Notice of Privacy Practices

Zira Medical LLC (“Zira,” “we,” “us,” or “our”) is a network of licensed clinicians — physicians, nurse practitioners, and physician assistants — licensed in all 50 states and the District of Columbia. A Zira clinician reviewed your information and, if clinically appropriate, prescribed your treatment.

Zira is only a clinician network. We do not operate the website or app where you signed up, we do not run the pharmacy that fills your prescription, and we do not sell or operate any software. You reached us through a digital health platform (the “Platform”), which is a separate company.

This Notice covers the health information Zira’s clinicians create, receive, and maintain about you. The Platform has its own privacy policy covering the information you gave it, and the pharmacy has its own. If you are unsure which company holds a piece of information, ask us and we will help you find it.

We are required by law to:

• keep your protected health information (“PHI”) private;
• give you this Notice describing our legal duties and privacy practices;
• follow the terms of the Notice currently in effect; and
• notify you if a breach occurs that may have compromised the privacy or security of your information.

Zira’s clinicians document your care in the electronic health record system operated by the Platform you signed up with, rather than in a separate Zira system. Where the Platform or its vendors hold your health information on our behalf, they are required by written agreement to protect it and to use it only as permitted.

This does not reduce your rights. If you want your records, want them corrected, or want to know how they have been shared, you can come directly to us using the contact information at the end of this Notice. We will obtain the information from the system where it is kept and respond within the deadlines described below. You may also be able to get your records faster directly from the Platform.

For treatment. We use your information to evaluate you and provide care, and share it with others involved in your care. For example, we send your prescription and the details the pharmacy needs to the dispensing pharmacy, and we may share information with a clinician we refer you to or with your primary care provider at your request.

For payment. Zira is paid by the Platform that arranged your consultation, or in some cases directly by you, on a private-pay basis. What we share for payment is generally limited to confirming that a consultation was completed. We do not bill Medicare, Medicaid, TRICARE, or commercial insurance, and we do not submit claims on your behalf.

For health care operations. We use your information to run our practice — reviewing the quality of care our clinicians deliver, evaluating clinician performance, credentialing and training, resolving complaints, arranging legal and auditing services, and managing our business.

With our business associates. We work with companies that perform functions for us, including the Platform and its record system where your care is documented, e-prescribing services, communications providers, and our professional advisors. Each is bound by written agreement to safeguard your information and use it only as permitted.

For appointment reminders and health-related communications. We may contact you by email, text message, or telephone with reminders, follow-up instructions, refill notices, lab or monitoring reminders, and information about treatment alternatives or other health-related services that may interest you. Message and data rates may apply, and email and text are not fully secure. You may ask us to stop, or to use a different method — see “Your Rights.”

Because the law requires it. We disclose information when federal, state, or local law requires it.

For public health and safety. We may disclose information to public health authorities to prevent or control disease, injury, or disability; to report births and deaths; to report medication reactions or product problems to the FDA; to notify people who may have been exposed to a disease; and to report suspected abuse, neglect, or domestic violence as required or permitted by law. We may also disclose information when necessary to prevent a serious and imminent threat to your health or safety or someone else’s.

For health oversight. We may disclose information to agencies overseeing the health care system for audits, investigations, inspections, and licensure — including state medical, nursing, and pharmacy boards and the Drug Enforcement Administration.

To prescription drug monitoring programs. Because our clinicians prescribe controlled substances, including certain hormone therapies, state law generally requires us to check and report to your state’s prescription drug monitoring program.

For judicial and administrative proceedings. We may disclose information in response to a court or administrative order, or to a subpoena or other lawful process where efforts have been made to notify you or obtain a protective order.

For law enforcement. We may disclose information in the limited circumstances the law allows — for example, in response to a court order, warrant, or grand jury subpoena; to identify or locate a suspect, fugitive, or missing person; or about a death we believe may have resulted from criminal conduct.

To coroners, medical examiners, and funeral directors, as necessary for their duties.

