Notice of Privacy Practices

Effective 12 Aug 2026

PART I — INTRODUCTION

1. About This Notice

Wider Circle, Inc. (“Wider Circle,” “we,” “our,” or “us”) is a family of companies that connects members to community, care, and coverage. This Notice explains how the Wider Circle family of companies collects, uses, and shares information about you across our different lines of activity.

This single document does two jobs. The first job is a Notice of Privacy Practices under the federal Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (collectively, “HIPAA”). The HIPAA portion of this Notice (Part II) is the Joint Notice of the Affiliated Covered Entity described in Section 4, comprising WiderCare Community Health PC and Menda Behavioral Health Services PC. The second job is a consumer privacy notice (Part III) that describes how the broader Wider Circle family handles personal information that is not protected health information under HIPAA, including information collected through our community engagement program, our brokerage activities, our social platform, our management services, and our website. Each part is clearly labeled, and Section 3 tells you which part applies to which interaction.

Please read this Notice carefully. Where federal HIPAA and state law differ, we will follow the more protective rule. Where this Notice and a separate written agreement you sign with us (for example, a clinical consent form, a Connect for Life membership form, or an Ask Claire scope-of-appointment form) differ, the more protective terms control.

2. The Wider Circle Family

This Notice applies to information collected, used, or shared by Wider Circle, Inc. and the affiliates listed below. The HIPAA role each affiliate plays is identified so you can understand which protections apply when you interact with them.

2.1 Wider Circle, Inc. (parent company)

Wider Circle, Inc. is the parent company of the Wider Circle family of companies and the publisher of this Notice. Wider Circle, Inc. is not a HIPAA covered entity. Wider Circle, Inc. is a First Tier, Downstream, and Related Entity (an “FDR”) for the Medicare Advantage organizations and Part D plan sponsors with which it contracts, as defined in 42 C.F.R. §§ 422.500 and 423.501, and is subject to the contractual flow-down compliance obligations of 42 C.F.R. §§ 422.504(i) and 423.505(i). Wider Circle, Inc. operates the Connect for Life community engagement program described in Section 10 and the corporate website and marketing functions described in Section 13. When Wider Circle, Inc. receives protected health information from a contracted health plan in connection with these activities, it does so as a business associate of that plan under a written business associate agreement.

2.2 WiderCare Health Management, LLC (management services organization)

WiderCare Health Management, LLC (“WiderCare Health Management” or the “MSO”) is the management services organization for the Wider Circle clinical affiliates. The MSO provides administrative, operational, billing, technology, human resources, compliance, and similar back-office services to WiderCare Community Health PC and Menda Behavioral Health Services PC under written management services agreements. WiderCare Health Management is not a HIPAA covered entity in its own right. To the extent WiderCare Health Management creates, receives, maintains, or transmits protected health information on behalf of the clinical affiliates, it acts as a business associate of those affiliates under written business associate agreements that comply with 45 C.F.R. § 164.504(e). The MSO is not a treating provider, does not direct clinical care, and does not make clinical decisions about your care.

2.3 WiderCare Community Health PC

WiderCare Community Health PC (“WiderCare Community Health”) is a professional corporation that delivers community-based clinical services, including Community Health Integration (CHI), Principal Illness Navigation (PIN), and Shared Medical Appointments (SMA). WiderCare Community Health is a HIPAA covered entity and is one of the two participants in the Affiliated Covered Entity described in Section 4.

2.4 Menda Behavioral Health Services PC

Menda Behavioral Health Services PC (“Menda”) is a professional corporation that delivers pain management services, with a behavioral health treatment model that includes individual and group clinical encounters and Shared Medical Appointments. Menda is a HIPAA covered entity and is one of the two participants in the Affiliated Covered Entity described in Section 4. Because Menda delivers behavioral health services, certain categories of information about your care may receive additional protection under HIPAA and applicable state law, including psychotherapy notes (Section 6), mental health information generally (Section 14), and substance use disorder records when applicable (Section 9).

2.5 Ask Claire Insurance Services, LLC

Ask Claire Insurance Services, LLC (“Ask Claire”) is a wholly-owned Wider Circle subsidiary licensed as an insurance producer in the states in which it operates. Ask Claire provides Medicare and other insurance brokerage services, helping eligible individuals understand and enroll in Medicare Advantage plans, Medicare Part D plans, and other insurance products in the geographies where Ask Claire is contracted. Ask Claire is not a HIPAA covered entity. With respect to Medicare Advantage and Part D activity, Ask Claire is a Third-Party Marketing Organization (a “TPMO”) under 42 C.F.R. § 422.2260 and 42 C.F.R. § 423.2260; with respect to other insurance lines, Ask Claire is a licensed producer subject to state insurance law. Ask Claire may act as a business associate of a Medicare Advantage organization or Part D plan sponsor when it receives protected health information from that plan under a written agreement. Section 11 of this Notice describes Ask Claire’s privacy practices.

2.6 Hank

Hank is a Wider Circle social platform that lets members connect with one another, join interest- and condition-based groups, and participate in self-directed peer activities. Hank is not a clinical service and is not a HIPAA covered entity. Information you share on Hank is governed by the consumer privacy disclosures in Section 12. If you receive clinical care from a Wider Circle covered entity that incorporates information from your Hank account into your medical record, that information is then protected health information governed by Part II of this Notice.

