1. NOTICE OF PRIVACY AND CONFIDENTIALITY PRACTICES

Effective Date: February 16, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN ACCESS THIS INFORMTION. PLEASE REVIEW IT CAREFULLY.

This section provides information about how Hope Ranch, LLC (the “Company”) may use and disclose information about you and your substance use disorder records in compliance with state and federal laws and regulations. All clinical, clerical and support staff, volunteers, interns, students and contracted employees working for, in collaboration with or on behalf of Company are mandated to comply with the provisions set forth in this notice.

We provide substance use disorder treatment and mental health treatment services and certain records we create or receive are protected by the Health Insurance Portability and Accountability Act (“HIPAA”) and federal confidentiality law governing substance use disorder records under 42 CFR Part 2 (“Part 2”). In some cases, Part 2 provides additional protections beyond HIPAA.

We are committed to protecting the privacy of your health, mental health and substance abuse records (hereinafter collectively referred to as “PHI,” “protected health information,” or simply “your information” or “information”). When we use or disclose your information, we are required to abide by the terms of this notice in effect at the time of the use or disclosure. We are required to provide you with this notice of our legal duties and privacy and confidentiality practices, which are set forth below.

Our Legal Obligations As Mandated By 42 CFR Part 2

Part 2 mandates specific protection and restrictions for the disclosure and use of substance use disorder client information and records maintained by any federally assisted alcohol and drug abuse program. Records related to substance use disorder diagnosis, treatment or referral may be protected under Part 2. With your signature on the Informed Consent, you are authorizing the Company to use and disclose substance use disorder records for treatment, payment and health care operations as provided in HIPAA and as described in this notice. We may use and disclose your substance use disorder records as permitted by law, including pursuant to your written consent when required, and for other permitted or required disclosures. However, we will NOT use or disclose your substance use disorder records in any civil, criminal, administrative or legislative proceeding against you unless you provide specific written authorization; or a court issues an order that complies with Part 2 requirements after notice and an opportunity for you to be heard. In instances where Part 2 applies to your information, we will comply with its additional protections which may be in addition to HIPAA protections.

Our Legal Obligations As Mandated By HIPAA

The Company is also mandated to protect the privacy of your information in compliance with HIPAA with specific interest to the “Privacy Rule” stipulations delineated in 45 CFR Parts 160 and 164, Subparts A and E. The Privacy Rule permits uses and disclosures of PHI for “treatment, payment and health care operations” as well as certain other disclosures without the individual’s prior written authorization. Disclosures not otherwise specifically permitted or required by the Privacy Rule must have an authorization that meets certain requirements. With certain exceptions, the Privacy Rule generally requires that uses and disclosures of PHI be the minimum necessary for the intended purpose of the use or disclosure.

General Definition of Protected Health Information (PHI)

Protected health information (PHI) is any information in the medical record or designated record set that can be used to identify an individual and that was created, used, or disclosed in the course of providing a health care service such as diagnosis or treatment.

USE AND DISCLOSURE OF YOUR INFORMATION REQUIRING YOUR WRITTEN AUTHORIZATION

Signed Authorization Granting Permission For The Release Of Information

Generally, we can use or disclose your information to any individual, agency or entity designated by you with your express written authorization and in accordance with the restrictions and parameters defined by you in that authorization.

Revoking Authorization for the Release of Information

You may revoke any authorization that you have previously signed granting permission for the sharing of information between the Company and the recipient designated by you on the authorization at any time prior to the expiration date stated on the authorization. In order to revoke an authorization, you are required to notify the Company in a written signed statement including the specific revocation you desire. Upon receipt of your written notice of revocation, the Company will document the notice appropriately in your record and discontinue the release of any information as specified by you. The revocation will apply from the date the Company receives the notice on and will not apply to information that was released prior to the date the Company received the notice of revocation.

