Notice of Privacy Practices

Effective date: October 30, 2026

Version 1.0

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

1. Who we are and who this notice covers

This is a joint notice of the independent medical practices in the MyOrbit Health provider network ("we," "us," or "the practices"). These are professional corporations and medical groups that have contracted to provide care through the MyOrbit Health platform. The practice that provides your care is the practice whose licensed provider reviews your intake or sees you. You may contact our Privacy Officer to learn which practice provided your care.

Our providers are physicians, nurse practitioners and physician assistants licensed in your state. Nurse practitioners and physician assistants practice under the supervision or collaboration your state requires.

Joint notice. Each practice in the network has agreed to follow the terms of this notice. The practices may share your health information with each other as needed for treatment, payment and health care operations related to the care provided through the network.

Where we provide care. Care is provided by telehealth: online health questionnaires, secure messaging and secure video visits, delivered to you in the state where you are located and in which the treating provider is licensed. Prescriptions are filled by licensed pharmacies and shipped to you. Lab tests are performed by licensed laboratories.

MyOrbit Health, Inc. provides the technology and administrative services for the practices, including the online forms, checkout, patient portal, messaging and video visits. MyOrbit Health is not a medical practice and does not provide care. It is the practices' business associate. That means it handles your health information on our behalf and must protect it under a written agreement and federal law.

The brand through which you ordered. You may have reached us through the website or app of another company that offers products and services. In this notice we call it "the brand through which you ordered." The brand is not your medical provider and does not make medical decisions. Our providers make those decisions.

This notice applies to all health information that the practices create or receive about you through this service ("health information"). Examples include your contact details, date of birth and shipping address; your answers to health questions; photos and documents you upload; lab results; messages with your care team; visit notes; prescriptions; and order and shipping status.

2. Our duties to you

The law requires us to:

Keep your health information private and secure.
Give you this notice of our legal duties and privacy practices.
Tell you if there is a breach of your unsecured health information.
Follow the terms of the notice that is currently in effect.

We will not use or share your health information in ways other than those described in this notice unless you give us written permission.

Below are the ways we may use and share your health information. When the law requires it, we limit what we use or share to the minimum needed for the purpose. This limit does not apply to sharing for your treatment or sharing with you.

3.1 For your treatment

We use and share your health information to provide and coordinate your care. For example:

A provider reviews your health questionnaire and lab results to decide whether a treatment is right and safe for you.
When a provider prescribes a medication, we send the prescription and the information the pharmacy needs to fill and ship it to the pharmacy that will fill it.
When a provider orders lab tests, we share the information needed to perform the tests with the laboratory, and the laboratory sends the results back to us.
We communicate with you through secure messaging and video visits about your care. We do not record video visits.

3.2 For payment

We use and share health information to bill and collect payment for your care. Payment processors receive only the information needed to process your payment.

3.3 For our health care operations

We use and share health information to run our practices, improve the quality of care, and train and review our providers and staff. For example:

We review records to check the quality of care and to make sure our providers follow the laws of your state.
We use business associates that help us operate, such as MyOrbit Health and technology vendors. Each business associate must protect your information under a written agreement.
Software tools, including artificial intelligence, may help a provider prepare a visit note. The licensed provider caring for you is responsible for your care and for the notes in your record.

3.4 The brand through which you ordered

The brand through which you ordered helps you place, pay for, ship and get support for your order. The brand acts under a written agreement with the provider network and MyOrbit Health. That agreement limits its use of your health information to helping with your order and care, and does not allow the brand to use your health information for its own marketing or to sell it.

To help with your order and care, the brand may receive the minimum information needed for that purpose, such as your name, contact and shipping details, date of birth and sex; the status of your order, appointments and payments; and the name and professional details of your provider. When needed to fulfill or support your order, the brand may also receive information about your prescription, including the diagnosis code on it; the documents you upload for your order, such as identification, photos, prior prescriptions, medical records and lab results; the reason, if a provider decides not to prescribe; and communications with your care team.

The brand may also help you access your account and schedule visits. Any information the brand collects to support your care, such as health questionnaire answers you complete on the brand's own website or app, is handled on behalf of the practices under that written agreement.

Apart from what is described above, the brand does not receive your health questionnaire answers or your provider's clinical notes.