2.7 Other Wider Circle affiliates

Wider Circle may from time to time form or acquire additional affiliates, including joint ventures, additional clinical entities, and additional service providers. When that occurs, this Notice will be updated as appropriate to reflect any change in the entities to which Part II or Part III applies.

3. Which Part of This Notice Applies to You

If you are receiving clinical care from WiderCare Community Health or Menda, Parts II and IV of this Notice apply to that care.

If you are a member of a Medicare Advantage organization or other health plan that contracts with Wider Circle, Inc. to provide Connect for Life, your information is primarily governed by your plan’s Notice of Privacy Practices and the business associate agreement between Wider Circle and the plan. Section 10 of this Notice describes Wider Circle, Inc.’s practices in plain language.

If you are working with an Ask Claire agent to evaluate or enroll in a Medicare Advantage, Part D, or other insurance plan, Section 11 of this Notice applies. Ask Claire is also subject to CMS marketing rules at 42 C.F.R. Part 422, Subpart V, and 42 C.F.R. Part 423, Subpart V, and to applicable state insurance law.

If you are using Hank, Section 12 applies.

If you are visiting our website, opening a marketing email, or interacting with our public-facing digital properties, Section 13 applies.

Part IV applies across all interactions.

PART II — JOINT NOTICE OF PRIVACY PRACTICES (HIPAA)

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

4. Affiliated Covered Entity Designation; Scope of Part II

WiderCare Community Health PC and Menda Behavioral Health Services PC are legally separate covered entities under common ownership and control. Pursuant to 45 C.F.R. § 164.105(b), these two entities have designated themselves as a single covered entity for purposes of HIPAA compliance (the “Affiliated Covered Entity”). The Affiliated Covered Entity designation is documented in a written instrument maintained by Wider Circle in its privacy compliance file.

This Part II is a joint notice of privacy practices for the Affiliated Covered Entity, issued under 45 C.F.R. § 164.520(d) where applicable. Each participant is bound by this Part II and may share protected health information with the other participant for the joint operations of the Affiliated Covered Entity, including for treatment, payment, and health care operations.

Wider Circle, Inc. (the parent company) and WiderCare Health Management, LLC (the MSO) are not covered entities and are not participants in the Affiliated Covered Entity. They may act as business associates of the Affiliated Covered Entity when they create, receive, maintain, or transmit protected health information on its behalf, and they are bound by written business associate agreements with the Affiliated Covered Entity that comply with 45 C.F.R. § 164.504(e). Section 5.5 describes our business associate practices.

This Part II applies to all protected health information (“PHI”) that the Affiliated Covered Entity creates, receives, maintains, or transmits, whether held in electronic, paper, or oral form. PHI is individually identifiable health information that relates to your past, present, or future physical or mental health condition, the health care provided to you, or the past, present, or future payment for that care.

This Part II also applies to substance use disorder records protected by 42 C.F.R. Part 2 (“Part 2”) that the Affiliated Covered Entity creates, receives, or maintains as a Part 2 program or as a lawful holder, as described in Section 9.

5. How We Use and Disclose PHI Without Your Authorization

The federal HIPAA rules permit covered entities to use and disclose PHI for certain purposes without your written authorization. The categories below describe the most common uses and disclosures we make. Where state law is more protective, we follow the state law. See Section 14 for state-law overlays.

5.1 Treatment

We use and disclose PHI to provide, coordinate, and manage your health care and related services. Our clinicians at WiderCare Community Health and Menda may share information about your conditions, medications, allergies, and recent visits with one another so that the care you receive across the Affiliated Covered Entity is consistent and complete. We may disclose PHI to physicians, hospitals, laboratories, pharmacies, durable medical equipment suppliers, home health agencies, behavioral health providers, community health workers, and other health care providers and their agents to coordinate the services you receive from them.

5.2 Payment

We use and disclose PHI to bill and collect for the care we provide. We may disclose PHI to your Medicare Advantage organization, traditional Medicare, Medicaid managed care organization, or other health plan to determine your eligibility, obtain prior authorization, submit claims, and resolve coverage or billing disputes. We may also disclose PHI to other health care providers and to business associates that perform billing, coding, claims processing, and collections services for us, including WiderCare Health Management.

5.3 Health Care Operations

We use and disclose PHI to operate the Affiliated Covered Entity and to support the quality, safety, and effectiveness of the care we provide. Examples include quality assessment and improvement activities, case management and care coordination, clinician evaluation and credentialing, training of students and workforce members, internal audits, accreditation, licensure activities, business planning and development, and customer service. We may share PHI with another covered entity that has a current or past treatment relationship with you when that other entity needs the information for its own quality assessment, case management, or fraud and abuse detection activities, as permitted by 45 C.F.R. § 164.506(c)(4).

5.4 Sharing Within the Affiliated Covered Entity

Because WiderCare Community Health and Menda have designated themselves as an Affiliated Covered Entity, the two participants share PHI with one another for the joint operations of the Affiliated Covered Entity as if they were a single covered entity, subject to applicable minimum necessary requirements. For example, your Menda pain management record may be made available to a WiderCare Community Health clinician who is also caring for you.

5.5 Business Associates

We use business associates to perform services on our behalf. These include WiderCare Health Management (which provides management services to both participating PCs) and Wider Circle, Inc. (which provides corporate services and operates Connect for Life-related care coordination flows for contracted plans where you are also a Menda or WiderCare Community Health patient). We also use third-party business associates including technology vendors, billing services, care coordination services, analytics services, accreditation organizations, and consultants. We require each business associate to safeguard your PHI through a written business associate agreement that meets the requirements of 45 C.F.R. § 164.504(e) and, where applicable, 42 C.F.R. § 2.32.

5.6 Individuals Involved in Your Care; Family and Friends; Notification

Unless you object, we may disclose PHI directly relevant to a person’s involvement in your care or payment for your care, including to a family member, relative, close personal friend, or other person you identify. We may also use or disclose PHI to notify (or assist in notifying) a family member, personal representative, or another person responsible for your care of your location, general condition, or death. Where you are present and have capacity to make decisions, we will give you an opportunity to agree or object before we share PHI with these individuals. In emergencies and other circumstances in which you cannot agree or object, we will use professional judgment to determine whether disclosure is in your best interests.

5.7 Appointment Reminders, Treatment Alternatives, Health-Related Benefits and Services

We may contact you to provide appointment reminders, information about treatment alternatives, or information about health-related benefits and services that may be of interest to you. These communications are not “marketing” under HIPAA so long as they relate to your current treatment, case management or care coordination, or health-related products or services provided by, included in a plan of benefits of, or available only through the Affiliated Covered Entity or a network of providers that includes the Affiliated Covered Entity.

5.8 Public Health, Health Oversight, and Required-by-Law Disclosures

We may use or disclose PHI without your authorization when permitted or required by law for the following purposes:

•       Public health activities, including disease reporting, vital statistics, child abuse and neglect reporting, FDA-regulated product reporting and recalls, occupational injury reporting, and notification of persons exposed to a communicable disease.
•       Reporting of victims of abuse, neglect, or domestic violence to a government authority authorized by law to receive such reports.
•       Health oversight activities, including audits, investigations, inspections, licensure and disciplinary actions, and civil, administrative, or criminal proceedings or actions for which oversight is authorized by law.
•       Judicial and administrative proceedings, in response to a court or administrative order, or in response to a subpoena, discovery request, or other lawful process accompanied by appropriate assurances under 45 C.F.R. § 164.512(e).
•       Law enforcement, in the limited circumstances permitted by 45 C.F.R. § 164.512(f), and subject to the additional limitations described in Sections 8 and 9 below for reproductive health care information and substance use disorder records.
•       Coroners, medical examiners, and funeral directors, as necessary to carry out their duties.
•       Organ, eye, and tissue donation purposes, when authorized under applicable law.
•       Research, when an Institutional Review Board or Privacy Board has approved a waiver of authorization, when the research uses only decedents’ information, or when the disclosure is otherwise permitted under 45 C.F.R. § 164.512(i).
•       Serious threats to health or safety, when, in good faith, we believe the disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, and to a person or persons reasonably able to prevent or lessen the threat.
•       Specialized government functions, including activities of armed forces personnel, national security and intelligence activities, protective services for the President, and medical suitability determinations.
•       Workers’ compensation programs, as authorized by and to the extent necessary to comply with workers’ compensation laws.
•       Inmates and correctional institutions, in the limited circumstances permitted by 45 C.F.R. § 164.512(k)(5).
•       Any other use or disclosure required by federal, state, or local law, including reporting obligations imposed by the Centers for Medicare & Medicaid Services and state health departments.

5.9 Fundraising

The Affiliated Covered Entity does not currently use PHI for fundraising. If we begin to do so, we will provide a clear and conspicuous opportunity to opt out of receiving fundraising communications, in accordance with 45 C.F.R. § 164.514(f), and we will update this Notice.

6. Uses and Disclosures That Require Your Written Authorization

Except as otherwise permitted or required by law, we will use and disclose PHI only with your written authorization. In particular, your written authorization is required for:

•       Most uses and disclosures of psychotherapy notes. “Psychotherapy notes” means notes recorded by a mental health professional documenting or analyzing the contents of a counseling session and maintained separately from the rest of your medical record, as defined in 45 C.F.R. § 164.501. Because Menda delivers behavioral health services, your provider may create psychotherapy notes; if so, those notes receive heightened protection.
•       Uses and disclosures of PHI for marketing purposes, including subsidized treatment communications and most communications encouraging you to purchase or use a product or service.
•       The sale of PHI, as defined by 45 C.F.R. § 164.502(a)(5)(ii).
•       Most uses and disclosures of substance use disorder records, as described in Section 9.
•       Any other use or disclosure not described in this Notice or otherwise permitted by law.

You may revoke your written authorization at any time by submitting written notice to our Privacy Officer at the address in Section 21. Revocation does not affect uses or disclosures we have already made in reliance on the authorization.

7. Online Tracking Technologies in Authenticated Settings

We treat information collected through any authenticated patient portal or member tool operated by a participant in the Affiliated Covered Entity as PHI, and we apply this Part II to that information. We follow current guidance from the U.S. Department of Health and Human Services Office for Civil Rights regarding the use of online tracking technologies by HIPAA-regulated entities, including the limitations on third-party tracking technologies in authenticated experiences and on pages addressing specific health conditions or providers. Our handling of cookies and similar technologies on our public-facing websites is described in Section 13.

