HIPAA Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

1. Who we are

NextAct ("NextAct") is a healthcare technology platform that connects you with licensed providers affiliated with Elite Care Health for telehealth care, with prescriptions fulfilled by Rx Ave Health. We are committed to protecting your health information and complying with the Health Insurance Portability and Accountability Act (HIPAA).

2. Protected health information (PHI)

PHI is health information that can identify you, in any form. It may include:

• Identifiers such as your name, date of birth, address, email and phone number.
• Health history, medications, allergies and intake answers.
• Lab results, consultation notes, prescriptions and treatment plans.
• Payment information related to your care, processed by a PCI-compliant payment processor.

3. How we use and disclose PHI

• Treatment: with providers affiliated with Elite Care Health to review your intake and provide care, and with Rx Ave Health to fulfill prescriptions.
• Payment: with our payment processor to process charges for your care.
• Healthcare operations: for quality improvement, audits, compliance and provider credentialing.
• Business associates: with vendors that help us run the Services (such as hosting and secure messaging), only under a Business Associate Agreement that requires them to protect your PHI.
• As required by law: to public health authorities, to the U.S. Department of Health and Human Services, or to law enforcement in limited circumstances.

We do not sell your PHI. We do not use or disclose PHI for marketing without your written authorization. Other uses require your written authorization, which you may revoke at any time in writing.

4. Your rights

• Access: request a copy of your PHI. We respond within 30 days and may charge a reasonable, cost-based fee.
• Amendment: ask us to correct information you believe is inaccurate or incomplete. We may deny the request if the record is accurate, and will tell you why in writing.
• Accounting of disclosures: request a list of disclosures we made, other than for treatment, payment or healthcare operations.
• Restrictions: ask us to limit certain uses or disclosures. We will consider your request but are not always required to agree.
• Confidential communications: ask us to contact you in a specific way or at a specific address.
• Paper copy: request a paper copy of this notice at any time.

Send requests to the Privacy Officer at [[PRIVACY EMAIL]].

5. How we protect your information

We use encryption in transit and at rest, role-based access controls, audit logs of access to PHI, and Business Associate Agreements with every vendor that handles PHI.

6. Breach notification

If a breach of unsecured PHI affects you, we will notify you without unreasonable delay and no later than 60 days after discovery. The notice will explain what happened, what information was involved, what we are doing about it, and steps you can take to protect yourself.

7. Retention

We keep PHI for at least seven years from the date of service, or longer if state law requires, and then securely destroy it.

8. Complaints

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer at [[PRIVACY EMAIL]], or with the U.S. Department of Health and Human Services, Office for Civil Rights, at www.hhs.gov/ocr/complaints. We will not retaliate against you for filing a complaint.

9. Changes to this notice

We may change this notice at any time. Changes apply to all PHI we hold. The current version is always available at nextact.health/hipaa, and we will email you about material changes.

10. Effective date

This notice is effective as of November 4, 2026.