MDTELEMED WEB MASTER POLICY

PATIENT CONSENT TO TREATMENT

1. PATIENT ENROLLMENT, TELEMEDICINE TREATMENT, PROGRAM PARTICIPATION & POLICY ACKNOWLEDGMENT

Patient-Facing Master Consent | Version 1.0 | Effective September 26, 2026

2. Purpose of This Consent

This document is MDTelemed's master patient enrollment and telemedicine participation consent. It is intended to be reviewed and electronically acknowledged once when an individual becomes an MDTelemed patient. It authorizes participation in MDTelemed's telemedicine program, documents consent to receive telemedicine care, explains the patient's choice between fee-for-service care and any optional membership program then offered, and records the patient's agreement to review and comply with applicable MDTelemed patient policies and procedures. This master consent operates together with any additional disclosure, notice, consent, or addendum required by the law of the jurisdiction in which the patient is physically located or by the nature of a particular service. If controlling law requires a more specific or renewed consent, MDTelemed may obtain that additional consent before providing the affected service.

3. Voluntary Enrollment as an MDTelemed Patient

I voluntarily request to establish a patient relationship with MDTelemed for services that MDTelemed and its licensed health care professionals are legally and clinically able to provide through telemedicine. I understand that enrollment does not guarantee that every medical condition can be evaluated or treated through telemedicine. I understand that becoming an MDTelemed patient does not obligate me to purchase a membership. I may receive care on a fee-for-service or per-visit basis, or I may elect to participate in an available MDTelemed membership program if I choose and if I am eligible under the membership terms then in effect.

4. My Care Option

• Fee-for-Service / Per-Visit Patient
• MDTelemed Membership Program

Membership is optional. Choosing fee-for-service care does not prevent me from becoming or remaining an MDTelemed patient. I may later elect an available membership by accepting the membership terms then in effect. Cancellation of a membership does not by itself terminate my status as an MDTelemed patient, although future services may be subject to the then-current fee-for-service terms.

5. Consent to Telemedicine Treatment

I consent to evaluation and treatment through telemedicine by appropriately licensed MDTelemed health care professionals. When clinically appropriate and legally permitted, telemedicine care may include history-taking, review of information I provide, visual or audio assessment, diagnosis, treatment planning, patient education, prescribing of permitted medications, medication management, ordering and review of laboratory or diagnostic testing, referrals, follow-up care, care coordination, and other professional services that can appropriately be provided remotely. I understand that the treating clinician retains independent professional judgment and may determine that telemedicine is not appropriate for my condition, that additional information is needed, or that I require an in-person examination, laboratory testing, imaging, specialist evaluation, urgent care, emergency department evaluation, or another level of care. I understand that I may not be prescribed medication during my visit. The decision whether to prescribe medication is based solely on the treating clinician’s independent medical judgment and what is medically appropriate for my condition. I understand that not receiving a prescription does not mean that I did not receive medical evaluation, treatment, or professional services during the encounter.

6. Nature and Limitations of Telemedicine

I understand that telemedicine uses electronic communications to permit a patient and health care professional who are not in the same physical location to communicate and exchange information for health care purposes. I understand that telemedicine has limitations. A remote clinician may be unable to perform the complete hands-on physical examination available during an in-person encounter. Technical problems may interrupt or prevent a visit. Images, audio, patient-reported information, home devices, or remote measurements may be incomplete or inaccurate. A diagnosis or treatment plan may therefore require additional testing or an in-person assessment. I understand that an MDTelemed clinician may stop or decline a telemedicine encounter when continuing remotely would not be clinically appropriate or legally permitted.

7. Emergency and Urgent Conditions

I understand that MDTelemed is not a substitute for 911, emergency medical services, or an emergency department. If I believe I am experiencing a medical or psychiatric emergency, I should call 911 or the applicable local emergency number or go to the nearest emergency department rather than wait for an MDTelemed response. If an MDTelemed clinician determines during an encounter that emergency or urgent in-person evaluation is appropriate, I agree to follow the clinician's escalation instructions or accept responsibility for declining recommended care.

8. Identity, Location and Contact Information

I consent to MDTelemed verifying my identity, date of birth, contact information, and other information reasonably necessary to identify me and provide care. I understand that I may be asked to confirm my current physical location at each telemedicine encounter because professional licensure, prescribing authority, emergency response, privacy, and other legal requirements may depend on where I am physically located at the time care is provided. I agree to provide accurate information and not to allow another person to impersonate me or use my patient account.

9. State and Territory-Specific Requirements

I understand that telemedicine requirements vary among states, the District of Columbia, U.S. territories, and other jurisdictions. My care is subject to the law applicable where I am physically located and to the professional authority of the treating clinician. This master consent is supplemented by any jurisdiction-specific notice, disclosure, consent language, prescribing limitation, minor-consent rule, privacy requirement, recording requirement, professional disclosure, or other condition applicable to my care. When a jurisdiction requires additional or encounter-specific consent, MDTelemed may require me to complete that step before the affected service is provided. If MDTelemed or the assigned clinician is not authorized to provide care where I am located, MDTelemed may decline or discontinue the encounter and direct me to an appropriate alternative source of care.

10. Medication and Prescribing

I understand that becoming an MDTelemed patient, purchasing a visit, or participating in a membership does not guarantee that I will receive a prescription, antibiotic, antiviral, refill, particular medication, test, referral, diagnosis, medical certification, or any other requested treatment. Prescribing and treatment decisions are made by the treating clinician based on professional judgment, available clinical information, applicable law, and the standard of care. I agree to provide accurate information regarding my medications, allergies, adverse reactions, medical history, pregnancy status when clinically relevant, and other information reasonably necessary for safe prescribing.

11. Freedom to Choose My Pharmacy

I am free to choose the pharmacy I wish to use, subject to that pharmacy's ability and legal authority to dispense the prescribed medication and any applicable insurance or benefit limitations. MDTelemed will not require me to use a particular pharmacy as a condition of receiving clinical care and will not pressure or improperly steer me toward a particular pharmacy. If MDTelemed provides factual information about pharmacy availability, convenience, hours, delivery, kiosk access, formulary, cost, or other options, the final pharmacy choice remains mine except where a particular dispensing arrangement is required by law, payer rules, medication availability, or a specific service I voluntarily select.

12. Laboratory, Diagnostic Testing and Referrals

When clinically appropriate, I consent to MDTelemed clinicians ordering or recommending laboratory tests, diagnostic studies, referrals, or in-person evaluation. I understand that I may be responsible for completing recommended testing or referrals and for ensuring that outside results are transmitted to MDTelemed when necessary. Failure to obtain recommended testing, follow-up, referral, or in-person evaluation may limit MDTelemed's ability to safely continue treatment.

