NOTICE OF PRIVACY PRACTICES

Effective Date: March 18, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

1. WHO WE ARE

Outfront Health LLC (“Outfront Health,” “we,” “our,” or “us”) provides preventive health screening services, including at-home blood testing kits and in-person preventive screening services such as ultrasound imaging, electrocardiogram (ECG) screening, body composition analysis, and other non-invasive biometric assessments.

Outfront Health operates as a Business Associate of certain third-party CLIA-certified laboratories and licensed healthcare providers who are HIPAA Covered Entities. In that capacity, we handle your Protected Health Information (“PHI”) as necessary to facilitate services and as permitted by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and its implementing regulations.

Important: Outfront Health is not itself a HIPAA Covered Entity. However, Outfront Health voluntarily implements administrative, physical, and technical safeguards consistent with HIPAA standards to protect all health information in its custody, regardless of whether HIPAA directly requires it.

2. HOW WE MAY USE AND DISCLOSE YOUR PROTECTED HEALTH INFORMATION

We may use or disclose your PHI for the following purposes without your separate written authorization:

Testing and Service Delivery. We may share your PHI with third-party CLIA-certified laboratories, independent licensed physicians, radiologists, sonographers, and other qualified clinicians to facilitate the processing, interpretation, and delivery of screening results. For in-person clinic services, this includes transmitting imaging data and biometric measurements to reviewing clinicians.

Payment and Transaction Processing. We may use or disclose limited PHI as necessary to process payments, verify HSA/FSA eligibility, and coordinate billing through our third-party payment processor.

Healthcare Operations. We may use PHI for internal quality assurance, auditing, credentialing of independent clinicians, training, and service improvement.

Legal Compliance. We may disclose PHI when required by federal, state, or local law, including in response to a court order, subpoena, or administrative request.

Public Health and Safety. We may disclose PHI to public health authorities for disease prevention, injury reporting, or other public health activities authorized by law.

As Required for Clinician Review. Where applicable law requires that certain screening or test results be reviewed by a licensed clinician before delivery to the patient, we will share PHI with an independent, licensed clinician for that limited purpose.

3. USES AND DISCLOSURES REQUIRING YOUR WRITTEN AUTHORIZATION

We will obtain your written authorization before using or disclosing your PHI for purposes not described in this Notice, including but not limited to:

• Marketing communications (other than face-to-face communications or promotional gifts of nominal value)
• Sale of PHI
• Research purposes involving identifiable health information
• Uses of psychotherapy notes, if any

You may revoke any written authorization at any time by contacting us in writing at the address below. Revocation will not affect any actions taken in reliance on the authorization prior to revocation.

4. YOUR RIGHTS REGARDING YOUR PROTECTED HEALTH INFORMATION

Right to Access. You have the right to inspect and obtain a copy of your PHI maintained by Outfront Health. To request access, submit a written request to the Privacy Officer at the contact information below. We may charge a reasonable, cost-based fee for copies.

Right to Amend. You have the right to request that we amend your PHI if you believe it is inaccurate or incomplete. We may deny the request in certain circumstances permitted by law and will provide a written explanation if denied.

Right to an Accounting of Disclosures. You have the right to request a list of certain disclosures of your PHI that we have made. This accounting does not include disclosures made for treatment, payment, or healthcare operations, or disclosures made with your authorization.

Right to Request Restrictions. You have the right to request that we restrict how we use or disclose your PHI. We are not required to agree to your request unless the disclosure is to a health plan for payment or healthcare operations and the PHI pertains to a service you paid for in full out of pocket.

Right to Request Confidential Communications. You have the right to request that we communicate with you about your PHI in a specific way or at a specific location (for example, by email only or at an alternative address).

Right to a Paper Copy of This Notice. You have the right to obtain a paper copy of this Notice at any time, even if you previously agreed to receive it electronically.

Right to Be Notified of a Breach. You have the right to be notified if a breach of your unsecured PHI occurs, as required by law.

5. OUR DUTIES

We are required by law to maintain the privacy of your PHI, to provide you with this Notice of our legal duties and privacy practices, and to abide by the terms of this Notice currently in effect. We reserve the right to change the terms of this Notice and to make the new provisions effective for all PHI we maintain. If we make material changes, we will post the revised Notice on our website and make it available at our clinic location.

6. DATA SECURITY MEASURES

Outfront Health implements the following safeguards to protect your PHI:

• Encryption of PHI in transit and at rest
• Role-based access controls limiting PHI access to authorized personnel
• Secure, access-controlled servers and cloud infrastructure
• Physical security measures at clinic locations, including secured workstations and restricted access to records
• Workforce training on privacy and security obligations
• Business Associate Agreements with all third-party service providers who access PHI

No system is completely secure. While we implement commercially reasonable safeguards, we cannot guarantee absolute security of your PHI.

7. IN-PERSON CLINIC SERVICES

If you receive screening services at an Outfront Health clinic location, the following additional practices apply:

• Screening data, including imaging files, biometric measurements, and ECG recordings, will be captured and stored electronically on secure, encrypted systems.
• Physical intake forms or paper records, if any, will be converted to electronic format and the originals securely destroyed within a reasonable time after your visit.
• Screening results will be delivered to you through the secure Outfront Health patient portal or encrypted electronic communication. Results will not be provided verbally at the clinic unless required for immediate patient safety.
• Independent clinicians reviewing your screening data at the clinic are bound by their own professional obligations and, where applicable, their own HIPAA compliance obligations as Covered Entities.

8. COMPLAINTS

If you believe your privacy rights have been violated, you may file a complaint with:

• Outfront Health Privacy Officer at the contact information below; or
• The U.S. Department of Health and Human Services, Office for Civil Rights, at www.hhs.gov/ocr/privacy/hipaa/complaints.

You will not be penalized or retaliated against for filing a complaint.

9. CONTACT INFORMATION

Privacy Officer — Outfront Health

Email: support@outfronthealth.com

Mailing Address: Outfront Health LLC, 15169 N Scottsdale Rd STE 205, Scottsdale, AZ 85254

Phone: 480-256-9128

10. CHANGES TO THIS NOTICE

We reserve the right to change this Notice at any time. Any revised Notice will be effective for all PHI we maintain at the time of the change. The revised Notice will be posted on our website at www.outfronthealth.com and will be available in paper form at our clinic location upon request.