Notice of Privacy Practices

1. Who This Notice Covers

This Notice of Privacy Practices (“Notice”) describes the privacy practices of Copergrine Health & Wellness, the medical and wellness clinic affiliated with Copergrine LLC(“Copergrine,” “we,” “us,” or “our”), a HIPAA covered entityunder 45 C.F.R. §160.103. It applies to all protected health information (“PHI”) created or received by the clinic, our workforce, our physicians, our advanced practice providers, our medical assistants, and our students, volunteers, and trainees, whether stored in paper records, electronic health records, images, voicemails, or other media.

Organized Health Care Arrangement (OHCA).Copergrine participates in an Organized Health Care Arrangement with its affiliated physicians and treating clinicians for purposes of joint operations, including quality assessment, utilization review, credentialing, and shared clinical workflows. This single Notice covers all participants in the OHCA consistent with 45 C.F.R. §164.520(d).

Scope of operating arms.Copergrine also operates (i) a telehealth/EMR platform (telehealth.copergrine.com) used by the clinic’s providers and by unaffiliated provider customers, and (ii) a medical courier and STAT specimen-delivery service (courier.copergrine.com) that acts as a HIPAA business associateto its client healthcare providers under 45 C.F.R. §164.504(e). The courier arm is not a covered entity. Its handling of PHI is governed by its Business Associate Agreements. Questions about courier privacy practices may be directed to compliance@copergrine.com.

2. Our Pledge Regarding Your Health Information

We understand that health information about you is personal, and we are committed to protecting it. We create a record of the care and services you receive at our clinic. We need this record to provide you with quality care and to comply with legal requirements. This Notice applies to all of the records of your care generated by the clinic.

This Notice tells you about the ways we may use and disclose PHI, your rights, and our obligations regarding the use and disclosure of PHI. We are required by law to:

• Maintain the privacy of your PHI;
• Give you this Notice of our legal duties and privacy practices with respect to PHI;
• Notify you following a breach of unsecured PHI (45 C.F.R. §164.404);
• Abide by the terms of the Notice currently in effect; and
• Comply with Chapter 181 of the Texas Health and Safety Code (the Texas Medical Records Privacy Act, as amended by House Bill 300) and other applicable Texas law.

3. How We May Use and Disclose PHI Without Your Authorization

The following categories describe different ways we may use and disclose PHI. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information will fall within one of the categories.

3.1 Treatment

We may use and disclose your PHI to provide, coordinate, or manage your health care and any related services. For example, we may share PHI with other physicians, specialists, hospitals, laboratories, pharmacies, imaging centers, and home health providers to treat you. We may disclose PHI to a specimen-transport courier (including our affiliated medical courier) for the purpose of moving specimens between our clinic and a laboratory.

Example: A physician treating you for diabetes may need to know whether you have other health problems, and may obtain those records from another provider.

3.2 Payment

We may use and disclose PHI so the treatment and services you receive may be billed to, and payment collected from, you, an insurance company, or a third party. For example, we may need to disclose PHI to your health plan to obtain prior authorization or to determine coverage.

3.3 Health Care Operations

We may use and disclose PHI for our health care operations, including quality assessment and improvement, peer review, credentialing, training of students and staff, licensing, accreditation, auditing, business planning, and management activities.

Example:We may use PHI to review our treatment and services and to evaluate our staff’s performance in caring for you.

4. Uses and Disclosures Requiring an Opportunity to Agree or Object

4.1 Appointment Reminders, Treatment Alternatives, and Health-Related Services

We may contact you to remind you of appointments, to tell you about or recommend possible treatment alternatives, and to tell you about health-related benefits or services that may be of interest to you. You may request that we communicate with you in a particular way or at a particular location (see “Your Rights” below).

4.2 Individuals Involved in Your Care

Unless you object, we may disclose PHI to a family member, a close personal friend, or any other person you identify, if the information is directly relevant to that person’s involvement in your care or payment for your care. We may also disclose PHI to notify such persons of your location, condition, or death.

4.3 Disaster Relief

We may disclose PHI to a public or private entity authorized to assist in disaster-relief efforts.

