SHIFT HEALTH – PRIVACY POLICY

Effective Date: April 23, 2026

Shift Health ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and safeguard your information when you use our platform, including our website, mobile applications, and telehealth services (collectively, the "Platform").

By using the Platform, you consent to the practices described in this Privacy Policy. If you do not agree, please do not use the Platform.

SMS / Mobile Information — Important Disclosure

Program name: Shift Health Account Notifications. This is a transactional SMS program — we do not send marketing or promotional text messages.

What you'll receive: one-time verification and security codes, appointment reminders, secure-message notifications, on-call provider alerts, and other account-related notifications.

Message frequency: Message frequency varies based on your account activity and the care you receive.

Costs: Message and data rates may apply. Shift Health does not charge for SMS messages; your mobile carrier may charge you according to your plan.

Opt out: Reply STOP to any Shift Health text message to cancel. You will receive a single confirmation and we will stop sending SMS to that number.

Help: Reply HELP for support information, or email support@joinshift.health.

No sharing for marketing. No mobile information, SMS opt-in data, or consent data is shared with third parties or affiliates for any purpose, including marketing or promotional purposes. Mobile information is shared only with the messaging service provider strictly necessary to deliver the messages you have requested.

See our full SMS Terms for complete program details.

1. Scope of This Policy

This Privacy Policy applies to all users of the Shift Health Platform, including patients, caregivers, authorized representatives, and employees and their enrolled dependents accessing through employer-sponsored programs. It does not apply to third-party websites, services, or healthcare providers who may have their own privacy practices.

2. Information We Collect

a. Personal Information

We collect information you provide directly, such as:

• Name, date of birth, and contact information
• Account credentials
• Insurance and payment information
• Emergency contact details

b. Health Information

To facilitate care, we collect health-related information, including:

• Medical history and current symptoms
• Medications, allergies, and conditions
• Provider notes and visit summaries
• Prescriptions, lab orders, and referrals

This information may be considered Protected Health Information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA).

c. Dependent and Minor Information

As part of employer-sponsored enrollment, we collect demographic and health information for enrolled dependents (spouses and children). For minor dependents (under age 18), a parent or legal guardian provides this information and consents to its collection on the minor's behalf.

d. Technical Information

We automatically collect certain data when you use the Platform, including:

• Device type, operating system, and browser
• IP address and general location
• Pages viewed and actions taken
• Referring URLs and session duration

3. How We Use Your Information

We use your information to:

• Facilitate virtual healthcare visits and follow-up care
• Process payments and verify insurance eligibility
• Communicate with you about appointments, prescriptions, and services
• Improve the Platform and develop new features
• Ensure compliance with legal and regulatory requirements
• Detect and prevent fraud, abuse, or security threats

4. How We Share Your Information

We do not sell your personal or health information. We may share your information with:

• Healthcare providers who deliver care through the Platform
• Pharmacies to fulfill prescriptions
• Labs and diagnostic services for ordered tests
• Payment processors to complete transactions
• Business partners who help us operate the Platform (under strict confidentiality agreements)
• Legal authorities when required by law or to protect our rights

Note: This sharing does not include mobile phone numbers or SMS opt-in data. See Section 13 (Mobile Phone Numbers and SMS) for the SMS program's separate, stricter sharing rules.

If Shift Health is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

Dependent Data and Employer Reporting

Employer-sponsored program reports provided to the sponsoring employer contain only de-identified, aggregated data. Individual dependent clinical records are never shared with the sponsoring employer. The employer receives utilization summaries and program performance metrics only. Individual health information remains confidential between the patient (or their guardian) and their healthcare provider.

Parental/Guardian Access to Minor Records

Parents or legal guardians may access their minor dependent's health records through the Platform, subject to applicable state law regarding minor consent and confidentiality. In states where minors have independent consent rights for certain services, access to those records may be restricted as required by law.

5. AI-Powered Documentation Tools

Shift Health uses artificial intelligence (AI) to assist healthcare providers in documenting clinical encounters. These tools are designed to:

• Transcribe and summarize visit conversations
• Generate draft clinical notes for provider review
• Support accurate and efficient recordkeeping

Important:

• AI-generated content is always reviewed and finalized by a licensed healthcare provider before becoming part of your medical record.
• AI tools do not make clinical decisions, diagnoses, or treatment recommendations.
• You may ask your provider about how AI was used during your visit.

6. Data Security

We implement administrative, technical, and physical safeguards to protect your information, including:

• Encryption of data in transit and at rest
• Access controls and authentication requirements
• Regular security assessments and monitoring

While we strive to protect your data, no system is completely secure. If you believe your information has been compromised, please contact us immediately.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access and receive a copy of your health information
• Request corrections to inaccurate data
• Request deletion of your account and associated data (subject to legal retention requirements)
• Opt out of certain communications

To exercise these rights, contact us at privacy@shifthealth.com.

8. Data Retention

We retain your information for as long as necessary to provide services, comply with legal obligations, resolve disputes, and enforce our agreements. Health records may be retained for the minimum period required by applicable law.

9. Children's Privacy

The Platform is not intended for use by individuals under the age of 18 without parental or guardian consent. Minor dependents enrolled through an employer-sponsored plan may use the Platform only with the consent and supervision of a parent or legal guardian. If we learn that we have collected information from a child without proper consent, we will take steps to delete it.

10. Third-Party Links

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their policies before providing any information.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on the Platform or sending you an email. Your continued use of the Platform after the effective date of revised terms constitutes your acceptance of those changes.

12. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

Shift Health Email: privacy@shifthealth.com

13. Mobile Phone Numbers and SMS

When you provide a mobile phone number to Shift Health, we use it only for account-related purposes, including phone verification, account security, appointment reminders, on-call provider alerts, secure-message notifications, and other transactional notifications you have consented to receive. Full details of the SMS program, including message frequency and opt-out instructions, are in our Terms of Service and our SMS Terms.

No mobile information, SMS opt-in data, or consent data is shared with third parties or affiliates for any purpose, including marketing or promotional purposes. Mobile information is used only to deliver the messages you have requested and is shared only with the messaging service provider strictly necessary to deliver those messages.

We share mobile phone numbers only with the service providers strictly necessary to deliver the messages you have consented to receive (for example, our SMS delivery vendor), and only to the extent required to deliver those messages. These vendors are contractually prohibited from using your mobile information for their own marketing.

You may opt out of SMS at any time by replying STOP to any Shift Health text message, or by disabling SMS notifications in your account settings. Opting out of SMS does not affect your ability to use the Shift Health platform through other channels (web, email, in-app).