THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

I. OUR COMMITMENT TO YOUR PRIVACY

FuzeRx Pharmacy LLC and its affiliates (“FuzeRx,” “we,” “our,” or “us”) are dedicated to protecting the privacy and security of your Protected Health Information (“PHI”). PHI is information about you, including basic demographic information, that may identify you and that relates to your past, present or future physical or mental health or condition and related health care services.

This Notice of Privacy Practices (“Notice”) describes how we may use and disclose your PHI to carry out treatment, payment, or healthcare operations, and for other purposes permitted or required by law. It also describes your rights to access and control your PHI.

We are required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Health Information Technology for Economic and Clinical Health (HITECH) Act, federal regulations governing Substance Use Disorder (SUD) records (42 CFR Part 2), the 2024 HIPAA Privacy Rule to Support Reproductive Health Care Privacy (45 CFR § 164.520), and applicable state laws to:

• Maintain the privacy and security of your PHI and protected health records.

• Provide you with this Notice detailing our legal duties and privacy practices regarding PHI.

• Notify you promptly following any breach of your unsecured PHI.

• Abide by the terms of this Notice currently in effect.

FuzeRx will not use or disclose PHI about you without your written authorization, except as described in this Notice.

II. PERMITTED USES AND DISCLOSURES FOR TREATMENT, PAYMENT, AND OPERATIONS

Under HIPAA, we are permitted to use and disclose your PHI without obtaining your prior written authorization for the following primary purposes:

• For Treatment: We may use your PHI for treatment purposes such as dispensing prescription medications, communicating with covered entities or business associates about your care, and reviewing and counseling you about your health and/or the appropriate usage of your medications. We will document in your record information related to the medications dispensed to you and services provided to you. 

• For Payment: We may contact your health care payor, insurer or pharmacy benefit manager (or their designated agents or business associates) for payment purposes, such as determining payment for your prescription and the amount of your co-payments.  We may bill you or a third-party payer for the cost of prescription medications dispensed to you. The information on or accompanying the bill may include information that identifies you, as well as the prescriptions you are taking. We may also disclose your PHI to other HIPAA covered entities or business associates who may need it for processing of your health care payment activities, such as claims adjudicators or other third party administrators. When you request or utilize copay assistance, manufacturer coupons, or patient assistance programs, we may disclose relevant prescription and billing information to health plans, pharmacy benefit managers, or program clearinghouses as necessary to adjudicate your claim and apply eligible out-of-pocket savings.

• For Healthcare Operations: We use your PHI to support our business and operational functions, including quality assurance, internal compliance audits, identity verification, staff training, customer support, and maintaining secure information technology infrastructure. This includes using operational software tools to support scheduling, claims routing, or digital triage, provided these tools do not make unassisted clinical care decisions without human oversight. We may use your PHI to create de-identified data in accordance with federal HIPAA standards by removing all personal identifiers. Once de-identified, this information is no longer PHI, it does not identify you, and we may use and share it to analyze trends, improve our products and software services, conduct internal research, or for other lawful operational purposes. 

• Business Associates: We may share your PHI with third-party vendors and service providers (“Business Associates”) who perform operational functions on our behalf (e.g., mail delivery couriers, cloud hosting infrastructure, pharmacy billing platforms). All Business Associates are bound by strict contractual agreements to safeguard your PHI in accordance with HIPAA standards.

• Patient Communications and Digital Support: We may contact you via phone, SMS/text message, email, or secure patient portal to provide prescription refill reminders, order shipment alerts, clinical consultations, or information about treatment alternatives and health benefits available to you.

III. OTHER PERMITTED USES AND DISCLOSURES REQUIRED OR ALLOWED BY LAW

Subject to strict legal bounds and applicable statutory protections, we may use or disclose your PHI without your authorization in the following circumstances:

• Public Health and Safety: To public health authorities for preventing or controlling disease, tracking adverse drug events or medication recalls, and reporting suspected child or adult abuse or neglect. When necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person, we may use and disclose your health information in a very limited manner to someone able to help lessen the threat.

• Health Oversight Activities: To government oversight agencies (such as state boards of pharmacy, the FDA, or the Department of Health and Human Services) for audits, investigations, mandatory reporting, inspections, and licensure actions. For example we may disclose to the FDA, or persons under the jurisdiction of the FDA, PHI relative to adverse events with respect to drugs, foods, supplements, products and product defects, or post marketing surveillance information to enable product recalls, repairs, or replacement.

• Law Enforcement & Judicial Proceedings: Pursuant to a valid court order, search warrant, grand jury subpoena, or specific legal mandate (subject to the reproductive care attestation rules described in this Notice).

• As required by Law: We must disclose PHI about you when required to do so by law.

