Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices ("Notice") is provided to you by PureRx Biotech INC, d/b/a WePeptideRx ("we," "us," or "our"), a covered entity under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), as amended by the Health Information Technology for Economic and Clinical Health ("HITECH") Act. This Notice describes how we may use and disclose your protected health information ("PHI") and your rights regarding that information.

Covered Entity: PureRx Biotech INC, d/b/a WePeptideRx

Address: 5550 Glades Road, Suite 500 #1128, Boca Raton, FL 33431

Phone: (561) 678-5208

Privacy Officer: privacy@wepeptiderx.com | (561) 678-5208

We are required by law to maintain the privacy and security of your protected health information (PHI). We must provide you with this Notice of our legal duties and privacy practices with respect to your PHI, and we must abide by the terms of the Notice currently in effect.

We are required to notify you following a breach of unsecured protected health information. A breach is the acquisition, access, use, or disclosure of PHI in a manner not permitted under HIPAA that compromises the security or privacy of the information.

We will not use or disclose your PHI without your written authorization, except as described in this Notice. If you provide us with an authorization, you may revoke that authorization in writing at any time. Your revocation will not affect any use or disclosure already made in reliance on your prior authorization.

When using or disclosing your PHI, or when requesting PHI from another covered entity or business associate, we will make reasonable efforts to limit the use, disclosure, or request to the minimum amount of information necessary to accomplish the intended purpose. This minimum necessary standard does not apply to disclosures made for treatment purposes, disclosures made to you or pursuant to your authorization, disclosures made to the U.S. Department of Health and Human Services, or disclosures required by law.

Under federal law, you have certain rights regarding the PHI that we maintain about you. You may exercise any of the following rights by submitting a written request to our Privacy Officer at privacy@wepeptiderx.com or by calling (561) 678-5208.

• Right to Inspect and Copy: You have the right to inspect and obtain a copy of your PHI contained in a designated record set for as long as we maintain the record. We may charge a reasonable, cost-based fee for copies. We may deny your request in certain limited circumstances; if we do, you may request a review of the denial.
• Right to Amend: You have the right to request that we amend your PHI if you believe it is incorrect or incomplete. We may deny your request if we did not create the information, if the information is not part of a designated record set, or if we determine the information is accurate and complete.
• Right to an Accounting of Disclosures: You have the right to request a list of certain disclosures we have made of your PHI. The first accounting in any 12-month period is free; subsequent requests may be subject to a reasonable fee.
• Right to Request Restrictions: You have the right to request a restriction on the uses and disclosures of your PHI for treatment, payment, or healthcare operations. We are not required to agree to your request, except that we must agree to restrict disclosures to a health plan for payment or healthcare operations purposes if you have paid for the service or item in full out of pocket.
• Right to Request Confidential Communications: You have the right to request that we communicate with you about your health information by alternative means or at alternative locations. We will accommodate reasonable requests.
• Right to Receive a Paper Copy: You have the right to obtain a paper copy of this Notice upon request, even if you have previously agreed to receive the Notice electronically.
• Right to Be Notified of a Breach: You have the right to be notified in the event that we discover a breach of your unsecured PHI.

Except as outlined in this Notice, we will not use or disclose your PHI for any purpose without your written authorization. Uses and disclosures not described in this Notice will be made only with your written authorization.

You may revoke any authorization you have given us at any time by submitting a written revocation to our Privacy Officer. Your revocation will be effective upon receipt, except to the extent that we have already taken action in reliance upon the authorization.

Certain uses and disclosures that require your written authorization include:

• Most uses and disclosures of psychotherapy notes (where applicable)
• Uses and disclosures of PHI for marketing purposes
• Disclosures that constitute a sale of PHI under the HITECH Act
• Any other uses and disclosures not described in this Notice

We may use and disclose your PHI without your authorization for the following purposes:

• Treatment: We may use and disclose your PHI to provide, coordinate, or manage your healthcare and related services. This includes sharing information with prescribing physicians, compounding pharmacies, laboratory services, and other healthcare providers involved in your care. For example, we may share your health information with a pharmacy that fills your prescription or with a telemedicine provider who evaluates your treatment plan.
• Payment: We may use and disclose your PHI to bill and collect payment for the services and items we provide to you. This may include contacting your health insurer (if applicable) to confirm coverage, submitting claims, and collecting amounts owed.
• Healthcare Operations: We may use and disclose your PHI for our internal operations, including quality assessment and improvement activities, reviewing the competence or qualifications of healthcare professionals, conducting training programs, accreditation activities, compliance programs, and business planning.

We may use or disclose your PHI without your authorization in the following circumstances, as permitted or required by law:

• As Required by Law: We will disclose your PHI when required to do so by applicable federal, state, or local law.
• Public Health Activities: We may disclose your PHI to a public health authority authorized to collect or receive the data for the purpose of preventing or controlling disease, injury, or disability; to report adverse events, product defects, or to enable product recalls.
• Health Oversight Activities: We may disclose your PHI to a health oversight agency for activities authorized by law including audits, investigations, inspections, and licensure.
• Judicial and Administrative Proceedings: We may disclose your PHI in response to a court order or an administrative tribunal order, or in response to a subpoena, discovery request, or other lawful process.
• Law Enforcement: We may disclose your PHI to law enforcement officials for law enforcement purposes as required by law or in compliance with a court order, warrant, subpoena, or administrative request.
• Coroners, Medical Examiners, and Funeral Directors: We may disclose your PHI to a coroner, medical examiner, or funeral director as necessary to carry out their duties.
• Serious Threats to Health or Safety: We may use and disclose your PHI when necessary to prevent or lessen a serious and imminent threat to a person's or the public's health or safety.
• Workers' Compensation: We may disclose your PHI as authorized by and to the extent necessary to comply with workers' compensation laws or similar programs.
• National Security and Protective Services: We may disclose your PHI to authorized federal officials for national security and intelligence activities or for the protection of the President or other authorized persons.
• Inmates and Law Enforcement Custody: If you are an inmate or in the custody of law enforcement, we may disclose your PHI to the correctional institution or law enforcement official as permitted by law.
• Business Associates: We may disclose your PHI to our business associates who perform functions on our behalf or provide services to us, provided they agree in writing to safeguard your PHI in accordance with HIPAA.

If you believe your privacy rights have been violated, you have the right to file a complaint. You will not be retaliated against or penalized in any way for filing a complaint.

File a Complaint with WePeptideRx

Contact our Privacy Officer:

• Email: privacy@wepeptiderx.com
• Phone: (561) 678-5208
• Mail: Privacy Officer, PureRx Biotech INC, d/b/a WePeptideRx, 5550 Glades Road, Suite 500 #1128, Boca Raton, FL 33431

File a Complaint with the U.S. Department of Health and Human Services

You also have the right to file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights ("HHS OCR"):

• Address: U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue, S.W., Washington, D.C. 20201
• Phone: (877) 696-6775
• Online: https://www.hhs.gov/hipaa/filing-a-complaint/

You will not be retaliated against for filing a complaint.

We reserve the right to change the terms of this Notice and to make the revised Notice effective for all PHI we already have about you as well as any PHI we receive in the future. We will post a copy of the current Notice on our website at www.wepeptiderx.com/hipaa-notice. The Notice will contain the effective date on the first page. You may also request a copy of the current Notice at any time by contacting our Privacy Officer.

If you have any questions about this Notice or wish to exercise any of your rights described herein, please contact:

Privacy Officer
PureRx Biotech INC, d/b/a WePeptideRx
5550 Glades Road, Suite 500 #1128
Boca Raton, FL 33431

Phone: (561) 678-5208
Email: privacy@wepeptiderx.com

We will respond to your request within 30 days. If we need additional time, we will notify you in writing within the initial 30-day period and may extend the response period by up to 30 additional days.