NOTICE OF PRIVACY PRACTICES

Effective Date: April 1 2026

Aspen Health LLC • 601 Ewing Street, Suite B17, Princeton, NJ 08540 • info@aspen.health

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Your health information is private. Aspen Health LLC (“Practice”) is required by law to maintain the privacy of your protected health information (“PHI”) and to provide you with notice of its legal duties and privacy practices. In the unlikely event that your PHI becomes unsecured, Practice will provide you with prompt notification as required by the HIPAA Breach Notification Rule (within 60 days of discovery). Practice will not use or disclose your PHI except as described in this Notice. This Notice applies to all medical records generated during your care at Practice. Privacy Officer: Jay Benson, D.O. — Contact at info@aspen.health or 601 Ewing Street, Suite B17, Princeton, NJ 08540.

HOW WE MAY USE AND DISCLOSE YOUR HEALTH INFORMATION

Treatment: Practice will use your PHI in providing and coordinating your healthcare. We may share relevant portions of your medical record with physicians, specialists, nurses, and other healthcare providers involved in your care. For example, we may send records to a specialist to whom we refer you.

Payment: Practice may use and disclose PHI to obtain payment for services. Because Practice does not bill health insurance directly, this is limited primarily to documenting services for patient billing purposes and, where applicable, providing superbills to patients for potential self-submission.

Health Care Operations: Practice may use and disclose PHI to operate the practice, improve care quality, and contact you when necessary. This includes quality review, staff training, and business planning activities.

Business Associates: Practice may share PHI with business associates—vendors under written contract who perform functions on our behalf requiring access to PHI (e.g., our electronic health record platform, secure messaging provider, billing services, attorneys, or accountants). We require all business associates to protect the confidentiality of your PHI under a signed Business Associate Agreement.

Regulatory Agencies: Practice may disclose PHI to public health or legal authorities charged with preventing or controlling disease, injury, or disability, or to the NJ Division of Consumer Affairs / Board of Medical Examiners or the Secretary of HHS in connection with compliance oversight.

Workers’ Compensation: Practice may release PHI for workers’ compensation or similar programs covering work-related injuries or illness.

Military and Veterans: If you are a member of the armed forces, Practice may disclose PHI as required by military command authorities.

Correctional Institutions: If you are in the custody of a law enforcement officer or correctional institution, Practice may release PHI to that institution or officer.

Organ and Tissue Donation: PHI may be shared with organ procurement organizations. Medical Examiner or Funeral Director: PHI may be disclosed to a coroner, medical examiner, or funeral director when an individual dies.

Required by Law: Practice will disclose PHI when required to do so by law, including responding to court orders, subpoenas, and lawful requests.

Family Members and Persons Involved in Your Care: With your presence or permission, Practice may share relevant PHI with family members or others involved in your care. In an emergency, we will use professional judgment to disclose only information directly relevant to that person’s involvement in your care.

Other Uses: Any other uses and disclosures of PHI not described here will be made only with your specific written authorization, which you may revoke at any time in writing.

YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION

Right to Access and Receive Copies: You have the right to inspect and receive a copy of your PHI, including through our secure patient portal. Under the 21st Century Cures Act (Information Blocking Rule), you have the right to timely, electronic access to your health information, and Practice will not take actions designed to unreasonably delay or block your access to your own records.

Right to Amend: You may request that Practice amend your PHI. Submit your request in writing with a reason supporting the amendment to info@aspen.health or the address below.

Right to an Accounting of Disclosures: You have the right to a list of certain disclosures Practice has made of your PHI during the preceding six (6) years (three years for substance use disorder records — see below).

Right to Request Restrictions: You may request that Practice restrict certain uses or disclosures of your PHI. Practice is not required to agree to most restrictions; however, Practice must comply if the request is to restrict disclosure for payment or operations purposes, the PHI relates solely to a service you paid for out-of-pocket in full, and the disclosure is not otherwise required by law.

Right to Confidential Communications: You may request that Practice communicate with you by alternative means or at an alternative location (e.g., contact you only by email or at a different address).

Right to a Paper Copy: You have the right to a paper copy of this Notice upon request, even if you have agreed to receive it electronically.

Right to Electronic Copies: You have the right to receive an electronic copy of your PHI.

Right to Choose a Representative: If you have granted someone medical power of attorney or have a legal guardian, that person may exercise your rights on your behalf.

Right to Revoke Authorization: You may revoke any authorization you have given Practice to use or disclose your PHI, except to the extent action has already been taken in reliance on that authorization. To exercise any of these rights, submit a written request to: Aspen Health LLC, Attn: Privacy Officer, 601 Ewing Street, Suite B17, Princeton, NJ 08540, or email info@aspen.health.

SPECIAL PROTECTIONS FOR SUBSTANCE USE DISORDER RECORDS

If Practice creates, receives, or maintains records subject to 42 CFR Part 2 (federal Substance Use Disorder treatment records), the following additional protections apply:

• Heightened Confidentiality: These records carry stricter protections than standard medical records. Practice generally may not disclose them—even for treatment, payment, or operations—without your specific written consent, except in limited circumstances permitted by law (e.g., medical emergencies or mandatory child abuse reporting).

• Legal Proceedings: SUD treatment records and any testimony relaying their contents will not be used or disclosed in any civil, criminal, administrative, or legislative proceeding against you without: (a)your specific written consent, or (b) a court order and subpoena meeting the requirements of 42 CFR Part 2.

• Fundraising: If Practice intends to use SUD records for fundraising, you will first receive a clear opportunity to opt out.

• Accounting: You may request an accounting of disclosures of your SUD records made during the three (3) years prior to your request.

STATE LAW PROTECTIONS

New Jersey law may provide privacy protections that are more restrictive than HIPAA. In accordance with NJ law, Practice uses data encryption software on electronic devices that may contain PHI. Where New Jersey law is more protective than HIPAA, Practice will comply with the more stringent state standard.

FOR MORE INFORMATION OR TO FILE A COMPLAINT

If you have questions or believe your privacy rights have been violated, please contact: Practice: Email info@aspen.health or write to Aspen Health LLC, Attn: Privacy Officer, 601 Ewing Street, Suite B17, Princeton, NJ 08540.

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights:

• Phone: 1-800-368-1019 (TDD: 800-537-7697)

• Online: https://www.hhs.gov/hipaa/filing-a-complaint

• Email: OCRComplaint@hhs.gov

• Mail: Centralized Case Management Operations, U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Room 509F HHH Bldg., Washington, D.C. 20201

Practice will not retaliate against you for filing a complaint.

DISTRIBUTION OF THIS NOTICE As required by HIPAA (45 CFR §164.520), this Notice is provided to all new patients at or before their first visit and is posted continuously on the Practice website at https://aspen.health and within the Practice’s secure patient portal. A paper copy is available upon request at no charge.

CHANGES TO THIS NOTICE

Practice reserves the right to change the terms of this Notice and to make updated provisions effective for all PHI it maintains. The current Notice will always be posted on the Practice website at https://aspen.health and is available upon request from our office. The effective date at the top of this Notice indicates the most current version.