• Coroners, Medical Examiners, and Funeral Directors: To identify a deceased individual or determine cause of death.

• Organ and Tissue Donation: To organ procurement organizations for organ or tissue donation purposes.

• Workers’ Compensation: To comply with state laws relating to workers’ compensation or similar programs.

• Research: Under certain circumstances, we may disclose PHI about you to researchers when their research has been approved by an institutional review board that has reviewed the research proposal and established protocols to ensure the privacy of your information.

• Correctional institution: If you are or become an inmate of a correctional institution, we may disclose PHI to the institution or its agents when necessary for your health or the health and safety of others.

• Military and veterans: If you are a member of the armed forces, we may release PHI about you as required by military command authorities. We may also release PHI about foreign military personnel to the appropriate military authority.

• National security and intelligence activities: We may release PHI about you to authorized federal officials for intelligence, counterintelligence, military and other national security activities authorized by law.

• Victims of abuse, neglect, or domestic violence: We may disclose PHI about you to a government authority, such as a social service or protective services agency, if we reasonably believe you are a victim of abuse, neglect, or domestic violence. We will only disclose this type of information to the extent required by law, if you agree to the disclosure, or if the disclosure is allowed by law and we believe it is necessary to prevent serious harm to you or someone else or the law enforcement or public official that is to receive the report represents that it is necessary and will not be used against you.

• Communication with individuals involved in your care or payment for your care: If you do not object to the disclosure, health professionals such as pharmacists, using their professional judgment, may disclose to a family member, other relative, close personal friend or any person you identify, PHI relevant to that person's involvement in your care or payment related to your care. We may also use or disclose your health information to disaster-relief organizations so that your family or other persons responsible for your care can be notified about your condition, status, and location. We may also make these disclosures after your death unless doing so is inconsistent with any prior expressed preference. We may disclose PHI to your designated personal representative to make health care decisions for you, as we would treat him or her the same way we would treat you with respect to your PHI.

IV. SPECIAL MANDATED STATUTORY PROTECTIONS

Certain types of health information are subject to enhanced privacy protections under federal and state laws. FuzeRx complies strictly with the following heightened standards:

Reproductive Health Care Privacy Protections (45 CFR § 164.520)

In accordance with federal regulations, FuzeRx is strictly prohibited from using or disclosing your PHI to conduct an investigation into, or to impose civil, criminal, or administrative liability on, any person for seeking, obtaining, providing, or facilitating lawful reproductive health care.

• Prohibited Disclosure Example: FuzeRx will not disclose prescription records to state or local law enforcement agencies seeking to investigate a patient for obtaining lawful oral contraceptives, emergency contraception, or other lawful reproductive health medications.

• Attestation Requirement: Before releasing PHI that may relate to reproductive health care for administrative proceedings, health oversight activities, judicial requests, or law enforcement purposes, the party requesting the information must provide a signed, legally binding Attestation affirming that the request is not being made for a prohibited purpose. For example, if a state oversight board requests pharmacy records, they must submit a signed attestation confirming the request is solely for standard regulatory oversight and not to penalize a patient or provider for lawful reproductive care.

• Presumption of Lawfulness: Reproductive health care provided to you is presumed to be lawful under the circumstances provided unless FuzeRx possesses actual knowledge or verifiable evidence to the contrary.

Substance Use Disorder (SUD) Records (42 CFR Part 2 Alignment)

To the extent FuzeRx creates, receives, or maintains patient records subject to 42 CFR Part 2 (federal regulations governing confidential substance use disorder records):

• Proceedings Protection: We cannot use or share your Part 2 SUD records (or testimony regarding them) in civil, criminal, administrative, or legislative proceedings against you without your explicit written consent or a qualifying, specialized court order accompanied by a subpoena.

• Redisclosure Warning: While HIPAA permits a single broad consent for Treatment, Payment, and Operations (TPO), once SUD records are permissibly disclosed outside a Part 2 program, the information may potentially be redisclosed by the recipient and may no longer be protected under 42 CFR Part 2.

V. USES AND DISCLOSURES REQUIRING YOUR EXPLICIT WRITTEN AUTHORIZATION

FuzeRx will obtain your written authorization before using or disclosing PHI about you for marketing purposes (excluding face-to-face communications and refill reminders), to sell your PHI, or for purposes other than those provided above or as otherwise permitted or required by law. 

With your authorization, we may share PHI with manufacturers and their agents in order to request and obtain coupons or voucher discounts on your behalf.

