Notice of Privacy Practices

Effective Date: January 15, 2026  |  Last Updated: January 15, 2026

This Notice of Privacy Practices ("Notice") is provided by Linux Health, Inc. ("Linux Health," "we," "us," or "our") in compliance with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and the Health Information Technology for Economic and Clinical Health Act ("HITECH Act"). This Notice applies to all protected health information ("PHI") created, received, maintained, or transmitted by Linux Health in connection with the healthcare services we provide.

1. Our Commitment to Your Privacy

Linux Health is committed to maintaining the privacy and confidentiality of your protected health information. We are required by law to:

• Maintain the privacy of your PHI as required by federal and state laws
• Provide you with this Notice of our legal duties and privacy practices with respect to your PHI
• Notify you following a breach of your unsecured PHI
• Follow the terms of this Notice currently in effect
• Obtain your written authorization before using or disclosing your PHI for purposes other than those described in this Notice

We reserve the right to change the terms of this Notice and to make the new provisions effective for all PHI we maintain. If we make a material change to this Notice, we will post the revised Notice on our website and notify you through your account.

2. Uses and Disclosures of Your Protected Health Information

We may use and disclose your PHI without your authorization for the following purposes:

2.1 Treatment

We may use or disclose your PHI to provide, coordinate, or manage your healthcare and related services. This includes:

• Sharing information among healthcare providers involved in your care, including physicians, nurses, and other clinical staff within our network
• Transmitting prescription information to pharmacies for medication dispensing and delivery
• Coordinating and managing your treatment plan, including dosage adjustments and follow-up care
• Communicating with you regarding your treatment, including appointment reminders, medication instructions, and health updates
• Referring you to other healthcare providers or specialists when clinically appropriate

2.2 Payment

We may use or disclose your PHI to obtain payment for healthcare services provided to you. This includes:

• Billing and collecting payment from you or your payment method on file
• Verifying payment authorization and processing transactions
• Activities related to determining eligibility and medical necessity

2.3 Healthcare Operations

We may use or disclose your PHI for our healthcare operations, which are necessary for us to run our practice and ensure quality care. This includes:

• Quality assessment and improvement activities
• Reviewing the competence and qualifications of healthcare providers
• Conducting clinical training programs and credentialing activities
• Medical review, compliance programs, and auditing functions
• Business planning, development, and general administrative activities
• Customer service and resolution of internal grievances
• Conducting or arranging for legal services, including fraud and abuse detection

2.4 Required by Law

We may use or disclose your PHI when required to do so by federal, state, or local law. This includes:

• Court orders, subpoenas, or other legal process
• Administrative requests from government agencies
• Reporting to public health authorities for disease prevention or control
• Reporting suspected abuse, neglect, or domestic violence to appropriate government authorities
• Disclosures to the Food and Drug Administration (FDA) regarding adverse events or product defects
• Reporting to health oversight agencies for audits, investigations, and inspections
• Disclosures for law enforcement purposes, including to identify or locate a suspect, witness, or missing person
• Disclosures to coroners, medical examiners, and funeral directors
• Disclosures necessary to avert a serious threat to health or safety
• Disclosures for specialized government functions, including military and veterans' activities
• Disclosures related to workers' compensation programs

2.5 De-identified Information

We may use or disclose your health information after it has been de-identified in accordance with HIPAA standards. De-identified information cannot reasonably be used to identify you and is not subject to the protections of this Notice.

2.6 Business Associates

We may disclose your PHI to our business associates who perform functions on our behalf or provide services to us, provided that they agree in writing to protect the privacy and security of your PHI. Our business associates include, but are not limited to, technology service providers, cloud hosting providers, payment processors, and pharmacy fulfillment partners.

2.7 Authorizations

For any use or disclosure of your PHI not described in this Notice, we will obtain your written authorization before using or disclosing your PHI. You may revoke any authorization you provide at any time by submitting a written request to us, except to the extent that we have already taken action in reliance on your authorization.

The following uses and disclosures require your specific written authorization:

• Marketing communications (except face-to-face communications and promotional gifts of nominal value)
• Sale of your PHI
• Most uses and disclosures of psychotherapy notes (if applicable)
• Any other uses and disclosures not described in this Notice

3. Your Rights Regarding Your Protected Health Information

You have the following rights with respect to your PHI. To exercise any of these rights, please submit a written request to our Privacy Officer using the contact information provided in Section 5.

