Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Important Scope Note. This Notice applies only to protected health information ("PHI") that Massoudi Longevity Professionals of America, Inc., a Delaware corporation ("MLPA"), or an MLPA-affiliated, participating, or contracted HIPAA covered health care provider, professional entity, organized health care arrangement participant, or business associate creates, receives, maintains, or transmits in connection with HIPAA-covered clinical services. MLPA is a longevity, wellness, membership, technology, AI, education, product, and e-commerce company. Not all health-related information collected by MLPA is PHI or governed by this Notice. Non-HIPAA personal information, consumer health data, website/app data, membership administration data, e-commerce data, non-clinical product-safety or product-complaint data, marketing data, cookie/SDK data, and interactions with the AI assistant currently known as "Mya" outside a HIPAA-covered clinical workflow are generally governed by MLPA's Privacy Policy, Consumer Health Data Privacy Policy, California Privacy Supplement, Terms and Conditions, and applicable stand-alone consents or authorizations.

1. Who Must Follow This Notice

This Notice describes the privacy practices of MLPA and any MLPA-affiliated, participating, or contracted covered health care provider, professional entity, clinical workforce member, or organized health care arrangement participant that adopts this Notice for HIPAA-covered services (collectively, the “Covered MLPA Services”).

Covered MLPA Services may include, where legally available and clinically appropriate, ancillary or supplemental telehealth visits, clinical intake reviews, provider messaging, laboratory or diagnostic order coordination, review of laboratory, genetic, biomarker, imaging, wearable, or remote-monitoring results by licensed providers, pharmacy or prescription coordination, care coordination with your primary care physician or specialists, clinically relevant product, supplement, peptide, device, medication, adverse-event, safety, or recall follow-up, and other health care services provided by or through a HIPAA-covered MLPA provider or participating professional entity.

This Notice also applies to MLPA workforce members and business associates who need access to PHI to perform functions for Covered MLPA Services. “Workforce” includes employees, contractors, trainees, volunteers, and other persons whose conduct is under our direct control for HIPAA purposes. “Business associates” are vendors and service providers that create, receive, maintain, or transmit PHI for us and are required by written business associate agreement to safeguard PHI when HIPAA requires such an agreement.

If clinical services are provided by independent medical groups, licensed professionals, laboratories, pharmacies, imaging centers, or other third parties that have not adopted this Notice, their own Notices of Privacy Practices or privacy notices may govern their use and disclosure of PHI. MLPA’s role may vary by service: MLPA may be a covered health care provider for some services, a business associate or technology/administrative services provider for others, and an independent business for non-HIPAA membership, website, app, AI, e-commerce, and wellness activities.

2. Relationship to MLPA’s Business Model and Other Privacy Documents

MLPA is a longevity, wellness, and health-technology company led by physicians and other professionals. MLPA is not intended to replace your primary care physician, specialist, oncologist, emergency provider, mental health crisis provider, or comprehensive health care team. Covered MLPA Services, if offered, are intended to be ancillary, supplemental, and limited in scope unless a licensed provider separately agrees to provide a specific clinical service to you within the scope of that provider’s license and applicable law.

This Notice is a HIPAA Notice of Privacy Practices. It is different from MLPA's general Privacy Policy, Consumer Health Data Privacy Policy, California Privacy Supplement, cookie notices, EU/UK/Swiss privacy disclosures, and Terms and Conditions. Many types of health-related information may be regulated by consumer privacy or consumer health data laws even when they are not PHI under HIPAA. Examples may include website visits to health-related pages, membership onboarding data, e-commerce purchases, product-safety reports or product complaints outside a Covered MLPA Service, Mya chats outside a covered clinical workflow, marketing preferences, device identifiers, cookie or SDK data, lead-intelligence data, wearable data not used in Covered MLPA Services, and information collected through MLPA's public website, mobile app, membership platform, or store.

When the same information is PHI and also protected by another law, MLPA will apply the more protective legal requirement when required. When state laws, federal laws, professional rules, or platform rules provide greater privacy protections for certain information, such as mental health information, substance use disorder treatment records, HIV/AIDS or STI information, genetic information, reproductive health information, biometric information, minors’ information, or information relating to abuse or neglect, MLPA will follow those additional requirements to the extent applicable.

