Notice of Privacy Practices

For Patients of [Clinical Affiliate PLLC Name] Through the Halftime Health Platform

Effective Date: 2026-08-01 Last Updated: 2026-05-06 Version: 1.0

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices (“Notice”) describes the privacy practices of [Clinical Affiliate PLLC Name] (the “Practice,” “we,” “us,” or “our”) with respect to your Protected Health Information (“PHI”), as required by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended, and its implementing regulations at 45 CFR Parts 160 and 164.

The Practice is an independent professional medical entity, managed by OpenLoop Health, Inc. under a management-services arrangement, that provides clinical services to patients on the Halftime Health platform. Halftime Health LLC (“Halftime Health”) operates the technology, member experience, payment, and customer-support layer of that platform. Halftime Health is a HIPAA Business Associate of the Practice. This Notice is published on the Halftime Health website on the Practice’s behalf for the convenience of patients.

1. Our duties

We are required by law to:

• Maintain the privacy and security of your PHI.
• Provide you with this Notice of our legal duties and privacy practices regarding your PHI.
• Notify you following a breach of unsecured PHI as required by 45 CFR 164.404.
• Abide by the terms of the Notice currently in effect.

We reserve the right to change the terms of this Notice and to make the new Notice provisions effective for all PHI we maintain. We will post any revised Notice on the Halftime Health website and provide it to you on request.

2. Uses and disclosures of your PHI

We may use and disclose your PHI for the following purposes without your written authorization, as permitted by 45 CFR 164.502, 164.506, and 164.512.

2.1 Treatment

We may use and disclose your PHI to provide, coordinate, or manage your healthcare. For example, we may share your intake responses, bloodwork results, and clinical history with the clinicians who evaluate you, with consulting clinicians, and with the dispensing pharmacy that prepares your prescription.

2.2 Payment

We may use and disclose your PHI to obtain payment for the services we provide. For example, we may share information with our payment processor (Stripe) to charge your subscription, with the dispensing pharmacy to coordinate billing for medications, and with our auditors and accountants.

2.3 Healthcare operations

We may use and disclose your PHI for our healthcare operations, including quality assessment, clinician credentialing and review, training, customer service, business planning, and compliance activities.

2.4 Business Associates

We may share your PHI with vendors that perform services on our behalf under a written Business Associate Agreement. Halftime Health LLC is our principal Business Associate. Other Business Associates include our cloud and infrastructure providers, our communications providers, our payment processor, our laboratory partners, our identity-verification and fraud-prevention providers, and our analytics, error-monitoring, and audit-logging providers.

2.5 Required by law

We may use and disclose your PHI when required by federal, state, or local law.

2.6 Public health and safety

We may disclose your PHI to:

• public-health authorities for disease prevention or control, vital statistics, or product safety reporting;
• authorities authorized to receive reports of abuse, neglect, or domestic violence;
• the U.S. Food and Drug Administration regarding adverse events or product defects;
• persons exposed to or at risk of contracting a communicable disease, where authorized by law; and
• health-oversight agencies for audits, investigations, inspections, and licensure.

2.7 Judicial and administrative proceedings

We may disclose your PHI in response to a court or administrative order, subpoena, discovery request, or other lawful process, subject to HIPAA’s procedural requirements.

2.8 Law enforcement

We may disclose your PHI to law-enforcement officials for limited purposes, such as identifying a suspect or victim, reporting a crime, or responding to a court order, subject to HIPAA’s specific limits.

2.9 Coroners, medical examiners, and funeral directors

We may disclose your PHI to coroners, medical examiners, and funeral directors as necessary to carry out their duties.

2.10 Organ and tissue donation

We may disclose your PHI to organizations that handle organ procurement, donation, and transplantation.

2.11 Research

We may use or disclose your PHI for research only with your written authorization, with an Institutional Review Board waiver, or under other HIPAA-permitted research safeguards.

2.12 Serious threat to health or safety

We may disclose your PHI to prevent or lessen a serious and imminent threat to a person or the public, consistent with applicable law and ethical standards.

2.13 Workers’ compensation

We may disclose PHI as authorized by and to the extent necessary to comply with workers’-compensation laws.

2.14 Specialized government functions

We may disclose PHI in connection with military and veterans’ activities, national security and intelligence activities, protective services for the President and others, and inmates of correctional institutions, as permitted by HIPAA.

2.15 Appointment reminders, treatment alternatives, and health-related benefits

We may use and disclose your PHI to provide appointment reminders, follow-up communications, and information about treatment alternatives or health-related products and services we offer.

3. Uses and disclosures requiring your written authorization

The following uses and disclosures of your PHI require your written authorization under 45 CFR 164.508:

• most uses and disclosures of psychotherapy notes (where applicable);
• marketing communications that involve financial remuneration to us from a third party for making the communication;
• sale of PHI;
• voice intake recordings or audio recordings used for purposes other than treatment, payment, or healthcare operations; and
• any other use or disclosure not described in this Notice or otherwise permitted by law.