13. Financial Responsibility and Membership Terms

I acknowledge responsibility for applicable charges for services I request or receive, subject to applicable insurance, membership, payment, refund, cancellation, and consumer-protection requirements. Current charges and membership terms will be presented through the MDTelemed platform or applicable patient-facing materials. This consent does not establish a fixed price. If I elect an MDTelemed membership, the separate membership, billing, automatic-renewal, cancellation, and payment terms presented to me govern that membership. If I remain a fee-for-service patient, the applicable per-visit payment terms apply.

14. Notice of Privacy Practices

I acknowledge that MDTelemed has provided me, or has made electronically available to me in connection with my first request for service, its Notice of Privacy Practices. I understand that the Notice explains how protected health information may be used and disclosed, my privacy rights, and MDTelemed's privacy responsibilities. I understand that acknowledgment of receiving the Notice of Privacy Practices is distinct from my consent to medical treatment and does not itself authorize uses or disclosures that otherwise require separate authorization. I may request a copy of the current Notice.

15. Privacy and Confidentiality

I understand that MDTelemed will handle my health information in accordance with applicable privacy and security laws and its applicable privacy policies. Telemedicine involves electronic transmission of information and, despite reasonable safeguards, no electronic system can be guaranteed to be completely free from all security or technical risk. I agree to take reasonable steps to protect privacy on my side of the encounter, including using a private environment when feasible, protecting my account credentials, and informing the clinician if another person is present or able to hear the encounter.

16. AI-Assisted Documentation / Telescribe

I understand that MDTelemed clinicians may use an artificial-intelligence-assisted documentation or telescribe system to assist in preparing the medical record. The system may process the conversation or encounter information for documentation purposes. I consent, on a one-time basis for future MDTelemed encounters, to use of such an AI-assisted documentation tool when MDTelemed makes it available, subject to applicable law and MDTelemed's separate AI/Telescribe disclosure and policy. The AI tool does not replace my clinician and does not independently make my diagnosis or treatment decision. The treating clinician remains responsible for reviewing and finalizing the clinical documentation. If a separate retained audio or video recording is proposed, or applicable law requires additional consent for recording or ambient processing, MDTelemed will obtain any additional consent required before that recording or processing occurs.

17. Electronic Communications and Electronic Documents

I consent to receive routine clinical, service, account, appointment, billing, security, and administrative communications electronically through methods offered by MDTelemed, which may include the patient platform, email, SMS/text message, or other electronic means. I agree to electronic documents, disclosures, acknowledgments, and electronic signatures where legally permitted. Optional marketing communications are separate from my consent to treatment and may be subject to separate choices or consent requirements.

18. Medical Records

I understand that MDTelemed will create and maintain a medical record of the care provided to me as required by applicable law and professional standards. Closing my account or withdrawing from future MDTelemed care does not require MDTelemed to destroy records that it is legally required or permitted to retain. My rights to access, request amendment of, or obtain copies of my records are governed by applicable law and MDTelemed's medical-record and privacy policies.

19. Patient Responsibilities

Provide complete, truthful, and accurate information about my identity, location, symptoms, medical history, medications, allergies, diagnoses, prior treatment, and other information relevant to my care. Tell the clinician when I do not understand a question, recommendation, diagnosis, medication instruction, or follow-up plan. Use medications only as directed and report significant adverse reactions or changes in my condition. Complete recommended testing, referrals, follow-up, or in-person evaluation when I choose to continue the treatment plan. Seek emergency or urgent in-person care when instructed or when my condition requires it. Maintain accurate contact information and protect my account credentials. Treat clinicians, staff, support personnel, and other participants respectfully and comply with lawful platform conduct requirements. Review the patient-facing policies, notices, and procedures MDTelemed provides or makes reasonably available to me.

20. Patient Rights

I may ask questions about telemedicine, treatment options, risks, benefits, alternatives, privacy practices, fees, or MDTelemed policies before deciding whether to proceed. I may request reasonable accommodations or language/communication assistance as available and required by law. I may decline a proposed treatment, medication, test, referral, or other recommendation, recognizing that declining recommended care may affect the clinician's ability to safely continue treatment.

21. Minors, Guardians and Legally Authorized Representatives

When the patient is a minor or an adult who has a legally authorized representative, a parent, guardian, health care agent, surrogate, or other legally authorized person may complete this acknowledgment to the extent permitted by applicable law. State law may allow a minor to consent independently to certain services or protect particular categories of a minor's health information from parental or proxy access. MDTelemed will apply those rules when applicable. A representative who acknowledges this consent confirms that the representative has legal authority to act for the patient to the extent required for the services requested.

22. Withdrawal from MDTelemed

I may withdraw from participation in MDTelemed and discontinue future care through MDTelemed at any time. Withdrawal is prospective and does not undo care already provided, prescriptions or orders already issued, lawful uses or disclosures already made, outstanding financial obligations, or MDTelemed's obligation or authority to retain medical, billing, compliance, or other records. If I am receiving ongoing treatment, MDTelemed may take reasonable steps required by professional standards and applicable law to support continuity of care, transition, or termination of the treatment relationship.

23. Agreement to MDTelemed Policies and Procedures

I acknowledge that MDTelemed maintains policies and procedures governing the services offered through its platform. I agree to read and abide by the patient responsibilities, conduct requirements, payment terms, and other provisions applicable to my use of MDTelemed. Applicable policies may include MDTelemed's Terms of Use; Patient Bill of Rights and Responsibilities; Telehealth Informed Consent; Notice of Privacy Practices; privacy policies; Prescribing and Medication Safety Policy; Pediatric/Minor policies; Emergency/Urgent Care Policy; Payment/Billing/Membership/Automatic Renewal Policy; Medical Records policies; Electronic Communications and SMS policies; Accessibility, Nondiscrimination and Language Access policies; Complaints/Grievances/Appeals policy; AI-assisted documentation/telescribe policy; pharmacy, laboratory, diagnostic testing and kiosk policies; and other patient-facing policies or legally required notices provided or made reasonably available to me. MDTelemed may revise policies from time to time. Material changes will be handled in accordance with applicable law and the terms governing the affected service. If a material change requires renewed consent or acceptance, MDTelemed may require that step before I continue using the affected service.

24. One-Time Master Acknowledgment

This consent is intended to serve as my one-time master acknowledgment for enrollment as an MDTelemed patient and for the recurring matters described above. MDTelemed may request additional acknowledgment or consent when required by applicable law, when my location or legal status changes, when I elect a new service such as membership, when a materially different technology or data use is introduced, or when the circumstances of a particular encounter require additional informed consent.