3. Consents, Authorizations, and Acknowledgments

This Notice does not replace separate consents, acknowledgments, authorizations, opt-ins, or user interface controls that may be required or recommended for MLPA’s layered consent architecture. Depending on the service or feature, MLPA may require or present separate consents or authorizations, including:

• account Terms and Conditions acceptance and Privacy Policy acknowledgment;

• membership subscription and automatic renewal authorization;

• telehealth informed consent, patient location confirmation, and financial responsibility notices;

• acknowledgment of receipt of this Notice or another applicable provider Notice of Privacy Practices;

• Mya first-use AI consent or consent for any successor, renamed, rebranded, modified, or replacement AI assistant;

• recording, transcription, or AI-supported documentation consent;

• genetic testing, DNA, blood, saliva, swab, biological specimen, biomarker, laboratory, or sample-processing consent;

• consumer health data collection consent, sharing consent, and any required signed authorization before any sale of consumer health data;

• HIPAA authorization for non-treatment, non-payment, or non-health-care-operations uses or disclosures;

• cookie, SDK, pixel, session replay, analytics, advertising, Global Privacy Control, and “Do Not Sell or Share” controls;

• wearables, Apple Health, Google Health Connect, or other health app integration consent;

• SMS/text marketing consent and communications preferences;

• conflict-of-interest or product recommendation acknowledgment when a protocol recommends MLPA-sold products or services;

• product-specific risk acknowledgments, prescription, pharmacy, compounded medication, peptide, supplement, device, test, regulated-product, adverse-event, recall, or product-safety consents or notices where required or appropriate; and

• third-party disclosure authorizations for disclosures to caregivers, family members, employers, sponsors, concierge representatives, or other recipients you designate.

Your agreement to MLPA’s Terms and Conditions is not a substitute for a HIPAA authorization when HIPAA requires an authorization. Likewise, acknowledgment of this Notice is not the same as authorization for uses or disclosures of PHI that require a separate written authorization.

4. What Is Protected Health Information

"Protected health information" or "PHI" means individually identifiable health information that is created, received, maintained, or transmitted by a HIPAA covered entity or its business associate and that relates to your past, present, or future physical or mental health or condition, the provision of health care to you, or payment for health care. PHI can include demographic information, contact information, medical history, symptoms, diagnoses, medications, treatment information, laboratory results, genetic or biomarker results when maintained in a clinical record, clinical notes, provider messages, telehealth recordings or transcripts if maintained for clinical purposes, billing information, clinically relevant adverse-event, product-safety, pharmacy, prescription, supplement, peptide, device, test, or recall information maintained in a clinical record, and other information that identifies you or could reasonably identify you.

Information is not PHI merely because it relates to health. For example, information you provide to MLPA to create a general membership account, browse the website, purchase non-prescription products, submit an e-commerce return or product inquiry outside a covered clinical workflow, interact with Mya outside a HIPAA-covered clinical workflow, receive marketing communications, or use general wellness tools may not be PHI unless it is created, received, maintained, or transmitted in connection with Covered MLPA Services. Different privacy laws and notices may apply to that information.

5. How We May Use and Disclose PHI for Treatment, Payment, and Health Care Operations

HIPAA permits us to use and disclose PHI for treatment, payment, and health care operations without your written authorization. We will use and disclose the minimum necessary information when HIPAA requires us to do so. The minimum necessary standard generally does not apply to disclosures to or requests by a health care provider for treatment purposes.

5.1 Treatment

We may use and disclose PHI to provide, coordinate, or manage your health care and related services. Examples include:

• sharing information with MLPA providers, participating providers, your primary care physician, specialists, laboratories, pharmacies, imaging centers, emergency providers, or other health care professionals involved in your care;

• reviewing intake forms, medical history, medications, allergies, symptoms, goals, laboratory results, genetic or biomarker results, wearable or remote-monitoring information, uploaded records, or prior clinical records to support a clinical consultation or care coordination;

• ordering, coordinating, receiving, or communicating laboratory testing, genetic testing, diagnostic testing, prescriptions, referrals, or follow-up recommendations when clinically appropriate and legally permitted;

• using secure telehealth, messaging, scheduling, documentation, clinical decision-support, AI-assisted transcription, AI-assisted summarization, or other technology tools to support provider review, documentation, safety, and care coordination, subject to applicable safeguards;

• communicating with you about clinical follow-up, abnormal or concerning results, appointment reminders, medication-related matters, supplement, peptide, product, device, laboratory, prescription, adverse-event, contraindication, interaction, safety, recall, or product-use instructions when clinically relevant, or health-related information connected to Covered MLPA Services;

• evaluating clinically relevant product, supplement, peptide, medication, compounded medication, device, test, or protocol issues, including allergies, contraindications, interactions, pregnancy or nursing status, dosage or administration information you provide, suspected adverse events, quality concerns, recall follow-up, and whether in-person care, emergency care, primary care, specialty care, pharmacy review, or laboratory follow-up is appropriate; and

• coordinating with a third-party laboratory, pharmacy, device platform, manufacturer, fulfillment partner, or provider to carry out a service, prescription, laboratory order, test kit, clinical recommendation, safety notice, adverse-event follow-up, recall, or related clinical workflow that you request or that a provider orders.

MLPA’s services are supplemental. You remain responsible for maintaining a relationship with your primary care physician and other appropriate treating providers, and for seeking emergency or in-person care when needed.

5.2 Payment

We may use and disclose PHI to bill for, obtain payment for, or facilitate payment for Covered MLPA Services. Examples include verifying eligibility, processing private-pay charges, preparing invoices or receipts, processing refunds, responding to payment disputes, coordinating with payment processors, communicating with a health plan if applicable, collecting amounts owed, and conducting utilization or medical-necessity review when applicable.

MLPA membership, wellness services, and many related products or services may be private-pay, non-insurance offerings. This Notice does not make MLPA a health insurer, health plan, Medicare/Medicaid provider, or substitute for health insurance. Where MLPA or participating providers do not bill insurance or federal/state health care programs, we may still use limited PHI to process private payment, document financial responsibility, and comply with law.

5.3 Health Care Operations

We may use and disclose PHI for health care operations. These are activities necessary to operate and support Covered MLPA Services. Examples include:

• quality assessment and improvement, patient-safety activities, outcomes review, protocol development, care coordination improvement, provider performance review, and follow-up workflow improvement;

• credentialing, licensing, training, peer review, professional supervision, compliance programs, audits, fraud, waste, and abuse prevention, and legal or risk-management activities;

• customer support and care navigation related to Covered MLPA Services, including secure messaging, appointment management, follow-up coordination, and technical support for clinical workflows;

• developing, maintaining, testing, securing, and improving electronic health records, telehealth platforms, patient portals, mobile app clinical features, cybersecurity tools, identity-verification tools, and other clinical technology systems;

• business planning, management, administration, accounting, insurance, professional liability coverage, legal services, regulatory compliance, and responding to complaints or regulatory inquiries;

• internal review of claims, protocols, educational materials, product recommendations, safety signals, adverse-event reports, product-quality issues, and conflict-of-interest controls to help ensure that health, longevity, anti-aging, DNA-based, supplement, peptide, product, device, test, or protocol-related statements are appropriately substantiated and not misleading;

• regulatory, legal, clinical, quality, safety, labeling, claims-substantiation, product-classification, prescription, pharmacy, laboratory, device, dietary-supplement, peptide, compounded-medication, adverse-event, recall, and product-safety review, including responding to audits, inspections, complaints, subpoenas, inquiries, and enforcement requests when permitted or required by law; and

• creating and using de-identified information, limited data sets, or aggregated data in accordance with HIPAA and applicable law for analytics, quality improvement, research, product development, benchmarking, AI evaluation, claims substantiation, safety review, product-quality review, and service improvement.

6. Telehealth, Electronic Health Records, Mya, AI-Supported Tools, and Recordings

MLPA may use secure electronic health records, patient portals, telehealth platforms, messaging tools, and other systems for Covered MLPA Services. Prescriptions, clinical encounters, and patient medical records are handled through HIPAA-covered clinical workflows operated by or on behalf of licensed providers, and information in those workflows is treated as PHI under HIPAA and the applicable provider Notice of Privacy Practices.

MLPA may use the AI assistant currently known as “Mya,” or any renamed, rebranded, modified, updated, successor, or replacement AI assistant, in different contexts. When Mya is used only as a general educational, directional, wellness-support, navigation, or non-clinical tool outside a HIPAA-covered clinical workflow, information submitted to Mya may not be PHI and may be governed by MLPA’s Privacy Policy, Consumer Health Data Privacy Policy, Terms and Conditions, and Mya first-use consent rather than this Notice. When an AI-supported tool is used within a Covered MLPA Service, related information may be PHI and will be handled under this Notice and applicable HIPAA safeguards.

MLPA does not intend Mya or any successor AI assistant to diagnose, treat, cure, mitigate, or prevent disease; provide emergency triage; replace your primary care physician; or make autonomous clinical decisions. Unless a separate notice and any required consent or authorization states otherwise, we do not use identifiable PHI to train external foundation models for general commercial purposes. AI-supported tools may assist with documentation, transcription, summarization, administrative support, safety review, quality improvement, or similar activities, but licensed providers remain responsible for their professional judgment and clinical communications.

Mya outputs are not intended to determine whether any product, peptide, supplement, medication, compounded medication, test, device, strip, film, protocol, or recommendation is legally available, clinically appropriate, FDA-approved, FDA-cleared, lawfully marketed as a dietary supplement, or appropriate for you. If Mya is used within a Covered MLPA Service, PHI may be used or disclosed as permitted by HIPAA for treatment, patient safety, documentation, quality review, claims review, compliance review, and health care operations. Outside a Covered MLPA Service, other MLPA privacy notices and consents apply.

With consent where required, telehealth visits, support calls, chats, Mya interactions, or app sessions may be recorded, transcribed, monitored, reviewed, or summarized for quality, training, safety, compliance, documentation, and dispute-resolution purposes. If a recording or transcript is created or maintained as part of a Covered MLPA Service, it may be PHI and will be handled under this Notice. If it is created outside a covered clinical workflow, other MLPA privacy notices and consents may apply.

