Notice of Privacy Practices

— Our Commitment to Your Privacy

Go Clinic MD LLC., its affiliates and wholly owned subsidiaries make up an organized health care arrangement. Go Clinic MD is a clinically integrated care setting in which our members receive health care ("Services") from more than one health care provider. In addition, we are an organized health care system that jointly participates in numerous activities including quality assessment and improvement activities.

Go Clinic MD respects and is committed to protecting the privacy of your medical information. In performing its services, Go Clinic MD will receive, create, and disclose your protected health information ("PHI"). Go Clinic MD is required by law to maintain the privacy and security of your PHI and to provide you with notice of our legal duties and privacy practices with respect to your PHI. For information about our collection, use, and disclosure of personal information other than PHI, please see our Privacy Policy.

Your Information. Your Rights. Our Responsibilities.

In this Notice, we describe:

• Information We Collect About You
• When We Use and Share Your Information
• When We Must Share Your Information
• When We Need Your Authorization to Use or Share Your Information
• Your Rights Regarding Your Information
• How We Keep Your Information Safe
• Changes to the Terms of This Notice

— 1. Information We Collect About You

To provide you with the Go Clinic MD Services, we collect PHI about you from a few sources including directly from you. PHI is information about you that may be used to identify you (such as your name), and that relates to:

• Your past, present or future physical or mental health or condition,
• The provision of healthcare to you, or
• Your past, present, or future payment for the provision of healthcare.

PHI Collected From You

As you use the Go Clinic MD Services you will need to provide Go Clinic MD with information about yourself and your medical history, past treatment, and potential future treatment options. As you communicate with us, your telephone calls, emails, and other communications between you and Go Clinic MD and/or Go Clinic MD's service providers, may be recorded and logged. As such, we will collect and maintain all information discussed during such communications including your identity, the date and time of the communication, and the contents of the communications.

PHI Collected from Third Parties

In connection with the Go Clinic MD Services, we may collect information about you from third parties such as past or current health care providers, health insurance and pharmacy benefit management companies. Your employer or other organization that has contracted with Go Clinic MD to give you access to the Services may provide us with your name and demographic information, so we know you are eligible for the Services.

PHI Collected Automatically

When you register and log in to our secure websites and mobile apps, Go Clinic MD automatically collects information about you, including: IP address, device information, general geographic information, and dates and times you accessed and used the secure websites/mobile apps, features you used, and how long you use the secure websites/mobile apps.

— 2. When We Use and Share Your Information

To provide you with the Services, we will need to use and disclose your PHI for the following reasons:

Treatment Activities

We will use your PHI within Go Clinic MD to treat you and provide you with medical services. We may also disclose your PHI to other physicians or healthcare providers so that they can treat you. For example, electronic prescriptions written by Go Clinic MD may be available to your treating physician to ensure your quality of care.

Payment Activities

We can use and share your PHI to get paid and for other payment activities. For example, we will send PHI to your assignees to get paid. We may share PHI with other entities covered by HIPAA, such as health plans, for their payment activities.

Healthcare Operations Purposes

Go Clinic MD may use and disclose your PHI to run our business — for example, to improve medical services, provide customer service, conduct quality review, contact you about the Services available to you and health benefits, and monitor the qualifications of providers.

We may also use PHI to:

• Participate in health information exchanges (HIEs) so that we can share, request, and receive electronic health information from other health care organizations for treatment, payment, and healthcare operations purposes.
• Engage third parties to assist Go Clinic MD with our payment and healthcare operations. If any such third party needs access to PHI to perform its services on behalf of Go Clinic MD, Go Clinic MD will require that third party to enter a written agreement that protects the PHI.
• Communicate with family and friends who are involved in your care and payment for care.
• Create deidentified and aggregate information.

