HIPAA & Protected Health Information Notice

THIS NOTICE DESCRIBES ERCHONIA'S ROLE IN HANDLING PROTECTED HEALTH INFORMATION PROVIDED BY PARTICIPATING HEALTHCARE PROVIDERS IN CONNECTION WITH THE ERCHONIA-DPN PROGRAM. PLEASE REVIEW IT CAREFULLY.

Erchonia Corporation, LLC ("Erchonia," "we," "our," or "us") is a medical device manufacturer and fulfillment and logistics provider.

In connection with the Erchonia-DPN program, participating healthcare providers and clinics may provide Erchonia with limited Protected Health Information ("PHI") so that Erchonia can perform device fulfillment, shipment, delivery, return, product-safety, regulatory, and related services on the clinic's behalf.

Where applicable, Erchonia handles PHI as a Business Associate of the participating clinic in accordance with the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act ("HITECH"), applicable regulations, and the Business Associate Agreement ("BAA") entered into between Erchonia and the participating clinic.

Erchonia is not the patient's healthcare provider and does not practice medicine, diagnose patients, determine treatment eligibility, prescribe treatment, or provide medical advice.

1. Erchonia's Role

The Erchonia-DPN program allows participating clinics to obtain Erchonia-DPN Devices for use as practice equipment in Courses of Treatment independently prescribed and directed by their licensed healthcare providers.

The participating clinic and its healthcare providers are responsible for:

• Evaluating the patient
• Diagnosing the patient
• Determining whether treatment is medically appropriate
• Prescribing and directing treatment
• Screening for contraindications, warnings, and precautions
• Providing patient instructions
• Obtaining informed consent and required patient acknowledgments
• Determining treatment duration
• Monitoring treatment and adherence
• Maintaining the patient's medical records
• Providing clinical follow-up and medical care
• Establishing and collecting the clinic's professional fees

Erchonia does not make these clinical decisions or perform these clinical services.

When a participating clinic directs Erchonia to ship an Erchonia-DPN Device to a patient's residence, Erchonia performs shipment and related logistics on behalf of the clinic.

Shipment of a Device to a patient's residence does not create a physician-patient or other healthcare-provider relationship between Erchonia and the patient.

2. Erchonia as a Business Associate

For purposes of the Erchonia-DPN program, the participating clinic may be a HIPAA Covered Entity and Erchonia acts as the clinic's Business Associate with respect to PHI that Erchonia creates, receives, maintains, or transmits on the clinic's behalf.

Before the clinic submits an order containing patient information, Erchonia and the clinic are required to enter into an applicable BAA.

The BAA governs Erchonia's permitted uses and disclosures of PHI and Erchonia's responsibilities for safeguarding that information.

Erchonia's role as the clinic's shipping agent for purposes of Device fulfillment does not make Erchonia the clinic's agent for purposes of HIPAA or the federal common law of agency. Erchonia performs its Business Associate functions as an independent contractor.

3. PHI Erchonia May Receive

The Erchonia-DPN program is designed to minimize the amount of PHI provided to Erchonia.

Ordinary Fulfillment Information

For an ordinary Device fulfillment order, the participating clinic provides Erchonia with:

• A Patient Reference Identifier
• The patient's name
• The patient's Delivery Address

The Patient Reference Identifier is intended to facilitate fulfillment and Device tracking while minimizing directly identifying patient information.

The Patient Reference Identifier should not contain the patient's:

• Name or initials
• Date of birth
• Address
• Telephone number
• Other directly identifying information

The clinic maintains the relationship between the Patient Reference Identifier and the applicable patient in the clinic's own records.

Portal Record

Erchonia also maintains a Portal Record associated with the Patient Reference Identifier.

The Portal Record may include:

• Device serial number
• Shipment date
• "Return by" date
• Carrier-confirmed delivery date
• Return receipt date

To the extent this record is associated with an identifiable patient, it constitutes Program PHI and is handled in accordance with the applicable BAA.

Additional PHI

Additional PHI may be received when reasonably necessary for:

• Complaint handling
• Reports of Device malfunction
• Reports of shipping damage or missing items
• Adverse-event reporting
• Medical Device Reporting
• Recalls
• Corrections and removals
• Field safety actions
• Product-safety investigations
• Compliance with applicable law

Erchonia will request, use, and disclose only the minimum PHI reasonably necessary for the permitted purpose.