7. Laboratory Testing, Genetic Information, DNA, Blood, Biological Samples, and Deletion or Destruction Requests

Covered MLPA Services may involve laboratory testing, biomarker review, genetic testing, DNA analysis, blood draws, saliva or swab collection, specimen collection, imaging, wearable data, device data, or other health-related measurements. When these activities are ordered, reviewed, or maintained by a covered provider or business associate for clinical purposes, related information may be PHI. When collected or used outside a Covered MLPA Service, the same or similar information may be non-HIPAA consumer health data, genetic data, biometric data, or personal information governed by MLPA’s Privacy Policy, Consumer Health Data Privacy Policy, California Privacy Supplement, genetic/biological sample consent, and other applicable laws.

MLPA may receive laboratory, genetic, biomarker, or other results from independent third-party laboratories or providers. MLPA generally does not physically retain your blood, saliva, swab, DNA, or other biological sample unless a specific workflow expressly states otherwise. Third-party laboratories, collection sites, imaging centers, device manufacturers, pharmacies, and health app platforms may maintain samples, results, or records under their own policies, notices, consents, legal duties, and retention requirements.

You may request deletion of genetic data or related information that MLPA maintains, and you may request destruction of your DNA, blood, saliva, swab, or other biological sample. MLPA will honor such requests to the extent required by applicable law and to the extent MLPA controls the relevant information or sample. If the physical sample is held by a third-party laboratory, MLPA will forward or help facilitate your destruction request to the applicable laboratory where reasonably able to do so. A deletion or destruction request may be denied or limited where retention is required or permitted by law, where the information is part of a medical record that must be retained, where the sample has already been de-identified, destroyed, consumed, or cannot reasonably be located, or where the request is subject to legal exceptions.

HIPAA generally gives you rights to access, amend, restrict, and receive an accounting of certain PHI disclosures; HIPAA does not always require deletion of medical records. Separate genetic privacy laws, biometric laws, consumer health data laws, contracts, laboratory rules, and consents may provide additional deletion or sample-destruction rights. Those rights are described in the applicable MLPA Privacy Policy, Consumer Health Data Privacy Policy, genetic/biological sample consent, or laboratory notice.

8. Product Recommendations, Protocols, Conflicts of Interest, and Marketing Limits

MLPA may provide or facilitate educational materials, longevity protocols, laboratory result summaries, product recommendations, supplement suggestions, medication reminders, treatment alternatives, or health-related benefits and services. If provided in a Covered MLPA Service, providers may use PHI for treatment and health care operations, including care coordination, medication or supplement safety review, product or protocol safety review, adverse-event follow-up, treatment alternatives, and health-related benefits and services permitted by HIPAA.

Some protocols, recommendations, or wellness plans may refer to MLPA-sold products, products sold by affiliates, prescription or pharmacy-dispensed products, compounded medications, laboratory tests, devices, supplements, peptides, strips, films, or services from vendors with which MLPA has a financial or business relationship. Where appropriate, MLPA may provide a separate conflict-of-interest acknowledgment or disclosure. MLPA will not use or disclose PHI for marketing that requires HIPAA authorization without obtaining that authorization, including paid or subsidized communications that are not excepted by HIPAA. MLPA will not sell PHI without written authorization where HIPAA requires authorization. Product recommendations should not be understood as guarantees of any health, longevity, anti-aging, life-extension, biomarker, disease-prevention, disease-treatment, cosmetic, product-safety, or regulatory outcome.

8.1 Product Regulatory, Peptide, Supplement, Drug, Device, Claims, Safety, and Adverse-Event Compliance

When a product, supplement, peptide, compounded medication, prescription drug, device, test, strip, film, protocol, or similar article is associated with a Covered MLPA Service, MLPA may use and disclose PHI as permitted by HIPAA and other applicable law for treatment, health care operations, public health, product safety, quality assurance, adverse-event intake and investigation, recall support, product-complaint handling, claims-substantiation review, regulatory classification review, eligibility screening, legal compliance, and communications with providers, pharmacies, laboratories, manufacturers, distributors, fulfillment partners, insurers, professional advisors, and regulators where permitted or required by law.

This Notice does not determine the legal status of any product and does not make any peptide, supplement, medication, compounded medication, drug, biologic, device, strip, film, test, or protocol lawfully available as a dietary supplement, over-the-counter product, prescription product, compounded product, medical device, or other regulated article. Product category and availability are governed by applicable food, drug, dietary supplement, device, pharmacy, telehealth, professional-practice, advertising, consumer-protection, and other laws; MLPA's Terms and Conditions; product-specific labels and notices; provider orders; pharmacy requirements; and any applicable consents or authorizations.

