Terms of Service and Privacy Policy

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU OR YOUR CHILD MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Who this Notice applies to

This Notice of Privacy Practices (this "Notice") applies to Hey Nouri Medical Services, P.A. and its workforce members, clinicians, contractors, and business associates that help it provide healthcare services (collectively, the "Practice," "we," "us," or "our").

Naeven Health Inc. acts as the management services organization supporting certain non-clinical administrative, operational, technology, customer support, and business functions for the Practice. Naeven Health Inc. does not practice medicine and does not control clinical decision-making. Where Naeven Health Inc. handles protected health information on the Practice's behalf, it does so as a business associate under a written business associate agreement.

Because Hey Nouri provides pediatric-focused services, this Notice applies to protected health information relating to a child and to information provided by a parent, legal guardian, or other authorized representative acting on the child's behalf, as permitted by law.

Our legal duties

We are required by law to maintain the privacy and security of protected health information, to provide you with this Notice describing our legal duties and privacy practices with respect to that information, to notify you following a breach of unsecured protected health information, and to abide by the terms of the Notice currently in effect.

We reserve the right to change this Notice and to make the revised Notice effective for protected health information we already hold as well as information we create or receive in the future. If we make a material change, we will post the revised Notice on heynouri.com, update the effective date above, and make a copy available to you on request. You may request a paper copy of this Notice at any time, even if you have agreed to receive it electronically.

What is protected health information

Protected health information, or PHI, is individually identifiable health information that relates to the past, present, or future physical or mental health or condition of an individual, the provision of healthcare to an individual, or the past, present, or future payment for healthcare.

PHI may include, for example: names, dates of birth, and contact details; symptoms, diagnoses, medications, allergies, treatment history, and care plans; height, weight, BMI and BMI percentile, growth and pubertal development, nutrition, behavior, activity, sleep, and laboratory information; chart notes, progress updates, appointment records, and communications with clinicians; and insurance, billing, claims, and payment information.

How we may use and disclose PHI without your written authorization

A. Treatment. To provide, coordinate, or manage healthcare and related services, including reviewing health history, evaluating symptoms, communicating with clinicians and other providers, prescribing medications, ordering laboratory tests, and creating care plans.

B. Payment. For payment-related purposes, including insurance eligibility verification, prior authorization, claims submission, billing, collections, and utilization review.

C. Health care operations. For healthcare operations, including quality assessment and improvement, outcomes review, staff training, credentialing, compliance, auditing, and practice management.

D. Appointment reminders and care communications. To contact you regarding appointments, follow-up care, forms, prescriptions, laboratory requests, treatment coordination, onboarding, and other service-related matters. You may request that we contact you by an alternative means or at an alternative location.

E. Individuals involved in care or payment. Where permitted by law, to a parent, guardian, caregiver, family member, or other person involved in the patient's care or payment for care.

F. Business associates. To third-party vendors and service providers that help us operate the practice, such as electronic health record vendors, billing providers, laboratories, pharmacies, communication platforms, and cloud hosting providers. Each is bound by a written agreement requiring it to safeguard PHI.

G. As required by law. When required by federal, state, or local law.

H. Public health and safety. For public health activities, including reporting to public health authorities, and when necessary to prevent or lessen a serious and imminent threat to health or safety.

I. Abuse, neglect, or domestic violence. To appropriate government authorities where we reasonably believe a patient is a victim of abuse, neglect, or domestic violence, as required or permitted by law. Because we serve minors, our clinicians are mandated reporters in the states where they are licensed.

J. Health oversight, legal process, and law enforcement. To health oversight agencies, in judicial or administrative proceedings, or to law enforcement officials, when permitted or required by law.

K. Research and other permitted uses. For research or other purposes only as permitted by HIPAA and other applicable law. Research uses require either your authorization, an approved waiver from an institutional review board or privacy board, or use of a limited or de-identified data set.

L. Workers' compensation, military, and specialized government functions. As authorized by and to the extent necessary to comply with applicable law.

Uses and disclosures that require your written authorization

We will obtain your written authorization before using or disclosing PHI for any purpose not described above, including for marketing purposes, for the sale of PHI, and for most uses and disclosures of psychotherapy notes. You may revoke an authorization in writing at any time, except to the extent we have already acted in reliance on it.

