Notice of Privacy Practices

Protected Health Information (“PHI”) includes information that identifies you and relates to:

• Your past, present, or future physical or mental health condition;
• Healthcare services provided to you;
• Payment for healthcare services;
• Information generated by remote monitoring devices;
• Information collected through patient communications, assessments, treatment plans, and clinical interactions.

PHI may be maintained in paper, electronic, audio, photographic, or other formats.

Treatment

We may use and disclose your PHI to provide, coordinate, or manage your healthcare and related services.

Examples include:

• Coordinating care with your physician or therapist;
• Reviewing clinical progress;
• Communicating with healthcare providers involved in your care;
• Monitoring data transmitted from approved devices;
• Providing education regarding equipment use and treatment plans.

Payment

We may use and disclose PHI to obtain payment for services rendered.

Examples include:

• Billing Medicare, Medicaid, or commercial insurance plans;
• Verifying insurance eligibility and benefits;
• Obtaining prior authorizations;
• Processing claims and appeals;
• Collecting patient financial responsibilities.

Healthcare Operations

We may use and disclose PHI for healthcare operations necessary to run our organization.

Examples include:

• Quality improvement activities;
• Staff training and education;
• Accreditation and certification activities;
• Clinical program evaluation;
• Risk management and compliance reviews;
• Internal audits and investigations.

As part of RTM, RPM, and related services, we may collect and transmit information generated through approved devices and technologies.

Information may include:

• Device usage information;
• Therapy adherence information;
• Physiologic measurements;
• Clinical assessment information;
• Patient-reported outcomes;
• Communications regarding treatment progress.

This information may be shared with authorized healthcare providers involved in your care and with authorized payers as permitted by law.

Unless you object, we may disclose relevant information to:

• Family members;
• Caregivers;
• Personal representatives;
• Individuals involved in your care or payment for your care.

We may also share information when necessary to notify family members regarding your location, condition, or care status.

We may contact you regarding:

• Equipment deliveries;
• Follow-up appointments;
• Therapy participation;
• Device usage support;
• Treatment recommendations;
• Care coordination activities.

Communications may occur by:

• Telephone;
• Text message;
• Email;
• Patient portal;
• Mail;
• Other approved communication methods.

We may disclose your PHI when required or permitted by law, including:

Required by Law

We will use or disclose PHI when federal, state, or local law requires it, including to the U.S. Department of Health and Human Services when it asks to confirm that we comply with federal privacy law.

Public Health Activities

• Disease reporting;
• Public health investigations;
• FDA reporting requirements;
• Product recalls and safety notifications.

Health Oversight Activities

• Government audits;
• Inspections;
• Investigations;
• Licensure reviews;
• Accreditation surveys.

Abuse, Neglect, or Domestic Violence Reporting

We may disclose information to appropriate governmental authorities when required by law.

Judicial and Administrative Proceedings

We may disclose PHI pursuant to:

• Court orders;
• Subpoenas;
• Legal proceedings;
• Administrative requests.

Law Enforcement

We may disclose information for authorized law enforcement purposes as permitted by law.

Coroners, Medical Examiners, and Funeral Directors

We may disclose information as necessary for identification, cause of death determinations, or other legally authorized purposes.

Workers’ Compensation

We may disclose information as authorized by workers’ compensation laws.

Serious Threat to Health or Safety

We may disclose information to prevent or lessen a serious threat to health or safety when permitted by law.

Research

We may use or disclose PHI for health research, subject to the approvals and safeguards that HIPAA requires, such as review by an institutional review board or privacy board.

Organ and Tissue Donation

We may disclose PHI to organizations that handle organ, eye, or tissue procurement or transplantation, as needed to facilitate donation and transplantation.

Specialized Government Functions

We may disclose PHI for military and veterans activities, national security and intelligence activities, and protective services for the President and others, and, if you are an inmate or in lawful custody, to the correctional institution or law enforcement official that has custody of you, as HIPAA permits.

We may disclose PHI to business associates that perform services on our behalf.

Examples include:

• Billing companies;
• Technology vendors;
• Cloud storage providers;
• Data processing vendors;
• Compliance consultants;
• Customer support vendors.

Business associates are required by law and contract to safeguard your information.

Except as otherwise described in this Notice, we will obtain your written authorization before using or disclosing your PHI for:

• Most marketing activities;
• Sale of PHI;
• Certain psychotherapy notes;
• Other uses not otherwise permitted by law.

You may revoke an authorization at any time in writing, except to the extent action has already been taken based on the authorization.

You may exercise any of the rights below by contacting our Privacy Officer using the information at the end of this Notice. We may ask you to make certain requests in writing.

Right to Access

You have the right to inspect and obtain copies of your PHI maintained in a designated record set, subject to limited exceptions.

Right to Request Amendment

You may request that we amend information you believe is incorrect or incomplete.

Right to Request Restrictions

You may request restrictions on certain uses or disclosures of your PHI.

While we are not required to agree to all requests, we will comply when required by law.

For example, if you pay in full, out of pocket, for a service, you may ask us not to disclose the protected health information about that service to your health plan, and we will honor that request as the law requires.

Right to Request Confidential Communications

You may request that we communicate with you using alternative methods or at alternative locations.

Right to Receive an Accounting of Disclosures

You may request a list of certain disclosures made by us, as permitted by law.

Right to Receive a Paper Copy

You have the right to obtain a paper copy of this Notice at any time, even if you previously agreed to receive it electronically.

Right to Be Notified of a Breach

You have the right to receive notification if your unsecured PHI is compromised in a manner requiring notification under applicable law.

We are required to:

• Maintain the privacy of your PHI;
• Provide this Notice;
• Follow the terms of this Notice;
• Notify you following certain breaches of unsecured PHI;
• Comply with federal and state privacy laws.

We reserve the right to revise this Notice and make revised terms applicable to all PHI maintained by us. Updated Notices will be made available upon request and on our website.

This Notice governs the protected health information we create or receive in connection with your care, your treatment, or the equipment we furnish. Our website and any related microsites also collect information when you browse them, such as device and usage data gathered through cookies and similar technologies. That browsing information is governed by the Privacy Policy posted on our website, not by this Notice.

We do not permit third-party analytics or advertising technologies to receive your protected health information. On any page that requires you to sign in, or that relates to your care or your equipment, we do not allow analytics or advertising vendors to collect protected health information without a written agreement that satisfies HIPAA or your authorization. On the general, public pages of our website and microsites, a consent banner lets you accept or decline non-essential tracking technologies, as our Privacy Policy describes.

If you have questions about how our website handles information, you may review our Privacy Policy or contact our Privacy Officer using the information below.

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services.

You will not be retaliated against for filing a complaint.

Privacy Officer Contact Information

Privacy Officer

Phone: (203) 404-4143, ext. 1032

Email: privacy@romtech.com

You may also file a complaint with:

U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue, SW
Washington, DC 20201
https://www.hhs.gov/ocr

This Notice is effective as of September 30, 2026. We may revise it, and the most current version will be posted on our website and any related microsites with its effective date.