Notice of Privacy Practices (HIPAA & Health Information Privacy)

This Notice applies to:

• VITL Healthcare ("we," "us," or "Company") – an online platform that helps connect you with licensed healthcare providers and pharmacies.
• Partner Healthcare Providers and Pharmacies – the independent physicians and pharmacies who review your information, prescribe (if appropriate), and dispense medications.

We are not a pharmacy or medical practice. We facilitate the transmission of your information to licensed providers and pharmacies who are responsible for your diagnosis, treatment, and dispensing of medications.

Depending on our role and contracts, we may act as a Business Associate of these covered entities under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA").

"Protected Health Information" or PHI is information that:

• Identifies you or can reasonably be used to identify you; and
• Relates to your past, present, or future physical or mental health or condition, the provision of healthcare to you, or payment for that care.

Examples include your name, date of birth, contact details, medical history, medication requests, questionnaires, and payment information tied to medical services.

When acting on behalf of our partner physicians and pharmacies, we may use and disclose your PHI as permitted or required by HIPAA.

a. Treatment

• Sending your health questionnaire and order request to a licensed physician for review.
• Sharing necessary information with a partner pharmacy to dispense an approved prescription.

b. Payment

• Processing payments for consultations or prescriptions.
• Working with payment processors or billing services as needed.

c. Healthcare Operations

• Quality assessment and improvement activities.
• Customer service, training, auditing, and compliance monitoring.
• Managing our relationships with partner providers and pharmacies.

When possible, we use de-identified or limited data sets for analytics and internal reporting.

We may also use or disclose your PHI without your authorization in situations such as:

• As required by law, including disclosures to regulators, law enforcement, courts, or government agencies.
• Public health activities (for example adverse events or product recalls).
• Health oversight activities, such as audits, inspections, or investigations.
• Legal proceedings and law enforcement in response to lawful requests.
• To prevent a serious threat to health or safety, consistent with applicable law.
• With business associates under contracts requiring safeguarding of PHI.

Where state law provides greater privacy protections than HIPAA, we will follow the more protective rule.

In situations not described in this Notice, we will ask for your written authorization before using or disclosing your PHI.

This includes, for example:

• Most uses or disclosures of psychotherapy notes (if applicable).
• Most marketing-related uses of PHI beyond communications about your treatment or benefits.
• Any sale of your PHI, as defined by HIPAA.

You may revoke your authorization at any time in writing, except to the extent that we or our partners have already relied on it.

Under HIPAA (and, where applicable, state law), you have the following rights:

a. Right to Access

You have the right to inspect and obtain a copy of your PHI with certain limited exceptions.

To request access, contact us at privacy@vitl.life or 5900 Balcones Drive, STE 100, Austin, TX, 78731.

We may charge a reasonable cost-based fee as permitted by law.

b. Right to Request an Amendment

If you believe your PHI is incomplete or inaccurate, you may request an amendment. We may deny your request in some cases, but we will tell you why in writing.

c. Right to an Accounting of Disclosures

You may request a list of certain disclosures of your PHI made in the past six years, with HIPAA exclusions.

d. Right to Request Restrictions

You may ask us to limit certain uses or disclosures. We are not required to agree to all requested restrictions.

e. Right to Request Confidential Communications

You may request communications in a specific way (for example, a different email, phone number, or mailing address). We will accommodate reasonable requests.

f. Right to a Paper Copy of This Notice

You may request a paper copy at any time, even if you agreed to receive it electronically.

We are required by law to:

• Maintain the privacy and security of your PHI.
• Provide you with this Notice of Privacy Practices.
• Follow the terms of the Notice currently in effect.
• Notify you following a breach of unsecured PHI, as required by law.

We may update this Notice from time to time and will post updates on our website with a new Effective Date.

• Independent providers are responsible for their own HIPAA Notices and compliance.
• We share information only as needed to support treatment, prescriptions, payment, and operations consistent with HIPAA.
• For questions about a specific provider or pharmacy privacy policy, review their Notice or contact them directly.

To exercise your rights or ask questions, contact:

Privacy Officer
VITL Healthcare
5900 Balcones Drive
STE 100
Austin, TX, 78731
Email: privacy@vitl.life

If you believe your privacy rights have been violated, you may file a complaint with:

• Us, using the contact information above; and/or
• The U.S. Department of Health and Human Services, Office for Civil Rights (OCR).

We will not retaliate against you for filing a complaint.

In addition to HIPAA, our collection and use of personal information through this website (including non-medical information like cookies, IP addresses, and browser data) is described in our separate Website Privacy Policy.

That policy includes details on cookies, analytics, advertising, and non-health personal data.

When health information is combined with identifiers and used in connection with healthcare services, it is treated as PHI as described in this Notice.