Sera Rx LLC

Notice of Privacy Practices

Last updated: May 11, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Introduction

This Notice of Privacy Practices ("Notice" or "NPP") describes the privacy practices of the professional medical group(s) and the licensed physicians, nurse practitioners, physician assistants, and other healthcare professionals affiliated with them (each, a "Provider," and collectively with the medical group(s), the "Medical Group") who deliver medical services to you through the technology platform and related services (the "Service") made available at https://joinserarx.com (the "Platform") and operated by Sera Rx LLC ("Sera RX," "we," "us," or "our," solely where used to describe the operator of the Platform).

The Medical Group is required by law to maintain the privacy of your Protected Health Information ("PHI"), to provide you with this Notice of its legal duties and privacy practices with respect to your PHI, to notify you following a breach of unsecured PHI, and to abide by the terms of the Notice currently in effect. This Notice applies to all records of your care that the Medical Group creates, receives, maintains, or transmits, whether made by Medical Group personnel or recorded on the Medical Group's behalf.

Important — who this Notice covers. Sera RX is a technology platform that enables your access to telehealth services. Sera RX is not a healthcare provider and is not a "covered entity" under the Health Insurance Portability and Accountability Act of 1996, as amended, and its implementing regulations ("HIPAA"). The medical services you receive are provided by the Medical Group and its Providers, who are independent of Sera RX. This Notice is adopted by and describes the privacy practices of the Medical Group and its Providers — the covered entities — and not those of Sera RX. This is the "Medical Group's Notice of Privacy Practices" referenced in the HIPAA Notice, the Patient Bill of Rights, and the HIPAA acknowledgment you complete when you create your patient account.

For information about how Sera RX, in its capacity as the operator of the Platform, collects, uses, and shares information that is not governed by HIPAA, please review the Sera RX Privacy Policy and the Consumer Health Data Privacy Policy. For an overview of how HIPAA applies to Sera RX's role as a technology platform, see the HIPAA Notice. Your rights as a patient are also summarized in the Patient Bill of Rights, and your consent to receive care by telehealth is described in the Telehealth Consent. Your use of the Platform is also governed by the Terms and Conditions.

Who Will Follow This Notice; Organized Health Care Arrangement

This Notice describes the privacy practices of:

• The Medical Group(s) that provide medical services through the Service;
• Each Provider who is a member of, employed by, or contracted with a Medical Group and who furnishes care to you through the Service; and
• All other healthcare personnel authorized to enter information into your medical record maintained by the Medical Group.

To coordinate your care and to carry out treatment, payment, and health care operations, the Medical Group, its Providers, and, where applicable, partnering licensed compounding pharmacies that dispense medications pursuant to a Provider's prescription (each, a "Pharmacy") may participate together in an "organized health care arrangement" ("OHCA") as that term is defined under HIPAA. The participants in such an OHCA may share PHI with one another as necessary to carry out the treatment, payment, and health care operations of the arrangement. This Notice is a joint notice for the participants in the OHCA with respect to the Service. The participants who are covered entities will abide by the terms of this Notice.

The medications offered through the Service may include compounded GLP-1 medications such as semaglutide and tirzepatide, which are prepared and dispensed by licensed compounding pharmacies pursuant to a valid prescription issued by a Provider. Compounded medications are not FDA-approved. PHI may be shared among the Medical Group, the Provider, and the Pharmacy as necessary to evaluate, prescribe, prepare, dispense, and deliver these medications and to follow up on your care.

Our Pledge Regarding Protected Health Information

The Medical Group understands that information about you and your health is personal. The Medical Group is committed to protecting the confidentiality of your PHI. "Protected Health Information" or "PHI" means individually identifiable health information that relates to your past, present, or future physical or mental health or condition; the provision of health care to you; or the past, present, or future payment for the provision of health care to you, and that identifies you or could reasonably be used to identify you.

The Medical Group creates a record of the care and services you receive through the Service. The Medical Group needs this record to provide you with quality care and to comply with certain legal requirements. This Notice applies to all of the records of your care generated by the Medical Group, whether received through the Platform, by telephone, by secure message, or otherwise.

