Effective and Last Updated on May 20, 2026

Notice of Privacy Practices

THIS NOTICE DESCRIBES:

• HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED
• YOUR RIGHTS WITH RESPECT TO YOUR HEALTH INFORMATION
• HOW TO FILE A COMPLAINT CONCERNING A VIOLATION OF THE PRIVACY OR SECURITY OF YOUR HEALTH INFORMATION, OR OF YOUR RIGHTS CONCERNING YOUR INFORMATION

YOU HAVE A RIGHT TO A COPY OF THIS NOTICE (IN PAPER OR ELECTRONIC FORM) AND TO DISCUSS IT WITH GROUPS RECOVER TOGETHER’S COMPLIANCE AND PRIVACY DEPARTMENT AT 1-888-980-5995 AND COMPLIANCE@JOINGROUPS.COM IF YOU HAVE ANY QUESTIONS.

PLEASE REVIEW THIS NOTICE CAREFULLY.

Our Duties

Recover Together LLC. d/b/a Groups Recover Together, and its affiliates, subsidiaries, facilities, employees, managed entities, and contractors (collectively, "Groups" or "We") are committed to protecting your health information according to applicable law. In particular, we are required by applicable federal and state law, including by the Health Insurance Portability and Accountability Act and its implementing regulations ("HIPAA") and 42 C.F.R. Part 2, the Confidentiality of Substance Use Disorder Patient Records ("Part 2") to maintain the privacy of your health information. We are also required to give you this notice about our privacy practices, our legal duties, and your rights concerning your health information. We must follow the privacy practices that are described in this notice while it is in effect. If a breach of your unsecured protected health information should occur, we are required to notify you.

We reserve the right to change our privacy practices and the terms of this notice at any time, provided such changes are permitted by applicable law. We reserve the right to make the changes in our privacy practices and the new terms of our notice effective for all health information that we maintain, including health information we created or received before we made the changes. Before we make a significant change in our privacy practices, we will change this notice and make the new notice available on our website at http://www.joingroups.com. You may request a copy of our notice at any time, and it may be provided to you electronically if you have agreed to receive notices in that manner. You may always receive a paper copy of this notice, upon request.

Uses and Disclosures of Health Information

We will obtain your written authorization to use and disclose your health information unless we are permitted to use or disclose your health information without your consent under applicable law. The following categories describe the ways that we may use and disclose your health information without your written authorization under Part 2. If state law is more restrictive than Part 2 on how we use and disclose any of your health information, we will comply with that state law.

Other Uses and Disclosures

Use or disclosure of your health information for any purpose other than those listed above requires your written authorization. Some examples include:

• Presence in Treatment / Treatment. We will not disclose your presence in treatment to individuals who may contact Groups unless you have provided your written authorization. With your consent, we can share information with other healthcare providers to help provide the treatment you may need.
• To a central registry or other treatment program. We may disclose your information to a central registry or other treatment program for the purpose of preventing multiple enrollments.
• PDMP. We may report medication prescribed to you if required under state law to a state's Prescription Drug Monitoring Program.

We may also disclose your health information in the following ways:

• Payment or Healthcare Operations. We may disclose your information to your insurance company for payment purposes, and for care coordination and/or case management services.
• Sale of Your Health Information. We will not sell your health information without your written authorization.

Patient Rights

You have the following rights with respect to your health information:

• Access to Inspect and Copy: You have the right to inspect or obtain electronic or paper copies of your health information, with limited exceptions, and may request that we transmit a copy to a designated person or entity.
• Restrictions: You have the right to request additional restrictions on our use or disclosure of your health information. We must agree to restrictions on disclosures to your insurance company for payment or healthcare operations if the related item or service was paid for in full by you or another person other than your insurance company.
• Correction or Amendment: You have the right to request that we correct or amend your health information. We will respond in writing within sixty (60) days, and you may file a written statement of disagreement if your request is denied.
• Confidential Communications: You have the right to receive confidential communications from us, such as being contacted at a specific address or phone number. We will grant reasonable requests.
• Accounting of Disclosures: You have the right to receive an accounting of disclosures of your protected health information for the six years prior to your request, including who we shared it with and why.
• Obtain a Copy: You have the right to obtain a paper or electronic copy of this notice at any time, including from our website at www.joingroups.com.
• Discuss This Notice: You have the right to discuss this notice with our Compliance and Privacy Department using the contact information below.

