Privacy Policy and Notice of Privacy Practices

This policy covers two things at once:

1. The Utah Bloom portal, including your member account, the content and pricing guides we publish, and the emails and text messages we send you.
2. Your health information, meaning the records created when you are seen by our clinic for a medical card evaluation, telehealth visit, labs, or any other clinical service. Some services are performed by outside clinicians we refer you to. This notice covers the records we hold. Those clinicians give you their own notice for the records they hold.

Your health information is protected by federal law (HIPAA) and by Utah law. Sections 4 through 7 below are our Notice of Privacy Practices and describe those protections. The rest of this policy describes how the website and membership work.

In this policy, "Utah Bloom," "we," "us," and "our" mean Lotus Health, Inc., located at 1776 S Main St, Salt Lake City, Utah 84115. "You" means a patient, member, or visitor to our site.

Information you give us

• Name, date of birth, email address, mailing address, and phone number
• Account login credentials for the portal
• Membership status and billing history
• Health information you share with us during a visit, on a consent form, or through the portal
• Messages you send us

Information created by your care

• Evaluation notes, diagnoses, and provider recommendations
• Medical card status and renewal dates
• Lab orders, imaging orders, and results
• Referrals we make on your behalf

Information collected automatically

• Basic technical data such as browser type, device type, and pages viewed
• Cookies that keep you logged in and remember your preferences

We do not sell your personal information, and we do not sell your health information. Ever.

We use the information above to:

• Provide your care and keep your medical card current
• Create and maintain your portal account
• Process your membership payment and send receipts
• Send renewal reminders, appointment notices, and membership updates
• Show you the cost savings options, partner pricing, and wellness content that come with membership
• Answer your questions and provide support
• Keep the portal secure and working properly
• Meet our legal and licensing obligations

Federal law lets us use and disclose your protected health information without your written authorization for the following purposes.

Treatment. We use your health information to provide and coordinate your care. For example, we may send your lab order to Labcorp, share imaging orders with a radiology partner, or discuss your history with another provider treating you.

Referrals to outside clinicians. Some services, including some medical card evaluations, are performed by licensed clinicians outside our practice. When we refer you to one, we share what they need in order to evaluate and treat you. That clinician keeps their own records of the care they provide and operates under their own privacy notice, which they will give you.

Payment. We use your health information to bill and collect for services. For example, we may confirm that a service was performed in order to process your payment.

Health care operations. We use your health information to run the clinic. For example, we review records for quality improvement, train staff, and evaluate provider performance.

Business associates. Some services are performed for us by outside companies, such as our electronic health record system, our email and text messaging platform, and our payment processor. We share only what they need to do their work, and each one signs an agreement requiring them to protect your information the same way we do.

Appointment reminders and health-related benefits. We may contact you about appointments, renewals, treatment alternatives, and health-related services that may interest you. You may ask us to stop at any time.

Required by law. We will disclose your health information when federal, state, or local law requires it.

Public health and safety. We may disclose your health information to public health authorities, to report abuse or neglect, to report problems with a product or medication, or to prevent a serious and imminent threat to the health or safety of you or someone else.

Health oversight, courts, and law enforcement. We may disclose your health information to a health oversight agency for audits and investigations, in response to a court order or lawful subpoena, and to law enforcement in the limited circumstances the law allows.

Workers' compensation, coroners, and organ donation. We may disclose your health information as authorized by workers' compensation laws and to coroners, medical examiners, funeral directors, and organ procurement organizations.

Others involved in your care. If you agree, or if you do not object, we may share relevant information with a family member or friend who is involved in your care.

Uses that always require your written permission

We will not do any of the following without your signed authorization:

• Use or disclose psychotherapy notes, other than as narrowly permitted by law
• Use or disclose your health information for marketing purposes where we receive payment from a third party for the communication
• Sell your health information

You may revoke an authorization in writing at any time. Revoking it stops future uses and disclosures, but it cannot undo anything we already did while the authorization was in effect.

Any use or disclosure not described in this notice will be made only with your written permission.

Utah law treats your participation in the state medical cannabis program as confidential. We follow those rules on top of HIPAA:

• We do not confirm to anyone that you are a medical cannabis patient without your written authorization, unless the law requires us to.
• Utah does not maintain a public list of medical cannabis patients, and your name does not appear in any public record because of your card.
• Your employer has no right to your registry information through us.
• Law enforcement may verify card status through the state system only. They do not receive your qualifying condition, your provider's notes, or your purchase history from us.
• We report to the state Electronic Verification System only what the Utah Department of Health and Human Services requires in order to issue and renew your card.

