HIPAA Notice of Privacy Practices

Alpine Digital Health, Inc. ("Alpine," "we," "us," or "our") is committed to protecting the privacy of your health information. We are required by law to:

• Maintain the privacy of your Protected Health Information (PHI)
• Provide you with this Notice of our legal duties and privacy practices
• Follow the terms of the Notice currently in effect
• Notify you if we are unable to agree to a requested restriction on how we use or disclose your PHI

This Notice applies to all health information created, received, maintained, or transmitted by Alpine through the Arc and Arc Care services.

Protected Health Information is information about you, including demographic information, that may identify you and relates to:

• Your past, present, or future physical or mental health or condition
• The provision of health care to you
• Payment for the provision of health care to you

We may use and disclose your PHI without your written authorization for the following purposes:

Treatment

We use and disclose your health information to facilitate your medical treatment and care coordination. Examples include:

• Provider Communication: Sharing your health information with your healthcare provider
• Care Coordination: Enabling communication between healthcare professionals involved in your care
• AI-Assisted Care: Using your health information to generate personalized communications and care plans

Payment

We may use and disclose your health information to support payment and billing activities.

Healthcare Operations

We may use and disclose your health information for our healthcare operations and business activities.

For uses and disclosures beyond treatment, payment, and healthcare operations, we will obtain your written authorization. These include:

• Marketing Communications: Using your health information for marketing purposes
• Sale of PHI: Selling your health information (we do not sell your health information)
• Other Purposes: Any other use or disclosure not described in this Notice

You have the right to revoke your authorization at any time by submitting a written request.

In certain situations, we may use or disclose your health information without your authorization:

• Required by Law: When required by federal, state, or local law
• Public Health Activities: For disease reporting, adverse reaction reports
• Health Oversight Activities: For audits, investigations, inspections
• Judicial and Administrative Proceedings: In response to court orders
• Law Enforcement: As required by law enforcement officials
• Serious Threat to Health or Safety: When necessary to prevent serious threats

You have the following rights regarding your health information:

To exercise any of the rights described above, please contact our Privacy Officer:

We reserve the right to change this Notice at any time. We will post the current Notice on our website and in the Arc app.

If you believe your privacy rights have been violated, you have the right to file a complaint.

How to file a complaint with us:

• Submit a written complaint to our Privacy Officer
• Send an email to privacy@alpine.healthcare

How to file a complaint with the federal government:

• U.S. Department of Health and Human Services
• Office for Civil Rights
• Website: www.hhs.gov/ocr/privacy/hipaa/complaints/

If you have questions about this Notice or need more information, please contact: