Notice of Privacy Practices

Who This Notice Applies To

This Notice applies to Pelerin Medical Services, PLLC (the "Practice"), a licensed professional corporation that provides all clinical services to Novus MD patients. The Practice is the HIPAA Covered Entity responsible for your protected health information (PHI).

This Notice does not apply to Novus MD LLC, the management services organization that operates the website and subscription platform. Novus MD LLC's handling of non-clinical information is governed by the Novus MD Privacy Policy at novusmd.com/privacy.

Our Obligations

The Practice is required by law to:

• maintain the privacy of your PHI;
• provide you with this Notice;
• notify you in the event of a breach of your unsecured PHI; and
• follow the terms of the Notice currently in effect.

1. How We May Use and Disclose Your Health Information

1.1 Treatment — to provide, coordinate, and manage your medical treatment, including sharing information with clinicians involved in your care, ordering and reviewing lab results, and prescribing through our electronic prescribing system.

1.2 Payment — to process payments for your clinical services, including sharing information with Novus MD LLC, which acts as the billing agent for the Practice.

1.3 Healthcare Operations — for quality assessment, training, compliance activities, and business management necessary to run the Practice.

1.4 As Required by Law — in response to valid court orders, subpoenas, or government investigations.

1.5 Public Health Activities — to public health authorities as required by law.

1.6 Health Oversight Activities — to health oversight agencies for audits, investigations, inspections, and licensure actions.

1.7 Serious Threats to Health or Safety — if necessary to prevent or lessen a serious and imminent threat to health or safety.

1.8 Business Associates — we share PHI with Business Associates who perform services on our behalf, including Novus MD LLC (management and billing), Elation Health (electronic health records and telehealth platform), and our compounding pharmacy and laboratory partners. All Business Associates sign a Business Associate Agreement obligating them to protect your PHI under HIPAA.

2. Uses and Disclosures That Require Your Authorization

Marketing, sale of PHI, and most other uses not described in Section 1 require your prior written authorization, which you may revoke at any time in writing except where we have already acted in reliance on it.

3. Your Rights Regarding Your Health Information

• Right to access and obtain a copy of your PHI (response within 30 days)
• Right to request amendment of your PHI
• Right to an accounting of disclosures made in the prior six years
• Right to request restrictions on use or disclosure
• Right to confidential communications
• Right to a paper copy of this Notice
• Right to be notified of a breach without unreasonable delay, no later than 60 days after discovery

4. Telehealth-Specific Disclosures

Clinical services are provided via telehealth using audio-visual technology through Elation Health. Your participation involves electronic transmission of health information. We maintain safeguards including encrypted transmission and secure storage. Our clinicians are licensed in the states listed at novusmd.com/state-availability.

5. Changes to This Notice

We reserve the right to change this Notice and to make the revised Notice effective for PHI we already hold and PHI we receive in the future. The current version is always available at [Pelerin domain]/notice-of-privacy-practices.

6. Complaints

To file a complaint with the Practice, contact the Privacy Officer below. We will not retaliate against you for filing a complaint. You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights, 200 Independence Avenue, S.W., Washington, D.C. 20201, 1-877-696-6775, www.hhs.gov/ocr/privacy/hipaa/complaints.

7. Contact — Privacy Officer