Effective date: July 14, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, HOW YOU CAN OBTAIN ACCESS TO THIS INFORMATION, AND YOUR RIGHTS REGARDING THAT INFORMATION. PLEASE REVIEW IT CAREFULLY.

Who This Notice Applies To

This Notice applies to clinical services provided by Digital Medical Care, P.C.; TXMD of California, P.C.; TXMD of Kansas, P.A.; and TXMD of Texas, P.C. (each, as applicable to a patient, the “Provider Group”), including the licensed healthcare professionals and workforce members acting for the applicable Provider Group.

Kurea is a consumer-facing brand operated by Altura Ventures LLC. Kurea and Altura Ventures LLC are not medical providers. They provide non-clinical administrative and technology support and may perform functions for a Provider Group as a business associate or other service provider. Rimo Health LLC supplies technology used to facilitate care. Independent licensed pharmacies maintain their own privacy practices and may provide a separate notice.

This Notice concerns protected health information (“PHI”) created or maintained in connection with clinical care. The Kurea Privacy Policy separately describes information collected through the public website and non-clinical services.

The Provider Group’s Duties

The applicable Provider Group is required by law to:

• Maintain the privacy and security of your PHI.

• Provide this Notice explaining its legal duties and privacy practices.

• Follow the terms of the Notice currently in effect.

• Notify affected individuals following a breach of unsecured PHI when required by law.

• Refrain from retaliating against you for exercising a privacy right or filing a complaint.

The Provider Group may revise this Notice and make the revised practices effective for PHI already maintained as well as PHI received in the future. The current Notice will be available through the Kurea website and secure clinical platform and upon request.

How PHI May Be Used and Disclosed

Treatment

PHI may be used and disclosed to provide, coordinate, or manage your healthcare. For example, information may be shared among Providers, pharmacies, laboratories, other treating professionals, and care-team members involved in your treatment.

Payment

PHI may be used and disclosed to bill for and collect payment for healthcare services, verify payment status, address charge questions, and coordinate payment-related activities. Kurea operates as a cash-pay service and generally does not submit insurance claims on your behalf.

Healthcare Operations

PHI may be used and disclosed for healthcare operations, including quality assessment, patient-safety activities, training, credentialing, auditing, compliance, legal services, business planning, customer service, technology administration, and evaluating Provider performance.

Business Associates

PHI may be disclosed to business associates that perform services involving PHI, such as Rimo Health LLC and vendors providing technology, secure communications, records support, payment administration, or other operational functions. Business associates are required to protect PHI as provided by law and contract.

Treatment Alternatives and Health-Related Services

PHI may be used to contact you about treatment alternatives, follow-up care, refill reminders, or health-related services that may be relevant to you, as permitted by law. You may opt out of communications where an opt-out right applies.

People Involved in Your Care or Payment

With your agreement, or when professional judgment determines it is in your best interest, relevant PHI may be disclosed to a family member, friend, personal representative, or another person involved in your care or payment. In an emergency or when you are unable to express a preference, limited information may be shared when permitted by law.

Public Health and Safety

PHI may be used or disclosed for legally authorized public-health activities, including disease prevention, adverse-event reporting, product recalls, reporting suspected abuse or neglect, and preventing or reducing a serious and imminent threat to health or safety.

Health Oversight

PHI may be disclosed to health-oversight agencies for activities authorized by law, including audits, inspections, licensure actions, investigations, and disciplinary proceedings.

Legal and Administrative Proceedings

PHI may be disclosed in response to a court or administrative order, subpoena, discovery request, or other lawful process when applicable legal requirements are satisfied.

Law Enforcement

PHI may be disclosed to law enforcement when permitted or required by law, including to comply with legal process, report certain injuries or crimes, identify a person, or address a death potentially resulting from criminal conduct.

Coroners, Medical Examiners, and Funeral Directors

PHI may be disclosed as necessary for legally authorized duties involving identification, cause of death, or funeral arrangements.

Organ and Tissue Donation

PHI may be disclosed to organizations involved in organ, eye, or tissue donation and transplantation as permitted by law.

Research

PHI may be used or disclosed for research when an institutional review board or privacy board has approved the research or another HIPAA authorization or exception applies.

Workers’ Compensation

PHI may be disclosed as authorized by workers’ compensation and similar laws.

Specialized Government Functions

PHI may be disclosed as permitted by law for military and veterans’ activities, national security, protective services, correctional institutions, and other specialized government functions.

Required by Law

PHI will be used or disclosed when required by federal, state, or local law.

Uses Requiring Authorization

Uses and disclosures not described in this Notice will generally require your written authorization. Most uses and disclosures of psychotherapy notes, uses of PHI for marketing, and sales of PHI require authorization unless an exception applies.

If you provide authorization, you may revoke it in writing at any time. Revocation will not affect action already taken in reliance on the authorization and may be subject to other limitations permitted by law.

The Provider Group will not sell PHI or use clinical information for targeted advertising without any authorization required by law. Advertising pixels must not be placed on secure intake, patient-portal, or clinical pages in a manner that discloses PHI.

Your Rights

Obtain a Copy of Your Medical Record

You may inspect or obtain an electronic or paper copy of PHI maintained in a designated record set, with limited exceptions. The Provider Group will generally respond within the period required by law and may charge a reasonable cost-based fee where permitted. If access is denied, you will receive a written explanation and information about any review right.

Request a Correction

If you believe PHI is inaccurate or incomplete, you may request an amendment. The request should be in writing and explain the reason. The Provider Group may deny the request in circumstances permitted by law and will provide a written explanation. You may submit a statement of disagreement.

Request Confidential Communications

You may request that communications about PHI be sent by an alternative method or to an alternative location. Reasonable requests will be accommodated as required by law.

Request Restrictions

You may request limits on certain uses or disclosures for treatment, payment, or healthcare operations or disclosures to people involved in your care. The Provider Group is not required to agree to every request.

If you pay in full out of pocket for a specific item or service, you may request that PHI concerning that item or service not be disclosed to a health plan for payment or healthcare operations. The Provider Group will honor the request when required by law unless disclosure is otherwise legally required.

Receive an Accounting of Disclosures

You may request a list of certain disclosures of PHI made during the six years before your request. The accounting does not include disclosures for treatment, payment, or healthcare operations and other disclosures excluded by law. One accounting in a 12-month period is provided without charge; a reasonable fee may apply to additional requests after advance notice.

Obtain a Paper Copy

You may request a paper copy of this Notice at any time, even if you agreed to receive it electronically.

Choose a Personal Representative

If a person has legal authority to act for you, such as through a healthcare power of attorney or legal guardianship, that person may exercise your rights as permitted by law. Verification of authority may be required.

File a Complaint

You may file a complaint if you believe your privacy rights were violated. You will not be retaliated against for filing a complaint.

Complaints or requests may be sent to:

Privacy Officer for the Applicable Provider Group, c/o Kurea
Altura Ventures LLC
1309 Coffeen Ave STE 1200
Sheridan, WY 82801
Email: contact@kureacare.com
Telephone: +1 (888) 864-2119

Kurea will administratively route clinical privacy requests and complaints to the applicable Provider Group.

You may also file a complaint with:

U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue SW
Washington, DC 20201
Website: www.hhs.gov/ocr/privacy/hipaa/complaints/

Questions and Copies

For questions, assistance identifying your applicable Provider Group, or a paper copy of this Notice, contact contact@kureacare.com or +1 (888) 864-2119.