We do not sell PHI. We do not use PHI to send you marketing communications without your separate written authorization.

Your rights

Subject to applicable law, you have the right to:

• Inspect and obtain a copy of PHI in a designated record set, including in electronic form where we maintain it electronically. We will respond within 30 days and may charge a reasonable, cost-based fee.
• Request an amendment of PHI you believe is incorrect or incomplete. We may deny the request and will explain why in writing.
• Request an accounting of certain disclosures we have made in the six years prior to your request.
• Request restrictions on certain uses and disclosures. We are not required to agree, except that we must agree to a request not to disclose information to a health plan where you have paid for the service in full out of pocket.
• Request confidential communications by alternative means or at alternative locations.
• Obtain a paper copy of this Notice on request.
• Be notified following a breach of unsecured PHI when required by law.
• Revoke an authorization you previously gave, in writing.

Minors, parents, and adolescent confidentiality

In most circumstances, a parent or legal guardian is the personal representative of a minor patient and may exercise the rights described above on the patient's behalf.

State law limits this in certain situations. Depending on the state, an adolescent may have the right to consent to certain categories of care on their own, and where that is the case, the related records may not be disclosed to a parent or guardian without the adolescent's agreement. We may also decline to treat a parent or guardian as the personal representative where we reasonably believe doing so could endanger the patient, or where required by state law or a court order.

Where custody is shared or contested, we may require documentation of legal authority before providing records or accepting instructions.

If you have questions about what a parent or guardian can access in a particular circumstance, contact us at info@heynouri.com.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint.

To complain to us, contact our Privacy Officer: Stef Trepekli Hey Nouri Medical Services, P.A. 1 Minetta Street 6D 10012 NYC NY Phone: 332 296 2509 Email: info@heynouri.com

To complain to the Office for Civil Rights, visit https://www.hhs.gov/ocr/complaints or call 1-800-368-1019.

This Privacy Policy explains how we handle personal information that is not protected health information governed by the HIPAA Notice above. This generally includes information collected from visitors to our website, prospective patients who have not yet entered a treatment relationship, job applicants, and users of public tools such as our BMI calculator.

Where information is PHI held by the Practice, the HIPAA Notice in Section 1 governs, and HIPAA takes precedence over the general privacy rights described here.

Information we collect

Information you give us. Name, email address, phone number, mailing address, the state you are located in, insurance information, information you enter into intake forms or public tools such as the BMI calculator, and the content of messages you send us.

Information collected automatically. IP address, device and browser type, operating system, application version, pages viewed, referring URL, approximate location derived from IP address, and interaction events. See Section 5 for how we use cookies and similar technologies.

Information from others. Your health plan or employer where they refer you or verify eligibility, healthcare providers who refer you with your authorization, and service providers who help us verify identity or eligibility.

How we use it

To respond to your inquiries; determine whether our program may be a fit; verify insurance eligibility; create and administer accounts; provide and improve the website and app; communicate with you where you have consented; measure the performance of our marketing; maintain security and prevent fraud; and comply with legal obligations.

How we share it

We share personal information with service providers acting on our behalf under contract, including hosting, analytics, communications, customer support, and payment processors; with your health plan where relevant to coverage; with professional advisors; with government authorities where required by law; and in connection with a merger, acquisition, or sale of assets, subject to the protections described in this policy.

We do not sell personal information for money. Depending on how advertising and analytics technologies are configured, some disclosures may qualify as "sharing" for cross-context behavioral advertising or as a "sale" or "targeted advertising" under certain state laws. See Sections 5 and 8 for how to opt out.

Security

We maintain administrative, physical, and technical safeguards designed to protect personal information, including encryption in transit and at rest, access controls and role-based permissions, logging and monitoring, workforce training, and vendor due diligence. No system is perfectly secure, and we cannot guarantee absolute security.

International users

Our services are intended for individuals located in the United States. We do not offer services to individuals outside the United States, and information we collect is stored and processed in the United States.

We retain personal information and PHI only for as long as necessary to fulfill the purposes for which it was collected, to provide and administer care, and to meet our legal, regulatory, professional, accreditation, tax, and accounting obligations. When information is no longer needed for those purposes, we securely destroy it or de-identify it so that it can no longer be linked to an individual.

