United Concierge Medicine of Colorado, PLLC (together with its subsidiaries, affiliates, and entities under common ownership/control, “United Concierge”) Effective Date: August 22, 2022 THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. If you have any questions about this notice, please contact our Compliance Department, whose contact information is set forth at the very end of this notice. Terms used, but not defined, in this notice have the meanings set forth in the Federal HIPAA statute and regulations.

WHO WILL FOLLOW THIS NOTICE

This notice describes United Concierge’s privacy practices and that of the following:

• Any health care professional authorized to enter information into your United Concierge chart.
• All departments, units, facilities, and site locations of United Concierge, which may share medical information with each other for treatment, payment or health care operations, and any other purposes described in this notice and/or allowed by applicable law.
• All employees, staff, and other United Concierge personnel.

OUR PRIVACY OBLIGATIONS REGARDING MEDICAL INFORMATION

United Concierge understands that medical information about you is personal, and United Concierge is committed to protecting this information and keeping it private. United Concierge creates a record of your information and information regarding the care and services you receive from United Concierge. United Concierge needs this record to provide you with quality care and to comply with certain legal requirements. This notice applies to such record, as well as all of the medical information, known as “protected health information” or “PHI,” which United Concierge creates or receives from another health care provider. PHI includes information created or received by United Concierge, which can be used to identify you and relates to your past, present, or future health or condition, the provision of health care to you, or payment for the health care. We are required by law to protect the privacy of this information. Be aware, however, that your other health care providers may have different policies or notices regarding their use and sharing of your medical information that they create or maintain. This notice will tell you about the ways United Concierge may use and share your medical information. This notice also describes your rights and certain obligations United Concierge has regarding the use and sharing of medical information. United Concierge may be required by law to do any of the following:

• Make sure that medical information that identifies you is kept private (with certain limited exceptions) and secure.
• Adhere to the duties and privacy practices described in this notice, and give you a copy of it.
• If medical information is used or disclosed in violation of HIPAA, notify you promptly if the use/disclosure is a “Breach of Unsecured Protected Health Information” (as defined by the Federal HIPAA Law), and also notify you pursuant to any state law that may apply.

United Concierge is committed to your medical information’s privacy, and in any event will not use or disclose your medical information in any manner that is contrary to applicable law or regulation.

HOW WE MAY USE AND SHARE YOUR MEDICAL INFORMATION

The following categories describe the types of uses or disclosures of your medical information we are authorized to make. Not every specific use or disclosure within a category will be listed. However, all of the ways we are permitted to use and disclose information will fall within one of the categories. In many of the instances described below, we will have to meet additional conditions before we can use or share your information for the purposes described. Any other uses and disclosures not described in this notice will not be made without your authorization. HIGHLY SENSITIVE INFORMATION: SPECIAL AUTHORIZATION MAY BE REQUIRED In some circumstances, your health information may be subject to restrictions that limit or preclude some uses or disclosures described in this notice. Our records may contain information regarding your mental health, substance abuse, pregnancy, sexually transmitted diseases, psychotherapy, HIV/AIDS/ARC or other types of sensitive health information. Records of these types may be protected by additional restrictions under state and federal law, which we will comply with. United Concierge will obtain your general consent with regard to many of the categories discussed in this notice, even though HIPAA may not require United Concierge to obtain such consent. Government health benefit programs, such as state Medicaid programs, may also limit the sharing of beneficiary information for purposes unrelated to the applicable program. DISCLOSURES THAT GENERALLY REQUIRE AUTHORIZATION (PSYCHOTHERAPY NOTES, MARKETING, AND SALE) Under HIPAA, there are some circumstances where we can only use and share medical information if you have signed a HIPAA authorization form or otherwise given us written permission. For instance, your authorization is required for most uses and disclosures of your medical information involving psychotherapy notes (we may or may not maintain “psychotherapy notes”). In most cases, United Concierge does not have psychotherapy notes as defined by HIPAA. Please note, however, psychotherapy notes are narrowly defined under HIPAA and do not include all mental health care records. We may use and/or share medical information for marketing or sales purposes in accordance with HIPAA and state law. Your authorization is required for most uses and sharing of your medical information for “marketing” purposes, including subsidized treatment communications, or for disclosures that constitute the “sale” of protected health information. Please be aware, however, that HIPAA’s definitions of “marketing” and “sales,” and the restrictions related thereto, are technical, include exceptions (examples include, but are not limited to, face-to-face communications to you about a product, to provide refill reminders, research purposes, and the sale, transfer, merger or consolidation of all or part of United Concierge), and do not apply to all situations that you may personally consider to be marketing or sales.

