Notice of Privacy Practices

Prosoma, Inc. Prosoma.com/us
Version 2.3
Effective Date: November 4, 2026
Last Updated: November 6, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Your Information at a Glance

• We use your health information to support your care, get paid for that care, and run our services.
• We will not sell your health information, use it for marketing or advertising, or share it with advertising platforms without your written permission.
• You can see and get a copy of your records, ask us to correct them, and choose how we contact you.
• If you have a concern, you can contact our Privacy Officer or the U.S. Department of Health and Human Services. We will not retaliate against you.

1. Who We Are

This Notice describes the privacy practices of Prosoma, Inc. ("Prosoma," "we," "us"), which operates Prosoma.com/us and the Living Well app, and its workforce members, including health coaches, care navigators, and support staff, as well as its contracted clinical partners who assist with enrollment and care, such as OpenLoop Health, when they act on our behalf. A licensed clinician who provides care to you in their own right may also give you their own notice of privacy practices. Our services are intended solely for individuals 18 years of age or older.

2. Our Pledge Regarding Medical Information

We understand that medical information about you and your health is personal. We are committed to protecting medical information about you. We create a record of the care and services you receive to provide you with quality care and to comply with certain legal requirements. This Notice applies to all of the records of your care generated by Prosoma and its contracted clinical partners acting on our behalf.

3. Our Responsibilities

• We are required by law to protect the privacy and security of your protected health information (PHI) and to give you this Notice.
• We must follow the terms of the Notice currently in effect.
• We will tell you promptly if a breach occurs that may have compromised the privacy or security of your information.
• We will not use or share your information other than as described here unless you tell us we can in writing. You may change your mind at any time by letting us know in writing.

4. How We May Use and Disclose Your Medical Information (PHI)

We may use and disclose your Protected Health Information (PHI) for the following purposes:

Treatment: We may use medical information to provide support services and coordinate with your oncologist. This includes sharing relevant information with OpenLoop Health, a contracted clinical partner, to verify your eligibility for and enroll you in programs such as Remote Therapeutic Monitoring (RTM), including the issuance of the clinical order required for enrollment.

Payment: We may use information for billing and payment collection from insurance, including sharing information with your insurance provider and with OpenLoop Health to verify coverage and eligibility.

Health Care Operations: We may use information for quality assessment and platform improvement, including reviewing recorded coaching calls, which are processed and stored via Zoom, our contracted communications platform, for quality assurance and staff training. We tell you at the start of each recorded call, and you may ask us not to record. We may also create de-identified information that no longer identifies you.

Communicating With You: We may contact you by phone, email, text message, or in the Living Well app with appointment reminders, health check-ins, and information about your care. Text messages are not fully secure. You can ask us to contact you in a different way (Section 7) or reply STOP to stop texts.

Family, Friends, and Caregivers: We may share information with a family member, friend, or caregiver involved in your care if you agree or do not object, or if you are unable to agree and we believe it is in your best interest. We share only what is relevant to their involvement.

Other Uses and Disclosures Permitted or Required by Law

As Required By Law: We will disclose information when required by law.

To Avert Serious Threat: We may disclose to prevent serious health or safety threats.

We may also use or disclose your information, as permitted by law, for:

• Public health activities, such as preventing disease or reporting adverse reactions to medications or medical devices
• Reporting abuse, neglect, or domestic violence to authorized government agencies
• Health oversight, such as audits, investigations, and inspections by government agencies
• Lawsuits and legal proceedings, in response to a court order, subpoena, or other lawful process
• Law enforcement, when required by law or in response to a valid legal request
• Coroners, medical examiners, and funeral directors, as needed for their duties
• Organ and tissue donation organizations
• Research, when approved through a process that protects your privacy or with your authorization
• Workers' compensation and similar programs
• Specialized government functions, such as military, national security, and protective services

Business Associates

All contracted partners who receive PHI from us, including OpenLoop Health and Zoom, are bound by a Business Associate Agreement requiring them to protect your information and use it only for the purposes described above. These include Tellescope, our care coordination and text messaging provider and Cloudflare our hosting provider.

5. Uses That Require Your Written Authorization

We will ask for your written authorization before we:

• Use or disclose your PHI for marketing or advertising, including sharing it with advertising platforms
• Sell your PHI
• Use or disclose session notes
• Use or disclose your PHI for any other purpose not described in this Notice

We do not use your PHI for fundraising. You may revoke an authorization at any time by writing to our Privacy Officer. Revoking it stops future uses and disclosures but does not undo those already made.

6. Special Protections Under Other Laws

Some types of information, such as mental health, HIV/AIDS, genetic, and substance use disorder information, have extra protection under federal and state law, including California's Confidentiality of Medical Information Act. Where those laws are stricter than HIPAA, we follow them. If we receive substance use disorder treatment records protected by federal law (42 C.F.R. Part 2), we will not use or disclose them in any civil, criminal, administrative, or legislative proceeding against you without your written consent or a court order.

7. Your Rights Regarding Medical Information

• Right to Inspect and Copy: Access your medical information including billing records, on paper or electronically. We will respond within 30 days.
• Right to Amend: Request corrections to your information. We will respond within 60 days. If we deny your request, we will explain why in writing, and you may submit a statement of disagreement.
• Right to Accounting: Request a list of disclosures, including disclosures made to contracted clinical partners such as OpenLoop Health, for up to six years before your request. The accounting does not need to include disclosures for treatment, payment, health care operations, or those you authorized. The first list in any 12-month period is free.
• Right to Restrictions: Request limitations on use/disclosure. We are not required to agree, except that we must agree not to share information with your health plan about a service you paid for in full out of pocket, unless the law requires us to share it.
• Right to Confidential Communications: Request specific communication methods, such as contact only at a particular phone number or address. We will agree to all reasonable requests.
• Right to Paper Copy: Request a paper copy of this notice, even if you agreed to receive it electronically.
• Right to Choose Someone to Act for You: A legal guardian or someone with medical power of attorney may exercise your rights. We will confirm their authority first.
• Right to Be Notified of a Breach: We will notify you if a breach affects your PHI.

How to exercise your rights: Email support@prosoma.com or write to our Privacy Officer at the address below. We will verify your identity before releasing information.

8. Retention

We retain your medical information for a minimum of seven (7) years following your last date of service, or longer where required by applicable state or federal law.

9. Changes to This Notice

We reserve the right to change this notice, and the changes will apply to all information we hold about you. We will post the current notice on our website, show its effective date at the top, and provide a copy on request.

10. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us using the contact information below, or with the Secretary of Health and Human Services. You will not be penalized or retaliated against for filing a complaint.

To file a complaint with the U.S. Department of Health and Human Services:

Office for Civil Rights, U.S. Department of Health and Human Services

200 Independence Avenue, S.W., Washington, D.C. 20201

Complaint Portal: https://ocrportal.hhs.gov/ocr/smartscreen/main.jsf

Phone (toll-free): 1-800-368-1019 · TDD: 1-800-537-7697

11. Language and Accessibility

This Notice is available in Spanish and in accessible formats. To request a copy, contact support@prosoma.com.

Contact Us

Prosoma, Inc. (Prosoma.com/us)

Attn: Privacy Officer

2108 N St #13468, Sacramento, CA 95816

Email: support@prosoma.com

Phone: 877-509-5978