8. Reproductive Health Care Information

Information relating to reproductive health care, including, without limitation, contraception, pregnancy testing, prenatal care, miscarriage management, abortion care, fertility services, and related counseling, is sensitive. We treat reproductive health care information with the same confidentiality protections that apply to all PHI under HIPAA and, where applicable, with the additional protections required by state law.

Several states in which we operate provide heightened protection for reproductive health care information, restrict cooperation with out-of-state investigations targeting lawful reproductive health care, or impose specific shield-law protections. We will use and disclose your reproductive health care information consistent with applicable state and federal law and only when we have a lawful basis to do so. Where state law gives you greater rights or imposes greater restrictions on disclosure than HIPAA does, we will follow the state law.

If we receive a request for your reproductive health care information for purposes of investigating or imposing liability on a person for seeking, obtaining, providing, or facilitating reproductive health care that is lawful under the circumstances in which it was provided, we will evaluate that request carefully under applicable law, and we may decline to make the disclosure where law permits.

Drafting note: On June 18, 2025, the U.S. District Court for the Northern District of Texas vacated most of the 2024 HIPAA Privacy Rule to Support Reproductive Health Care Privacy (89 Fed. Reg. 32976), including the federal attestation requirement at 45 C.F.R. § 164.509 and the related NPP provisions at § 164.520(b)(1)(ii)(F)–(H) (Purl v. HHS). The Fifth Circuit dismissed the appeal. This Notice does not rely on the vacated provisions; protection for reproductive health information rests on HIPAA confidentiality, the more-protective-state-law overlay, and Affiliated Covered Entity discretion to decline disclosures not affirmatively required by law.

9. Substance Use Disorder Records

Some of the information we create, receive, or maintain about you may be a “record” covered by the federal Confidentiality of Substance Use Disorder Patient Records regulations at 42 C.F.R. Part 2 (“Part 2”). Part 2 imposes confidentiality protections that, in many circumstances, are stricter than HIPAA. These protections apply whether we create the record ourselves or receive the record from another provider or program that is subject to Part 2 (we are then a “lawful holder” of the record under Part 2).

Because Menda delivers pain management services, some of the patients we care for may be in active treatment for, or carry a diagnosis of, a substance use disorder, and the records we receive in coordinating that care may include SUD records. We handle those records consistent with Part 2 whether the source is a treating Part 2 program or another provider.

9.1 What Part 2 Protects

Part 2 generally protects information that would identify a person as having a substance use disorder, having been treated for a substance use disorder, or having sought a diagnosis of a substance use disorder, when that information has been created or received by a Part 2 program or by a lawful holder. Part 2 information is sometimes referred to in this Notice as “SUD records.”

9.2 Uses and Disclosures Permitted Without Patient Consent

As amended by the SAMHSA final rule published at 89 Fed. Reg. 12472 (Feb. 16, 2024), with a compliance date of February 16, 2026, Part 2 permits us to use and disclose SUD records without your written consent for the following purposes, among others:

•       Medical emergencies that pose an immediate threat to the health of any individual and require immediate medical intervention.
•       Scientific research that meets the requirements of 42 C.F.R. § 2.52.
•       Audits and program evaluations that meet the requirements of 42 C.F.R. § 2.53.
•       Reports of suspected child abuse or neglect made under applicable state law to the appropriate state or local authority.
•       Crimes on the premises of a Part 2 program or against program personnel, as permitted by 42 C.F.R. § 2.12(c)(5).
•       Disclosures required by federal, state, or local laws that require certain reports of injuries, communicable or sexually transmitted diseases, or similar information.
•       Disclosures to our business associates and other service providers under written agreements that comply with 42 C.F.R. § 2.32.

9.3 Uses and Disclosures Requiring Your Written Consent

Other uses and disclosures of SUD records, including disclosures for treatment, payment, and health care operations performed by another entity, generally require your written consent. Under the 2024 amendments to Part 2, a single written consent may now authorize uses and disclosures of SUD records for treatment, payment, and health care operations purposes by the Affiliated Covered Entity and other recipients identified in the consent. You may revoke that consent in writing at any time, except to the extent that we have already acted in reliance on it. Disclosures for use in civil, criminal, administrative, or legislative proceedings against you are subject to the additional restrictions in 42 C.F.R. § 2.65 and, where applicable, § 2.67, and generally require a court order even if you have signed a consent.

9.4 Notice Accompanying Disclosures

Most disclosures of SUD records must be accompanied by a written statement notifying the recipient that the records are protected by Part 2 and that the recipient may not further use or disclose the records except as permitted by Part 2 or with your written consent.

9.5 Your Rights Specific to SUD Records

In addition to the patient rights described in Section 15, you have the following rights with respect to SUD records:

•       The right to request a restriction on uses and disclosures of SUD records for treatment, payment, and health care operations, including a restriction on disclosures to a health plan when you have paid for the relevant service in full out of pocket.
•       The right to receive an accounting of disclosures of SUD records made for treatment, payment, or health care operations purposes through an electronic health record, where applicable.
•       The right to file a complaint regarding our handling of SUD records with us, with the Secretary of the U.S. Department of Health and Human Services, and with the Substance Abuse and Mental Health Services Administration (SAMHSA).

