Privacy Policy

Scope of This Policy

This Privacy Policy applies to personal information collected through:

• the MedexCore website;

• website contact, consultation, audit, or inquiry forms;

• email and telephone communications with MedexCore;

• business development and sales communications;

• interactions with current or prospective healthcare provider clients;

• online scheduling tools, where provided;

• our client onboarding and administrative processes; and

• other business interactions in which this Privacy Policy is provided or referenced.

This Privacy Policy primarily describes MedexCore's handling of personal information in connection with its website and business relationships. Information that qualifies as Protected Health Information (“PHI”) under HIPAA and that MedexCore processes as a Business Associate is also governed by the applicable Business Associate Agreement (“BAA”), client agreement, HIPAA, HITECH, and other applicable laws. If this Privacy Policy conflicts with an applicable BAA concerning PHI, the BAA and applicable law will control with respect to that PHI.

Important Notice About Patient Information

MedexCore primarily provides services to healthcare providers and healthcare organizations. Our general website is not intended to serve as a patient portal or a substitute for communicating directly with your healthcare provider. “Do not submit patient records, Social Security numbers, insurance cards, medical records, diagnosis information, treatment information, or other PHI through a general website contact form or ordinary email unless MedexCore has specifically instructed you to use a secure method that is appropriate for transmitting such information.” Where MedexCore provides a secure portal, secure file-transfer system, or other specifically designated method for exchanging PHI, users should use that method. If you are a patient seeking to exercise rights relating to your medical records or PHI, you should generally contact the physician, medical practice, clinic, healthcare organization, health plan, or other Covered Entity responsible for your records. When MedexCore acts as that organization's Business Associate, we will assist our client with applicable privacy requests as required by HIPAA, our BAA, and applicable law.

Information We Collect

The information MedexCore collects depends on how you interact with us. Information You Provide Directly When you contact MedexCore, request a consultation, request information, inquire about services, become a client, or otherwise communicate with us, we may collect information such as: Contact information, including your name, business email address, telephone number, mailing address, and other contact details. Professional and practice information, including your practice name, healthcare organization, job title, medical specialty, practice size, location, provider information, and information relating to your business operations. Service inquiry information, including information about the billing, coding, credentialing, collections, accounts receivable, claims, denial, prior authorization, eligibility, or revenue cycle issues for which you request assistance. Client account and administrative information, including authorized contacts, account-related information, service preferences, implementation details, and information needed to administer our client relationship. Contract and payment-related information, where applicable, that is reasonably necessary to establish or administer a commercial relationship with MedexCore. Communication information, including information contained in emails, telephone communications, form submissions, support requests, meeting notes, correspondence, and other communications with us. You are responsible for ensuring that information you provide to us is accurate and that you are authorized to provide it.

Information Collected Automatically

When you visit our website, certain information may be collected automatically by our website, hosting providers, analytics providers, security providers, or similar technologies. This information may include:

• Internet Protocol (“IP”) address;

• browser type and version;

• device type;

• operating system;

• general geographic location derived from an IP address;

• referring website or page;

• pages viewed;

• links clicked;

• date and time of access;

• time spent on particular pages;

• website navigation information;

• cookie or similar technology identifiers; and

• information used to detect fraud, abuse, malicious activity, or security threats.

We may use this information to operate the website, understand website usage, improve performance, protect our systems, and improve our services.

Cookies and Similar Technologies

MedexCore may use cookies, pixels, tags, local storage, scripts, analytics technologies, and similar technologies. These technologies may be used for purposes such as maintaining website functionality, remembering preferences, understanding how visitors use our website, measuring performance, maintaining security, preventing fraud, and evaluating marketing effectiveness. Cookies may generally fall into categories such as: Essential cookies, which support basic website functions, security, navigation, and operation. Functional cookies, which may remember settings or preferences. Analytics cookies, which help us understand website traffic, visitor behavior, and website performance. Marketing or advertising technologies, if used, which may help measure marketing campaigns or deliver more relevant business advertising. Where required by applicable law, MedexCore will provide appropriate choices regarding non-essential cookies or similar technologies. You may also be able to restrict cookies through your browser settings. Restricting certain cookies may affect website functionality. Some browsers offer “Do Not Track” signals. Because there is not a single universally accepted standard for responding to all Do Not Track signals, our website may not respond to every such signal. Where applicable privacy law requires recognition of a legally valid browser-based opt-out preference signal, such as Global Privacy Control (“GPC”), MedexCore will handle such signals as required by applicable law.

