Notice of Privacy Practices

NOTICE OF PRIVACY PRACTICES

Effective Date: June 10, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

[Drafting note: This Notice is to be issued by the covered entity. Confirm whether MedGrid acts as a covered entity for any patient-facing function or solely as a business associate. If MedGrid is solely a business associate, this Notice is provided as a template for the physician or clinic covered entities, and the covered entity name should replace references to "we" and "the Practice." If MedGrid acts as a covered entity for a given function, MedGrid issues this Notice for that function.]

We are required by law to maintain the privacy of your protected health information ("PHI"), to provide you this Notice of our legal duties and privacy practices, to follow the terms of the Notice currently in effect, and to notify you following a breach of unsecured PHI. We reserve the right to change this Notice and to make the revised Notice effective for PHI we already have, as well as any information we receive in the future.

2. How We May Use and Disclose Your PHI

We may use and disclose your PHI without your authorization for the following purposes:

• Treatment: to provide, coordinate, or manage your health care and related services, including sharing PHI with other providers involved in your care.
• Payment: to obtain payment for services, including billing and collection.
• Health Care Operations: for activities necessary to operate, including quality assessment, care coordination, and administrative functions.
• Business Associates: to vendors that perform functions on our behalf under a written business associate agreement, including the MedGrid platform.
• As Required by Law and for Public Health and Safety: including reporting required by law, public health activities, oversight, judicial and law-enforcement purposes, and to avert a serious threat to health or safety, in each case as permitted by 45 C.F.R. Part 164.

3. Uses and Disclosures Requiring Your Authorization

Most uses and disclosures of psychotherapy notes, uses and disclosures for marketing, and any sale of PHI require your written authorization. Other uses and disclosures not described in this Notice will be made only with your written authorization, which you may revoke at any time, in writing, except to the extent we have already acted in reliance on it.

4. Your Rights

You have the right to:

• Inspect and obtain a copy of your PHI in a designated record set, subject to limited exceptions, under 45 C.F.R. Section 164.524.
• Request an amendment of your PHI under 45 C.F.R. Section 164.526.
• Receive an accounting of certain disclosures of your PHI under 45 C.F.R. Section 164.528.
• Request restrictions on certain uses and disclosures, and to request that we restrict disclosure to a health plan for services you paid for in full out of pocket.
• Request to receive communications by alternative means or at an alternative location.
• Receive a paper copy of this Notice on request, and to be notified following a breach of your unsecured PHI.

5. Complaints and Contact

If you believe your privacy rights have been violated, you may file a complaint with us using the contact information below, or with the Secretary of the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint.

the physician, practice, or clinic identified in the applicable Business Associate Agreement

MedGrid, LLC, 1691 Michigan Ave, Ste 360, Miami, Florida, USA

the MedGrid Privacy Officer at privacy@medgrid.com