RSRV Health · Document 05 of 05

HIPAA Notice of Privacy Practices

Effective date: August 19, 2026 · RSRV Health

This Notice of Privacy Practices describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully. Independent clinicians and pharmacies on the RSRV platform may be covered entities under HIPAA and may provide their own notices. Where RSRV Health acts as a business associate, it handles protected health information (“PHI”) only as permitted by contract and law.

1. Our duties

We are required by law to maintain the privacy of PHI, to provide this Notice of our legal duties and privacy practices, and to notify affected individuals of a breach of unsecured PHI. We must follow the terms of the Notice that is currently in effect.

2. How we may use and disclose PHI

We may use and disclose PHI without your written authorization for:

• Treatment: to licensed clinicians evaluating your intake, prescribing, or providing follow-up care, and to pharmacies compounding, dispensing, and shipping medication.
• Payment: to bill and collect for services after clinical approval, including payment processors and insurers if applicable.
• Health care operations: quality review, customer support related to your care logistics, training, and legal or compliance activities.
• As required by law: including public-health reporting, health-oversight activities, judicial or administrative proceedings, law enforcement in limited circumstances, and reports of abuse, neglect, or threats of harm when required or permitted.
• Business associates: vendors who help operate the Platform under written agreements that require them to protect PHI.

Other uses and disclosures — including most marketing that is not face-to-face, sale of PHI, and most sharing of psychotherapy notes — require your written authorization. You may revoke an authorization in writing except to the extent we have already relied on it.

3. Your rights

Subject to HIPAA and state law, you have the right to:

• Request restrictions on certain uses and disclosures of PHI (we are not required to agree, except in limited payment-related cases required by law).
• Request confidential communications at an alternative address or by alternative means.
• Inspect and obtain a copy of PHI in a designated record set, including an electronic copy if we maintain the record electronically.
• Request an amendment of PHI you believe is incorrect or incomplete.
• Receive an accounting of certain disclosures of PHI.
• Receive a paper copy of this Notice even if you agreed to receive it electronically.
• File a complaint if you believe your privacy rights have been violated.

To exercise these rights, contact privacy@rsrv.health. We will not retaliate against you for filing a complaint. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights.

4. Independent clinicians and pharmacies

Your treating clinician and dispensing pharmacy maintain medical and pharmacy records and may use and disclose PHI for treatment, payment, and operations as described in their own notices. RSRV does not replace those entities’ HIPAA obligations.

5. Changes to this Notice

We may change this Notice and make the revised Notice effective for PHI we already have as well as information we receive in the future. The current Notice will be posted on the Platform with its effective date.

6. Contact

Privacy Officer · RSRV Health
Phone: +1 (978) 740-7778
privacy@rsrv.health · legal@rsrv.health
RSRV Health
740 Reserve Drive, Suite 978
Peabody, MA 01960