Notice of Privacy Practices

Summary

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully. It explains when your health information may be used or shared, the rights you have over it, and how to use those rights or make a complaint. Nimbus Healthcare Corporation and the licensed clinicians who provide your care follow this notice. You can ask for a paper copy at any time.

Who this notice applies to

This notice applies to Nimbus Healthcare Corporation and to the licensed clinicians who provide care through Nimbus patient programs and who have agreed to follow this notice (together, "we"). Lake Hills Pharmacy issues its own notice of privacy practices, available at lakehillsrx.com.

Nimbus Healthcare Corporation provides technology, administrative and support services to those clinicians. It does not practice medicine. Medical decisions are made by your licensed clinician.

This notice covers your protected health information. That is information about your health, your care or payment for your care that identifies you and that we create or receive through the patient programs offered on our website and in our member app (the "Patient Programs"). The federal law known as HIPAA requires us to give you this notice.

This notice does not cover information from the public pages of our website that is not health information. The Privacy Policy covers that information. The Consumer Health Data Privacy Policy covers certain health-related information that HIPAA does not cover. You can read the Lake Hills Pharmacy notice at lakehillsrx.com.

Your rights

You have the following rights over your health information. To use any of them, follow the steps in the section called How to use your rights and file a complaint.

• Get a copy of your records. You can ask to see or get an electronic or paper copy of your medical record and other health information we have about you. You can also ask us to send a copy to another person you name. We will respond within the time the law requires. Under HIPAA that is generally 30 days, with one extension of up to 30 days in limited cases. If we need an extension, we will tell you why. If the law allows us to charge a reasonable, cost-based amount for copies, we will tell you the amount before we make them. If you live in Texas and ask in writing for an electronic copy of your electronic health record, we provide it within 15 business days after we receive your request, unless the law allows more time.
• Ask us to correct your records. If you think information in your record is wrong or incomplete, you can ask us to amend it. We will respond in writing within 60 days. If we say no, we will tell you why in writing, and you may file a statement of disagreement that becomes part of your record.
• Ask for confidential communications. You can ask us to contact you in a specific way or at a specific place, such as through a different email address. We will say yes to reasonable requests, and we will not ask you why.
• Ask us to limit what we use or share. You can ask us not to use or share certain information for treatment, payment or our operations. We do not have to agree, and we may say no if it would affect your care. If you pay for a service or item out of pocket in full and ask us not to share information about it with your health plan for payment or operations, we will say yes unless a law requires us to share it.
• Get a list of disclosures. You can ask for a list of the times we have shared your health information in the six years before your request, who we shared it with and why. The list does not include disclosures for treatment, payment and operations, disclosures you asked us to make or authorized in writing, and certain other disclosures the law excludes. We will give you one list each year at no charge. If you ask for another list within 12 months, we may charge a reasonable, cost-based amount.
• Get a paper copy of this notice. You can ask for a paper copy at any time, even if you agreed to receive this notice electronically.
• Choose someone to act for you. If you have given someone medical power of attorney, or if someone is your legal guardian, that person can use your rights and make choices about your health information. We will check that the person has this authority before we act.
• File a complaint. If you believe we have violated your rights, you can complain to us or to the federal government. We will not retaliate against you for filing a complaint. See the last section for how to file.

Your choices

For some information, you can tell us what you want us to do.

• Family and friends. You can tell us whether we may share information with family members, close friends or others who are involved in your care or in payment for your care. If you cannot tell us your preference, for example because you are unconscious, we may share information when we believe it is in your best interest. We may also share information to lessen a serious and imminent threat to health or safety.
• Marketing. We will not use or share your health information for marketing without your written authorization. Communications about your own treatment and care are not marketing.
• Sale of health information. We will not sell your health information without your written authorization.
• Fundraising. We will not use or share your health information for fundraising without your written authorization.
• Psychotherapy notes. Psychotherapy notes receive extra protection. We will not use or share them without your written authorization, except in the narrow cases the law allows.

How we use and share your health information

We may use and share your health information in the following ways. Not every example applies to every person.