3.1 Right to Access

You have the right to inspect and obtain a copy of your PHI maintained by us, including medical records, billing records, and other records used to make decisions about your care. We will provide your requested information within 30 days of receiving your written request. We may charge a reasonable, cost-based fee for copying, mailing, or other supplies associated with your request. In certain limited circumstances, we may deny your request for access. If we deny your request, we will provide you with a written explanation and inform you of your right to have the denial reviewed.

3.2 Right to Amendment

You have the right to request that we amend your PHI if you believe it is inaccurate or incomplete. Your request must be in writing and must include the reason for the requested amendment. We will respond to your request within 60 days. We may deny your request if the information:

• Was not created by us
• Is not part of the records we maintain
• Is not available for inspection (e.g., certain legal exceptions apply)
• Is accurate and complete as determined by us

If we deny your request, we will provide you with a written explanation. You have the right to submit a written statement of disagreement, which we will include in your records.

3.3 Right to an Accounting of Disclosures

You have the right to request an accounting of certain disclosures of your PHI that we have made during the six (6) years prior to your request (or a shorter period if you specify). This accounting will include disclosures made for purposes other than treatment, payment, healthcare operations, and certain other exceptions. Your first request within a 12-month period will be provided free of charge. For additional requests within the same period, we may charge a reasonable, cost-based fee.

3.4 Right to Request Restrictions

You have the right to request restrictions on certain uses and disclosures of your PHI for treatment, payment, or healthcare operations. You also have the right to request restrictions on disclosures to individuals involved in your care or the payment for your care. We are not required to agree to your request, except that we must comply with a request to restrict disclosures to a health plan if:

• The disclosure is for payment or healthcare operations and is not otherwise required by law
• The PHI pertains solely to a healthcare item or service for which you have paid us in full out of pocket

3.5 Right to Confidential Communications

You have the right to request that we communicate with you about your health information in a particular way or at a certain location. For example, you may request that we contact you only by email or only at a specific phone number. We will accommodate reasonable requests and will not ask you for the reason for your request.

3.6 Right to a Copy of This Notice

You have the right to obtain a paper copy of this Notice upon request, even if you have previously agreed to receive this Notice electronically.

3.7 Right to File a Complaint

If you believe your privacy rights have been violated, you have the right to file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint.

• File with Linux Health: Contact our Privacy Officer using the information in Section 5
• File with HHS: U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue, S.W., Washington, D.C. 20201. You may also file a complaint online at hhs.gov/ocr/complaints or by calling 1-877-696-6775.

4. Our Responsibilities

Linux Health is required to:

• Maintain the privacy and security of your PHI using appropriate administrative, technical, and physical safeguards
• Provide you with this Notice describing our privacy practices, duties, and your rights regarding your PHI
• Abide by the terms of this Notice currently in effect
• Notify you if we are unable to agree to a requested restriction on how we use or disclose your PHI
• Accommodate reasonable requests to communicate with you by alternative means or at alternative locations
• Notify you in the event of a breach of your unsecured PHI, in accordance with applicable breach notification requirements
• Use or disclose the minimum necessary amount of PHI to accomplish the intended purpose of the use or disclosure
• Obtain your written authorization before using your PHI for marketing purposes or before selling your PHI

5. Contact Information

If you have questions about this Notice, wish to exercise any of your rights, or want to file a complaint, please contact our Privacy Officer:

• Privacy Officer: Linux Health Privacy Office
• Email: privacy@linuxhealth.com
• Mail: Linux Health, Inc., Attn: Privacy Officer, 251 Little Falls Drive, Wilmington, DE 19808
• Phone: 1-800-LINUX-RX (1-800-546-8979)

All complaints and inquiries will be investigated promptly. You will not be penalized or retaliated against for filing a complaint or exercising your rights under HIPAA.

6. Changes to This Notice

We reserve the right to change this Notice at any time. Any revised Notice will be effective for all PHI we maintain at the time of the change. We will make the revised Notice available on our website and through your patient portal. If we make material changes, we will provide notice through your account or by other means as required by law.