A dietary-supplement disclaimer, wellness label, research label, product-category label, Supplement Facts panel, or similar statement does not authorize MLPA to use or disclose PHI for marketing when HIPAA requires authorization, does not change whether information is PHI, and does not cure unlawful product classification, unapproved-drug status, misbranding, lack of substantiation, or a misleading advertising impression.

9. Business Associates and Other Service Providers

We may use vendors and service providers to support Covered MLPA Services. These may include telehealth platforms, cloud hosting providers, electronic health record vendors, secure messaging providers, scheduling tools, call-center vendors, payment processors, identity-verification vendors, cybersecurity providers, laboratories, pharmacies, transcription tools, AI-supported documentation tools, quality-assurance vendors, adverse-event intake vendors, product-safety and recall vendors, product-quality vendors, claims-substantiation and regulatory-review vendors, manufacturers, distributors, fulfillment partners, professional advisors, and other service providers. When these vendors create, receive, maintain, or transmit PHI for us and HIPAA requires it, we enter into written business associate agreements requiring them to safeguard PHI and use it only as permitted by law and contract.

MLPA does not intend to disclose PHI to advertising networks, lead-intelligence tools, session replay vendors, cross-context behavioral advertising vendors, data brokers, affiliates, influencers, or promotional partners for their own marketing or advertising purposes. Non-HIPAA website/app tracking technologies are addressed in MLPA's Privacy Policy, Cookie Preferences, Your Privacy Choices, Consumer Health Data Privacy Policy, and applicable consent mechanisms.

10. Other Uses and Disclosures We May Make Without Your Written Authorization

HIPAA and other laws permit or require us to use or disclose PHI without your written authorization in certain circumstances. State laws may be more restrictive, and we will comply with more restrictive requirements when they apply.

• Required by law. We may use or disclose PHI when federal, state, local, or other law requires us to do so.

• Public health and product-safety activities. We may disclose PHI to public health authorities, the U.S. Food and Drug Administration, persons subject to FDA jurisdiction, manufacturers, distributors, pharmacies, laboratories, or other authorized persons for disease reporting, injury reporting, vital statistics, communicable disease control, public health investigations, product quality, product safety or effectiveness, adverse event reporting, product complaints, tracking, recalls, repairs, replacements, post-marketing surveillance, and similar activities permitted by law.

• Abuse, neglect, or domestic violence. We may disclose PHI to appropriate authorities if we reasonably believe you are a victim of abuse, neglect, or domestic violence, as permitted or required by law.

• Health oversight activities. We may disclose PHI to government agencies and oversight bodies for audits, investigations, inspections, licensure, certification, disciplinary actions, civil rights enforcement, health care fraud and abuse oversight, medical board, pharmacy board, laboratory, professional-practice, and other activities necessary or authorized for oversight of the health care system, government benefit programs, regulated health care professionals, and entities subject to civil rights laws.

• Judicial and administrative proceedings. We may disclose PHI in response to a court or administrative order, subpoena, discovery request, civil investigative demand, regulator request, or other lawful process, subject to applicable safeguards and any reproductive-health attestation requirements that apply.

• Law enforcement. We may disclose PHI to law enforcement officials for purposes permitted by law, such as responding to a warrant, subpoena, court order, locating a suspect or missing person, reporting certain injuries or crimes, or responding to emergencies, subject to applicable safeguards and any reproductive-health attestation requirements that apply.

• Coroners, medical examiners, and funeral directors. We may disclose PHI to coroners, medical examiners, and funeral directors as necessary for them to perform their duties.

• Organ, eye, and tissue donation. We may disclose PHI to organizations involved in organ, eye, or tissue donation and transplantation.

• Research. We may use or disclose PHI for research if you authorize it, if an institutional review board or privacy board has approved a waiver of authorization, if the information is de-identified or included in a limited data set as permitted by law, or as otherwise allowed by HIPAA.

• Serious threat to health or safety. We may use or disclose PHI when necessary to prevent or lessen a serious and imminent threat to your health or safety or the health or safety of another person or the public.

• Specialized government functions. We may disclose PHI for certain military, veterans, national security, intelligence, protective services, medical suitability, correctional institution, or custodial situations permitted by law.

• Workers’ compensation. We may disclose PHI as authorized by and to the extent necessary to comply with workers’ compensation or similar programs.

• Inmates and persons in custody. If you are an inmate or under custody of law enforcement, we may disclose PHI to the correctional institution or law enforcement official as permitted by law.

• Secretary of Health and Human Services. We must disclose PHI to the U.S. Department of Health and Human Services when required to investigate or determine our compliance with HIPAA.

• Incidental disclosures. Limited incidental disclosures may occur as a byproduct of an otherwise permitted use or disclosure despite reasonable safeguards and minimum necessary efforts.

