Notice of Privacy Practices

zebraMD, Inc. · Effective Date: October 13, 2026

YOUR INFORMATION. YOUR RIGHTS. OUR RESPONSIBILITIES.

This Notice describes how medical information about you may be used and disclosed and how you can access this information. Please review it carefully.

About This Notice

zebraMD, Inc. ("zebraMD," "we," "us," or "our") operates a healthcare technology platform that provides clinical decision support, health information organization and analysis, and related services. zebraMD also provides clinical consultation services through its licensed physicians to patients who request those services and accept the applicable Consent to Clinical Services.

This Notice of Privacy Practices ("Notice") explains how zebraMD uses and discloses protected health information ("PHI") in its capacity as a HIPAA-covered healthcare provider, your rights regarding that information, and our legal responsibilities under applicable law.

The general technology platform may generate clinical insights, analyses, and decision-support outputs to assist with the organization and interpretation of health information. These outputs are not necessarily medical advice, a definitive diagnosis, or a treatment plan. Where you separately request clinical consultation services, zebraMD's licensed physicians may review your information and provide a physician-reviewed clinical consultation report under the applicable Consent to Clinical Services.

zebraMD's clinical consultation services supplement, and do not replace, your ongoing medical care. zebraMD does not provide emergency or urgent medical care, prescribe medications, or independently establish or manage your treatment plan. Treatment decisions remain with you and your treating healthcare providers.

This Notice should be read together with zebraMD's Terms of Use, Privacy Policy, Consent to Clinical Services, and any separate consents or authorizations applicable to your use of the Services. Each document addresses different aspects of our services and information practices. Where a particular use or disclosure of PHI requires a separate authorization under applicable law, this Notice does not replace that authorization.

Our Terms of Use and Privacy Policy are available at:

• https://zebramd.org/about/terms
• https://zebramd.org/about/privacy

This Notice applies to PHI maintained by zebraMD in its capacity as a HIPAA-covered healthcare provider. Information processed through our technology platform that is not PHI under HIPAA may be subject to our Privacy Policy and other applicable federal and state privacy laws.

1. Your Rights

You have certain rights regarding your PHI. This section explains your rights and how you may exercise them.

Access Your Medical Information

You may request to inspect or obtain a copy of your medical records and other PHI maintained by zebraMD, including electronic copies where applicable. We will generally respond within the time required by law, ordinarily within 30 days. We may charge a reasonable, cost-based fee where permitted by law.

Request Corrections

You may request that we amend PHI that you believe is incorrect or incomplete. We may deny your request in certain circumstances permitted by law. If we deny your request, we will explain the reason in writing and describe any options available to you.

Request Confidential Communications

You may ask us to contact you in a particular way or at a specific address, telephone number, or email address. We will accommodate reasonable requests as required by law.

Request Restrictions on Uses and Disclosures

You may request restrictions on certain uses and disclosures of your PHI for treatment, payment, or healthcare operations. We are not generally required to agree to a requested restriction, except where the law requires it.

For example, if you pay for a healthcare item or service in full out of pocket, we must honor a qualifying request not to disclose information about that item or service to your health plan for payment or healthcare operations, unless disclosure is otherwise required by law.

Request an Accounting of Disclosures

You may request an accounting of certain disclosures of your PHI made during the six years preceding your request. The accounting generally excludes disclosures for treatment, payment, and healthcare operations, as well as other disclosures excluded by law.

We will provide one accounting in a 12-month period without charge and may charge a reasonable, cost-based fee for additional requests as permitted by law.

Receive a Copy of This Notice

You may request a paper copy of this Notice at any time, even if you previously agreed to receive it electronically.

Choose a Personal Representative

A person legally authorized to act on your behalf may exercise your rights where permitted by law. We will verify that person's authority before acting on their request.

Revoke an Authorization

If you have provided a written authorization for a particular use or disclosure of your PHI, you may revoke it in writing at any time, except to the extent that we have already acted in reliance on it.

Withdrawal of consent to receive clinical consultation services or withdrawal of permission for future access to connected records may be subject to different procedures and consequences, as described in the applicable consent and our Privacy Policy.

File a Complaint

You may complain to zebraMD or the U.S. Department of Health and Human Services Office for Civil Rights if you believe your privacy rights have been violated. We will not retaliate against you for filing a complaint.

