Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

I. Who We Are

AA Health Solutions, LLC, doing business as Evolve Your Bod (“Evolve,” “we,” “our,” or “us”), operates as a Management Services Organization (MSO) and healthcare coordination platform. Evolve partners with independent, licensed healthcare professionals, medical groups, and partner clinics to coordinate healthcare services across four care models: Telehealth (TH), In-Person Visits (IPV), Hybrid Consult + IV Therapy (Hybrid), and Mobile IV Therapy (Mobile IV).

Evolve does not directly practice medicine, prescribe medications, or provide clinical care. All medical services are rendered by independent, licensed healthcare providers and medical groups.

This Notice of Privacy Practices (“Notice”) outlines how Evolve Your Bod and its affiliated healthcare professionals collect, use, share, and safeguard your Protected Health Information (PHI) in accordance with the Health Insurance Portability and Accountability Act (HIPAA), the Texas Medical Records Privacy Act (Health & Safety Code Chapter 181), and other applicable federal and state laws.

This is the sole, authoritative Notice of Privacy Practices for Evolve Your Bod. It supersedes any prior versions, including any abbreviated notice that may have previously appeared on the HIPAA Compliance page of our website.

II. Our Legal Responsibilities

We are legally required to:

– Maintain the privacy of your Protected Health Information (PHI).

– Provide you with this Notice explaining our legal duties and privacy practices.

– Follow the terms of this Notice currently in effect.

– Notify you if a breach of unsecured PHI occurs that may have compromised the privacy or security of your information. We will provide breach notification as required by HIPAA and applicable state law, including the identity of the information involved, what we are doing in response, and what you can do to protect yourself.

III. How Your Information May Be Used or Shared Without Your Written Authorization

Certain uses and disclosures of PHI do not require your written permission. These include the following:

A. Treatment

We may use and disclose your PHI to provide, coordinate, and manage your healthcare. This includes sharing information with healthcare providers, medical groups, partner clinics, satellite site clinical staff, mobile IV nurses, pharmacies, and laboratories involved in your care. The specific entities that receive your PHI depend on your care model:

– Telehealth (TH): Your PHI may be shared with the affiliated Medical Group and assigned remote provider for your telehealth consultation, and with licensed pharmacies for prescription fulfillment.

– In-Person Visits (IPV): Your PHI may be shared with the partner clinic and its affiliated providers where your visit takes place, and with pharmacies and laboratories as clinically appropriate.

– Hybrid (Consult + IV): Your PHI may be shared with the satellite/facilitating site, on-site clinical staff (such as registered nurses), the rendering Medical Group and remote physician, and with pharmacies and laboratories. On-site staff receive relevant information for vitals collection, intake facilitation, and IV therapy administration under physician direction.

– Mobile IV: Your PHI may be shared with the rendering Medical Group, the ordering physician, and the licensed mobile nurse traveling to your location for IV administration.

Your PHI may also be shared with other healthcare professionals involved in your care, including specialists to whom you may be referred.

B. Payment

We may use and disclose your PHI to process payment for healthcare services. This includes:

– Processing cash-pay transactions for telehealth services.

– For IPV, Hybrid, and Mobile IV services: verifying insurance eligibility, submitting claims, processing pre-authorizations, and coordinating benefits with your insurance carrier or payer. Insurance billing may be performed by the rendering provider, the partner clinic, or by Evolve Your Bod acting as a billing agent on behalf of the rendering provider under a Management Services Agreement.

– Processing copays, deductibles, coinsurance, and patient-responsibility balances.

– Communicating with third-party payment processors to facilitate secure transactions.

C. Healthcare Operations

We may use and disclose your PHI for healthcare operations, including:

– Quality assurance, clinical audits, and performance improvement activities.

– Training and credentialing of healthcare providers.

– Internal reviews, compliance activities, and business planning.

– For telehealth services, maintaining the security and integrity of the HIPAA-compliant telehealth platform.