Information the brand collects on its own website for its own purposes, such as browsing data, is covered by the brand's own privacy policy, not this notice.

3.5 Contacting you

We may email you about your account, orders, shipping, appointments, refills, results that are ready to view, and requests for documents. Emails may be sent under the name of the brand through which you ordered. We limit the health information included in emails; however, an email may indicate the type of service you ordered. Ordinary email is not encrypted. You can view full details in your patient portal. We may also contact you by phone when your care requires it.

You can opt out of non-essential emails at any time. Messages needed for your care, your orders and your account will still be sent.

We will send you text messages only if you have agreed to receive them. Message and data rates may apply, and you can opt out at any time.

3.6 People involved in your care

If you agree, or if you are present and do not object, we may share information with a family member, friend or other person you name who is involved in your care or in paying for it. If you are not able to agree, for example in an emergency, we may share information if we believe it is in your best interest. We may also share information with disaster relief organizations so your family can be told where you are and how you are.

4. Other uses and sharing allowed or required by law

The law allows us, and sometimes requires us, to share your health information without your written permission in the situations below. We must meet the conditions the law sets before we share.

When required by law. When a federal, state or local law requires it.
Public health and safety. To prevent or control disease, injury or disability; to report adverse reactions or problems with medications or products to the U.S. Food and Drug Administration or a manufacturer; to report recalls; and to notify a person who may have been exposed to a disease.
Abuse, neglect or domestic violence. To a government agency if we believe you are a victim of abuse, neglect or domestic violence. We will share only as the law allows and will usually tell you.
Health oversight. To agencies that oversee health care, such as for audits, investigations, inspections and licensing.
Lawsuits and legal disputes. In response to a court or administrative order. We may also share information in response to a subpoena or other legal request, but only if efforts have been made to tell you about the request or to obtain an order protecting the information.
Law enforcement. For limited law enforcement purposes, such as responding to a court order or warrant, identifying a suspect or missing person, or reporting a crime.
Prescription drug monitoring. For controlled substances, our providers check your state's prescription drug monitoring program where required, and the pharmacy that fills your prescription reports it to the state as required.
Coroners, medical examiners and funeral directors. So they can carry out their duties.
Organ and tissue donation. To organizations that handle organ, eye or tissue donation and transplant.
Research. For research, if a review board approves it and the law's privacy protections are met.
Serious threat to health or safety. To prevent or lessen a serious and imminent threat to your health or safety or the health or safety of others.
Special government functions. For military and veterans' activities as required by military authorities, for national security and intelligence activities, and for protective services for the President and others.
People in custody. To a correctional institution or law enforcement official that has custody of you, as needed for your care, health or safety, or the safety of others.
Workers' compensation. For workers' compensation or similar programs that provide benefits for work-related injuries or illness.
Business associates. To business associates that perform services for us, each bound by a written agreement to protect your information.
The U.S. Department of Health and Human Services. When the Secretary is checking that we comply with federal privacy law.

Substance use disorder treatment records

If we receive records from a federally assisted substance use disorder treatment program, those records have extra protection under federal law (42 CFR Part 2). We will not use or share them in any civil, criminal, administrative or legislative investigation or proceeding against you unless you give written consent or a court orders it after giving you notice and an opportunity to be heard.

5. Uses that need your written permission

We will ask for your written permission (an "authorization") before we:

Share psychotherapy notes. Most uses and sharing of psychotherapy notes, if we have any, need your permission.
Use your information for marketing. We will not use or share your health information to market products or services to you without your permission, except for face-to-face communications with you or promotional gifts of nominal value, as the law allows.
Sell your information. We do not sell your health information.
Use or share it for any other purpose not described in this notice.

We do not use your health information for fundraising.

You can change your mind. If you give us permission, you can take it back (revoke it) at any time by writing to our Privacy Officer at the address in Section 9. Revoking stops future uses and sharing. It does not undo anything we already did while we had your permission.

6. State law

Where a state law protects your health information more than federal law does, for example in California, Texas, Washington and New York, the practices follow the stricter law. Some federal and state laws give extra protection to information about HIV and other sexually transmitted infections, mental health, substance use, genetic testing and reproductive health. Where those laws require it, we will get your written permission before sharing that information, or share it only as those laws allow.

