HIPAA Notice of Privacy Practices

DRAFT — Pending Attorney Review. The HIPAA Notice of Privacy Practices (“NPP”) is legally required content and must be reviewed by qualified healthcare counsel before ReddyDoc accepts its first patient. The NPP structure below follows 45 CFR § 164.520.

Last updated: July 4, 2026 · Effective date: [pending attorney sign-off]

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our commitment to your privacy

ReddyDoc (“we,” “us,” “our“) is required by law to protect the privacy of your protected health information (“PHI“), provide you with this Notice of our legal duties and privacy practices, and follow the terms of the version of this Notice currently in effect. PHI includes any information that can identify you and relates to your past, present, or future physical or mental health, healthcare treatment, or payment for healthcare.

How we may use and disclose your health information

Uses and disclosures that do not require your authorization

The following uses and disclosures may be made without your authorization:

• For treatment: we use PHI to provide medical services and coordinate your care. For example, our clinicians review your intake responses to make prescription decisions, and we share information with our pharmacy partner so they can fulfill your prescription.
• For payment: we use PHI to bill and collect payment for services rendered. For example, we may verify your identity with a payment processor.
• For healthcare operations: we use PHI to run our practice — quality improvement, credentialing, workforce training, audit, licensing, insurance, legal services, and business management. Access is limited to workforce members with a legitimate need.
• Business associates: we share PHI with third parties who perform services on our behalf under a written Business Associate Agreement. Our subprocessors are listed in our Privacy Policy and at reddydoc.com/subprocessors.
• As required by law: including public health reporting, communicable disease surveillance, adverse drug reaction reporting to the FDA, and mandatory reporting of abuse, neglect, or domestic violence.
• Health oversight activities: including audits, investigations, inspections, and licensure or disciplinary actions.
• Judicial and administrative proceedings: in response to a subpoena, court order, or discovery request that meets HIPAA requirements.
• Law enforcement purposes: as required by law or a valid court order.
• Coroners, medical examiners, and funeral directors: to carry out their duties.
• Organ or tissue donation: if you are an organ donor.
• Research: only with your written authorization, or where an Institutional Review Board has waived the authorization requirement in accordance with HIPAA.
• To prevent a serious threat to health or safety: to the extent necessary to prevent or lessen a serious and imminent threat.
• Military and veterans: as required for military command authorities.
• Workers’ compensation: as authorized by workers’ compensation law.

Uses and disclosures that require your written authorization

• Marketing communications where we would receive payment from a third party.
• Sale of PHI — which we do not do.
• Most uses and disclosures of psychotherapy notes, if any exist.
• Other uses and disclosures not described in this Notice.

You may revoke your authorization in writing at any time. Revocation does not affect uses or disclosures we made in reliance on the authorization before we received your written revocation.

Your rights regarding your PHI

• Right of access: you may inspect and receive a copy of your PHI. Requests must be made in writing to privacy@reddydoc.com. We will provide access within 30 days, extendable by 30 days with written notice. We may charge a reasonable, cost-based fee for copies.
• Right to request amendment: you may request that we correct PHI you believe is inaccurate or incomplete. We may deny your request under certain circumstances and will provide our reasons in writing.
• Right to an accounting of disclosures: you may request a list of disclosures we made of your PHI, other than for treatment, payment, healthcare operations, and certain other exceptions, for the six years before your request.
• Right to request restrictions: you may ask us to restrict how we use or disclose your PHI. We are not required to agree, except that we must agree to your request to restrict disclosures to a health plan for a service you paid for out of pocket in full.
• Right to confidential communications: you may request that we contact you in a specific way (for example, by mail rather than email) or at a specific location.
• Right to a paper copy of this Notice: available on request even if you have agreed to receive it electronically.
• Right to be notified of a breach: we will notify you if a breach of your unsecured PHI occurs, in accordance with 45 CFR §§ 164.400–414.
• Right to complain: to us or to the U.S. Department of Health and Human Services Office for Civil Rights. We will not retaliate against you for filing a complaint.

Our responsibilities

• We are required by law to maintain the privacy and security of your PHI.
• We will let you know promptly if a breach occurs that may have compromised the privacy or security of your PHI.
• We must follow the duties and privacy practices described in this Notice and give you a copy of it.
• We will not use or share your PHI other than as described here unless you tell us in writing that we can.

Changes to this Notice

We reserve the right to change this Notice at any time. Changes apply to all PHI we maintain, including PHI created or received before the change. Any changes will be posted here with a new effective date, and, where required, we will provide the revised Notice to you.

Complaints and contact

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights.

• To file with ReddyDoc: email our Privacy Officer at privacy@reddydoc.com or write to ReddyDoc Privacy Officer, [address pending]. Phone: +1 (888) 512-9213.
• To file with OCR: hhs.gov/ocr. Complaints must be filed within 180 days of when you knew or should have known of the alleged violation.

You will not be penalized in any way for filing a complaint.