This Notice will tell you about the ways in which the Medical Group may use and disclose PHI about you. It also describes your rights and certain obligations the Medical Group has regarding the use and disclosure of PHI.

How We May Use and Disclose Protected Health Information

The following categories describe different ways that the Medical Group may use and disclose PHI. Not every use or disclosure in a category will be listed; however, all of the ways the Medical Group is permitted to use and disclose PHI will fall within one of the categories described below.

For Treatment

The Medical Group may use and disclose PHI to provide, coordinate, or manage your health care and related services. This includes the coordination or management of your care with a third party. The Medical Group may disclose PHI to other Providers, the Pharmacy, laboratories, or other healthcare professionals who become involved in your care.

Examples relevant to the Service include:

• A Provider reviewing the health questionnaire, intake information, photographs, laboratory results, and medical history you submit through the Platform in order to evaluate whether a treatment such as a compounded GLP-1 medication is appropriate for you;
• Conducting a synchronous or asynchronous telehealth encounter and documenting your evaluation, diagnosis, and treatment plan in your medical record;
• Transmitting a prescription for a compounded medication (such as semaglutide or tirzepatide) to a licensed compounding Pharmacy, including the dosage, titration schedule, refill instructions, and shipping information necessary to prepare, dispense, and deliver the medication;
• Sharing PHI with the Pharmacy's pharmacists so that they can perform a clinical review, verify the appropriateness of the prescription, and counsel you regarding the medication;
• Sending you follow-up messages, lab requisitions, dose adjustments, and check-ins regarding your response to treatment, side effects, or progress toward your treatment goals; and
• Consulting with another Provider or specialist about your condition.

For Payment

The Medical Group may use and disclose PHI so that the treatment and services you receive may be billed and payment may be collected. The Service is offered on a cash-pay basis only. The Medical Group, the Providers, and Sera RX are not enrolled in or reimbursed by Medicare, Medicaid, or any commercial health insurance plan for the services provided through the Service.

Examples relevant to the Service include:

• Using and disclosing PHI to charge the payment method you provide for consultation fees, medication fees, subscription fees, or shipping;
• Disclosing PHI to Sera RX or to a third-party payment processor as reasonably necessary to process your payment and to resolve billing disputes, chargebacks, or refunds; and
• Maintaining records of the services provided and amounts paid.

Because the Service is cash-pay, the Medical Group does not submit claims to insurers. If you ask the Medical Group to restrict disclosure of PHI to a health plan for an item or service you paid for in full out of pocket, the Medical Group will honor that request as described in "Your Rights Regarding Protected Health Information" below.

For Health Care Operations

The Medical Group may use and disclose PHI for its own health care operations. These uses and disclosures are necessary to operate the Medical Group's practice and to make sure that all of its patients receive quality care.

Examples relevant to the Service include:

• Reviewing and evaluating the quality, safety, and effectiveness of the care provided through the Service, including review of compounded medication prescribing patterns and patient outcomes;
• Conducting quality assessment and improvement activities, peer review, credentialing, and evaluation of Provider performance;
• Auditing functions, including compliance, fraud and abuse detection, and legal services;
• Conducting clinical protocol development and clinical-decision-support activities relating to the prescribing and monitoring of GLP-1 and other medications;
• Performing business management and general administrative activities of the Medical Group;
• Disclosing PHI to its business associates, including Sera RX as the technology platform vendor, pursuant to a written Business Associate Agreement, so that they may perform functions on the Medical Group's behalf; and
• Disclosing PHI to another covered entity that has or had a relationship with you for that entity's own quality assessment and improvement, case management, or health care fraud and abuse detection activities, as permitted by HIPAA.

