Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy explains how Graceland Wellness ("Graceland Wellness," "we," "us," or "our") collects, uses, processes, shares, and protects Consumer Health Data and describes rights that may be available to consumers under applicable consumer health data privacy laws.

This Policy supplements our general Privacy Policy and our Notice of Privacy Practices.

Certain health information maintained by Graceland Wellness in connection with providing healthcare services may constitute protected health information ("PHI") governed by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and other healthcare privacy laws. Our HIPAA privacy practices are described separately in our Notice of Privacy Practices.

This Consumer Health Data Privacy Policy applies to Consumer Health Data to the extent applicable consumer health data privacy laws require.

1. Consumer Health Data We May Collect

Depending on how you interact with Graceland Wellness and the healthcare services you request, Consumer Health Data may include information concerning:

• Physical or mental health conditions, symptoms, diagnoses, or health status;
• Healthcare services sought, requested, recommended, or received;
• Medical history;
• Medications and prescription information;
• Allergies and medication reactions;
• Laboratory or diagnostic information;
• Height, weight, body mass index, and weight-management information;
• Metabolic health information;
• Mental and behavioral health information;
• Sexual and reproductive health information;
• Information concerning men's or women's health;
• Treatment preferences and treatment history;
• Information submitted through health screening, eligibility, intake, assessment, or clinical questionnaires;
• Information communicated to healthcare providers or authorized clinical personnel;
• Information concerning healthcare appointments, consultations, prescriptions, treatment, or care coordination; and
• Other information that may identify or reasonably be used to infer a consumer's past, present, or future physical or mental health status where such information constitutes Consumer Health Data under applicable law.

We seek to collect Consumer Health Data only as reasonably necessary for the purposes described in this Policy and as permitted by applicable law.

2. Sources of Consumer Health Data

We may collect Consumer Health Data from:

You

We may receive information directly from you when you:

• Complete an eligibility or health screening;
• Complete an intake questionnaire;
• Create or use an account;
• Request healthcare services;
• Communicate with Graceland Wellness;
• Communicate with a healthcare provider;
• Participate in a telehealth consultation;
• Request a prescription or refill;
• Submit documents or health information;
• Provide information through the patient portal; or
• Otherwise interact with our services.

Healthcare Providers

Licensed healthcare professionals providing or coordinating your care may create or provide Consumer Health Data in connection with evaluations, treatment, prescribing, follow-up, and care coordination.

Healthcare and Service Partners

Where permitted by applicable law, information may also be received from entities involved in supporting your requested healthcare services, such as laboratories, pharmacies, healthcare technology providers, and other service providers.

3. Why We Collect and Use Consumer Health Data

Graceland Wellness may collect and use Consumer Health Data for purposes including:

• Determining eligibility for requested healthcare services;
• Providing telehealth healthcare services;
• Conducting clinical evaluations;
• Supporting diagnosis and treatment;
• Medication management;
• Determining whether a requested treatment or medication is clinically appropriate;
• Prescribing medications when clinically appropriate;
• Coordinating prescriptions with licensed pharmacies;
• Ordering, receiving, or reviewing laboratory or diagnostic information;
• Communicating with patients;
• Scheduling and managing healthcare services;
• Providing follow-up care;
• Maintaining healthcare and business records;
• Operating and securing our digital healthcare platform;
• Detecting or preventing fraud, misuse, security incidents, or unlawful activity;
• Complying with applicable healthcare, privacy, regulatory, and legal requirements; and
• Other purposes disclosed to you or authorized by you as permitted by applicable law.

4. How Consumer Health Data Is Processed

Consumer Health Data may be collected and processed through Graceland Wellness's website, secure patient systems, electronic health record systems, telehealth technology, clinical workflows, electronic prescribing systems, laboratory integrations, pharmacy coordination processes, patient communications, and other systems used to provide or support requested healthcare services.

Access to Consumer Health Data is limited as appropriate to individuals and service providers who require access for authorized purposes.

5. Consumer Health Data We May Share

Graceland Wellness may share Consumer Health Data when reasonably necessary to provide or support services requested by you or when otherwise permitted or required by applicable law.

Depending on the services you use, recipients may include:

• Licensed healthcare providers involved in your care;
• Electronic health record and telehealth technology providers;
• Licensed dispensing pharmacies;
• Laboratories and diagnostic service providers;
• Healthcare technology and infrastructure providers;
• Service providers supporting secure communications or patient operations;
• Payment or transaction service providers, where applicable;
• Professional advisers and compliance service providers when legally appropriate;
• Government agencies, regulators, courts, or other parties when disclosure is required or permitted by law; and
• Other parties at your direction or with your authorization.

The particular recipients may vary depending on the healthcare service requested, your location, clinical needs, and the vendors supporting Graceland Wellness.

Where applicable law requires us to identify particular third parties or affiliates receiving Consumer Health Data, Graceland Wellness will maintain and update the required disclosures as our operational relationships are finalized or changed.

6. Sale of Consumer Health Data

Graceland Wellness does not sell Consumer Health Data.

We do not exchange Consumer Health Data for monetary consideration as part of our business model.

Where applicable law defines "sale" more broadly or requires specific authorization for a particular disclosure, Graceland Wellness will comply with those requirements before engaging in such activity.

7. Advertising and Consumer Health Data

Graceland Wellness does not intend to use Consumer Health Data collected through clinical intake, patient records, provider communications, or other clinical interactions for targeted advertising.

