Notice of Privacy Practices

My 4M Life

Notice of Privacy Practices (HIPAA)

Effective Date: September 1, 2026 Last Reviewed: September 1, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

1. Our Commitment to Your Privacy

My 4M Life ("we," "us," or "our") is a concierge and membership-based health, wellness, and longevity practice that delivers care primarily through telehealth and digital health channels. We are committed to protecting the privacy of your protected health information ("PHI"). This Notice describes our legal duties and privacy practices with respect to PHI and explains your rights under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA"), as amended by the HITECH Act, and applicable state law.

We are required by law to: (a) maintain the privacy and security of your PHI; (b) provide you with this Notice of our legal duties and privacy practices; (c) follow the terms of the Notice currently in effect; and (d) notify you following a breach of unsecured PHI.

2. How We May Use and Disclose Your PHI

A. For Treatment

We may use and disclose PHI to provide, coordinate, or manage your health care. This includes consultations with other clinicians, coordination with laboratories, pharmacies, imaging centers, specialists, allied wellness professionals, and your primary care provider, as well as care delivered via telehealth platforms or digital health tools.

B. For Payment

Because we operate primarily as a membership/concierge practice, most services are paid for directly by you and not billed to insurance. We may, however, use and disclose PHI as needed to: collect membership fees and service charges; process credit card or ACH payments; provide you with documentation (such as superbills) you may submit to your insurer or HSA/FSA administrator; or, where requested by you, communicate with your health plan.

C. For Health Care Operations

We may use and disclose PHI for activities necessary to operate our practice, including quality improvement, training, credentialing, accreditation, business planning, audits, legal services, and risk management.

D. Business Associates

We contract with business associates who perform services on our behalf (e.g., telehealth platforms, electronic health record vendors, AI-enabled documentation and communication tools, billing services, secure messaging, cloud storage, IT support). These business associates may access PHI only as permitted under written Business Associate Agreements that require them to protect your PHI in accordance with HIPAA.

E. Appointments, Reminders, and Health-Related Communications

We may contact you to remind you of appointments, follow up on care, share health education or wellness program information, and provide treatment alternatives or other health-related benefits and services that may be of interest to you. Communications may occur by phone, voicemail, text message, secure messaging, or email, consistent with the contact preferences you provide. See also our separate Consent for AI-Assisted Communication.

F. Other Permitted or Required Disclosures

Subject to applicable law, we may use or disclose PHI without your authorization for the following purposes:

• Required by law (including reporting to public health authorities).
• Public health activities such as disease prevention or control, FDA-related reporting, or notifying persons exposed to communicable disease.
• Victims of abuse, neglect, or domestic violence, where authorized by law.
• Health oversight activities, including audits, investigations, inspections, and licensure.
• Judicial and administrative proceedings, in response to valid court orders, subpoenas, or discovery requests.
• Law enforcement purposes, as permitted by law.
• Coroners, medical examiners, and funeral directors.
• Organ and tissue donation.
• Research, where the disclosure has been approved by an Institutional Review Board or Privacy Board, or where appropriate de-identification has occurred.
• To avert a serious and imminent threat to health or safety.
• Specialized government functions (e.g., military, national security).
• Workers' compensation, as authorized by law.

3. Uses and Disclosures Requiring Your Written Authorization

The following uses and disclosures will be made only with your written authorization (which you may revoke at any time, except to the extent we have already relied on it):

• Most uses and disclosures of psychotherapy notes.
• Uses and disclosures for marketing purposes, including subsidized communications.
• Disclosures that constitute a sale of PHI.
• Uses and disclosures of genetic information for underwriting purposes (where applicable).
• Other uses and disclosures not described in this Notice or otherwise required or permitted by law.

4. Special Notice Regarding Telehealth and AI-Enabled Tools

As a digital-first practice, we use telehealth platforms (audio, video, and secure messaging) and may use artificial intelligence ("AI") tools to support clinical documentation (AI scribes), patient communication (AI chat or messaging assistants), phone interactions (AI voice agents for scheduling, intake, or reminders), and clinical decision support or summarization. AI vendors that access PHI are engaged under Business Associate Agreements. You will be asked to sign a separate Consent for AI-Assisted Communication that describes these uses in greater detail and explains your right to opt out of certain AI-enabled features.

5. Your Rights Regarding Your PHI

A. Right to Inspect and Copy

You have the right to inspect and obtain a copy of PHI we maintain about you, in the form and format you request if readily producible (including electronic copies). We may charge a reasonable, cost-based fee. Certain records may be excluded by law.

B. Right to Request Amendment

You may request that we amend PHI in our designated record set if you believe it is incorrect or incomplete. Requests must be in writing and include a reason supporting the request. We may deny your request in certain circumstances permitted by law.

C. Right to an Accounting of Disclosures

You have the right to receive a list of certain disclosures we have made of your PHI, generally for the six (6) years prior to your request, excluding disclosures for treatment, payment, health care operations, and certain other purposes.

D. Right to Request Restrictions

You may ask us to restrict certain uses or disclosures of your PHI for treatment, payment, or health care operations, or to family members or friends involved in your care. We are not required to agree to all requests, but we will agree to a request to restrict disclosures to a health plan when the disclosure is for payment or health care operations and the PHI relates solely to a service for which you (or someone other than the plan) have paid in full out of pocket.

E. Right to Confidential Communications

You have the right to request that we communicate with you about health matters in a particular way or at a particular location (for example, only by mobile phone or only at a specific email address). We will accommodate reasonable requests.

F. Right to Be Notified of a Breach

You have the right to be notified following a breach of unsecured PHI affecting you.

G. Right to a Paper Copy of This Notice

You have the right to receive a paper copy of this Notice upon request, even if you have agreed to receive it electronically.

H. Right to Choose Someone to Act for You

If you have given someone medical power of attorney or if someone is your legal guardian, that person may exercise your rights and make choices about your PHI.

6. How to Exercise Your Rights or File a Complaint

To exercise any of your rights, or to ask questions about this Notice, please contact our Privacy Officer:

Privacy Officer, My4MLife

Email: support@my4mlife.com

Website: https://my4mlife.com

Requests may be made by email. Please write "Privacy Request" in the subject line.

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint.

U.S. DHHS, Office for Civil Rights:

• 200 Independence Avenue, S.W., Washington, D.C. 20201
• Toll-free: 1-877-696-6775
• https://www.hhs.gov/ocr/privacy/hipaa/complaints/

7. Changes to This Notice

We reserve the right to change this Notice and to make the revised Notice effective for PHI we already have about you as well as any PHI we receive in the future. Copies of the current Notice are available at our office and on our website at https://my4mlife.com/legal/privacy-notice. The effective date appears at the top of this Notice.

8. Acknowledgment

Please sign below to acknowledge receipt of this Notice. Your signature does not constitute consent for any specific use or disclosure of PHI; it only confirms that you have received this Notice.

____________________________________ ____________________________________

Patient / Personal Representative Signature Date

____________________________________ ____________________________________

Printed Name Relationship to Patient (if applicable)

For Office Use Only — If we were unable to obtain a written acknowledgment, document the reason here:

[REASON ACKNOWLEDGMENT NOT OBTAINED]