FOR TREATMENT

We may use and share medical information about you to provide you with health care treatment or related items and services (including for care coordination purposes). United Concierge may share medical information about you with doctors, nurses, assistants, technicians, medical students, or other personnel who are involved in taking care of you. United Concierge also may share medical information about you with people outside of United Concierge who may be involved in your medical care. For example, we may share your medical information with an outside doctor who is treating you for an injury and asks a United Concierge doctor about your overall health condition or a particular test result, or we may share medical information about you with third-parties who use United Concierge’s platform to deliver their own products or services to you, in order to coordinate the different things you need from us. Additionally, we may share your medical information with physicians and other health care providers as a member of an Accountable Care Organization (“ACO”), Regional Health Information Organization (“RHIO”) or other Health Information Exchange (“HIE”). In some (but not all) cases, there may be an “opt out” right or other rights particular to an ACO, RHIO or HIE – please contact our Compliance Department if you want more information on what rights you may have.

FOR PAYMENT

We may use and share medical information about you so that the treatment and services you receive from United Concierge may be billed to, and payment may be collected from, either you, an insurance company, or a third party. United Concierge may also share your medical information with another health care provider or payor of health care for the payment activities of that entity. For example, we may need to give your health plan information about a service you received from us so your health plan will pay us or reimburse you for the service. We may also tell your health plan about a treatment you are going to receive to obtain prior approval, referrals, or to determine whether your plan will cover the treatment. We may also provide basic information about you and your health plan, insurance company, or other source of payment to practitioners outside United Concierge who are involved in your care, to assist them in obtaining payment for products and services they provide to you through United Concierge’s platform. United Concierge may also need to use and share your medical information in various appeals processes to defend the necessity of services offered in the past, and to pursue collections actions for services we have rendered to you. If you do not want us to share medical information about you with your health plan, you have the right to pay out-of-pocket for all services and care, and to inform us that you wish to restrict the information shared with your health plan. For more information, see your rights listed below.

FOR HEALTH CARE OPERATIONS

United Concierge may use and share your medical information for health care operations. These uses and disclosures are necessary to run United Concierge and make sure that all of our patients receive competent, quality health care, and to maintain and improve the quality of health care that United Concierge provides. For example, United Concierge may use medical information to review our treatment and services and to evaluate the performance of our staff in caring for you. United Concierge may also combine medical information about many United Concierge patients to evaluate the effectiveness of new treatments, and decide what additional services United Concierge should offer and what services are not needed. United Concierge may additionally provide your medical information to governmental or accreditation entities to maintain any license(s) and/or accreditations we may have.

TO INDIVIDUALS INVOLVED IN YOUR CARE OR PAYMENT FOR YOUR CARE (AND YOUR OPPORTUNITY TO OBJECT)

We may release medical information about you to someone who is involved in, or helps pay for, your care, unless you object, in whole or in part, in writing. Unless there is a specific written request/objection from you to the contrary, we are also permitted under HIPAA, in limited circumstances, to tell your family or friends about your condition and that you are a patient of United Concierge. In addition, to the extent applicable, United Concierge may share certain medical information about you with an entity assisting in a disaster relief effort so that your family can be notified about your condition, status, or location. If you arrive at a United Concierge facility either unconscious or otherwise unable to communicate, we may go ahead and share your information if we believe it is in your best interests.

TO COMPLY WITH THE LAW

We will share medical information about you when required to do so by federal, state, or local law, including with the federal Department of Health and Human Services if it wants to see that we’re complying with federal privacy laws.