For organ and tissue donation, to procurement organizations facilitating donation and transplantation.

For research, where an institutional review board or privacy board has approved the research and established protocols to protect your privacy, and in limited preparatory or decedent research. Other research use of identifiable information requires your written authorization.

For workers’ compensation, as authorized by law.

For specialized government functions, including military and veterans activities, national security and intelligence, protective services, and correctional institutions holding an inmate.

To people involved in your care. Unless you object, we may share information directly relevant to your care with a family member, friend, or other person you identify. If you cannot agree or object, we may use professional judgment about what is in your best interest.

We will get your written authorization before:

• selling your health information;
• using or sharing it for marketing, except face-to-face communications and gifts of nominal value;
• using or sharing psychotherapy notes, if any exist, except as the law permits; and
• any other use or disclosure not described in this Notice.

We do not sell your health information, and we do not use it to market products to you on behalf of the Platform or any other company without your written authorization.

You may revoke an authorization in writing at any time. Revoking it stops future uses and disclosures under it, but does not undo what was already done in reliance on it.

Care is delivered remotely, and your information exists in electronic systems. We maintain administrative, technical, and physical safeguards to protect it.

The systems our clinicians work in may include automated or artificial-intelligence-assisted features — for example, summarizing intake responses, drafting documentation, flagging drug interactions or safety concerns, or supporting clinical decisions. These tools support our clinicians. They do not make decisions about your care. A licensed clinician reviews your case and is responsible for every clinical decision.

Get a copy of your record. You may inspect and get a copy of your medical and billing records, on paper or electronically. Send your request to the contact below. We will act within 30 days, with one 30-day extension if we notify you in writing. We may charge a reasonable, cost-based fee. You may also direct us to send a copy to someone you name.

Ask us to correct your record. If you believe something is wrong or incomplete, ask us in writing and tell us why. We will respond within 60 days, with one 30-day extension if we notify you. If we deny your request, we will explain why in writing, and you may file a statement of disagreement that we will keep with your record.

Ask for confidential communications. You may ask us to contact you at a particular phone number, email address, or mailing address, or by a particular method. We will accommodate reasonable requests and will not ask why.

Ask us to limit what we share. You may ask us to restrict how we use or share your information for treatment, payment, or operations, or with someone involved in your care. We are not required to agree. We must agree to a request not to share information with a health plan about care you paid for entirely yourself — which, because our services are private pay, will generally already be the case.

Get a list of disclosures. You may ask for an accounting of certain disclosures we made in the six years before your request. It excludes disclosures for treatment, payment, and operations, those you authorized, and certain others. One accounting is free every 12 months; we may charge a reasonable cost-based fee for additional ones.

Get a paper or electronic copy of this Notice. Ask us any time, even if you agreed to receive it electronically. We will provide one promptly.

Choose someone to act for you. A person with a medical power of attorney, a legal guardian, or a personal representative may exercise your rights. We will verify their authority first.

Opt out of fundraising. If we ever contact you for fundraising, you may tell us to stop, and we will.

Be notified of a breach. We will notify you if a breach occurs that may have compromised your information.

We will not retaliate against you for exercising any of these rights or for filing a complaint.

If you believe your privacy rights have been violated, tell us:

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights: 200 Independence Avenue, S.W., Washington, D.C. 20201 · 1-877-696-6775 · hhs.gov/ocr/privacy/hipaa/complaints

You will not be penalized for filing a complaint.

Our clinicians are licensed in all 50 states and D.C. Some states give you greater protection than federal law — including additional protections for hormone-related, reproductive health, genetic, mental health, and HIV information, and specific rules on record fees and retention periods. Where your state’s law is more protective, we follow your state’s law.

We may change this Notice and make the new terms apply to information we already have. The current version will be posted at ziramedical.com and made available through the Platforms where our clinicians provide care. Paper copies are available on request.

Acknowledgment. If you are asked to acknowledge this Notice, your acknowledgment confirms only that you received it. It is not consent to treatment and does not waive any right described above.