In the ordinary fulfillment process, Erchonia does not request or require the patient's diagnosis, medical history, symptoms, medications, treatment notes, medical records, questionnaire responses, or prescribed treatment duration.

4. How Erchonia May Use PHI

Erchonia may use PHI only as permitted by the applicable BAA and applicable law.

Permitted purposes include:

Device Fulfillment

To process clinic orders and prepare Devices for shipment at the clinic's direction.

Shipment, Delivery, and Return Logistics

This may include:

• Generating outbound shipping labels
• Generating return shipping labels
• Shipping Devices to patient Delivery Addresses designated by clinics
• Providing shipment notifications
• Providing delivery notifications
• Tracking outbound and return shipments
• Confirming or correcting a Delivery Address when a shipment cannot be delivered
• Reshipping an undeliverable Device when authorized under the program
• Providing replacement Return Kits or prepaid return labels
• Scheduling carrier pickups
• Receiving returned Devices
• Performing permitted Device-recovery activities
• Maintaining related shipment and return records

Portal Record and Program Notices

Erchonia may use PHI to:

• Maintain the Portal Record
• Record Device serial numbers
• Record shipment and delivery events
• Record Return-by dates
• Record return receipt dates
• Provide participating clinics with applicable fulfillment notices

Complaints, Damage, and Malfunctions

Erchonia may use PHI to receive and investigate:

• Product complaints
• Device malfunctions
• Shipping damage
• Missing items
• Other product-quality or safety concerns

Erchonia may also arrange applicable replacement and return logistics.

Regulatory and Safety Obligations

Erchonia may use PHI to comply with applicable legal and regulatory obligations, including:

• Medical Device Reporting
• FDA reporting
• Product complaint investigation
• Product traceability
• Recalls
• Corrections and removals
• Field safety actions
• Regulatory inspections
• Regulatory investigations
• Other legally required activities

Management and Administration

Erchonia may use PHI for its proper management and administration and to carry out its legal responsibilities as permitted by HIPAA and the applicable BAA.

5. How Erchonia May Disclose PHI

Erchonia may disclose PHI only as permitted by the applicable BAA and applicable law.

Permitted disclosures may include the following.

Participating Clinic

Erchonia may provide the applicable clinic with information regarding:

• Device fulfillment
• Device serial numbers
• Shipment status
• Delivery confirmation
• Return-by dates
• Device returns
• Failed deliveries
• Shipping damage
• Missing items
• Malfunctions
• Complaints
• Product-safety matters
• Recalls or field safety actions
• Other matters relating to the clinic's patient or Device order

Shipping Carriers

Patient names and Delivery Addresses may be provided to shipping carriers as necessary to transport Devices.

Outbound and return shipping materials may display the patient's name and address when necessary for carriage.

Return materials may also display the Patient Reference Identifier.

A common carrier transporting a sealed package may act as a conduit rather than as a HIPAA Business Associate.

Subcontractors and Service Providers

Erchonia may use subcontractors or service providers to perform permitted functions.

Any subcontractor that creates, receives, maintains, or transmits PHI on Erchonia's behalf will be required, where applicable, to agree in writing to privacy and security restrictions and protections consistent with Erchonia's obligations under the BAA.

This may include providers supporting:

• Provider-portal hosting
• Portal Record maintenance
• Cloud infrastructure
• Information technology
• Security
• Communications
• Logistics
• Customer support
• Other operational functions

Government and Regulatory Authorities

Erchonia may disclose PHI where required or permitted for:

• FDA reporting
• Medical Device Reporting
• Recalls
• Corrections or removals
• Field safety actions
• Product-safety investigations
• Regulatory inquiries
• Court orders or other legal process
• Other purposes Required by Law

6. Communications With Patients

Erchonia may communicate directly with patients only for limited purposes permitted under the applicable BAA and program agreements.

