Notice of Privacy Practices

Effective Date: August 17, 2026

Your Information. Your Rights. Our Responsibilities.

This Notice describes how medical information about you may be used and disclosed, how you may obtain access to that information, and the rights available to you regarding your health information.

Please review it carefully.

Evolve BioRx facilitates access to telehealth services provided by independent licensed healthcare providers. Medical care, including evaluation, diagnosis, treatment decisions, and prescribing, is provided by the applicable licensed healthcare provider.

This Notice applies to Protected Health Information (“PHI”) maintained or processed in connection with healthcare services to the extent the applicable organization or healthcare provider is subject to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).

The healthcare provider responsible for your treatment and medical record is the HIPAA-covered entity responsible for complying with the applicable requirements of HIPAA.

Protected Health Information

PHI is individually identifiable information concerning your past, present, or future physical or mental health condition, healthcare services provided to you, or payment for healthcare that is created, received, maintained, or transmitted by a HIPAA-covered entity or its business associate.

Examples may include:

• Your name and identifying information
• Medical history
• Symptoms
• Diagnoses
• Treatment information
• Prescription information
• Laboratory information
• Provider communications
• Pharmacy information
• Payment information associated with healthcare
• Other information contained within your medical record

How Your Health Information May Be Used and Disclosed

HIPAA permits healthcare providers to use and disclose PHI in certain circumstances without obtaining separate written authorization.

Treatment

Your PHI may be used and shared to provide, coordinate, or manage your healthcare. For example, information may be shared among your treating healthcare provider, pharmacy, laboratory, or another healthcare professional involved in your care.

Payment

PHI may be used or disclosed for activities necessary to obtain or process payment for healthcare services.

Healthcare Operations

PHI may be used for healthcare operations, including:

• Quality assessment and improvement
• Provider credentialing
• Compliance activities
• Audits
• Administrative functions
• Fraud and abuse prevention
• Legal services
• Business planning
• Service improvement

Business Associates

Certain third-party companies may provide services that require access to PHI, including telehealth technology, pharmacy coordination, communications, hosting, administrative services, or other healthcare-support functions.

When HIPAA requires it, covered entities require these organizations to appropriately safeguard PHI through Business Associate Agreements or other applicable contractual protections.

Public Health and Safety

PHI may be disclosed when permitted or required for public-health activities, including:

• Disease prevention or control
• Reporting adverse events
• Reporting suspected abuse or neglect
• Product recalls
• Preventing or reducing a serious threat to health or safety

Health Oversight Activities

PHI may be disclosed to authorized governmental agencies for activities such as audits, investigations, inspections, licensing activities, and other legally authorized oversight functions.

Judicial and Administrative Proceedings

PHI may be disclosed in response to a valid court order, subpoena, administrative request, or other lawful process when the requirements of applicable law have been satisfied.

Law Enforcement

PHI may be disclosed to law-enforcement officials in circumstances permitted or required by law.

Workers’ Compensation

PHI may be disclosed when authorized or required by laws governing workers’ compensation or similar programs.

Coroners, Medical Examiners, and Funeral Directors

PHI may be disclosed when permitted by law for purposes such as identifying a deceased person or determining a cause of death.

Organ and Tissue Donation

When applicable, PHI may be disclosed to organizations involved in organ, eye, or tissue donation and transplantation.

Research

PHI may be used or disclosed for approved research purposes when applicable legal requirements have been satisfied.

Required by Law

PHI may be used or disclosed when required by federal, state, or local law.

Uses Requiring Authorization

Certain uses or disclosures of PHI require your written authorization unless otherwise permitted by law.

These may include certain:

• Marketing activities
• Sales of PHI
• Uses of psychotherapy notes
• Disclosures to persons or organizations not otherwise authorized to receive your information

If you provide written authorization, you may generally revoke that authorization in writing at any time. Revocation will not affect actions already taken in reliance on the authorization.

Substance Use Disorder Records

If we or your healthcare provider maintain substance use disorder patient records protected under 42 CFR Part 2, additional confidentiality protections may apply.

