Privacy Notice for K12

This notice is effective as of October 15, 2025

NOTICE OF PRIVACY PRACTICES

This notice describes how medical information about you may be used and disclosed and how you can access this information. Please review it carefully.

INTRODUCTION. The Timely Telehealth Affiliated Professional Entities that are medical groups providing clinical services and work together to support your care and carry out joint activities, such as care coordination, quality improvement and processing your information for purposes like treatment, payment and healthcare operations. The Timely Telehealth Affiliated Professional Entities include: Telehealth Physician Network, a Texas PLLC; Dennington Physician, PLLC, a New York PLLC; Telehealth Physician Network, PLLC, a Michigan PLLC; Telehealth Physician Network, PLLC, a North Dakota PLLC; Telehealth Physician Network, P.C., a California professional corporation; Telehealth Physician Network, P.C., an Alaska professional corporation; and Telehealth Physician Network, P.C., a New Jersey professional corporation.

TimelyTelehealth, LLC and its Affiliated Professional Entities, collectively referred to herein as “TimelyCare”, “we”, “us”, or “our” are dedicated to maintaining the privacy of your Protected Health Information (“PHI”). To the extent any information we collect or use from you is PHI, this Notice of Privacy Practices (“Notice”) applies to you in the specific circumstances explained below. In this Notice, we describe what information we may collect, how such information may be used or shared, and what your rights are with respect to such information. All terms not defined herein are as defined under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (“HIPAA”).

We are required to (i) maintain the privacy of your medical information as required by law; (ii) provide you with this Notice stating our legal duties and privacy practices with respect to your medical information; (iii) abide by the terms of this Notice; and (iv) notify you following a breach of your medical information that is not secured in accordance with certain security standards.

INFORMATION WE COLLECT ABOUT YOU
To provide you with the TimelyCare services, we may collect PHI about you from a few sources, including directly from you. PHI is information about you that may be used to identify you (such as your name), and that relates to:

• Your past, present or future physical or mental health or condition
• The provision of healthcare to you, or
• Your past, present, or future payment for the provision of healthcare.

Any information about you (including PHI) that has been de-identified in accordance with standards established under HIPAA (“De-Identified Data”) is not considered PHI. De-Identified Data is not subject to this Notice and we may use and disclose De-Identified Data for any lawful purpose.

HOW WE MAY USE AND DISCLOSE PHI. We use and disclose the minimum necessary PHI to accomplish the intended purpose of the use and disclosure. Except for the purposes set out here and in the “Special Situations” section, below, we will use and disclose PHI only with your written authorization. These are the ways we may use and disclose your PHI:

