commission or your state attorney general with concerns.

Text Messages and Email

Standard text messages and email are not encrypted. If you choose to receive health-related reminders or messages by text or email, we will follow your choice. You can opt out of text messages at any time by replying STOP.

If There Is a Breach

If a breach affects your information, we will notify your healthcare organization as our Business Associate Agreement and HIPAA require, and the organization will notify you. If HIPAA does not apply, we will notify you and any required authorities as required by law, including the Federal Trade Commission's Health Breach Notification Rule and state breach laws.

Extra Protections Under Other Laws

Some types of information, such as HIV-related information, genetic information, mental health information, and substance use disorder treatment records, may have extra protection under federal or state law. When a law gives you more protection, we follow that law.

Texas law requires us to tell you that your health information may be disclosed electronically. Except for treatment, payment, health care operations, or as otherwise allowed by law, we will ask for your authorization before each electronic disclosure.

Changes to This Notice

We may change this Notice. The current version will always be available in the Ucardia app and on our website, and we will provide a copy on request.

Contact Us

If you have questions or want help using your rights, please contact our Privacy Officer:

Email: privacy@ucardia.com
Phone: 833-617-1926 (Monday to Friday, 9am to 6pm Central)
Mail: Ucardia, Inc., Attn: Privacy Officer, 1910 Pacific Ave, Suite 2000-1741, Dallas, TX 75201