Information Obtained From Other Sources

MedexCore receives information from sources other than directly from you. Depending on the relationship, those sources may include:

• healthcare provider clients;

• physicians or authorized practice personnel;

• health plans and insurance payers;

• healthcare clearinghouses;

• electronic health record or practice management systems;

• credentialing organizations;

• authorized vendors or service providers;

• referral or business partners;

• publicly available business sources; and

• other parties authorized to provide information to MedexCore.

Where such information includes PHI, MedexCore will process the PHI only as permitted by the applicable BAA, client agreement, HIPAA, and other applicable law.

Protected Health Information and HIPAA

When MedexCore performs services for a HIPAA Covered Entity that require MedexCore to create, receive, maintain, or transmit PHI on the Covered Entity's behalf, MedexCore generally acts as a Business Associate under HIPAA. In those circumstances, we use and disclose PHI only as permitted or required by the applicable BAA, our agreement with the client, and applicable law. PHI processed in connection with our services may include, as necessary for the applicable service:

• patient demographic information;

• insurance and health plan information;

• claim information;

• diagnosis and procedure codes;

• billing records;

• payment and remittance information;

• eligibility information;

• prior authorization information;

• provider information;

• accounts receivable information; and

• other information required to perform authorized revenue cycle management services.

MedexCore's access to PHI is limited to the information reasonably necessary to perform the functions for which we have been engaged, subject to applicable legal requirements. MedexCore does not sell PHI. MedexCore does not use PHI for unrelated advertising purposes. When required, we enter into BAAs with healthcare provider clients and require subcontractors that create, receive, maintain, or transmit PHI on MedexCore's behalf to enter into appropriate agreements and protect PHI as required by HIPAA. The healthcare provider or other Covered Entity remains responsible for its own HIPAA Notice of Privacy Practices, patient-facing privacy obligations, and other responsibilities that apply directly to the Covered Entity.

How We Use Information

We use personal information for legitimate business, contractual, operational, compliance, and legal purposes, including to:

• provide medical billing and revenue cycle management services;

• respond to inquiries and consultation requests;

• evaluate whether our services are appropriate for a prospective client;

• prepare proposals, service arrangements, and contracts;

• onboard and support clients;

• provide medical coding, claim submission, denial management, accounts receivable

follow-up, payment posting, eligibility verification, prior authorization, credentialing, reporting, and related services;

• communicate with healthcare providers, insurance payers, clearinghouses, vendors, and

other authorized parties as necessary to perform requested services;

• maintain and administer client relationships;

• respond to customer service and support inquiries;

• operate, maintain, secure, and improve our website and systems;

• analyze website performance and usage;

• protect against fraud, unauthorized access, misuse, cybersecurity threats, and other

harmful activities;

• investigate security events and suspected violations;

• maintain business records;

• comply with legal, regulatory, contractual, audit, insurance, and compliance obligations;

• establish, exercise, or defend legal claims;

• enforce our contracts, policies, and rights;

• send service-related communications; and

• send business or marketing communications where permitted by applicable law.

We may also create or use aggregated or de-identified information where permitted by applicable law and contract. Where information is de-identified pursuant to HIPAA, we will handle such information in accordance with applicable legal requirements.

Marketing Communications

We use business contact information to communicate about our services, resources, company updates, or other information that may be relevant to healthcare organizations and business contacts. You may opt out of promotional email communications by using the unsubscribe mechanism contained in the message or by contacting us. An opt-out from marketing communications does not prevent us from sending non-promotional communications that are necessary for an existing business relationship, such as service notices, security notices, contractual communications, or responses to your requests. If MedexCore offers SMS or text-message communications and you affirmatively opt in, you may be able to opt out by following the instructions included in the applicable message, such as replying “STOP.” We will comply with applicable marketing and communications laws.