Retention schedule

A. Medical and clinical records. Intake and questionnaire responses, growth, weight, and biometric history, clinician notes and care plans, laboratory orders and results, prescriptions, and clinical messaging are retained for a minimum of seven years after the last date of service. Where services were provided to a minor, these records are retained until the patient reaches 18 years of age and for a minimum of seven years after that date, or for a longer period where applicable state medical-record retention law requires it.

B. Account and profile data. Names, email addresses, phone numbers, account credentials, parent and child profile details, device identifiers, and push notification tokens are retained while the account is active and for up to 24 months following account closure or last account activity, after which they are deleted or de-identified. Data that also forms part of the medical record is retained under paragraph A.

C. Telehealth recordings, transcripts, and summaries. Where a visit is recorded with consent, the recording and any transcript or automatically generated summary are retained only as long as required to complete and verify clinical documentation, and in no event longer than 12 months. Clinical documentation derived from them is retained under paragraph A.

D. Billing, insurance, and payment records. Claims, invoices, eligibility and prior-authorization records, remittances, and payment history are retained for seven years from the date of the transaction to satisfy tax, audit, payer, and healthcare-claims requirements. Full payment card numbers are processed by our payment processor and are not stored on our systems.

E. HIPAA documentation. Authorizations, acknowledgments, consent forms, restriction requests, accountings of disclosures, business associate agreements, and related HIPAA compliance documentation are retained for at least six years from the date of creation or the date last in effect, whichever is later, as required by 45 C.F.R. § 164.530(j).

F. SMS, email, and marketing records. Records evidencing consent and opt-out are retained for at least five years so that we can demonstrate consent and honor opt-out requests. Contact information for prospective patients who do not enter into a treatment relationship is deleted or de-identified within 24 months of the last interaction. Following an unsubscribe or STOP request, we retain a minimal suppression record so that we do not re-contact you.

G. Support and administrative communications. Support tickets, emails, and other non-clinical correspondence are retained for three years from the date of the last message, unless they form part of the medical record.

H. Analytics, device, and log data. Cookie, analytics, and device data, including IP address, application version, and usage events, is retained for up to 26 months. Server, security, audit, and crash logs are retained for up to 12 months, except where a longer period is required for security investigation or legal compliance.

I. Public tool inputs. Height, weight, age, and similar values entered into the BMI calculator or other public tools by visitors who do not create an account are not associated with an identified individual and are retained in aggregate or de-identified form only.

J. Backups. Systems are backed up on an encrypted, rolling basis. Data deleted from live systems may persist in backup media until those backups expire, which occurs within 90 days.

Legal holds and extended retention

We may retain information beyond the periods stated above where required by law, or where the information is subject to an open claim, dispute, audit, government investigation, or litigation hold. Retention is extended only for as long as the underlying obligation applies.

Requesting deletion

You may request deletion of your account and associated data at any time by selecting "Delete Account" in the Nouri mobile app or by emailing info@heynouri.com. After we verify the request, we will close the account and delete or de-identify personal information within 30 days, except for records we are required to retain under the schedule above, which are destroyed securely at the end of the applicable retention period. We will inform you of any categories of information we are required to retain and the basis for doing so.

Medical records generally cannot be deleted on request. State medical-record retention law and professional licensing rules require us to keep them, and this is for your protection as well as ours.

Uninstalling the mobile application does not, by itself, delete data already stored on our systems.

Secure disposal

Electronic records are destroyed using secure deletion methods, and paper records, where any exist, are shredded or otherwise rendered unreadable, in accordance with HIPAA requirements for the disposal of PHI.

These Terms of Use (the "Terms") govern your access to and use of the websites, applications, digital tools, content, communications, and related services made available by Naeven Health Inc. and Hey Nouri Medical Services, P.A. (collectively, "Hey Nouri," "we," "us," or "our"). By accessing or using our services, you agree to these Terms. If you do not agree, do not use the services.

These Terms contain an arbitration agreement and a class action waiver in the section titled "Dispute Resolution." They affect your legal rights. Claims relating to clinical care are excluded from arbitration. Please read that section carefully.

