HIPAA Notice of
Privacy Practices

AuthFight, Inc. ("AuthFight") operates as a Business Associate under HIPAA. This means we receive, create, and transmit Protected Health Information (PHI) on behalf of patients and, where applicable, in connection with Covered Entities such as your physician or health plan.

As a Business Associate, we are directly required to comply with HIPAA's Privacy Rule (45 CFR Part 164, Subpart E) and Security Rule (45 CFR Part 164, Subpart C), and we are subject to the same enforcement and penalty provisions that apply to Covered Entities.

We enter into Business Associate Agreements (BAAs) with physician reviewers and other vendors who access PHI in connection with our service, ensuring your information is protected throughout the appeal process.

Protected Health Information (PHI) is any information we hold about you that relates to your past, present, or future physical or mental health condition, the healthcare services you receive, or payment for those services — and that could reasonably be used to identify you.

PHI includes information in any form: written, electronic (ePHI), or verbal. The following identifiers, when combined with health information, make data PHI under HIPAA:

In the context of AuthFight, the PHI we typically hold includes your name, diagnosis, prescribed medication or procedure, prescribing physician's name, insurer name and member ID, and the contents of your denial letter and appeal documents.

We use your PHI only for purposes directly related to building and submitting your insurance appeal. Specifically:

Appeal preparation

We use your diagnosis, denial code, denial letter contents, and medical history you provide to decode your denial, calculate your Fight Score, and generate a personalized appeal letter that accurately reflects your clinical situation.

Deadline tracking and reminders

We use your denial date, insurer name, and plan type to calculate your legal appeal deadlines and send you reminders before those windows close.

Physician coordination

We use your PHI to share your appeal draft with a licensed physician reviewer, who reviews the letter for clinical accuracy and medical appropriateness before it is submitted to your insurer.

Platform operations

We use de-identified, aggregated data — from which all PHI identifiers have been removed — to understand appeal outcomes, improve our Fight Score accuracy, and develop new features. De-identified data is not PHI and is not subject to HIPAA restrictions.

We disclose your PHI only in the following circumstances. Every disclosure is limited to the minimum information necessary to accomplish its specific purpose.

We do not disclose your PHI to employers, life insurers, financial institutions, data brokers, pharmaceutical companies, or any marketing entity.

The uses and disclosures described above are permitted under HIPAA without your specific written authorization because they are necessary to perform the service you requested. For any use or disclosure not described in this notice, we will ask for your written authorization before proceeding.

Uses that always require your written authorization include:

• Most uses of PHI for marketing purposes
• Sale of PHI to any third party
• Disclosures of psychotherapy notes
• Any use not otherwise permitted by the HIPAA Privacy Rule

Revoking your authorization

You may revoke a written authorization at any time by notifying us in writing at privacy@authfight.com. Revocation takes effect upon our receipt of your written notice. It does not apply to actions we have already taken based on your prior authorization. Please note that revoking authorization for us to process your PHI will prevent us from continuing to work on your appeal.

HIPAA gives you specific rights over your Protected Health Information. You may exercise any of these rights by emailing privacy@authfight.com with the subject line "HIPAA Rights Request". We will respond within 30 days, as required by law.

Under HIPAA, AuthFight is legally required to:

• Maintain the privacy and security of your Protected Health Information.
• Provide you with this Notice of Privacy Practices describing our legal duties and privacy practices with respect to your PHI.
• Notify you following a breach of your unsecured PHI.
• Abide by the terms of this Notice currently in effect.
• Not use or disclose your PHI except as described in this Notice or as otherwise permitted by applicable law.
• Train all members of our workforce on our HIPAA privacy and security policies.
• Designate a Privacy Officer responsible for developing and implementing our HIPAA compliance program.

When using or disclosing your PHI, or when requesting PHI from another source on your behalf, AuthFight makes reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request.

In practice, this means:

• We only request the clinical records and documentation directly relevant to your specific denial and appeal.
• We only share with physician reviewers the information they need to evaluate your appeal — not your complete medical history.
• We only transmit to your insurer the documents required for your appeal submission.
• Internal access to your PHI is restricted to AuthFight personnel whose job function requires it, and all access is logged.

If you believe your HIPAA privacy rights have been violated, or that we have not complied with this Notice, you have the right to file a complaint. You may file with us directly or with the U.S. Department of Health and Human Services Office for Civil Rights (HHS OCR) — or both.

We reserve the right to change the terms of this Notice at any time, provided that the revised Notice applies only to PHI we create or receive after the effective date of the change.

When we make a material change to this Notice, we will:

• Post the updated Notice on our website at authfight.com/hipaa with a new effective date.
• Send email notification to all registered users at the address on their account.
• Make a paper copy available upon request at no charge.

The most current version of this Notice is always available at authfight.com/hipaa. Previous versions are available upon request by emailing privacy@authfight.com.

For questions about this Notice, to exercise your HIPAA rights, or to report a privacy concern, contact our designated Privacy Officer:

Legal disclaimer:This HIPAA Notice of Privacy Practices reflects AuthFight's current data practices as a Business Associate under HIPAA. It does not constitute legal advice. This notice should be reviewed by a qualified healthcare privacy attorney before being published in a final production environment. HIPAA compliance requirements may vary based on your specific business relationships and the nature of PHI you handle.