Notice of Privacy Practices

"Protected Health Information" or "PHI" is individually identifiable health information about you, including demographic information, that relates to your past, present, or future physical or mental health or condition, the provision of health care to you, or payment for that care, and that is created, received, maintained, or transmitted in connection with services arranged through Onnova Pharma Rx.

This Notice applies to Onnova Pharma Rx and its affiliated clinical and pharmacy partners, including the licensed providers of LocumTele and the dispensing pharmacy Rush Pharmacy, to the extent they create or receive PHI in connection with your care.

We are required by law, including the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations, to:

• Maintain the privacy and security of your PHI.
• Provide you with this Notice of our legal duties and privacy practices with respect to your PHI.
• Follow the terms of the Notice currently in effect.
• Notify you promptly if a breach occurs that may have compromised the privacy or security of your unsecured PHI.
• Not use or share your PHI other than as described in this Notice unless you authorize it in writing. You may revoke an authorization in writing at any time, except to the extent we have already relied on it.

We reserve the right to change this Notice and to make the new Notice effective for all PHI we maintain. Updated notices will be posted on this website with a revised effective date and are available upon request.

We may use and disclose your PHI without your written authorization for the following purposes:

• Treatment. To provide, coordinate, or manage your care, such as sharing intake information with a licensed provider who evaluates you, or sending a prescription to the pharmacy that dispenses it.
• Payment. To bill and collect payment for services and medications, and to verify eligibility or process refunds.
• Health care operations. To run our services, including quality assessment, provider credentialing, compliance reviews, training, customer support, and business planning.
• Business associates. To vendors that perform services on our behalf (for example, secure hosting, telehealth software, or shipping) under written agreements requiring them to protect your PHI.
• Communications with you. To send appointment, refill, shipping, and treatment reminders, and information about treatment alternatives or health-related services.
• Individuals involved in your care. To a family member or other person you identify who is involved in your care or payment, unless you object.
• As required by law. When federal, state, or local law requires it.
• Public health and safety. To report adverse drug reactions or product problems to the FDA, prevent or control disease, or avert a serious threat to health or safety.
• Health oversight. To agencies for audits, investigations, inspections, and licensure activities.
• Legal proceedings. In response to a court or administrative order, subpoena, or other lawful process.
• Law enforcement. For limited law enforcement purposes permitted by law.
• Abuse, neglect, or domestic violence. To appropriate authorities as required or permitted by law.
• Specialized government functions, workers' compensation, coroners, and research as permitted by HIPAA and applicable law.

Uses requiring your written authorization. We will not use or disclose your PHI for marketing purposes, sell your PHI, or use or disclose psychotherapy notes without your written authorization. Other uses not described in this Notice will be made only with your written authorization. Some state laws provide additional protections for sensitive information (such as mental health, substance use disorder, HIV, or genetic information), and we will follow those laws where they apply.

You have the following rights with respect to your PHI:

• Right to inspect and copy. You may request to see or obtain a copy (paper or electronic) of your medical and billing records. We will respond within 30 days and may charge a reasonable, cost-based fee.
• Right to amend. If you believe information in your record is incorrect or incomplete, you may request an amendment in writing and explain the reason. We may deny the request in certain cases and will tell you why in writing; you may then submit a statement of disagreement.
• Right to an accounting of disclosures. You may request a list of certain disclosures of your PHI made in the six years before your request, other than for treatment, payment, operations, and certain other purposes. One accounting per 12 months is free.
• Right to request restrictions. You may ask us to limit how we use or share your PHI for treatment, payment, or operations. We are not required to agree, except that we must agree not to share information with a health plan for payment or operations if you paid for the item or service out of pocket in full.
• Right to request confidential communications. You may ask that we contact you in a specific way (for example, a particular phone number or email) or at a different address. We will accommodate reasonable requests.
• Right to a paper copy of this Notice. You may request a paper copy at any time, even if you agreed to receive it electronically.
• Right to choose someone to act for you. A person with medical power of attorney or legal guardianship may exercise your rights. We will verify their authority before acting.
• Right to be notified of a breach of your unsecured PHI.

To exercise any of the rights above, submit a written request through the secure messaging feature of the patient portal addressed to the Privacy Officer, or through the contact method listed on our Contact & Disclosures page. Please include your full name, date of birth, the right you wish to exercise, and the specific records or details involved. We will verify your identity before fulfilling any request and respond within the time frames required by law.

If you believe your privacy rights have been violated, you may file a complaint with us by contacting our Privacy Officer through the patient portal or the contact method on our Contact & Disclosures page. Please describe what happened and the date it occurred.

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, by mail at 200 Independence Avenue, S.W., Washington, D.C. 20201, by phone at 1-877-696-6775, or online at www.hhs.gov/ocr/complaints.

We will not retaliate against you for filing a complaint.

This Notice is effective as of September 26, 2026.