Eligibility and accounts

You must be at least 18 years old to use the services on your own behalf, or the parent or legal guardian of a minor for whom you are seeking services. Accounts are created and held by an adult. Where a patient under 18 is given access to the Nouri app, that access is provisioned by the account-holding parent or guardian, who is responsible for supervising it. See Section 7.

You are responsible for the accuracy of the information you provide, for maintaining the confidentiality of your credentials, and for activity that occurs under your account. Notify us promptly at info@heynouri.com if you believe your account has been compromised.

No emergency services

THE SERVICES ARE NOT FOR MEDICAL EMERGENCIES. IF YOU THINK YOU OR YOUR CHILD MAY HAVE A MEDICAL EMERGENCY, CALL 911 OR GO TO THE NEAREST EMERGENCY ROOM IMMEDIATELY.

Our clinicians cannot connect you to local emergency services.

The clinical relationship

Clinical services are provided by licensed clinicians employed by or contracted with Hey Nouri Medical Services, P.A., not by Naeven Health Inc. Clinical judgment rests solely with the treating clinician. Nothing in these Terms limits a clinician's professional or ethical obligations, and no provision of these Terms should be read to interfere with the exercise of independent medical judgment.

A clinician may decline to provide or continue care where, in their professional judgment, the program is not appropriate for a patient.

Acceptable use

You may not: violate any applicable law; impersonate another person or misrepresent your identity, age, or location; interfere with the operation or security of the services; scrape, harvest, or extract data without permission; upload malicious code; use the services to harm, harass, threaten, or defraud others; reverse engineer the services; use the services to develop a competing product; or attempt unauthorized access to systems or data.

Payments and memberships

If you enroll in paid services, you agree to pay all applicable fees, recurring charges, cancellation fees, rescheduling fees, no-show fees, or other charges disclosed to you at enrollment or purchase. See Section 13.

Intellectual property

All content, branding, software, text, graphics, designs, logos, and materials made available through the services are owned by or licensed to Hey Nouri and protected by intellectual property law. We grant you a limited, revocable, non-exclusive, non-transferable license to use the services for your own personal, non-commercial use in connection with receiving care. All rights not expressly granted are reserved.

Feedback

If you send us suggestions or feedback, we may use them without obligation or compensation to you.

Third-party services

The services may link to or integrate third-party services, including pharmacies, laboratories, and payment processors. We do not control those services and are not responsible for their content, practices, or terms. Your use of them is governed by their own agreements.

Term and termination

You may stop using the services at any time. We may suspend or terminate your access to the non-clinical services at any time, with or without notice, for any violation of these Terms or where we reasonably believe it is necessary to protect the services or other users. Termination of app or website access does not by itself terminate a clinician-patient relationship, which will be concluded in accordance with professional obligations, including reasonable notice and assistance in transitioning care where required.

Sections that by their nature should survive termination will survive, including intellectual property, disclaimers, limitation of liability, indemnification, and dispute resolution.

Disclaimer of warranties

TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE WEBSITE, APPLICATION, AND OTHER NON-CLINICAL TECHNOLOGY SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE," WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED OR ERROR-FREE.

THIS DISCLAIMER DOES NOT APPLY TO CLINICAL SERVICES. Clinical services are provided in accordance with applicable professional standards of care, and nothing in these Terms disclaims, limits, or waives any duty owed by a licensed clinician to a patient.

Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, HEY NOURI SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES ARISING OUT OF YOUR USE OF THE WEBSITE OR APPLICATION.

FOR CLAIMS ARISING OUT OF THE WEBSITE OR APPLICATION AND NOT INVOLVING CLINICAL CARE, OUR TOTAL AGGREGATE LIABILITY SHALL NOT EXCEED THE GREATER OF (A) THE AMOUNT YOU PAID TO US IN THE TWELVE MONTHS BEFORE THE CLAIM AROSE OR (B) ONE THOUSAND DOLLARS ($1,000).