How We Disclose Information

MedexCore does not disclose personal information arbitrarily. We disclose information in the following circumstances. Healthcare Clients We may disclose information to the healthcare provider or healthcare organization on whose behalf we perform services. Payers, Clearinghouses, and Healthcare Participants As authorized by our clients, we may exchange information with insurance companies, health plans, clearinghouses, provider networks, credentialing organizations, and other healthcare participants when necessary to perform billing or revenue cycle services. Service Providers and Vendors We may disclose personal information to companies that assist us with functions such as: website hosting; cloud infrastructure; information technology; cybersecurity; communications; email services; customer relationship management; scheduling; analytics; document management; professional services; business operations; and other services used to operate our business. If a service provider or subcontractor will create, receive, maintain, or transmit PHI on behalf of MedexCore, MedexCore will require an appropriate BAA where required by HIPAA. Professional Advisors Information may be disclosed where reasonably necessary to attorneys, accountants, auditors, insurers, consultants, and other professional advisors that assist MedexCore. Legal and Regulatory Requirements We may disclose information when we reasonably believe disclosure is necessary to:

• comply with applicable law or regulation;

• respond to a valid subpoena, court order, warrant, or other legal process;

• cooperate with a lawful government or regulatory request;

• protect the rights, property, security, or safety of MedexCore, our clients, our workforce,

or others;

• investigate suspected fraud, security incidents, or illegal activity; or

• establish, exercise, or defend legal claims.

PHI will only be disclosed under this section to the extent permitted or required by HIPAA and other applicable law. Business Transactions Information may be transferred or disclosed in connection with a merger, acquisition, financing, restructuring, reorganization, sale of assets, bankruptcy, or similar corporate transaction. Any transfer involving PHI remains subject to applicable HIPAA requirements, contractual restrictions, and BAAs. At Your Direction We may disclose information when you direct us to do so or when you otherwise provide valid authorization or consent.

Sale and Sharing of Personal Information

MedexCore does not sell PHI. MedexCore does not knowingly sell website visitors' personal information to third parties in exchange for monetary consideration. Certain disclosures involving analytics, cookies, advertising technologies, or similar online technologies can be treated as a “sale,” “sharing,” or use for “targeted advertising” under some U.S. state privacy laws even when no money is exchanged. To the extent MedexCore engages in an activity that is legally considered a sale, sharing, or targeted advertising, we will provide any notice, consent mechanism, or opt-out right required by applicable law. PHI processed as a Business Associate is subject to HIPAA and applicable BAAs and is not used for cross-context behavioral advertising.

Sensitive Personal Information

Depending on the services being provided, MedexCore may process information that applicable law considers sensitive. This can include health information, insurance information, financial information, authentication information, or similar data. We process sensitive personal information only for legitimate purposes reasonably necessary to provide services, comply with applicable law, maintain security, or otherwise fulfill an authorized purpose. We do not intentionally collect Social Security numbers, medical records, insurance card information, or other sensitive patient information through ordinary marketing or general contact forms unless expressly necessary and a suitable method for collection has been provided.

Data Security

MedexCore recognizes the sensitive nature of healthcare and billing information. We maintain administrative, physical, and technical safeguards designed to protect personal information and, where applicable, electronic PHI against unauthorized access, acquisition, use, disclosure, alteration, loss, or destruction. Our safeguards are designed to be appropriate to the nature of the information, the systems involved, applicable contractual requirements, and applicable law. Depending on the applicable system and risk, safeguards may include access controls, authentication measures, workforce training, information security procedures, system monitoring, secure transmission methods, backup and recovery practices, vendor oversight, incident response procedures, and other technical or organizational controls. Where MedexCore is subject to the HIPAA Security Rule as a Business Associate, we maintain safeguards designed to comply with applicable HIPAA requirements concerning the confidentiality, integrity, and availability of electronic PHI. No Internet transmission, electronic storage system, network, or security measure can be guaranteed to be completely secure. MedexCore therefore cannot guarantee absolute security. Users are also responsible for protecting passwords, access credentials, devices, and other means through which they access systems or communicate information.

Security Incidents and Breach Notification

MedexCore maintains processes designed to identify, investigate, contain, mitigate, and respond to suspected privacy and security incidents. Where a security incident involves PHI processed by MedexCore as a Business Associate, we will notify the applicable Covered Entity as required by HIPAA, the applicable BAA, and other applicable law. Where other personal information is affected by a reportable data breach, we will provide or support legally required notifications in accordance with applicable federal and state breach-notification laws.

