Notice of Privacy Practices

This Notice of Privacy Practices (the "Notice") describes how Mrida Enterprise Inc d/b/a BiteQ, a Delaware corporation ("BiteQ"), together with its affiliated entities (including any subsidiaries) and the independent health care professionals and organizations who use the BiteQ device and services (collectively, the "Professionals," and together with BiteQ, "we" and "our"), may use and disclose your protected health information as an organized health care arrangement to carry out treatment, payment, or health care operations and for other purposes that are permitted or required by law, and how you can receive access to this information.

As an organized health care arrangement, the Professionals and BiteQ agree to abide by the terms of this Notice and will share protected health information with each other for the treatment, payment, and health care operations of BiteQ and as permitted by the Health Insurance Portability and Accountability Act ("HIPAA") and this Notice. This Notice applies to the BiteQ smart utensil hardware device (the "Device"), the BiteQ companion mobile and web applications, any clinician-facing dashboards or portals, and any related integrations and services facilitated through BiteQ's platform (collectively, the "Platform").

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW THIS NOTICE CAREFULLY.

Capitalized terms not defined herein shall have the respective meanings given to them in the BiteQ Terms of Use.

BiteQ’s current Privacy Policy may be found at www.biteq.ai/legal/privacy and is hereby expressly incorporated into this Notice by reference. The Privacy Policy describes BiteQ’s practices regarding the collection, use, and disclosure of your personal information. By using the Device and Platform, you are also agreeing to the terms of BiteQ’s Privacy Policy and consenting to the use and disclosure of information you provide to BiteQ as set forth therein. For inquiries in regard to the Privacy Policy, or to report a privacy-related problem, please contact support@biteq.ai

Our Role Under HIPAA: When we provide technology-enabled services through the Platform to independent health care providers, clinics, or health systems (each, a “Clinic”), we may receive, create, or maintain protected health information about you on behalf of that Clinic. In that context, we act as a “business associate” to the Clinic under HIPAA, and the Clinic is a “covered entity” responsible for providing its own HIPAA Notice of Privacy Practices describing how it uses and discloses protected health information and your rights with respect to that information. This Notice describes, at a high level, how we and the Professionals may use and disclose protected health information both as part of our own organized health care arrangement and, where applicable, on behalf of Clinics in connection with services provided through the Platform, and the safeguards we apply, subject to our Business Associate Agreements and applicable law.

How is patient privacy protected?

We understand that information about you and your health is personal. By "health information," we mean protected health information as defined under federal law (HIPAA, and its implementing regulations). This Notice does not apply to information that is not covered by HIPAA. It is our obligation to maintain the privacy and security of your health information. We continuously seek to safeguard your health information through administrative, physical, and technical measures, including, for example, access controls, encryption in transit and at rest where appropriate, audit logging, workforce training, and vendor management designed to protect the confidentiality, integrity, and availability of your health information. We will let you know promptly if a breach occurs that may have compromised the privacy or security of your information.

What health information do we collect?

The health information that we collect or maintain may include:

Patient consents and sharing with Clinics. When a Patient User creates an account and uses the Device and Platform, we (and, where applicable, your Clinic) will request consents and authorizations to collect, use, and share data (including health-related data) as described in this Notice, in our Privacy Policy, and in applicable HIPAA authorizations. Certain consents are required to enable data sharing with Clinics, electronic health record (EHR) systems, or other third parties. If you are a Patient User and you link your account to a Clinic or clinician, you authorize us to share your relevant data and reports with that Clinic or clinician, as further described in the Privacy Policy and any applicable HIPAA authorization form you sign. For Clinics, any dashboard or portal will display data and reports for patients who have consented to such sharing. If enabled, and with appropriate consents and authorizations, we may also push certain data from our systems into a Clinic’s EHR environment. You may revoke applicable authorizations in accordance with the instructions provided, but revocation will not affect uses and disclosures already made based on your prior authorization. Clinics are responsible for accessing and using this data only as permitted under applicable law, including HIPAA, and any business associate agreement executed with BiteQ, and for maintaining appropriate safeguards, access controls, and EHR configurations.

• Your name, age, email address, username, password, and other registration information.
• Health information that you provide us, which may include information or records relating to your medical or health history, health status and laboratory testing results, diagnostic images, and other health related information.
• Health information about you prepared or obtained by the clinical professionals and support staff who provide clinical services through the Platform such as medical and records, treatment and examination notes, remote monitoring data, and other health related information.
• Billing information that you provide us, such as credit card information, or that we receive from a health plan or other provider of healthcare benefits on your behalf.