THE LIMITATIONS IN THIS SECTION DO NOT APPLY TO, AND WE DO NOT SEEK TO LIMIT OR EXCLUDE LIABILITY FOR: (I) PROFESSIONAL NEGLIGENCE OR MEDICAL MALPRACTICE; (II) DEATH OR PERSONAL INJURY; (III) GROSS NEGLIGENCE, RECKLESSNESS, FRAUD, OR WILLFUL MISCONDUCT; (IV) VIOLATIONS OF HIPAA OR APPLICABLE PRIVACY LAW; OR (V) ANY OTHER LIABILITY THAT CANNOT LAWFULLY BE LIMITED OR EXCLUDED.

Some states do not allow certain exclusions or limitations, so some of the above may not apply to you.

Indemnification

You agree to indemnify and hold harmless Hey Nouri and its officers, directors, employees, and agents from claims arising out of your violation of these Terms, your misuse of the services, or your violation of the rights of a third party. This does not apply to claims arising from our own negligence or misconduct, and does not require you to indemnify us for claims relating to the care we provided.

Dispute resolution

Claims relating to clinical care are excluded. Any claim of professional negligence, medical malpractice, or personal injury arising out of clinical services is expressly excluded from the arbitration agreement below and may be brought in court.

Informal resolution first. Before filing any claim, you agree to contact us at info@heynouri.com and give us 60 days to attempt to resolve the dispute informally.

Arbitration. Except as excluded above, any dispute arising out of or relating to these Terms or the non-clinical services will be resolved by binding individual arbitration administered by the American Arbitration Association under its Consumer Arbitration Rules. Arbitration will take place in the county where you reside or, at your election, by videoconference or on documents alone. The arbitrator's award may be entered in any court of competent jurisdiction.

Exceptions. Either party may bring an individual claim in small claims court, and either party may seek injunctive relief in court to protect intellectual property or address unauthorized access.

Class action waiver. You and Hey Nouri each agree that claims will be brought only in an individual capacity, and not as a plaintiff or class member in any purported class or representative proceeding. If this waiver is found unenforceable as to a particular claim, that claim will proceed in court.

Your right to opt out. You may opt out of this arbitration agreement by emailing info@heynouri.com with your name and a statement that you decline arbitration, within 30 days of first accepting these Terms. Opting out will not affect any other part of these Terms and will not affect your care.

Governing law. These Terms are governed by the laws of the State of Florida without regard to conflict-of-laws principles, except that the Federal Arbitration Act governs the arbitration agreement. Nothing in this section deprives you of the protection of mandatory consumer-protection laws of the state where you reside.

General

Severability. If any provision is found unenforceable, it will be limited or severed to the minimum extent necessary, and the remaining provisions remain in effect.

No waiver. Our failure to enforce a provision is not a waiver of it.

Assignment. You may not assign these Terms. We may assign them in connection with a merger, acquisition, or sale of assets.

Force majeure. Neither party is liable for delays or failures caused by events beyond its reasonable control.

Entire agreement. These Terms, together with the policies referenced here and any consents or agreements you sign at intake, are the entire agreement between you and us regarding the non-clinical services.

Contact. info@heynouri.com

This notice explains how we use cookies and similar technologies on Hey Nouri's websites, applications, and digital properties.

Categories we use

Strictly necessary. Security, authentication, session management, load balancing, and core site functionality. These cannot be disabled through our preference center.

Functional. Remembering preferences and improving the user experience.

Analytics. Understanding site usage, engagement, and performance. We use Curve Analytics as well as Google Analytics.

Advertising and measurement. We use Curve for HIPAA-compliant conversion tracking.

Your choices

Cookie preference center. Manage non-essential cookies at any time through the "Cookie Preferences" link in our website footer.

Global Privacy Control. We honor the Global Privacy Control (GPC) browser signal as a valid request to opt out of sale and sharing where applicable law requires it.

Do Not Sell or Share My Personal Information. We do not sell or share personal information and no opt-out is necessary.

Browser and device settings. You can also manage cookies through your browser settings and limit ad tracking through your device settings.

Contact: info@heynouri.com

These terms describe our SMS program. Consent to receive messages is collected separately at the point of signup, not by your use of this website.

Two separate consents. We ask for your consent to care-related messages and your consent to promotional messages separately. You may agree to one and not the other.

Care-related messages include appointment reminders and confirmations, scheduling changes, forms and intake reminders, prescription and laboratory notifications, and messages from your care team.

Promotional messages include program updates, offers, and other marketing content.