How May We Use and Disclose Your Health Information?

We may use and disclose your health information in the following ways, without your written authorization, unless state law is more restrictive:

• Within Our Organization & Emergencies. Groups workforce who have a need for your information in connection with their duties may use or share your information, and we may share it with the entity that has direct administrative control over our substance use disorder program. In the event of a bona fide medical emergency in which your authorization cannot be obtained, we may disclose your identifying information to medical personnel.
• Business Associates / Qualified Service Organizations. We may disclose your information to "business associates" and "qualified service organizations" that perform various services on our behalf. These third parties agree to protect the privacy of your health information.
• Audits. We may disclose your health information to entities who are legally permitted to perform audits of our facilities. Those entities are required to maintain the privacy of your information.
• Response to a Court Order. Records or testimony relaying the content of records shall not be used or disclosed in any civil, administrative, criminal, or legislative proceedings against you unless the disclosure was based on a specific written authorization or a court order, and only after you have received notice and an opportunity to be heard.
• Reporting Crimes on Our Premises or Against Our Workforce. We may disclose a member's commission (or threatened commission) of a crime on our premises or against our personnel to a law enforcement agency or official, including the suspect's name, address, last known whereabouts, and status as a patient in our program.
• Reporting Child Abuse or Neglect / Deceased Persons. We may report incidents of suspected child abuse and neglect to the appropriate authorities in accordance with applicable state law. We may also disclose information relating to the cause of death of a patient under laws requiring the collection of death or other vital statistics.
• Research / FDA Reporting. Under certain circumstances, we may disclose your health information to researchers conducting a specific research project, and your identifying information will never be published without your written authorization. We may also disclose patient identifying information to FDA medical personnel who believe a person's health may be threatened by a product error, for the purpose of notifying patients or their physicians.
• Redisclosure. Disclosures made to Groups that required your written consent may be further disclosed without your written consent as long as the disclosure is allowed by HIPAA.

For Members Who Receive Treatment in Florida Only

We participate in the Florida Health Information Exchange (Florida HIE). As permitted by law, your health information will be shared with this exchange to provide faster access, better coordination of care, and to assist providers and public health officials in making more informed decisions. You may "opt-out" and disable access to your health information available through CRISP Shared Services by calling 877-940-6144 or completing and submitting an Opt-Out form to the Florida HIE by mail, fax, or through their website at www.flhie.org.

How do I access and correct my Personal Information?

You can review your Personal Information by logging into our Services and visiting either the “Profile” section of our Platform. You may Contact Us to inform us of any changes or errors in any Personal Information we have about you to ensure that it is complete, accurate, and as current as possible or to delete your account. We cannot delete your personal information except by also deleting your account with us. We may also not be able to accommodate your request if we believe it would violate any law or legal requirement or cause the information to be incorrect.

Revoking Your Authorization

You may provide a single consent for all future uses or disclosures for treatment, payment, and healthcare operations purposes. If you change your mind after authorizing a use or disclosure of your health information, you may withdraw your permission by revoking the authorization. However, your decision to revoke the authorization will not affect or undo any use or disclosure of your health information that occurred before you notified us of your decision, or any actions that we have taken based upon your authorization. To revoke an authorization, please contact us using the contact information in this notice.

Questions, Complaints, and Contact Information

If you are concerned that we may have violated your privacy rights, you disagree with a decision we made about access to your health information, or a request you made to amend or restrict the use of your health information, you may contact the Groups Compliance and Privacy Department at 1-888-980-5995 or at compliance@joingroups.com. Any individual filing a complaint will not be retaliated against.

You may also submit a written complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints/. A violation of the federal law and regulations discussed in this Notice is a crime and suspected violations may be reported to the appropriate authorities, including the United States Attorney for the judicial district in which the violation occurs.