Treatment

We may use or disclose your information to persons in our program who have a need for the information in connection with their job duties. Such a need may arise in the context of treatment, including, but not limited to, assessment, diagnosis, psychotherapy, referral, and discharge planning. The Company utilizes a collaborative clinical team approach to providing treatment services. At times, members of the staff at the Company will require access to your information regardless of the type of services you are receiving (individual services, group services or a combination of the two). In addition, your information may need to be disclosed in clinical consultation with other team members in order to coordinate the delivery of the highest quality care.

For Billing of Services and Collection of Payment

We may use and disclose your information to bill and collect payment for services provided. For example, we may need to exchange information with your insurance company or other third-party payor to verify benefits and coverage, to pre-authorize services, to dispute denied claims and/or to negotiate payment rates. We may also provide relevant information to any “qualified service organizations” or “business associates” working in collaboration with the Company or on its behalf, including, but not limited to, billing clearinghouses, collection agencies, attorneys, and accountants. We require all qualified service organizations and business associates with access to protected health information to develop and comply with a mutually agreed upon qualified service organization and business associate agreement acknowledging their legal obligation to safeguard protected health information when receiving, storing, processing or otherwise dealing with client records as mandated by law.

Health Care Operations

We may use or disclose your protected health information for the purposes of health care operations, including without limitation, internal administration and planning and various activities that improve the quality and effectiveness of care. For example, we may use information related to the services you received to evaluate our clinical staff. We may disclose information to qualified personnel in the interest of capturing, analyzing, synthesizing and reporting outcomes statistics and for the purposes of conducting internal agency audits, licensure and compliance audits, and/or financial audits. Information used in generating statistics, outcomes-based conclusions or any other type of research/quality improvement initiative may not directly or indirectly identify any individual client. We may disclose your information as needed within the Company to resolve and/or adequately address any complaints or grievances that may occur in the course of your care. We may also disclose your protected health information to an agent or agency that provides services to the Company under a qualified service organization agreement and/or business associate agreement, in which they agree to abide by applicable federal law and related regulations. The Company may also include use of your protected health information for programs or events facilitated by the Company such as distributing invitations to alumni events and workshops sponsored by the Company. The examples listed are provided to demonstrate the pragmatic use of privacy stipulations set forth in health care operations and is not an exhaustive list of all of the potential uses and disclosures that may be made for health care operations.

For The Purposes of Providing Clinical Supervision for Staff Counselors

Staff counselors are provided clinical supervision by the Clinical Director, in-house, and also provided clinical supervision and consultation, at times, by other out-of-house clinicians trained in the counselor’s specific licensure requirements. All clinical supervision is performed by licensed and/or certified clinical staff that

are legally and ethically mandated to comply with all applicable local, state and federal laws regarding the privacy and confidentiality of your information.

For The Purpose of Follow-up

As part of our program, you will be contacted at regular intervals regarding your continued progress after discharge from treatment. This will give you an opportunity to discuss particular situations, which may come up after your discharge and return to your community. It will also allow us to provide additional support and services to aid you in maintaining your program.

Emergency Treatment

In cases of an immediate threat to your health requiring immediate medical intervention, we may disclose your information, to the extent necessary, to medical personnel involved in providing you with emergency treatment as defined by Part 2.

Incompetent and Deceased Patients

We may disclose information to an authorized personal representative, guardian or other individual(s) or entity as authorized by applicable local, state and federal regulations in accordance with Part 2 in case the client is determined to be legally incompetent or is deceased.

Decedents

We may disclose protected health information to a coroner, medical examiner or other authorized person under laws requiring the collection of death or other vital statistics, or which permit inquiry into the cause of death.

Judicial And Administrative Proceedings

We may disclose your information in civil, criminal, administrative or legislative proceedings with your specific authorization or in response to a court order that complies with Part 2 after notice and an opportunity for you to be heard. Note also that if your records are not actually “patient records” within the meaning of 42 CFR Part 2 (e.g., if your records are created as a result of your participation in the family program or another non-treatment setting), your records may not be subject to the protections of 42 CFR Part 2. If that is the case and if you are involved in a legal issue, lawsuit or a dispute, we may disclose information about you in response to a court or administrative order. We may also disclose information about you in response to a court or administrative ordered subpoena or discovery request.

