InHealth Notice of Privacy Practices

How health information about you may be used and disclosed, and how you can get access to it

Effective date: October 26, 2026 Version 1.1

Please read this notice carefully. It explains who holds your health information, how it is used, and what rights you have.

1. Our role

InHealth Medical Services (“InHealth”, “we”, “us”) delivers behavioral and lifestyle health programs on behalf of health plans, employer sponsored group health plans, and the partners that administer them.

Under the Health Insurance Portability and Accountability Act, we are a business associate. That means:

• We receive, create, and maintain protected health information about you on behalf of your health plan or program sponsor, under a written business associate agreement.
• We may use and disclose your health information only as that agreement and HIPAA permit. We cannot use it for our own purposes.
• The privacy notice that governs your health information is the Notice of Privacy Practices issued by your health plan or program sponsor. Ask them for a copy, or look for it on their member website.
• Your HIPAA rights are held against your health plan as the covered entity. We are required to support your plan in honoring them, and we will help you exercise them, as Section 5 explains.

We are also directly subject to the HIPAA Security Rule and to the Breach Notification Rule, and we are directly liable for compliance with them.

We provide this notice so that you can see, in one place, how we actually handle your information.

2. What health information we hold

We hold the information described in Section 2 of our Privacy Policy. In summary: the eligibility information your sponsor sends us, the account and health information you give us, the documentation your coach creates during your program, readings from any connected device in your program, your messages with your coach, and records of your program activity.

3. How we use and disclose your health information

We use and disclose your health information only for the following purposes.

3.1 To deliver your program

To enroll you, confirm eligibility, assign a coach, conduct coaching visits, document your care, ship and support a device, send appointment reminders and program communications, and provide program content.

3.2 To your health plan or program sponsor, as our agreements require

To report enrollment, engagement, participation, and outcomes; to provide clinical and outcomes files to the contracting health plan or its administrator; and to enable the plan to administer and pay for the program.

Your employer does not receive your individual health information from us. Reporting to an employer group is aggregated across the group, and we do not report any figure derived from fewer than 20 members.

3.3 To our service providers

To vendors that host the platform, deliver video visits and text messages, supply and fulfill devices, and produce reporting. Each one that touches health information operates under a written business associate agreement, may use it only to perform services for us, and must apply the same safeguards.

3.4 As required or permitted by law

To respond to a subpoena, court order, or lawful government request; to cooperate with a health oversight agency, including the Department of Health and Human Services; to comply with public health reporting requirements; to establish or defend a legal claim; and to prevent or reduce a serious and imminent threat to the health or safety of a person or the public. We make these disclosures only as HIPAA and our business associate agreements permit, and we notify the covered entity where the agreement requires it.

3.5 With your written authorization

Any other use or disclosure requires your written authorization, or the authorization of the covered entity where HIPAA requires it. In particular, we will not sell your health information, and we will not use or disclose it for marketing, without an authorization. You may revoke an authorization in writing at any time, except to the extent we have already acted on it.

3.6 Psychotherapy notes

We do not create psychotherapy notes as HIPAA defines them. If that changes, an authorization will be required for most uses and disclosures of them.

4. The minimum necessary standard

When we use or disclose your health information, and when we request it, we limit it to the minimum necessary to accomplish the purpose. Your coach sees the members assigned to them and the information needed to deliver your program. Access is reviewed regularly and revoked when it is no longer needed.

5. Your rights, and how we help you exercise them

Your HIPAA rights are held against your health plan as the covered entity. You may direct any of these requests to us and we will act on them or route them to your plan, and we will tell you which we did.

Right	What it means	How to use it
Access	See and get a copy of the health information we hold about you, including in electronic form	Contact us or your plan. We respond within 30 days
Amendment	Ask that information you believe is incorrect or incomplete be corrected	Submit the request in writing, with the reason
Accounting of disclosures	Get a list of certain disclosures we have made in the six years before your request	Contact us. The first request in any 12 months is free
Restriction	Ask that we limit how we use or disclose your information	Contact us. Your plan is not required to agree to every restriction
Confidential communications	Ask us to contact you by a different means or at a different address	Contact us. We will accommodate reasonable requests
Electronic copy	Receive your information in an electronic format, or have it sent to a person you name	Contact us in writing
Breach notification	Be notified if your unsecured health information is breached	Automatic. No request needed
Paper copy	Get a paper copy of this notice even if you received it electronically	Contact us

To exercise a right: email security@inhealthonline.com, call 888-219-5299, or write to InHealth Medical Services, Attn: Privacy Officer, 1801 Century Park East, 24^th Floor, Los Angeles, CA 90067.

We will verify your identity before acting on a request.

6. Breach notification

If a breach of your unsecured health information occurs, notification is provided as HIPAA and applicable state law require. Because we are a business associate, we notify the affected health plan or contracting partner, without unreasonable delay and no later than one business day after discovery, and we support that party in providing notice to you. Where notice to you is our obligation, we provide it directly.

The notice will describe what happened, the dates of the breach and its discovery, the types of information involved, the steps you can take to protect yourself, what we are doing about it, and how to reach us.

7. How we protect your health information

Section 8 of our InHealth Privacy Policy describes our safeguards in full. In summary: encryption at rest and in transit, multi-factor authentication, unique user accounts and role based access, background screening and annual HIPAA training for everyone who touches health information including contracted coaches, audit logging, vendor business associate agreements, a tested incident response and disaster recovery plan, and storage and processing of health information within the United States.

8. How long we keep your health information

Member clinical records and coaching documentation are retained for six years from the date of your last encounter, unless a longer period is required by law, by an agreement with your health plan, or by a litigation hold. Audit logs are retained for a minimum of 12 months. Closing your account does not delete your clinical record.

9. Complaints

If you believe your privacy rights have been violated, tell us. Contact our Privacy Officer:

Johnnie Jenkins, Chief Operating Officer, Privacy Officer jjenkins@inhealthonline.com · 888-219-5299

You may also complain to your health plan, and you may file a complaint with:

U.S. Department of Health and Human Services, Office for Civil Rights 200 Independence Avenue SW, Washington, DC 20201 1-877-696-6775 · www.hhs.gov/ocr/privacy/hipaa/complaints

We will not retaliate against you in any way for filing a complaint.

10. Changes to this notice

We may change this notice. A change applies to health information we already hold as well as information we receive afterward. The current version is always posted in the application and on the member website, with the effective date at the top. We will notify you of a material change through the Services or by email.

11. How to reach us

InHealth Medical Services 1801 Century Park East, 24^th Floor, Los Angeles, CA 90067

Privacy Officer: Johnnie Jenkins, Chief Operating Officer jjenkins@inhealthonline.com · 888-219-5299 Security concerns: security@inhealthonline.com