Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION.

PLEASE REVIEW IT CAREFULLY

Valar Labs is required by law to maintain the privacy of Protected Health Information ("PHI"), to provide you with this Notice of our legal duties and privacy practices with respect to PHI, and notify affected individuals following a breach of unsecured PHI. PHI is information that identifies you and is related to your health, condition, or payment for health care services.

Valar Labs will comply with the terms of this Notice that is currently in effect. However, we reserve the right to make changes to this Notice and to make such changes effective for all PHI we may already have about you. If a material change is made to this Notice, we will post the revised Notice on our public website at www.valarlabs.com/hipaa-notice. We will also provide the notice upon request.

This Notice is intended to address compliance with the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA"). In certain cases, however, other federal and state laws impose additional requirements or limitations on the use and disclosure of health information. For example, additional protection may be required under applicable law for information related to mental health, HIV/AIDS, reproductive health, genetics, or substance use disorders. We will follow the more stringent and protective law, where applicable.

USES AND DISCLOSURES OF YOUR PHI

The following categories describe different ways in which we may use or disclose your PHI. The examples provided under the categories below are not intended to be comprehensive, but instead, to identify some of the more common types of uses and disclosures of PHI within the category.

Uses and Disclosures for Treatment, Payment, and Health Care Operations

We may use and disclose PHI for treatment, payment and health care operations activities, as described more fully below. We are not required to obtain your authorization for these activities.

• Treatment: We provide laboratory testing ordered by physicians and other healthcare professionals, and we use your PHI to perform this testing. We disclose PHI to authorized healthcare professionals who need access to your test results in order to treat you.
• Payment: We may use or disclose PHI to obtain payment for the testing services we have provided. For example, we may use and disclose your PHI to bill you or your health insurer for such lab tests.
• Health Care Operations: We may use and disclose your PHI for activities necessary to support and run our business, such as performing quality verification or internal audits.

We may disclose your PHI to other individuals or third parties, called "business associates," such as consultants, subcontractors, or auditors, who help us with our business activities. If we share your PHI with business associates, they are required to maintain the privacy and security of your information.

Other Permitted Uses and Disclosures Without Your Authorization

We also may use and/or disclose PHI without your authorization for the following purposes:

• When Required By Law: We may use and disclose PHI for judicial and administrative proceedings pursuant to court or administrative order or to report information related to victims of abuse, neglect, or domestic violence where required by law to do so.
• For Health and Safety Purposes: We may use and disclose PHI to avert a serious threat to the health or safety of you or any other person; to an authorized public health authority or individual to perform public health and safety activities, such as preventing or controlling disease, injury, or disability or to report vital statistics such as birth or death; or to meet the reporting and tracking requirements of governmental agencies, such as the Food and Drug Administration.
• For Law Enforcement, Specialized Government, or Regulatory Functions: We may use and disclose PHI for intelligence, national security activities, security clearance activities and protection of public officials; and to health oversight agencies for audits, examinations, investigations, inspections, and licensures.
• For Licensing and Accreditation: We may use and disclose PHI to organized committees and agents of professional societies, staffs of licensed health care providers, professional standards review organizations, independent medical review organizations, or peer review organizations in order to review the competence or qualifications of health care professionals or in reviewing health care services with respect to medical necessity, level of care, quality of care, or justification of charges.
• For Lawsuits, Disputes, and Other Legal Actions: We may use and disclose PHI in connection with lawsuits or other legal proceedings, in response to a court or administrative order, or in response to a subpoena, warrant, summons, or other lawful process when certain requirements are met.
• For Active Members of the Military and Veterans: We may use and disclose PHI to comply with the laws and regulations governing military services and veterans' affairs.
• For Workers' Compensation: We may use and disclose PHI to comply with the laws which provide benefits for work-related illnesses or injuries.
• In Emergency Situations: We may use and disclose PHI to a family member or close personal friend involved in your care in the event of an emergency or to a disaster relief entity in the event of a disaster.
• To Others Involved in Your Care: We may use and disclose PHI under limited circumstances, to a member of your family, a relative, a close friend, or other person who is directly involved in your health care or payment of bills related to your health care; or, if you are seriously injured and unable to make a health care decision for yourself, we may disclose your PHI to a family member if we determine that disclosure is in your best interest.
• To Personal Representatives: We may use and disclose PHI to people you have authorized to act on your behalf, or people who have a legal right to act on your behalf, such as parents for un-emancipated minors and individuals who have Power of Attorney for adults.
• For Research Purposes: We may use and disclose PHI for research purposes to the extent that certain steps required by law are taken to protect your privacy.
• For Organ, Eye and Tissue Donation: If you are an organ donor, we may use and disclose PHI to an organ or procurement organization to facilitate an organ, eye, or tissue donation and transplantation.
• Regarding Deceased Individuals: If you pass away, we may use and disclose PHI to coroners, medical examiners, and funeral directors so those professionals may perform their duties.
• To Correctional Facilities: If you are an inmate in a correctional facility, we may use and disclose PHI for certain purposes, such as providing health care to you or protecting your health and safety or that of others.