We seek to maintain appropriate separation between healthcare information and website advertising or analytics activities.

We do not authorize advertising partners to use Consumer Health Data obtained from clinical interactions to independently profile patients for advertising purposes.

8. Consumer Health Data and Geofencing

Graceland Wellness does not use geofencing technology around healthcare facilities for the purpose of identifying, tracking, collecting data from, or sending health-related communications or advertisements to consumers based on their presence at or near a healthcare facility where prohibited by applicable law.

9. Consumer Rights

Depending on where you reside and applicable law, you may have rights concerning your Consumer Health Data, including the right to:

• Confirm whether Graceland Wellness collects, shares, or processes your Consumer Health Data;
• Access Consumer Health Data concerning you;
• Obtain information regarding how your Consumer Health Data is collected, used, or shared;
• Request correction of inaccurate Consumer Health Data;
• Request deletion of Consumer Health Data;
• Withdraw consent for certain collection or sharing of Consumer Health Data;
• Obtain information regarding third parties or affiliates with whom Consumer Health Data has been shared;
• Appeal certain decisions regarding your privacy request; and
• Exercise other rights provided by applicable law.

These rights may be subject to exceptions and limitations under applicable law.

Certain information maintained as part of your healthcare record may also be governed by HIPAA, medical-record retention requirements, or other healthcare laws. A request to delete Consumer Health Data therefore does not necessarily require or permit Graceland Wellness to delete information that must be retained under applicable law.

10. How to Exercise Your Rights

Where applicable law grants you Consumer Health Data privacy rights, you may submit a request using the privacy-request method identified by Graceland Wellness.

Privacy Contact:Graceland Wellness Privacy SupportEmail: care@gracelandwellness.com

We may need to verify your identity before fulfilling a request.

We will respond within the period required by applicable law. If applicable law permits an extension, we will notify you when an extension is necessary.

We will not unlawfully discriminate against you for exercising an applicable privacy right.

11. Appeals

If Graceland Wellness denies a Consumer Health Data privacy request and applicable law provides a right to appeal, you may appeal the decision by contacting:

Graceland Wellness Privacy SupportEmail: care@gracelandwellness.com

Please identify the request being appealed and explain why you believe the decision should be reconsidered.

We will review and respond to eligible appeals in accordance with applicable law.

12. Consent

Where applicable law requires consent before Graceland Wellness collects, uses, processes, or shares particular Consumer Health Data, we will obtain the required consent.

Where applicable law provides a right to withdraw consent, you may submit a withdrawal request using the contact method identified in this Policy.

Withdrawal of consent will not affect processing that occurred lawfully before the withdrawal.

Because certain Consumer Health Data may be necessary to evaluate or provide requested healthcare services, withdrawing consent may affect our ability to provide some services.

13. Data Minimization and Security

Graceland Wellness seeks to limit the collection and processing of Consumer Health Data to information reasonably necessary and proportionate to provide or support requested services, comply with legal obligations, and accomplish other purposes disclosed in this Policy.

We maintain administrative, technical, and physical safeguards designed to protect Consumer Health Data against unauthorized access, use, disclosure, alteration, or destruction.

No electronic system can be guaranteed to be completely secure.

14. Retention

We retain Consumer Health Data for as long as reasonably necessary for the purposes for which it was collected and as required or permitted by applicable law.

Retention periods may vary depending on the type of information, whether the information forms part of a medical record, applicable healthcare record-retention requirements, legal and regulatory obligations, dispute-resolution requirements, fraud prevention, and other legitimate purposes.

Closing an online account does not necessarily result in deletion of healthcare records or other information that Graceland Wellness is legally required or permitted to retain.

15. Third-Party Collection and Tracking Technologies

Graceland Wellness may use technologies necessary to operate, secure, and improve its public website.

We seek to configure analytics, advertising, and tracking technologies so that Consumer Health Data submitted through clinical intake, patient portals, provider communications, or other healthcare workflows is not improperly disclosed to third parties.

Our general use of cookies and similar website technologies is described in our Privacy Policy.

16. Children

If Graceland Wellness provides healthcare services to minors, information concerning a minor will be handled in accordance with applicable healthcare, privacy, consent, and parental or guardian authorization requirements.

Consumer rights relating to a minor's information may be exercised by a parent, guardian, personal representative, or the minor as provided by applicable law.

17. Relationship to Our Notice of Privacy Practices

Some Consumer Health Data collected by Graceland Wellness may also constitute Protected Health Information governed by HIPAA.

Our Notice of Privacy Practices describes how Graceland Wellness may use and disclose PHI and explains patients' HIPAA rights.

To the extent this Consumer Health Data Privacy Policy and our Notice of Privacy Practices apply differently to information that constitutes PHI, Graceland Wellness will handle the information in accordance with applicable law.

18. Material Changes to This Policy

We may update this Consumer Health Data Privacy Policy when our practices, services, technologies, vendors, or legal obligations change.

When required by applicable law, we will provide appropriate notice and obtain consent before materially changing how previously collected Consumer Health Data is collected, used, or shared.

The effective date displayed at the beginning of this Policy indicates when this version became effective.

19. Contact Us

Questions regarding this Consumer Health Data Privacy Policy or requests concerning Consumer Health Data may be directed to:

Graceland Wellness Privacy SupportEmail: care@gracelandwellness.com

Graceland Wellness operates as a digital telehealth platform. Privacy communications and requests may be submitted electronically using the contact information above.