4Ever Young

Notice of Privacy Practices

Effective Date: May 12, 2026 | THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our Commitment to Your Privacy

This joint Notice of Privacy Practices is issued by the following affiliated professional medical entities, which together participate in an Organized Healthcare Arrangement ("OHCA") as defined in 45 C.F.R. § 164.501 for the purpose of providing coordinated telehealth care across multiple states: (a) Arora Health and Aesthetics HUB, P.A., a Florida professional association; (b) Arora Health of CA, PC, a California professional corporation; (c) Arora Health of NJ, PC, a New Jersey professional corporation; (d) Arora Health of NY, PC, a New York professional corporation; and (e) Arora Health of KS, PC, a Kansas professional corporation, each with a business office at 300 Lenora Street, Suite #958, Seattle, WA 98121 (collectively, the "Practice," "we," "us," or "our"). Each participant in the OHCA is a HIPAA-covered entity responsible for the protected health information ("PHI") it creates, receives, maintains, or transmits. As permitted under 45 C.F.R. § 164.506, OHCA participants may share PHI with one another for treatment, payment, and joint healthcare operations purposes.

4Ever HoldCo LLC, operating the consumer-facing brand "4Ever Young" (the "Platform"), is not an OHCA participant. The Platform provides administrative, technology, billing, scheduling, and care-coordination services to each OHCA participant under a written Business Associate Agreement. References to "we" in this Notice refer to the Practice. The Platform does not make clinical decisions about your care; where the Platform receives PHI in the course of supporting the Practice it is contractually required to safeguard that PHI in accordance with HIPAA.

This Notice applies to all records relating to your care that are created or retained by the Practice and its affiliated providers (and, on the Practice's behalf, by the Platform). It covers both electronic and paper records, including information collected through our telehealth platform and patient portal.

How We May Use and Disclose Your Health Information

The following categories describe the ways we may use and disclose your PHI. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted or required to use and disclose information will fall within one of the categories.

Treatment

We may use your PHI to provide, coordinate, or manage your healthcare and related services. For example, we may disclose your PHI to a licensed physician affiliated with our platform so they can provide you with a telehealth consultation, or to a pharmacy to fulfill a prescription your provider has written. We may also share your health information with other providers involved in your care.

Payment

Because our Services operate on a cash-pay basis, we generally do not use or disclose PHI for insurance billing purposes. However, we may use PHI to process your payment, verify your financial information, and send you billing communications. If you choose to seek reimbursement from your insurer independently, we may provide you with documentation of services rendered at your request.

Healthcare Operations

We may use and disclose your PHI for healthcare operations, which include quality assessment and improvement activities, reviewing provider performance, licensing and accreditation activities, training programs, conducting or arranging for other business activities, and business management and general administrative activities.

Appointment Reminders and Treatment Alternatives

We may use and disclose PHI to contact you as a reminder about appointments or follow-up consultations. We may also use your PHI to tell you about treatment alternatives or other health-related benefits and services that may be of interest to you.

Uses and Disclosures Required by Law

We will disclose PHI about you when required to do so by federal, state, or local law. This includes disclosures to state licensing boards, law enforcement where legally required, and mandatory reporting obligations.

Public Health Activities

We may disclose your PHI for public health activities permitted or required by law, including: reporting of communicable diseases to public health authorities; reporting abuse, neglect, or domestic violence to appropriate authorities; reporting reactions to medications or problems with products; notifying people who may have been exposed to a communicable disease; and notifying appropriate government authorities when we reasonably believe you have been a victim of abuse, neglect, or domestic violence.

Health Oversight Activities

We may disclose PHI to health oversight agencies for activities authorized by law, including audits, investigations, inspections, and licensure.

Judicial and Administrative Proceedings

We may disclose PHI in the course of judicial or administrative proceedings, including in response to a court order, subpoena, discovery request, or other lawful process.

Law Enforcement

We may disclose PHI for law enforcement purposes as required by law or in response to a valid law enforcement request, including to identify or locate a suspect, fugitive, material witness, or missing person; to report certain types of wounds or injuries; or to alert law enforcement of a crime that occurred on our premises.

Serious Threat to Health or Safety

We may use and disclose PHI when necessary to prevent a serious and imminent threat to the health or safety of a person or the public, and when the disclosure is to someone reasonably able to prevent or lessen the threat.

Business Associates

We may disclose PHI to third-party "business associates" that perform services on our behalf, including 4Ever HoldCo LLC (the Platform), our electronic health record vendor, our telehealth video vendor, our payment processor, our cloud-hosting providers, customer support vendors, and analytics vendors. We require all business associates to enter into a written Business Associate Agreement (BAA) that requires them to protect the privacy and security of your PHI and to use it only as permitted by HIPAA.