4.4 Fundraising

Copergrine does not currently engage in fundraising activities that use PHI. If this changes in the future, we will notify you, and you will have the right to opt out of receiving fundraising communications.

5. Uses and Disclosures Requiring Your Written Authorization

Most uses and disclosures of psychotherapy notes, most uses and disclosures of PHI for marketing purposes, and disclosures that constitute a sale of PHI require your written authorization. Other uses and disclosures not described in this Notice will be made only with your written authorization. You may revoke an authorization at any time, in writing, except to the extent we have already relied on it.

Specifically, your written authorization is required for:

• Psychotherapy notes, except for limited uses permitted by 45 C.F.R. §164.508(a)(2)(i).
• Marketing, except face-to-face communications and promotional gifts of nominal value (45 C.F.R. §164.508(a)(3)).
• Sale of PHI (45 C.F.R. §164.508(a)(4)).
• Most uses or disclosures of genetic information for underwriting purposes — prohibited under 45 C.F.R. §164.502(a)(5)(i). We never do this.

Texas HB 300 enhancement.Consistent with Tex. Health & Safety Code Chapter 181, we will not disclose your PHI for marketing purposes or sell your PHI without your express written authorization, which must be separate from any general consent to treatment and must clearly describe the disclosure.

6. Uses and Disclosures Permitted or Required by Law Without Authorization

We may use or disclose PHI without your authorization in the following circumstances, each of which is authorized by 45 C.F.R. §164.512:

• Required by law (§164.512(a)) — federal, state, or local laws that compel disclosure.
• Public health activities (§164.512(b)) — public health authorities for disease prevention, vital statistics, FDA-regulated product tracking, and exposure notification.
• Victims of abuse, neglect, or domestic violence (§164.512(c)) — authorized government authorities.
• Health oversight activities (§164.512(d)) — agencies authorized to audit, investigate, license, or conduct civil or criminal proceedings related to health care.
• Judicial and administrative proceedings (§164.512(e)) — court order, subpoena, or discovery request meeting the Rule’s requirements.
• Law enforcement (§164.512(f)) — limited disclosures to identify or locate a suspect, fugitive, witness, or missing person; victims of crime; or to report a crime on our premises.
• Coroners, medical examiners, and funeral directors (§164.512(g)).
• Organ, eye, and tissue donation (§164.512(h)).
• Research (§164.512(i)) — with Institutional Review Board or Privacy Board approval, or as otherwise permitted.
• To avert a serious threat to health or safety (§164.512(j)).
• Specialized government functions (§164.512(k)) — military and veterans, national security, protective services, inmates.
• Workers’ compensation (§164.512(l)).

Minimum Necessary.When we use or disclose PHI, or request PHI from another covered entity, we will make reasonable efforts to limit the PHI used, disclosed, or requested to the minimum necessary to accomplish the intended purpose, except where the minimum-necessary standard does not apply (for example, to disclosures for treatment). 45 C.F.R. §164.502(b); §164.514(d).

7. Your Rights Regarding Your PHI

You have the following rights with respect to PHI we maintain about you.

7.1 Right to Inspect and Copy

You have the right to inspect and obtain a copy of PHI in our designated record set, including medical and billing records. Your request must be in writing. Under HIPAA, we will respond within thirty (30) days. Under Texas HB 300, if the requested record is maintained in electronic form and you request an electronic copy, we will provide it within fifteen (15) business days of your written request.We may charge a reasonable, cost-based fee as permitted by 45 C.F.R. §164.524(c)(4) and Texas law.

We may deny your request in limited circumstances. If we deny your request, we will tell you in writing and, where required, give you the right to have the denial reviewed by a licensed health care professional.

7.2 Right to Amend

If you believe PHI we maintain about you is incorrect or incomplete, you may ask us to amend it. Your request must be in writing and must state the reason for the amendment. We may deny the request under the limited circumstances set forth in 45 C.F.R. §164.526. If we deny your request, you may submit a written statement of disagreement that we will include with your records.

7.3 Right to an Accounting of Disclosures

You have the right to request an accounting of disclosures of PHI we have made for purposes other than treatment, payment, health care operations, and certain other exceptions. Your request must be in writing and must state a time period up to six years before the request. 45 C.F.R. §164.528.