To exercise your rights or submit a request, contact us using the details in Section 10.

2. How We May Use and Disclose Your Health Information

We may use and disclose your PHI without obtaining a separate written authorization when permitted or required by HIPAA and other applicable law.

Treatment and Clinical Consultation

We may use your PHI to provide clinical consultation services you request. Our licensed physicians may review and analyze your medical records, test results, symptoms, diagnoses, medications, genetic and genomic information, and other relevant health information to support clinical decision-making.

As part of these services, zebraMD may:

• Review and analyze your medical records and other health information;
• Have a zebraMD physician review your information and prepare a physician-reviewed clinical consultation report;
• Communicate with you about the consultation;
• Communicate or coordinate, as appropriate and authorized, with your treating physicians and other healthcare providers;
• Facilitate referrals to specialists or other appropriate healthcare professionals;
• Coordinate or, when clinically appropriate, facilitate genetic or other diagnostic testing through the zebraMD platform; and
• Provide clinical information and recommendations intended to help you and your healthcare providers determine appropriate next steps.

We may disclose relevant PHI to your treating physicians, specialists, laboratories, diagnostic facilities, and other healthcare providers involved in your care, as permitted by law, to support consultation, diagnosis, referrals, testing, and care coordination.

The general technology platform may provide clinical decision-support outputs without independently establishing a treatment relationship. A direct clinical relationship with zebraMD is established for the clinical consultation services described in the applicable Consent to Clinical Services.

Health Information Exchange and Medical Record Retrieval

With the permissions, consent, or other legal authority required in the circumstances, we may use health information exchange services, including services provided by Metriport, to locate, retrieve, receive, organize, and analyze your available medical records from participating healthcare providers and connected systems.

Retrieved information may include diagnoses, clinical notes, laboratory results, medications, procedures, medical history, and other available health information. We use this information as reasonably necessary to provide your clinical consultation and related services.

The information available depends on the participating organizations, the records they maintain, the permissions applicable to the exchange, and the technical capabilities of the connected systems. We cannot guarantee that all of your medical records will be available.

We may use service providers and technology vendors to process PHI on our behalf, subject to applicable law and required contractual safeguards.

General acceptance of the Terms of Use or this Notice does not replace a separate consent or authorization where one is required by law or by the applicable record-access process.

Disconnecting a connected source or withdrawing permission for future retrieval may prevent future access through that connection. It does not necessarily delete information already received, clinical documentation, information held by other organizations, or information that zebraMD is required or otherwise permitted to retain.

Healthcare Operations

We may use and disclose PHI for healthcare operations permitted by law. These activities may include:

• Assessing and improving the quality and effectiveness of our healthcare services;
• Evaluating clinical processes and service performance;
• Conducting appropriate quality assurance and administrative activities;
• Auditing, compliance, and security monitoring;
• Managing and supporting our clinical operations; and
• Using service providers to assist with permitted healthcare operations.

We will conduct these activities in accordance with applicable privacy, security, and contractual requirements.

Payment

If applicable to the services we provide, we may use and disclose PHI to obtain payment, process claims, determine coverage or eligibility, and conduct related payment activities, as permitted by law.

Other Permitted or Required Disclosures

We may also use or disclose PHI without your authorization when permitted or required by law, including for:

• Public health and safety: Authorized public health reporting, disease prevention, and other public health activities.
• Abuse, neglect, or domestic violence: Reporting suspected abuse, neglect, or domestic violence when authorized or required by law.
• Health oversight: Audits, investigations, inspections, licensing, and other activities of authorized oversight agencies.
• Legal proceedings: Responding to court orders, subpoenas, and other lawful processes, subject to applicable requirements.
• Law enforcement: Disclosures to law enforcement officials when authorized or required by law.
• Serious threats: Disclosures necessary to prevent or lessen a serious and imminent threat to health or safety, as permitted by law.
• Government functions: Certain authorized military, national security, correctional, and other government activities.
• Workers' compensation: Disclosures authorized by applicable workers' compensation laws.
• Research: Research activities that satisfy applicable legal requirements, including any required authorization, institutional review board approval, or privacy board waiver.
• Legal compliance: Disclosures necessary to comply with applicable federal, state, or local laws.