Consent is not a condition of purchase. You are not required to agree to promotional messages in order to receive care or to purchase any goods or services from us.

Message frequency. Approximately 2 to 4 messages per month for promotional messages. Care-related message frequency varies based on your care plan.

Rates. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages.

Help and opt-out. Reply HELP for assistance or STOP to opt out at any time. After you send STOP, we will send one confirmation message and no further messages of that type. You may also contact us at info@heynouri.com. Opting out of promotional messages does not opt you out of care-related messages, and opting out of care-related messages may affect our ability to coordinate your care.

No sharing for third-party marketing. We do not share, sell, or rent your mobile phone number or information collected through SMS to third parties for their own marketing purposes. We share it with our messaging vendors solely to deliver our own messages, under contract.

Not for emergencies. Do not use SMS for medical emergencies. Call 911 or seek emergency care immediately.

Contact: info@heynouri.com

Hey Nouri serves patients aged 10 to 18. Because of this, we handle children's information with particular care.

Accounts are held by adults. Only a parent or legal guardian aged 18 or older may create an account, enroll a patient, and agree to these Terms. We do not knowingly permit a child to create an account independently.

Parental consent. Where a patient under 13 is given access to the Nouri app or where we otherwise collect personal information directly from a child under 13, we obtain verifiable parental consent from the account-holding parent or guardian before doing so, consistent with the Children's Online Privacy Protection Act (COPPA). The parent or guardian may review the information we have collected from their child, request that we delete it, and refuse to permit further collection, by contacting info@heynouri.com.

What we collect from patients under 13. Name, date of birth, height, weight, activity and habit tracking entered in the app, and messages to the care team. We collect only what is reasonably necessary to provide care and to operate the app.

We do not use children's information for advertising. We do not serve behavioral advertising to patients, do not use patient information to build advertising audiences, and do not disclose children's personal information to third parties for their own purposes.

Health information is separately governed. Information collected in the course of providing care is PHI and is governed by the HIPAA Notice in Section 1, which in most cases applies in place of COPPA's requirements.

If you believe we have collected information from a child in a way inconsistent with this section, contact info@heynouri.com and we will investigate promptly.

Important scope note. Most state consumer privacy laws exempt protected health information held by a HIPAA covered entity and medical information governed by state medical-confidentiality statutes. If you are a patient, the rights in Section 1 generally govern your health information, and the rights below apply to information that falls outside that scope, such as website browsing data and prospective-patient inquiries.

California

Notice at collection. We collect the following categories of personal information: identifiers (name, email, phone, postal address, IP address, account identifiers); customer records information; characteristics of protected classifications where voluntarily provided; commercial information; internet or other electronic network activity; geolocation data; audio or visual information; professional or employment information (job applicants); education information (job applicants); inferences; and sensitive personal information, including health information and account log-in credentials.

Sources. Directly from you; automatically from your device; from your health plan; from referring providers with your authorization; and from service providers.

Purposes. As described in Section 2.

Disclosure. We disclose personal information to service providers and contractors, to your health plan, to professional advisors, and to government authorities where required by law.

Sensitive personal information. We use and disclose sensitive personal information only for the purposes permitted under the CCPA without a right to limit, such as providing the services you request, security, and legal compliance. We do not use it to infer characteristics about you.

Retention. As described in Section 3.

Sale and sharing. We do not sell personal information for money.

Your rights. To know, access, correct, delete, opt out of sale or sharing, limit the use of sensitive personal information, and not be discriminated against for exercising these rights. Submit requests at info@heynouri.com . We will verify your identity before responding. An authorized agent may submit a request on your behalf with written permission. If we deny your request, you may appeal by replying to our decision.

Colorado, Connecticut, Delaware, Indiana, Iowa, Maryland, Minnesota, New Jersey, Texas

Residents of these states may have the right to confirm whether we process their personal data, access and obtain a copy of it, correct inaccuracies, delete it, and opt out of targeted advertising, sale, and certain profiling. Some states also provide a right to appeal a denial. Submit requests at info@heynouri.com. If we deny a request, you may appeal by replying to our response, and we will inform you of the outcome within the period required by your state's law. Residents of some states may also contact their state attorney general with concerns.

