Notice of Privacy Practices

Effective: October 6, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Who we are. Primary Diagnostics, Inc. d/b/a Primary.Health (“Primary”) provides care directly to you through our website, app, and patient portal at my.primary.health: lab test ordering and results, immunization record retrieval from registries at your request, and telehealth visits with clinicians of Primary Diagnostics Medical Group P.A. d/b/a Primary.Health Medical (the “Medical Group”). This is a joint notice for Primary and the Medical Group (together, “we”), which share information with each other to treat you, bill, and run the arrangement. It covers the health information we keep for those services. When we act for another organization (your provider, employer, school, or health department), its notice applies instead. Our Privacy Policy at https://www.primary.health/privacy-policy/ covers information that is not health information.

YOUR RIGHTS

• Get a copy of your record. Ask for an electronic or paper copy, or download it from the portal. We respond within 30 days and may charge a reasonable, cost-based fee. You can have us send a copy to someone you name.
• Ask us to correct your record. If we say no, we will tell you why in writing within 60 days. We will help you send corrections to immunization records to the registry or the provider that reported them.
• Request confidential communications. Ask us to contact you in a specific way or at a specific address or number. We will say yes to reasonable requests.
• Ask us to limit what we use or share. We may say no, except that if you pay for a service in full yourself, you may stop us from sharing information about it with your health plan.
• Get a list of disclosures. Ask for an accounting of disclosures in the past six years, other than for treatment, payment, operations, and certain other purposes. One a year is free.
• Get a paper copy of this notice, even if you agreed to receive it electronically.
• Choose someone to act for you. A person with your medical power of attorney or your legal guardian may exercise your rights; we will confirm their authority. For a minor, this is usually a parent or guardian, except for services a minor may consent to alone under state law.
• File a complaint with our Privacy Officer (below) or with the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Ave. S.W., Washington, D.C. 20201, 1-877-696-6775, www.hhs.gov/ocr/privacy/hipaa/complaints/. We will not retaliate against you.

To exercise these rights: https://privacy.primary.health, privacy@primary.health, or 1-855-970-3223.

YOUR CHOICES

You can tell us whether to share information with family, friends, or others involved in your care or payment, or in a disaster relief situation; if you cannot tell us, we may share it if we believe it is in your best interest. We never share your information for marketing, sell it, or share psychotherapy notes without your written permission, and we never use it for fundraising. We will text, email, or call you about appointments, results, follow-up care, and treatment options; you can ask us to use a different method or to stop.

OUR USES AND DISCLOSURES

We typically use or share your health information to:

• Treat you. Example: our clinician orders a test and sends the order to the laboratory, which returns results to us; we send a prescription electronically to your pharmacy; at your request, we send your name and date of birth to immunization registries to retrieve your records.
• Run our organization. Example: we review the quality of our services and message you when results are ready. We may de-identify information as HIPAA allows.
• Bill for your services. Example: we give our payment processor what it needs to process your payment, or your health plan what it needs to pay a claim if you ask us to bill it.

We may also share your information, subject to conditions in the law, to:

• Help with public health and safety: reporting immunizations to registries and reportable results to public health authorities; preventing disease; reporting adverse reactions, suspected abuse, neglect, or domestic violence; preventing a serious threat to health or safety; and, with your (or your parent’s) agreement, giving proof of immunization to a school required to have it.
• Do research approved by an institutional review board or privacy board, or with your permission.
• Comply with the law, including showing the Department of Health and Human Services that we comply with federal privacy law.
• Respond to organ and tissue donation requests, and work with a coroner, medical examiner, or funeral director.
• Address workers’ compensation, law enforcement, health oversight, and special government functions such as military and national security.
• Respond to court or administrative orders and subpoenas.
• Work with service providers that host our systems, run our telehealth and messaging tools, transmit prescriptions, and process payments; they must protect your information by contract.

Substance use disorder records. To the extent we have your substance use disorder records subject to 42 C.F.R. Part 2, we will not share them for investigations or legal proceedings against you without your written consent or a court order and subpoena.

State law. Where state law is more protective, we follow it. For example, California and other states require your written permission to share many records about HIV, sexually transmitted infections, mental health, substance use, genetic testing, reproductive and sexual health, and services a minor consented to alone. Immunization registries are run by public health agencies under state law, which sets your choices about participating.

OUR RESPONSIBILITIES

We are required by law to maintain the privacy and security of your health information, to notify you promptly if a breach may have compromised it, to follow this notice and give you a copy, and not to use or share your information except as described here unless you tell us we can in writing. You may change your mind at any time by telling us in writing.

CHANGES TO THIS NOTICE

We can change this notice, and changes will apply to all information we have about you. The current notice is posted at https://www.primary.health/privacy-practices-notice-of/ and in our app and portal and is available on request.

CONTACT US

Privacy Officer, Primary Diagnostics, Inc. d/b/a Primary.Health, 595 Pacific Ave, Floor 4, San Francisco, CA 94133 | privacy@primary.health | 1-855-970-3223 | https://privacy.primary.health. This notice is available in other languages and formats on request.