11. Reproductive Health Information and Other Sensitive Information

We will not use or disclose PHI for a purpose prohibited by HIPAA or other applicable law, including for a criminal, civil, or administrative investigation into, or proceeding against, any person for seeking, obtaining, providing, or facilitating reproductive health care that was lawful under the circumstances in which it was provided, or for identifying any person for such a purpose. For HIPAA purposes, reproductive health care is presumed lawful when it was provided in the state where it was provided and lawful there, when it was protected, required, or authorized by federal law, or when it was provided by a person other than MLPA and MLPA does not have actual knowledge or substantial factual information showing that the care was unlawful. Where required by HIPAA, we will obtain a signed attestation before using or disclosing PHI potentially related to reproductive health care for health oversight activities, judicial or administrative proceedings, law enforcement purposes, or coroner/medical examiner purposes, unless an exception applies.

Certain categories of PHI may receive additional protections under federal or state law, such as substance use disorder treatment records, mental health or psychotherapy information, HIV/AIDS or sexually transmitted infection information, genetic information, biometric information, reproductive or sexual health information, gender-affirming care information, records relating to minors, and information relating to abuse, neglect, or domestic violence. We will obtain consent, authorization, a court order, attestation, or other documentation when required by applicable law before using or disclosing such information.

If any record is subject to 42 C.F.R. Part 2 or another heightened-confidentiality law, MLPA or the participating provider will use or disclose that record only as permitted by the applicable law, consent, court order, or exception. This Notice does not replace any separate Part 2, mental health, genetic, biometric, reproductive-health, minor-consent, or state-law notice or consent that may be required.

We will not use or disclose genetic information for health plan underwriting purposes when prohibited by law. If MLPA offers or facilitates genetic testing or receives genetic information, additional notices, consents, or authorizations may be provided as required by law.

12. Uses and Disclosures That Require Your Written Authorization

We must obtain your written authorization before using or disclosing PHI for purposes not otherwise permitted or required by law. You may revoke an authorization in writing at any time, except to the extent we have already relied on it. A HIPAA authorization is separate from your acceptance of MLPA’s Terms and Conditions, Privacy Policy acknowledgment, cookie consent, Mya consent, or consumer health data consent, unless the authorization itself satisfies HIPAA’s requirements.

The following uses and disclosures generally require your written authorization:

• psychotherapy notes, if MLPA or a participating provider maintains psychotherapy notes as HIPAA defines that term, except for limited purposes permitted by law;

• marketing communications using PHI, including paid or subsidized communications about MLPA-sold, affiliate, third-party, peptide, supplement, drug, compounded medication, device, test, strip, film, protocol, or other products or services when HIPAA requires authorization, except for limited communications permitted by HIPAA, such as certain face-to-face communications, nominal promotional gifts, refill reminders, case management, care coordination, or information about treatment alternatives or health-related benefits and services;

• sale of PHI. MLPA will not sell your PHI without your written authorization when HIPAA requires authorization;

• uses or disclosures of PHI for targeted advertising, cross-context behavioral advertising, lead enrichment, data brokerage, affiliate or influencer marketing, audience building, retargeting, look-alike modeling, or similar marketing activities when HIPAA or applicable law requires authorization;

• uses or disclosures of identifiable PHI in testimonials, endorsements, influencer or affiliate content, public reviews, before-and-after materials, case studies, press, public relations, social media, or advertising unless the information is properly de-identified or you have provided a valid authorization where required;

• disclosure of detailed clinical information, laboratory results, genetic results, Mya clinical workflow content, or medical records to employers, sponsors, family offices, concierge representatives, caregivers, or other third parties unless permitted by law or authorized by you;

• uses or disclosures of certain sensitive information when a more protective federal or state law requires consent or authorization;

• non-treatment, non-payment, or non-health-care-operations uses of identifiable PHI for research, publication, case studies, testimonials, training datasets, external AI model development, product development, commercialization, claims substantiation, or advertising when authorization is required; and

• any other use or disclosure of PHI that is not described in this Notice and not otherwise permitted or required by law.

MLPA does not currently use PHI for fundraising. If MLPA ever uses PHI for fundraising communications, it will do so only as permitted by HIPAA and will provide a clear opportunity to opt out of future fundraising communications.

13. Uses and Disclosures Where You May Agree or Object

Unless you object, or unless we reasonably infer from the circumstances that you do not object, we may use or disclose limited PHI to a family member, close friend, caregiver, personal representative, or other person involved in your care or payment for your care. We will disclose only information directly relevant to that person’s involvement. If you are unavailable or unable to object, we may use our professional judgment to determine whether the disclosure is in your best interest.

We may disclose limited PHI to assist in disaster relief efforts or to notify, identify, or locate a family member, personal representative, or other person responsible for your care, as permitted by law. You may tell us at any time if you do not want us to share information with specific persons, subject to emergency, legal, or safety exceptions.

