Notice of Privacy Practices (HIPAA)

Who We Are & Scope

This Notice of Privacy Practices describes the privacy practices of CareValidate (owned by CareValidate, Inc.) and its affiliates, including affiliated professional entities, physicians, and other personnel.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

II. Privacy Obligations

We are required by law to maintain the privacy of your Protected Health Information (PHI) and notify you following a Breach of unsecured PHI. When we use or disclose your PHI, we must abide by the terms of this Notice.

III. Permissible Uses Without Written Authorization

A. Treatment: We may use/disclose PHI to diagnose and treat your injury or illness. B. Payment: We may use/disclose PHI to obtain payment for services provided. C. Healthcare Operations: We may use PHI for internal administration, quality improvement, and resolving complaints.

Other permissible disclosures: Relatives and caregivers; Public health activities; Abuse/neglect reporting; Health oversight agencies; Judicial/legal proceedings; Law enforcement; Research (with IRB approval); Imminent health/safety threats; Workers' compensation.

IV. Uses Requiring Written Authorization

We must obtain your written authorization for: marketing purposes; sale of PHI; and disclosures of Highly Confidential Information (mental health, substance abuse, HIV/AIDS, STDs, genetic testing, child abuse, domestic abuse, sexual assault records).

Revocation: You may withdraw any written authorization (except to the extent we have already acted in reliance upon it) by delivering a written statement to the Privacy Officer.

V. Your Rights Regarding Your PHI

A. Right to Request Additional Restrictions on uses/disclosures of PHI. B. Right to Receive Confidential Communications by alternative means. C. Right to Inspect and Copy your medical record and billing records. D. Right to Request Amendment of PHI in your records.

E. Right to Receive an Accounting of Disclosures (up to 6 years prior). F. Right to a Copy of this Notice in email or paper format. Complaints: Contact our Compliance and Privacy Officer or call +1-800-123-4567. File written complaints with the Director, Office for Civil Rights, U.S. Dept. of Health and Human Services.

VI–VII. Effective Date & Privacy Officer

Effective Date: January 1, 2024. We may change the terms of this Notice at any time and will post updates at www.trimmedi.com. Privacy Officer: CareValidate, Inc., 4575 Webb Bridge Rd, Suite 4345, Alpharetta, GA 30005

Per Hörbergs Väg 3, 164 50 Bromma, Sweden