Notice of Privacy Practices

Blue Oak Services LLC dba Prescriva (“Prescriva,” “we,” “us,” or “our”) is a California limited liability company that operates as a Management Services Organization (MSO). We provide technology, administrative, and marketing services that support the delivery of healthcare through our platform at prescriva.com.

All clinical decisions and medical services are provided by licensed, independent healthcare practitioners through OpenLoop Health and its affiliated medical professional corporations. This Notice applies to the protected health information (“PHI”) created, received, maintained, or transmitted in connection with those services.

We are required by applicable federal and state law, including the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), to:

• Maintain the privacy and security of your protected health information
• Provide you with this Notice describing our legal duties and privacy practices regarding your PHI
• Follow the terms of the Notice currently in effect
• Notify you if we are unable to agree to a requested restriction on how your information is used or disclosed
• Notify you promptly following a breach of unsecured PHI that may have compromised the privacy or security of your information

We may use and disclose your PHI without your written authorization for the following purposes:

Treatment

We may use your PHI to provide, coordinate, or manage your healthcare and related services. For example, your health assessment responses are shared with licensed healthcare providers in the OpenLoop Health network who review your information and make independent clinical decisions regarding your care, including prescribing compounded medications when medically appropriate.

Payment

We may use and disclose your PHI to obtain payment for healthcare services provided to you. This includes processing your subscription payments, verifying insurance eligibility if applicable, and coordinating with licensed compounding pharmacies for medication fulfillment and billing.

Healthcare Operations

We may use and disclose your PHI for our healthcare operations, which include quality assessment and improvement activities, reviewing the competence or qualifications of healthcare professionals, conducting or arranging for medical reviews, legal services, and auditing functions, and business planning and development.

Disclosures to Relatives, Close Friends, and Caregivers

We may disclose your PHI to a family member, relative, close friend, or other person you identify who is involved in your care or payment for your care. If you are incapacitated or unavailable, we may use professional judgment to determine whether such a disclosure is in your best interest.

As Required by Law

We will disclose your PHI when required to do so by applicable federal, state, or local law.

Public Health Activities

We may disclose your PHI for public health activities, including reporting to public health authorities for the purpose of preventing or controlling disease, injury, or disability, and reporting adverse events and product defects related to medications or medical devices.

Abuse and Neglect Reporting

We may disclose your PHI to appropriate government authorities if we reasonably believe you are a victim of abuse, neglect, or domestic violence, as required or authorized by law.

Health Oversight Activities

We may disclose your PHI to a health oversight agency for activities authorized by law, such as audits, investigations, inspections, licensure, and other proceedings necessary for the government to monitor the healthcare system, government programs, and compliance with civil rights laws.

Judicial and Administrative Proceedings

We may disclose your PHI in response to a court or administrative order, subpoena, discovery request, or other lawful process, subject to the conditions and limitations set forth under HIPAA.

Law Enforcement

We may disclose your PHI for certain law enforcement purposes, including to comply with court orders or warrants, to locate a suspect or missing person, to report a crime that occurred on our premises, or to provide information about a crime victim.

Research

Under certain circumstances, we may use and disclose your PHI for research purposes, provided that an Institutional Review Board (IRB) or Privacy Board has reviewed and approved the research protocol and established safeguards for the privacy of your information.

To Prevent a Serious Threat to Health or Safety

We may use and disclose your PHI when necessary to prevent or lessen a serious and imminent threat to your health or safety, or the health or safety of another person or the public.

Specialized Government Functions

We may disclose your PHI for specialized government functions, including military and veterans’ activities, national security and intelligence activities, protective services for the President, and medical suitability determinations.

Coroners, Medical Examiners, and Funeral Directors

We may disclose your PHI to a coroner, medical examiner, or funeral director as necessary for them to carry out their lawful duties.

Workers’ Compensation

We may disclose your PHI to the extent necessary to comply with laws relating to workers’ compensation or similar programs providing benefits for work-related injuries or illness.