Data Retention

MedexCore retains personal information only for as long as reasonably necessary for the purposes for which it was collected or as otherwise required or permitted by law. Retention periods may depend on factors including:

• the duration of a client or business relationship;

• the type and sensitivity of the information;

• the purpose for which the information was collected;

• client instructions;

• contractual requirements;

• applicable BAAs;

• legal and regulatory requirements;

• billing, tax, accounting, audit, and insurance obligations;

• security and fraud-prevention needs; and

• the need to establish, exercise, or defend legal claims.

PHI processed on behalf of a healthcare provider may be retained, returned, deleted, or otherwise handled in accordance with the applicable BAA, client agreement, and applicable law. When information is no longer required, we delete, destroy, anonymize, or de-identify it, subject to applicable legal obligations and reasonable backup or archival processes.

Your Privacy Rights

Depending on where you live and the laws that apply to MedexCore, you may have certain rights concerning your personal information. These rights may include the right to:

• confirm whether we process your personal information;

• request access to personal information maintained about you;

• request correction of inaccurate personal information;

• request deletion of certain personal information;

• obtain a portable copy of certain personal information;

• opt out of certain sales or sharing of personal information;

• opt out of certain targeted advertising;

• opt out of certain profiling activities involving decisions that produce legal or similarly

significant effects;

• limit certain uses or disclosures of sensitive personal information where applicable;

• withdraw consent where processing is based on consent;

• appeal certain decisions concerning a privacy request; and

• exercise privacy rights without unlawful discrimination or retaliation.

These rights are subject to limitations, exceptions, and verification requirements under applicable law. For example, we may be unable to delete information that we are legally or contractually required to retain. Certain state consumer privacy laws also contain exemptions for PHI, healthcare information, Business Associates, Covered Entities, business-to-business information, employment information, or other categories of information.

How to Submit a Privacy Request

To submit a privacy request, contact MedexCore using one of the following methods: Email: info@medexcore.com Telephone: (917) 924-9022 Please include “Privacy Request” in the subject line of an email where possible. Your request should provide sufficient information for us to understand the request and reasonably verify your identity and, where applicable, your authority to make the request. We may request additional information when reasonably necessary to verify identity or prevent fraudulent requests. We will not request more personal information than is reasonably necessary for verification. We will respond within the period required by applicable law. Where legally permitted, additional time may be used when reasonably necessary, and we will provide any notice required by law.

Authorized Agents

Where permitted by applicable law, you may use an authorized agent to submit a privacy request on your behalf. MedexCore may require evidence that the agent is authorized to act for you and may separately verify your identity. We may deny an authorized-agent request where we cannot reasonably verify the authorization or where denial is otherwise permitted by law.

Appeals

If applicable state law provides a right to appeal a decision concerning your privacy request, you may submit an appeal by emailing: info@medexcore.com Please use the subject line “Privacy Request Appeal” and explain why you believe the decision should be reconsidered. We will process an appeal in accordance with applicable law.

California Privacy Disclosure

This section applies to California residents only to the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), applies to MedexCore or the applicable information. During the preceding twelve months, depending on how an individual has interacted with us, MedexCore may have collected the following categories of personal information:

• Identifiers, such as name, business email address, telephone number, IP address, or

online identifiers.

• Customer records information, such as contact details and other information provided

in connection with a business relationship.

• Commercial information, such as information about services requested, purchased,

considered, or discussed.

• Internet or electronic network activity, such as browsing activity, interactions with our

website, device information, and cookie identifiers.

• Professional or employment-related information, such as job title, practice affiliation,

medical specialty, or professional role.

• Geolocation information, generally limited to approximate location inferred from an IP

address unless otherwise disclosed.

• Sensitive personal information, where required to provide authorized services and

subject to applicable exemptions and restrictions. The sources of this information may include the individual, the individual's employer or healthcare organization, clients, authorized representatives, website technologies, service providers, publicly available business sources, and other authorized sources. We use these categories for the business and commercial purposes described in this Privacy Policy, including providing services, responding to inquiries, administering business relationships, operating and securing our website, complying with law, performing contracts, detecting security threats, and improving our services. Information may be disclosed to the categories of recipients described in the “How We Disclose Information” section of this Policy. MedexCore does not sell PHI. MedexCore does not knowingly sell personal information for monetary consideration. Where online technologies constitute “sharing” for cross-context behavioral advertising under California law, we will provide applicable rights and opt-out mechanisms as required by law. California residents have the right to know, access, correct, delete, obtain information about collection and disclosure practices, opt out of sale or sharing, limit certain uses of sensitive personal information, and exercise those rights without unlawful discrimination. Not all information processed by MedexCore is subject to the CCPA. Information governed by HIPAA and other statutory exemptions may be outside the scope of particular CCPA requirements.

