Notice of Privacy Practices

For Protected Health Information

Effective Date: August 18, 2026

1. Who This Notice Applies To

This Notice of Privacy Practices explains how protected health information (“PHI”) may be handled in connection with healthcare services made available through the Nova GLP-1 program.

Nova GLP-1 is not itself the treating healthcare provider and does not independently diagnose conditions, prescribe medications, or make medical treatment decisions. Medical care is provided by an independent licensed healthcare provider or professional medical practice.

The healthcare provider responsible for your care may maintain its own Notice of Privacy Practices and may have separate obligations under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and applicable state law.

Where Nova GLP-1 receives or handles PHI on behalf of a HIPAA-covered healthcare provider, Nova GLP-1 will handle that information in accordance with applicable law and its contractual obligations to the healthcare provider.

2. Our Commitment to Protecting Your Health Information

Healthcare providers are required by law to protect the privacy of PHI, provide individuals with information about their privacy practices, and notify affected individuals when a breach of unsecured PHI occurs when notification is required by law.

PHI generally includes individually identifiable information relating to your health, healthcare services, or payment for healthcare services.

We take reasonable measures to protect information entrusted to us and limit the use and disclosure of PHI to what is permitted or required by applicable law.

3. How Your PHI May Be Used or Disclosed

HIPAA permits certain uses and disclosures of PHI without obtaining a separate written authorization from you.

Treatment

PHI may be used or disclosed when necessary for the provision, coordination, or management of your healthcare. For example, information may be shared with healthcare professionals involved in evaluating or treating you so that they can make informed clinical decisions.

Payment

PHI may be used or disclosed as necessary to obtain payment for healthcare services or to conduct related billing activities.

Healthcare Operations

PHI may be used for activities necessary to operate a healthcare practice and maintain the quality and safety of healthcare services. Examples may include quality assessment, compliance activities, reviewing healthcare professionals’ performance, resolving complaints, and administrative functions.

Other Permitted Uses and Disclosures

Depending on the circumstances and applicable law, PHI may also be disclosed for purposes such as:

• activities required for public health;
• reporting suspected abuse, neglect, or domestic violence when legally required or permitted;
• certain healthcare oversight activities;
• judicial or administrative proceedings;
• law enforcement purposes when permitted by law;
• medical examiner or coroner functions;
• workers’ compensation matters;
• certain research activities;
• preventing or reducing a serious threat to an individual’s or the public’s health or safety; and
• other purposes expressly permitted under HIPAA or applicable law.

4. Disclosures to People Involved in Your Care

When permitted by law, PHI may be shared with a family member, close personal friend, or another individual whom you identify as being involved in your healthcare or payment for your healthcare.

The healthcare provider may also use professional judgment to disclose limited information when doing so is appropriate and in your best interests.

You may ask the provider to limit or stop certain disclosures where applicable.

5. Uses and Disclosures Requiring Your Authorization

Some uses and disclosures of PHI require your written authorization. For example, an authorization may generally be required for:

• certain uses of PHI for marketing;
• the sale of PHI; and
• other uses or disclosures that HIPAA specifically requires to be authorized.

If your written authorization is required, you may generally revoke that authorization in writing at any time. A revocation will not affect actions already taken in reliance upon the authorization before it was revoked.

Certain types of highly sensitive information may also be subject to additional federal or state protections.

6. Special Protection for Certain Health Information

Certain categories of health information may receive additional protection under federal or state law.

Depending on the circumstances, this may include information concerning mental health services, substance use disorder treatment records, HIV/AIDS, sexually transmitted diseases, genetic information, reproductive healthcare, abuse or assault, and other specially protected records.

Where a more protective federal or state requirement applies, the applicable healthcare provider will follow that requirement.

Federal requirements concerning substance use disorder records under 42 CFR Part 2 were updated in 2024, and covered entities subject to those requirements were required to incorporate applicable changes into their privacy notices beginning February 16, 2026.

7. Your Rights Concerning PHI

Depending on the circumstances and applicable law, you have rights concerning your PHI, including the following:

Access to Your Records

You may request to inspect or obtain a copy of PHI maintained about you, subject to applicable legal limitations.

Request for Correction

If you believe information maintained about you is incorrect or incomplete, you may request that it be amended.

Confidential Communications

You may ask that communications concerning your healthcare or PHI be sent to you by a particular method or at an alternative location when permitted by law.

Request for Restrictions

You may ask for restrictions on certain uses or disclosures of your PHI. We are not required to agree to every requested restriction. In certain circumstances, however, HIPAA requires a healthcare provider to agree to a restriction concerning disclosure to a health plan when the applicable statutory requirements are satisfied.

Accounting of Certain Disclosures

You may request an accounting of certain disclosures of your PHI made during the applicable period, generally covering the six years preceding the request, subject to HIPAA’s exceptions and limitations.

Electronic or Paper Copy

You may request a paper copy of this Notice even if you previously agreed to receive it electronically.

8. Our Responsibilities

Where Nova GLP-1 or an affiliated service is acting on behalf of a HIPAA-covered healthcare provider, we are required to comply with applicable HIPAA requirements governing the use and disclosure of PHI.

The applicable covered healthcare provider is required to:

• maintain the privacy of PHI;
• provide individuals with this Notice describing its privacy practices;
• comply with the terms of the Notice currently in effect;
• provide individuals with certain rights regarding their PHI; and
• notify affected individuals of certain breaches of unsecured PHI when notification is required by law.

We reserve the right to revise privacy practices and this Notice when permitted or required by law.

9. Changes to This Notice

We may revise this Notice from time to time.

If a material change is made to the privacy practices described in the Notice, the revised Notice will be made available as required by HIPAA and applicable law.

The current version will be made available through the applicable website and may also be obtained in paper form upon request.

10. Questions and Privacy Complaints

If you have questions about how your PHI is handled, you may contact the applicable healthcare provider or Nova GLP-1 using the information below.

11. Effective Date

Effective Date: August 18, 2026