14. Your Rights Regarding PHI

You have the following rights with respect to PHI maintained by or for MLPA in a designated record set, subject to limitations and exceptions under HIPAA and other applicable law. To exercise these rights, contact the MLPA Privacy Officer using the contact information at the end of this Notice. We may require that certain requests be in writing and may verify your identity before acting on a request.

• Right to inspect and obtain a copy. You have the right to inspect and obtain a copy of PHI in your medical and billing records, except in limited circumstances. If we maintain the information electronically and you request an electronic copy, we will provide it in the electronic form and format you request if readily producible, or in another agreed-upon readable electronic format. We may charge a reasonable, cost-based fee where permitted by law.

• Right to direct a copy to a third party. You may request that we send a copy of certain PHI to another person or entity. Your request must be in writing, signed by you, and clearly identify the recipient and where to send the copy.

• Right to request amendment. If you believe PHI we maintain about you is incorrect or incomplete, you may request an amendment. We may deny the request in certain circumstances, such as if we did not create the information or believe it is accurate and complete. If we deny your request, you may submit a written statement of disagreement.

• Right to request restrictions. You may request restrictions on how we use or disclose PHI for treatment, payment, or health care operations, or to persons involved in your care. We are not required to agree to every requested restriction. If we agree, we will comply except in an emergency or as otherwise permitted by law.

• Right to restrict disclosure to a health plan for out-of-pocket services. If you pay out of pocket in full for a health care item or service, you may request that we not disclose PHI about that item or service to your health plan for payment or health care operations. We must agree to that request unless disclosure is required by law.

• Right to confidential communications. You may request that we communicate with you by alternative means or at an alternative location, such as through a different mailing address, email address, phone number, portal, or other method. We will accommodate reasonable requests.

• Right to an accounting of disclosures. You may request an accounting of certain disclosures of your PHI made during the six years before your request, or a shorter period if you specify. The accounting does not include certain disclosures, such as disclosures for treatment, payment, or health care operations, disclosures made to you, disclosures made with your authorization, or other disclosures excluded by law. If required by law for electronic health records, additional accounting rights may apply.

• Right to receive a paper copy of this Notice. You may request a paper copy of this Notice at any time, even if you previously agreed to receive it electronically.

• Right to be notified of a breach. You have the right to receive notice if we discover a breach of unsecured PHI that requires notification under HIPAA.

• Right to complain without retaliation. You may complain to MLPA or to the U.S. Department of Health and Human Services if you believe your privacy rights have been violated. We will not retaliate against you for filing a complaint.

• Right to revoke an authorization. If you sign a written authorization, you may revoke it in writing at any time, except to the extent we have already taken action in reliance on it.

• Right to choose a personal representative. You may designate a personal representative to exercise rights on your behalf if the person has legal authority under applicable law. We may require documentation of that authority.

• Sample, genetic data, product-safety, adverse-event, and consumer health data requests. You may have additional deletion, destruction, access, correction, withdrawal, appeal, or list-of-third-parties rights under genetic privacy laws, direct-to-consumer genetic testing privacy laws, biometric privacy laws, consumer health data laws, product-safety laws, laboratory-specific policies, or MLPA's other privacy notices. These rights may be broader than, separate from, or different than HIPAA rights. HIPAA generally does not require deletion of medical records or product-safety records that must be retained by law. Requests to delete DNA, genetic data, blood, saliva, swab, or other biological samples will be handled as described in this Notice and MLPA's genetic/biological sample consent and Consumer Health Data Privacy Policy.

15. Our Duties

We are required by law to maintain the privacy and security of PHI, provide this Notice of our legal duties and privacy practices, follow the terms of this Notice currently in effect, limit uses and disclosures of PHI as required by HIPAA and other applicable law, and notify affected individuals following a breach of unsecured PHI when HIPAA requires notification. We are also required to train workforce members, apply appropriate administrative, physical, and technical safeguards, and enter into business associate agreements when required by HIPAA. Your acceptance of MLPA's Terms and Conditions or Privacy Policy does not waive rights that cannot be waived under HIPAA or other applicable law.

We may change the terms of this Notice and make the revised Notice effective for all PHI we maintain, including PHI created or received before the change. If we make a material change, we will post the revised Notice on our website or otherwise make it available as required by law. You may request a current copy of this Notice at any time.

16. Breach Notification and Security

If we discover a breach of unsecured PHI that requires notification under HIPAA, we will notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of the breach, unless a shorter time period applies under state law or notification is delayed as permitted by law. The notice will include information required by law, which may include a brief description of what happened, the types of information involved, steps you should take to protect yourself, what we are doing to investigate and mitigate the breach, and how to contact us with questions.

