Joint Notice of Privacy Practices

EFFECTIVE DATE: September 30, 2025

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Joint Notice of Privacy Practices (the “Notice”) applies to Headspace Medical Group (CA) P.C. and its affiliated providers that collectively form an Organized Health Care Arrangement (“OHCA”). Where this Notice refers to “Headspace Medical,” “we,” “us,” or “our,” it is referring collectively to all members of the OHCA. For a full list of the entities making up the OHCA, please contact our privacy office using the contact information at the end of this Notice. This Notice describes our obligations and your rights under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) along with how we may use and disclose your protected health information (“PHI”).

Headspace Medical provides mental health services including coaching, therapy, and psychiatry. Headspace Medical is affiliated with Headspace, Inc. and its affiliates (“Headspace”), where Headspace provides management and administrative services to Headspace Medical and functions as its Business Associate as defined by HIPAA.

OUR RESPONSIBILITY

We are required by law to:

• maintain the privacy of your health information, (“PHI”)
• provide you notice of our legal duties and privacy practices with respect to your PHI,
• notify you following a breach that compromises the privacy or security of your PHI, and
• abide by the terms of this Notice.

This Notice is provided to you electronically and we reserve the right to change our privacy practices and the terms of this Notice and make those changes effective for all PHI we maintain. We will post any updated version of this Notice on Headspace’s website or otherwise provide it to you.

HOW WE MAY USE AND DISCLOSE YOUR HEALTH INFORMATION

Your PHI may be used and disclosed for treatment, payment, healthcare operations and other purposes permitted or required by law. Headspace Medical may use and disclose your PHI for the following purposes.

TREATMENT

We may use or disclose your PHI to provide coaching, tele­health, therapy, and psychiatry services as part of our product and service offerings. We may also disclose PHI to doctors, therapists, or other healthcare providers who are involved in taking care of you and your health.

PAYMENT

We may use and disclose PHI about you so that the health services you receive may be billed to and payment may be collected from you, an insurance company, or a third party.

HEALTHCARE OPERATIONS

We may use and disclose PHI about you for activities necessary to support, operate, and improve our products and services. For example, we may use your PHI to monitor and/or improve the quality of our services, respond to patient inquiries, and review the competence and qualifications of our providers and coaches.

DE-IDENTIFIED DATA

We may de-identify your PHI by removing information that identifies you, such as your name and address, according to the standards provided by HIPAA. We may use this de-identified data for any purpose including to develop new products, improve our services, or to work with others who assist us in doing the same. This de-identified data is not considered PHI.

OHCA MEMBERS

As mentioned at the beginning, Headspace Medical is part of an OHCA. We may share your PHI among participants of the OHCA for treatment, payment, and healthcare operations.

BUSINESS ASSOCIATES

We may disclose your PHI to other companies or individuals, known as "Business Associates," who provide services to us or on our behalf. For example, we may use a company to perform billing services or process prescription orders on our behalf. Our Business Associates are contractually required to protect the privacy and security of your PHI and notify us of any improper disclosure of information.

PERSONS INVOLVED IN YOUR CARE OR PAYMENT FOR CARE

We may disclose limited PHI to a family member or other individual involved in your care or payment for your health care.

PERSONAL REPRESENTATIVES

We may disclose PHI about you to an authorized personal representative, such as a lawyer, administrator, executor, or other authorized person responsible for you or your estate. We may take steps to verify that the individual has been properly authorized before taking any action.

THREAT TO HEALTH AND SAFETY

We may disclose PHI to prevent or reduce the risk of a serious and imminent threat to your health or safety, or to the health and safety of another person or the general public.

COMMUNICATIONS ABOUT OUR PRODUCTS AND SERVICES

We may use and disclose your PHI to contact you about other Headspace Medical products and services which we believe may be of interest to you.

LAW ENFORCEMENT

We may disclose your PHI to the police or other law enforcement officials as required by law or in compliance with a court order, warrant, subpoena, summons, or other legal process for locating a suspect, fugitive, witness, missing person, or victim of a crime.

AS REQUIRED BY LAW

We must disclose your PHI when required to do so by any applicable law.

JUDICIAL AND ADMINISTRATIVE PROCEEDINGS

Under certain circumstances, we may disclose your PHI in the course of a judicial or administrative proceeding in response to a court order, subpoena, or other lawful process.

RESEARCH

Under certain circumstances, we may use or disclose your PHI for research purposes. In preparation for research, we may review limited PHI to draft research protocols, to identify prospective research participants, or for similar purposes.

HEALTH AND GOVERNMENT AGENCIES

As permitted by HIPAA, we may also disclose your PHI to:

• Public Health Authorities
• The Food and Drug Administration
• Health Oversight Agencies
• Military Command Authorities
• National Security and Intelligence Organizations
• Correctional Institutions
• Organ and Tissue Donation Organizations
• Coroners, Medical Examiners and Funeral Directors
• Workers Compensation Agents

USES AND DISCLOSURES REQUIRING YOUR PERMISSION

We will ask for your written authorization before using or disclosing your PHI for any purpose not described above. You may revoke your authorization, in writing, at any time, except for disclosures that the company has already acted upon or are required by law. Headspace Medical will not sell your PHI, disclose your PHI for marketing purposes, or disclose your psychotherapy notes unless you provide written authorization as required by law.

YOUR RIGHTS

You have the following rights with respect to your PHI. To exercise any of these rights, please send a written request to our Privacy Office using the contact information provided at the end of this Notice.

Right to inspect and copy: You have the right to inspect or copy the PHI maintained by us. You also have the right to have us send an electronic copy of your medical record to a third party. We may deny your request in certain circumstances and we may charge a reasonable fee for costs incurred.

Right to receive confidential communications: You have the right to request that we communicate with you about your PHI by alternative means or to an alternative address, email, or phone number. Your request must be in writing and must specify the alternative means or location.

Right to amend: If you believe the PHI we maintain about you contains an error, you may request that we correct or update your information. Your request must be in writing and must explain why the information should be corrected or updated. We may deny your request under certain circumstances and provide a written explanation.

Right to an accounting: You may request a list of certain disclosures of your PHI made by us or our business associates for purposes other than treatment, payment, healthcare operations and certain other activities. The request must be in writing and state a time period, which may not be longer than the prior six years.

Right to request restrictions: You have the right to request restrictions on our use and disclosure of your PHI. While we will consider all requests for additional restrictions carefully, we are not required to agree to a requested restriction except for Payment or Operations restrictions where payment has been made "out-of-pocket" and “paid-in-full.”

Right to request a copy of this notice: Upon request, you may obtain a paper copy of this Notice You can find the current electronic copy on the Headspace website at: https://www.headspace.com/notice-of-privacy-practices.

QUESTIONS AND COMPLAINTS

If you have questions or would like more information about this Notice, please contact us using the contact information below.

If you believe that we have violated your privacy rights, you may submit a complaint to us using the contract information below or to the U.S. Department of Health and Human Services Office for Civil Rights. Headspace Medical will not take retaliatory action against you if you choose to file a complaint.

CONTACT INFORMATION

When communicating with us regarding this Notice, our privacy practices, or your privacy rights, please contact us using the following contact information:

Headspace Medical Group (CA), P.C.
Attn: Privacy Officer
2417 Michigan Ave
Santa Monica, CA 90404
privacy@headspace.com