HIPAA Notice of
Privacy Practices

AuthFight, Inc. ("AuthFight") handles your health information in one of two legal postures, depending on how you reach us. When we provide services on behalf of a HIPAA Covered Entity — such as a partner pharmacy that refers you to us — we act as a Business Associate under a signed Business Associate Agreement (BAA) with that entity, and HIPAA's Privacy Rule (45 CFR Part 164, Subpart E) and Security Rule (45 CFR Part 164, Subpart C) apply directly to our handling of your information.

When you sign up with AuthFight directly, HIPAA generally does not govern that relationship — HIPAA applies to Covered Entities and their Business Associates, not to services you engage yourself. In that case, your information is protected by this notice, our Privacy Policy, the FTC Act's prohibition on unfair and deceptive practices, the FTC Health Breach Notification Rule (16 CFR Part 318), and applicable state privacy laws. As a matter of policy, we apply the same HIPAA-aligned administrative, technical, and physical safeguards to your information in both postures.

Where technology service providers store, transmit, or otherwise process identifiable health information to help AuthFight operate the platform, we require appropriate contractual safeguards, including Business Associate Agreements where HIPAA requires them and equivalent confidentiality and data-protection terms where it does not. These technology providers are separate from your treating physician, partner pharmacy, and health insurer. Disclosures to your physician and insurer are made at your direction as part of your appeal.

Protected Health Information (PHI) is individually identifiable health information that AuthFight creates, receives, maintains, or transmits on behalf of a HIPAA Covered Entity, such as a participating pharmacy, while acting as its Business Associate. Information you provide directly to AuthFight may contain the same sensitive health details without being PHI as legally defined by HIPAA. We protect both categories under the safeguards described in this notice.

PHI includes information in any form: written, electronic (ePHI), or verbal. The following identifiers, when combined with health information, make data PHI under HIPAA:

In the context of AuthFight, the PHI we typically hold includes your name, diagnosis, prescribed medication or procedure, prescribing physician's name, insurer name and member ID, and the contents of your denial letter and appeal documents.

We use your PHI only for purposes directly related to building and submitting your insurance appeal. Specifically:

Appeal preparation

We use your diagnosis, denial code, denial letter contents, and medical history you provide to decode your denial, calculate your Fight Score, and generate a personalized appeal letter that accurately reflects your clinical situation.

Deadline tracking and reminders

We use your denial date, insurer name, and plan type to calculate your legal appeal deadlines and send you reminders before those windows close.

Physician coordination

We use your PHI to share your appeal draft with your treating physician, who reviews the letter for clinical accuracy and medical appropriateness and signs it before it is submitted to your insurer, and we follow up with their office on your behalf until a response is received.

Platform operations

We use de-identified, aggregated data — from which all PHI identifiers have been removed — to understand appeal outcomes, improve our Fight Score accuracy, and develop new features. De-identified data is not PHI and is not subject to HIPAA restrictions.

We disclose your PHI only in the following circumstances. We practice data minimization and limit information to what is reasonably appropriate for each purpose, subject to circumstances in which HIPAA's minimum-necessary standard does not apply, including certain authorized disclosures and disclosures for treatment.

We do not disclose your PHI to employers, life insurers, financial institutions, data brokers, pharmaceutical companies, or any marketing entity.

The uses and disclosures described above are made with your consent and at your direction — they are what you hire us to do when you start an appeal. Where HIPAA applies to our work, they fall within its permitted purposes. For any use or disclosure not described in this notice, we will ask for your written authorization before proceeding, regardless of which legal posture applies.

Uses that always require your written authorization include:

• Most uses of PHI for marketing purposes
• Sale of PHI to any third party
• Disclosures of psychotherapy notes
• Any use not otherwise permitted by the HIPAA Privacy Rule

Revoking your authorization

You may revoke a written authorization at any time by notifying us in writing at support@authfight.com. Revocation takes effect upon our receipt of your written notice. It does not apply to actions we have already taken based on your prior authorization. Please note that revoking authorization for us to process your PHI will prevent us from continuing to work on your appeal.

When AuthFight holds PHI as a Business Associate, the applicable Covered Entity is generally responsible for responding to HIPAA requests for access, amendment, restrictions, and an accounting of disclosures. AuthFight supports the Covered Entity as required by our BAA and may respond directly when the BAA authorizes us to do so. We also offer comparable privacy choices to direct AuthFight users as a matter of policy. You may begin a request by emailing support@authfight.com with the subject line "Health Information Request." We will respond or route the request to the appropriate Covered Entity within the timeframe required by applicable law and our contractual obligations.

When we act as a Business Associate, HIPAA and our BAA impose duties concerning how we safeguard and handle PHI. We apply comparable protections to every user as a matter of policy. Our responsibilities include:

• Maintain the privacy and security of your Protected Health Information.
• Report breaches of unsecured PHI to the applicable Covered Entity and provide any other notifications for which AuthFight is responsible under applicable law.
• Follow the privacy commitments described in this notice.
• Not use or disclose your PHI except as described in this Notice or as otherwise permitted by applicable law.
• Train all members of our workforce on our HIPAA privacy and security policies.
• Designate a Privacy Officer responsible for developing and implementing our HIPAA compliance program.

Where HIPAA's minimum necessary standard applies, AuthFight makes reasonable efforts to limit PHI to what is needed for the intended purpose. The HIPAA standard does not apply to every disclosure, including certain disclosures for treatment or those made under a valid individual authorization. Even when the HIPAA standard does not apply, we practice data minimization as a company policy.

In practice, this means:

• We only request the clinical records and documentation directly relevant to your specific denial and appeal.
• We only share with your treating physician the appeal materials relevant to the denied treatment they prescribed.
• We only transmit to your insurer the documents required for your appeal submission.
• Internal access to your PHI is restricted to AuthFight personnel whose job function requires it, and all access is logged.

If you believe AuthFight has not complied with this notice, you may file a complaint with us. If your concern involves PHI handled by AuthFight as a Business Associate, you may also complain to the applicable Covered Entity or the U.S. Department of Health and Human Services Office for Civil Rights (HHS OCR).

We may update this notice as our services, privacy practices, or legal obligations change. A revised notice will state its effective date and describe the practices that apply to health information we maintain, including information collected before the revision when permitted by applicable law and our contractual obligations.

When we make a material change to this Notice, we will:

• Post the updated Notice on our website at authfight.com/hipaa with a new effective date.
• Send email notification to all registered users at the address on their account.
• Make a paper copy available upon request at no charge.

The most current version of this Notice is always available at authfight.com/hipaa. Previous versions are available upon request by emailing support@authfight.com.

For questions about this Notice, to exercise your HIPAA rights, or to report a privacy concern, contact our designated Privacy Officer:

Legal disclaimer:This notice reflects AuthFight's current data practices. It does not constitute legal advice. This notice should be reviewed by a qualified healthcare privacy attorney before being published in a final production environment. Legal obligations vary based on specific business relationships and the nature of the health information handled.