Business Associates

The Medical Group may disclose PHI to third parties that perform services on its behalf, known as "business associates." For example, Sera RX provides the technology platform, hosting, communications, scheduling, payment-facilitation, and administrative services that the Medical Group uses to deliver care through the Service. When Sera RX or another business associate creates, receives, maintains, or transmits PHI on the Medical Group's behalf, it is required by a written Business Associate Agreement, and by HIPAA, to appropriately safeguard your PHI and to use and disclose it only as permitted by that agreement and by law. Other business associates may include cloud-hosting providers, electronic health record vendors, secure-messaging providers, laboratory-interface vendors, the compounding Pharmacy where it acts as a business associate, payment processors, and professional advisors.

Other Permitted Uses and Disclosures

Appointment Reminders, Consultation Reminders, and Refill Reminders

The Medical Group may use and disclose PHI to contact you as a reminder that you have an appointment or scheduled consultation, that a follow-up is due, or that a refill or reorder of your medication is available or recommended. These communications may be delivered through the patient portal, by email, by text message, or by other means you have agreed to use.

Treatment Alternatives and Health-Related Benefits and Services

The Medical Group may use and disclose PHI to tell you about or recommend possible treatment options or alternatives, and to tell you about health-related benefits or services that may be of interest to you, such as additional treatment programs, dosing options, or wellness services available through the Service.

Individuals Involved in Your Care

The Medical Group may, when you are present and do not object, or when in its professional judgment it is in your best interest, disclose to a family member, relative, close personal friend, or any other person you identify, PHI directly relevant to that person's involvement in your care or payment for your care. The Medical Group may also use or disclose PHI to notify, or assist in notifying, such a person of your location, general condition, or death.

Uses and Disclosures That Require Your Written Authorization

Other than as described in this Notice, the Medical Group will not use or disclose your PHI without your written authorization. In particular, the following uses and disclosures will be made only with your written authorization:

• Most marketing communications. Uses and disclosures of PHI for marketing purposes that constitute "marketing" under HIPAA, except for face-to-face communications and certain permitted communications, require your written authorization. If the Medical Group receives any financial remuneration from a third party in exchange for making a marketing communication, the authorization will say so.
• Sale of PHI. The Medical Group will not sell your PHI without your written authorization. Any such authorization will state that the disclosure will result in remuneration to the Medical Group.
• Psychotherapy notes. Most uses and disclosures of psychotherapy notes (where any such notes exist) require your written authorization.
• Other uses and disclosures not described in this Notice will be made only with your written authorization.

You may revoke an authorization, in writing, at any time. If you revoke your authorization, the Medical Group will no longer use or disclose your PHI for the reasons covered by your written authorization, except to the extent it has already taken action in reliance on your authorization. You understand that the Medical Group is unable to take back any disclosures it has already made with your authorization.

Uses and Disclosures to Which You Have the Opportunity to Object

For the uses and disclosures described under "Individuals Involved in Your Care," you have the right to object. You may ask the Medical Group to limit or to not make these disclosures. If you are not present, or in the event of your incapacity or an emergency, the Medical Group may use professional judgment to determine whether a disclosure is in your best interest, disclosing only the PHI that is directly relevant to the person's involvement in your care.

Uses and Disclosures Permitted or Required by Law

The Medical Group may use or disclose PHI without your authorization in the following circumstances, subject to the requirements and limitations of applicable law:

• As Required by Law. When the disclosure is required by federal, state, or local law.
• Public Health Activities. To public health authorities for purposes such as preventing or controlling disease, injury, or disability; reporting births and deaths; reporting child abuse or neglect; reporting reactions to medications or problems with products; notifying people of recalls of products they may be using; notifying a person who may have been exposed to a disease or may be at risk of contracting or spreading a disease or condition; and, when authorized by law, notifying the appropriate government authority if the Medical Group believes a patient has been the victim of abuse, neglect, or domestic violence.
• Victims of Abuse, Neglect, or Domestic Violence. To a government authority, including a social service or protective services agency, authorized by law to receive reports of abuse, neglect, or domestic violence.
• Health Oversight Activities. To a health oversight agency for activities authorized by law, such as audits, investigations, inspections, licensure, and disciplinary actions. These oversight activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.
• Judicial and Administrative Proceedings. In response to a court or administrative order. The Medical Group may also disclose PHI in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request or to obtain an order or agreement protecting the information requested.
• Law Enforcement. For law enforcement purposes, including: in response to a court order, subpoena, warrant, summons, or similar process; to identify or locate a suspect, fugitive, material witness, or missing person; about the victim of a crime under certain conditions; about a death the Medical Group believes may be the result of criminal conduct; about criminal conduct; and in emergency circumstances to report a crime, the location of a crime or victims, or the identity, description, or location of the person who committed a crime.
• Coroners, Medical Examiners, and Funeral Directors. To a coroner or medical examiner, for example, to identify a deceased person or determine the cause of death; and to funeral directors as necessary to carry out their duties.
• Organ and Tissue Donation. To organ procurement organizations or others engaged in the procurement, banking, or transplantation of organs, eyes, or tissue, as necessary to facilitate donation and transplantation.
• Research. For research purposes, subject to a special approval process and the protections required by law, including the approval of an Institutional Review Board or privacy board, or under other circumstances permitted by HIPAA. In most cases the Medical Group will ask for your specific authorization if the researcher will have access to your name, address, or other identifying information.
• To Avert a Serious Threat to Health or Safety. To prevent or lessen a serious and imminent threat to the health or safety of you or another person or the public. Any disclosure would be to someone able to help prevent the threat, including disclosures necessary for law enforcement authorities to identify or apprehend an individual.
• Military and Veterans. If you are or were a member of the armed forces, as required by appropriate military command authorities. The Medical Group may also disclose PHI of foreign military personnel to the appropriate foreign military authority.
• Workers' Compensation. As authorized by, and to the extent necessary to comply with, laws relating to workers' compensation or other similar programs established by law that provide benefits for work-related injuries or illness.
• National Security and Intelligence Activities; Protective Services. To authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law, and to authorized federal officials so they may provide protection to the President, other authorized persons, or foreign heads of state, or conduct special investigations.
• Inmates. If you are an inmate of a correctional institution or under the custody of a law enforcement official, the Medical Group may disclose PHI to the correctional institution or law enforcement official as necessary for your health and the health and safety of others.

Your Rights Regarding Protected Health Information

You have the following rights regarding the PHI the Medical Group maintains about you. To exercise any of these rights with respect to your medical record, contact the Medical Group through the patient portal, or contact us using the information in "Contacting Us" below and we will help direct your request to the Medical Group.

Right to Inspect and Copy

You have the right to inspect and obtain a copy of the PHI that may be used to make decisions about your care, including medical and billing records, for as long as the Medical Group maintains the PHI. To inspect and copy this information, you must submit your request in writing. If you request a copy, the Medical Group may charge a reasonable, cost-based fee for the costs of copying, mailing, or other supplies associated with your request, as permitted by law. If your PHI is maintained electronically, you have the right to obtain a copy in an electronic format and to direct the Medical Group to transmit the copy to a person or entity you designate, provided your direction is clear, conspicuous, and specific. The Medical Group may deny your request to inspect and copy in certain limited circumstances. If you are denied access, you may, in certain cases, request that the denial be reviewed.

Right to Request an Amendment

If you believe that PHI the Medical Group has about you is incorrect or incomplete, you have the right to request that the Medical Group amend the information for as long as the information is kept by or for the Medical Group. To request an amendment, your request must be made in writing and must include a reason that supports your request. The Medical Group may deny your request for an amendment if it is not in writing or does not include a reason, or if it determines that the information: was not created by the Medical Group (unless the originator is no longer available to make the amendment); is not part of the PHI kept by or for the Medical Group; is not part of the information you would be permitted to inspect and copy; or is accurate and complete. If your request is denied, you have the right to submit a written statement of disagreement.