Organized Healthcare Arrangement

As stated at the beginning of this Notice, the Practice operates as an OHCA composed of Arora Health and Aesthetics HUB, P.A., Arora Health of CA, PC, Arora Health of NJ, PC, Arora Health of NY, PC, and Arora Health of KS, PC. PHI may be shared among OHCA participants for treatment, payment, and joint healthcare operations purposes. This includes sharing PHI to facilitate continuity of care for patients who relocate or seek care in more than one state, to conduct joint quality assessment and improvement activities, and to support shared clinical and administrative operations. The Platform is not an OHCA participant; it is a Business Associate to each OHCA participant.

Uses and Disclosures Requiring Your Authorization

Other uses and disclosures of your PHI not covered by this Notice or required by law will be made only with your written authorization. If you authorize us to use or disclose PHI, you may revoke that authorization in writing at any time. Your revocation will not affect any use or disclosure that occurred prior to revocation.

The following uses and disclosures will always require your written authorization:

• Uses and disclosures of psychotherapy notes (where applicable).
• Uses and disclosures of PHI for marketing purposes, including any communication encouraging you to purchase or use a product or service for which we receive direct or indirect remuneration from a third party, except for face-to-face communications and promotional gifts of nominal value. Refill reminders, treatment alternatives, and case-management communications about your current treatment are not considered marketing under the HIPAA marketing rule (45 C.F.R. § 164.508(a)(3)).
• Sale of PHI.
• Most uses and disclosures of PHI for research purposes.
• Uses or disclosures not otherwise permitted by this Notice or applicable law.

Your Rights Regarding Your Health Information

You have the following rights with respect to your PHI. To exercise any of these rights, submit a written request to telehealth@fyinstitute.com.

Right to Access

You have the right to inspect and obtain a copy of the PHI that may be used to make decisions about your care. We will provide you with a copy within 30 days (or as otherwise required by applicable law). We may charge a reasonable cost-based fee for the preparation and delivery of copies.

Right to Request Amendment

If you believe that PHI we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept. We may deny your request if the information was not created by us, is not part of the information we keep, is not part of the information you would be permitted to inspect, or if we determine the record is accurate and complete.

Right to an Accounting of Disclosures

You have the right to request a list of disclosures we have made of your PHI during the six years prior to your request (or as required by applicable law). This accounting does not include disclosures for treatment, payment, and healthcare operations.

Right to Request Restrictions

You have the right to request restrictions on certain uses and disclosures of your PHI. Because the Practice operates on a cash-pay basis and does not bill insurance, your right to restrict disclosure to a health plan for services you have paid for in full out of pocket (45 C.F.R. § 164.522(a)(1)(vi)) is honored by default. We will not disclose PHI to any insurer for any service paid in full by you unless you direct us to do so in writing or applicable law requires the disclosure.

Right to Request Confidential Communications

You may request that we communicate with you about healthcare matters in a specific way or at a specific location (for example, by email only or at a particular address). We will accommodate reasonable requests.

Right to a Paper Copy of This Notice

You have the right to a paper copy of this Notice at any time, even if you have agreed to receive it electronically. You may request a paper copy by contacting us at telehealth@fyinstitute.com.

Right to Be Notified of a Breach

You have the right to be notified in the event of a breach of unsecured PHI affecting you, as required by the HIPAA Breach Notification Rule (45 CFR §§ 164.400–414) and applicable state law.

Our Duties

We are required by law to maintain the privacy of your PHI, to provide you with this Notice of our duties and privacy practices, and to notify you following a breach of your unsecured PHI. We are required to abide by the terms of this Notice as currently in effect.

Special Protections for Reproductive Health Information. Consistent with the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (effective February 16, 2026), the Practice will not use or disclose PHI for any of the following purposes: (i) to conduct a criminal, civil, or administrative investigation into any person for seeking, obtaining, providing, or facilitating reproductive health care that was lawful under the circumstances in which it was provided; (ii) to impose criminal, civil, or administrative liability on any such person for the same; or (iii) to identify any person for either purpose. Before disclosing PHI that is potentially related to reproductive health care, we will obtain a signed attestation from the requester confirming the disclosure is not for a prohibited purpose, as required by 45 C.F.R. § 164.509.

We reserve the right to change this Notice and to make the revised Notice effective for PHI we already have about you as well as any information we receive in the future. We will post the current Notice on our website and make it available upon request.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights.

To file a complaint with us, contact:

Privacy Officer, 4Ever Young — telehealth@fyinstitute.com

To file a complaint with the Office for Civil Rights:

U.S. Department of Health and Human Services

Office for Civil Rights

200 Independence Avenue, S.W., Washington, D.C. 20201

Phone: 1-877-696-6775 | Website: www.hhs.gov/ocr/privacy/hipaa/complaints

We will not retaliate against you for filing a complaint.

Acknowledgment of Receipt. We are required to make a good-faith effort to obtain your written acknowledgment of receipt of this Notice. We will document any such effort and the reason a written acknowledgment was not obtained, where applicable.

How to Contact Us

For questions about this Notice or to exercise any of your rights, please contact: