Notice of Privacy Practices

Effective Date: August 1, 2026

Our Commitment to Your Privacy

Goodness Health Group ("GHG," "we," "us," or "our") is required by law to maintain the privacy of your health information, provide you with this notice describing our legal duties and privacy practices, and follow the terms of the notice currently in effect.

We understand that your health information is personal, and we are committed to protecting it.

How We May Use and Share Your Health Information

The following categories describe the ways we may use and share your health information. Not every use or disclosure in a category is listed, but all the ways we are permitted to use and share information fall within at least one of these categories.

For Treatment. We may use and share your health information to provide, coordinate, or manage your care. For example, your nurse practitioner may share information about your condition with another provider involved in your care, or use your visit history to guide your ongoing treatment plan.

For Payment. We may use and share your health information to bill and collect payment for the services we provide, including submitting claims to Medicaid (Health First Colorado) or other health plans.

For Health Care Operations. We may use and share your health information to run our practice, improve care quality, train staff, and conduct internal audits and compliance reviews. For example, we may review a sample of patient charts to confirm our documentation meets applicable standards.

As Required by Law. We will share health information about you when required to do so by federal, state, or local law.

Public Health Activities. We may share health information for public health purposes, such as reporting to public health authorities to prevent or control disease, injury, or disability. Such reporting is sometimes required by law.

Health Oversight Activities. We may share information with health oversight agencies for activities authorized by law, such as audits, investigations, and inspections related to oversight of the health care system, government benefit programs (including Medicaid), and compliance with regulatory programs.

Judicial and Administrative Proceedings. We may share health information in response to a court or administrative order, or in response to a subpoena, if the legal requirements for doing so are met.

Law Enforcement. We may share health information for law enforcement purposes as required by law, such as in response to a court order, subpoena, or similar legal process.

To Avert a Serious Threat to Health or Safety. We may share health information about you when necessary to prevent a serious threat to your health and safety or the health and safety of the public.

With Our Business Associates. We may share your health information with third-party vendors ("business associates") who perform services on our behalf, such as our telehealth platform and billing services. We may also share similar information within clinical referrals. These vendors are contractually required to protect your information under a written agreement.

Emergency Situations. If you are experiencing a medical emergency, we may share information about you as necessary to enable emergency responders or emergency care providers to treat you.

Uses and Disclosures Requiring Your Written Authorization

For any purpose not described above — including most uses of psychotherapy notes, uses for marketing purposes, or the sale of your health information — we will ask for your written authorization. If you provide authorization, you may revoke it in writing at any time, except to the extent we have already relied on it.

Your Rights Regarding Your Health Information

You have the right to:

• Get a copy of this notice. You may ask us for a paper copy of this notice at any time, even if you have agreed to receive it electronically.
• Inspect and receive a copy of your health information. You may ask to see or receive a copy of your health information. We will provide a copy or a summary, usually within 30 days of your request. We may charge a reasonable, cost-based fee.
• Request corrections. You may ask us to correct health information you believe is incorrect or incomplete. We may deny your request in certain circumstances, and we will explain our reasoning in writing.
• Request an accounting of disclosures. You may ask for a list of certain disclosures we have made of your health information.
• Request restrictions. You may ask us not to use or share certain health information for treatment, payment, or operations purposes. We are not required to agree, except in limited circumstances required by law.
• Request confidential communications. You may ask us to contact you in a specific way (for example, a personal cell phone rather than a home phone) or at a different location, and we will accommodate reasonable requests.
• Choose someone to act for you. If you have given someone medical power of attorney, or if someone is your legal guardian, that person may exercise your rights and make choices about your health information.
• File a complaint. If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services. You will not be retaliated against for filing a complaint.

Our Responsibilities

We are required by law to:

• Maintain the privacy and security of your protected health information.
• Notify you promptly if a breach occurs that may have compromised the privacy or security of your information.
• Follow the duties and privacy practices described in this notice and give you a copy of it.
• Not use or share your information other than as described here, unless you give us written permission. If you tell us we can, you may change your mind at any time by letting us know in writing.