— 3. When We Must Share Your Information

There are limited times when Go Clinic MD may be permitted or required by law to use or disclose your PHI without your authorization. These include the following:

• For public health activities such as reporting certain diseases
• To protect victims of abuse or neglect, such as child abuse and elder neglect
• For judicial and administrative proceedings such as responding to subpoenas
• For workers compensation claims
• To prevent or lessen a serious and imminent threat of harm to a person or the public
• When required by law or for law enforcement purposes
• For state and federal health oversight activities such as physician licensing and disciplinary action
• To coroners, medical examiners, and funeral directors in limited circumstances
• For organ donation and transplantation
• For research approved by an institutional review board
• For specialized government functions such as national security

— 4. When We Need Your Authorization

Go Clinic MD will not share your PHI for other purposes not described in this Notice unless you give us your written permission. For instance, your written authorization is needed prior to us using and disclosing your PHI:

• For marketing purposes
• For a sale of your PHI
• For fundraising purposes
• To your employer

If Go Clinic MD wants to use or disclose your PHI for the purposes listed above or for any other purpose not described in this Notice, we will seek your authorization using the HIPAA Authorization to Disclose Protected Health Information Form found here. You have the right to revoke any authorization that you previously provided.

— 5. Your Rights Regarding Your PHI

You have the following rights regarding your PHI maintained by Go Clinic MD. Additionally, your medical power of attorney or legal guardian can exercise these rights on your behalf and make choices about your health information.

Right to Access PHI

Most of your PHI that Go Clinic MD maintains is available to you directly on the Member Portal. To request access to information that is not available online, you must submit your request in writing to Go Clinic MD using our Webform found here. Go Clinic MD may impose a fee for the costs related to copying and mailing.

Right to Request Amendment of PHI

You have a right to request that Go Clinic MD amend your PHI if you believe it is incorrect. To request an amendment you cannot make yourself online, submit your request in writing using our Webform found here. If Go Clinic MD denies your request, you will be permitted to submit a statement of disagreement for inclusion in your records.

Right to Request Restrictions on Uses and Disclosures of PHI

You have the right to request that Go Clinic MD not use or disclose your PHI for treatment, payment, or healthcare operations purposes. To request a restriction, submit your request in writing using our Webform found here. Go Clinic MD is not required to agree to your request unless you are requesting that we not disclose your PHI to your insurance company or health plan, in which case you will be required to pay for services out of pocket.

Right to Request Confidential Communication

You may request that Go Clinic MD communicate with you through alternate means or at an alternate location. To request confidential communications, submit your request in writing using our Webform found here. Go Clinic MD is not required to agree to your request, however we will use best efforts to agree to reasonable requests.

Right to Request an Accounting of Disclosures

You have a right to receive an accounting of disclosures Go Clinic MD has made of your PHI. To request an accounting of disclosures, submit your request in writing using our Webform found here. Your right to an accounting does not include disclosures made for treatment, payment or healthcare operations. Your first accounting will be free of charge.

You also have the right to:

1. Obtain a paper copy of this Notice from Go Clinic MD at any time upon request;
2. File a complaint with Go Clinic MD and/or the Secretary of Health and Human Services at www.hhs.gov/ocr/privacy/hipaa/complaints/ if you believe that your privacy rights have been violated; and
3. Obtain more information about Go Clinic MD's privacy practices by contacting the Privacy Officer below.

Privacy Officer — Go Clinic MD
1846 E Innovation Park Dr #100
Oro Valley, AZ 85755
[email protected]
(602) 730-6232

— 6. How We Keep Your PHI Safe

The security of your PHI is very important to us. We use administrative, technical, and physical safeguards to keep your PHI from unauthorized access, and other threats and hazards to its security and integrity. We base our security program on complying with state and federal law, including the HIPAA Security Regulations, as well as industry best practices. More specifically, we protect the confidentiality of your PHI in the following ways:

• Our databases are encrypted at both the volume layer (physical) as well as within the database columns themselves.
• Access to our databases is tightly controlled and is only allowed to a small subset of technical administrators.
• On a quarterly basis, access reviews are performed to certify staff roles are still appropriately assigned. Our employees are trained on an annual basis on how to maintain the privacy and security of our members' information.

If your unsecured PHI is disclosed to an unauthorized person, despite our security safeguards, we will notify you promptly if such disclosure may have compromised the privacy or security of the PHI.

— 7. Changes to This Notice

Go Clinic MD reserves the right to change the terms of this Notice at any time, as long as the changes are in compliance with applicable laws. If Go Clinic MD changes the terms of this Notice, the new terms will apply to all PHI that it maintains. If Go Clinic MD changes this Notice, it will post the new Notice on its website and will make the new Notice available upon request.