Notice of Privacy Practices

Effective Date: August 20, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Who We Are and Who This Notice Covers

This Notice of Privacy Practices (this "Notice") is issued by CTrue LLC, doing business as CTrue Vision (the "Practice," "we," "us," or "our"), a covered entity under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, each as amended (collectively, "HIPAA"). This Notice applies to all protected health information ("PHI") created, received, maintained, or transmitted by the Practice at each of its office locations:

• Williamsburg — 433 Park Ave, Brooklyn, NY 11205 — (718) 534-7100

• Borough Park — 1581 48th St, Brooklyn, NY 11219 — (718) 534-7100

• Monroe — 1 Preshburg Blvd, Kiryas Joel, NY 10950 — (845) 915-9371

PHI is information that identifies you, or could reasonably be used to identify you, and that relates to your past, present, or future physical or mental health, the provision of health care to you, or the payment for that care. It includes demographic information, such as your name, date of birth, and contact information, when held together with health information such as an appointment record.

Our Legal Duties

We are required by law to:

• Maintain the privacy and security of your PHI;

• Provide you with this Notice of our legal duties and privacy practices with respect to your PHI;

• Abide by the terms of the Notice currently in effect; and

• Notify you following a breach of your unsecured PHI.

How We May Use and Disclose Your PHI Without Your Authorization

The following categories describe the ways we may use and disclose PHI without your written authorization. Not every use or disclosure within a category is listed, but every permitted use or disclosure falls within one of the categories below. In each case, we make reasonable efforts to use or disclose only the minimum amount of PHI necessary for the purpose, except where the minimum-necessary standard does not apply, such as disclosures for treatment.

Treatment

We may use your PHI to provide you with eye care, and disclose it to other health care providers involved in your care. For example, we may share your eyeglass or contact lens prescription with an optical laboratory that fabricates your lenses, or send your examination findings to a physician to whom we refer you.

Payment

We may use and disclose your PHI to obtain payment for the services we provide to you. For example, we may bill you, or, with the information you provide to us, submit a claim to your vision or health plan and include information identifying you, your diagnosis, and the services rendered.

Health Care Operations

We may use and disclose your PHI for the operations of the Practice. For example, we may use appointment records for scheduling, quality assessment and improvement, workforce training, and the general administration of the Practice.

Appointment Reminders and Communications About Your Care

We may use your PHI to contact you, at the telephone number or email address you have provided, to confirm, schedule, or remind you of an appointment, or to tell you about treatment alternatives and health-related services that may be of interest to you. If you submit an appointment request through our website, the information you submit is transmitted and received through email service providers that have signed business associate agreements with us, as described in our Privacy Policy.

Business Associates

We may disclose your PHI to contractors and service providers that perform functions on our behalf and that require access to PHI to perform those functions, such as the email delivery and email hosting services through which website appointment requests are transmitted and received. Each such business associate is bound by a written business associate agreement requiring it to safeguard your PHI as required by HIPAA.

Individuals Involved in Your Care

We may disclose PHI to a family member, other relative, close personal friend, or other person you identify, to the extent the PHI is directly relevant to that person's involvement in your care or payment for your care, provided you do not object after being given the opportunity to do so, or, if you are unavailable or incapacitated, provided we determine in our professional judgment that the disclosure is in your best interest.

As Required by Law and for Public Purposes

We may use or disclose your PHI without your authorization in the following circumstances, subject to the conditions and limitations of applicable law:

• Required by law: when federal, state, or local law requires the use or disclosure;

• Public health activities: to public health authorities for purposes such as disease prevention and control, and reporting of vital events;

• Victims of abuse, neglect, or domestic violence: to appropriate government authorities as authorized or required by law;

• Health oversight activities: to health oversight agencies for audits, investigations, inspections, and licensure activities;

• Judicial and administrative proceedings: in response to a court or administrative order, or, subject to legal safeguards, a subpoena or other lawful process;

• Law enforcement: to law enforcement officials in the limited circumstances permitted by HIPAA;

• Decedents: to coroners, medical examiners, and funeral directors as necessary to carry out their duties;

• Organ and tissue donation: to organ procurement organizations as permitted by law;

• Research: for research purposes, subject to approval and safeguards required by law;

• Serious threat to health or safety: to prevent or lessen a serious and imminent threat to the health or safety of a person or the public;

• Specialized government functions: for military, national security, intelligence, and protective services purposes, and with respect to inmates, as permitted by law; and

• Workers' compensation: as authorized by and to the extent necessary to comply with workers' compensation and similar laws.