25. Electronic Acknowledgment

By selecting the acknowledgment/consent button presented with this document, I confirm that I have had the opportunity to review this document, ask questions, and access the MDTelemed patient policies and notices made available to me. I voluntarily consent to participate in MDTelemed's telemedicine program and to receive telemedicine treatment under the terms described above. My electronic acknowledgment is intended to have the same effect as my written acknowledgment or signature to the extent permitted by applicable law. The MDTelemed system may retain the date, time, version, account identifier, and other audit information associated with my acknowledgment. If I am acknowledging on behalf of another patient, I confirm that I am legally authorized to do so to the extent required by law.

26. Primary Legal and Regulatory Framework

HIPAA Privacy Rule, including 45 C.F.R. § 164.520 (Notice of Privacy Practices). Applicable federal, state, District of Columbia, and U.S. territorial laws governing telemedicine informed consent, professional licensure, prescribing, patient records, privacy, electronic communications, minors, and patient rights. Applicable electronic-signature laws, including the federal E-SIGN Act and applicable state electronic-transactions laws. Applicable consumer-protection, billing, membership, automatic-renewal, and cancellation laws. Applicable jurisdiction-specific requirements based on the patient's physical location when telemedicine care is provided.

TERMS OF USE - TERMS OF SERVICE

1. MDTELEMED LLC

2. TERMS OF USE & TERMS OF SERVICE

Version 1.0 | September 15, 2026

National patient-facing terms for MDTelemed LLC digital and telemedicine services

3. AGREEMENT, PARTIES, AND ACCEPTANCE

These Terms of Use & Terms of Service (“Terms”) are entered into between MDTelemed LLC (“MDTelemed,” “we,” “us,” or “our”) and the individual who accesses or uses the MDTelemed website, patient portal, telemedicine technology, communications tools, membership features, or related services (“you” or “your”). MDTelemed LLC is the contracting entity identified by MDTelemed for the services governed by these Terms. By creating an account, clicking an acceptance control, purchasing or enrolling in a service or membership, or otherwise using a service after being presented with these Terms, you acknowledge that you have had an opportunity to review them and agree to be bound by them to the extent permitted by applicable law. These Terms must be read together with the documents incorporated by reference where applicable, including the Website & Consumer Privacy Policy, HIPAA Notice of Privacy Practices, Telehealth Informed Consent, Payment/Billing Policy, Membership/Automatic Renewal Terms, Patient Rights & Responsibilities, Prescribing Policy, Emergency Policy, and applicable state addenda. Nothing in these Terms is intended to waive a right that applicable law does not permit a patient or consumer to waive. If a provision is prohibited in a particular jurisdiction, the provision will be interpreted or limited to the maximum lawful extent rather than used to eliminate a nonwaivable right.

3.1 No Hidden Incorporation

A policy or consent is incorporated into these Terms only when MDTelemed identifies it as applicable and makes it reasonably available to the user. Clinical consents that require a separate acknowledgment remain separate even when referenced here.

3.2 Changes to Terms

MDTelemed may revise these Terms when services, laws, or business practices change. The effective date will be updated. Material changes affecting ongoing memberships, dispute rights, privacy rights, or other legally significant obligations will be communicated in the manner required by applicable law. MDTelemed will not rely on silent retroactive modification where applicable law requires affirmative assent.

4. MDTeleMED SERVICE MODEL

MDTelemed provides telemedicine and related administrative and digital services. Clinical services are delivered by licensed medical doctors (MDs). MDTelemed’s current service model does not use DOs, nurse practitioners, or physician assistants as treating clinicians. MDTelemed may offer synchronous video, audio-only/telephone, asynchronous questionnaire or messaging, and secure messaging. Availability of a modality for a particular patient, condition, or state depends on physician judgment and applicable law. The existence of a technical modality does not mean that the modality is clinically appropriate or legally sufficient for every encounter.

4.1 Human Physician Care

Clinical decisions are made by human MD physicians. MDTelemed does not hold out an autonomous artificial-intelligence system as the treating clinician. AI-assisted telescribing or documentation technology may assist the physician in documenting an encounter, subject to separate disclosures and consent. The physician remains responsible for clinical judgment and the medical record.

4.2 Scope of Clinical Services

MDTelemed may evaluate and manage a broad range of acute, chronic, preventive, primary-care, psychiatric, dermatologic, sexual-health, men’s and women’s health, weight-management, medication-refill, and other conditions that a physician determines can be appropriately addressed through telemedicine. A broad service scope is not a promise that every condition can or will be treated remotely. Physicians may order or recommend laboratory testing, imaging, electrocardiography, or other diagnostic services when clinically appropriate and legally permitted. Such testing is ordinarily performed by an independent facility or other appropriate provider, not through the remote video or messaging interface itself.

4.3 No Controlled Substances

MDTelemed’s company policy prohibits prescribing Schedule II-V controlled substances through the MDTelemed service. This is an MDTelemed scope-of-service restriction even if federal or state law might otherwise permit a particular controlled-substance prescription in a particular circumstance. Patients seeking controlled substances should use an appropriate in-person or other lawful clinical service.

5. TELEMEDICINE IS NOT EMERGENCY CARE

MDTelemed is not an emergency medical service and is not a substitute for 911, an emergency department, or immediate in-person emergency evaluation. If you believe you are experiencing a medical or psychiatric emergency, including severe chest pain, severe difficulty breathing, signs of stroke, severe bleeding, loss of consciousness, severe allergic reaction, overdose, suicidal intent, homicidal intent, or another condition requiring immediate intervention, call 911 or your local emergency number and seek emergency care. A physician may stop or redirect a telemedicine encounter if the physician believes the patient needs emergency or in-person care. MDTelemed’s Emergency, Urgent Care & Crisis Policy provides additional information.

6. ELIGIBILITY, AGE, AND AUTHORITY

MDTelemed treats patients of all ages, from infancy through older adulthood. Adults may generally act for themselves. A parent, legal guardian, authorized representative, or other person may act for another individual only when legally authorized. Minor consent and confidentiality laws vary substantially by state and by service. Nothing in these Terms should be read as establishing a single national age at which a minor may independently consent to all care. MDTelemed’s Pediatric Care, Parent/Guardian Consent & Minor Rights Policy and 50-State Minor Consent & Confidentiality Addendum govern those issues.

6.1 Authority to Accept Terms

If you accept these Terms for another person, you represent that you have legal authority to do so. MDTelemed may request reasonable documentation of guardianship, parental authority, personal-representative status, power of attorney, or other authority before permitting access to records or services.

6.2 Accurate Identity

You must provide accurate identity and contact information and must not impersonate another person. MDTelemed may use reasonable identity-verification procedures and may suspend access when identity or authority cannot be established.

