Motus Medicine — Notice of Privacy Practices

1. How We May Use and Disclose Your Health Information

We use and disclose your PHI primarily to provide and coordinate your physical therapy rehabilitation services. The following categories describe how we may use or disclose your information:

• Treatment. We may use or share your PHI to provide, coordinate, or manage your rehabilitation care. For example, your movement data, pain scores, and session videos are shared with your assigned physical therapist to guide your treatment protocol.
• Healthcare Operations. We may use your PHI for quality improvement, training, and service evaluation activities necessary to operate the Motus Medicine platform. For example, we may review session data in aggregate to improve our exercise algorithms.
• Payment. Motus Medicine does not bill patients or insurers and does not process payments or collect insurance information. We do not use or disclose your PHI for payment purposes.
• Required by Law. We may disclose your PHI when required by federal, state, or local law, including in response to a court order, subpoena, or government investigation.
• Public Health Activities. We may disclose your PHI to public health authorities for disease reporting, vital statistics, or to prevent a serious threat to health or safety.
• Health Oversight. We may disclose PHI to health oversight agencies for audits, inspections, or investigations authorized by law.
• Business Associates. We share PHI with vendors who perform services on our behalf under HIPAA Business Associate Agreements. Our current business associates include Google (Firebase — authentication, database, and hosting) and Cloudinary (video storage). These vendors are contractually required to safeguard your PHI.

All other uses and disclosures of your PHI not described in this Notice require your written authorization. You may revoke that authorization at any time in writing, except where we have already acted in reliance on it.

2. Your Rights Regarding Your Health Information

You have the following rights with respect to your PHI:

• Right to Access. You may request a copy of your health information maintained by Motus Medicine in a designated record set. Requests must be submitted in writing to privacy@motusmedicine.com. We will respond within 30 days.
• Right to Request Amendment. If you believe your PHI is incorrect or incomplete, you may request that we amend it. We may deny your request if the information was not created by us, is not part of our records, or is already accurate.
• Right to an Accounting of Disclosures. You may request a list of disclosures of your PHI made by Motus Medicine for purposes other than treatment, payment, or healthcare operations during the previous six years. The first accounting in any 12-month period is free.
• Right to Request Restrictions. You may ask us to restrict how we use or disclose your PHI for treatment, payment, or operations. We are not required to agree to all restrictions, but if we do, we will honor that restriction unless an emergency requires otherwise.
• Right to Confidential Communications. You may request that we communicate with you about your health information in a specific way or at a specific location. We will accommodate reasonable requests.
• Right to a Paper Copy of This Notice. You may request a paper copy of this Notice at any time, even if you previously received it electronically.
• Right to Delete Your Data. You may request deletion of your account and all associated PHI by using the in-app account deletion feature or by emailing privacy@motusmedicine.com.

3. Our Duties

Motus Medicine is required by law to:

• Maintain the privacy of your PHI.
• Provide you with this Notice of Privacy Practices.
• Notify you following a breach of your unsecured PHI.
• Abide by the terms of this Notice currently in effect.

We reserve the right to change the terms of this Notice and to make the new terms effective for all PHI we maintain. If we make a material change, we will post the revised Notice in the app and on our website. The effective date at the top of this Notice will reflect the date of the most recent revision.

4. How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with Motus Medicine or with the Secretary of the U.S. Department of Health and Human Services (HHS). We will not retaliate against you for filing a complaint.

To file a complaint with Motus Medicine: Email privacy@motusmedicine.com with a description of your concern. We will respond within 30 days.

To file a complaint with HHS: Contact the Office for Civil Rights at hhs.gov/ocr/privacy/hipaa/complaints or by calling 1-800-368-1019.

5. Contact Information

For questions about this Notice or to exercise any of your rights described above, contact our Privacy Officer:

Motus Medicine — Privacy Officer: Yash Saoji
Email: privacy@motusmedicine.com