Notice of Privacy Practices

Effective Date:: September 10, 2026
Last Updated:: September 10, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

1. Who gives this notice

This notice is given by each employer-sponsored group health plan that Rivendell administers (each, the "Plan"). Your employer sponsors your Plan. Your Plan's name appears in your enrollment materials and in your Rivendell account.

The Plan is the HIPAA covered entity for your protected health information ("PHI"). PHI is information that identifies you and relates to your health, the care you receive, or payment for that care. Elrond Health Inc., doing business as Rivendell ("Rivendell"), administers the Plan as its business associate under a written agreement. In this notice, "we" and "us" mean the Plan and Rivendell acting for the Plan.

This notice does not cover information Rivendell collects outside its work for the Plan. Rivendell's Privacy Policy covers that information.

2. Our duties

The law requires the Plan to:

maintain the privacy and security of your PHI
give you this notice of its legal duties and privacy practices
notify you after a breach that compromises the privacy or security of your unsecured PHI
follow the terms of the notice currently in effect

3. How we use and disclose your PHI

Payment

We use and disclose PHI to pay for your care and run your coverage. For example, we review a claim or receipt, decide what the Plan covers, track your deductible, and pay a provider or reimburse you.

Health care operations

We use and disclose PHI to run the Plan. For example, we review claims for accuracy and fraud, work with stop-loss insurers, arrange legal and audit services, and support members. The Plan does not use or disclose genetic information for underwriting.

Treatment

We may disclose PHI to help a provider treat you. For example, when you ask us to find or book care, we share what the provider needs to schedule it.

Business associates

We share PHI with companies that perform services for the Plan, such as claims processing, document processing, hosting, payments, and messaging. Each company signs an agreement to protect your PHI and to use it only for the services it performs for the Plan.

The Plan may disclose PHI to your employer, as plan sponsor, only as the Plan documents allow and only for plan administration. Before it receives PHI, your employer must certify that it will protect the information and will not use it for employment decisions or for other benefit plans. The Plan may also give your employer information about whether you are enrolled, and summary information that does not identify you, to obtain premium bids or to change the Plan.

People involved in your care or payment

We may share PHI with a family member, friend, or other person you identify who is involved in your care or in paying for it, unless you object. If you cannot agree or object, for example in an emergency, we use professional judgment about what is in your best interest.

Other uses and disclosures the law permits or requires

We may use or disclose PHI without your authorization:

when federal, state, or local law requires it
for public health activities, such as preventing disease or reporting problems with medications or medical devices
to report abuse, neglect, or domestic violence to an authorized agency
for health oversight activities, such as audits, investigations, inspections, and licensure
in response to a court or administrative order, or to a subpoena or other lawful process that meets legal requirements
to law enforcement officials for purposes the law allows
to coroners, medical examiners, and funeral directors
to organizations that handle organ, eye, or tissue donation
for research that meets legal privacy protections
to prevent a serious threat to the health or safety of a person or the public
for specialized government functions, such as military, veterans, national security, and protective services
for workers' compensation or similar programs
to the U.S. Department of Health and Human Services when it reviews our compliance

When a state or federal law gives certain information more protection than HIPAA, such as some mental health, HIV, or genetic testing information, we follow the more protective law.

Substance use disorder treatment records

Federal law at 42 CFR part 2 protects certain records of substance use disorder treatment. If the Plan receives or keeps these records, it will not use or disclose them, or testimony about their contents, in civil, criminal, administrative, or legislative proceedings against you unless you give written consent, or a court orders it after notice and an opportunity to be heard.

Uses that require your written authorization

We need your written authorization to:

use or disclose psychotherapy notes, except where the law allows
use or disclose PHI for marketing
sell PHI

We will make any other use or disclosure not described in this notice only with your written authorization. You may revoke an authorization in writing at any time, except to the extent we have already acted on it.

4. Your rights

Get a copy of your records

You can ask to see or get a copy of your enrollment, claims, and other records the Plan keeps about you, in paper or electronic form. We will respond within 30 days. We may charge a reasonable, cost-based fee.

Ask us to correct your records

You can ask us to correct records you believe are wrong or incomplete. We may say no, and if we do, we will explain why in writing within 60 days.

Request confidential communications

You can ask us to contact you in a specific way or at a different address, such as a personal email or mailing address. We will agree to reasonable requests, and we must agree if you tell us that you would be in danger otherwise.

You can ask us not to use or share certain PHI for treatment, payment, or health care operations. We are not required to agree, and we may say no if the limit would affect your coverage.

Get a list of disclosures

You can ask for a list, called an accounting, of the times we disclosed your PHI in the six years before your request, who received it, and why. The list will not include disclosures for treatment, payment, or health care operations, disclosures you authorized, and certain other disclosures. We provide one list free every 12 months and may charge a reasonable, cost-based fee for another within 12 months.

Get a paper copy of this notice

You can ask for a paper copy of this notice at any time, even if you agreed to receive it electronically.

Choose someone to act for you

If you have given someone medical power of attorney, or someone is your legal guardian, that person can exercise your rights. We confirm the person has authority before we act.

File a complaint

If you believe your privacy rights have been violated, you can file a complaint with the Plan using the contact information below. You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by writing to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/ocr/complaints. We will not retaliate against you for filing a complaint.

5. Contact

For questions about this notice, to exercise a right, or to file a complaint, contact:

Privacy Official, Rivendell, on behalf of the Plan
Email: privacy@rivendell.health
Phone: (646) 600-8840
Mail: 156 2nd St, Unit 310, San Francisco, CA 94105

6. Changes to this notice

We can change the terms of this notice, and the change will apply to all PHI we keep about you. If we make a material change, we will post the revised notice at rivendell.health/hipaa-notice and in your Rivendell account by the date the change takes effect. We will also send you information about the change, and how to get the revised notice, in the Plan's next annual communication to members.

At least once every three years, we will remind you that this notice is available and how to get it.

7. Electronic delivery

We provide this notice in your Rivendell account and by email if you have agreed to receive notices electronically. If an email to you fails, we will send you a paper copy. You can ask for a paper copy at any time.