Right to Thrive Health, Inc. ("RTT," "we," or "us") is committed to protecting the privacy and confidentiality of client information. This Privacy Notice explains how RTT collects, uses, stores, and discloses information provided to RTT in connection with its patient advocacy, support, navigation, research, and coordination services.

RTT and HIPAA. RTT is not a healthcare provider, health plan, or health care clearinghouse, and is not a "covered entity" under the Health Insurance Portability and Accountability Act ("HIPAA"). Health information that you give RTT, or that your providers release to RTT at your direction, may no longer be protected by HIPAA once RTT receives it. RTT protects that information as described in this Notice and as required by applicable state law, including state consumer health data and genetic privacy laws.

RTT may collect and maintain information including:

• Contact information;
• Demographic information;
• Medical records;
• Physician notes;
• Hospital records;
• Pathology reports;
• Imaging reports and images;
• Laboratory results;
• Genomic and genetic testing reports;
• Treatment histories;
• Insurance-related information;
• Payment and billing information;
• Information about biological specimens collected by your providers or laboratories, and data derived from them;
• Device, browser, and usage information collected through our website and communications platforms;
• Information relating to therapeutic opportunities and healthcare services.

RTT may use information to:

• Evaluate client cases;
• Research therapeutic opportunities;
• Identify clinical trials and investigational therapies;
• Coordinate communications with healthcare providers, researchers, manufacturers, and other authorized parties;
• Facilitate laboratory, pathology, genomic, and specimen-related activities;
• Maintain internal records and case files;
• Improve RTT programs and services;
• Conduct research, educational, publication, and program development activities as authorized by the patient;
• Create de-identified or aggregated data, and license or sell de-identified data, as described in Section 5;
• Process payments and Pass-Through Costs;
• Comply with law and protect the rights, safety, and property of RTT, our clients, and others.

RTT may share information, only as you authorize in a signed authorization or consent, with:

• Healthcare providers;
• Researchers and scientific advisors;
• Academic institutions;
• Pharmaceutical and biotechnology companies;
• Contract Research Organizations (CROs);
• Regulatory authorities;
• Laboratories and testing facilities;
• Other organizations involved in evaluating or facilitating therapeutic opportunities.

RTT may otherwise share information only (a) with service providers (such as cloud hosting, e-signature, and payment vendors) that process it for RTT under written confidentiality obligations; (b) as required by law, subpoena, or court order; (c) to prevent fraud or serious harm; and (d) in connection with a merger, acquisition, financing, or sale of RTT's assets, subject to the commitments in this Notice. RTT does not distribute information that identifies you.

RTT may de-identify your information and may license or sell de-identified or aggregated data (including data derived from biospecimens) to third parties, including pharmaceutical, biotechnology, diagnostic, and data companies, for research, product development, and commercial purposes, and RTT may be compensated for it. RTT de-identifies information using either the HIPAA Safe Harbor method, 45 C.F.R. § 164.514(b)(2), or the HIPAA Expert Determination method, 45 C.F.R. § 164.514(b)(1), will not attempt to re-identify it, and contractually prohibits recipients from re-identifying it or combining it with other data to do so.

RTT keeps your information for as long as needed to provide its services and pursue the research and program activities you have authorized, and as required by law. Biospecimens held by partner laboratories or biobanks are subject to those organizations' retention practices.

RTT uses reasonable administrative, technical, and organizational safeguards designed to protect information from unauthorized access, disclosure, loss, misuse, or alteration.

Despite these safeguards, no method of electronic storage or transmission can be guaranteed to be completely secure. If RTT learns of a breach of the security of your information, RTT will notify you and others as required by applicable law.

You may contact RTT to:

• Request copies of signed authorizations and consents;
• Update contact information;
• Ask questions regarding RTT's information practices;
• Revoke authorizations to the extent permitted by law and applicable agreements;
• Request access to, correction of, or deletion of your information, subject to legal exceptions and except for information that has already been de-identified or used in completed research, publications, or regulatory submissions;
• Withdraw consent to RTT's collection or sharing of your health information going forward.

Depending on where you live, you may have additional rights under state law (for example, Washington's My Health My Data Act, Nevada SB 370, Connecticut's consumer health data law, or state genetic privacy laws), including the right to appeal RTT's denial of a request. RTT will not discriminate against you for exercising these rights. To make a request or appeal, email inquiries@rtthealth.com.

RTT may update this Privacy Notice from time to time. RTT will post the current version on its website and will notify you by email before any material change takes effect. RTT will obtain your consent before using information already collected in a materially different way where the law requires it.

Questions regarding this Privacy Notice may be directed to:

Right to Thrive Health, Inc.
Mail: 2025 Riverside Drive, STE 35941, Columbus, OH 43221
Email: inquiries@rtthealth.com