Notice of Privacy Practices

1. Who this notice applies to

This Notice of Privacy Practices ("Notice") describes the privacy practices of the independent Medical Practice that provides your wellness medical services through the Yuvia website, mobile applications, patient portal, and related technology and communication services (collectively, the "Platform"). "Medical Practice" means the independent professional entity (P.A., P.C., or another professional entity authorized under applicable law) that provides or provided your wellness medical services.

This Notice applies to all members of the Medical Practice's workforce, including physicians, nurse practitioners, physician assistants (where applicable), nurses, employees, contractors, trainees, volunteers, students, temporary personnel, other authorized workforce members, and Business Associates acting on behalf of the Medical Practice as permitted by HIPAA.

This Notice does not apply to Yuvia Holdings LLC acting solely in its capacity as a management services organization ("MSO"), except to the extent Yuvia Holdings LLC performs services for the Medical Practice as a HIPAA Business Associate pursuant to an applicable Business Associate Agreement.

2. Our commitment to your privacy

The Medical Practice understands that your medical information is personal and confidential. Federal and state law require the Medical Practice to protect the privacy of your Protected Health Information ("PHI"); provide this Notice describing its legal duties and privacy practices; comply with the terms of the Notice currently in effect; notify you following a breach of unsecured PHI when required by applicable law; and provide a copy of the current Notice upon request. Where applicable state law provides greater privacy protections than HIPAA, the Medical Practice will comply with the applicable state law.

3. Our legal duties

The Medical Practice is required by HIPAA, its implementing regulations, and other applicable federal and state laws to maintain appropriate administrative, technical, and physical safeguards to protect your PHI; provide this Notice; comply with its terms; notify you of a reportable breach when required; and honor your rights regarding your PHI. The Medical Practice reserves the right to revise this Notice; any revised Notice will apply to all PHI it maintains and will be made available through the Platform and upon request.

4. Protected Health Information

PHI is individually identifiable health information created or received by the Medical Practice relating to your past, present, or future physical or mental health, the wellness medical services provided, or payment for those services. Examples include demographic and contact information, health history, medications, allergies, intake information, prescription information (where applicable), laboratory results (where applicable), communications regarding your services, and billing information.

5. Permitted uses and disclosures without your written authorization

Federal and state law permit the Medical Practice to use and disclose your PHI for certain purposes without your written authorization, including:

A. Treatment

To provide, coordinate, and manage your wellness medical services — for example, evaluating whether you are an appropriate candidate, reviewing your health information, transmitting prescriptions to authorized pharmacies where permitted, coordinating follow-up, and maintaining your medical record.

B. Payment

To obtain payment for services, including processing payments, verifying payment information, billing, collecting amounts owed, and coordinating with authorized payment service providers acting on the Medical Practice's behalf.

C. Healthcare operations

To operate the Medical Practice and improve quality, including quality assessment, peer review, credentialing, licensing, accreditation, workforce training, compliance, auditing, legal and accounting services, business planning, customer service, fraud prevention, risk management, and information security.

D. Persons involved in your care

Unless you object, or as otherwise permitted by law, the Medical Practice may disclose relevant PHI to family members, caregivers, or others involved in your care or payment for your care, using professional judgment.

E. Appointment reminders and service communications

To contact you regarding appointments, scheduling, reminders, follow-up, prescription information (where applicable), treatment alternatives related to the wellness services offered, and other relevant health-related benefits or services, through the Platform, telephone, mail, secure electronic message, video, or other permitted methods.

F. Uses and disclosures required or permitted by law

Without your written authorization whenever required or permitted, including for public health activities; reporting abuse, neglect, or domestic violence; health oversight; judicial and administrative proceedings; law enforcement; coroners, medical examiners, and funeral directors; organ and tissue donation; certain research; workers' compensation; specialized government functions; disaster relief; preventing a serious threat to health or safety; and other purposes authorized or required by law.

6. Minimum necessary standard

Except where otherwise permitted or required by HIPAA, the Medical Practice limits the use, disclosure, and request for PHI to the minimum necessary to accomplish the intended purpose. The minimum necessary standard generally does not apply to disclosures made to you, for treatment, pursuant to your valid written authorization, to HHS for compliance activities, or where HIPAA does not require it.

