Notice of Privacy Practices

Effective date: October 6, 2026 | Last updated: October 6, 2026 | Version: 1.0 | Issued by: OSI Medical Services, P.A.

1. Who follows this notice

This notice applies to OSI Medical Services, P.A. (“the Practice,” “we,” “us”). It covers the Practice’s doctors, nurse practitioners, physician assistants and other licensed clinicians, and its staff, who care for you through our telehealth service.

WellPeps helps us run the service. WellPeps, a Wyoming corporation (“WellPeps”), is not a medical practice. It runs the website, the sign-up and intake process, customer support and non-clinical membership services. When WellPeps handles your health information for the Practice, it acts as the Practice’s business associate. That means the law and a written agreement limit what WellPeps can do with your information. Our management-services partner and the technology platform that runs your patient portal and stores your records may also act as business associates.

Pharmacies and laboratories have their own notices. The state-licensed pharmacy that fills your prescription and any laboratory that runs your tests are separate health care providers. They must follow privacy laws and will give you their own notice.

What this notice does not cover. It does not cover information you give WellPeps when you only visit wellpeps.com, read our articles or join an email list. Those are described in the Privacy Policy and the Consumer Health Data Privacy Policy.

2. What “health information” means

“Protected health information” is information about you that we create or receive and that can identify you. It relates to your health, your care, or payment for your care. Examples are your intake answers, medical history, prescriptions, test results, messages with your clinician and billing records. In this notice we call it “your health information.”

3. How we use and share your health information for treatment, payment and operations

The law lets us use and share your health information in these three ways without asking you first.

Treatment

We use and share your information to give you care and to coordinate that care. For example:

• Your clinician reviews the answers and records you give in your intake forms to decide whether treatment is medically appropriate.
• We send your prescription, and the information the pharmacy needs (such as your name, address, date of birth, allergies and the medicine ordered), to the state-licensed pharmacy that fills it.
• Our technology platform stores your records, lets you message your care team and sends reminders.
• If a clinician orders laboratory tests, we share the order and your details with the laboratory and receive the results.
• When you ask us to, or the law allows, we may contact your primary care provider or another clinician about your care.

Payment

We use and share your information to get paid. Our service is cash pay. We do not bill health insurance, Medicare or Medicaid. For example:

• We give our payment processor the information it needs to charge your card and send your receipt.
• We use your information to answer billing questions, process refunds, resolve payment disputes and collect money you owe.

Health care operations

We use and share your information to run the practice and improve care. For example:

• Reviewing the quality of care and training or reviewing our clinicians and staff.
• Customer support: WellPeps staff may see limited information to help with your account, orders and shipping.
• Licensing, audits, accreditation, legal advice and business planning.
• Keeping our systems secure, finding and fixing errors and preventing fraud.
• Creating “de-identified” information, which is information that can no longer reasonably be used to identify you.
• Sharing information with business associates who do these jobs for us. They must agree in writing to protect it.

Reminders and information about your care. We may use your information to send you visit, refill and order reminders, and to tell you about treatment options or health-related services that may interest you. We will not put sensitive details in a text message. See the Text Messaging Terms and the Electronic Records, Signatures and Communications Consent.

4. Other ways we may use or share your information without your written permission

The law allows or requires us to use or share your information in the situations below. We share only what is needed.

• Required by law. When federal, state or local law requires it.
• Public health. To prevent or control disease, injury or disability; to report side effects, product problems or recalls to the Food and Drug Administration (FDA) and others responsible for the product; and to tell a person who may have been exposed to a disease.
• Abuse, neglect or domestic violence. To report suspected abuse, neglect or domestic violence to a government agency that the law allows to receive these reports.
• Health oversight. To agencies that oversee health care, such as state medical and pharmacy boards, for audits, investigations, inspections and licensing.
• Lawsuits and legal proceedings. In response to a court or administrative order, and in response to a subpoena or similar request if we receive the assurances the law requires.
• Law enforcement. Limited information to police in some cases, such as to follow a court order, to identify or find a suspect, witness or missing person, to report a crime that happens at our practice or against our staff, or about a death that may be the result of a crime.
• To prevent a serious threat. To stop or lessen a serious and immediate threat to the health or safety of you, another person or the public.
• Workers’ compensation. As workers’ compensation and similar laws allow.
• Workforce safety. If one of our workers is the victim of a crime, he or she may give police limited information about the person who did it. A worker may also report to an oversight agency or an attorney, in good faith, conduct the worker believes is unlawful.
• Organ and tissue donation. To groups that handle organ, eye or tissue donation or transplant.
• Coroners, medical examiners and funeral directors. To identify a person who has died, find the cause of death or let funeral directors do their jobs.
• Research. Only as the law allows, for example when a review board has approved it, or when details that identify you have been removed (a “limited data set”) and the researcher signs an agreement to protect the information.
• Specialized government functions. For military and veterans’ activities, national security and intelligence, protective services for the President and others, and, for a person in custody, to the jail or prison.
• To you and your personal representative. To you, and to a person who has legal authority to act for you.