D. Disclosures to Family Members, Caregivers, or Trusted Individuals

If you are present and capable, we may share your PHI with a family member, friend, or caregiver involved in your care, provided you agree to the disclosure, you are given the chance to object and do not do so, or we reasonably determine you do not object. If you are unavailable due to an emergency or incapacity, we may disclose PHI when, in our professional judgment, it is in your best interest. We will only share information relevant to their involvement in your care or payment of services.

E. Public Health and Safety

We may share your PHI when required by law to report diseases, injuries, or conditions to public health authorities; notify government agencies about child abuse, neglect, or domestic violence; comply with Food and Drug Administration (FDA) reporting requirements; or alert individuals who may have been exposed to contagious diseases.

F. Victims of Abuse or Domestic Violence

If we reasonably believe you are a victim of abuse or neglect, we may share your PHI with government agencies authorized to intervene, if you agree or if disclosure is required or permitted by law.

G. Government Oversight and Compliance

Your PHI may be disclosed to regulatory agencies responsible for overseeing healthcare operations, including those enforcing Medicare, Medicaid, FDA, or other regulatory compliance.

H. Legal and Judicial Requests

We may provide PHI if required by a court order, subpoena, or other valid legal process.

I. Law Enforcement

We may share PHI with law enforcement officials when required by law, needed to identify or locate a suspect, witness, or missing person, or when investigating criminal activity.

J. Decedents

We may release PHI to coroners, medical examiners, or funeral directors as needed after death.

K. Research

We may use or disclose PHI for research purposes, provided an Institutional Review Board (IRB) or Privacy Board approves the request in accordance with applicable privacy laws.

L. Serious Threats to Health or Safety

We may disclose PHI to prevent or reduce serious threats to public health or individual safety when we believe in good faith that disclosure is necessary.

M. Military and National Security

Your PHI may be disclosed to government agencies for military, intelligence, or security-related activities when authorized by law.

N. Workers’ Compensation

If you are injured at work, we may disclose PHI as necessary to comply with workers’ compensation laws.

O. Other Legally Required Disclosures

We may share PHI when required by other applicable federal, state, or local laws not described above.

IV. Situations Requiring Your Written Authorization

Some uses and disclosures of your PHI require your signed written authorization. These include:

A. Marketing and Sale of Health Information

We will not sell your PHI or use it for marketing purposes without your written permission, unless permitted by law (for example, face-to-face communications or promotional gifts of nominal value).

B. Highly Sensitive Information

Certain categories of PHI receive additional legal protection under federal and/or state law, including mental health records, substance use treatment details, HIV/AIDS status, sexually transmitted infections (STIs), genetic testing results, and reports of abuse or neglect. We will not share this information without your explicit written consent unless required by law.

C. PHI / Data-Sharing Authorization

As part of your intake process with Evolve Your Bod, you will be asked to sign a standalone PHI / Data-Sharing Authorization that provides your explicit consent for Evolve to share your health information with the specific entities involved in your care across all care models. That Authorization supplements this Notice and provides additional detail on data flows, authorized recipients, and your rights to revoke.

V. Your Right to Revoke Authorization

You may revoke any written authorization at any time by submitting a request in writing to info@evolveyourbod.com with the subject line “Revocation of Authorization.” Your revocation will take effect upon receipt, except to the extent that we have already taken action in reliance on the authorization prior to receiving your revocation.

VI. Your Rights Regarding Your Health Information

Under HIPAA and applicable state law, you have the following rights:

A. Right to Request Restrictions

You may request limits on how we use or share your PHI. We are not always required to agree to your request, except where the disclosure is to a health plan for payment or healthcare operations purposes and the PHI pertains to a service for which you have paid out-of-pocket in full.

B. Right to Confidential Communications

You may request to receive communications about your PHI at an alternative address, phone number, or email. We will accommodate reasonable requests.

