Notice of Privacy Practices

This Notice of Privacy Practices ("Notice") is issued by MDI Medical Group PC, a professional corporation, together with its affiliated professional entities and the licensed physicians and clinical personnel who provide care to patients through the EdgeRx platform (collectively, the "Practice," "we," "us," or "our"). The Practice is the entity responsible under the Health Insurance Portability and Accountability Act ("HIPAA") for the privacy of the protected health information ("PHI") created when you receive care. Because you reached the Practice through EdgeRx, this Notice may be presented to you as the "EdgeRx Notice of Privacy Practices," but it is the Notice of the Practice.

EdgeRx's role. EdgeRx Health, LLC ("EdgeRx") operates the technology platform and provides marketing and administrative support through which you accessed the Practice. EdgeRx is a separate company that contracts with the Practice on an independent basis to connect its customers with the Practice's physicians. EdgeRx is not a health care provider and is not a covered entity under HIPAA; it does not provide the medical services, and it does not control the professional judgment of the physicians. The information you provide to EdgeRx directly — for example, while browsing, during checkout, or before a clinical relationship is formed — is handled by EdgeRx as part of its own consumer business and is governed by the EdgeRx Privacy Policy and applicable consumer health data laws, not by this Notice. The PHI described in this Notice is created and held by the Practice and its physicians. The telehealth technology platform used by the Practice is provided by M&D Integrations, Inc.

I. Our Duties

We are required by law to maintain the privacy of your PHI, to provide you with this Notice of our legal duties and privacy practices with respect to your PHI, to notify you following a breach of your unsecured PHI, and to abide by the terms of the Notice currently in effect. We reserve the right to change this Notice and to make the revised Notice effective for PHI we already maintain, as described in Section VI.

II. How We May Use and Disclose Your PHI Without Your Authorization

We may use and disclose your PHI without your written authorization for the following purposes:

Treatment. Our physicians and clinical personnel use your PHI to assess your health, determine an appropriate protocol, provide and coordinate your care, and share information with other providers involved in your treatment.

Payment. We may use and disclose your PHI to obtain or arrange payment for the services and products provided to you.

Health Care Operations. We may use and disclose your PHI for operational activities such as quality assessment and improvement, reviewing the competence and performance of our physicians, care coordination, and business management.

Business Associates. We may disclose your PHI to our business associates and their subcontractors who assist us with treatment, payment, or health care operations — including M&D Integrations, Inc., which provides and operates the telehealth technology platform used to deliver care. We require our business associates, by written agreement, to appropriately safeguard your PHI.

Communicating with You. We may use your PHI to contact you about your care, treatment options, orders, and other health-related matters, including by email, text message, or telephone using the contact information you provide. If your contact information changes, please let us know.

Subject to conditions set by law, we may also use or disclose your PHI without your authorization:

• as required by law;
• for public health activities, including reporting disease, injury, birth, and death, reporting to the U.S. Food and Drug Administration regarding regulated products, and reporting adverse events or product recalls;
• to report suspected abuse, neglect, or domestic violence to authorities permitted by law to receive such reports;
• to health oversight agencies for audits, investigations, inspections, and similar activities;
• in response to a court or administrative order, subpoena, or other lawful process;
• for law enforcement purposes as permitted or required by law;
• to coroners, medical examiners, and funeral directors;
• for organ or tissue donation, where applicable;
• to prevent or lessen a serious and imminent threat to the health or safety of a person or the public;
• for specialized government functions, such as military or national security activities;
• for workers' compensation as authorized by law; and
• for research, where an Institutional Review Board or Privacy Board has approved a waiver of authorization.

III. Uses and Disclosures Requiring Your Written Authorization

Except as described above, we will not use or disclose your PHI without your written authorization. In particular, your written authorization is required for most uses and disclosures of psychotherapy notes, for uses and disclosures for marketing, and for any disclosure that constitutes a sale of PHI. Certain categories of highly confidential information — which may include substance use disorder treatment records, mental health information, and HIV-related information — receive special protection under state and federal law, and we may disclose them only with your authorization or as those laws otherwise permit. You may revoke an authorization in writing at any time, except to the extent we have already relied on it.

IV. Your Rights Regarding Your PHI

Subject to certain limitations under applicable law, you have the following rights:

Access, inspect, and copy. You may inspect and obtain a copy of the PHI we maintain about you, in paper or electronic form. You may access much of your health information through the patient portal (see Section V). We may charge a reasonable, cost-based fee for copies as permitted by law.

Amend. You may request that we amend PHI you believe is incorrect or incomplete. Your request must be in writing and state the reason for it. We may deny the request in certain circumstances and will give you a written explanation if we do.

Accounting of disclosures. You may request an accounting of certain disclosures of your PHI made in the six years before your request. This does not include disclosures for treatment, payment, or health care operations, or certain other disclosures.

Request restrictions. You may request restrictions on our uses and disclosures of your PHI for treatment, payment, or health care operations. We are not required to agree, but we will consider reasonable requests. We must honor a request to restrict disclosure to a health plan for payment or operations when the PHI pertains solely to an item or service you have paid for in full out of pocket.

Confidential communications. You may request that we communicate with you by alternative means or at an alternative location, and we will accommodate reasonable written requests.

Paper copy. You may obtain a paper copy of this Notice on request, even if you agreed to receive it electronically.

Breach notification. We are required to notify you following a breach of your unsecured PHI without unreasonable delay and no later than 60 days after discovery of the breach.

V. How to Exercise Your Rights, and Complaints

The Practice's records are maintained through MD Integrations. You may exercise the rights above, access your records, or ask questions about this Notice through the patient portal at privacy.mdintegrations.com, or by writing to the Practice's Privacy Officer, c/o MD Integrations, at support@mdintegrations.com. You may also submit a request through EdgeRx at privacy@edgerx.org, and EdgeRx will forward it to the Practice.

If you believe your privacy rights have been violated, you may file a written complaint with the Practice's Privacy Officer using the contact information above, and you may also file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights, at hhs.gov/ocr. We will not retaliate against you for filing a complaint, and filing a complaint will not affect the quality of your care.

VI. Effective Date and Changes to This Notice

This Notice is effective as of the date shown above. We may change the terms of this Notice at any time, and the revised Notice will apply to all PHI we maintain, including PHI created or received before the change. When we revise this Notice, the current version will be posted at edgerx.org and made available on request.

Covered entity (the Practice): MDI Medical Group PC, 100 Powell Place #1859, Nashville, TN 37204.

Platform operator: EdgeRx Health, LLC, 1776 Broadway, Suite 2002, New York, NY 10019 — privacy@edgerx.org