CAREWELL FAMILY SERVICES PRIVACY POLICY

Carewell Family Services LLC d/b/a Carewell Health

Last Revised: July 20, 2026

This Privacy Policy ("Privacy Policy") describes how Carewell Family Services LLC d/b/a Carewell Health, a Florida limited liability company ("Carewell Health," "we," "us," or "our"), collects, uses, discloses, safeguards, retains, and disposes of your Personal Information in connection with the Carewell Health website located at www.carewell.com (and any subdomains or successor URLs) (the "Website") and the care coordination, intake support, scheduling, and related administrative services we provide or facilitate (collectively, the "Care Coordination Services"). This Privacy Policy is incorporated by reference into, and supplements, the Carewell Care Coordination Program Terms and Conditions ("Care Coordination Terms"). Capitalized terms not defined here have the meanings given to them in the Care Coordination Terms.

By accessing the Website, enrolling in, or using any Care Coordination Service, you acknowledge that you have read and understand this Privacy Policy.

Our Non-Clinical Role

Carewell Health provides Care Coordination Services only; these services are exclusively administrative and non-clinical in nature. We do not provide medical care, medical advice, diagnosis, or treatment, and no physician-patient or other clinical relationship exists between you and Carewell Health. All clinical services are provided exclusively by independently licensed healthcare professionals and provider organizations ("Providers") who are not employees or agents of Carewell Health. This Privacy Policy governs information handled by Carewell Health in its administrative care coordination role; any privacy notices issued by your Provider concerning clinical records are between you and that Provider and are not part of this Privacy Policy.

Information We Collect

We collect Member Information, which is personally identifiable information you share with us in connection with Care Coordination Services, such as your name, contact details, date of birth, insurance information, health conditions, medications, appointment preferences, Provider selections, and other information necessary for administrative care coordination. "Personal Information" (or "PII") means any information that identifies or could reasonably be used to identify you as an individual, including Member Information collected for administrative care coordination purposes. [

To the extent Member Information constitutes individually identifiable health information collected or maintained in connection with Care Coordination Services, it is "Protected Health Information" ("PHI"), including electronic PHI ("ePHI"), and is subject to the additional protections described below and under the Health Insurance Portability and Accountability Act of 1996, as amended ("HIPAA"). We acknowledge that we serve as the patient's first point of contact and that patient demographic, clinical, and insurance information collected during initial intake constitutes PHI from the moment of collection, with full HIPAA Privacy Rule protections attaching immediately upon intake.

We also receive Member-Submitted Documents that you provide through channels we make available — including the Carewell Health portal, email, facsimile, and text message — such as insurance cards, identification documents, referral letters, clinical records, prior authorization materials, and intake questionnaires. In addition, we collect information automatically through cookies, web beacons, analytics tools, and other tracking technologies on the Website.

How We Use Your Information

We collect and use your Personal Information solely to: (a) provide, coordinate, and improve Care Coordination Services, including scheduling, intake, and administrative communications with Providers; (b) support administrative intake and benefits navigation inquiries, as requested by you; (c) comply with applicable legal and regulatory requirements; (d) fulfill such other purposes as described in this Privacy Policy or for which you have provided valid consent; and (e) to the extent Member Information constitutes PHI, carry out our obligations under HIPAA, whether as a business associate pursuant to an applicable Business Associate Agreement or as a covered entity, including activities related to treatment, payment, and healthcare operations.

We use Member-Submitted Documents — whether solicited or submitted at your own initiative — for enrollment processing and eligibility verification; care coordination, scheduling, and intake support; administrative communications with Providers on your behalf; insurance and benefits navigation; compliance with applicable legal and regulatory requirements; and any other purpose described in the Care Coordination Terms or this Privacy Policy. Where Member-Submitted Documents contain PHI, we handle that information in accordance with applicable HIPAA requirements.

How We Disclose Your Information

We disclose your Personal Information to Providers and provider organizations as necessary to schedule appointments, support intake, and carry out administrative care coordination on your behalf. We may engage payment processors, technology vendors, communication vendors, and other third-party service providers in connection with Care Coordination Services. Personal Information collected through Care Coordination Services is not shared for marketing purposes except as permitted by applicable law.

The Website may contain links to third-party websites or resources; we do not control, endorse, or assume responsibility for the content, privacy policies, or practices of any third-party website, and your access to and use of third-party websites is at your own risk. We may also report suspected violations of law, including suspected fraud or misuse of health information, to applicable regulatory or law enforcement authorities.

HIPAA Compliance

To the extent we receive, create, maintain, or transmit PHI in connection with Care Coordination Services, we comply with all applicable requirements of HIPAA, including the Privacy Rule (45 C.F.R. Part 164, Subpart E), the Security Rule (45 C.F.R. Part 164, Subparts A and C), and the Breach Notification Rule (45 C.F.R. Part 164, Subpart D), primarily in our capacity as a business associate. Where we act on behalf of a Covered Entity, we will enter into a Business Associate Agreement — compliant with 45 C.F.R. §§ 164.504(e) and 164.314(a) — with each Covered Entity where required by applicable law. Our HIPAA compliance obligations are limited to our administrative care coordination role and do not extend to or create any clinical services, treatment relationships, or provider-patient relationships.