• Treatment, Payments, and Health Care Operations. We may use or disclose your PHI for purposes of treatment, payment and health care operations. Examples of such uses are:
  • Treatment Activities. We may use and disclose your PHI to treat you and provide you with behavioral or medical care, and treatment-related services, including the provision, coordination or management of your mental health care. This may include, for example, disclosure of your PHI to facilitate the provision of telehealth visits, consultations between health care providers relating to your care including school health care providers, directors or medical professions who are authorized to access your information, and referrals for health care from one health care provider to another.
  • Payment Activities. We may use and disclose your PHI to obtain payment for services. For example, we may provide your PHI to companies who assist us in obtaining payment for our services. Federal or state law may require us to obtain a written release from you prior to disclosing certain specially protected medical information for payment purposes, and we will ask for your authorization when necessary under applicable law.
• Health Care Operations Purposes. We may use and disclose your PHI to operate our business, improve how services are provisioned, and provide customer service, including for quality assessment activities, employee review activities, communications with and/or about you, training, licensing, and to monitor qualifications of providers and other healthcare activities. We may also share your PHI in connection with certain professional services. For example, we may share your PHI with an insurance company, law firm or risk management organization in order to maintain professional advice about how to manage risk and legal liability, including insurance or legal claims. However, you should know that in these situations, we require such third parties to provide us with contractual assurances that they will safeguard your information.
• Business Associates. We also may need to disclose your PHI to certain of our “business associates” or other third parties that perform services for us if the information is necessary for these services. For example, we may use another company for our billing services. In certain cases, we will provide your PHI to contractors, agents and other parties, such as the onsite/campus medical clinic or counseling center, who may need the information in order to perform a service for us, including, without limitation, Timely Telehealth, LLC, such as obtaining payment for health care services or carrying out business operations. All of our business associates are required to protect the privacy of your PHI and are not allowed to use or disclose any such information except as stated in our contractual agreement with such business associates.
• Electronic Health Information Exchanges. We may also use PHI to participate in electronic health information exchanges (“HIEs”) so that we can share, request, and receive electronic health information from other health care organizations for treatment, payment, and healthcare operations purposes as described above, as well as engage third parties to assist TimelyCare with our payment and healthcare operations in coordination with Affiliated Professional Entities. If required by applicable law, we will request your consent prior to disclosing your information to an HIE and/or inform you of your rights to opt-out or withdraw from participation in an HIE.
• Schedule and Provide Appointment Reminders. To schedule or provide appointment reminders for treatment or medical care.
• Treatment Alternatives and Health-Related Benefits and Services. To tell you about or recommend possible treatment alternatives or other health-related benefits and services that may be of interest to you. Applicable law may require us to seek your authorization before such communications, and we will ask for your authorization when necessary under applicable law.
• Uses and Disclosures Required by Law. We will use or disclose your PHI when required to do so by applicable law.

SPECIAL SITUATIONS. Subject to the requirements of applicable law, there are limited times when we may make the following uses and disclosures of your PHI without authorization, including in for the following:

• To family members or friends who are involved in your medical care or to someone who helps pay for your care. We may also use or disclose your medical information to notify (or assist in notifying) a family member, legally authorized representative or other person responsible for your care of your location, general condition or death. If you are a minor, we may release your medical information to your parents or legal guardians when we are permitted or required to do so under federal and applicable state law.
• For public health activities such as reporting certain diseases and disaster relief efforts
• To protect victims of abuse or neglect, such as child abuse and elder neglect
• For judicial and administrative proceedings such as responding to subpoenas
• For workers compensation claims
• To prevent or lessen a serious and imminent threat of harm to a person or the public
• For state and federal health oversight activities such as healthcare provider licensing and disciplinary action
• To coroners, medical examiners, and funeral directors in limited circumstances
• For organ donation and transplantation
• For research purposes
• For specialized government functions such as national security
• To law enforcement, including in the following circumstances: in response to a court order, warrant, summons or similar process; to identify or locate a suspect, fugitive, material witness, or missing person; to provide information about the victim of a crime under certain limited circumstances; to provide information about a death we believe may be the result of criminal conduct; about criminal conduct on our premises; or in emergency circumstances, to report a crime, the location of the crime or the victims, or the identity, description or location of the person who committed the crime
• As permitted by applicable law and standards of ethical conduct, we may use and disclose medical information if we, in good faith, believe that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public or is necessary for law enforcement authorities to identify or apprehend an individual.
• If you are or become an inmate of a correctional institution or are in the custody of a law enforcement official, we may disclose to the institution or law enforcement official information necessary for the provision of health services to you, your health and safety, the health and safety of other individuals and law enforcement on the premises of the institution and the administration and maintenance of the safety, security and good order of the institution.
• If you are a member of the armed forces, we may release your medical information as required by military command authorities or to the Department of Veterans Affairs. We may also disclose your medical information to authorized federal officials for intelligence and national security purposes to the extent authorized by law.

Note: Under federal and/or state laws, certain information about you may be subject to special protections and in some instances disclosure may be subject to a healthcare provider’s professional judgment (e.g., to protect the safety and wellbeing of you or a third party). Any disclosures of these types of records will be subject to these special protections or restriction.