7. PATIENT PHYSICAL LOCATION AND PHYSICIAN LICENSURE

You must accurately disclose your physical location for a telemedicine encounter. The relevant location is where you are physically present at the time of care, not merely your residence, mailing address, or account state. MDTelemed will seek to connect you with an MD who is licensed or otherwise legally authorized to practice in the jurisdiction where you are located. If your location changes, you must tell the physician or platform. A visit may be delayed, redirected, or discontinued if an appropriately authorized physician is unavailable. MDTelemed does not promise that a physician is available in every state at every moment merely because MDTelemed intends to operate nationally.

8. ACCOUNT REGISTRATION AND SECURITY

Provide complete and accurate registration information. Maintain current contact information. Protect passwords, authentication codes, devices, and other account credentials. Do not share an account except through an authorized proxy or dependent-access feature. Notify MDTelemed promptly if you reasonably believe an account has been compromised. Use patient portals and secure communication methods when available for sensitive health information. MDTelemed may temporarily restrict an account when reasonably necessary to investigate suspected fraud, impersonation, cybersecurity risk, abuse, or unauthorized access. Restriction of a digital account does not eliminate MDTelemed’s obligations concerning continuity of care, medical records, or patient abandonment under applicable law.

9. PATIENT RESPONSIBILITIES AND CLINICAL INFORMATION

Telemedicine depends materially on the accuracy and completeness of information supplied by the patient or representative. You agree to provide information that is accurate to the best of your knowledge, including symptoms, medical history, medications, allergies, pregnancy status when relevant, recent testing, and other information requested by the physician. You are responsible for asking questions when instructions are unclear, following agreed treatment plans or informing the physician when you cannot do so, completing recommended testing or follow-up, and seeking in-person or emergency care when directed. A physician may decline to prescribe, diagnose, continue treatment, or provide a requested service when information is insufficient, the condition is unsuitable for telemedicine, the request is clinically inappropriate, the physician cannot establish an adequate physician-patient relationship, or applicable law prohibits the service.

10. PRESCRIPTIONS, PHARMACIES, LABS, IMAGING, AND REFERRALS

A prescription is never guaranteed. Prescribing is based on the physician’s independent medical judgment, applicable law, clinical appropriateness, available information, and MDTelemed’s prescribing policies. MDTelemed may transmit a lawful prescription electronically to a pharmacy selected by the patient or otherwise arranged through the service. A pharmacy is generally responsible for its own dispensing decisions, inventory, pricing, substitutions, and fulfillment. A physician may change, cancel, or decline a prescription when clinically or legally appropriate. Laboratory, imaging, specialist, emergency, pharmacy, and other third-party services may result in separate charges. Unless expressly stated on the MDTelemed website for a particular service, the MDTelemed visit price does not automatically include third-party testing, medication, imaging, specialist, or facility charges. Patients are responsible for completing ordered or recommended testing and for ensuring MDTelemed can obtain results when necessary for follow-up. Abnormal or time-sensitive results may require urgent or in-person care.

11. PAYMENT, PRICING, AND SELF-PAY STATUS

MDTelemed is launching as a cash/self-pay service. Current prices are displayed on the MDTelemed website or during the applicable purchase or enrollment flow and may change prospectively. These Terms intentionally do not hard-code a dollar amount that could become inaccurate. Before a charge is authorized, MDTelemed should disclose the price or pricing method applicable to the service. You are responsible for charges you authorize, subject to refund, cancellation, dispute, Good Faith Estimate, and other rights provided by applicable law and MDTelemed policies. MDTelemed is not health insurance, and a membership is not an insurance product. Unless MDTelemed expressly states otherwise for a specific service, payment to MDTelemed does not cover third-party pharmacy, laboratory, imaging, specialist, hospital, or emergency-service charges.

11.1 Good Faith Estimates

Uninsured and self-pay patients may have federal rights to a Good Faith Estimate and to dispute certain bills under the No Surprises Act framework. MDTelemed will provide the notices and estimates required for services within that framework. The Good Faith Estimate notice is separate from these Terms.

11.2 Payment Disputes

Billing disputes should first be submitted through MDTelemed’s billing or administrative contact. Exercising a good-faith billing right will not result in retaliation or denial of medically necessary emergency information or access to records required by law.

12. MEMBERSHIPS, RECURRING CHARGES, AND CANCELLATION

MDTelemed may offer optional memberships or subscriptions. The price, billing frequency, included benefits, exclusions, renewal terms, cancellation method, and any trial or promotional conditions must be disclosed in the enrollment flow and in the separate Membership, Automatic Renewal & Cancellation Terms. If a membership renews automatically, MDTelemed will obtain the authorization required by applicable law and provide a cancellation mechanism that satisfies applicable federal and state requirements. MDTelemed will not make cancellation materially more difficult than enrollment where the law prohibits such practices. Cancellation of a membership does not automatically cancel a separately scheduled medical service, outstanding balance, or legally required medical-record retention. Because automatic-renewal law is changing, MDTelemed will maintain a 50-state renewal/cancellation compliance matrix and update enrollment flows rather than relying on a single static national rule.

13. ELECTRONIC COMMUNICATIONS AND E-SIGN

MDTelemed conducts substantial business electronically. By using the service and providing electronic contact information, you may receive service-related communications electronically, subject to applicable law and separate consent requirements. Where the federal E-SIGN Act or state electronic-transactions law requires consumer disclosures or consent before electronic delivery substitutes for legally required paper information, MDTelemed will provide the required disclosure and consent process. The separate Electronic Communications, Electronic Records & E-SIGN Consent will govern those matters. Consent to receive marketing texts or automated promotional communications is separate from consent to receive medical care and will be obtained where required.

14. AI-ASSISTED DOCUMENTATION

MDTelemed may use AI-assisted telescribing technology to help create clinical documentation from an encounter. The technology is an assistive documentation tool; it is not the treating physician and does not independently establish the diagnosis or treatment plan. The actual audio-processing, storage, retention, vendor, model-training, and deletion practices must be verified before public launch. Those practices will be addressed in MDTelemed’s AI Telescribe, Audio Capture & Documentation Consent. These Terms do not create an unsupported promise that audio is either permanently retained or immediately deleted.

15. PRIVACY AND MEDICAL RECORDS

MDTelemed’s handling of personal information is described in the Website & Consumer Privacy Policy. Uses and disclosures of PHI are addressed in the HIPAA Notice of Privacy Practices. State consumer-health-data and privacy rights are addressed in applicable supplemental notices. Patients may request access to medical records as provided by HIPAA and applicable state law. MDTelemed currently expects to support PDF records; these Terms do not promise CSV, FHIR, or another export format unless implemented or legally required. Medical records are retained according to applicable law and MDTelemed’s retention schedule. Closing an account or cancelling a membership does not authorize destruction of records that MDTelemed must retain.