MISCELLANEOUS

We may in certain circumstances, and only if allowed by applicable law, use and share medical information about you when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. We may disclose/share information when requested by you, which may require a separate written authorization from you. Any such authorizations that you give can be revoked at any time. Under certain circumstances, we are permitted to use and share medical information about you for research purposes. In some situations, your authorization is required in connection with research uses and disclosures. We may inadvertently use or share your medical information when such use or disclosure is incident to another use or disclosure that is permitted or required by law. Please be assured, however, that as much as possible, United Concierge has appropriate safeguards in place to avoid such situations. We are permitted to use or share certain parts of your medical information, called a “limited data set,” for purposes of research, public health reasons or for our health care operations, subject to certain conditions. United Concierge may use or share your medical information to create information that does not identify you. Once de-identified, your information can be used or shared in any way permitted by law. We may share medical information with covered entities participating in any organized health care arrangement in which we participate, as necessary to carry out treatment, payment, or health care operations relating to the organized health care arrangement. We may also share your medical information with third parties (sometimes called business associates) who perform services on United Concierge’s behalf. If we share your information with these entities, we will have a written agreement with them to safeguard your information. We can share medical information with organizations that handle organ procurement, transplantations, or organ donation banks. In certain circumstances, we may share medical information about you in the course of judicial or administrative proceedings in response to a court or administrative order, or a subpoena, discovery request, or other lawful process. We may release medical information to a coroner, medical examiner, or funeral director when an individual dies. United Concierge may share health information with a multidisciplinary personnel team relevant to the prevention, identification, management or treatment of an abused child and the child’s parents, or elder abuse and neglect.

YOUR RIGHTS REGARDING MEDICAL INFORMATION

In addition to any rights that you may have under state law, you have the following HIPAA rights regarding your medical information that United Concierge maintains.

GET AN ELECTRONIC OR PAPER COPY OF YOUR MEDICAL RECORD

You have the right to inspect and copy medical information that may be used to make decisions about your care. To inspect and copy your medical information, you must submit your request in writing to our Compliance Department, via the contact information set forth at the very end of this notice. If United Concierge maintains your medical information in an electronic health record, you have the right to obtain an electronic copy of such information. When information is not readily producible in the electronic form and format you have requested, we will provide you the information in an alternative readable electronic format as we may mutually agree upon. Furthermore, you have the right to direct United Concierge to transmit such electronic copy directly to another entity or person that you designate. If you request a copy of the information, United Concierge may charge a fee for the costs of copying, mailing or other supplies associated with your request. United Concierge will follow state law with regard to approved copying and other costs. United Concierge may deny your request to inspect and copy in certain very limited circumstances. If you are denied access to medical information, you may request that the denial be reviewed. Another licensed health care professional chosen by United Concierge will review your request and the denial. The person conducting the review will not be the person who denied your request. United Concierge will comply with the outcome of the review. Please be advised that, if you request that information be provided via email, there are risks associated with transmitting medical information in this manner. Information transmitted via email is more likely to be intercepted by unauthorized third parties than information sent via more secure transmission channels. If you request that we email you information, you are acknowledging that we have notified of you of these risks, that you are accepting the risks, and agreeing that we are not responsible for unauthorized access of such medical information while it is in transmission or any time after it is delivered to you.

AMEND YOUR MEDICAL INFORMATION

If you feel that your medical information is incorrect or incomplete, you have the right to request an amendment of the information, as long as the information is kept by or for United Concierge. To request an amendment, your request must be made in writing and submitted to our Compliance Department, via the contact information set forth at the very end of this notice. We may deny your request for a number of legally permissible reasons, but we will tell you why, in writing, within 60 days, and also give you the right to submit a written statement of disagreement with our decision. If you clearly indicate in writing that you want the statement of disagreement to be made part of your medical record, United Concierge will attach it to your records and include it whenever United Concierge discloses the item or statement you believe to be incomplete or incorrect.

RECEIVE AN ACCOUNTING OF DISCLOSURES

You have the right to request an “accounting of disclosures.” This is a list of the disclosures United Concierge made of medical information about you, other than our own uses for treatment, payment, and health care operations (as those functions are described above) and certain other disclosures. United Concierge will, however, account for disclosures related to treatment, payment, and health care operations if the information disclosed is maintained in an electronic health record. To request an accounting of disclosures, you must submit your request in writing to our Compliance Department, via the contact information set forth at the very end of this notice. Your request must state a time period, which may not be longer than six (6) years prior to the date you ask. Your request should indicate in what form you want the list (for example, on paper or electronically). The first list you request within a 12-month period will be free. For additional lists within a 12-month period, United Concierge may charge you a reasonable, cost-based fee for providing the list.