9.6 Breach Notification

If a breach of unsecured SUD records occurs, we will provide notification under the HITECH Act breach notification rules at 45 C.F.R. §§ 164.400–414, which now apply to Part 2 records as well as to other PHI.

PART III — CONSUMER PRIVACY DISCLOSURES (NON-HIPAA ACTIVITIES)

Part III of this Notice describes how the Wider Circle family handles personal information that is not protected health information under HIPAA. This includes information collected and used through the Connect for Life program (when not flowed under a business associate agreement with a health plan), Ask Claire brokerage activities, the Hank social platform, the Wider Circle website, our marketing and corporate communications, and the management services functions of WiderCare Health Management. If information described in Part III is later incorporated into the medical record of a Wider Circle covered entity (for example, when a clinician relies on it during a visit), that information is then PHI and is governed by Part II.

10. Connect for Life Outreach

Wider Circle, Inc. operates the Connect for Life program (“CFL”). When CFL is delivered on behalf of a Medicare Advantage organization or other health plan under a business associate agreement, your information is governed primarily by your plan’s Notice of Privacy Practices and the business associate agreement between Wider Circle, Inc. and the plan. Wider Circle, Inc. uses your information only for the purposes permitted by that agreement, including community outreach, member engagement, social determinants of health screening, and care coordination.

Connect for Life outreach typically begins with an outbound telephone call. We rely on prior express consent obtained by your health plan, on the healthcare-message exemption at 47 C.F.R. § 64.1200(a)(3)(v) where it applies, and on other applicable Telephone Consumer Protection Act and state telemarketing law provisions. You may request that we stop calling you at any time, and we will honor that request. Where SMS or text-message communications are used, we use them only for healthcare-scoped purposes, only at your health plan’s direction, and only with the consent your plan has obtained.

Once you have engaged with Connect for Life and joined a CFL group, your participation in events, your interactions with peers and program facilitators, and the social determinants of health information you choose to share with us are recorded and used to deliver the program. We do not sell your Connect for Life information, and we do not share it with third parties for those third parties’ own marketing purposes.

11. Ask Claire (Medicare and Insurance Brokerage)

Ask Claire is a licensed insurance producer and a wholly-owned Wider Circle subsidiary. Ask Claire helps eligible individuals understand and enroll in Medicare Advantage plans, Medicare Part D plans, and other insurance products in the geographies where Ask Claire is contracted. Ask Claire represents a limited set of plans in each geography. With respect to Medicare Advantage and Part D activity, Ask Claire is required by federal regulation to disclose to you, in writing, electronically, and verbally within the first minute of any sales-related telephone call, the number of plans Ask Claire represents in your geography, with the federally required language under 42 C.F.R. § 422.2267(e)(31) and 42 C.F.R. § 423.2267(e)(31).

11.1 Information Ask Claire Collects

To help you evaluate and enroll in a plan, Ask Claire collects identity, contact, eligibility, and household information from you, and may collect Medicare information you authorize us to access. Ask Claire may also receive information from you through completed scope-of-appointment forms, enrollment applications, and follow-up communications. For non-Medicare insurance lines, Ask Claire may collect additional information required by the carrier and by state insurance law to underwrite or place coverage.

11.2 How Ask Claire Uses That Information

Ask Claire uses your information to verify eligibility, help you compare plan options, complete enrollments, submit enrollment information to the Medicare Advantage organization, Part D plan sponsor, or other insurance carrier you choose, and provide ongoing service. For Medicare Advantage and Part D activity, Ask Claire is required to record sales-related calls with Medicare beneficiaries and to retain those recordings for the period required by 42 C.F.R. § 422.2274(g).

11.3 Ask Claire and Other Wider Circle Affiliates

Ask Claire is an affiliate of Wider Circle, Inc., WiderCare Community Health, Menda, and the other entities described in Section 2. Ask Claire does not receive your protected health information from those affiliates without your authorization or a permitted basis under HIPAA, and Ask Claire’s recommendations to you are governed by the federal Anti-Kickback Statute, the CMS Medicare Communications and Marketing Guidelines, the federal regulations governing Medicare brokerage activity, and state insurance law. You are free to enroll in a plan that Ask Claire does not represent or to use a different broker, and Ask Claire’s representation of a plan does not entitle the plan to additional information about you beyond what is required to evaluate or process the enrollment you authorize.

11.4 State Insurance Producer Compliance

Ask Claire is licensed as an insurance producer in each state in which it transacts insurance business and is subject to that state’s insurance regulatory framework, including, where applicable, state insurance information privacy and protection acts that may impose additional disclosure and consent obligations on the collection, use, and sharing of personal information collected in connection with insurance transactions. Where state insurance law is more protective than this Notice, Ask Claire will follow the state law.

11.5 Your Choices with Ask Claire

You may decline to share information with Ask Claire, decline to be recorded (in which case Ask Claire may be unable to assist you with enrollment over the phone), and withdraw an enrollment application before submission. You may also direct Ask Claire to stop contacting you for marketing purposes at any time.