This notice applies to consumer health data that is not protected health information governed by HIPAA. For most patients, health information is PHI and Section 1 applies instead. This notice principally covers people who visit our site, use our BMI calculator, or make an inquiry without becoming a patient.

What we collect. Information you enter into public tools, including a child's age, height, and weight; information you provide in inquiries about weight, health conditions, medications, or eligibility; and information that could reasonably indicate an interest in seeking weight-related healthcare, such as pages viewed and forms started.

How we use it. To respond to your inquiry, determine whether our program may be a fit, provide the tool you requested, improve our services, and maintain security.

Who we share it with. Service providers acting on our behalf under contract, including hosting, analytics, and communications vendors. We do not sell consumer health data. We will not sell consumer health data without your separate, valid written authorization.

Your rights. You have the right to confirm whether we collect, share, or sell your consumer health data; to access it, including a list of third parties with whom we have shared it; to withdraw consent to its collection and sharing; and to have it deleted. To exercise these rights, email info@heynouri.com. We will respond within 45 days, with one possible 45-day extension. If we deny your request, you may appeal by replying to our decision, and we will respond within 45 days. If your appeal is denied, you may contact the Washington Attorney General at https://www.atg.wa.gov/file-complaint.

Deletion. On a valid deletion request we will delete consumer health data from our records, including from archives and backups, and direct our processors to do the same, except where retention is required by law.

Telehealth consent is obtained from a parent or legal guardian at intake, before care begins, through a separate signed consent. The summary below is provided for reference and does not replace the signed consent.

Telehealth means care delivered using video, audio, messaging, or other electronic communication, where the patient and clinician are in different locations. Telehealth carries risks that in-person care does not, including technology failures, limits on a clinician's ability to respond to an emergency, the possibility that a condition observable in person is not identified remotely, and the risk, however small, of an unauthorized interception of communications.

Participation is voluntary. You may withdraw consent to telehealth at any time without affecting the right to future care. The patient must be physically located in a state where the treating clinician is licensed at the time of the visit. Records of telehealth visits are part of the medical record and are protected by the same federal and state privacy laws that apply to in-person care.

Questions: info@heynouri.com

Content on the Hey Nouri website, app, social media channels, blog, emails, and other public-facing materials is for general informational and educational purposes only unless expressly provided as part of a clinician-patient relationship. Public-facing content is not medical advice, is not a diagnosis, is not treatment, does not create a clinician-patient relationship by itself, and should not be relied upon in emergencies.

Our BMI calculator and similar tools are educational. BMI and BMI percentile are screening measures, not diagnoses. They do not account for body composition, growth stage, or individual health history, and a result from a calculator should never be used on its own to make decisions about a child's care.

Always seek the advice of a qualified healthcare provider for questions regarding a medical condition. If you believe you or your child may have a medical emergency, call 911 or seek emergency care immediately.

You consent to electronic records and signatures at the point of signup, through a separate affirmative acknowledgment. This section describes what that consent covers.

What we deliver electronically. Agreements and policy updates, appointment and account notices, billing notices, receipts, and Good Faith Estimates, disclosures and consent forms, and operational and support communications.

Legal effect. Electronic signatures, acknowledgments, and records have the same legal effect as paper versions under the Electronic Signatures in Global and National Commerce Act (E-SIGN) and applicable state law.

What you need. A device with internet access, a current web browser, a valid email address, sufficient storage or a printer to retain records, and the ability to open PDF files.

Paper copies. You may request a paper copy of any record we have provided electronically, free of charge, by contacting info@heynouri.com.

Withdrawing consent. You may withdraw consent to electronic records at any time by contacting info@heynouri.com. Withdrawal takes effect once we have processed it and does not affect the validity of records provided before then. Withdrawal may limit your ability to use some services.

Keeping your information current. Notify us promptly if your email address or phone number changes.

Payment

Fees, membership charges, copays, coinsurance, deductibles, self-pay obligations, and other charges are due as disclosed at enrollment or scheduling. We may keep a payment method on file where permitted. Insurance coverage, reimbursement, prior authorization, and eligibility are not guaranteed unless expressly stated. Where insurance does not cover a service, the guarantor is responsible for the balance.