REQUEST RESTRICTIONS ON WHAT WE USE OR SHARE

You have the right to request a restriction or limitation on the use and/or disclosure of your medical information in connection with treatment, payment or heath care operations. You also have the right to request a limit on the medical information United Concierge shares about you with someone who is involved in your care or the payment for your care, like a family member or friend. UNITED CONCIERGE IS GENERALLY NOT, HOWEVER, REQUIRED TO AGREE TO YOUR RESTRICTION REQUEST. We are required to agree to the request if all of the following apply: (i) you have requested that we restrict disclosure for payment or health care operations purposes; (ii) the disclosure would be made to a health plan/insurer (e.g., we are not precluded from making other allowable disclosures, only disclosures to the health plan/insurer); (iii) the disclosure is not otherwise required by law; and (iv) the restricted medical information pertains solely to a health care item or service for which you, or someone on your behalf, have paid us in full (excluding payments made by the health plan on your behalf) (e.g., you may not restrict the entirety of your medical record from being shared to a health plan/insurer – you may only restrict the portions of your record for those items or services that have been paid in full). You are hereby advised that, even if you utilize this required restriction request and meet the criteria set forth above, the required restriction is narrow. In particular, even if you have requested and received a required restriction, we may still share your information with others for allowable purposes, such as sending information to a pharmacy to have a prescription filled. In the event that we make such allowable disclosures, the party with which we have shared the information is not bound by the restriction, and we are not obligated to relay your restriction request to such party. The only way for you to guarantee that such party(ies) do not then share said information with your insurer/health plan is for you to request a required restriction from the party(ies), which request meets all of the elements set forth above. Note also that, to the extent you seek follow-up or other treatment from us, and it is necessary for us to include previously restricted PHI when billing your insurer/ health plan for the follow-up treatment, we may share such previously restricted information, but only to the extent that including it is required to support medical necessity of the follow-up care and you do not request a new required restriction after paying out-of-pocket in full for the follow-up care. United Concierge may, in its discretion, agree to comply with non-required restriction requests, unless otherwise required by law. You must make your restriction requests in writing to our Compliance Department via the contact information set forth at the very end of this notice. United Concierge will not ask you about the reason for your request. United Concierge will attempt to accommodate all reasonable requests.

REQUEST CONFIDENTIAL COMMUNICATIONS

You have the right to request that United Concierge communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that United Concierge only contact you at work or by mail. United Concierge will not ask you about the reason for your request. We will agree to all reasonable requests, which are made in writing to our Compliance Department, via the contact information set forth at the very end of this notice.

PAPER COPY OF THIS NOTICE

You have the right to a paper copy of this notice at any time, even if you have agreed to receive this notice electronically. https://www.ucmdigitalhealth.com/about/resources/hipaa-notice-of-privacy-practices/ To obtain a paper copy of this notice, ask our Compliance Department via the contact information set forth at the very end of this notice.

FILE A COMPLAINT IF YOU FEEL YOUR RIGHTS ARE VIOLATED

If you believe your privacy rights have been violated, you may file a complaint with United Concierge or with the Secretary of the U.S. Department of Health and Human Services. To file a complaint with United Concierge, contact our Compliance Department in writing, via the contact information set forth at the very end of this notice. We respectfully request that complaints be submitted in writing. You will not be penalized or retaliated against for filing a complaint.

CHANGES TO THE TERMS OF THIS NOTICE

United Concierge reserves the right to change this notice and any of our other privacy or security policies at any time, and the changes will apply to all information we already have about you. United Concierge will post a copy of the most recent notice in United Concierge’s facilities and on our website. The notice will identify the effective date and will be available upon request.

OTHER USES OF MEDICAL INFORMATION/PERMISSIONS/AUTHORIZATIONS

Other uses and disclosures of medical information not covered by this notice or the laws that apply to United Concierge will be made only with your written permission/authorization. If you provide us permission to use or share medical information about you, you may revoke that permission, in writing, at any time. If you revoke your permission, this will stop any further use or disclosure of your medical information for the purposes covered by your written authorization, except to the extent United Concierge has already acted in reliance on your permission. You understand that United Concierge is unable to take back any disclosures United Concierge has already made with your permission and that United Concierge is required to retain records of the care that United Concierge provides to you.

COMPLIANCE DEPARTMENT CONTACT INFORMATION

If you have any questions about this notice, please contact our Compliance Department, via the contact information set forth below. Legalandcompliance@ucmdigitalhealth.com; 844-484-7632; UCM Digital Health, Inc. 216 River Street, Troy, NY 12180 Revised/Reviewed: August 22, 2022