Other uses and disclosures of your PHI not described in this Notice will be made only with your written authorization. You may revoke your authorization at any time by submitting a written request to us, except to the extent that we have already taken action in reliance on your authorization.

The following uses and disclosures always require your written authorization:

• Use of your PHI for marketing purposes
• Sale of your PHI
• Most uses and disclosures of psychotherapy notes, if applicable

Highly Confidential Information

Certain categories of information may be subject to additional protections under federal or state law and require your explicit written consent before use or disclosure. These categories may include:

• Mental health records and substance use disorder treatment records
• HIV/AIDS-related information
• Sexually transmitted disease (STD) information
• Genetic testing information
• Records related to child abuse, domestic violence, or sexual assault

Where applicable law provides stronger protections for these categories of information, we will comply with the more protective standard.

You have the following rights with respect to your protected health information:

Right to Inspect and Copy

You have the right to inspect and obtain a copy of your PHI maintained in our records. To request access, submit a written request to help@prescriva.com. We may charge a reasonable, cost-based fee for providing copies. We will respond to your request within 30 days (or 60 days with written notice of the extension).

Right to Request Amendment

If you believe that your PHI in our records is incorrect or incomplete, you may request an amendment in writing. We may deny your request under certain circumstances (for example, if the information was not created by us, is not part of our records, or is already accurate and complete). If we deny your request, we will provide you with a written explanation and your right to submit a statement of disagreement.

Right to an Accounting of Disclosures

You have the right to request a list of certain disclosures we have made of your PHI during the six (6) years prior to your request (or since the effective date of this Notice, whichever is shorter). The accounting will not include disclosures made for treatment, payment, healthcare operations, or disclosures you authorized in writing. The first accounting within a 12-month period is provided at no charge; subsequent requests may incur a reasonable fee.

Right to Request Restrictions

You have the right to request a restriction on the PHI we use or disclose for treatment, payment, or healthcare operations. We are not required to agree to your request, except that we must agree to restrict disclosures to a health plan if you have paid for a service or item out of pocket in full and the disclosure is not otherwise required by law.

Right to Request Confidential Communications

You have the right to request that we communicate with you about health matters through a particular method or at a specific location. For example, you may request that we contact you only by email at a specified address. We will accommodate reasonable requests.

Right to a Paper Copy of This Notice

You have the right to obtain a paper copy of this Notice upon request, even if you have previously agreed to receive this Notice electronically.

Right to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer at privacy@prescriva.com. You may also file a complaint with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights. You will not be penalized or retaliated against for filing a complaint.

We maintain administrative, technical, and physical safeguards to protect the confidentiality, integrity, and availability of your PHI, including:

• Encryption of all PHI in transit (TLS 1.2+) and at rest (AES-256)
• Role-based access controls limiting PHI access to authorized personnel only
• Comprehensive audit logging of all PHI access and modifications
• Automatic session timeout after 15 minutes of inactivity
• Business Associate Agreements (BAAs) with all third-party vendors and service providers handling PHI
• Regular security assessments, risk analyses, and vulnerability testing
• Workforce training on HIPAA privacy and security requirements

We reserve the right to change the terms of this Notice at any time. Any revised Notice will be effective for all PHI we already maintain as well as any PHI we create or receive in the future. If we make a material change to this Notice, the updated version will be posted on our website at prescriva.com. You may request a copy of the current Notice at any time by contacting us.

To exercise any of the rights described in this Notice, request a copy of this Notice, file a complaint, or ask questions, contact:

Prescriva Privacy Officer
Sarkis Arutiunian, Designated HIPAA Privacy Officer
Effective May 8, 2026
Blue Oak Services LLC dba Prescriva
Email: privacy@prescriva.com

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights:

• Online: hhs.gov/ocr/privacy/hipaa/complaints
• Phone: 1-877-696-6775