HIPAA Notice of Privacy Practices

This Notice is provided by My Orbit Health, LLC ("My Orbit Health"), the licensed telehealth medical practice that provides clinical services to patients enrolled through Kingdom Longevity Labs. My Orbit Health is the HIPAA covered entity responsible for your protected health information (PHI). Kingdom Longevity Labs LLC operates the enrollment platform and website; it is not a healthcare provider and does not receive PHI except as a limited business associate for enrollment, scheduling, and billing support.

1. Who This Notice Covers

This Notice applies to all patients who receive medical evaluation, consultation, prescription, or ongoing care through My Orbit Health's telehealth platform, including patients enrolled through Kingdom Longevity Labs. It describes how My Orbit Health and the independent physicians and clinicians practicing through its platform may use and share your PHI, and your legal rights under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and applicable state law.

2. Our Pledge Regarding Your Health Information

My Orbit Health is required by law to:

• Maintain the privacy and security of your PHI.
• Provide you with this Notice of our legal duties and privacy practices with respect to your PHI.
• Abide by the terms of this Notice currently in effect.
• Notify you following a breach of unsecured PHI, as required by applicable law.

3. How We May Use and Disclose Your PHI

The following categories describe different ways that My Orbit Health may use and disclose your PHI without your specific written authorization. Not every use or disclosure in a category is listed, but all permitted uses and disclosures will fall within one of these categories.

Treatment

We use and share your PHI to provide, coordinate, and manage your healthcare. For example, a physician practicing through My Orbit Health may review your intake responses, lab results, and medical history to determine whether a particular medication is appropriate for you, and may share information with a licensed compounding pharmacy (such as RxHQ in Olympia, Washington) to dispense your prescription.

Payment

We use and share your PHI to bill for your care and collect payment. This may include verifying payment authorization with our payment processor (Stripe), sharing the minimum necessary information with the dispensing pharmacy for which the payment applies, and using information to determine eligibility for services.

Healthcare Operations

We use and share your PHI to run our practice, improve your care, and contact you when necessary. Examples include quality assessment, clinician training and credentialing review, regulatory compliance, accreditation, and activities to improve treatment outcomes.

Appointment Reminders and Care Communications

We may use your PHI to contact you with appointment reminders, follow-up prompts, refill notifications, and program updates — by email, portal message, or SMS, subject to your communication preferences. See our Electronic Communications Consent and SMS Terms for details on how these messages work and how to opt out.

Individuals Involved in Your Care

With your permission, we may share information with a family member, personal representative, or other person you designate as relevant to their involvement in your care.

As Required by Law

We will disclose your PHI when required to do so by federal, state, or local law — including, for example, reporting to state medical and pharmacy boards, the U.S. Drug Enforcement Administration, or public health authorities for purposes authorized by law.

Public Health, Safety, and Oversight

We may disclose your PHI for public health activities (such as disease reporting, adverse drug event reporting to the FDA), health oversight activities (such as audits and investigations), and to prevent or lessen a serious and imminent threat to health or safety.

Judicial and Administrative Proceedings, Law Enforcement

We may disclose your PHI in response to a valid court order, subpoena, or other lawful process, and to law enforcement in limited circumstances permitted by HIPAA.

Business Associates

We contract with third parties — our "business associates" — to perform certain services on our behalf, such as the enrollment platform operated by Kingdom Longevity Labs, electronic medical record hosting, secure communications, e-prescribing, and billing. These business associates are bound by written agreements to protect your PHI to the same standards required of My Orbit Health.

4. Uses and Disclosures That Require Your Written Authorization

Uses and disclosures not described in this Notice will be made only with your written authorization. This includes:

• Most uses and disclosures of psychotherapy notes (if any exist).
• Uses and disclosures of PHI for marketing purposes.
• Disclosures that constitute a sale of PHI.

You may revoke your authorization in writing at any time, except to the extent we have already acted in reliance on it.

5. Your Rights Regarding Your PHI

You have the following rights with respect to PHI that My Orbit Health maintains about you:

Right to Access

You have the right to inspect and obtain a copy of your medical record and billing record, in paper or electronic form. Requests may be submitted through the patient portal or to the HIPAA Privacy Officer using the contact information below. We may charge a reasonable, cost-based fee for copies as permitted by law.

Right to Amend

You have the right to request an amendment of your PHI if you believe it is incorrect or incomplete. Requests must be made in writing and include a reason supporting the request. We may deny the request in certain circumstances and will provide a written explanation.

Right to an Accounting of Disclosures

You have the right to request an accounting of certain disclosures we have made of your PHI, generally for disclosures made within the six (6) years prior to the date of your request, excluding disclosures made for treatment, payment, or healthcare operations and certain other categories.

Right to Request Restrictions

You have the right to request a restriction on how we use or disclose your PHI for treatment, payment, or healthcare operations, or to individuals involved in your care. We are not required to agree, except that we must agree to restrict disclosure of PHI to a health plan for payment or healthcare operations when you have paid for the related item or service in full out-of-pocket.

Right to Confidential Communications

You have the right to request that we communicate with you about medical matters in a certain way or at a certain location (for example, by mail to a specific address, or only through the patient portal).

Right to a Paper Copy of This Notice

You have the right to receive a paper copy of this Notice upon request, even if you have agreed to receive it electronically.

Right to Notification of a Breach

You have the right to be notified following a breach of your unsecured PHI, as required by the HIPAA Breach Notification Rule.

6. How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with My Orbit Health's HIPAA Privacy Officer using the contact information below. You may also file a complaint directly with the U.S. Department of Health and Human Services, Office for Civil Rights:

We will not retaliate against you for filing a complaint.

7. Changes to This Notice

My Orbit Health reserves the right to change the terms of this Notice and make the new provisions effective for all PHI it maintains. When a material change is made, the revised Notice will be posted on our website and made available through the patient portal. The effective date will appear at the top of this page.

8. Contact — HIPAA Privacy Officer

For questions about this Notice, to make requests regarding your PHI, or to file a complaint, contact the HIPAA Privacy Officer at My Orbit Health: