TOWARD HEALTH

Privacy & Terms

Effective Date: March 1, 2026

This Privacy & Terms notice applies to the website located at toward.health (the “Website”). The Website is operated by Toward Health, Inc., a healthcare management services organization (the “Company,” “Toward Health,” “we,” “us,” or “our”).

Toward Health, Inc. does not provide medical care or make clinical decisions. Any medical services referenced on or accessed through this Website are provided independently by licensed physician practices, including Toward Health, P.C., in accordance with applicable state and federal law.

• Website Use and Educational Purpose

1. 1. The content provided on this Website is for general informational and educational purposes only. Nothing on this Website constitutes medical advice, diagnosis, treatment, or a substitute for care from a licensed healthcare provider.
   2. Use of this Website does not create a physician–patient relationship.

• Services and Program Information

1. 1. The Website may describe or reference:
      1. Preventive health screening programs
      2. Educational resources related to metabolic and cardiometabolic health
      3. Screening coordination and program infrastructure
      4. Affiliate and employer-sponsored wellness initiatives
   2. All medical services, including test ordering, clinical review, interpretation of results, and follow-up care, are provided solely by independent, licensed clinicians affiliated with partner medical practices.

• Privacy and Data Collection (Website)

1. 1. Toward Health, Inc. collects limited personal information through the Website for non-clinical purposes, which may include:

      1. Contact information submitted through forms
      2. Affiliate or program inquiries
      3. Website usage and analytics data
   2. This information is used to:
      1. Respond to inquiries
      2. Provide requested information or materials
      3. Operate, maintain, and improve the Website
      4. Support program coordination and administrative functions
   3. Toward Health, Inc. does not collect protected health information (PHI) through this Website.

• Clinical Privacy (HIPAA)

1. 1. If you engage in clinical services through an affiliated medical practice, your health information is governed by that practice’s Notice of Privacy Practices and applicable privacy laws, including HIPAA.
   2. Website privacy practices and clinical privacy practices are separate.

• Communications

1. 1. Communications submitted through this Website are not intended for urgent or emergency medical matters.
   2. If you are experiencing a medical emergency, call 911 or seek immediate medical attention.

• Affiliate and Third-Party Links

1. 1. The Website may contain links to third-party websites, platforms, or services. Toward Health, Inc. is not responsible for the content, privacy practices, or terms of use of third-party sites.
   2. Affiliate relationships are governed by separate affiliate agreements and guidelines.

• Intellectual Property

1. 1. All Website content, including text, graphics, logos, and materials, is owned by or licensed to Toward Health, Inc. and may not be used, reproduced, or distributed without prior written permission, except as expressly permitted.

• Limitation of Liability

1. 1. Toward Health, Inc. makes no warranties regarding the accuracy or completeness of Website content and disclaims liability for reliance on information provided through the Website to the fullest extent permitted by law.

• Updates to This Policy

1. 1. We may update this Privacy & Terms notice from time to time. Updates will be posted on this page with a revised effective date.

• Contact Information

1. 1. For questions about this Website or these Privacy & Terms, please contact: Toward Health, Inc. – 564 Route 303, Blauvelt, NY 10913 – [email protected]

By using this Website, you acknowledge and agree to these Privacy & Terms.

HIPAA NOTICE OF PRIVACY PRACTICES

Northvale Primary Care, P.C.
d/b/a Toward Health
Effective Date: March 1, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU MAY ACCESS THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice is provided pursuant to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), 45 C.F.R. Parts 160 and 164, and applicable New York law.

• WHO WE ARE

1. 1. This Notice applies to: Northvale Primary Care, P.C., a New York professional corporation Doing business as Toward Health (“Practice,” “we,” “us,” or “our”)
   2. All medical services are provided exclusively by licensed healthcare professionals affiliated with Northvale Primary Care, P.C.
   3. Toward Health, Inc. is a management services organization (“MSO”) that provides non-clinical administrative, operational, and technology support services to the Practice pursuant to a management services agreement. Toward Health, Inc. does not practice medicine and does not provide clinical care. When performing services on behalf of the Practice that involve protected health information, Toward Health, Inc. acts as a Business Associate as defined by HIPAA.

• OUR LEGAL DUTIES

1. 1. We are required by law to:
      1. Maintain the privacy and security of your protected health information (“PHI”).
      2. Provide you with this Notice of our legal duties and privacy practices.
      3. Notify you following a breach of unsecured PHI when required by law.
      4. Abide by the terms of the Notice currently in effect.
   2. We reserve the right to change the terms of this Notice. Any revised Notice will apply to all PHI we maintain and will be made available on our website and upon request.

• HOW WE MAY USE AND DISCLOSE YOUR PROTECTED HEALTH INFORMATION

1. 1. 1. We may use and disclose your PHI without your written authorization for the following purposes:

• Treatment: We may use and disclose PHI to provide, coordinate, or manage your healthcare, including:

1. 1. 1. 1. 1. Medical evaluation, diagnosis, and treatment
            2. Telehealth consultations
            3. Laboratory testing and diagnostic services
            4. Prescriptions and medication management
            5. Referrals to specialists
            6. Care coordination with other healthcare providers

• Payment: Although the Practice operates on a self-pay basis and does not participate with insurance, Medicare, or Medicaid, we may use and disclose PHI for payment-related purposes, including:

1. 1. 1. 1. 1. Billing and collection activities
            2. Processing payments
            3. Issuing receipts or statements
            4. Reviewing program eligibility or participation

• Healthcare Operations: We may use and disclose PHI for healthcare operations, including:

1. 1. 1. 1. Quality assessment and improvement
         2. Clinical performance review
         3. Compliance, risk management, and legal review
         4. Licensing and credentialing
         5. Business planning and administrative activities
         6. Training and supervision of healthcare professionals

1. OTHER PERMITTED OR REQUIRED DISCLOSURES
   1. We may disclose PHI without your authorization when required or permitted by law, including:
      1. Public health reporting
      2. Health oversight activities
      3. Judicial or administrative proceedings
      4. Law enforcement purposes
      5. Coroners, medical examiners, or funeral directors
      6. Organ or tissue donation
      7. Serious threats to health or safety
      8. Workers’ compensation claims
      9. As otherwise required by federal or New York law

• USES AND DISCLOSURES REQUIRING WRITTEN AUTHORIZATION

1. 1. We will obtain your written authorization for:
      1. Most uses and disclosures of psychotherapy notes (if applicable)
      2. Marketing communications that require authorization under HIPAA
      3. Sale of PHI (we do not sell PHI)
      4. Any other use or disclosure not described in this Notice
   2. You may revoke an authorization in writing at any time, except to the extent we have already relied upon it.

• YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION

1. 1. 1. You have the following rights:

• Right to Access: You have the right to inspect and obtain a copy of your PHI in a designated record set, subject to limited exceptions permitted by law.

• Right to Request Amendment: You may request an amendment to your PHI if you believe it is incorrect or incomplete.

• Right to an Accounting of Disclosures: You may request a list of certain disclosures of your PHI made in the six (6) years prior to your request.

• Right to Request Restrictions: You may request restrictions on certain uses or disclosures of your PHI. We are not required to agree to all requested restrictions, except where required by law.

• Right to Confidential Communications: You may request that we communicate with you using alternative means or at alternative locations.

• Right to a Paper Copy: You have the right to receive a paper copy of this Notice upon request, even if you have agreed to receive it electronically.

• TELEHEALTH AND ELECTRONIC SYSTEMS

1. 1. As part of your care, we may use electronic systems, including:
      1. Electronic health record platforms
      2. Secure messaging applications
      3. Telehealth platforms
      4. Email or SMS communications (as authorized by you)
   2. We implement reasonable administrative, technical, and physical safeguards to protect PHI. However, no electronic transmission system can be guaranteed to be completely secure.

• COMPLAINTS

1. 1. If you believe your privacy rights have been violated, you may file a complaint with:
      1. Privacy Officer
         Northvale Primary Care, P.C.
         564 Route 303
         Blauvelt, NY 10913
         [email protected]
   2. You may also file a complaint with:
      1. U.S. Department of Health and Human Services
         Office for Civil Rights
         www.hhs.gov/ocr/privacy/hipaa/complaints/
         1-877-696-6775
   3. You will not be retaliated against for filing a complaint.