Other U.S. State Privacy Laws

Residents of states that provide comprehensive consumer privacy rights have additional rights under their applicable state laws. Such laws provide rights relating to access, correction, deletion, portability, targeted advertising, sale of personal data, certain profiling, sensitive information, appeals, or other privacy matters. MedexCore will honor applicable rights to the extent required by the law that applies to the individual and the information involved. Nothing in this Privacy Policy is intended to provide rights beyond those required by applicable law or an applicable contract.

Patient Rights Concerning PHI

If MedexCore possesses your PHI solely because we provide medical billing or revenue cycle services to your healthcare provider, the healthcare provider generally remains responsible for responding to your HIPAA privacy-rights requests. These may include requests involving access, amendment, restrictions, confidential communications, or an accounting of certain disclosures. Please contact the healthcare provider identified on your medical or billing records. Where required by our BAA or applicable law, MedexCore will assist the provider in responding to your request.

Children’s Privacy

The MedexCore website and its business services are intended for healthcare professionals, medical practices, healthcare organizations, and other business users. Our website is not directed to children under 13, and we do not knowingly collect personal information directly from children under 13 through ordinary website interactions. If we become aware that information has been collected directly from a child in a manner prohibited by applicable law, we will take appropriate steps. This section does not prevent MedexCore from processing information relating to minor patients when that information is lawfully provided by a healthcare provider and is necessary for authorized medical billing or revenue cycle services. Such information will be treated as PHI when HIPAA applies.

Third-Party Websites and Services

Our website contains links to websites, platforms, social networks, scheduling systems, or other services operated by third parties. MedexCore does not control the privacy practices of third parties that operate independently from us. When you leave the MedexCore website or interact directly with a third-party service, that third party's privacy policy and terms may apply. We encourage users to review the privacy policies of third-party services before providing personal information.

International Processing

MedexCore is focused on providing services to healthcare organizations in the United States. Personal information may nevertheless be processed in the United States or in other jurisdictions where MedexCore or authorized service providers operate. Where information is transferred or processed across jurisdictions, MedexCore will handle the information in accordance with applicable legal, contractual, and HIPAA requirements. PHI will not be disclosed to a third-party service provider merely because it provides services to MedexCore. Where HIPAA requires a BAA or other safeguards, those requirements must be satisfied before the provider is permitted to create, receive, maintain, or transmit PHI.

Business Contact Information

Information concerning physicians, employees of healthcare organizations, vendor representatives, contractors, and other business contacts may be used to establish, maintain, administer, or develop MedexCore's business relationships. Although certain privacy laws contain exclusions or special rules for business contact information, MedexCore will handle such information consistent with applicable law and this Privacy Policy.

Legal Requirements and Government Requests

MedexCore preserves or discloses information when required by applicable law or valid legal process. Where a government, regulator, law enforcement authority, or other party requests PHI, MedexCore will evaluate the request in light of HIPAA, the applicable BAA, and other legal requirements before disclosing PHI. We challenge or limit requests when legally appropriate.

Changes to This Privacy Policy

MedexCore may update this Privacy Policy periodically to reflect changes in our services, technology, legal requirements, privacy practices, or business operations. When we update the Policy, we will revise the “Last Updated” date shown above. If applicable law requires additional notice or consent for a material change, we will provide such notice or obtain such consent as required. A revised Privacy Policy will apply prospectively from its effective date except where applicable law provides otherwise. We encourage visitors and clients to review this Policy periodically.

Contact MedexCore

Questions about this Privacy Policy, our privacy practices, or a privacy request may be directed to: PRIMACY MEDEX INC. d/b/a MedexCore 5900 Balcones Drive, Suite 100 Austin, TX 78731 United States Email: info@medexcore.com Phone: (917) 924-9022 Website: https://medexcore.com/ For matters involving patient PHI, patients should generally contact their healthcare provider first. We will cooperate with its healthcare provider clients as required by HIPAA, applicable BAAs, and applicable law.