We may also require an authorization prior to using or disclosing psychotherapy notes or other records protected by stricter state or federal privacy laws (e.g., genetic testing records or specific mental health records). Your state and other federal laws may have additional requirements that we must follow or that may be more restrictive than HIPAA on how we use and disclose your health information. If there are more restrictive requirements, even for some of the purposes listed above, we may not disclose your health information without your written permission as required by such laws. For example, we will not disclose your HIV test results without obtaining your written permission, except as permitted by state law. We may also be required by law to obtain your written permission to use and disclose your information related to treatment for a mental illness, developmental disability, or alcohol or drug abuse.

If you change your mind after authorizing a use or disclosure of your health information, you may withdraw your permission by revoking such authorization in writing at any time to rx.privacy@fuzehealth.com. Upon receipt of the written revocation, we will stop using or disclosing PHI in the manner you had previously authorized. However, your decision to revoke the authorization will not affect or undo any use or disclosure of your health information that occurred before you notified us of your decision, or any actions that we have taken based upon your authorization.

VI. YOUR INDIVIDUAL HIPAA RIGHTS

You possess specific statutory rights regarding the PHI maintained by FuzeRx:

1. Right to Inspect and Copy Your Records

You have the right to access and copy PHI about you contained in a designated record set for as long as we maintain the PHI. The designated record set usually will include prescription and billing records. We may charge you a fee as authorized by law to fulfill your request. Upon receiving your request to access your PHI, we are required to respond to you no later than 30 days after the receipt of your request. We may deny your request to inspect and copy in certain limited circumstances. If you are denied access to PHI about you, you may request that the denial be reviewed. You may request access to your health information in a certain electronic form and format, if readily producible, or, if not readily producible, in a mutually agreeable electronic form and format. Further, you may request in writing that we transmit such a copy to any person or entity you designate. Your written, signed request must clearly identify such designated person or entity and where you would like us to send the copy.

2. Right to Request Restrictions

You have the right to request additional restrictions on our use or disclosure of PHI about you. We are not required to agree to such restrictions unless they are regarding disclosure of health information to your health insurance company and: (1) the disclosure is for the purpose of carrying out payment or health care operations and is not otherwise required by law; and (2) the health information pertains solely to a health care item or service for which you or another person (other than your health insurance company) paid for in full. If we agree to your requested restriction, we will comply with your request unless the information is needed to provide you emergency treatment.

3. Right to Request Confidential Communications

You have the right to request that we communicate with you about your pharmacy services in a specific manner or at an alternate location (for example, sending shipment notifications to a P.O. Box or contacting you exclusively at a designated mobile number). Your request must state how or where you would like to be contacted. We will attempt to accommodate all reasonable requests and will not request an explanation from you to be the basis for your request.

4. Right to Amend Your Health Records

If you believe the PHI we maintain about you is incorrect or incomplete, you may submit a written request asking us to amend your record. Include reasoning to support your request. We will review your request and provide a written response. If we deny your request, we will explain the legal basis for the denial in writing. We will respond to your request within 60 days with up to a 30-day extension, if needed. We will respond in a shorter period of time where required by state or other applicable law.

5. Right to an Accounting of Disclosures

You have the right to receive an accounting of the disclosures we have made of PHI about you for most purposes other than treatment, payment, or health care operations. The accounting will exclude certain disclosures, such as disclosures made directly to you, disclosures you authorize, disclosures to friends or family members involved in your care, and disclosures for notification purposes. The right to receive an accounting is subject to certain other exemptions, restrictions, and limitations. Your request must specify the time period, but it may not be longer than six years. We are required to provide you the accounting within 60 days plus one 30-day extension, if needed. The first accounting you request within a 12-month period will be provided free of charge, but you may be charged a reasonable fee for the cost of providing additional accountings. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs have been incurred.

6. Right to Receive a Paper Copy of This Notice

You have the right to obtain a paper copy of this Notice at any time upon request, even if you previously agreed to receive it electronically.

VII. CHANGES AND UPDATES TO THIS NOTICE

FuzeRx reserves the right to amend our privacy practices and the terms of this Notice at any time. Any changes will apply to all PHI we maintain, including information created or received prior to the update. Updated copies of this Notice will be posted on our website and made available upon request.

VIII. COMPLAINTS AND PRIVACY CONTACT INFORMATION

If you believe your privacy rights have been violated, or if you have questions or wish to exercise any of your rights under this Notice, please contact us immediately:

FuzeRx Privacy Officer

Email: privacy@fuzehealth.com

Phone: 1 (800) 874-5881

Mailing Address: 8407 Firebird Drive, Fairfield, Ohio 45011 Building 2, United States

You may also file a formal written complaint with the Secretary of the U.S. Department of Health and Human Services (HHS) Office for Civil Rights by visiting www.hhs.gov/ocr/privacy/hipaa/complaints/ or mailing a letter to the OCR regional office.

FuzeRx strictly prohibits retaliation. We will not penalize, discriminate, or retaliate against you in any way for filing a complaint or exercising your privacy rights.