USES AND DISCLOSURES THAT REQUIRE YOUR AUTHORIZATION. We must obtain your written authorization in situations that are not covered by the above. We also must obtain your written authorization for purposes of marketing, selling your PHI, or certain instances involving psychotherapy notes. We will not use or disclose any of your PHI that contains genetic information that will be used for underwriting purposes. You may take back your authorization in writing at any time. Following receipt of such written notification, we will stop using or disclosing your PHI for such authorized purpose(s), except to the extent we have already taken an action that relies on the use indicated in your authorization.

YOUR RIGHTS. You have the following rights regarding PHI we have about you:

1. Right to Request Restrictions. You have the right to request restrictions on our uses and disclosures of PHI for treatment, payment and health care operations. Please note that, except as required by law, we are not required to agree to your request. To request a restriction, you may make your request in writing to the Privacy Officer.
2. Right to Request Confidential Communication. You have the right to make reasonable requests to receive confidential communications of your medical
   information by alternative means or at alternative locations. To make such a request, you may submit your request in writing to the Privacy Officer.
3. Right to Inspect and Copy. You have the right to inspect and copy your PHI maintained in a designated record set. In order to inspect or obtain a copy of your medical information, you must submit your request in writing to us.. If you request a copy of your PHI or agree to a summary or explanation of such information, we may charge you a reasonable, cost-based fee as permitted by law. We may also deny a request for access to medical information under certain circumstances.
4. Right to Amend PHI. If you believe that your PHI maintained by us is incorrect or incomplete, you have the right to request that we correct or amend such information, subject to certain exceptions under applicable law. In any event, any agreed upon amendment will be included as an addition to, and not a replacement of, already existing records. In order to request an amendment to your medical information, you must submit your request in writing to us, along with a description of the reason for your request.
5. Right to an Accounting of Disclosures. You have the right to request an accounting of disclosures of PHI made by us to individuals or entities other than to you for the six years prior to your request, except for disclosures:

(i) to carry out treatment, payment and health care operations as provided above;
(ii) incidental to a use or disclosure otherwise permitted or required by applicable law;
(iii) pursuant to your written authorization;
(iv) to persons involved in your care or for other notification purposes as provided by law;
(v) for national security or intelligence purposes as provided by law; (vi) to correctional institutions or law enforcement officials as provided by law; (vii) as part of a limited data set as provided by law.

To request an accounting of disclosures of your PHI, you must submit your request in writing to the Privacy Officer identified below. Your request must state a specific time period for the accounting (e.g., the past three months). The first accounting you request within a twelve (12) month period will be free. For additional accountings, we may charge you a reasonable fee for the costs of providing the list. We will notify you of the costs involved, and you may choose to withdraw or modify your request at that time before any costs are incurred.

6. Right to a Paper Copy of This Notice. You have the right to a paper copy of this Notice. You may ask us to give you a copy of this Notice at any time. Even if you have agreed to receive this Notice electronically, you are still entitled to a paper copy of this Notice. You may obtain a copy of this Notice at our website,
www.timelycare.com, or by contacting the Privacy Officer identified below.

CHANGES TO THIS NOTICE. We reserve the right to change this Notice. We reserve the right to make the revised or changed notice effective for all PHI we maintain about you, including the PHI we already have about you and any PHI we receive in the future. We will post a copy of the current Notice on our website at www.timelycare.com.

COMPLAINTS. If you believe that your privacy rights have been violated, you may file a complaint with our office or with the Secretary of the Department of Health and Human Services. To file a complaint with our office, contact: Privacy Officer, TimelyCare, 1315 S. Adams St. Fort Worth, TX 76104 or email to [email protected]. All complaints made to our office must be made in writing. We will not retaliate against you for filing a complaint.

CONTACT PERSON. If you have any questions or would like further information about this notice, please contact our Privacy Officer at [email protected], and phone number at 1-833-484-6359.