Notice of Privacy Practices

National Health Group LLC, doing business as AwareWell (“we,” “us,” or “AwareWell”), is a mobile preventive health screening company based at 113 East Alton Avenue, Santa Ana, CA 92707. We provide community-based and in-home health screening services under the clinical oversight of licensed California physicians.

This Notice of Privacy Practices (“Notice”) explains how we collect, use, and disclose your Protected Health Information (“PHI”) in connection with our screening services, and describes your rights regarding that information.

AwareWell has voluntarily adopted HIPAA privacy and security standards as part of our commitment to protecting your health information, even though our 100% cash-pay model may place us outside the strict federal definition of a “Covered Entity.” California’s Confidential Medical Information Act (CMIA) provides additional protections that apply regardless of our HIPAA status.

We may use and disclose your PHI without your authorization for the following purposes:

Delivery of Screening Services. We may use your PHI to provide you with health screening services, including conducting your screening, generating results, and delivering your screening report. This includes sharing your information with our Lab/Medical Director, contracted radiologist, and other clinical personnel directly involved in your screening.

Clinical Oversight and Quality Assurance. We may use your PHI for quality control, CLIA compliance, clinical protocol adherence, and review of screening results by our physicians and clinical team.

Payment and Business Operations. We may use your PHI to process your payment, manage your account, and conduct internal business operations such as auditing, compliance activities, and service improvement.

Abnormal or Critical Findings. We may use your PHI to contact you regarding abnormal or critical screening results and to recommend follow-up with your healthcare provider, in accordance with our clinical protocols.

Communication with Your Healthcare Provider. With your authorization, we may share your screening results with your primary care physician or other healthcare provider that you designate.

As Required by Law. We may disclose your PHI when required by federal, state, or local law, including public health reporting, court orders, and regulatory investigations.

We will obtain your written authorization before using or disclosing your PHI for purposes not described in this Notice, including:

• Marketing communications using your PHI (note: general marketing about our services does not require authorization).
• Sale of your PHI (we will never sell your PHI).
• Disclosure to your employer, even if the screening event was hosted at your workplace.
• Disclosure to insurance companies or third-party payers.

You may revoke your authorization at any time in writing by contacting us at compliance@awarewell.com. Revocation will not affect any disclosures made prior to your revocation.

You have the following rights under HIPAA and California law:

Right to Access. You have the right to inspect and obtain a copy of your PHI maintained by AwareWell. We will provide your records within 30 days of your request (or 15 days for electronic records under California law). We may charge a reasonable, cost-based fee for copies.

Right to Amend. You have the right to request that we amend your PHI if you believe it is inaccurate or incomplete. We may deny your request in certain circumstances but will provide a written explanation.

Right to an Accounting of Disclosures. You have the right to request a list of certain disclosures of your PHI that we have made. This accounting does not include disclosures made for screening services, payment, business operations, or disclosures you authorized.

Right to Request Restrictions. You have the right to request that we restrict how we use or disclose your PHI. We are not required to agree to your request, except that we must comply with a request to restrict disclosure to a health plan if you paid for the service in full out of pocket (which all AwareWell participants do).

Right to Confidential Communications. You have the right to request that we communicate with you about your health information in a specific way or at a specific location. For example, you may request that we contact you only by email or only at a particular phone number.

Right to a Paper Copy of This Notice. You have the right to obtain a paper copy of this Notice at any time, even if you previously agreed to receive it electronically. Paper copies are available at all AwareWell screening events and by contacting us.

In addition to federal HIPAA protections, California’s Confidential Medical Information Act (CMIA, Civil Code §56.10 et seq.) provides you with additional rights:

• Your medical information may not be disclosed without your written authorization except as specifically permitted by California law.
• You may request that we not disclose medical information related to specific conditions, including mental health, HIV/AIDS, genetic information, and substance abuse.
• Negligent disclosure of your medical information may subject AwareWell to statutory damages under California law.

We implement the following safeguards to protect your PHI:

• Encryption of data in transit and at rest.
• Role-based access controls limiting PHI access to authorized clinical and administrative personnel.
• HIPAA Business Associate Agreements (BAAs) with all service providers who access PHI.
• Workforce training on HIPAA privacy and security requirements.
• Secure disposal of physical documents containing PHI.
• HIPAA-compliant electronic storage through our EMR and clinical imaging systems.

We retain your health screening records for a minimum of 7 years from the date of service, as required by California Health and Safety Code §123145. We may retain records longer if required by CLIA, CDPH, or other regulatory obligations. After the retention period expires, records are securely destroyed.

In the unlikely event of a breach of your unsecured PHI, we will notify you in writing within 60 days of discovering the breach. The notification will describe: (a) what happened; (b) the types of information involved; (c) steps you can take to protect yourself; (d) what we are doing to investigate and mitigate the breach; and (e) how to contact us for more information.

We reserve the right to change this Notice at any time. Changes will apply to PHI we already maintain as well as PHI we receive in the future. The revised Notice will be posted on our website and available at screening events. The effective date will be updated accordingly.

If you believe your privacy rights have been violated, you may:

File a complaint with AwareWell: Contact our Privacy Officer at compliance@awarewell.com or write to: AwareWell Privacy Officer, National Health Group LLC, 113 East Alton Avenue, Santa Ana, CA 92707.

File a complaint with HHS: You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, Region IX (San Francisco), at hhs.gov/ocr or by calling (800) 368-1019.

Non-Retaliation. AwareWell will not retaliate against you in any way for filing a complaint.

For questions about this Notice or to exercise any of your rights:

Company: National Health Group LLC dba AwareWell

Address: 113 East Alton Avenue, Santa Ana, CA 92707

Email: compliance@awarewell.com

Website: www.awarewell.com