I. WEBSITE HIPAA NOTICE

NECTAR HEALTH, LLC

NOTICE OF PRIVACY PRACTICES PURSUANT TO THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996

(HIPAA)

THIS NOTICE DESCRIBES AND INFORMS YOU HOW YOUR MEDICAL INFORMATION MAY BE USED AND DISCLOSED.

SPECIFICALLY, HOW YOUR MEDICAL INFORMATION MAY BE:

(A) PROCESSED, USED OR DISCLOSED, AND (B) ACCESED BY YOU.

PLEASE TAKE THE TME TO READ THIS PAGE CAREFULLY.

WE ARE AVAILABLE TO YOU FOR ANY QUESTIONS, COMMENTS OR CONCERNS

This Notice of Privacy Practices/HIPAA relates to Nectar Health, LLC and applies to NECTAR’s affiliated entities and persons (collectively, “NECTAR”) except as may relate to any services not amenable to any Department of Health and Human Services (“HHS”) adopted standards or relevant federal or state laws and regulations.

NECTAR’S COMMITMENT TO PROTECT YOUR MEDICAL INFORMATION

Under HIPAA, NECTAR must maintain the privacy of your confidential and private information. Your private, confidential healthcare information is referred to as “Protected Health Information” (“PHI”). HIPAA requires that NECTAR notify you of NECTAR’s PHI privacy practices. NECTAR is committed to, and follows HIPAA, to protect your PHI and its confidentiality. Our HIPAA mandate requires that NECTAR establish policiesand procedures to ensure NECTAR’s compliance under this (and other federal and state) privacy law. Nonetheless, NECTAR complies with all legal requirements that allow for, among other things, your access to your information under HIPAA.

NECTAR USE AND DISCLOSURE OF PHI

Pursuant to HIPAA’s standards, please see below the circumstances under which NECTAR may make use of or disclose your PHI. We note that additional requirements under separate federal or state laws and regulations may limit NECTAR from the uses and disclosures described.

IF YOU HAVE ANY QUESTIONS, CONCERN, COMPLAINTS OR REQUESTS, PLEASE SEE THIS PAGE FOR THE RELEVANT NECTAR CONTACT INFORMATION. WE REMAIN COMMITTED TO FOLLOWING HIPAA AND RESPECTING ALL LAWS THAT GOVERN YOUR RIGHTS TO YOUR INFORMATION.

NECTAR MAY USE OR DISCLOSE YOUR PHI UNDER THE FOLLOWING

MANDATES, STANDARDS OR CIRCUMSTANCES

A.NECTAR MAY, OR MAY BE REQUIRED TO, USE OR DISCLOSE YOUR PHI REGARDING:

(1)YOUR HEALTHCARE TREATMENT. NECTAR may use or disclose your PHI as it pertains to your treatment — including, disclosure to your physician or other relevant healthcare provider. For example, NECTAR may disclose your PHI to a relevant healthcare professional that provides or coordinates your healthcare services, treatment, products, or prescriptions.

(2)REIMBURSEMENT/PAYMENT FOR SERVICES. NECTAR may use or disclose your PHI relevant to NECTAR’s claims submission and reimbursement for the services NECTAR provides. In short, NECTAR must communicate directly or indirectly with payor for the services that we provide.

(3)NECTAR’S HEALTH CARE OPERATIONS. NECTAR may use or disclose your PHI relevant to NECTAR’s health care operations. For example, as relevant to necessary evaluations of our testing services, their accuracy, and certain accreditation, management or operations matters. As consistent with all laws, such PHI disclosures may also include for healthcare operations of providers or plans/programs related to your healthcare (e.g., coordination of healthcare/benefits, disease management).

(5)JUDICIAL AND OTHER PROCEEDINGS. NECTAR may use or disclose your PHI relevant under specific judicial or other proceedings. For example, in its response to proper demands pursuant to court or other proceeding order, subpoenas, discovery requests or any other proper and legal process.

(6)A SERIOUS THREAT TO HEALTH OR SAFETY. NECTAR may use or disclose your PHI in circumstances where the disclosure is necessary to mitigate or prevent imminent and serious threats to the health or safety of a person, the public or in the course of law enforcement’s acts to identify or arrest individuals.

