Notice of Privacy Practices

Effective Date: September 30th, 2026

This Notice is issued by Pinch Med IL, P.C. and its affiliated professional entities (collectively, "Pinch," "we," "us," or "our"), the professional entities through which Pinch clinicians deliver care. Administrative and technology support is provided by Pinch Med, Inc., which is not a health care provider and does not itself provide clinical services.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Who We Are and Our Legal Duties

Pinch provides non-surgical aesthetic and wellness services delivered in person by licensed clinicians engaged by our professional entities. This Notice applies to all health information about you created, received, or maintained in connection with the clinical services we provide ("Protected Health Information" or "PHI").

We are required by law to: maintain the privacy and security of your PHI; provide you with this Notice of our legal duties and privacy practices with respect to your PHI; notify you following a breach of your unsecured PHI; and abide by the terms of the Notice currently in effect. We will not use or disclose your PHI other than as described in this Notice unless you authorize us to do so in writing.

The Pinch Telehealth Program

Pinch Med, Inc. offers a telehealth program under the Pinch brand for prescription weight management, metabolic health, and skin care. Services in that program are not provided by us. They are provided by independent, licensed medical practices and pharmacies working through an independent telehealth platform provider. Those practices and pharmacies are separate health care providers, and each issues its own notice of privacy practices, which they provide to you directly. Their notices, not this one, govern the PHI they create and maintain, including your telehealth intake, consultation, prescriptions, and pharmacy records.

If you receive care from us and also participate in the telehealth program, we may exchange PHI with the telehealth medical practices for treatment purposes as permitted by law. For example, your Pinch clinician may receive information about a medication you have been prescribed so that we can plan your in-person care, and we may share your treatment history with a telehealth clinician who is caring for you. When we receive PHI from the telehealth medical practices, this Notice governs our copy of it. We will obtain your written authorization before any exchange that is not permitted without one.

How We May Use and Disclose Your PHI

Treatment

We use your PHI to provide, coordinate, and manage your care. For example, your clinician reviews your medical history and prior treatments to determine whether a treatment is appropriate for you, to plan your care over time, and to coordinate with other clinicians on our team involved in your care. We may also disclose your PHI to other health care providers involved in your care, including the independent telehealth medical practices described above and your other physicians, so that they can treat you.

Payment

We may use and disclose your PHI to obtain payment for services we provide to you. For example, processing your payment for a completed treatment through our payment processor.

Health Care Operations

We may use and disclose your PHI for our health care operations. For example, quality assurance and chart review (including physician collaboration review where required by state law), clinician training and competency validation, compliance auditing, and business planning.

Appointment Reminders and Treatment Options

We may use your PHI to contact you with appointment reminders, follow-up care instructions, and information about treatment alternatives or other health-related services that may be of interest to you. You may opt out of these communications at any time.

Business Associates

We may disclose PHI to contractors and vendors that perform services for us (such as scheduling, records hosting, payment processing, messaging, and administrative support, including Pinch Med, Inc.) under written agreements requiring them to safeguard your PHI.

Other Permitted or Required Disclosures

We may use or disclose your PHI without your authorization where permitted or required by law, including: as required by federal, state, or local law; for public health activities (such as adverse event reporting to the U.S. Food and Drug Administration); to health oversight agencies (such as state licensing boards) for audits, investigations, and inspections; in response to a court order, subpoena, or other lawful process; to law enforcement as permitted by law; to avert a serious threat to health or safety; for workers' compensation purposes; and to coroners, medical examiners, or funeral directors as permitted by law.

Uses and Disclosures Requiring Your Written Authorization

Most uses and disclosures of PHI for marketing purposes, any sale of PHI, and any use or disclosure not described in this Notice will be made only with your written authorization. You may revoke an authorization at any time by notifying us in writing; revocation will not affect uses or disclosures already made in reliance on it.

Your Rights Regarding Your Health Information

You have the following rights with respect to your PHI. To exercise any of these rights, submit a written request to our Privacy Officer using the contact information at the end of this Notice.

• Right to inspect and copy. You may inspect and obtain a copy of the PHI in your record (including an electronic copy where we maintain it electronically). We will respond within the time required by law and may charge a reasonable, cost-based fee for copies.

• Right to amend. If you believe information in your record is incorrect or incomplete, you may request that we amend it. We may deny the request in certain circumstances; if we do, we will explain why in writing and you may submit a statement of disagreement that will be kept with your record.

• Right to an accounting of disclosures. You may request a list of certain disclosures we have made of your PHI (other than for treatment, payment, health care operations, and certain other excluded categories) during the six years prior to your request.

• Right to request restrictions. You may request restrictions on how we use or disclose your PHI for treatment, payment, or health care operations, including a request that we not share your PHI with the telehealth medical practices. We are not required to agree to every restriction, but we will honor a request to restrict disclosure to your health plan where the disclosure concerns an item or service you paid for in full out of pocket and the disclosure is not otherwise required by law.

• Right to request confidential communications. You may request that we communicate with you about your health information in a particular way or at a particular location (for example, only at a specified phone number or email address). We will accommodate reasonable requests.

• Right to a paper copy of this Notice. You may request a paper copy of this Notice at any time, even if you agreed to receive it electronically.

• Right to breach notification. You have the right to be notified in the event of a breach of your unsecured PHI, as required by law.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us by contacting our Privacy Officer at the address or email below. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights, at 200 Independence Avenue S.W., Washington, D.C. 20201, by calling 1-800-368-1019 (TDD: 1-800-537-7697), or online at www.hhs.gov/ocr/complaints. We will not retaliate against you in any way for filing a complaint. Complaints about the telehealth medical practices or pharmacies should be directed to the privacy contact listed in their notice of privacy practices.

Changes to This Notice

We reserve the right to change this Notice and to make the revised Notice effective for PHI we already maintain as well as PHI we receive in the future. The current Notice will always be linked at the bottom of every page of our websites, including our skincare store and telehealth pages, with its effective date, and a copy is available on request.

Contact Us

If you have any questions about this Notice or wish to exercise any of the rights described above, you may contact us at:

Privacy Officer

Pinch Med IL, P.C., c/o Pinch Med, Inc.

909 Davis Street, Suite 500

Evanston, Illinois 60201

Email: privacy@bookpinch.com

Website contact form: https://www.bookpinch.com/contact-us