12. Hank (Community Platform)

Hank is Wider Circle’s social platform, designed to let members connect with one another, join interest- and condition-based groups, and participate in self-directed peer activities. Hank is not a clinical service, and Hank is not a HIPAA covered entity.

12.1 Information Hank Collects

To operate Hank, we collect account information you provide on registration (such as your name, contact information, and basic profile data), content you post or share (including in groups and direct messages), connections with other members, and usage information about how you interact with the platform. We may also collect device and browser information automatically through cookies and similar technologies, as described in Section 13.

12.2 How Hank Uses That Information

We use Hank information to operate the platform, deliver and personalize content and group recommendations, communicate with you about your account and Hank features, perform safety and content moderation activities, and improve the platform. We use Hank information to enforce our community guidelines and to respond to reports of abuse, harassment, or unsafe content.

12.3 What Other Members Can See

Information you make available on Hank, including profile information, posts, comments, and group activity, may be visible to other Hank members consistent with the privacy settings of the relevant group or feature. Direct messages are visible to recipients. Be thoughtful about what you share. If you share information about your health on Hank, it is shared at your direction with the audience you select; it does not become PHI unless a Wider Circle clinician incorporates it into your medical record.

12.4 What Hank Shares with Others

We do not sell Hank information. We share Hank information with our service providers under written contracts that require them to protect it and use it only for our purposes. We may share Hank information with other Wider Circle affiliates for operational and safety purposes. We may disclose Hank information to law enforcement or other government authorities only where required or permitted by law and only consistent with the policies described in Section 18.

12.5 Your Choices on Hank

You may edit your profile, manage your privacy settings, delete content you have posted, leave groups, block other members, and close your Hank account. Closure of your Hank account does not affect the records or care provided by any Wider Circle covered entity, which are governed by Part II of this Notice.

13. Website, Mobile App, and Marketing Communications

This Section 13 describes information collected through widercircle.com, related Wider Circle websites, our mobile applications, our marketing emails, and our public-facing digital tools. This Section applies to interactions with our public-facing properties that are not authenticated portals of a Wider Circle covered entity (which are governed by Part II).

13.1 Information Collected Automatically

We and our service providers collect device, browser, and usage information automatically when you visit our public-facing properties, including IP address, device and browser identifiers, pages visited, links clicked, referring URLs, time and duration of visit, and information collected through cookies, pixels, software development kits, and similar technologies.

13.2 Cookies and Similar Technologies

We use cookies and similar technologies for three categories of purposes: (a) strictly necessary cookies that enable site functionality, including authentication and security; (b) analytics cookies that help us understand how visitors use our properties; and (c) marketing cookies that support advertising activity on our properties and on third-party sites. You can manage cookies through your browser settings, and where required by law, we provide an in-product control that allows you to set your preferences for non-essential cookies. We honor recognized opt-out signals, including the Global Privacy Control, where required by applicable state law.

13.3 Marketing Communications

We may send you marketing emails and other marketing communications about Wider Circle programs and services, including invitations to events, newsletters, and information about Wider Circle affiliates. You may opt out of marketing communications at any time using the unsubscribe link in our emails or by contacting us as described in Section 21. Transactional communications (such as account notices, appointment reminders, and security alerts) will continue even after you opt out of marketing.

13.4 Sale and Sharing of Personal Information

Wider Circle does not sell personal information for money. Where state law treats certain disclosures for cross-context behavioral advertising as a “sale” or “share,” we provide the disclosures and opt-out rights required by that state law. You can manage your preferences using the “Do Not Sell or Share My Personal Information” link on our website and by setting the Global Privacy Control in your browser, which we honor as required by applicable state law.

13.5 Children

Wider Circle’s public-facing websites and apps are not directed to children under 13, and we do not knowingly collect personal information from children under 13. Clinical services delivered to minors by Wider Circle covered entities are governed by Part II of this Notice and by applicable state law concerning minor consent.

PART IV — YOUR RIGHTS AND COMMON PROVISIONS

14. State-Law Overlays

Wider Circle delivers services in California, Arizona, Texas, New Mexico, Florida, Louisiana, Georgia, Pennsylvania, South Carolina, North Carolina, New Jersey, Maryland, the District of Columbia, Virginia, and Michigan. State law in many of these jurisdictions provides additional protection for certain categories of health information beyond HIPAA, and several states also provide consumer privacy rights that apply to information not regulated by HIPAA. Where state law is more protective than federal law, we follow the state law. Because Menda delivers behavioral health services, state-law protections for mental health information are particularly relevant to Menda’s records.

14.1 California

If you are a California resident, your medical information receives additional protection under the California Confidentiality of Medical Information Act, Cal. Civ. Code §§ 56–56.37 (“CMIA”). CMIA generally requires your specific written authorization for disclosure of medical information for purposes that are not “treatment, payment, or health care operations” as those terms are defined under California law, and CMIA provides additional protections for psychotherapy, mental health, HIV testing, genetic testing, and other categories of information. California’s Lanterman-Petris-Short Act and related provisions also impose heightened confidentiality protections on certain mental health records. California also restricts the use of medical information for marketing and limits sharing with employers, insurers, and others. California provides additional protections for reproductive health care information and gender-affirming care information.