Part 2 records generally may not be used or disclosed in civil, criminal, administrative, or legislative investigations or proceedings against you unless specifically permitted by applicable law, including where you have provided appropriate consent or where disclosure is authorized by an appropriate court order.

Where required, you will be given an opportunity to make choices regarding certain uses or disclosures of Part 2 information.

Your Rights Regarding Your Health Information

You have important rights regarding your PHI.

1. Inspect and Obtain a Copy of Your Records

You may request to inspect or obtain a paper or electronic copy of medical and billing records and other PHI maintained about you.

In most circumstances, the healthcare provider will provide access within the period required by applicable law. A reasonable, cost-based fee may be charged where permitted by law. Certain information may be excluded from access when permitted by law.

How to Exercise This Right

Contact the healthcare provider responsible for your care or medical record.

If you are unsure whom to contact, email [email protected] and Evolve BioRx will assist in directing your request to the appropriate provider or privacy contact.

2. Request an Amendment or Correction

If you believe PHI maintained about you is inaccurate or incomplete, you may request an amendment. The healthcare provider may deny your request under certain circumstances permitted by law. If a request is denied, you may have the right to submit a written statement explaining your disagreement.

3. Request Confidential Communications

You may request that your healthcare provider communicate with you regarding health matters in a particular manner or at an alternative location. Reasonable requests will be accommodated where required by law.

4. Request Restrictions

You may request restrictions concerning certain uses or disclosures of PHI for treatment, payment, or healthcare operations. Healthcare providers are generally not required to agree to all restriction requests.

However, certain requested restrictions involving disclosures to a health plan may be required when you have paid for the applicable service in full out of pocket and other legal requirements are satisfied.

5. Receive an Accounting of Certain Disclosures

You may request a list of certain disclosures of your PHI made during the period allowed by law. The accounting generally does not include every disclosure, such as many disclosures made for treatment, payment, or healthcare operations.

6. Obtain a Copy of This Notice

You may request a paper or electronic copy of this Notice at any time. You may obtain a copy even if you previously agreed to receive the Notice electronically.

7. Choose Someone to Act for You

If you have given another person legal authority to act on your behalf, such as through a healthcare power of attorney or legal guardianship, that person may exercise your privacy rights to the extent permitted by law. Appropriate documentation may be required before the person is permitted to act on your behalf.

8. File a Complaint

You have the right to complain if you believe your privacy rights have been violated. You may submit a complaint directly to the healthcare provider responsible for your health information.

For assistance identifying the appropriate provider or privacy contact, contact:

Evolve BioRx
Email: [email protected]

You may also file a complaint with:

U.S. Department of Health and Human Services
Office for Civil Rights

Information about filing an HIPAA privacy complaint is available through the U.S. Department of Health and Human Services.

You will not be retaliated against for filing a privacy complaint.

Our Legal Duties

A healthcare provider subject to HIPAA is required by law to:

• Maintain the privacy and security of your PHI.
• Follow the duties and privacy practices described in the provider’s current Notice of Privacy Practices.
• Provide you with notice describing the provider’s privacy practices and legal duties.
• Notify affected individuals following a breach of unsecured PHI when notification is required by law.
• Provide access to PHI and honor other patient privacy rights as required by applicable law.
• Limit uses and disclosures of PHI to those permitted or required by law.
• Obtain written authorization when a use or disclosure is not otherwise permitted by law.
• Maintain appropriate administrative, physical, and technical safeguards designed to protect PHI.

We will not use or disclose PHI in a manner inconsistent with applicable law.

Changes to This Notice

Privacy practices and this Notice may change from time to time. Any revised Notice will apply to PHI maintained as permitted by applicable law. The current version of this Notice will be posted on evolvebiorx.com and will be made available upon request.

Questions and Privacy Requests

For general questions concerning this Notice or assistance identifying the healthcare provider responsible for your medical record, contact:

Evolve BioRx
Website: evolvebiorx.com
Email: [email protected]

For requests involving access, copies, amendments, restrictions, accounting of disclosures, or other rights concerning a medical record, Evolve BioRx may direct the request to the applicable treating healthcare provider or designated privacy officer responsible for that record.