(7)RESEARCH. NECTAR may use or disclose your PHI for research purposes. What are known as “Limited Data or Records,” can be seen by researchers in their efforts to identify patients that may be important in research activities, for example, but noting that such researchers may not copy or take possession of any PHI. Prior to any such PHI disclosure, NECTAR expect that one of the following will occur: (1) a “special committee” will be tasked with determining that the relevant research activity will not post a risk to privacy, including the existence of adequate safeguards in place for any PHI; (2) for PHI of the deceased, assurances are in place that PHI use is limited to the research; or (3) PHI provided shall not directly identify you.

(8)CERTAIN GOVERNMENT FUNCTIONS. NECTAR may use or disclose PHI of military personnel/ veterans (in certain circumstances) and as may be required by authorized, appropriate government authorities. Similarly, NECTAR may disclose PHI to authorized, appropriate government officials as may be relevant to national security purposes. Examples include, the protection of the President,intheconductofintelligenceorcounter-intelligencegatheringorother nationalsecurityactivities. Ifever relevant,NECTARshall only make such a disclosure as required and in compliance with laws and regulations.

(9)WORKERS' COMPENSATION. NECTAR may use or disclose your PHI as otherwise authorized by laws and regulations, for example, in relation to workers' compensation programs that regulate work injury or illness benefits.

(10)PUBLIC HEALTH MATTERS. NECTAR may use or disclose your PHI relevant to public health. Public health activity disclosures may relate to: (a) a public health authority; for example, relevant to reporting, preventing or controlling injuries, diseases, or disabilities;

(b)relevant to reporting births/deaths, child abuse/neglect; (c) the Food and Drug Administration ("FDA"); for example, as relevant to the quality, safety, effectiveness of regulated activities or products — this may include, notifying people of recalled or problems with FDA-regulated products or adverse medication reactions; (d) a person that may have been or is at risk of having been exposed to a disease or condition, and/or may be at risk of transmitting a disease or condition; and, (e) an employer in certain limited circumstances of workplace injury or illness, but all subject to all federal and state laws and regulations.

(11)ABUSE, NEGLECT OR DOMESTIC VIOLENCE VICTIMS. NECTAR may be required to use or disclose PHI relevant to abuse, neglect, or domestic violence victims. Pursuant to applicable law and regulation, NECTAR may disclose PHI to a government agency, authority or function, for example, social services, if NECTAR reasonably believesthat a person is an abuse, neglect, or domestic violence victim.

(12)REGARDING HEALTHCARE SERVICES OVERSIGHT. NECTAR may be required to use or disclose PHI to healthcare services oversight activities;for example,fora government agency’soversight authorizedbylaw whichmayincludecivil, criminalor administrative investigations, proceedings, prosecutions or action, including disciplinary, licensure, audits, inspections, audits, licensure/disciplinary actions, or other activities necessary for appropriate oversight of the health care system, government benefit programs, and compliance with regulatory requirements and civil rights laws.

B.NECTAR MAY, OR MAY BE REQUIRED TO, USE OR DISCLOSE YOUR PHI TO:

(1)THOSE INVOLVED IN YOUR HEALTHCARE OR ITS PAYMENT. NECTAR may use or disclose your PHI relevant to such persons that are part of your receipt of healthcare or that pay for your healthcare; for example, a family member. Also, NECTAR may use or disclose your PHI in certain circumstances; for example, relevant to disaster relief efforts. Further, NECTAR may use or disclose PHI of minors or incapacitated persons to their parents or legal guardian — subject to all federal and state law standards and requirements.

(2)BUSINESS ASSOCIATES (AS DEFINED BY LAW). NECTAR may use or disclose your PHI to NECTAR’s Business Associates as required to perform its operations, for example, when such operations are supported by the Business Associate’s services to NECTAR. NECTAR requires that its Business Associates secure the confidentiality and privacy of your PHI in the same way as NECTAR. Similarly, if properly requested by a healthcare provider or health plan/program, NECTAR may disclose PHI to its Business Associates relevant to the performance of health care services – e.g., Medicare business associate needs relevant to medical necessity audits.