Right to an Accounting of Disclosures

You have the right to request an "accounting of disclosures." This is a list of certain disclosures the Medical Group made of your PHI for purposes other than treatment, payment, and health care operations, and other than certain other disclosures (such as those you authorized). To request this list, you must submit your request in writing. Your request must state a time period, which may not be longer than six years and may not include dates before the Medical Group began providing care to you. The first list you request within a 12-month period will be free. For additional lists, the Medical Group may charge you a reasonable, cost-based fee and will notify you of the cost before the costs are incurred.

Right to Request Restrictions

You have the right to request a restriction or limitation on the PHI the Medical Group uses or discloses about you for treatment, payment, or health care operations, or to a person involved in your care. The Medical Group is not required to agree to your request, except that it must agree to your request to restrict disclosure of PHI to a health plan if the disclosure is for the purpose of carrying out payment or health care operations (and is not otherwise required by law) and the PHI pertains solely to an item or service for which you, or someone on your behalf other than the health plan, have paid the Medical Group in full. Because the Service is cash-pay, you may exercise this right with respect to items and services you pay for in full out of pocket. To request a restriction, you must make your request in writing and tell the Medical Group what information you want to limit, whether you want to limit use, disclosure, or both, and to whom you want the limits to apply.

Right to Request Confidential Communications

You have the right to request that the Medical Group communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that the Medical Group contact you only through the patient portal, by a specified email address, or by a specified phone number. To request confidential communications, you must make your request in writing and specify how or where you wish to be contacted. The Medical Group will accommodate all reasonable requests and will not ask you the reason for your request.

Right to a Paper Copy of This Notice

You have the right to a paper copy of this Notice at any time, even if you have agreed to receive this Notice electronically. To obtain a paper copy, contact us using the information in "Contacting Us" below.

Right to Be Notified of a Breach

You have the right to be notified following a breach of your unsecured PHI, as required by law.

Our Duties

The Medical Group is required by law to:

• Maintain the privacy and security of your PHI;
• Provide you with this Notice of its legal duties and privacy practices with respect to PHI;
• Notify you following a breach of your unsecured PHI;
• Abide by the terms of the Notice that is currently in effect; and
• Not use or disclose your PHI other than as described in this Notice, unless permitted or required by law, or unless you authorize the use or disclosure in writing.

The Medical Group will not use or disclose your PHI without your authorization, except as described in this Notice or as otherwise permitted or required by law.

Changes to This Notice

The Medical Group reserves the right to change this Notice and to make the revised or changed Notice effective for PHI it already has about you as well as any information it receives in the future. The Medical Group will post a copy of the current Notice on the Platform and make it available upon request. The effective date and "Last updated" date will appear at the top of the Notice. You may obtain a copy of the current Notice at any time by contacting us or through the patient portal.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with the Medical Group and with the Secretary of the U.S. Department of Health and Human Services.

To file a complaint with the Medical Group, contact us using the information in "Contacting Us" below, and we will direct your complaint to the Medical Group's Privacy Officer. All complaints must be submitted in writing.

To file a complaint with the federal government, you may contact:

U.S. Department of Health and Human Services Office for Civil Rights 200 Independence Avenue, S.W. Washington, D.C. 20201 1-877-696-6775 https://www.hhs.gov/ocr/

You will not be penalized, retaliated against, or subjected to any adverse treatment for filing a complaint. Filing a complaint will not affect the care you receive through the Service.

Contacting Us

If you have any questions about this Notice, wish to exercise any of the rights described above, or wish to obtain a paper copy of this Notice, please contact:

Email: privacy@joinserarx.com

Mail: Sera Rx LLC Attn: Privacy Officer 86 Oakwood Road Jacksonville Beach, FL 32250

If you have questions specifically about the medical care you receive or about the Medical Group's privacy practices, you may also contact your Medical Group through the patient portal.

This Notice and the privacy practices described in it are governed by HIPAA and by the laws of the State of Florida, with venue in Duval County, Florida, except to the extent that the laws of the state in which your Provider is licensed or in which you receive services provide you with greater protection, in which case those laws will apply.

Effective Date

This Notice of Privacy Practices is effective as of May 11, 2026.