7. Your rights

You have the rights below. To use any of them, contact our Privacy Officer using the information in Section 9. Please make your request in writing. Email is fine.

7.1 Get a copy of your health information

You can ask to see or get a copy of your health records and other health information we have about you, on paper or electronically. You can also ask us to send it to a person you choose.

You may be able to view much of your health information in your patient portal, and you can request a copy of your complete record.
We will respond within 30 days, or sooner if your state's law requires. If we need more time, we may extend this once by up to 30 days and will tell you in writing why.
We may charge a reasonable, cost-based fee for copies.
In limited cases we may deny your request. If we do, we will tell you why in writing and explain any right you have to have the denial reviewed.

7.2 Ask us to correct your health information

If you think health information we have about you is wrong or incomplete, you can ask us to correct (amend) it. Tell us what is wrong and why.

We will respond within 60 days. If we need more time, we may extend this once by up to 30 days and will tell you in writing why.
We may say no, for example if we did not create the information or if we believe it is accurate and complete. If we say no, we will tell you why in writing. You can then send us a statement of disagreement, which we will add to your record.

7.3 Ask us to limit what we use or share

You can ask us not to use or share certain health information for treatment, payment or health care operations. You can also ask us to limit what we share with people involved in your care.

We are not required to agree, and we may say no if it would affect your care. If we agree, we will follow your request except in an emergency.
If you pay for a service or item in full out of your own pocket, you can ask us not to share information about it with your health insurer for payment or health care operations. We will say yes unless a law requires us to share it.

7.4 Ask for confidential communications

You can ask us to contact you in a certain way (for example, only at a certain email address) or at a certain place (for example, a different mailing address). We will say yes to all reasonable requests. We will not ask you why.

7.5 Get a list of those with whom we shared your information

You can ask for a list (an "accounting") of the times we shared your health information in the six years before your request, who we shared it with, and why.

The list will not include sharing for treatment, payment or health care operations, sharing you asked for or gave permission for, and certain other sharing the law excludes.
We will provide one list a year for free. If you ask for another within 12 months, we may charge a reasonable, cost-based fee. We will tell you the fee first, and you can change or withdraw your request.

7.6 Get a paper copy of this notice

You can ask for a paper copy of this notice at any time, even if you agreed to receive it electronically. We will send it to you promptly.

7.7 Choose someone to act for you

If you have given someone medical power of attorney, or if someone is your legal guardian or another person the law recognizes as your personal representative (for example, the executor of your estate), that person can exercise your rights and make choices about your health information. We will confirm that the person has this authority before we act.

7.8 Be told about a breach

We will notify you if a breach occurs that may have compromised the privacy or security of your health information, as the law requires.

8. Changes to this notice

We may change the terms of this notice, and the changes will apply to all health information we have about you, including information we had before the change. If we make a material change, the new notice will be posted on our website and in your patient portal, with its effective date at the top, and it will be available from our Privacy Officer on request.

9. Questions and complaints

Contact our Privacy Officer to exercise your rights, ask a question or make a complaint:

Privacy Officer, MyOrbit Health provider network
Mail: Privacy Officer, MyOrbit Health provider network, c/o MyOrbit Health, Inc., 3524 Silverside Road, Suite 35B, Wilmington, DE 19810-4929
Email: hello@myorbithealth.com
Phone: (951) 329-2195

For questions about an order, shipping or billing, you can also email hello@myorbithealth.com or contact the brand through which you ordered.

If you believe your privacy rights have been violated, you can file a complaint:

With us, by contacting our Privacy Officer above.
With the U.S. Department of Health and Human Services, Office for Civil Rights, online at https://www.hhs.gov/ocr/complaints, by phone at 1-877-696-6775, or by mail to Centralized Case Management Operations, U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Room 509F HHH Bldg., Washington, D.C. 20201.

We will not retaliate against you for filing a complaint.

10. Emergencies

This service is not for emergencies. If you have a medical emergency, call 911 or go to the nearest emergency room. If you are in a mental health crisis, call or text 988.

You may also wish to read the Telehealth Informed Consent and the Refund Policy.

Effective date of this notice: October 30, 2026. Version 1.0.