APALY HEALTH INC.

1. Who Is Providing This Authorization

This Authorization is provided by you, the individual member of an employer-sponsored health plan that has enrolled in or is being enrolled in the ApalyRx prescription benefit program operated by Apaly Health Inc. Your acceptance of the Apaly Health Inc. Terms of Use at apalyrx.net constitutes your agreement to this Authorization.

2. Who Is Authorized to Use and Disclose Your Information

The following entities are authorized to use and disclose your Protected Health Information as described in this Authorization:

• Apaly Health Inc., a Delaware corporation, operating the ApalyRx prescription benefit platform at 802 E. Whiting, Tampa, Florida 33602
• ApalyRx LLC, a Texas Class G centralized prescription processing pharmacy (NPI 1912873969) and wholly owned subsidiary of Apaly Health Inc.

3. Description of Protected Health Information

This Authorization covers the following categories of your Protected Health Information:

• Your prescriptions for medications covered under the ApalyRx program, including drug name, dosage, quantity, prescriber identity, fill date, and fill history
• Your medical records and clinical information relevant to covered medications held by your participating healthcare providers, including information stored in electronic medical record systems, including but not limited to diagnoses, current and past medications, laboratory results, and clinical notes
• Your health plan enrollment and benefit information, including eligibility status, plan design, benefit configuration, and cost share obligations
• Information collected through the ApalyRx platform in connection with your enrollment and use of the program, including your identity, contact information, and payment information
• Pharmacy transaction data, including prescription routing decisions, Dispensing Pharmacy selection, dispense records, and shipment information

This Authorization may cover information about your entire medical record, which could include sensitive information such as:

• Mental health and behavioral health information
• Alcohol and substance use information
• Communicable disease information, including HIV/AIDS status
• Genetic information and genetic test results
• Reproductive and family planning health information
• Developmental disability information

4. Who May Receive Your Protected Health Information

The following persons and entities are authorized to receive your Protected Health Information under this Authorization. The applicable recipients for your specific prescriptions will depend on which medications are covered and which dispensing pharmacy and Program Supplier programs apply to your health plan.

4.1 Dispensing Pharmacy Partners. State-licensed dispensing pharmacies designated to fulfill your prescriptions under the program, for purposes of prescription receipt, pharmacist verification, drug utilization review, dispensing, labeling, shipment, and all other dispensing and fulfillment activities.

4.2 Program Suppliers and Their Agents. Program Suppliers whose products are covered under your health plan's program, together with their affiliated companies, agents, and authorized representatives, for the purposes described in Section 5 of this Authorization. For purposes of this Authorization, "Program Supplier" means any manufacturer, pharmacy, distributor, or other entity that supplies products or provides pricing to eligible members through the ApalyRx program.

4.3 Program Supplier Service Providers. Third-party service providers engaged by Apaly Health or Program Suppliers to manage patient support services, and to maintain, de-identify, aggregate, or analyze data in connection with Program Supplier programs, subject to confidentiality obligations and applicable law.

4.4 Your Health Plan and Plan Administrator. Your employer-sponsored health plan and its designated third-party administrator, for purposes of benefit administration, eligibility verification, claims processing, and coordination of benefits.

4.5 Authorized Technology Vendors. Authorized technology vendors operating as subcontractor business associates of Apaly Health Inc. under Business Associate Agreements, for purposes of eligibility verification, electronic medical record connectivity, prescription data exchange, risk stratification, and care coordination functions necessary to operate the program.

4.6 Legal and Regulatory Disclosures. Courts, government agencies, law enforcement, and other persons or entities to the extent required by applicable law, legal process, or regulatory obligation, consistent with HIPAA's permitted disclosures for such purposes.

5. Purpose of Use and Disclosure

Your Protected Health Information will be used and disclosed for the following purposes:

5.1 Program Administration. To administer the ApalyRx prescription benefit program on behalf of your health plan, including eligibility verification, prescription routing, benefit adjudication support, cost share calculation and collection, Dispensing Pharmacy coordination, DSCSA compliance, reporting, and all related administrative functions.

5.2 Prescription Fulfillment. To facilitate the receipt, processing, routing, and transfer of your prescriptions to the designated Dispensing Pharmacy, and to support the Dispensing Pharmacy's dispensing, labeling, shipment, and delivery of your medications.

5.3 Program Supplier Program Administration. To enable Program Suppliers to administer applicable patient support programs, which may include:

• Copayment assistance and buy-down programs
• Reimbursement assistance programs
• Drug coverage verification services
• Nurse educator and clinical support services
• Medication adherence programs
• Patient enrollment and onboarding support
• Program eligibility verification and validation
• Utilization reporting and compliance monitoring required under Program Supplier agreements

5.4 Care Coordination and Population Health. To support care coordination, risk stratification, and program operations on behalf of your health plan, including identification of members who may benefit from program participation and outreach to support medication access and adherence.