7. Electronic communications

The Medical Practice may communicate with you electronically where permitted by law and consistent with your preferences, including secure patient portal messages, email, text messages (where authorized), telephone, video, and other secure electronic communications. Reasonable safeguards are employed, but no method of electronic communication or storage can be guaranteed completely secure. By choosing to communicate electronically, you acknowledge the inherent risks.

8. Uses and disclosures requiring your written authorization

Except as otherwise permitted or required by law, the Medical Practice will obtain your written authorization before using or disclosing your PHI. This generally includes uses not otherwise permitted by HIPAA, most uses of psychotherapy notes (where applicable), the sale of PHI where authorization is required, and certain marketing communications. You may revoke your authorization in writing at any time; revocation does not affect uses or disclosures already made in reliance on it.

9. Your rights regarding PHI

Subject to applicable law, you have the right to:

• Inspect and obtain a copy of PHI maintained by the Medical Practice, subject to limited exceptions (reasonable cost-based fees may apply).
• Request an amendment of PHI you believe is inaccurate or incomplete; the Medical Practice may deny in circumstances permitted by law and will explain the reason.
• Receive an accounting of certain disclosures, subject to HIPAA limitations.
• Request restrictions on certain uses or disclosures; the Medical Practice will consider reasonable requests but is not required to agree unless required by law.
• Request confidential communications by alternative means or at alternative locations, where reasonable.
• Receive a paper copy of this Notice at any time, even if you agreed to receive it electronically.

10. Business associates

The Medical Practice may engage Business Associates to perform services on its behalf; they may process PHI only as permitted by HIPAA, applicable law, and written agreements, and must implement appropriate safeguards. Yuvia Holdings LLC provides non-clinical administrative, operational, management, technology, communications, scheduling, payment support, customer support, and related business services. When Yuvia Holdings LLC processes PHI on behalf of the Medical Practice, it does so solely as permitted by HIPAA, pursuant to an applicable Business Associate Agreement, and for authorized non-clinical services. Yuvia Holdings LLC performs only non-clinical functions and does not provide medical care, practice medicine, exercise clinical judgment, establish provider-patient relationships, diagnose, prescribe, or make treatment decisions.

11. Breach notification

The Medical Practice is required to notify affected individuals following a breach of unsecured PHI when required by HIPAA or other applicable law, without unreasonable delay, and may also notify HHS or other authorities as required by law.

12. Complaints

If you believe your privacy rights have been violated, you may file a complaint with the Medical Practice (directed to the Privacy Contact below) and with the U.S. Department of Health and Human Services, Office for Civil Rights. Filing with the Medical Practice does not affect your right to file with OCR. The Medical Practice will not retaliate against you for filing a complaint or exercising your rights.

13. Changes to this notice

The Medical Practice may revise or amend this Notice at any time as permitted by law. Any revised Notice will apply to all PHI it maintains, including PHI created or received before the revision, unless otherwise required by law. The most current version will be made available through the Platform and provided upon request.

14. Privacy contact

Questions regarding this Notice, requests to exercise your rights, requests relating to your PHI, or privacy complaints should be directed to the Medical Practice that provides or provided your wellness medical services. The identity and contact information of your Medical Practice are available through the Platform, your patient portal, your appointment confirmations, and your billing communications.

Mailing address
5155 Corporate Way, Suite C
Jupiter, FL 33458

15. Relationship to the Yuvia Privacy Policy

This Notice applies solely to the Medical Practice's use and disclosure of PHI. The Medical Practice is the healthcare provider responsible for your care and, where applicable, the HIPAA Covered Entity. Yuvia Holdings LLC maintains a separate Yuvia Privacy Policy describing its practices as a management services organization. Nothing in the Yuvia Privacy Policy modifies this Notice or changes the Medical Practice's responsibilities.

16. Effective date

This Notice of Privacy Practices is effective as of July 15, 2026 and remains in effect until revised or replaced by the Medical Practice in accordance with applicable law. Your receipt of this Notice does not waive any rights provided under HIPAA or other applicable law.