5. Uses that need your written permission

For any use or sharing that this notice does not describe, we need your written permission. We always need it in these cases:

• Psychotherapy notes. These are a mental health professional’s private notes about counseling sessions, kept apart from the medical record. We need your written permission to use or share them, with a few legal exceptions. We do not expect to keep psychotherapy notes.
• Marketing. We need your written permission to use or share your health information to market products or services to you. There are two exceptions: a face-to-face conversation with you, and a promotional gift of small value. If an outside company would pay us for the marketing, the permission form will tell you.
• Sale of health information. We will not sell your health information. Any sale would need your written permission.

You can change your mind. You may cancel a written permission at any time by writing to the Privacy Official (section 11). Canceling does not undo anything we did while your permission was in effect. See the HIPAA Authorization Forms.

6. Your choices

In these situations you can tell us what you want us to do. If you cannot tell us, for example in an emergency, we may share information if we believe it is in your best interest.

• Family, friends and others involved in your care or payment. We may share relevant information with a person you name. You can say no, or tell us who may and may not receive it.
• Disaster relief. We may share information with a disaster relief group so your family can be told where you are and how you are doing.
• Fundraising. We do not use your health information for fundraising.

7. Your rights

You have these rights about your health information. To use any of them, contact the Privacy Official (section 11). We may ask you to put a request in writing and to prove who you are before we release records.

8. Our duties

• The law requires us to keep your health information private and secure.
• We must tell you if a breach puts your health information at risk.
• We must give you this notice of our legal duties and privacy practices, follow the notice that is in effect, and ask you to confirm that you received it.
• We will not use or share your information in ways this notice does not describe unless you tell us in writing that we can. If you say yes, you can change your mind at any time by telling us in writing.
• We make WellPeps and our other business associates agree in writing to protect your information.

9. Substance use disorder treatment records (42 CFR Part 2)

The Practice does not provide substance use disorder treatment. Federal law (42 CFR Part 2) gives extra protection to records from programs that diagnose or treat substance use disorder. If the Practice ever receives or keeps records like these, these extra rules apply to them:

• We may use and share these records for treatment, payment and health care operations if you have given written consent. One consent can cover all future uses and sharing for those purposes.
• Without your written consent, or a court order made after you have had a chance to be heard, these records cannot be used or shared against you in a civil, criminal, administrative or legislative case or investigation.
• Another HIPAA-covered organization that gets these records with your consent may share them again as HIPAA allows, but not in a case against you without your consent or a court order.
• You may ask for a list of the times these records were shared, ask us to limit how they are used and shared, and complain if you believe your rights were violated. We will not retaliate against you for complaining.

10. State laws that may protect you more

Some state laws give you more privacy protection than HIPAA, or more control over your information. When a state law is stricter, we follow it. We follow the law that applies to you.

Health information you share with WellPeps outside of your care, for example when you ask for a free guide or join a waiting list, may be protected by consumer health data laws. See the Consumer Health Data Privacy Policy.

11. Questions and complaints

Contact the Privacy Official. Questions about this notice, requests to use your rights, and complaints go here:

File a complaint. If you believe your privacy rights were violated, you may file a complaint with us using the contact details above, or with the U.S. Department of Health and Human Services, Office for Civil Rights, www.hhs.gov/ocr/complaints, 1-800-368-1019. You generally must file with HHS within 180 days of when you knew or should have known about the problem.

We will not retaliate. We will not punish you, refuse you care or take any other action against you for filing a complaint.

12. Changes to this notice

We may change this notice, and the new terms may apply to health information we already have. The current notice is always available in the footer of wellpeps.com, in your patient portal and on request. The effective date is on the first page. If we make an important change, we will post the new notice and tell you in your portal or by email.

13. Effective date

This notice is effective October 6, 2026. Version 1.0.

Acknowledgment of Receipt of Notice of Privacy Practices

Please read the Notice of Privacy Practices of OSI Medical Services, P.A. (version 1.0, effective October 6, 2026). It explains how we may use and share your health information and what rights you have.

☐ I received the Notice of Privacy Practices of OSI Medical Services, P.A.. I know I can read it again at any time at portal.wellpeps.com and in the footer of the WellPeps website.

☐ I know I can ask for a paper copy of the notice at any time, and that I can ask the Privacy Official any questions about it.

Signing is not a condition of getting care. If you do not sign, we will still give you the notice and we will note that we gave it to you.

Electronic signature

By typing my name, I confirm that I received the notice. I agree that my electronic signature is the legal equivalent of my handwritten signature, and that I have agreed to receive and sign documents electronically (see the Electronic Records, Signatures and Communications Consent). This acknowledgment does not waive any of my rights.

For the Practice’s records (complete only if no acknowledgment was obtained)