16. ACCEPTABLE USE AND PROHIBITED CONDUCT

You may use MDTelemed only for lawful personal health-care and related purposes. Prohibited conduct includes: Impersonating another person or misrepresenting authority to act for a patient. Providing materially false information to obtain a prescription, service, refund, or other benefit. Threatening, stalking, harassing, or abusing physicians, staff, contractors, or other users. Attempting to defeat authentication, access another patient’s information, introduce malicious code, scrape protected systems, or interfere with platform operation. Using MDTelemed to obtain or attempt to obtain controlled substances in violation of MDTelemed policy. Using another person’s payment method without authorization. Using MDTelemed content or systems to facilitate fraud, unlawful activity, or infringement. MDTelemed may take proportionate action in response to misconduct, including warnings, feature restrictions, suspension, or termination. MDTelemed does not promise a rigid first-offense/second-offense/third-offense sequence because immediate action may be necessary for serious safety, fraud, privacy, or security concerns.

17. RECORDING AND CAPTURE BY USERS

A patient must comply with all applicable federal and state recording, wiretap, eavesdropping, privacy, and consent laws. MDTelemed does not state that every patient recording is automatically a federal crime; recording laws vary by jurisdiction and circumstance. Unless expressly authorized by MDTelemed and all legally required participants, users may not record, livestream, rebroadcast, commercially exploit, or publicly distribute a telemedicine encounter through the MDTelemed platform. This contractual restriction does not eliminate any right that applicable law makes nonwaivable. MDTelemed’s own AI-assisted audio processing or recording, if any, is governed by separate disclosure and consent and is not authorized merely because this section restricts user recording.

18. INTELLECTUAL PROPERTY

The MDTelemed website, software, interfaces, branding, graphics, text, workflows, and other proprietary platform content may be protected by copyright, trademark, patent, trade-secret, and other laws. Except for rights expressly granted to use the service, MDTelemed does not transfer ownership of its platform intellectual property to users. Patients retain the rights in their health information provided by applicable law. Ownership of the physical or electronic medical record itself is governed by applicable state law and should not be confused with the patient’s rights of access, amendment, authorization, and confidentiality.

19. THIRD-PARTY SERVICES

MDTelemed may interact with pharmacies, laboratories, imaging facilities, payment services, communications providers, and other third parties. Those parties may be independent entities with their own terms and privacy practices. MDTelemed is not responsible for a third party’s independent acts merely because MDTelemed provides a link, referral, electronic order, or technical connection. This provision does not excuse MDTelemed from responsibility imposed by law for its own negligence, contractual duties, selection obligations, HIPAA responsibilities, or other nonwaivable duties.

20. SERVICE AVAILABILITY AND TECHNOLOGY

Telemedicine depends on telecommunications, internet access, compatible devices, electricity, and third-party infrastructure. Interruptions can occur. MDTelemed will use reasonable efforts to maintain its services but does not promise uninterrupted or error-free availability. MDTelemed does not currently make a contractual 99.9% uptime guarantee because that specification has not been verified. Any future service-level commitment must be expressly stated in a separate written agreement or verified public policy. If a technology failure prevents clinically adequate care, the physician may reschedule, change modality where lawful and appropriate, recommend in-person care, or terminate the remote encounter.

21. NO GUARANTEE OF A PARTICULAR MEDICAL OUTCOME

Medicine involves uncertainty. MDTelemed and its physicians do not guarantee a particular diagnosis, treatment response, medication effect, laboratory result, referral outcome, or cure. A lack of guaranteed outcome does not eliminate the physician’s obligation to comply with the applicable professional standard of care. Telemedicine has inherent limitations, including the inability to perform some hands-on examinations or procedures remotely. The physician must decide whether the available information is sufficient and whether escalation to in-person care is required.

22. WARRANTIES REGARDING THE DIGITAL PLATFORM

To the maximum extent permitted by law, non-clinical digital platform functions are provided without warranties that they will be uninterrupted, completely error-free, or compatible with every device or network. Any legally implied warranties that cannot be disclaimed remain in effect. This digital-platform disclaimer is not intended to disclaim or cap liability for professional medical negligence, gross negligence, willful misconduct, statutory privacy rights, or other liability that applicable law does not permit MDTelemed to disclaim.

23. LIMITATION OF LIABILITY - LAWFUL SCOPE

The original MDTelemed draft attempted to cap nearly all liability at the amount paid or $500 and expressly purported to exclude damages from a missed diagnosis causing a stroke. That formulation is not adopted in Version 1.0. For claims arising solely from non-clinical platform functionality and not from professional medical care, privacy/security duties, gross negligence, willful misconduct, bodily injury, or another category for which limitation is prohibited, MDTelemed may seek to limit liability to the maximum extent permitted by applicable law. The precise enforceable limitation should be finalized by 50-state consumer and health-care counsel. Nothing in these Terms limits a remedy or damages category when applicable law makes such a limitation unenforceable or prohibits advance waiver.

24. INDEMNIFICATION - LIMITED TO USER MISCONDUCT

To the extent permitted by law, a user may be responsible for losses arising from the user’s intentional unlawful conduct, fraud, infringement, unauthorized account use caused by the user’s deliberate credential sharing, or material violation of these Terms. This section is not intended to require a patient to indemnify MDTelemed for MDTelemed’s own professional negligence, statutory violation, gross negligence, or willful misconduct.

25. SUSPENSION, TERMINATION, AND CONTINUITY OF CARE

A user may stop using MDTelemed, subject to membership cancellation and outstanding-payment terms. MDTelemed may suspend or terminate access for material breach, fraud, threats, security risk, abuse, inability to verify identity or location, or other legitimate reasons. Termination of digital access must be distinguished from termination of a physician-patient relationship. When applicable law or the circumstances require notice, interim care, medication considerations, records access, referral information, or other steps to avoid patient abandonment, MDTelemed and the physician will follow those requirements. Medical records remain available as required by law after account or membership termination.

26. COMPLAINTS AND GRIEVANCES

Patients may submit complaints or grievances without retaliation. Complaints may concern clinical care, privacy, accessibility, billing, conduct, or other services. The Grievance & Complaints Policy provides the applicable channels and process. Nothing in an internal grievance process prevents a patient from contacting a state medical board, privacy regulator, consumer-protection agency, law-enforcement agency, or other governmental authority when the patient has a legal right to do so.

27. DISPUTE RESOLUTION - PRE-ARBITRATION NOTICE

Before initiating formal arbitration or litigation, the parties should ordinarily provide written notice describing the dispute and requested relief and allow a reasonable period for good-faith informal resolution, unless waiting would prejudice a legal right, limitations period, emergency remedy, or other protected interest. Notices to MDTelemed may be sent to Support@MDTelemed.com and MDTelemed LLC, 304 S Jones Blvd #4872, Las Vegas, NV 89107. A final launch version should specify a dedicated legal-notice channel if MDTelemed establishes one.