How We Protect Your Information

We implement reasonable administrative, technical, and physical safeguards designed to protect your Personal Information against unauthorized access, use, or disclosure. To the extent we maintain ePHI, such safeguards are designed to comply with the HIPAA Security Rule (45 C.F.R. Part 164, Subparts A and C). Notwithstanding the foregoing, no security system is impenetrable, and we cannot guarantee the absolute security of your Personal Information. In the event of a breach of unsecured PHI, we will provide notification in accordance with the HIPAA Breach Notification Rule (45 C.F.R. Part 164, Subpart D) and applicable state data breach notification laws.

Electronic Transmission Risks and Your Responsibilities

Electronic communications and document transmissions — including email, text message, facsimile, and submissions from personal devices — involve inherent security risks, and such transmissions are not encrypted end-to-end by default and may be intercepted, misdirected, or accessed by unauthorized third parties. While we implement reasonable safeguards within our own systems, we cannot guarantee the security of information while in transit over networks or systems outside our control.

To help protect your information, you agree to verify the accuracy of recipient contact information before transmitting; use the Carewell Health portal or other designated secure submission methods rather than unencrypted email or text message, particularly for sensitive health information; limit the information included in any transmission to the minimum necessary for the stated care coordination purpose; secure the personal devices from which you submit documents; avoid transmitting PHI over public or unsecured Wi-Fi networks unless using an encrypted connection; and promptly notify us at support@health.carewell.com if you believe any transmission was misdirected, intercepted, or otherwise compromised. Nothing in these acknowledgments limits our obligations under HIPAA, this Privacy Policy, or applicable state data privacy and security laws with respect to information within our custody or control.

Communications

By enrolling in Care Coordination Services and providing your contact information, you consent to receive administrative communications from us by email, telephone, voicemail, and text message regarding scheduling, care coordination, appointment reminders, intake follow-up, and other administrative matters ("Care Coordination Communications"). Care Coordination Communications are not marketing or promotional messages. Consent to Care Coordination Communications does not constitute consent to receive marketing or promotional messages, which require separate opt-in consent, and you may opt out of marketing communications at any time without affecting your receipt of Care Coordination Communications. Standard message and data rates may apply to text communications.

Your Privacy Rights

Where Carewell Health acts as a business associate, your HIPAA rights — including rights to access, amend, restrict, and receive an accounting of disclosures of your PHI — are governed by the applicable Covered Entity's policies and the terms of the applicable Business Associate Agreement. You may also have additional rights under applicable state law regarding your Personal Information. To exercise your privacy rights with respect to information held by Carewell Health, contact privacy@health.carewell.com; for rights relating to clinical records maintained by your Provider, please contact your Provider directly. You may submit a written request for deletion of your Personal Information to the extent permitted by applicable law by contacting privacy@health.carewell.com, and we will respond to deletion requests within thirty (30) days.

Minors' Information

You must be at least 18 years of age to enroll in or use Care Coordination Services. Where Care Coordination Services are accessed on behalf of a minor, we will comply with applicable state laws governing the confidentiality of minors' health information, including age-of-consent requirements for mental health, reproductive health, and substance use disorder treatment. Where state law permits a minor to consent independently to certain categories of treatment, we will not disclose Member Information related to such treatment to the minor's parent, guardian, or authorized representative without the minor's consent except as required by law.

Data Retention and Destruction

We retain your Member Information, Personal Information, and PHI only for so long as reasonably necessary to fulfill the purposes described in the Care Coordination Terms and this Privacy Policy or as required by applicable law, HIPAA, or an applicable Business Associate Agreement. Upon expiration of the applicable retention period or upon termination of the Care Coordination Terms (whichever is later), we will securely destroy or de-identify your information using methods designed to render it unreadable and unrecoverable, consistent with the HIPAA Security Rule and applicable NIST guidelines. Where we act as a business associate, we will return or destroy PHI in accordance with the applicable Business Associate Agreement and 45 C.F.R. § 164.504(e)(2)(ii)(J).

State-Specific Provisions

Care Coordination Services may be subject to additional state laws governing healthcare privacy, data security, insurance, and patient rights in the state(s) in which you are located, and we will use reasonable efforts to comply with applicable state requirements. Where required by state law, including Florida's applicable healthcare privacy and patient rights statutes, we will provide additional disclosures, obtain required consents, and comply with applicable notification and recordkeeping requirements. California residents may report complaints to the California Department of Managed Health Care (DMHC) or the California Department of Consumer Affairs, and nothing in this Privacy Policy waives any rights you may have under California Health & Safety Code § 1363.1 or other applicable California patient protection statutes. To the extent any provision of this Privacy Policy conflicts with applicable state law, the applicable state law shall control.

Changes to This Privacy Policy

We may revise this Privacy Policy at any time. Where material changes are made, we will communicate them consistent with the notice practices described in the Care Coordination Terms, and your continued use of Care Coordination Services after the effective date constitutes acceptance of the revised Privacy Policy. The collection, use, and disclosure of Personal Information in connection with Care Coordination Services remains governed by this Privacy Policy and, to the extent your Member Information constitutes PHI, by HIPAA.

How to Contact Us

If you have questions or complaints regarding this Privacy Policy or our privacy practices, or if you wish to exercise your privacy rights, please contact our Privacy Officer:

Carewell Family Services LLC d/b/a Carewell Health 104 Crandon Blvd, #406 Key Biscayne, FL 33149 Phone: (448) 233-5964 Privacy Officer: privacy@health.carewell.com General Support: support@health.carewell.com Compliance: compliance@health.carewell.com

Nothing in this Privacy Policy limits your right to file a complaint with the U.S. Department of Health and Human Services, the Florida Agency for Health Care Administration, or any other applicable federal or state regulatory authority.