HIPAA Notice of Privacy Practices

Covenix Health LLC ("Covenix Health," "we," "us," or "our") is a telehealth-based precision performance medicine practice committed to safeguarding the privacy and security of your protected health information (PHI) as required by the Health Insurance Portability and Accountability Act (HIPAA) and its implementing regulations. This Notice of Privacy Practices outlines our policies and procedures regarding the use, disclosure, and protection of your PHI. Please review this notice carefully.

Purpose of PHI Use and Disclosure

We collect, use, and disclose your PHI only for purposes related to your healthcare and for other purposes permitted by HIPAA. Such purposes include treatment, payment, and healthcare operations. We may also use your PHI for other purposes with your written authorization or as required or permitted by law.

• Treatment: We use your PHI to provide, coordinate, and manage your healthcare, including sharing information with other providers involved in your care (e.g., compounding pharmacies, laboratory services).
• Payment: We may use and disclose your PHI to obtain payment for services rendered, including billing and collection activities.
• Healthcare Operations: We may use your PHI for internal operations such as quality assessment, training, compliance activities, and improving our services.

Your Rights

You have certain rights regarding your PHI under HIPAA, including the right to:

• Request access to your PHI.
• Request an amendment to your PHI if you believe it is inaccurate or incomplete.
• Request an accounting of disclosures of your PHI.
• Request restrictions on the use and disclosure of your PHI.
• Request confidential communication of your PHI (e.g., via a specific phone number or email).
• Receive notice of a breach of your unsecured PHI.
• File a complaint about our privacy practices without fear of retaliation.

To exercise any of these rights, please contact our Privacy Officer using the contact information provided at the bottom of this notice.

Disclosure of PHI

We will only disclose your PHI as necessary for authorized purposes, including treatment, payment, healthcare operations, and as required or permitted by law. We may share your PHI with our business associates, such as compounding pharmacies, laboratory partners, and technology platforms, provided they have signed appropriate Business Associate Agreements (BAAs) to protect your PHI in accordance with HIPAA requirements.

As a telehealth practice, all PHI transmitted through our platform is protected using industry-standard encryption and secure communication protocols. We do not sell your PHI to third parties.

Security Measures

Covenix Health maintains physical, electronic, and procedural safeguards to protect your PHI. Access to your PHI is restricted to authorized personnel who have a legitimate need to access it in the course of providing your care. We regularly conduct risk assessments and maintain ongoing compliance with HIPAA Security Rule requirements, including:

• Encryption of PHI in transit and at rest.
• Secure, HIPAA-compliant telehealth and electronic health record platforms.
• Access controls and audit logging for all systems containing PHI.
• Regular staff training on HIPAA privacy and security obligations.

Notice of Privacy Practices

This Notice of Privacy Practices explains your rights and our privacy practices as required by HIPAA. This notice is available at any time on our website at covenix.health/hipaa-privacy-policy and will be provided to you at the time of your first service. We reserve the right to amend this notice at any time. Any changes will be effective for all PHI we maintain, including information created or received before the effective date of the changes. The most current version will always be available on our website.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer or with the U.S. Department of Health and Human Services Office for Civil Rights at hhs.gov/hipaa/filing-a-complaint. We will not retaliate against you in any way for filing a complaint.

Changes to This Notice

We reserve the right to amend this HIPAA Notice of Privacy Practices at any time. Any changes will be effective for all PHI we maintain, including information created or received before the effective date of the changes. Please visit our website or contact our Privacy Officer for the most current version of this notice.

Contact Information

For questions, requests, or complaints related to this HIPAA Notice of Privacy Practices, please contact our Privacy Officer:

This HIPAA Notice of Privacy Practices is effective as of March 24, 2026 and is subject to periodic review and revision. Please visit our website or contact our Privacy Officer for the most current version of this notice.