7.4 Right to Request Restrictions

You have the right to request a restriction on how we use or disclose PHI for treatment, payment, or health care operations, or disclosures to persons involved in your care. We are generally not required to agree to your request. However, we are required to agree if you request that we not disclose PHI to your health plan for a health care item or service that you have paid for out of pocket in full, unless otherwise required by law. 45 C.F.R. §164.522(a)(1)(vi).

7.5 Right to Request Confidential Communications

You have the right to request that we communicate with you about medical matters in a certain way or at a certain location — for example, only at your work telephone or by mail to a post office box. We will accommodate reasonable requests. 45 C.F.R. §164.522(b).

7.6 Right to a Paper Copy of This Notice

You have the right to a paper copy of this Notice, even if you have previously agreed to receive it electronically. You may obtain a copy at our clinic or by contacting our Privacy Officer.

7.7 Right to Be Notified of a Breach

You have the right to be notified following a breach of your unsecured PHI, consistent with 45 C.F.R. §§164.400–414 and, where applicable, Tex. Bus. & Com. Code §521.053. If a breach of system security involves the sensitive personal information of 250 or more Texas residents, we will notify the Texas Attorney General as soon as practicable, and in no event later than 30 days after determining that the breach occurred, using the electronic form accessible on the Attorney General’s website.

7.8 Right to Revoke Authorization

If you have given us an authorization, you may revoke it in writing at any time, except to the extent we have already acted in reliance on it.

8. Texas HB 300 Enhancements

In addition to HIPAA, Copergrine complies with Chapter 181 of the Texas Health and Safety Code (the Texas Medical Records Privacy Act, as amended by House Bill 300), which provides enhanced protections to Texas residents:

• Broader definition of covered entity. Tex. Health & Safety Code Chapter 181 defines a covered entity more broadly than HIPAA, and Copergrine complies as to all PHI it handles in Texas.
• Workforce training. All Copergrine workforce members are trained on applicable state and federal PHI laws within 90 days of hire and at least every two years thereafter, and whenever there is a material change in law.
• 15-day electronic records access, as described in §7.1 above.
• No sale or marketing without express written authorization, as described in §5 above.
• Texas Attorney General breach notification, as described in §7.7 above.
• Enforcement. Violations of Chapter 181 are subject to civil penalties administered by the Texas Attorney General and the applicable Texas licensing agencies.

9. Our Duties

We are required by law to:

• Maintain the privacy of PHI;
• Provide this Notice of our legal duties and privacy practices;
• Abide by the terms of the Notice currently in effect;
• Notify you following a breach of your unsecured PHI; and
• Make available for inspection any amendments to this Notice.

We reserve the right to change this Notice and to make the revised Notice effective for PHI we already have about you as well as any information we receive in the future. The new Notice will be available in the clinic, posted on our website at copergrine.com/hipaa, and provided upon request.

10. Complaints

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer and/or the Secretary of the U.S. Department of Health and Human Services and/or the Texas Attorney General. You will not be retaliated against for filing a complaint.

Copergrine Privacy Officer

Copergrine LLC
13100 Wortham Center Dr, 3rd Floor
Houston, TX 77065
Email: compliance@copergrine.com
Phone: (832) 205-8404

U.S. Department of Health and Human Services, Office for Civil Rights

200 Independence Avenue SW, Room 509F, HHH Building
Washington, DC 20201
Toll-free: 1-800-368-1019 · TDD: 1-800-537-7697
hhs.gov/hipaa/filing-a-complaint

Office of the Attorney General of Texas — Consumer Protection Division

P.O. Box 12548
Austin, Texas 78711-2548
Phone: (800) 621-0508
texasattorneygeneral.gov/consumer-protection/file-consumer-complaint

11. Physical and Website Posting

Consistent with 45 C.F.R. §164.520(c)(2)(iii), a copy of this Notice is prominently posted in our clinic reception area in a manner that patients are likely to see, and it is also posted on our website at copergrine.com/hipaa. A paper copy is available upon request at no charge.

12. Effective Date and Updates

This Notice is effective April 13, 2026. We will promptly revise and distribute this Notice whenever there is a material change to the uses or disclosures, individual rights, our legal duties, or other privacy practices stated in it.