These communications may include:

• Shipment notifications
• Delivery notifications
• Return-logistics communications
• Confirmation or correction of a Delivery Address when delivery fails
• Replacement Return Kits
• Replacement prepaid shipping labels
• Scheduling a carrier pickup
• Communications regarding shipping damage, missing items, or Device malfunctions
• Permitted Device-recovery communications
• Product-safety communications
• Recalls, corrections, removals, or field safety actions
• Communications otherwise required by law

Erchonia does not use these communications to:

• Provide medical advice
• Prescribe treatment
• Determine treatment duration
• Direct clinical care
• Market or solicit patients
• Communicate an Erchonia charge, fee, price, or financial consequence to a patient

Questions regarding medical treatment, symptoms, treatment duration, medications, injuries, adverse events, or other clinical issues should be directed to the patient's healthcare provider.

7. Return Shipping Information

Return materials supplied with the Device may include the patient's name and Delivery Address as shipper-of-record information required for carriage.

The Return Kit may also contain the Patient Reference Identifier.

Patients should not add medical information, clinical information, or other unnecessary patient-identifying information to the return label, packaging, or contents.

8. No Marketing or Sale of PHI

Erchonia does not sell PHI as that term is defined under HIPAA.

Erchonia does not use PHI received through the Erchonia-DPN program to:

• Market Erchonia products or services to patients
• Advertise to patients
• Solicit patients
• Add patients to Erchonia marketing lists
• Communicate Device prices or charges to patients
• Communicate late-return or other financial consequences to patients

PHI received for program fulfillment will be used only for purposes permitted under the applicable BAA and applicable law.

9. De-Identified Information

Erchonia may de-identify PHI in accordance with HIPAA.

Information that has been properly de-identified is no longer PHI.

Erchonia may use properly de-identified information for purposes including:

• Device quality
• Product safety
• Program operations

Erchonia will not use de-identified information to re-identify an individual and will not use it for patient marketing.

10. Safeguarding PHI

Erchonia maintains reasonable and appropriate administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of Electronic PHI and to prevent uses or disclosures of PHI not permitted by the applicable BAA.

Access to PHI is limited to personnel and service providers who require access for authorized:

• Fulfillment
• Logistics
• Product safety
• Regulatory
• Legal
• Security
• Administrative purposes

Erchonia requires applicable subcontractors handling PHI on its behalf to maintain appropriate privacy and security protections.

No electronic system, storage method, or method of transmission can be guaranteed to be completely secure.

11. Security Incidents and Breaches

Erchonia will investigate unauthorized uses or disclosures of PHI and Security Incidents in accordance with applicable law and the BAA.

If Erchonia becomes aware of a use or disclosure of PHI not permitted by the BAA, or a reportable Security Incident, Erchonia will notify the applicable clinic as required by the BAA.

If a Breach of Unsecured PHI occurs, Erchonia will notify the applicable clinic without unreasonable delay and in accordance with the applicable BAA and HIPAA requirements.

Erchonia will also take reasonable steps to mitigate harmful effects of an impermissible use or disclosure of PHI when required.

The participating clinic remains responsible for patient or governmental notifications allocated to the clinic under HIPAA, applicable state law, and the BAA.

12. Patient Medical Records

Erchonia does not maintain the clinic's complete patient medical record.

The participating clinic remains responsible for clinical records including:

• Evaluation
• Diagnosis
• Medical history
• Prescriptions
• Treatment decisions
• Treatment duration
• Patient instructions
• Monitoring
• Follow-up care

The clinic also maintains the relationship between the Patient Reference Identifier and the applicable patient.

13. Designated Record Set and Patient Requests

Under the current Erchonia-DPN program structure, Erchonia does not maintain a HIPAA Designated Record Set on behalf of the participating clinic.

Accordingly, patients seeking access to or amendment of medical records should generally direct those requests to their healthcare provider or clinic.

If Erchonia receives an individual request for access to or amendment of PHI, Erchonia will forward that request to the applicable clinic and reasonably cooperate with the clinic in responding as required by the BAA.

If the program structure changes in the future and Erchonia begins maintaining a Designated Record Set on behalf of a clinic, Erchonia will comply with applicable HIPAA access and amendment requirements.

14. Accounting of Disclosures

Where required by HIPAA and the applicable BAA, Erchonia will document disclosures of PHI and related information necessary to assist a participating clinic in responding to an individual's request for an accounting of disclosures.

Patients seeking an accounting of disclosures should generally submit the request to their participating healthcare provider or clinic.