• Treatment. We may use and share information to provide, coordinate and manage your care. For example, your clinician may share information with a pharmacy, such as Lake Hills Pharmacy, with a laboratory, or with another clinician who is involved in your care. Lake Hills Pharmacy is owned by an affiliate of Nimbus Healthcare Corporation. You may choose another pharmacy at any time, and your clinician will send your prescription to the pharmacy you choose where the law and the pharmacy permit.
• Payment. We may use and share information to process your payments and to obtain payment for the care you receive. The Patient Programs are self-pay.
• Health care operations. We may use and share information to operate the Patient Programs and the technology that supports them, to improve care, to review the quality of care, to train staff, to answer your questions and support requests, to meet licensing and legal requirements, and for business planning and management. We may de-identify your health information as HIPAA defines it, and we use de-identified data to improve our services, including the artificial intelligence tools that support clinicians. Where the law permits, we may use your health information to develop, test and improve those tools as part of our health care operations; you can manage optional uses in the Notification and Privacy Center in your account.
• Business associates. We may share information with organizations that perform services for us, such as hosting, messaging, payment processing, identity verification and shipping. These organizations must protect your information and may use it only for the services they provide to us.
• Health information exchange. We may take part in health information exchanges. These allow the clinicians who treat you to share information about your care electronically.
• Public health and safety. We may share information for public health activities, such as preventing or controlling disease, reporting reactions to medications or problems with products, reporting suspected abuse, neglect or domestic violence as the law requires, and notifying people of product recalls.
• Health oversight. We may share information with agencies that oversee health care, for audits, investigations, inspections and licensing.
• Legal proceedings. We may share information in response to a court or administrative order, a subpoena or another lawful process. We may also share information when the U.S. Department of Health and Human Services asks to review our compliance with federal privacy law.
• Law enforcement. We may share limited information with law enforcement officials for purposes the law allows, such as responding to a court order or warrant, identifying or locating a suspect, witness or missing person, or reporting certain crimes.
• Research. We may use or share information for research only with your written authorization, or when an institutional review board or privacy board has approved a waiver as the law allows, or in a limited form that does not directly identify you.
• Serious threats. We may use or share information to prevent or lessen a serious and imminent threat to the health or safety of a person or the public. We will share it only with someone able to help prevent the threat.
• Specialized government functions. We may share information with military command authorities, with federal officials for national security and intelligence activities and for the protection of the President and others, and with correctional institutions that have custody of a person.
• Workers' compensation. We may share information to comply with workers' compensation laws.
• Required by law. We may use or share information when a federal, state or local law requires it.
• Electronic disclosure. We may disclose your health information electronically, for example to a pharmacy, a laboratory or another provider involved in your care, as this notice and the law permit.
• Coroners, medical examiners and funeral directors. We may share information about a person who has died with a coroner, a medical examiner or a funeral director, and for organ and tissue donation.

Some federal and state laws give extra protection to certain kinds of sensitive health information. When a stricter law applies, we follow it.

Uses that require your written authorization

We will use or share your health information for any purpose that this notice does not describe only with your written authorization. The law also requires your written authorization for most uses and disclosures of psychotherapy notes, for marketing, and for the sale of health information, as described above.

You may revoke an authorization at any time by sending a written notice to privacy@nimbushealthcare.com or to the mailing address in the last section. Revoking an authorization stops future uses and disclosures. It does not undo what we already did in reliance on your authorization.

Our responsibilities

• We are required by law to maintain the privacy and security of your protected health information.
• We will tell you promptly, as the law requires, if a breach occurs that may have compromised the privacy or security of your information.
• We must follow the duties and privacy practices described in this notice and give you a copy of it.
• We will not use or share your information in ways this notice does not describe unless you tell us in writing that we can. You may change your mind at any time by telling us in writing.
• The licensed clinicians who provide care through the Patient Programs have agreed to follow this notice.

Changes to this notice

We may change the terms of this notice. The new terms will apply to all health information we hold about you, including information we created or received before the change. We will post the new notice at nimbushealthcare.com/notice-of-privacy-practices and will give you a copy on request.

How to use your rights and file a complaint

To use a right described in this notice, to ask a question or to make a complaint, contact our Privacy Official:

• Email: privacy@nimbushealthcare.com
• Mail: Nimbus Healthcare Corporation, Attention: Privacy Official, 12005 Bee Cave Road, Suite 1A, Austin, Texas 78738

We may ask you to verify your identity before we act on a request.

You can also file a complaint with the HHS Office for Civil Rights, 200 Independence Avenue SW, Washington, DC 20201, 1-800-368-1019, www.hhs.gov/ocr/privacy/hipaa/complaints.

We will not retaliate against you for filing a complaint.

Dispute resolution

Nothing in our Terms of Use limits your rights under this notice, including your right to file a complaint with us or with a regulator.

Effective date

This notice is effective October 11, 2026. It was last updated on October 11, 2026.