Notice of Privacy Practices

1. Who we are and why this notice applies

BlueBay Mobility Inc. is a complex rehab technology (CRT) and durable medical equipment (DMEPOS) supplier based in Tustin, California. Because we provide health care equipment and services and send health information electronically for Medicare and insurance transactions, we are a covered entity under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its regulations (45 C.F.R. Parts 160 and 164).

This Notice explains how we may use and share your protected health information (PHI), meaning health information that identifies you and that we create, receive, keep or send, as well as your rights and our legal duties.

2. Our legal duties

We are required by law to:

• Keep your PHI private and secure
• Give you this Notice of our legal duties and privacy practices
• Follow the terms of the Notice currently in effect
• Notify you if a breach occurs that may have compromised the privacy or security of your PHI
• Not use or share your PHI other than as described in this Notice, unless you tell us in writing that we can

California’s Confidentiality of Medical Information Act (CMIA) and other state laws may give you additional protections. Where state law is more protective than HIPAA, we follow state law.

3. How we may use and share your PHI

Treatment

We use and share PHI to provide, coordinate and manage your equipment and related services.

Example: We share your diagnosis, physician order and mobility assessment with the occupational or physical therapist taking part in your evaluation.

Payment

We use and share PHI to bill and get paid for the equipment and services we provide.

Example: We send Medicare or your insurer a claim that includes your diagnosis and the equipment ordered, or request prior authorization.

Health care operations

We use and share PHI to run our business, improve quality and train staff.

Example: We review records to check that our evaluations and documentation meet quality and payer requirements.

People involved in your care

Unless you object, we may share relevant PHI with a family member, caregiver or other person you identify who is involved in your care or in paying for it. In an emergency, or if you can’t agree or object, we’ll use our professional judgment.

Appointment reminders and service updates

We may contact you about deliveries, fittings, repairs, recalls or equipment-related information.

4. Other uses and disclosures we may make without your authorization

• As required by law: when federal, state or local law requires it.
• Public health and safety: for example, reporting product problems or recalls to the FDA or manufacturers, or preventing disease.
• Health oversight: to agencies that audit, inspect or license health care providers, such as CMS and Medicare contractors.
• Legal proceedings: in response to a court order, subpoena or other lawful process.
• Law enforcement: in limited circumstances allowed by law.
• Serious threat to health or safety: to prevent or lessen a serious and imminent threat to you or others.
• Abuse, neglect or domestic violence: to authorities allowed to receive such reports.
• Workers’ compensation: as authorized by workers’ compensation laws.
• Specialized government functions: such as military, veterans or national security purposes, as allowed by law.
• Coroners, medical examiners and funeral directors: as allowed by law.
• Business associates: to vendors that help us operate, such as billing, IT and secure document services. They must sign a Business Associate Agreement and protect your PHI.

5. Uses and disclosures that require your written authorization

We will not do the following without your signed, written authorization:

• Use or share your PHI for marketing, except face-to-face communications or small promotional gifts as allowed by law
• Sell your PHI
• Share psychotherapy notes (we generally don’t keep them)
• Any other use or disclosure not described in this Notice

You may revoke an authorization in writing at any time. This won’t affect anything we already did based on your authorization.

6. Your rights

To use any of these rights, contact our Privacy Officer (section 8). We may ask you to make the request in writing.

Get a copy of your health information

You can ask to see or get a paper or electronic copy of PHI we keep about you. We’ll respond within 30 days, or tell you in writing if we need up to 30 more days. We may charge a reasonable, cost-based fee.

Ask us to correct your information

You can ask us to amend PHI you believe is incorrect or incomplete. We may say no, and if we do, we’ll explain why in writing within 60 days.

Request confidential communications

You can ask us to contact you in a specific way (for example, by cell phone) or at a different address. We’ll agree to all reasonable requests.

Ask us to limit what we use or share

You can ask us not to use or share certain PHI for treatment, payment or operations. We’re not required to agree in most cases. However, if you pay for an item or service out of pocket in full, you can ask us not to share that information with your health insurer for payment or operations, and we will agree unless the law requires us to share it.

Get a list of those we’ve shared information with

You can ask for a list (accounting) of the times we’ve shared your PHI in the six years before your request, who we shared it with and why. It excludes disclosures for treatment, payment and operations and certain others. One list per year is free; we may charge a reasonable fee for additional lists in the same year.

Get a copy of this Notice

You can ask for a paper copy of this Notice at any time, even if you agreed to receive it electronically.

Choose someone to act for you

If you’ve given someone medical power of attorney, or someone is your legal guardian, that person can exercise your rights. We’ll confirm their authority first.

Be notified of a breach

If a breach of your unsecured PHI occurs, we’ll notify you without unreasonable delay, and no later than 60 days after we discover it, as required by the HIPAA Breach Notification Rule.

7. How to file a complaint

If you believe your privacy rights have been violated, you can file a complaint with us or with the U.S. Department of Health and Human Services. We will not retaliate against you for filing a complaint.

With BlueBay Mobility

Contact our Privacy Officer (section 8) by email, mail or phone.

With HHS Office for Civil Rights

8. Privacy Officer contact

9. Changes to this Notice

We can change the terms of this Notice, and the changes will apply to all PHI we have about you. The new Notice will be posted on our website and available on request, with a new effective date.

Effective date: October 15, 2026 (replaces the version effective May 10, 2026) · BlueBay Mobility Inc. · 3002 Dow Ave, Unit 312, Tustin, CA 92780