How We May Use and Disclose Your Protected Health Information

Bridgewell Health, Inc. ("Bridgewell") is required by law to maintain the privacy of your Protected Health Information (PHI) and to provide you with this notice of our legal duties and privacy practices. The following describes the ways we may use and disclose your PHI without your written authorization:

Treatment: We may use and disclose your PHI to provide, coordinate, or manage your health care and related services. For example, we may share your medical history with a licensed clinician who is treating you through our platform, or send your prescription information to a pharmacy.

Payment: We may use and disclose your PHI to obtain payment for services provided to you. For example, we may share information with your health insurer or payment processor to bill and collect for the services you receive.

Health Care Operations: We may use and disclose your PHI for our internal operations, including quality assessment, clinician performance review, training, compliance activities, and business management. For example, we may review your records to evaluate the quality of care you received.

Other uses and disclosures require your written authorization except as permitted or required by law, including disclosures to your personal representatives, for research (subject to institutional review board oversight), for organ donation, and to avert a serious threat to health or safety.

Disclosures Required or Permitted by Law

We may be required or permitted to disclose your PHI without your authorization in circumstances including:

• Public health activities: reporting disease, injury, or vital statistics to public health authorities as required by law.
• Victims of abuse or neglect: disclosures to government authorities authorized to receive reports of abuse or neglect.
• Health oversight activities: disclosures to agencies conducting audits, investigations, or inspections of health care providers.
• Judicial and administrative proceedings: in response to a court or administrative order, subpoena, or other lawful process.
• Law enforcement: under limited circumstances as required or permitted by law, such as to identify a suspect or to report a crime.
• Workers' compensation: as authorized by and to the extent necessary to comply with workers' compensation laws.

Your Rights

You have the following rights with respect to your PHI:

• Right to access your records: You have the right to inspect and obtain a copy of your medical records and other PHI that we maintain about you. Requests must be made in writing. We may charge a reasonable fee for copying. We will respond within 30 days.
• Right to request amendments: You have the right to request that we correct or amend PHI that you believe is inaccurate or incomplete. We may deny your request in certain circumstances, but will explain any denial in writing.
• Right to request restrictions: You have the right to request restrictions on how we use or disclose your PHI. We are not required to agree to all restrictions, but will comply with restrictions we do agree to, unless required by law to disclose.
• Right to request confidential communications: You have the right to request that we communicate with you about health matters in a particular way or at a particular location (for example, only by email, or only to a specific address).
• Right to an accounting of disclosures: You have the right to receive a list of certain disclosures we have made of your PHI in the prior six years, other than disclosures for treatment, payment, or health care operations.
• Right to a paper copy of this notice: You have the right to receive a paper copy of this notice at any time, even if you agreed to receive it electronically. Contact us to request one.

Our Duties

Bridgewell Health is required by law to:

• Maintain the privacy of your PHI.
• Provide you with this notice of our legal duties and privacy practices.
• Follow the terms of this notice currently in effect.
• Notify you in the event of a breach of your unsecured PHI.

We reserve the right to change the terms of this notice and to make the revised notice effective for PHI we already have about you as well as any PHI we receive in the future. We will post the current notice in our patient portal and make it available upon request.

Complaints

If you believe your privacy rights have been violated, you have the right to file a complaint with us or with the Secretary of the U.S. Department of Health and Human Services.

To file a complaint with Bridgewell Health, contact our Privacy Officer at privacy@bridgewellhealth.example.

To file a complaint with the federal government, contact the HHS Office for Civil Rights (OCR) at https://www.hhs.gov/ocr/ or by calling 1-800-368-1019.

We will not retaliate against you for filing a complaint.

Effective Date and Paper Copy

This Notice is effective January 1, 2026. To receive a paper copy of this Notice, contact us by email at privacy@bridgewellhealth.example or by writing to: Bridgewell Health, Inc., Attn: Privacy Officer, Boston, MA. We will provide a paper copy promptly and at no charge.