(3)LAW AND LAW ENFORCEMENT. NECTAR may be required to use or disclose your PHI as otherwise required by federal, state, or local law. Further, NECTAR may use or disclose your PHI for law enforcement purposes. For example, in response to court orders, warrants, subpoenas/summons, or other proper authorized by law. Similarly, NECTAR may use or disclose your PHI when it is required

as authorized by law, relevant to: (a) the location/identification of suspects, fugitives, material witnesses or missing persons; (b) crime victims;

(c)a deceased person; (d) criminal conduct at a NECTAR facility; or (e) emergencies involving a crime, including reporting and location of same or its victims, or the location, identity, description of the perpetrator.

(4)CORONERS, MEDICAL EXAMINERS, AND FUNERAL DIRECTORS. NECTAR may be required to use or disclose your PHI as otherwise required by federal, state, or local law germane to a medical examiner/coroner or funeral director. For example, when such disclosure is required for the identification of a decedent, to determine cause of death, or relevant to performing such other duties authorized by laws and regulations.

(5)PERSONAL REPRESENTATIVE. NECTAR may be required to use or disclose your PHI as otherwise required, established or allowed by federal, state, or local law to a personal representative, an administrator, executor, or other authorized individual that may be associated with you and your estate.

(6)A CORRECTIONAL INSTITUTION. NECTAR may be required to use or disclose the PHI as otherwise required, established or allowed by federal, state, or local law of an inmate or other individual, as may be requested by law enforcement or correctional institution officials and as relevant to health, safety, and security purposes.

C.NECTAR MAY, OR MAY BE REQUIRED TO, USE OR DISCLOSE YOUR PHI THAT CONSTITUTES DE-IDENTIFIED INFORMATION AND LIMITED DATA SETS: NECTAR may use/disclose “de-identified” healthcare information. Information that has been “de-identified” constitutes information that has been edited in such a manner that certain identifiers that may have identified you; that is, in a manner that makes it unlikely that the person could be identified from the information. Similarly, NECTAR may disclose “limited health information” which may be contained in a “limited data set.” A “limited data set” contains no information that may directly identify you, such as, your state, city, county or zip code, but certainly not your name, age, phone number or address.

OTHER USES AND DISCLOSURES OF PHI

NECTAR explicitly states that pursuant to any purpose not set out above, NECTAR will not use or transfer PHI without your explicit authorization; for example, use or disclosure of your PHI by NECTAR for marketing purposes. In such an example, NECTAR will not “sell” your PHI; any use or disclosure not allowed for under the law requires your authorization. We note that if you ever have given your authorization for such a use, you retain sole and absolute discretion to revoke such authorization, except as may be relevant to a prior NECTAR use or disclosure in reliance on your prior consent.

INFORMATION BREACH NOTIFICATION

If NECTAR ever discovers that a breach of unsecured PHI has occurred, NECTAR is required to notify you of same except in the case that the circumstances of same demonstrates (for example, based on a risk assessment) that the breach presents with a low probability that such PHI has been actually compromised. Nonetheless, a notification will be made without delay, but not later than sixty days subsequent to the breach discovery. The notification includes the facts relevant to the breach and information on mitigating harm.

YOUR RIGHTS REGARDING PHI

The HIPAA establishes the following in regards to your PHI rights:

A.YOUR RIGHT TO RECEIVE A COPY OF NECTAR’S PRIVACY PRACTICES NOTICE. You have a right to receive NECTAR’s Privacy Practices Notice. You may request the Notice at any time and through NECTAR’s Privacy Officer at Nectar Health, LLC – ATTN. Privacy Officer, compliance@nectarhealthcorp.com. NECTAR’s notice is nonetheless posted on its website.

B.YOUR RIGHT TO REQUEST THAT NECTAR LIMIT THE USE AND DISCLOSURE OF YOUR PHI. Under the law, you can request that NECTAR limit: (1) how NECTAR uses or discloses PHI relevant to any health care operations activity, including regarding treatment or payment; or 2) whether NECTAR disclosed your PHI to persons involved in your healthcare or for its payment. We note that pursuant to your request, NECTAR will follow the law and consider your request, but you must understand that NECTAR may in some cases not be required to agree to your request if it is not allowed under the law in the case your request involves disclosure to a health payment program regarding payment or health care operations (and not for treatment) and you have paid for NECTAR’s services in full and out of pocket. In cases where NECTAR has agreed to your request, NECTAR will memorialize agreed-upon restrictions in writing and will comply with our agreement – we further note, that NECTAR may not so abide under emergency circumstances when such a disclosure is for treatment purposes.

