HIPAA Notice of Privacy Practices

About This Notice

This notice describes how medical information about you may be used and disclosed by PURi, LLC ("Puri") and how you can get access to this information. Please review it carefully.

This notice is provided pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health Act (HITECH), and all applicable federal and state regulations. This notice applies to all protected health information created, received, maintained, or transmitted by Puri in connection with the services we provide.

Who Follows This Notice

This notice describes the privacy practices of PURi, LLC, including all staff, contractors, and workforce members who access protected health information in the course of their work for Puri.

Puri coordinates care with independent licensed healthcare providers (physicians and prescribers) and licensed compounding pharmacies. These providers and pharmacies are separate covered entities or business associates under HIPAA and maintain their own privacy practices and notices. This notice covers Puri's handling of your information, not theirs.

Your Protected Health Information (PHI)

Protected Health Information (PHI) includes individually identifiable health information that relates to your past, present, or future physical or mental health condition, the provision of healthcare to you, or the past, present, or future payment for healthcare. This includes information you provide through intake assessments, provider messaging, and any other interaction with the Puri platform.

We are required by law to maintain the privacy of your PHI, provide you with this notice of our legal duties and privacy practices, and follow the terms of this notice as currently in effect.

How We May Use and Disclose Your PHI

Treatment: We may use and disclose your PHI to provide, coordinate, and manage your healthcare. This includes sharing your intake assessment and medical information with licensed physicians who review your case, with compounding pharmacies that fill your prescriptions, and with other providers involved in your care. For example, a licensed physician reviewing your intake receives the information you provided so they can make a clinical decision about whether treatment is appropriate.

Payment: We may use and disclose your PHI for billing and payment purposes, including processing your payments through our payment processor, verifying insurance eligibility if applicable, and conducting other payment-related activities.

Healthcare Operations: We may use your PHI for our internal operations, including quality assessment and improvement, clinical auditing, compliance programs, staff training, and business management activities necessary to support the services we provide.

Business Associates: We contract with third-party service providers (business associates) who perform functions on our behalf that involve access to PHI. These business associates are contractually required through Business Associate Agreements (BAAs) to safeguard your PHI and comply with HIPAA requirements. Examples include our cloud infrastructure provider, our email service provider, and our compounding pharmacy partners.

As Required by Law: We may disclose your PHI when required by federal, state, or local law, including public health reporting, reporting abuse or neglect, health oversight activities, judicial and administrative proceedings, law enforcement purposes, and to avert a serious threat to health or safety.

With Your Authorization: Uses and disclosures of your PHI not described in this notice will be made only with your written authorization. You may revoke an authorization at any time by contacting us in writing, except to the extent that we have already relied on the authorization.

Uses and Disclosures That Require Your Authorization

We will obtain your written authorization before using or disclosing your PHI for purposes not covered by this notice or as otherwise permitted by law. This includes: marketing communications (other than face-to-face communications and promotional gifts of nominal value), sale of PHI, and most uses of psychotherapy notes, if applicable.

You may revoke an authorization at any time by submitting a written request to [email protected]. Revocation will not affect any uses or disclosures made in reliance on the authorization prior to its revocation.

Your Rights Regarding Your PHI

Right to Inspect and Copy: You have the right to inspect and obtain a copy of your PHI maintained by Puri. To request access, submit a written request to [email protected]. We may charge a reasonable, cost-based fee for copies. We will respond within 30 days of receiving your request.

Right to Amend: You have the right to request an amendment to your PHI if you believe it is incorrect or incomplete. Submit your request in writing to [email protected] with an explanation of why you believe the amendment is warranted. We may deny the request in certain circumstances permitted by HIPAA and will provide you with a written explanation if we do.

Right to an Accounting of Disclosures: You have the right to request a list of certain disclosures of your PHI that we have made. This accounting does not include disclosures made for treatment, payment, or healthcare operations, or disclosures made with your authorization. Submit your request in writing to [email protected].

Right to Request Restrictions: You have the right to request restrictions on certain uses and disclosures of your PHI. We are not required to agree to a requested restriction, except that we must agree to restrict disclosures to a health plan if the disclosure is for payment or healthcare operations and the PHI pertains to a service for which you paid out of pocket in full.

Right to Request Confidential Communications: You have the right to request that we communicate with you about health matters in a certain way or at a certain location. For example, you may ask that we contact you only by email at a specific address. We will accommodate reasonable requests.

Right to a Paper Copy of This Notice: You have the right to obtain a paper copy of this notice at any time by contacting us at [email protected].

Right to Be Notified of a Breach: You have the right to be notified if there is a breach of your unsecured PHI. We will notify you in accordance with HIPAA and HITECH breach notification requirements.

How We Protect Your Information

We implement administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of your PHI in accordance with HIPAA Security Rule requirements (45 CFR Part 164, Subpart C). These safeguards include access controls, encryption of data in transit and at rest, audit logging of access to PHI, workforce training, and contractual protections with business associates.

We do not disclose the specific technical details of our security infrastructure publicly, as doing so could compromise the effectiveness of those safeguards. If you have questions about our security practices, contact us at [email protected].

Our Responsibilities

We are required by law to: maintain the privacy of your PHI as described in this notice; provide you with this notice of our legal duties and privacy practices; notify you following a breach of your unsecured PHI; and abide by the terms of this notice currently in effect.

We will not use or disclose your PHI without your authorization except as described in this notice. We will not sell your PHI. We will not use your PHI for marketing purposes without your authorization.

Changes to This Notice

We reserve the right to change this notice at any time and to make the revised terms effective for all PHI we maintain, including PHI created or received before the date of the revision. A current copy will always be available on our website at puri.pro/legal/hipaa. We will post the revised notice with a new effective date.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with Puri or with the U.S. Department of Health and Human Services Office for Civil Rights.

To file a complaint with Puri, contact us at [email protected] or write to the address below. To file a complaint with HHS, visit www.hhs.gov/ocr/privacy/hipaa/complaints or call 1-877-696-6775.

You will not be retaliated against for filing a complaint.

Contact Information

PURi, LLC Privacy Officer. Email: [email protected]. 7901 4th St N, STE 300, St. Petersburg, FL 33702.

Effective Date

This notice is effective as of April 12, 2026.