Notice of Privacy Practices

Your information. Your rights. Our responsibilities.

This notice describes how medical information about you may be used and disclosed, and how you can access this information. Please review it carefully.

Who this notice covers

This notice applies to Stone Health Holdings LLC (“Stone”) and the affiliated clinicians, clinician groups, and pharmacy partners that provide care through the Stone platform. These entities may share your protected health information (PHI) with one another as needed to carry out treatment, payment, and health care operations.

Your rights

When it comes to your health information, you have the following rights:

• Get an electronic or paper copy of your medical record.
• Ask us to correct information you believe is inaccurate or incomplete.
• Request confidential communications (for example, by a specific phone or address).
• Ask us to limit what we use or share.
• Receive a list of those with whom we’ve shared your information.
• Get a paper copy of this notice, even if you agreed to receive it electronically.
• Choose someone to act for you (for example, a legal guardian or medical power of attorney).
• File a complaint if you believe your privacy rights have been violated.

Get an electronic or paper copy of your medical record

You can ask to see or get a copy of your medical record and other health information we have about you. We will provide a copy or summary, usually within 30 days of your request. We may charge a reasonable, cost-based fee.

Ask us to correct your medical record

You can ask us to correct health information about you that you think is incorrect or incomplete. We may decline your request, but we’ll explain why in writing within 60 days.

Request confidential communications

You can ask us to contact you in a specific way or to send mail to a different address. We will accommodate all reasonable requests.

Ask us to limit what we use or share

You can ask us not to use or share certain health information for treatment, payment, or our operations. We are not required to agree, and may decline if it would affect your care. If you pay for a service out-of-pocket in full, you can ask us not to share that information with your health insurer for payment or operations, and we will agree unless required by law to share it.

Get a list of those with whom we’ve shared information

You can ask for an accounting of the times we’ve shared your health information for the six years prior to your request, who we shared it with, and why. We’ll include all disclosures except those about treatment, payment, and health care operations, and certain other disclosures. One accounting per year is free; we may charge a reasonable fee for additional requests within 12 months.

Choose someone to act for you

If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will confirm the person has this authority before taking any action.

File a complaint

You can file a complaint with us by contacting Stone using the information at the bottom of this notice. You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by mail to 200 Independence Avenue, S.W., Washington, D.C. 20201, by phone at 1-877-696-6775, or online at www.hhs.gov/ocr/privacy/hipaa/complaints. We will not retaliate against you for filing a complaint.

Your choices

For certain health information, you can tell us your choices about what we share. If you have a clear preference, let us know and we’ll follow your instructions.

You have both the right and choice to tell us to:

• Share information with family, close friends, or others involved in your care.
• Share information in a disaster relief situation.

If you are unable to tell us your preference (for example, if you are unconscious), we may share information if we believe it is in your best interest, or when needed to lessen a serious and imminent threat to health or safety.

We will never share your information for the following purposes without your written permission:

• Marketing purposes.
• Sale of your information.
• Psychotherapy notes, except where permitted by law.

Our uses and disclosures

To treat you

We use your health information and share it with other professionals treating you. Example: a clinician treating you asks another clinician about your overall health.

To run our organization

We use and share your health information to operate the Stone platform, improve your care, and contact you when necessary. We may send appointment reminders and updates by email or text; electronic communications carry a risk of unauthorized access, which you accept by providing your contact information. We may use artificial intelligence and machine learning tools to analyze health information to improve our services and clinical workflows, in compliance with HIPAA. These tools do not replace a licensed clinician’s judgment.

To bill for your services

We use and share your health information to process payment for the services you receive through Stone.

Other permitted uses and disclosures

We may also use or share your information, subject to legal conditions, to:

• Help with public health and safety issues (preventing disease, product recalls, reporting adverse reactions, reporting suspected abuse or neglect, reducing a serious threat to health or safety).
• Conduct health research.
• Comply with federal, state, or local law.
• Respond to organ and tissue donation requests.
• Work with a coroner, medical examiner, or funeral director.
• Address workers’ compensation, law enforcement, health oversight, and other government requests.
• Respond to court orders, subpoenas, and other legal actions.

For more information, see www.hhs.gov/ocr/privacy/hipaa/understanding/consumers.

Our responsibilities

• We are required by law to maintain the privacy and security of your protected health information.
• We will let you know promptly if a breach occurs that may have compromised your information, no later than 60 days after discovery.
• Where state laws provide greater privacy protection than HIPAA, we will follow state law.
• We must follow the duties and privacy practices described in this notice and provide you a copy.
• We will not use or share your information other than as described here unless you tell us we can in writing. You may change your mind at any time by notifying us in writing.

Changes to this notice

We may change the terms of this notice, and the changes will apply to all information we have about you. The updated notice will be available on our website and upon request.

Contact

To exercise any of the rights above, ask questions about this notice, or file a complaint, contact our Privacy Office at support@stonehealth.co.