Commission Of A Crime On Premises Or Against Company Personnel

We may disclose limited information to the police or other law enforcement officials if you threaten to commit a crime, if you commit a crime or if reasonable suspicion exists about the potential for you to commit a crime on the premises or against program personnel.

Abuse and Neglect

We may disclose your information to legally authorized personnel to investigate any report(s) or reasonable suspicion of abuse or neglect of a child, an elder or any individual in a dependent living situation.

Duty To Warn

In the event that a client has made a specific threat of serious physical harm to another specific person or the public, and disclosure is otherwise required under statute and/or common law the program will carefully consider appropriate options that would permit disclosure.

Public Health Reporting

When legally mandated we may release information about you to appropriate local, state and/or federal agencies as required for public health reporting, including, without limitation, if it is determined that you are at a high risk of spreading an infectious disease including, but not limited to HIV/AIDS, Tuberculosis and/or Hepatitis.

Oversight, Audit And Evaluation Activities

We may disclose your information to authorized individuals for oversight of the program or the Company, for completing audits and program evaluation for the purpose of verifying our compliance with regulatory mandates and for the purpose of maintaining program licensure and/or certification. We may also disclose your information to authorized individuals providing financial assistance to the program; for example, we may disclose your information to authorized personnel responsible for verifying our compliance with the allocation of state and/or federal grant funds.

Intern Disclosure

I understand that some services may be provided by an alcohol and drug counselor intern, social work or other discipline intern, under the clinical supervision of a qualified clinical supervisor. The clinical supervisor will oversee the treatment provided in such cases. This disclosure must be signed by the client and retained as part of the client record.

Research

In certain limited circumstances we may use and disclose information about you for research purposes. You will not be identified or connected to the information disclosed.

National Security And Intelligence

We may release mental health/medical information about you for national security purposes, such as protecting the President of the United States or foreign heads of state, or for conducting intelligence operations.

Inmates

If you are an inmate of a correctional institution or under the custody of a law enforcement official, we may release mental health/medical information about you to the correctional institution or law enforcement official. This release may be necessary for the institution to provide you with mental health/health care; to protect your health and safety or the health and safety of others; or for the safety and security of the correctional institution.

Workers Compensation

We may disclose your PHI to workers’ compensation agencies for your workers’ compensation benefit determination.

Information Technology Management

The Company has contracts and may enter contracts in the future with providers of electronic medical record, electronic data management services and electronic billing. Such providers are bound by HIPAA and Part 2 confidentiality rules and may not disseminate any confidential information and are only privy to information needed to perform information management activities.

YOUR RIGHTS REGARDING YOUR HEALTH, MENTAL HEALTH AND SUBSTANCE ABUSE INFORMATION

The Right to Revoke Authorization

As stated above in the section “Revoking Authorization for the Release of Information,” you have the right to revoke consent to the sharing of your information as set forth in any authorization signed by you. To revoke your authorization, you are required to notify the Company in a written signed statement including the specific revocation you desire. Upon receipt of your written notice of revocation, the Company will document the notice appropriately in your record and discontinue the release of any information as specified by you. The revocation will apply from the date the Company receives the notice on and will not apply to information that was released prior to the date the Company received the notice of revocation.

The Right To Inspect And Copy

You have the right to inspect and receive a copy of the health, mental health and/or substance abuse information used to make decisions about your care. Typically, that information does not include clinical psychotherapy progress notes. Requests for your information must be made in writing and you may be required to pay a standard fee at the time of that request. The Company will comply with your request within 30 days after receiving your written request, unless a different time period is required by applicable law. We may deny certain requests in cases where the professionals involved in your care have reason to believe that access to your information could be harmful to you or others.