28. ARBITRATION AND CLASS-ACTION WAIVER - COUNSEL-REVIEW DRAFT

MDTelemed intends to use a carefully drafted pre-dispute arbitration framework for eligible consumer disputes. This section must not be activated in the production click-through flow until qualified counsel has reviewed enforceability and required disclosures in every state in which MDTelemed operates, including special rules that may apply to agreements concerning medical malpractice or health-care services. Subject to that review, disputes that are legally eligible for pre-dispute arbitration may be resolved by binding individual arbitration administered by JAMS under the rules applicable to the dispute and JAMS Consumer Arbitration Minimum Standards, rather than by a judge or jury.

28.1 Consumer Fairness Safeguards

The arbitration obligation should be reciprocal. The consumer must receive conspicuous notice of the arbitration clause and its consequences. Small-claims relief must remain available for qualifying claims. Remedies available under applicable law must remain available in arbitration unless the consumer retains a lawful court route for the remedy. The arbitrator must be neutral and the consumer must have a reasonable opportunity to participate in selection. Location may not effectively prevent consumer access to arbitration. The agreement may not discourage representation by counsel. Consumer costs must comply with JAMS Consumer Minimum Standards and applicable law; MDTelemed should bear required arbitration costs beyond the consumer filing amount. Relevant non-privileged discovery must be available. The award should be written and state the essential findings and conclusions as required by applicable JAMS consumer standards.

28.2 Medical Malpractice and Other Special Claims

The final arbitration clause must separately determine whether professional-negligence, medical-malpractice, wrongful-death, informed-consent, or other health-care claims may lawfully be included in a pre-dispute consumer arbitration agreement in the patient’s state. If a state requires a separate form, special font, separate signature, post-dispute agreement, revocation period, or prohibits pre-dispute arbitration of a category of claim, MDTelemed will follow that state rule.

28.3 Class and Representative Proceedings

For disputes lawfully subject to individual arbitration, MDTelemed intends to require individual rather than class or representative arbitration to the extent enforceable. This provision will not be applied where applicable law makes the waiver unenforceable or preserves a nonwaivable public-injunctive or representative remedy.

28.4 Opt-Out Consideration

Before launch, counsel should determine whether providing a time-limited arbitration opt-out improves enforceability or consumer fairness in the states served. No opt-out period is promised by this draft until the final arbitration architecture is approved.

28.5 Arbitration Provider

MDTelemed’s intended administrator is JAMS. The final clause should link or provide access to the applicable JAMS rules and Consumer Minimum Standards and identify how to commence arbitration.

29. GOVERNING LAW AND STATE-SPECIFIC RIGHTS

MDTelemed is headquartered at the address stated below, but telemedicine is regulated substantially by the law of the state where the patient is located. A single Nevada choice-of-law clause cannot be used to erase mandatory patient, professional, privacy, consumer, minor-consent, or medical-malpractice protections of another state. The final Terms may designate Nevada law for ordinary contract questions to the extent lawful, while expressly preserving mandatory law of the patient’s jurisdiction and any governing professional standard of care. Venue provisions must likewise be reconciled with the final arbitration structure and state consumer law.

30. FORCE MAJEURE AND EVENTS OUTSIDE REASONABLE CONTROL

For non-clinical platform obligations, MDTelemed will not be responsible for delay caused by events beyond its reasonable control, such as widespread telecommunications outages, natural disasters, governmental actions, or infrastructure failures, to the extent permitted by law. This section does not excuse legally required patient-safety actions, emergency escalation, record preservation, breach notification, or other nonwaivable duties.

31. SEVERABILITY, WAIVER, AND INTERPRETATION

If a court or arbitrator with authority determines that a provision is invalid or unenforceable, the provision should be enforced to the maximum lawful extent or severed if necessary, while preserving the remainder of the Terms where legally permissible. A failure to enforce a provision on one occasion does not automatically waive future enforcement. Headings are for organization and do not change substantive meaning. “Including” means including without limitation unless context requires otherwise.

32. ASSIGNMENT

A user may not transfer an MDTelemed account or personal rights under these Terms to another person except as permitted by law. MDTelemed may assign contractual rights in connection with a lawful merger, reorganization, financing, sale, or transfer of the business, subject to applicable privacy, medical-record, and professional-practice obligations.

33. CONTACT INFORMATION

MDTelemed LLC 304 S Jones Blvd #4872 Las Vegas, NV 89107 Business Administration / General Contact: Support@MDTelemed.com Separate contact pathways may be established for privacy, records, billing, accessibility, grievances, and legal notices. Until such addresses are operationally verified, MDTelemed should not publish invented email aliases.

34. RELATED DOCUMENTS

Website & Consumer Privacy Policy Patient Bill of Rights & Responsibilities Telehealth Informed Consent Prescribing & Medication Safety Policy Pediatric Care, Parent/Guardian Consent & Minor Rights Payment, Billing, Cancellation & Refund Policy Emergency, Urgent Care & Crisis Policy Complaints, Grievances & Appeals Acceptable Use & Patient Conduct Continuity of Care, Transfer & Termination Policy Dispute Resolution, Arbitration & Class-Action Waiver HIPAA Notice of Privacy Practices 50-State Telehealth Consent & Disclosure Addendum Electronic Communications, Electronic Records & E-SIGN Consent Membership, Automatic Renewal & Cancellation Terms Good Faith Estimate / No Surprises Act Notice AI Telescribe, Audio Capture & Documentation Consent Patient Identity Verification & Physical Location Policy Implement clickwrap acceptance that records the Terms version, timestamp, user/account identifier, and affirmative acceptance event. Present the arbitration provision conspicuously and separately enough to satisfy applicable consumer notice requirements; obtain any additional signature or acknowledgment required by state health-care law. Complete a 50-state review of pre-dispute medical-malpractice arbitration, class waivers, venue, choice of law, required notices, revocation periods, and special health-care agreement formalities. Verify the membership enrollment and cancellation flow against federal ROSCA/FTC requirements and every applicable state automatic-renewal law. Verify all clinical modalities by state, including whether audio-only and asynchronous care are permitted for the intended service and whether special consent is required. Verify the platform captures the patient's physical location at each encounter and prevents routing to an MD who lacks required authority in that location. Verify that only MD physicians are presented as MDTelemed treating clinicians at launch. Verify that no controlled substances can be prescribed through MDTelemed workflows, including formulary, e-prescribing, and physician training controls. Verify pricing, refunds, no-show rules, membership benefits, and cancellation mechanics before cross-linking the billing and membership policies. Verify the AI telescribe audio-processing and retention facts before incorporating the separate AI consent into the encounter workflow. Publish the HIPAA Notice of Privacy Practices, Telehealth Informed Consent, state telehealth addendum, minor-consent addendum, and Good Faith Estimate notice before clinical launch. Have qualified health-care and consumer counsel approve the final public Terms and the production acceptance workflow.