C.YOUR RIGHT TO REQUEST CONFIDENTIAL COMMUNICATIONS. You retain the right to request that NECTAR communicate with you relevant to PHI, for example, via a different address or by a certain communication means. NECTAR will accommodate any reasonable request to change the mode or address through which we communicate with you.

D.YOUR RIGHT TO INSPECT AND RECEIVE A COPY OF YOUR PHI. You or your personal representative have a right to access your NECTAR relevant PHI, for example, your reports ordered by your physician. If you so request, and unless an exception applies, your will receive (within 30 days after NECTAR’s receipt of your request) a copy of your NECTAR held documentation. An exception may apply when a licensed health care professional determines that such access requested may endanger your or another person life or safety of you or another person. In such a case, NECTAR may extend our response time for an additional 30 days (but you can expect to be provided in writing, the reason(s) for the delay, and when you will have access). You retain the right to your PHI in electronic format if same is reasonably reproducible in such a format. Nonetheless, you retain the right to instruct NECTAR to send your data to such other person as you may designate in a writing that has your signature and through which you explicitly designate such person. PHI requests may be made: (1) when you visit a NECTAR relevant facility; (2) by completing NECTAR’s request form; (3) by contacting NECTAR’s Privacy Officer at compliance@nectarhealthcorp.com.

E.YOUR RIGHT TO RECEIVE A DISCLOSURE ACCOUNTING. You have the right to receive and accounting of the instances that NECTAR has disclosed your PHI. Please note that such an accounting may not include all PHI disclosures, for example, for those disclosures made in writing by you or regarding disclosures prior a date on which NECTAR was required to comply. Your accounting request for PHI disclosures made for purposes other than treatment, payment, or health care operations, will include such disclosures made in the past six years; except in the case your request is for a shorter period. An accounting request for PHI disclosures made for purposes of treatment, payment, or health care operations, will include disclosures made in the past three years; except in the case your request is for a shorter period.

F.YOUR RIGHT TO CORRECT OR UPDATE. At any time that you conclude that your PHI includes a mistake, you retain the right to request that NECTAR correct such mistake. If NECTAR denies your request to correct or update, NECTAR will provide to you an explanation in writing setting out the reason(s) for NECTAR’s decision to deny your request to correct or update.

INFORMATION ON HOW TO ACCESS YOUR RIGHTS UNDER THIS NOTICE

To access your rights under HIPAA/this Notice, send your request in writing to:

Nectar Health, LLC – ATTN. Privacy Officer, at

.

Nonetheless, if you wish to contact NECTAR regarding any billing, claims, or other insurance matter, please contact us at the number or department contact information set out in the documentation you have received from or relevant to NECTAR and its partner labs.

HOW TO FILE A COMPLAINT – CONTACTING NECTAR

If you want to file a complaint, or have any questions, either as relevant to NECTAR’s processing, use or disclosure of your medical information, the preceding information, or our privacy practices, you are encouraged to reach out to compliance@nectarhealthcorp.com or reach out to us at (888) 665-0238. Separately and additionally, you may send to us any written request, complaint or question at:

Nectar Health, LLC – ATTN. Privacy Officer, at

.

Nonetheless, you retain your right to file any complaint with the U.S. Department of Health and Human Services. NECTAR has a zero- tolerance policyagainst retaliation for anyone, including you, filing a complaint regarding medical information privacy mattersor practices or any other matter.

CHANGES TO THIS PRIVACY PRACTICES NOTICE

NECTAR may change this notice or its privacy policies in the future. If so, such changes may relate to your medical information/PHI that NECTAR may maintain. At all times, NECTAR shall act consistent with our notice to you and our privacy policies in effect. If changes to our notice(s) to you or our privacy policies occur, NECTAR will update this Notice on this Website. For your most current information, please periodically review this Website for any relevant changes.

THE EFFECTIVE DATE OF THIS NOTICE/PUBLISHED ON: January 1st 2021