15. Patient HIPAA Rights

HIPAA provides individuals with certain rights concerning PHI maintained by Covered Entities and their Business Associates, as applicable.

These rights may include rights to:

• Access certain PHI
• Request amendment of certain PHI
• Request restrictions on certain uses or disclosures
• Request confidential communications
• Receive an accounting of certain disclosures
• Receive information regarding applicable privacy practices
• File a privacy complaint

Because Erchonia acts as a Business Associate and does not maintain the clinic's Designated Record Set under the current program structure, patients should ordinarily direct HIPAA rights requests concerning their medical records or treatment information to their healthcare provider.

Erchonia will cooperate with participating clinics in responding to requests as required by the applicable BAA.

16. Clinic Responsibilities

The participating clinic remains responsible for its own HIPAA obligations and its relationship with its patients.

The clinic is responsible for:

• Providing its own Notice of Privacy Practices where required
• Informing Erchonia of applicable restrictions affecting PHI
• Informing Erchonia of applicable changes or revocations of patient authorizations when relevant
• Informing Erchonia of restrictions on PHI use or disclosure that affect Erchonia's services
• Requesting only uses or disclosures of PHI that are permissible under HIPAA
• Providing any required notice or obtaining any required acknowledgment for Erchonia's permitted shipment-, delivery-, and return-related communications with patients
• Obtaining the Patient Custody Acknowledgment required under the Erchonia-DPN program

This Notice does not replace the participating clinic's own Notice of Privacy Practices.

17. Patient Custody Acknowledgment

Before a participating clinic submits an order for a Device, the clinic obtains a Patient Custody Acknowledgment from the patient.

That acknowledgment is between the clinic and the patient. Erchonia is not a party to it.

The acknowledgment informs the patient, among other things, that:

• Erchonia may ship the Device directly to the patient's home at the clinic's direction
• Erchonia may contact the patient if necessary to confirm or correct an undeliverable address
• Erchonia may send shipment and delivery notifications
• Erchonia may provide replacement return materials or schedule a carrier pickup
• Return labels may contain the patient's name and Delivery Address as required for carriage
• Clinical questions must be directed to the clinic
• Erchonia does not provide medical advice or treatment instruction

18. Retention of PHI

Erchonia retains PHI only as permitted or required by applicable law, the BAA, and applicable regulatory obligations.

The Portal Record is retained for at least six (6) years after the Device is returned or, if the Device is never returned, for the applicable retention period associated with the Device's Fee Date.

PHI may also be retained as necessary for:

• Outstanding or unreturned Devices
• Product traceability
• Complaint handling
• Medical Device Reporting
• FDA recordkeeping
• Recalls
• Corrections and removals
• Field safety actions
• Quality-system recordkeeping
• Legal obligations

Upon termination of the applicable clinic agreement, Erchonia will return or destroy PHI as required by the BAA except where retention is permitted or required.

Where PHI must be retained after termination, Erchonia will continue to protect that information and limit further uses or disclosures to the purposes requiring retention.

19. Applicable State Privacy and Breach Laws

To the extent applicable to Erchonia in its role as a service provider or third-party agent of a clinic, Erchonia will comply with state laws governing the security of and notification concerning personal or medical information where those requirements are more stringent than HIPAA.

20. Changes to This Notice

Erchonia may revise this Notice to reflect changes in:

• Applicable law
• HIPAA or HITECH requirements
• Business Associate obligations
• Technology
• Security practices
• Program operations

The current version will be posted on the Erchonia-DPN website with its effective date.

This Notice describes Erchonia's handling of PHI in connection with the Erchonia-DPN program and does not replace the Notice of Privacy Practices issued by a patient's healthcare provider.

21. Privacy Questions and Complaints

Questions or concerns regarding Erchonia's handling of PHI may be submitted using the contact information below.

Patients may also contact their healthcare provider or clinic regarding PHI maintained by that provider.

Individuals may have the right to file a HIPAA complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, where applicable.

Erchonia will not retaliate against an individual for raising a privacy concern or exercising rights available under applicable law.

22. Contact Information

Erchonia Corporation, LLC
112 Southchase Boulevard
Fountain Inn, South Carolina 29644

Email: info@erchonia.com
Phone: (888) 242-0571

Effective Date: August 24, 2026