For information that is not PHI, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”), grants California residents rights including the right to know what personal information we have collected, the right to correct inaccurate personal information, the right to delete certain personal information, the right to limit the use of sensitive personal information, the right to opt out of sale or sharing, and the right to non-discrimination. See Section 16.

14.2 Texas

If you are a Texas resident, the Texas Medical Records Privacy Act, Tex. Health & Safety Code ch. 181 (“HB 300”), imposes additional requirements on covered entities, including training and electronic disclosure provisions. Texas law provides heightened protection for mental health, communicable disease, and HIV-related information. The Texas Data Privacy and Security Act, Tex. Bus. & Com. Code ch. 541, applies to information that is not PHI we hold as a HIPAA covered entity and grants Texas residents consumer privacy rights. See Section 16.

14.3 New Jersey

If you are a New Jersey resident, additional protections apply to mental health records, AIDS/HIV-related records under N.J. Stat. Ann. §§ 26:5C-1 to -14, genetic information, and certain other categories. The New Jersey Data Privacy Law, effective January 15, 2025, grants New Jersey residents consumer privacy rights with respect to information that is not PHI we hold as a HIPAA covered entity.

14.4 Maryland

If you are a Maryland resident, the Maryland Confidentiality of Medical Records Act, Md. Code Ann., Health-Gen. §§ 4-301 to -309, applies in addition to HIPAA. Maryland provides heightened protection for mental health records, HIV-related records, and genetic information. The Maryland Online Data Privacy Act, effective October 1, 2025, grants Maryland residents consumer privacy rights with respect to information that is not PHI we hold as a HIPAA covered entity.

14.5 Virginia

If you are a Virginia resident, the Virginia Health Records Privacy Act, Va. Code Ann. § 32.1-127.1:03, applies in addition to HIPAA. The Virginia Consumer Data Protection Act grants Virginia residents consumer privacy rights with respect to information that is not PHI we hold as a HIPAA covered entity.

14.6 Other States in Our Footprint

In Arizona, New Mexico, Florida, Louisiana, Georgia, Pennsylvania, South Carolina, North Carolina, the District of Columbia, and Michigan, state law provides additional protection for categories of information including (depending on the state) mental health records, HIV-related information, genetic information, communicable disease reports, abortion-related information, gender-affirming care information, and information concerning minors. We will follow each applicable state law where it is more protective than federal law.

14.7 Minors

State law in most of the jurisdictions in which we operate gives minors the right to consent to certain categories of treatment without parental involvement, including, depending on the state, treatment for sexually transmitted infections, reproductive health care, substance use disorders, mental health conditions, and abuse. Where a minor has lawfully consented to care without parental involvement, we will treat the related records consistent with applicable state law and the minor’s privacy rights.

15. Your HIPAA Rights

With respect to PHI that the Affiliated Covered Entity maintains about you, you have the following rights. You may exercise these rights by contacting our Privacy Officer using the information in Section 21.

15.1 Right to Access and Receive a Copy

You have the right to inspect and obtain a copy of PHI in our designated record set, including in electronic form when the information is maintained electronically. You may also direct us to transmit the copy to a third party you designate. We may charge a reasonable, cost-based fee as permitted by law. We will respond to your request within 30 days, with one 30-day extension if needed and disclosed to you in writing.

15.2 Right to Amend

You have the right to request that we amend PHI we maintain about you if you believe it is incorrect or incomplete. We may deny your request in limited circumstances permitted by 45 C.F.R. § 164.526. If we deny your request, we will explain why in writing, and you may submit a written statement of disagreement that will be included with future disclosures.

15.3 Right to an Accounting of Disclosures

You have the right to receive a list of certain disclosures we have made of your PHI during the six years before the date of your request, subject to the exceptions in 45 C.F.R. § 164.528. For disclosures of SUD records made for treatment, payment, or health care operations through an electronic health record, you have an additional accounting right under Part 2 as amended.

15.4 Right to Request Restrictions

You have the right to request that we restrict our uses and disclosures of PHI for treatment, payment, and health care operations, or to family members or others involved in your care. We are not required to agree to most restriction requests, but we will agree to your request that we not disclose PHI to a health plan for purposes of payment or health care operations if (a) the disclosure is not otherwise required by law, and (b) the PHI relates solely to a health care item or service for which you, or another person on your behalf (other than the health plan), has paid us in full.

15.5 Right to Confidential Communications

You have the right to request that we communicate with you about your health matters by a particular means or at a particular location. For example, you may ask that we contact you only at a specified telephone number or by mail at a specified address. We will accommodate reasonable requests.

15.6 Right to a Paper Copy of This Notice

You have the right to receive a paper copy of this Notice on request, even if you have agreed to receive it electronically.

15.7 Right to Notification of a Breach

You have the right to be notified following a breach of unsecured PHI, as required by 45 C.F.R. §§ 164.400–414 and, for SUD records, as described in Section 9.6 above.

15.8 Right to Choose Someone to Act for You

If you have given someone medical power of attorney, or if someone is your legal guardian, that person may exercise your rights and make choices about your PHI. We will verify that the person has this authority before we act on his or her behalf.