You may revoke your authorization at any time by writing to the address below. Revocation will not affect any uses or disclosures already made in reliance on your authorization.

4. Your rights regarding your PHI

You have the following rights with respect to your PHI, subject to applicable conditions and exceptions.

4.1 Right to access (45 CFR 164.524)

You have the right to inspect and obtain a copy of your PHI in our designated record set, in the form and format you request (including electronic copy where readily producible). We may charge a reasonable, cost-based fee where permitted.

4.2 Right to amend (45 CFR 164.526)

You have the right to request that we amend PHI you believe is inaccurate or incomplete. We may deny your request under limited circumstances; if we do, you may submit a statement of disagreement.

4.3 Right to an accounting of disclosures (45 CFR 164.528)

You have the right to request a list of certain disclosures we have made of your PHI in the six (6) years preceding your request. The first accounting in any 12-month period is free; we may charge a reasonable, cost-based fee for additional accountings.

4.4 Right to request restrictions (45 CFR 164.522(a))

You have the right to request restrictions on certain uses and disclosures for treatment, payment, or healthcare operations, and on disclosures to family members or others involved in your care. We are not required to agree, except that we must agree to a request to restrict disclosures of PHI to a health plan if the PHI pertains solely to a healthcare item or service for which you have paid out of pocket in full.

4.5 Right to confidential communications (45 CFR 164.522(b))

You have the right to request that we communicate with you about PHI in a particular way or at a particular location (for example, by email rather than by mail, or to a P.O. box). We will accommodate reasonable requests.

4.6 Right to a paper copy of this Notice

You have the right to a paper copy of this Notice on request, even if you have agreed to receive it electronically. Request a paper copy by contacting us using the information below.

4.7 Right to be notified of a breach

You have the right to be notified following a breach of unsecured PHI as required by 45 CFR 164.404.

4.8 Right to choose someone to act for you

If you have a personal representative or have given someone medical power of attorney, that person can exercise your rights and make choices about your PHI, after we have verified the authority.

5. How to exercise your rights

To exercise any of the rights in Section 4, submit a written request to:

[Clinical Affiliate PLLC Name] c/o Privacy Officer Halftime Health LLC, Attn: Privacy 600 W. 6th Street, Suite 400, Fort Worth, TX 76102 Email: privacy@halftime.health

You may also use the in-product privacy request flow at /account/privacy.

We will respond within the timeframes required by HIPAA and applicable state law. Some requests require a written, dated, and signed authorization on our standard form.

6. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us, with the U.S. Department of Health and Human Services Office for Civil Rights (“OCR”), or both. You will not be retaliated against for filing a complaint.

6.1 Our Privacy Officer

[Clinical Affiliate PLLC Name] c/o Privacy Officer Halftime Health LLC, Attn: Privacy 600 W. 6th Street, Suite 400, Fort Worth, TX 76102 Email: privacy@halftime.health

6.2 The U.S. Department of Health and Human Services Office for Civil Rights

• Mail: Centralized Case Management Operations, U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Room 509F HHH Bldg., Washington, D.C. 20201
• Online: https://www.hhs.gov/hipaa/filing-a-complaint/index.html
• Phone: 1-800-368-1019 (TDD: 1-800-537-7697)

7. State law and additional protections

Where state law provides greater privacy protection than HIPAA, we comply with the more protective state requirement. This includes laws regarding mental-health information, HIV-related information, genetic information, substance-use-disorder records (42 CFR Part 2 where applicable), and minors’ health information. State telehealth, prescribing, and consumer-health-data laws may impose additional requirements in the states in which the Halftime Health platform is offered.

In particular:

• California. California residents are protected by the Confidentiality of Medical Information Act, the California Consumer Privacy Act / California Privacy Rights Act, and other California-specific laws. We honor those protections in addition to HIPAA.
• Washington. Consumer health data of Washington residents and data collected in Washington is also covered by the My Health My Data Act. A separate Washington Consumer Health Data Privacy Policy is published at /legal/wa-consumer-health-data.
• New York and Texas. New York SHIELD and Texas HB 300 impose additional safeguarding and training obligations that we honor with respect to residents of those states.
• Florida. Florida telehealth privacy and recordkeeping rules apply to telehealth services rendered to Florida residents.

8. Genetic Information Nondiscrimination Act (“GINA”)

We are prohibited from using or disclosing genetic information for underwriting purposes.

9. Changes to this Notice

We reserve the right to change this Notice at any time. Changes will apply to PHI we already maintain as well as PHI we receive in the future. Updated Notices will be posted on the Halftime Health website with a new “Effective Date.” We will provide you with the revised Notice on request, and where required by law, in writing.

10. Contact

For questions about this Notice or to exercise your rights:

[Clinical Affiliate PLLC Name] c/o Privacy Officer Halftime Health LLC, Attn: Privacy 600 W. 6th Street, Suite 400, Fort Worth, TX 76102 Email: privacy@halftime.health