Patient Disclosure

Effective Date: December 15, 2025 This Notice describes how your medical information may be used and disclosed and how you may access this information.

Our Commitment to Your Privacy

This Notice applies to all health information we create or receive about you. Zida Control Sock (“Zida,” “we,” or “our”) is required by law to maintain the privacy of your protected health information (PHI), provide you with this Notice, and follow the terms of this Notice.

Who Will Follow This Notice

This Notice applies to all Zida workforce members and agents, including Patient Advocates, billing staff, management, and business associates that create, receive, maintain, or transmit PHI on our behalf.

Redisclosure Notice

Information disclosed to another person or entity may no longer be protected by HIPAA and may be subject to redisclosure unless otherwise restricted by applicable federal or state law. Additional protections apply to certain records, including substance use disorder (SUD) records governed by 42 CFR Part 2.

How We May Use and Disclose Your Health Information

Treatment

We may use or disclose PHI to healthcare providers as necessary to dispense the Zida Control Sock and coordinate your care.

Payment

We may use or disclose PHI to verify insurance coverage, obtain prior authorization, submit claims, collect payment, or respond to audits, appeals, or utilization reviews.

Healthcare Operations

We may use PHI for our healthcare operations, including quality assessment, compliance activities, accreditation, training, device safety, and customer service.

Business Associates

We may share PHI with third parties that perform services on our behalf, such as billing platforms, shipping vendors, and compliance consultants. We require written agreements to ensure they protect your information as required by law.

Delivery and Follow-Up Communications

We may contact you regarding order processing, shipment status, required documentation, device education, or follow-up communications related to your use of the Zida Control Sock.

Individuals Involved in Your Care

We may disclose limited PHI to a family member, caregiver, or personal representative only when:

• You have provided explicit verbal or written consent; or
• The individual has valid legal authority to act on your behalf, such as a Power of Attorney, healthcare proxy, or legal guardianship; or
• You are unable to agree or object, and we determine the disclosure is in your best interest as permitted by HIPAA.

Disclosures Required by Law

We will disclose PHI when required by federal, state, or local law, including for public health activities, health oversight, law enforcement purposes, judicial or administrative proceedings, national security, coroners or medical examiners, organ donation, and workers’ compensation. Certain disclosures are further restricted by other applicable laws, including 42 CFR Part 2.

Additional State-Law Protections

Some states require specific authorization before certain sensitive health information, such as mental health information, substance use information, HIV/AIDS-related information, or genetic testing information, may be disclosed. When applicable, we comply with the most protective state or federal law.

Substance Use Disorder (SUD) Records Under 42 CFR Part 2

If we receive SUD treatment records from a federally assisted Part 2 program, we are prohibited from disclosing those records unless:

• You provide written consent;
• The disclosure is permitted by Part 2 for treatment, payment, or healthcare operations;
• A court issues an order after proper notice and opportunity to be heard; or
• Another specific Part 2 exception applies. These records may not be used to investigate or prosecute you without your consent or a qualifying court order.

Your Rights Regarding Your Health Information

Right to Receive This Notice

You have the right to receive a paper or electronic copy of this Notice at any time.

Right to Confidential Communications

You may request that we communicate with you in a specific way or at a specific location. Requests must be made in writing and will be accommodated when reasonable.

Right to Request Restrictions

You may request limits on how we use or disclose your PHI. We are not required to agree to most requests. However, if you pay in full out-of-pocket for an item or service, you may request that we not disclose information about that item or service to your health plan.

Right to Inspect and Obtain Copies

You may request access to or copies of your medical or billing records that we maintain. Requests must be made in writing and may be subject to fees as permitted by law.

Right to Request Amendment

You may request that we amend PHI you believe is incorrect or incomplete. We may deny the request under certain circumstances but will provide a written explanation.

Right to an Accounting of Disclosures

You may request a list of certain disclosures of your PHI made during the six years prior to your request, excluding disclosures for treatment, payment, and healthcare operations.

Right to Breach Notification

You have the right to be notified if unsecured PHI about you is breached, as required by law.

Uses and Disclosures That Require Your Authorization

We must obtain your written authorization before using or disclosing PHI for marketing purposes, the sale of PHI, or any other use not described in this Notice. You may revoke an authorization at any time in writing, except to the extent we have already relied on it.

Changes to This Notice

We may change this Notice at any time. Any changes will apply to all PHI we maintain, and updated versions will be available upon request.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with Zida or with the U.S. Department of Health and Human Services, Office for Civil Rights. You will not be retaliated against for filing a complaint.

Contact Information

For questions or concerns regarding this Notice or your privacy rights: Zida, LLC Phone: 877-203-1580