5.5 Electronic Medical Record Access. To access, retrieve, and use your medical records and clinical information held by your participating healthcare providers, including information stored in electronic medical record systems, for purposes of eligibility determination, care coordination, risk stratification, and program administration.

5.6 Compliance and Audit. To comply with applicable laws and regulations, including HIPAA, DSCSA, and applicable state pharmacy laws, and to support audit and compliance activities required under Program Supplier agreements and health plan contracts.

5.7 De-identification and Aggregation. To de-identify your PHI using methods meeting 45 C.F.R. Section 164.514(a)-(c), and to use such de-identified information for data aggregation, program analytics, and healthcare operations in accordance with 45 C.F.R. Section 164.514. Apaly Health owns all de-identified information created under this Authorization.

6. Expiration

This Authorization expires on the earlier of:

• One (1) year from the date you accepted the Apaly Health Inc. Terms of Use at enrollment; or
• The maximum period permitted under the law of the state in which you reside; or
• The date you revoke this Authorization as described in Section 7.

Upon expiration or revocation, Apaly Health will no longer use or disclose your PHI under this Authorization for new activities. Uses and disclosures made before expiration or revocation are not affected.

7. Your Right to Revoke This Authorization

You have the right to revoke this Authorization at any time by contacting Apaly Health using any of the following methods:

• Email: privacy@apalyrx.com
• Mail: Apaly Health Inc., 802 E. Whiting, Tampa, Florida 33602
• Through your account settings at apalyrx.net (if available)

Revocation is effective upon receipt by Apaly Health. Revocation does not affect any actions taken by Apaly Health or its partners in reliance on this Authorization before Apaly Health received your revocation notice.

If you revoke this Authorization, Apaly Health will:

• Remove you from program pricing and Program Supplier-supported patient assistance programs
• Transfer your active prescriptions to standard pharmacy channels
• Notify applicable Dispensing Pharmacy partners of the revocation as required

Revocation does not affect your right to obtain your prescriptions through standard pharmacy channels or your coverage under your health plan's standard benefits.

8. Risk of Re-Disclosure

Information used or disclosed pursuant to this Authorization may be re-disclosed by the person or entity that receives it. Once re-disclosed outside of Apaly Health's control, it may no longer be protected by HIPAA or other applicable privacy laws. You should be aware of this risk when deciding whether to provide this Authorization.

9. Your Right to a Copy

If you agree to provide this Authorization, you have the right to receive a copy of it. A copy of this Authorization is available at apalyrx.com/legal and through your account at apalyrx.net. You may also request a copy by contacting privacy@apalyrx.com.

10. Program Supplier and Pharmacy Partner Specific Notices

Certain Program Suppliers and Dispensing Pharmacy partners have specific requirements regarding the content or delivery of patient authorizations. By accepting this Authorization, you acknowledge the following:

10.1 Dispensing Pharmacy Partner Specific Forms. Certain Dispensing Pharmacy partners require their own specific authorization, consent, and TCPA forms as a condition of dispensing medications under their programs. Those partner-specific forms are available at apalyrx.com/legal. Your acceptance of this Authorization and the Apaly Health Inc. Terms of Use constitutes your acceptance of those partner-specific forms for any prescriptions routed to the applicable Dispensing Pharmacy. Those forms are incorporated herein by reference and are not modified by this Authorization. If a partner-specific form conflicts with this Authorization on a matter specific to that partner's program, the partner-specific form governs for that matter.

10.2 Program Supplier Participation Terms. Program Supplier member-facing program requirements are set forth in the Program Supplier Participation Terms at apalyrx.com/legal, which are incorporated herein by reference. Program Suppliers may be added from time to time and their applicable terms will be posted at apalyrx.com/legal.

10.3 Future Partners. As Apaly Health adds Dispensing Pharmacy partners and Program Suppliers, their applicable terms will be posted at apalyrx.com/legal. Your continued use of the platform following such additions constitutes your acceptance of those terms.

11. Member Acknowledgments

By accepting the Apaly Health Inc. Terms of Use and this Authorization, you acknowledge and confirm:

• You have read and understand this Authorization
• You understand that this authorization is a condition of participating in program pricing through the ApalyRx platform
• You understand that you may refuse to provide this Authorization without affecting your right to receive treatment or to obtain medications through standard pharmacy channels
• You understand that you may revoke this Authorization at any time as described in Section 7
• You understand that information disclosed pursuant to this Authorization may be re-disclosed and may not be protected by applicable privacy laws after re-disclosure
• You understand that Apaly Health and Program Suppliers may receive remuneration in connection with obtaining this Authorization
• You understand that the specific recipients of your PHI will depend on which Program Supplier programs and dispensing pharmacies apply to your prescriptions