How do we use and disclose health information?

We use and disclose your health information for the normal business activities that the law sees as falling in the categories of treatment, payment, and health care operations. Depending on how you receive services through the Platform, we may do so in our capacity as part of an organized health care arrangement with the Professionals, and/or as a business associate to your health care provider or Clinic under a Business Associate Agreement. Generally, we do not need your permission for these disclosures under applicable laws. Below we provide examples of those activities, although not every use or disclosure falling within each category is listed:

• Treatment – We keep a record of the health information you provide us. This record may include your test results, diagnoses, medications, your response to medications or other therapies, and information we learn about your medical condition through our services. We may disclose this information to other health professionals who are treating you so that other doctors, nurses, and entities such as laboratories can meet your healthcare needs.
• Payment – We document the services and supplies you receive when we are providing care to you so that you, your insurance company, or another third party can pay us. We may tell your health plan about upcoming treatment or services that require prior approval by your health plan.
• Health Care Operations – Health information is used to run our and improve the services we provide, to train staff, for business management, quality assessment and improvement, in and for communications about our health related products and services, and for customer service. For example, we may use your health information to review our treatment and services and to evaluate the performance of our staff in caring for you.

We may also use and disclose your health information to:

• Comply with federal, state or local laws that require disclosure.
• Assist in public health activities such as tracking diseases or medical devices.
• Inform authorities to protect victims of abuse or neglect.
• Comply with federal and state health oversight activities such as fraud investigations.
• Respond to law enforcement officials or to judicial orders, subpoenas or other processes.
• Conduct research following internal review protocols to ensure the balancing of privacy and research needs.
• Avert a serious threat to health or safety, such as threat of suicide or other self-harm.
• Assist in specialized government functions such as national security, intelligence and protective services.
• Inform military and veteran authorities if you are an armed forces member (active or reserve).
• Inform a correctional institution if you are an inmate.
• Recommend treatment alternatives.
• Tell you about health-related products and services.
• Communicate within for treatment, payment, or healthcare operations.
• Communicate with other providers, health plans, or their related entities for their treatment or payment activities, or health care operations activities relating to quality assessment and improvement, care coordination and the qualifications and training of healthcare professionals.
• Provide information to other third parties with whom we do business, such as a record storage provider. However, you should know that in these situations, we require third parties to provide us with assurances that they will safeguard your information.
• Create de-identified or aggregated information in accordance with HIPAA, which we may use or disclose for purposes permitted by law, such as analytics, improving the Platform and related services, and developing and validating our technology (including artificial intelligence and related models).
• We may also use or disclose your personal or health information for operational purposes. For example, we may communicate with individuals involved in your care or payment for that care, such as family or guardians and send appointment reminders.

All other uses and disclosures, not previously described, may only be done with your written authorization. We will also obtain your authorization before we:

• Use or disclose your health information for marketing purposes;
• Sell your information; or
• Share health treatment notes (in most cases).

You may revoke your authorization at any time; however, this will not affect prior uses and disclosures. In some cases, state law may require that we apply extra protections to some of your health information.

What are the Healthcare Professional’s Responsibilities?

We are required by law to:

• Maintain the privacy and security of your health information.
• Provide a copy of this Notice of our duties and privacy practices.
• Abide by the terms of the Notice currently in effect.
• Promptly tell you if there has been a breach that may have compromised the privacy or security of your health information.

We reserve the right to change this Notice and make the new practices effective for all the information we maintain. Revised notices will be posted on the Site.

What about use of Large Language Models (LLMs) in providing Services through the Platform?

The Services may include an AI-powered chatbot and other features that use large language models ("LLMs") to assist Professionals and patients by answering questions and providing nutrition-related suggestions, behavioral coaching, or other automated outputs based on your input and your usage data collected through the Device and Platform. Any recommendations or information provided by the AI chatbot or other LLM-powered features are general informational and educational content only and are not medical advice. You should verify any recommendations with your treating clinician or other qualified health care professional and should not disregard or delay seeking professional medical advice because of any content generated by the AI chatbot.

• Enhanced Data Analysis and Retrieval: LLMs, powered by advanced natural language processing, excel in comprehending and extracting valuable insights from Electronic Health Records (EHRs). This translates to faster and more accurate access to critical patient information, enabling healthcare professionals to make well-informed decisions promptly.
• Improved Documentation Accuracy: Through the integration of specialized medical transcription datasets, LLMs significantly elevate the accuracy of medical documentation. This ensures that patient records are not only created efficiently but also with a level of precision that reduces the likelihood of errors. This is critical for maintaining the integrity of patient histories and treatment plans.
• Predictive Healthcare and Disease Management: LLMs have demonstrated their potential in reimagining disease management by virtue of their ability to sift through extensive datasets and provide insights that can inform strategies for predicting, preventing, and managing diseases.
• Time Efficiency and Workflow Streamlining: By automating tasks related to data analysis and documentation, LLMs free up valuable time for healthcare professionals, like you, allowing you more time on direct patient care, ultimately leading to improved patient outcomes and a more efficient healthcare system.