35. LEGAL AND INDUSTRY REFERENCES

Federal Arbitration Act, 9 U.S.C. §§ 1-16, subject to applicable law and enforceability principles. JAMS, Policy on Consumer Arbitrations Pursuant to Pre-Dispute Clauses - Minimum Standards of Procedural Fairness, effective May 1, 2024. Electronic Signatures in Global and National Commerce Act (E-SIGN), 15 U.S.C. § 7001 et seq. Restore Online Shoppers’ Confidence Act (ROSCA), 15 U.S.C. §§ 8401-8405, as applicable to online negative-option transactions. Federal Trade Commission Act, 15 U.S.C. §§ 41-58, including prohibitions on unfair or deceptive acts or practices. Health Insurance Portability and Accountability Act and implementing regulations, 45 C.F.R. Parts 160 and 164. Applicable state telehealth, medical-practice, informed-consent, minor-consent, consumer-protection, automatic-renewal, medical-malpractice, privacy, and arbitration laws. DrHouse Terms of Use and Consent to Virtual Visits, reviewed as industry architecture examples; not treated as legal authority. Teladoc Health Terms of Service, reviewed as an industry architecture example distinguishing public-site privacy terms and health-service privacy documentation.

35.1 Primary online sources reviewed for Version 1.0

JAMS Consumer Arbitration Minimum Standards: https://www.jamsadr.com/consumer-minimum-standards JAMS Rules, Procedures, and Forms: https://www.jamsadr.com/rules-download FTC Negative Option Rule / 2026 rulemaking page: https://www.ftc.gov/legal-library/browse/rules/negative-option-rule FTC v. Uber - subscription consent/cancellation enforcement example: https://www.ftc.gov/legal-library/browse/cases-proceedings/2423092-uber-ftc-v DrHouse Terms of Use: https://drhouse.com/terms-of-use/ DrHouse Consent to Virtual Visits: https://drhouse.com/consent-to-virtual-visits/ Teladoc Health Terms of Service: https://www.teladochealth.com/legal/el-gr/terms-of-service

36. END OF

PATIENT BILL OF RIGHTS AND RESPONSIBILITIES

1. MDTELEMED LLC

2. PATIENT BILL OF RIGHTS & RESPONSIBILITIES

Version 1.0 | September 15, 2026

Applies to patients, parents/guardians, and authorized representatives using MDTelemed LLC clinical services

3. PURPOSE AND SCOPE

This Patient Bill of Rights & Responsibilities describes the rights MDTelemed LLC recognizes for patients receiving telemedicine services and the responsibilities that help patients and physicians use telemedicine safely and effectively. It is designed for a national MD-only telemedicine service treating patients of all ages through video, audio-only/telephone, asynchronous communications, and secure messaging when clinically appropriate and legally permitted. This document supplements, and does not replace, rights arising under federal law, the law of the state where the patient is physically located, professional medical standards, MDTelemed’s HIPAA Notice of Privacy Practices, Telehealth Informed Consent, Pediatric Care Policy, Behavioral Health Policy, accessibility policies, state addenda, and other applicable documents. If state or federal law gives a patient greater protection than this Policy, MDTelemed will follow the controlling law. Nothing in this Policy is intended to create a lesser standard of care for telemedicine than would otherwise apply to the physician under the circumstances.

4. RIGHT TO RESPECTFUL, DIGNIFIED, AND PATIENT-CENTERED CARE

Every patient has the right to be treated with dignity, courtesy, compassion, and respect. Telemedicine should not diminish the seriousness of the physician-patient relationship. To have personal values, beliefs, cultural considerations, communication needs, disability-related needs, and reasonable preferences considered in care when clinically and legally appropriate. To receive care without retaliation for asking questions, requesting records, raising a safety concern, making a complaint, or exercising a lawful privacy right. To be addressed in a respectful manner and to expect professional conduct from physicians and MDTelemed personnel. To receive reasonable privacy during an encounter and to be informed when another person is participating in the encounter in a professional capacity, subject to emergencies and applicable law. A patient also has the right to tell the physician if the patient is uncomfortable with another person being present, with a particular communication method, or with a nonessential part of the telemedicine environment. MDTelemed will evaluate such requests under clinical, privacy, operational, and legal requirements.

5. RIGHT TO NONDISCRIMINATION AND EQUAL ACCESS

MDTelemed does not deny or diminish medically appropriate access based on characteristics protected by applicable federal or state law. The precise list of protected characteristics and legal duties can vary by jurisdiction and program. MDTelemed’s separate Nondiscrimination, Reasonable Accommodation & Language Access Policy describes applicable protections and methods for requesting assistance. MDTelemed will not make an unverified claim that every provision of a particular federal funding statute applies to MDTelemed merely because MDTelemed provides health care. As of 2026, federal Section 1557 rules have been affected by litigation and partial vacatur. MDTelemed therefore will base its public nondiscrimination statement on protections actually applicable at launch, while maintaining a broad company commitment to respectful, nondiscriminatory care.

6. RIGHT TO ACCESSIBLE COMMUNICATION

Patients with disabilities have the right to request reasonable accommodations and auxiliary aids or services where required by applicable law. Patients with limited English proficiency may request language assistance where required or made available. Patients may identify a communication disability, accessibility barrier, language need, or other accommodation request before or during care. MDTelemed should provide a practical method to request assistance without requiring a patient to disclose more information than reasonably necessary. A patient should not be charged a prohibited surcharge for an accommodation that MDTelemed is legally required to provide. The exact accessibility technologies and interpreter services offered must match MDTelemed’s verified operational capabilities. MDTelemed will not promise specific tools, response times, or certifications until implemented.

7. RIGHT TO KNOW WHO IS PROVIDING CARE

Patients have the right to know the identity and professional role of the physician providing care. MDTelemed’s current clinical model uses medical doctors (MDs) as treating clinicians; it does not represent DOs, nurse practitioners, or physician assistants as MDTelemed treating clinicians at launch. To know the treating physician’s name. To receive information sufficient to understand that the clinician is a physician and is licensed or otherwise legally authorized to provide care in the patient’s jurisdiction. To ask reasonable questions about the physician’s role and the nature of the telemedicine service. The patient’s physical location is important because the physician’s authority to practice generally depends on where the patient is physically located at the time of the encounter.

