Required of the group health plan by 45 CFR §164.520. Distributed with the Summary Plan Description at enrollment, with a reminder of availability at least every three years.

Notice of Privacy Practices

The {{COMPANY_LEGAL_NAME}} Dental Plan

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Who this notice covers

The {{COMPANY_LEGAL_NAME}} Dental Plan (the "Plan") is required by law to protect the privacy of your health information, to give you this notice of its legal duties and privacy practices, and to follow the terms of the notice currently in effect.

Denta, Inc. administers the Plan and handles your health information on its behalf under a business associate agreement, which requires Denta to protect it on the same terms set out here.

How the Plan uses your health information

To pay for your care. The Plan uses your information to decide whether a service is covered, how much to pay, and to pay your dentist or reimburse you. This includes checking that you are eligible and applying your annual maximum.

To run the Plan. The Plan uses your information for activities such as reviewing how well it is working, arranging for administration, auditing, and resolving complaints and appeals.

For treatment. The Plan may share information with your dentist to help coordinate your care.

The Plan uses and discloses the minimum amount of information reasonably needed for these purposes.

Other times the Plan may use or share it

The Plan may use or disclose your information without your permission where the law requires or allows it, including:

• When required by law
• For public health activities, such as reporting disease or product safety
• To report suspected abuse, neglect, or domestic violence
• For health oversight activities such as audits and investigations
• In response to a court order, subpoena, or other lawful process
• For law enforcement purposes permitted by law
• To coroners, medical examiners, and funeral directors
• For workers' compensation claims
• To avert a serious and imminent threat to health or safety
• For specialized government functions, including military and national security

What the Plan will not do without your written permission

The Plan will not use or disclose your information for marketing, will not sell it, and will not disclose psychotherapy notes, except where the law permits it without authorization. Any other use or disclosure not described in this notice requires your written authorization, and you may revoke that authorization at any time in writing, except to the extent the Plan has already acted on it.

What your employer can and cannot see

{{COMPANY_LEGAL_NAME}} sponsors the Plan, and the Plan and the employer are treated as separate for privacy purposes.

The employer may receive summary information about the Plan as a whole, and may be told whether you are enrolled. It may only receive your individual health information after it has certified that it will protect it, and only employees it has designated as responsible for benefits administration may see it.

Your employer may never use your health information to make employment decisions, or in connection with any other benefit plan.

Your rights

See and get a copy. You may inspect and get a copy of your health information held by the Plan, usually within 30 days. The Plan may charge a reasonable, cost-based fee.

Ask for a correction. If you believe information is wrong or incomplete, you may ask the Plan to amend it. The Plan may decline, and will tell you why in writing, and you may submit a statement of disagreement.

Get a list of disclosures. You may ask for an accounting of certain disclosures the Plan made in the six years before your request.

Ask for limits. You may ask the Plan to restrict how it uses or shares your information. The Plan is not required to agree, but will tell you either way.

Ask for confidential communication. You may ask the Plan to contact you at a different address or by a different method if the usual way would endanger you. The Plan will accommodate reasonable requests.

Get a paper copy. You may ask for a paper copy of this notice at any time, even if you agreed to receive it electronically.

Be told about a breach. The Plan will notify you if a breach compromises the privacy or security of your information.

Choose someone to act for you. Someone with legal authority to act on your behalf, such as a parent of a minor child or a person with power of attorney, may exercise these rights for you.

Complaints

If you believe your privacy rights have been violated, you may complain to the Plan using the contact below, or to the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue S.W., Washington, D.C. 20201, or at hhs.gov/ocr/privacy/hipaa/complaints.

You will not be retaliated against for filing a complaint.

Changes to this notice

The Plan may change this notice and apply the changes to information it already holds. If it does, it will provide the revised notice within 60 days of a material change and make it available on request.

Contact

Questions about this notice, or requests to exercise any right above, go to the Plan's privacy contact:

Jack Beecher, HIPAA Security and Privacy Officer Denta, Inc., on behalf of the Plan jack@trydenta.com · (319) 830-1094

Effective date: the date the Plan first became effective for you, shown in your Summary Plan Description.