C. Right to Access and Inspect Your Records

You have the right to request access to and obtain copies of your medical and billing records maintained by Evolve Your Bod or its affiliated providers. We may charge a reasonable, cost-based fee for copies. If access is denied in limited circumstances permitted by law, we will provide a written explanation and information about your right to have the denial reviewed.

D. Right to Request Amendment

If you believe your PHI is incorrect or incomplete, you may request an amendment. We may deny the request in certain circumstances (for example, if the information was not created by us, or if we believe the information is already accurate and complete) but will provide a written explanation of the denial.

E. Right to an Accounting of Disclosures

You have the right to request a list (accounting) of certain disclosures of your PHI made during the six years prior to your request. This accounting does not include disclosures made for treatment, payment, or healthcare operations, or disclosures you authorized in writing.

F. Right to a Copy of This Notice

You may request a paper or electronic copy of this Notice of Privacy Practices at any time, even if you have previously received a copy. The current version is always available at evolveyourbod.com/notice-of-privacy-practices.

G. Right to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with Evolve Your Bod or directly with the U.S. Department of Health and Human Services Office for Civil Rights. You may also file a complaint with the Texas Attorney General’s office under the Texas Medical Records Privacy Act. We will not retaliate against you for filing a complaint.

VII. Texas-Specific Privacy Protections

Under the Texas Medical Records Privacy Act (Health & Safety Code Chapter 181), your health information is confidential and may only be disclosed as authorized by you or as permitted by law. Texas law provides additional protections for certain types of health information, including mental health records and substance abuse treatment records. If Texas law provides greater protection than HIPAA for a particular type of information or disclosure, the more protective standard applies.

Under Texas law, you have the right to receive a notice of a privacy breach affecting your health information. Evolve Your Bod will comply with all applicable Texas breach notification requirements in addition to federal HIPAA requirements.

VIII. Changes to This Notice

We may update this Notice at any time. The revised version will apply to all PHI we maintain, including information collected before the change. The latest version will always be available on our website at evolveyourbod.com/notice-of-privacy-practices. Material changes will be communicated to active patients.

IX. Relationship to Other Privacy Documents

Evolve Your Bod maintains several privacy-related documents that work together to protect your information:

– This Notice of Privacy Practices governs how your PHI is used and disclosed for treatment, payment, and healthcare operations under HIPAA.

– The Privacy Policy (evolveyourbod.com/privacy-policy) governs the collection and use of personal information by Evolve as a technology platform, including website data, account information, and marketing data.

– The PHI / Data-Sharing Authorization is a signed consent document that provides your explicit authorization for Evolve to share your health information with the specific entities involved in your care.

– The California Privacy Notice (evolveyourbod.com/california-consumer-privacy-act-ccpa-privacy-notice) provides additional privacy rights for California residents under the CCPA/CPRA. Health information governed by HIPAA is exempt from the CCPA.

Where HIPAA applies, this Notice and the PHI Authorization govern. Where HIPAA does not apply, the Privacy Policy governs. In all cases, the most protective standard applies.

X. Contact Information

For privacy-related concerns, questions about this Notice, or to exercise your rights, please contact:

Evolve Your Bod — Privacy Office

AA Health Solutions, LLC

5521 Bellaire Drive South, Suite 200

Fort Worth, TX 76109

Email: info@evolveyourbod.com (Subject: Attn: Privacy Office)

Phone: 866-301-3141

To file a complaint with the U.S. Department of Health and Human Services:

Office for Civil Rights, U.S. Department of Health and Human Services

200 Independence Avenue, S.W., Washington, D.C. 20201

Toll-free: 1-877-696-6775 | Website: www.hhs.gov/ocr/privacy/hipaa/complaints/

To file a complaint under Texas law:

Office of the Attorney General of Texas

Consumer Protection Division, P.O. Box 12548, Austin, TX 78711-2548

Toll-free: 1-800-252-8011 | Website: www.texasattorneygeneral.gov