The Right to Request Restrictions

You have the right to ask us to restrict the information we disclose about you. For example, you may request restrictions on the use or disclosure of information provided to someone involved in your care or the payment for your care, like a family member or friend or someone who you designate as an emergency contact. Restrictions of the use and disclosure of your information can be requested at any time and must be appropriately documented through the completion of our consent form, which while you are in treatment, should be in the physical presence of a staff representative as a witness to verify the authentication of that release. Your consent must specifically set forth what information you want to restrict, what information you want to release and to whom you want the restrictions to apply (for example, disclosures to your emergency contact). You may terminate or modify a restriction at any time

by providing the Company with written notice of the termination or modification requested. The use and disclosure of your information by the Company will correspond with the effective dates of each restriction and/or modification to restrictions. You may not limit the uses and disclosures of your information in instances where we are legally mandated or allowed to use or disclose your information.

The Right to Amend

If you believe that the information we have about you is incorrect or incomplete; you have the right to request that we correct the existing information or add the missing information. You have the right to request an amendment for as long as the information is kept by or for the Company. To request an amendment, you must provide the request to the Company in writing along with a description of the reason you are requesting the amendment. We will respond within 60 days of receiving your request to notify if the request was approved or denied.

If we approve your request, we will make modifications to your information to reflect the information provided in your request and will notify you in writing that the modifications have been completed. In the event that your information is modified, we will make reasonable efforts to notify other relevant entities involved in your care of the changes.

We may deny your request if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if the information is (1) correct and complete, (2) not created by us, (3) not allowed to be disclosed, or (4) is not part of our records. In instances when the Company denies a request to amend, we will provide a written statement describing the reasons for the denial and instructions on your right to file a written statement of disagreement with the denial. If you do not file a written statement of disagreement in response to our denial to amend you have the right to request that your original request to amend and our statement of denial be attached to all future disclosures of your information.

The Right to an Accounting of Disclosures

You have the right to request an “accounting of disclosures” or, in other words, a list of instances in which we have made certain non-routine disclosures of your information in compliance with applicable legal regulations. The list will not include certain uses or disclosures, such as those you have specifically authorized and those that are otherwise permitted, including the instances already defined in this document for treatment, payment, or health care operations and releases made directly to you or to your authorized family members. To request an accounting of disclosures, you must submit your request to the Company in writing. Your request must state a time period, which may not be longer than three years. You will not be charged a fee for your first request for an accounting of disclosure in any given 12-month period. You may be charged a standard fee for any requests for accounting disclosures following the first request and occurring within the same 12-month period of time. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred. We will respond to your request in writing within 60 days of receiving your request. Our response will include the date of each applicable disclosure, to whom the disclosure was made a description of the information disclosed, and the reason the information was disclosed.

The Right to Request Confidential Communications

You have the right to request that we communicate with you about your treatment in a particular manner or directed to a certain location. For instance, you may ask that we contact you at home, rather than at work or by email rather than mailing correspondence to your home address. You do not have to provide a reason for your request but the request must be made in writing and directed to the Company’s Program Director. The request must specify all necessary details regarding the type of confidential communication you would like us to use in corresponding with you. The Company will accommodate all reasonable requests.

Right to a Paper Copy of This Notice

You have the right to a paper copy of this Notice. You may ask us to give you a copy of this document at any time.

Redisclosure Notice

Information disclosed pursuant to this notice may be subject to redisclosure by the recipient and may no longer be protected by HIPAA. However, substance use disorder records disclosed under Part 2 remain subject tot federal confidentiality protections and my not be redisclosed except as permitted by law.

Complaints Regarding Privacy Rights

If you believe your privacy rights have been violated you may file a complaint with:

Privacy Officer

Hope Ranch, LLC

18401 Von Karman, Suite 500

Irvine, CA 92612

[email protected]