LLMs learn the statistical relationships present in training datasets, which may include toxic language and historical biases along race, gender, sexual orientation, ability, language, cultural, and intersectional dimensions. While using the Platform and our Services, you should take potential model toxicity and bias into account, and you acknowledge and agree that: (i) outputs from the AI chatbot or other LLM-powered features may not always be accurate and may contain material inaccuracies even if they appear accurate because of their level of detail or specificity; (ii) you should not rely on any outputs without independently confirming their accuracy and appropriateness for your particular situation, including through consultation with a qualified health care professional where applicable; and (iii) the Services and any outputs may not reflect correct, current, or complete information and may not be tailored to your specific medical or nutritional needs. The Professionals providing advice are the human-in-the-loop and remain responsible for advice, recommendations, or subjective decisions that directly impact patients in high-risk domains.

We may use de-identified, aggregated, or otherwise appropriately protected data derived from your use of the Services (including your interactions with the AI chatbot) to provide, maintain, and improve the Services and to train, improve, and validate our AI models and algorithms, as described in the Privacy Policy. We will not use your identifiable protected health information ("PHI") for such purposes in a manner that violates HIPAA or other applicable laws, and we will not train our models on any materials that are not publicly available. When using our Services (including any AI chatbot or other LLM-powered features) to provide advice, recommendations, or subjective decisions that directly impact individuals in high-risk domains, a qualified professional in that field must review the content or decision prior to dissemination or finalization, and your business or practice is responsible for the accuracy and appropriateness of that information. Any data sent to LLMs is handled by models hosted within BiteQ's Azure infrastructure. No data is sent to external LLM providers such as ChatGPT, to protect your privacy.

Do you have any Federal Rights?

The law entitles you to:

If your health care services are provided through an independent health care provider or Clinic that uses the Platform, that provider or Clinic is generally responsible for responding to your requests to exercise HIPAA rights (such as access, amendment, or an accounting of disclosures), and we will assist your provider or Clinic in responding to such requests as required by our agreements and applicable law.

• Inspect and copy certain portions of your health information. We may deny your request under limited circumstances. You may request that we provide your health records to you in an electronic format.
• Request amendment of your health information if you feel the health information is incorrect or incomplete. However, under certain circumstances we may deny your request.
• Receive an accounting of certain disclosures of your health information made for the prior six (6) years, although this excludes certain disclosures for treatment, payment, and health care operations. (Fees may apply to this request.)
• Request that we restrict how we use or disclose your health information. However, we are not required to agree with your requests, unless you request that we restrict information

provided to a payor, the disclosure would be for the payor’s payment or healthcare operations, and you have paid for the health care services completely out of pocket.

• Request that we communicate with you at a specific telephone number or address.
• Obtain a paper copy of this notice even if you receive it electronically.
• Request that someone act for you, such as if you have given someone medical power of attorney or if someone is your legal guardian. We will confirm that the person has the authority and can act for you before taking any action.
• File a complaint if you feel that we have violated your rights, as outlined in the “What if I have a complaint?”

We may ask that you make some of these requests in writing.

What if I have a complaint?

If you believe that your privacy has been violated, you may file a complaint with us or with the Secretary of Health and Human Services in Washington, D.C. If your health care services are provided through an independent health care provider or Clinic that uses the Platform, you may also contact that provider or Clinic directly with questions or concerns about its privacy practices. We will not retaliate or penalize you for filing a complaint with us or the Secretary. To file a complaint with us or receive more information, please submit a request through e-mail support@biteq.ai

To file a complaint with the Secretary of Health and Human Services write to 200 Independence Ave., S.E., Washington, D.C. 20201, call 1-800-537-7697, or file an online complaint at https://ocrportal.hhs.gov/ocr/smartscreen/main.jsf.

Who will follow this Notice?

This Notice describes the health care practices of:

• Any Healthcare Professional authorized to access and/or enter information into your health record through the Platform;
• The Platform, and the independent health care providers, Clinics, and Professionals who use the Platform to provide telehealth and in-person health services; and
• All affiliates and volunteers.