Peridra Privacy & HIPAA Compliance Notice

PERIDRA PRIVACY & HIPAA COMPLIANCE NOTICE Effective Date: September 29, 2026 Version 1.0 1. PURPOSE Peridra is a care-management technology platform used by authorized facilities and workforce members to manage resident information, medications, appointments, documentation, tasks, schedules, attendance, reports, and related operations. Some information maintained through Peridra may constitute Protected Health Information (PHI) or electronic Protected Health Information (ePHI). 2. PERIDRA ROLE When Peridra creates, receives, maintains, or transmits PHI on behalf of a HIPAA covered entity or another business associate, Peridra may act as a Business Associate. Peridra will use or disclose PHI only as permitted by applicable law, an applicable Business Associate Agreement, and authorized customer instructions. This document does not replace a covered entity's own Notice of Privacy Practices. 3. INFORMATION MAINTAINED Depending on platform use, Peridra may maintain resident identifying information, medical information, diagnoses, allergies, medications, medication administration records, care notes, appointments, emergency contacts, staff information, schedules, training records, electronic signatures, audit records, IP addresses, device/browser information, and location information when an authorized location-based feature is enabled. 4. AUTHORIZED USE PHI and confidential resident information may be accessed only by authorized users and only for legitimate care, treatment, operations, documentation, security, compliance, or other authorized purposes. Users must follow the minimum-necessary principle when accessing, using, or sharing information. 5. FACILITY RESPONSIBILITY Each facility is responsible for assigning appropriate user roles and permissions, promptly disabling accounts that no longer require access, training its workforce, maintaining required privacy notices and procedures, and ensuring its use of Peridra complies with applicable law. 6. SECURITY Peridra is designed to support administrative and technical safeguards such as authentication, role-based access, facility-level isolation, audit/activity logging, session controls, secure communications, backups, access monitoring, and security maintenance. No electronic system can guarantee absolute security. 7. USER RESPONSIBILITIES Users must protect passwords, never share login credentials, access records only for authorized work, log out of shared devices, avoid unauthorized downloads or disclosures, and promptly report suspected privacy or security incidents, lost devices, or unauthorized access. 8. DISCLOSURES Information may be disclosed as necessary to provide authorized services, as directed by the responsible facility, as permitted by an applicable agreement, as required by law, or as necessary to investigate security incidents or protect users and systems. Peridra does not sell PHI and does not use PHI for unrelated behavioral advertising. 9. SERVICE PROVIDERS Peridra may use infrastructure or service providers for hosting, communications, backups, security, and support. When a vendor creates, receives, maintains, or transmits PHI and applicable law requires it, appropriate contractual protections should be maintained. 10. SECURITY INCIDENTS AND BREACHES Suspected unauthorized access will be investigated. When required by law or contract, Peridra will notify the responsible customer regarding a reportable breach involving unsecured PHI so required mitigation and notification procedures can be followed. 11. INDIVIDUAL RIGHTS Individuals may have rights under applicable law to access, amend, restrict, or obtain information about uses and disclosures of their health information. Because Peridra generally maintains information on behalf of a facility, requests concerning resident records should ordinarily be directed to that facility. Peridra will assist customers as required by applicable agreements and law. 12. RETENTION AND TERMINATION Information may be retained as necessary to provide contracted services, comply with record-retention requirements, resolve disputes, protect legitimate interests, and meet legal obligations. On termination, PHI will be handled according to the applicable customer agreement, Business Associate Agreement, law, and Peridra retention procedures. 13. WORKFORCE ACKNOWLEDGMENT A user's electronic acknowledgment records that the user received, reviewed, and agreed to follow Peridra privacy, confidentiality, security, and acceptable-use requirements. It is not a substitute for a patient authorization when an authorization is legally required, and it is not a substitute for a covered entity's Notice of Privacy Practices. 14. CONTACT Privacy and security questions should be directed to the Peridra Privacy & Security Office using the contact information published by Peridra or to the user's facility privacy officer when the question concerns the facility's records or practices.