If you have a substance use disorder treatment record with us, that record carries additional federal protection under 42 CFR Part 2. You may give a single consent covering future treatment, payment, and operations disclosures, you may revoke that consent, and anyone who receives those records may not pass them on without your further permission.

You have the right to:

Get a copy of your records. Ask us for your medical and billing records in paper or electronic form. We will respond within 30 days. We may charge a reasonable cost based fee.

Ask us to correct your records. If you believe something is wrong or incomplete, ask us in writing to amend it. We may deny the request, and if we do we will tell you why in writing.

Request confidential communication. Ask us to contact you at a specific phone number or address, or to leave no voicemail. We will accommodate reasonable requests without asking why.

Ask us to limit what we use or share. You may ask us to restrict how we use or disclose your information. We are not required to agree, with one exception: if you pay in full out of pocket for a service, you may direct us not to share information about that service with a health plan, and we must honor it.

Get a list of disclosures. Ask for an accounting of certain disclosures we made in the six years before your request.

Get a paper copy of this notice. Ask us at any time, even if you agreed to receive it electronically.

Choose someone to act for you. A person with medical power of attorney or a legal guardian may exercise these rights on your behalf once we verify their authority.

Be notified of a breach. We will tell you if a breach compromises the privacy or security of your health information.

File a complaint. See Section 14.

To exercise any of these rights, contact our Privacy Officer using the details in Section 15.

• We are required by law to keep your health information private and secure.
• We are required to give you this notice describing our legal duties and privacy practices, and to follow the terms of the notice currently in effect.
• We must tell you promptly if a breach occurs that compromises your information.
• We will not use or share your information other than as described here unless you tell us in writing that we may.
• We reserve the right to change this notice. A revised notice will apply to all health information we maintain, including information created before the change. The current version is always posted on the portal, and a copy is available at our office.

When you become a member or give us your phone number, you may receive:

• Renewal and appointment reminders
• Membership and billing notices
• Portal updates and cost savings content

We use ActiveCampaign to send these messages. Your name, contact details, membership status, and renewal dates are stored there so the reminders reach you on time.

You control this. Every email includes an unsubscribe link. Reply STOP to any text to stop texts, and HELP for help. Message and data rates may apply from your carrier. Turning off marketing messages will not stop essential messages about your care, your card, or your billing.

A large part of what membership gives you is a curated list of cash pay providers and programs, including imaging centers, labs, GI practices, and health cost sharing options.

Here is how your information moves, and does not move, in that process:

• Browsing costs nothing. Looking at partner pricing on the portal shares nothing with that partner.
• We share only when you ask us to. If you ask us to place an order or make a referral, we send that partner only what they need to serve you, such as your name, date of birth, contact information, and the order itself.
• We do not send partners a member list. No partner receives your information because you are a member. Only because you requested a service.
• Partner sites are their own. When you click a link and leave the portal, that company's privacy policy governs what happens next. We encourage you to read it.
• We may be compensated. For some partners and programs we receive a referral fee or affiliate commission. That compensation never involves handing over your health information, and it never changes what your provider recommends for your care.

Membership dues and visit fees are processed by a third party payment processor. Your full card number is handled by that processor and is not stored on our systems. We keep a record of what you paid and when.

The portal uses cookies that are necessary to log you in and keep your session working. If we add analytics or advertising tools in the future, we will update this policy before doing so and describe your choices at that time.

We do not place advertising or tracking pixels on pages where you view your health information.

We use administrative, physical, and technical safeguards to protect your information, including access controls, encryption in transit, and staff training. No system is perfectly secure, but we take this seriously and review our practices regularly.

We keep medical records for the period Utah law requires, and we keep membership and billing records as long as needed for tax, accounting, and legal purposes. When records are no longer needed, we destroy them securely.

The portal is intended for adults. Patients under 21 in the Utah medical cannabis program are served through the process the state requires, including parent or guardian involvement. We do not knowingly collect information online from children under 13.

If you believe your privacy rights have been violated, contact our Privacy Officer first. We would like the chance to fix it.

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights:

• Online at www.hhs.gov/ocr/privacy/hipaa/complaints
• By mail at 200 Independence Avenue SW, Washington, DC 20201
• By phone at 1-800-368-1019

We will never retaliate against you for filing a complaint.

We may update this policy as our services change or as the law changes. The effective date at the top tells you which version is current. If we make a material change to how we handle your information, we will notify members by email and post a notice on the portal.