Your health information, protected.

Effective date: July 11, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Who this notice covers

This notice applies to everydaymd, a physician-led telehealth practice based in Pittsburgh, Pennsylvania, and to the clinicians and staff who provide or support your care through it. It covers the health information we create or receive about you: your visit notes, messages with your care team, and the details you share when you book. In this notice we call that "health information."

This notice is about your medical privacy under HIPAA. For how our website itself handles data (cookies, analytics, the vendors behind the booking form), see our Privacy Policy. For what you're agreeing to when you receive care by video, see our Telehealth Consent.

Our duties to you

The law requires us to:

• Keep your health information private and secure.
• Give you this notice of our legal duties and privacy practices, and follow the version currently in effect.
• Notify you promptly if a breach occurs that may have compromised the privacy or security of your unsecured health information.
• Not use or disclose your information other than as described here, unless you give us written permission, which you may revoke at any time, in writing, for anything we haven't already done in reliance on it.

How we may use and disclose your health information

Without needing your separate authorization, we may use and disclose your health information for three everyday purposes. Here is what each one actually looks like in practice.

Treatment

We use your information to care for you. For example: your physician reviews your history before your video visit, documents what you discuss so your care has continuity, and coordinates with another clinician involved in your care where that's relevant to treating you.

Payment

We use your information to bill and collect payment for your care, for example by processing your $149 visit fee or your monthly membership charge. Because everydaymd is cash-pay, we do not bill insurance companies, so your information is not routinely sent to health plans at all.

Health care operations

We use your information to run a good practice, such as reviewing visits for quality, training staff, and improving how we schedule and follow up. We use only the minimum information necessary for the job at hand.

Uses that require your written authorization

Some things we will not do without your explicit written permission:

• Marketing. We will not use your health information for marketing purposes without your written authorization.
• Sale of your information. We will not sell your health information without your written authorization. To be plain about it, we don't sell it, period. That is not our business model.
• Most other uses not described in this notice. Anything beyond what this notice covers requires your written authorization, which you can revoke at any time.

Other disclosures the law permits or requires

There are situations where the law allows or requires us to share health information without your authorization. These are uncommon, but you should know about them:

• When required by law. For example, in response to a court order or a lawful government request.
• Public health and safety. Reporting to public health authorities as required (for instance, disease reporting or reports of suspected abuse or neglect), and helping with product recalls or adverse-reaction reporting.
• To prevent a serious threat. If we believe in good faith that disclosure is necessary to prevent a serious and imminent threat to your health or safety, or someone else's.
• Health oversight, legal proceedings, and law enforcement. Audits and investigations by health oversight agencies, lawful subpoenas and discovery requests, and limited law-enforcement purposes as the law defines them.
• Business associates. Companies that perform services for us (for example, the HIPAA-oriented telemedicine platform that hosts your video visits) may handle your information, but only under written agreements that require them to safeguard it the way we must. Our Privacy Policy names the vendors we use.
• People involved in your care. With your agreement, or when you're unable to agree and it's in your best interest, we may share relevant information with a family member or friend involved in your care.
• Other narrow circumstances defined by law, such as workers' compensation, coroners and medical examiners, and certain specialized government functions.

Your rights over your health information

You have real, enforceable rights here. You can:

• Inspect and get a copy of your records. Ask us and we'll provide a copy (electronic or paper, your choice), usually within 30 days. We may charge a reasonable, cost-based fee for copies, and we'll tell you the cost before we proceed.
• Ask us to amend your records. If you believe something in your record is wrong or incomplete, ask us in writing to correct it, with your reason. We may deny the request in limited cases (for example, if we didn't create the record), but you can file a statement of disagreement that becomes part of your record.
• Get an accounting of disclosures. You can request a list of certain disclosures we've made of your health information in the prior six years (this doesn't include disclosures for treatment, payment, or operations, or ones you authorized). One accounting per 12 months is free.
• Request restrictions. You can ask us to limit how we use or share your information. We aren't required to agree to every request, but we'll consider it seriously and tell you our answer. One restriction we must honor: if you pay for a service in full out of pocket, you can require that we not disclose it to a health plan. Since everydaymd is cash-pay and never bills insurance, that protection is effectively how we operate by default.
• Request confidential communications. Tell us how and where you'd like to be contacted (only by email, say, or only at a certain phone number) and we'll accommodate any reasonable request. You don't have to give a reason.
• Get a paper copy of this notice. Even though it lives on our website, you can request a paper copy at any time and we'll mail you one.
• Be notified of a breach. If your unsecured health information is compromised, we're required to tell you. And we will.

If you have given someone medical power of attorney, or someone is your legal guardian, that person can exercise these rights on your behalf once we've confirmed their authority.

How to exercise your rights

No forms to hunt down, no runaround. Email support@everydaymd.health or call (412) 407-3389 and tell us what you need. For some requests, like amendments, we'll ask you to put it in writing so there's a clear record; email counts. You can also reach us through our contact page.

Our Privacy Officer, [PRIVACY OFFICER NAME], is responsible for making sure this notice is followed and is available at the contacts above.

Complaints

If you believe your privacy rights have been violated, you can complain to us: contact our Privacy Officer at support@everydaymd.health or (412) 407-3389. We take these seriously and will respond.

You can also complain directly to the U.S. Department of Health and Human Services, Office for Civil Rights: 200 Independence Avenue S.W., Washington, D.C. 20201; 1-877-696-6775; or online at www.hhs.gov/ocr/privacy/hipaa/complaints. You do not need to complain to us first.

We will never retaliate against you for filing a complaint. Not in your care, not in your pricing, not in any way. That's the law, and it's also just how we'd want to be treated.

Changes to this notice

We may update this notice from time to time, and any changes will apply to the health information we already hold as well as information we receive going forward. The current version, with its effective date, will always be posted on this page, and you can request a copy at any time.