Notice of Privacy Practices

This Notice is issued by Allora Medical Services, P.A., the medical group that provides your care. Alora Health, LLC operates the Allora technology platform as a business associate of the medical group.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices ("Notice") describes the privacy practices of Allora Medical Services, P.A. and its affiliated providers and business associates (including Alora Health, LLC, our management and technology company) (collectively, "we" or "us"). We are required by law to maintain the privacy of your protected health information ("PHI"), to provide you this Notice of our legal duties and privacy practices, and to abide by the terms of the Notice currently in effect.

1. How We May Use and Disclose Your Health Information

We may use and disclose your PHI without your written authorization for the following purposes:

• Treatment. To provide, coordinate, and manage your care — for example, sharing your intake responses, vitals, and photos with the licensed provider reviewing your consultation, or transmitting your prescription to the pharmacy that dispenses your medication.
• Payment. To bill and collect payment for services — for example, processing your card payment for a consultation or medication, or verifying a charge with our payment processor.
• Health care operations. To run the Platform — for example, quality review of consultations, compliance audits, licensing verification, and customer support.
• As required by law. When federal, state, or local law requires disclosure, including to health oversight agencies, for judicial and administrative proceedings, to law enforcement as permitted by law, and to public health authorities (for example, adverse-event reporting to the FDA).
• To avert a serious threat. To prevent a serious and imminent threat to your health or safety or that of others.
• Business associates. With vendors that perform services for us (for example, our pharmacy partners, payment processor, identity-verification provider, and cloud hosting providers) under contracts that require them to safeguard your PHI.

Uses and disclosures requiring your written authorization. We will not use or disclose your PHI for the following purposes without your written authorization, which you may revoke at any time in writing (revocation does not affect actions we already took in reliance on it):

• Marketing purposes.
• Sale of your PHI.
• Most uses and disclosures of psychotherapy notes, if any.
• Any purpose not described in this Notice.

2. Your Rights Regarding Your Health Information

You have the right to:

• Access. Inspect and obtain a copy of your PHI in our designated record set, in electronic or paper form, generally within 30 days of your request. We may charge a reasonable cost-based fee for copies.
• Amendment. Request that we amend PHI you believe is incorrect or incomplete. We may deny the request in certain cases; if we do, you may submit a written statement of disagreement.
• Accounting of disclosures. Receive a list of certain disclosures of your PHI we made in the six years before your request (excluding disclosures for treatment, payment, and operations, and certain others).
• Restriction requests. Request restrictions on how we use or disclose your PHI. We are not required to agree, except that we must honor a request to restrict disclosure to your health plan for items or services you paid for in full out of pocket.
• Confidential communications. Request that we contact you by alternative means or at an alternative location (for example, a different email address). We will accommodate reasonable requests.
• Paper copy. Receive a paper copy of this Notice on request, even if you agreed to receive it electronically.
• Breach notification. Be notified if a breach of your unsecured PHI occurs, as required by law.

To exercise any of these rights, contact our Privacy Officer using the contact information below.

3. Our Duties

• We are required by law to maintain the privacy and security of your PHI.
• We will notify you promptly, as required by law, if a breach occurs that may have compromised the privacy or security of your unsecured PHI.
• We must follow the duties and privacy practices described in this Notice and give you a copy of it.
• We will not use or share your PHI other than as described here unless you authorize it in writing.

4. Changes to This Notice

We reserve the right to change this Notice and to make the revised Notice effective for PHI we already hold as well as PHI we receive in the future. The current Notice, with its effective date, is available in your patient portal at any time, and we will post and provide the revised Notice as required by law.

5. Complaints

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer (contact below) or with the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue S.W., Washington, D.C. 20201, by calling 1-877-696-6775, or online at hhs.gov/ocr/privacy/hipaa/complaints. We will not retaliate against you for filing a complaint.

6. Contact Us

Privacy Officer — Allora Medical Services, P.A.

• Alora Health, LLC
• Email: legal@allora.care or support@allora.care
• Phone: (813) 291-2526
• 2810 N Church St, Ste 89596, Wilmington, DE 19802

Effective date: This Notice is effective as of the date it is presented to you for acknowledgment.