No system can be guaranteed to be perfectly secure. We use administrative, technical, and physical safeguards designed to protect PHI, including access controls, encryption where appropriate, confidentiality requirements, secure systems, workforce training, vendor controls, audit logging, and incident-response procedures. You are responsible for maintaining the confidentiality of your account credentials, using secure devices and networks, and promptly notifying us if you believe your account or communications have been compromised.

17. Questions, Requests, and Complaints to MLPA

To ask questions about this Notice, exercise your HIPAA rights, request a copy of this Notice, request access or amendment, request confidential communications, submit a restriction request, revoke an authorization, submit a sample destruction request, or file a privacy complaint, contact:

HIPAA Privacy Officer: Massoudi Longevity Professionals of America, Inc.

Mailing Address: 23961 Calle De La Magdalena #405, Laguna Hills, CA 92653

Privacy Email: privacy@mlpa.health

Website: https://www.mlpa.health

Privacy Request Form (available after signing in): https://www.mlpa.health/dashboard/account/privacy-request

Support: support@mlpa.health

Telephone: (949) 588-5800

We will not retaliate against you for filing a complaint or exercising any privacy right.

18. Complaints to the U.S. Department of Health and Human Services

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, if you believe your HIPAA rights have been violated. You may contact the Office for Civil Rights at:

Mail: U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue, S.W., Washington, D.C. 20201

Telephone: 1-877-696-6775

Website: https://www.hhs.gov/ocr/privacy/hipaa/complaints/

MLPA will not retaliate against you for filing a complaint with MLPA or with the Office for Civil Rights.

19. Additional Notice for International Users and Non-HIPAA Privacy Rights

This Notice is a HIPAA Notice of Privacy Practices for Covered MLPA Services. It is not intended to replace MLPA's general Privacy Policy, Consumer Health Data Privacy Policy, California Privacy Supplement, EU/UK/Swiss privacy disclosures, cookie notice, Terms and Conditions, product-specific consents, or other consumer privacy notices. If MLPA processes personal information about individuals located outside the United States, or processes consumer health data, product-safety data, adverse-event or product-complaint data, e-commerce data, Mya data, or other health-related information that is not PHI, additional rights and disclosures may apply under other privacy, consumer health data, food/drug/device, pharmacy, advertising, product-safety, and consumer-protection laws. Please review MLPA's applicable privacy notices and product-specific terms for those rights and choices.

Appendix A — Covered MLPA Services and Participating Entities

This Appendix describes the categories of MLPA entities, participating providers, and service providers that may be involved in Covered MLPA Services. Independent third-party covered entities that have not formally adopted this Notice may provide their own Notices of Privacy Practices or privacy notices, and those notices may govern their own PHI practices.

Massoudi Longevity Professionals of America, Inc.

Role: Delaware corporation / MLPA platform and longevity company; covered entity only to the extent it provides HIPAA-covered clinical services or participates in a documented HIPAA covered entity, affiliated covered entity, organized health care arrangement, or business associate structure.

Covered Services / Scope: Platform support, supplemental telehealth facilitation, technology, care navigation, patient support, safety/compliance support, and administrative services to the extent performed within Covered MLPA Services. Non-HIPAA membership, e-commerce, AI, marketing, and wellness activities are governed by other MLPA privacy notices unless integrated into a HIPAA-covered clinical workflow.

MLPA-affiliated, participating, or contracted professional medical groups, physician entities, licensed physicians, and other licensed professionals that adopt this Notice or participate in a documented HIPAA structure with MLPA.

Role: Covered health care providers, professional entities, affiliated covered entity participants, organized health care arrangement participants, or independent providers, depending on the relationship and service.

Covered Services / Scope: Telehealth visits, provider messaging, clinical review, laboratory, genetic, diagnostic or imaging orders, prescriptions, referrals, product-safety follow-up, adverse-event review, and related clinical services within provider scope of practice and applicable law.

Independent laboratories, pharmacies, imaging centers, specimen collection sites, device platforms, manufacturers, distributors, fulfillment partners, and other ancillary providers or vendors involved in Covered MLPA Services.

Role: Independent covered entities, business associates, subcontractors, or service providers, depending on relationship and service. Their own notices, consents, and terms may also apply.

Covered Services / Scope: Laboratory testing, specimen handling, sample destruction, pharmacy fulfillment, imaging, device or wearable support, product fulfillment, product-quality review, adverse-event or product-complaint support, recall support, and other ancillary services.

Business associates and subcontractors supporting Covered MLPA Services.

Role: Vendors and service providers that create, receive, maintain, or transmit PHI for Covered MLPA Services when HIPAA requires a business associate agreement.

Covered Services / Scope: Technology, hosting, EHR, telehealth, secure messaging, identity verification, cybersecurity, transcription, AI-supported documentation, quality assurance, claims substantiation, product-safety support, regulatory review, professional advisory, and related support services.