16. Your Consumer Privacy Rights

With respect to information that is not PHI we hold as a HIPAA covered entity, you may have additional rights under the laws of the state in which you reside. These rights may include the right to know what personal information we have collected about you and how we use and share it; the right to access and obtain a copy; the right to correct inaccurate personal information; the right to delete personal information (subject to legal exceptions); the right to limit the use and disclosure of sensitive personal information; the right to opt out of the sale or sharing of personal information; the right to opt out of targeted advertising; the right to opt out of certain profiling; the right to appeal a decision on a rights request; and the right to non-discrimination for exercising any of these rights.

To exercise any of these rights, please use the “Privacy Rights” form available on our website at [URL TBD], email us at privacy@widercircle.com, or contact us using the information in Section 21. We will verify your identity before responding, and we will respond within the time required by applicable law. If an authorized agent submits a request on your behalf, we will verify the agent’s authority to act for you.

17. Our Duties

The Affiliated Covered Entity is required by law to:

•       Maintain the privacy and security of your PHI.
•       Provide you with notice, like this Notice, of our legal duties and privacy practices with respect to your PHI.
•       Abide by the terms of the Notice currently in effect.
•       Notify you promptly if a breach occurs that may have compromised the privacy or security of your PHI.
•       Comply with the more protective of HIPAA and applicable state law for each use and disclosure of your PHI.

Wider Circle, Inc. and the other non-covered-entity affiliates listed in Section 2 are bound to corresponding obligations under federal and state consumer privacy law, under business associate agreements with the Affiliated Covered Entity, under contractual flow-down obligations from contracted Medicare Advantage and Part D plans, and under applicable state insurance law.

We will not use or disclose your PHI in a manner inconsistent with this Notice, except as permitted or required by law.

18. Disclosures to Law Enforcement or Government Authorities

We disclose your information to law enforcement or other government authorities only where required or permitted by law. For PHI, we follow the limited circumstances permitted by 45 C.F.R. § 164.512, including, where applicable, the additional restrictions on reproductive health care information described in Section 8 and on SUD records described in Section 9. For information that is not PHI, we follow applicable consumer privacy law, including the “required by law” and “establish, exercise, or defend legal claims” provisions of state consumer privacy statutes.

19. Data Retention

The Affiliated Covered Entity retains PHI for the period required by federal and state law applicable to medical records, including state-specific retention periods for adult and minor records. The other Wider Circle affiliates retain personal information for as long as needed to fulfill the purposes described in this Notice, to satisfy our legal, regulatory, and contractual obligations (including the call-recording retention obligations of 42 C.F.R. § 422.2274(g) applicable to Ask Claire), to resolve disputes, and to enforce our agreements. Specific retention practices for Connect for Life, Ask Claire, Hank, and our public-facing properties are available on request and are summarized in our internal records retention schedule.

20. Security

The Affiliated Covered Entity implements administrative, physical, and technical safeguards designed to protect your PHI consistent with the HIPAA Security Rule at 45 C.F.R. Part 164, Subpart C, the HITECH Act, and other applicable laws. WiderCare Health Management implements corresponding safeguards in its role as a business associate. The other Wider Circle affiliates implement reasonable safeguards consistent with applicable consumer privacy and information security law. No system can guarantee absolute security; we work to maintain appropriate safeguards and to respond promptly if a security incident occurs.

21. Contact Information

To exercise any of the rights described in this Notice, or to ask questions about our privacy practices, please contact our Privacy Officer:

Wider Circle, Inc. — Privacy Officer

Attn: Ken Wake, Chief Compliance Officer and Privacy Officer

50 Woodside Plaza
Suite 743
Redwood City, CA 94061

Email: privacy@widercircle.com

The Privacy Officer serves in this capacity for the Affiliated Covered Entity and for the other Wider Circle affiliates. Privacy requests directed to a specific affiliate will be routed accordingly.

Please direct any security-related concerns to: security@widercircle.com

22. Complaints

If you believe your privacy rights have been violated, you may file a complaint with us by contacting our Privacy Officer using the information above. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights:

U.S. Department of Health and Human Services

Office for Civil Rights

200 Independence Avenue, S.W., Room 509F

HHH Building, Washington, D.C. 20201

1-877-696-6775

https://www.hhs.gov/ocr/privacy/hipaa/complaints/ 

For complaints relating to SUD records, you may also file a complaint with the Substance Abuse and Mental Health Services Administration. For complaints relating to consumer privacy law, you may also contact the Attorney General of the state in which you reside. For complaints relating to insurance brokerage activity, you may also contact the Department of Insurance of the state in which you reside.

You will not be retaliated against for filing a complaint.

23. Changes to This Notice

We reserve the right to change this Notice and to make the revised Notice effective for information we already hold about you and for information we receive in the future. We will post the current Notice at widercircle.com/privacy and at the sites of service operated by our covered-entity affiliates. The effective date of the most recent Notice is shown on the first page. You may request a paper copy of the current Notice at any time. For material changes that affect our use or disclosure of sensitive personal information or PHI, we will provide additional notice consistent with applicable law.

24. Acknowledgment of Receipt

HIPAA requires the Affiliated Covered Entity to make a good-faith effort to obtain written acknowledgment of receipt of this Notice from patients who receive direct care from us (other than in emergency treatment situations). Acknowledgment confirms only that you received this Notice; it does not constitute consent to any particular use or disclosure of your PHI.