Uses and Disclosures Requiring Your Written Authorization

Except as described in this Notice, we will not use or disclose your PHI without your written authorization. In particular, the following uses and disclosures will be made only with your written authorization:

• Uses and disclosures of PHI for marketing purposes;

• Disclosures that constitute a sale of PHI; and

• Uses and disclosures of psychotherapy notes, where applicable (the Practice does not ordinarily create psychotherapy notes).

If you provide an authorization, you may revoke it at any time by submitting a written revocation to the Privacy Officer, except to the extent we have already acted in reliance on it. We do not sell your PHI, and we do not use your PHI for fundraising.

Your Rights Regarding Your PHI

You have the following rights with respect to your PHI. You may exercise each of them by submitting a request to the Privacy Officer using the contact information at the end of this Notice; we may ask that your request be in writing.

Right to Inspect and Copy

You have the right to inspect and obtain a copy of the PHI we maintain about you in a designated record set, including your patient record, and to direct that a copy be transmitted to a person you designate. We may charge a reasonable, cost-based fee as permitted by law. In the limited circumstances in which we may deny access, you may be entitled to have the denial reviewed. Your right of access to your patient record is also protected under New York Public Health Law § 18.

Right to Request Amendment

If you believe that PHI we maintain about you is incorrect or incomplete, you have the right to request that we amend it for as long as we maintain it. We may deny your request in certain circumstances; if we do, we will inform you in writing of the reason, and you have the right to submit a statement of disagreement that will be kept with your record.

Right to an Accounting of Disclosures

You have the right to receive a list of the disclosures we have made of your PHI during the six years prior to your request, other than disclosures for treatment, payment, and health care operations and certain other disclosures excepted by law. The first accounting in any 12-month period is free of charge; we may charge a reasonable, cost-based fee for additional requests within the same period, of which we will notify you in advance.

Right to Request Restrictions

You have the right to request a restriction on the PHI we use or disclose for treatment, payment, or health care operations, or to persons involved in your care. We are not required to agree to a requested restriction, except that we must agree to your request to restrict disclosure of PHI to your health plan if the disclosure is for the purpose of payment or health care operations, is not otherwise required by law, and the PHI pertains solely to an item or service for which you, or a person on your behalf, has paid the Practice in full out of pocket.

Right to Request Confidential Communications

You have the right to request that we communicate with you about your health matters by alternative means or at alternative locations, for example, only at a specified telephone number or address. We will accommodate all reasonable requests and will not ask you the reason for your request.

Right to a Paper Copy of This Notice

You have the right to receive a paper copy of this Notice upon request at any time, even if you have agreed to receive it electronically. A copy of this Notice is available at each of our office locations and on our website.

Right to Notification of a Breach

You have the right to be notified, without unreasonable delay and in no case later than 60 days after discovery, of any breach of your unsecured PHI, as required by HIPAA and the Health Information Technology for Economic and Clinical Health Act (HITECH).

Right to Designate a Personal Representative

You may exercise your rights through a personal representative who demonstrates legal authority to act on your behalf, such as a parent or legal guardian of a minor patient, or the holder of a health care proxy or power of attorney, subject to the limitations of applicable law.

New York State Law

Where New York State law provides privacy protections greater than those of HIPAA, we comply with the more protective law. Certain categories of information, including HIV-related information, mental health information, and genetic testing information, receive heightened protection under New York law, and we will not disclose such information except as specifically permitted by those laws or with the specific authorization they require. We safeguard your private information in accordance with the New York Stop Hacks and Improve Electronic Data Security Act (SHIELD Act) and will provide any breach notification required by New York General Business Law § 899-aa.

Changes to This Notice

We reserve the right to change this Notice and our privacy practices at any time, and to make the revised Notice effective for all PHI we maintain, including PHI created or received before the change. When we make a material change, we will post the revised Notice, with its new effective date, on our website and make it available at each office location. The Notice posted and available at our offices at any given time is the Notice in effect.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us by directing it to the Privacy Officer using the contact information below. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue, S.W., Washington, D.C. 20201, by calling 1-877-696-6775, or online at hhs.gov/ocr/complaints.

We will not retaliate against you in any way for filing a complaint.

Contact; Privacy Officer

All requests to exercise your rights, questions about this Notice, and complaints may be directed to:

• Privacy Officer, CTrue LLC, 433 Park Ave, Brooklyn, NY 11205

• By email: info@thectrue.com

• By phone: (718) 534-7100