Good Faith Estimate (No Surprises Act)

If you are uninsured or choose not to use insurance, you have the right to receive a Good Faith Estimate of the expected charges for your care. We will provide one automatically when you schedule, and at any time on request. If you receive a bill that is at least $400 more than your Good Faith Estimate, you may dispute it. For more information, visit https://www.cms.gov/nosurprises or call 1-800-985-3059. Keep a copy of your Good Faith Estimate.

Cancellations and rescheduling

Patients may be required to cancel or reschedule within a stated notice window of 24 hours. Missed visits, late cancellations, or repeated rescheduling may result in fees, forfeited sessions, or service limitations. Fee amounts are disclosed at enrollment.

No-shows

A no-show occurs when a scheduled visit is missed without adequate notice. Repeated no-shows may lead to fees, scheduling restrictions, or discontinuation from certain services. Where a patient is discontinued, we will provide reasonable notice and assistance in transitioning care consistent with professional obligations.

No-show or cancellation fees are not billed to insurance and are the responsibility of the guarantor.

Refunds

Refund eligibility, if any, depends on the service type, plan terms, timing, and applicable law. Questions: info@heynouri.com .

Hey Nouri Medical Services, P.A. complies with applicable federal civil rights laws and does not discriminate on the basis of race, color, national origin, age, disability, or sex, including sex characteristics, sexual orientation, gender identity, and pregnancy or related conditions.

We provide free aids and services to people with disabilities to communicate effectively with us, including qualified interpreters and written information in other formats. We provide free language services to people whose primary language is not English, including qualified interpreters and information written in other languages.

To request these services, contact info@heynouri.com.

If you believe we have failed to provide these services or discriminated in another way, you may file a grievance with our Civil Rights Coordinator: info@heynouri.com

You may also file a civil rights complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at https://ocrportal.hhs.gov/ocr/portal/lobby.jsf, or by mail or phone at U.S. Department of Health and Human Services, 200 Independence Avenue SW, Room 509F, HHH Building, Washington, DC 20201, 1-800-368-1019 (TDD 1-800-537-7697).

Hey Nouri respects the intellectual property rights of others. If you believe content hosted on our website or app infringes your copyright, send a notice to our designated agent with: your contact information; identification of the copyrighted work; identification of the allegedly infringing material and its location; a statement of good-faith belief that the use is unauthorized; a statement under penalty of perjury that the information is accurate and that you are authorized to act on behalf of the copyright owner; and your physical or electronic signature.

Designated agent: Naeven Health Inc.

We may remove or disable access to material alleged to be infringing, will notify the person who posted it, and will consider counter-notices submitted under 17 U.S.C. § 512(g). We terminate the accounts of repeat infringers in appropriate circumstances.

Hey Nouri is committed to making its digital properties accessible to as many people as possible. We aim to conform to the Web Content Accessibility Guidelines (WCAG) 2.1 Level AA and we test our website and app against that standard on an ongoing basis.

We know that some parts of our experience may not yet fully conform, and we treat accessibility as continuing work rather than a finished project.

If you experience difficulty accessing any content, feature, or functionality, contact us at accessibility@heynouri.com with a description of the issue and the page or feature involved. We will respond within 5 business days and will provide the information you were seeking in an alternative format while we work on a fix.

We welcome respectful engagement on Hey Nouri's social media channels. To keep these spaces safe for the families we serve, we may hide or remove comments and content that: include harassment, abuse, threats, or hate speech; shame or stigmatize people based on body size or weight; disclose private or medical information about any person; promote disordered eating, extreme restriction, or unsafe weight-loss practices; contain spam, scams, or misleading promotions; infringe intellectual property rights; or are unlawful, obscene, or otherwise inappropriate.

Please do not post personal health information in comments or direct messages. Social media is not a secure channel and is not monitored by clinicians. To reach your care team, use the Nouri app.

Our social media content is for general informational purposes only and is not medical advice.

We may update these policies from time to time. When we do, we will revise the "Last updated" date at the top of this page. Where a change is material, we will provide additional notice, such as an email or an in-app notification, before the change takes effect. Changes to the HIPAA Notice of Privacy Practices are handled as described in Section 1.

Your continued use of the services after a change takes effect means you accept the revised Terms of Use. If you do not agree, stop using the services and contact us at info@heynouri.com.