We will limit uses and disclosures to those permitted or required by applicable law.

3. Artificial Intelligence, Algorithm Development, and Research

zebraMD uses artificial intelligence, machine learning, natural language processing, and related technologies to organize and analyze health information, identify potential clinical patterns, generate clinical decision-support insights, support clinical consultations, and develop and improve healthcare technologies.

As permitted by law, we may use PHI for treatment and healthcare operations, including appropriate quality assessment and service improvement. Other research, algorithm-development, or product-development activities involving identifiable PHI will be conducted only when permitted by applicable law and any required authorization or other legal permission has been obtained.

As described in our Privacy Policy and Terms of Use, zebraMD may use and disclose appropriately de-identified and aggregated information for lawful purposes, including:

• Training, validating, and improving algorithms and machine learning models;
• Identifying potential phenotype-genotype relationships and clinical patterns;
• Improving clinical decision-support and diagnostic methodologies;
• Quality assurance and product improvement;
• Developing analytics and benchmarking tools;
• Academic research, validation studies, and scientific publication; and
• Developing healthcare, precision medicine, and related technologies and services.

These activities may involve collaborations with healthcare organizations, academic institutions, pharmaceutical and biotechnology companies, life sciences organizations, and other research or technology partners.

Information described as coded or pseudonymized may remain PHI if it can still be linked to an identifiable individual. We will handle such information in accordance with applicable legal requirements.

Information that has been de-identified in accordance with applicable HIPAA standards is no longer PHI under HIPAA. De-identification reduces the risk of identification but cannot guarantee that re-identification is impossible in every circumstance.

Where applicable law requires authorization for research or other uses of identifiable PHI, we will obtain the required authorization or rely on another legally valid basis before proceeding.

Where permitted by law, appropriately de-identified, aggregated, and model-derived information may be retained and used for research, algorithm development, product improvement, and other lawful purposes after you discontinue the Services or delete your account.

zebraMD does not sell PHI or identifiable medical records to data brokers or advertisers and does not use identifiable PHI for third-party advertising purposes. Our Privacy Policy also describes our practices concerning the sale or sharing of personal information as those terms are defined under applicable California law.

You may be offered opportunities to participate in research studies, patient registries, or clinical trials. Where required by law, we will obtain the appropriate authorization before using or disclosing identifiable PHI for these activities.

4. Genetic and Genomic Information

zebraMD may receive and analyze genetic and genomic information that you provide or authorize us to access as part of clinical consultations, clinical decision support, precision health analysis, and other permitted activities.

We use this information to support clinical review, identify potential genotype-phenotype relationships, organize relevant health information, and provide insights to you and your healthcare providers.

Your genetic information will not be disclosed to anyone other than your physician(s) for diagnosis and treatment, except as separately authorized by you or as otherwise permitted or required by applicable law.

Where required by applicable law, zebraMD will obtain separate consent or authorization before collecting, analyzing, retaining, or disclosing genetic information for particular purposes. General acceptance of the Terms of Use or this Notice does not replace a separate authorization where one is required.

Genetic information may be used for research, algorithm development, or other purposes when permitted by applicable law and consistent with any required authorization. The use of genetic information for these purposes does not automatically authorize disclosure of identifiable genetic information to third parties.

You may withdraw consent for future collection or use of genetic information where applicable. Withdrawal does not necessarily reverse processing already completed or require deletion of information that zebraMD is permitted or required to retain under applicable law.

Certain federal and state laws provide additional protections for genetic information. The Genetic Information Nondiscrimination Act (GINA) generally prohibits certain uses of genetic information by health insurers and employers, but it does not cover every type of insurance, including life insurance, disability insurance, and long-term care insurance.

5. Service Providers, Technology, and Information Security

zebraMD may use cloud infrastructure providers, electronic health record and health information exchange services, analytics providers, artificial intelligence providers, security vendors, document-processing tools, and other technology service providers to operate the platform and provide related services.

For example, medical records may be processed using secure cloud infrastructure and document-processing technology to extract, organize, and analyze relevant medical information.

These service providers may create, receive, maintain, or transmit PHI on our behalf as necessary to perform their services. Where HIPAA requires it, zebraMD will use appropriate contractual safeguards, including business associate agreements where applicable.

zebraMD maintains administrative, technical, and physical safeguards designed to protect PHI and other personal information, including access controls, encryption, audit logging, and incident response procedures appropriate to the information processed.