Any Other Uses and Disclosures Require Your Express Authorization

For any other uses and disclosures of PHI not described in this Notice, including certain marketing activities or for the sale of PHI, we will first obtain your written authorization. You may revoke your authorization, in writing, at any time. If you revoke your authorization, we will no longer use or disclose PHI except to the extent we have taken action in reliance on your authorization.

De-Identification of PHI

We may de-identify your PHI by removing identifying features as determined by law to make it extremely unlikely that the information could identify you.

YOUR RIGHTS REGARDING YOUR PHI

You have the following rights regarding your PHI. To exercise any of these rights, please contact the Privacy Officer using the contact information provided at the end of this Notice.

Right to Request Restrictions: You have the right to request restrictions on our use or disclosure of your PHI to carry out treatment, payment, or health care operations. You may also ask that we limit the information we give to someone who is involved in your care, such as a family or friend. Please note that we are not required to agree to your request (unless otherwise required by law) except where you have paid for an item or service in full out-of-pocket and request that we not disclose information about that item or service to your health plan. If we do agree, we will honor your limits unless it is an emergency situation.

Right to Receive Confidential Communications or Communications by Alternative Means or at an Alternative Location: You have the right to request that we communicate with you by another means or at a different address. For example, you may request that we contact you at home rather than at work. Your request must be made in writing and include information on how payment, if any, will be handled and specify an alternative address or method of contact. We will accommodate all such reasonable requests.

Right to Inspect and Copy: You have the right to request to inspect and receive a copy of your PHI that we maintain in a designated record set. Your request must be made in writing. We may charge a reasonable fee for the cost of producing and mailing the copies. In certain situations, we may deny your request and will tell you why we are denying it. In some cases you may have the right to ask for a review of our denial.

Right to Amend: You have the right to request that we amend your PHI that is maintained in a designated record set if you believe the information is incorrect or incomplete. Your request must be made in writing and include a detailed description of what information you seek to amend and the reasons that support your request. We may deny your request in certain situations. We will notify you in writing as to whether it accepts or denies your request for an amendment.

Right to Receive an Accounting of Disclosures: You have the right to request an "accounting" of certain disclosures of your PHI. The accounting describes when we disclosed your PHI and to whom that disclosure was made for certain types of disclosures. The accounting does not include disclosures for treatment, payment, and health care operations; disclosures made to or authorized by you; and certain other disclosures. Your request for an accounting of disclosures must be made in writing and you may request an accounting of disclosures made up to six years before your request. You may receive one such accounting per year at no charge. If you request another accounting during the same 12 month period, we may charge you a reasonable fee; however, we will notify you of the cost involved before processing the accounting.

Right to Request a Paper Copy of this Notice: You have a right to request a paper copy of this Notice at any time.

COMPLAINTS

If you feel your privacy rights have been violated, you have the right to file a complaint with us and/or the Secretary of the Department of Health and Human Services. To file a complaint with us, please contact the Privacy Officer using the contact information provided at the end of this Notice. We will not retaliate against you for filing a complaint.

CONTACT US

If you want to exercise any of the rights described above or to file a complaint, please contact our Privacy Officer as follows:

Attn: Privacy Officer
privacy@valarlabs.com
(888) 862-0232
Valar Labs
1200 Binz St #660
Houston, TX 77004

You may also contact our Privacy Officer if you have questions about this Notice or would like additional information about our privacy practices.