No method of electronic transmission or storage can guarantee absolute security. We will comply with applicable breach notification requirements if a breach of unsecured PHI occurs.

6. Account Deletion, Withdrawal, and Retention

Your participation in zebraMD's clinical consultation services is voluntary. You may withdraw your consent to receive clinical consultation services and may request account deletion or withdraw consent for future processing through the available account settings, subject to applicable law and the terms of any separate authorization.

Withdrawal of consent does not affect the lawfulness of services or activities that occurred before withdrawal. It may prevent zebraMD from continuing to provide clinical consultation services or completing services that require your ongoing participation.

Following account deletion or withdrawal, zebraMD will handle your information in accordance with its Privacy Policy and applicable legal requirements.

We may retain PHI and other information as reasonably necessary or as required or permitted by law, including to:

• Maintain clinical documentation and records;
• Comply with legal, regulatory, and professional obligations;
• Protect the security and integrity of our platform;
• Maintain audit logs and investigate security incidents;
• Resolve disputes and enforce applicable agreements; and
• Maintain backups and archives in accordance with applicable retention practices.

Information held by healthcare providers, laboratories, health information exchanges, and other third parties may remain in their systems and be subject to their own privacy practices and legal obligations.

Certain appropriately de-identified, aggregated, and model-derived information that can no longer reasonably be associated with you may be retained and used for lawful purposes, including research, algorithm development, and product improvement, as described in our Privacy Policy and Terms of Use.

Deleting your account or disconnecting a data source does not necessarily delete records already received or information that zebraMD is required or otherwise permitted to retain.

7. Additional Protections for Certain Records

Certain health information may be subject to additional federal or state confidentiality requirements, including certain substance use disorder treatment records protected under 42 CFR Part 2, psychotherapy notes, and certain state-protected genetic, mental health, or other sensitive health information.

Where these additional requirements apply, zebraMD will comply with the relevant protections, including any special consent, authorization, and disclosure restrictions.

If zebraMD receives substance use disorder records protected by 42 CFR Part 2, applicable restrictions may limit their use and disclosure, including their use in certain investigations or legal proceedings against you. We will handle such records in accordance with applicable Part 2 requirements.

8. Our Responsibilities and Changes to This Notice

We are required by law to:

• Maintain the privacy and security of your PHI;
• Provide you with this Notice describing our legal duties and privacy practices;
• Follow the terms of the Notice currently in effect;
• Notify affected individuals as required by law if a breach of unsecured PHI occurs; and
• Comply with applicable federal and state privacy laws.

We reserve the right to change our privacy practices and the terms of this Notice as permitted by law. Changes may apply to PHI we maintain, including information we received or created before the revision, where permitted by law.

If we make a material change to our privacy practices, we will update this Notice and make the revised version available as required by law. The current version will be available on our website and upon request.

This Notice does not replace the separate Consent to Clinical Services, any required authorization to access or disclose health information, or other permissions required for particular services or uses of information.

9. Acknowledgment of Receipt

Where required by HIPAA, zebraMD will request acknowledgment that you have received this Notice of Privacy Practices. If you receive clinical consultation services in person, electronically, or through another permitted method, we will document acknowledgment in accordance with applicable law.

Acknowledgment of receipt confirms that you were provided with this Notice. It is not, by itself, authorization for uses or disclosures of PHI that require separate authorization, nor does it replace your separate Consent to Clinical Services.

If acknowledgment cannot be obtained, zebraMD will document its efforts and the reason acknowledgment was not obtained, as required by law.

10. Questions, Requests, and Complaints

If you have questions about this Notice, wish to exercise your privacy rights, or believe your privacy rights have been violated, contact:

zebraMD, Inc. 2355 Westwood Boulevard, #1813 Los Angeles, CA 90064-2109 Email: info@zebramd.org Privacy Policy: https://zebramd.org/about/privacy

You may also submit a complaint to the U.S. Department of Health and Human Services, Office for Civil Rights:

Website: https://www.hhs.gov/hipaa/filing-a-complaint/index.html Telephone: 1-800-368-1019

We will not retaliate against you for filing a complaint.

Effective Date: October 13, 2026