8. RIGHT TO INFORMATION ABOUT TELEMEDICINE

Before receiving telemedicine care, patients have the right to information reasonably necessary to understand the nature of the service, including material limitations, alternatives, privacy considerations, and circumstances in which in-person or emergency care may be preferable. To know which modality is being used—video, audio-only, asynchronous, secure messaging, or a combination. To be told when technology limitations materially affect the physician’s ability to evaluate the condition. To ask whether an in-person examination, laboratory test, imaging study, electrocardiogram, or other diagnostic service may be needed. To be informed when a telemedicine encounter must be stopped or redirected because remote care is not clinically adequate. A patient’s agreement to telemedicine does not require a physician to continue remote care when the physician concludes that in-person or emergency evaluation is necessary.

9. RIGHT TO INFORMED CONSENT AND PARTICIPATION IN DECISIONS

Patients have the right to participate meaningfully in decisions about their care. Informed consent is a process, not merely a checkbox. To receive information about the physician’s assessment, proposed treatment, material risks, expected benefits, and reasonable alternatives to the extent required by applicable law and appropriate to the clinical circumstances. To ask questions and receive understandable answers. To participate in choosing among clinically reasonable options. To decline a proposed medication, test, referral, or treatment, subject to the physician’s right not to provide care that the physician considers unsafe or below the standard of care. To withdraw consent to a nonemergency intervention where withdrawal is legally and clinically possible. Refusal of a recommended service may affect what the physician can safely provide. A physician may explain the consequences of refusal and recommend alternative or higher-acuity care.

10. RIGHT TO REFUSE OR DISCONTINUE TELEMEDICINE

A patient may generally decline telemedicine and seek an alternative form of care. State law may provide specific telehealth-consent or withdrawal rights. The separate Telehealth Informed Consent and 50-State Telehealth Consent & Disclosure Addendum will identify applicable requirements. Ending a telemedicine encounter does not guarantee that MDTelemed can provide the same service through another modality. The patient may need in-person care, emergency care, or another clinician.

11. RIGHT TO CLINICALLY APPROPRIATE CARE

Patients have the right to care consistent with the professional standard applicable to the physician and the circumstances. MDTelemed does not adopt a lower clinical standard merely because the encounter is remote. A physician may determine that telemedicine is insufficient because of examination limitations, diagnostic uncertainty, patient instability, inability to verify necessary information, inability to establish an adequate physician-patient relationship, or another clinical or legal reason. To have the physician consider whether the chosen telemedicine modality is adequate. To receive appropriate escalation instructions when the condition exceeds telemedicine capabilities. To receive reasonable follow-up recommendations and warning signs when clinically indicated. To have clinically relevant test results considered when available to the physician.

12. RIGHT TO EMERGENCY AND CRISIS ESCALATION INFORMATION

MDTelemed is not a hospital emergency department and does not replace 911 or emergency medical services. Patients have the right to clear instructions when the physician believes emergency evaluation is necessary. Federal EMTALA protections apply to covered hospital emergency departments, not simply to every telemedicine company. MDTelemed will therefore direct patients with possible emergency medical conditions to appropriate emergency services rather than falsely describing MDTelemed itself as an EMTALA emergency department. For psychiatric emergencies, suicidal intent, homicidal intent, severe psychosis, dangerous intoxication, or other acute safety concerns, MDTelemed may direct the patient to 911, 988 where appropriate, an emergency department, crisis service, or another higher-acuity resource based on the circumstances.

13. RIGHT TO PRIVACY AND CONFIDENTIALITY

Patients have the right to expect MDTelemed to protect health information as required by HIPAA and other applicable privacy laws. The HIPAA Notice of Privacy Practices explains MDTelemed’s HIPAA duties and patient rights in greater detail. To receive notice of privacy practices when required. To request confidential communications by an alternative method or at an alternative location as provided by HIPAA. To request certain restrictions on uses or disclosures of PHI; MDTelemed is not required to agree to every restriction, except where HIPAA requires agreement. For a self-pay service paid in full out of pocket, to request a qualifying restriction on disclosure of PHI to a health plan where the HIPAA conditions are met. Privacy is also a shared practical responsibility during telemedicine. Patients should choose a reasonably private environment when possible and tell the physician if another person is present.

14. RIGHT TO ACCESS MEDICAL AND BILLING RECORDS

HIPAA generally gives patients a broad right to inspect or obtain a copy of PHI in designated record sets maintained by or for a covered entity, subject to limited exclusions and denial grounds. This includes many medical and billing records. MDTelemed will not condition access to a medical record on payment of an outstanding bill where HIPAA prohibits doing so. Permissible copy or delivery fees, if any, must comply with applicable law. MDTelemed currently expects to make patient records available in PDF format. Other formats will be provided when actually supported or legally required; this Policy does not invent CSV, Excel, or FHIR capability.

15. RIGHT TO REQUEST AMENDMENT OR CORRECTION

A patient who believes information in the medical or billing record is inaccurate or incomplete may request an amendment as provided by HIPAA and applicable state law. An amendment request does not mean the patient can require deletion of an accurate physician opinion, diagnosis, or historical entry. MDTelemed must follow the applicable amendment process. If a request is denied where HIPAA applies, the patient may have a right to submit a statement of disagreement for inclusion with the record.

16. RIGHT TO AN ACCOUNTING OF CERTAIN DISCLOSURES

HIPAA gives individuals a right to request an accounting of certain disclosures of PHI. The right does not encompass every disclosure; HIPAA contains categories that are excluded from the accounting requirement, including many disclosures for treatment, payment, and health care operations. The Notice of Privacy Practices will explain how to exercise this right and any applicable limitations.

17. RIGHT TO CONTROL CERTAIN AUTHORIZATIONS

Where HIPAA or another law requires a written authorization for a use or disclosure, patients have the right to decide whether to sign that authorization and, subject to legal limitations, to revoke it prospectively. A general consent to treatment is not automatically a HIPAA authorization for every use or disclosure that requires authorization. MDTelemed will use the appropriate legal instrument for the purpose involved.

18. RIGHT TO UNDERSTAND AI-ASSISTED DOCUMENTATION

MDTelemed’s medical decisions are made by human MD physicians. Patients have the right to be informed that AI-assisted telescribing may be used to help document the encounter. The separate AI Telescribe, Audio Capture & Documentation Consent will describe the verified audio-processing and retention model, applicable consent, the role of any processor, and what occurs if the patient declines the documentation method. MDTelemed will not tell patients that AI audio is immediately deleted, permanently stored, or never used for training until those facts have been technically verified.

19. RIGHT TO PRESCRIPTION INFORMATION AND MEDICATION SAFETY

Patients have the right to understandable information about medications prescribed by an MDTelemed physician, including clinically appropriate directions, material precautions, and follow-up expectations. A patient does not have a right to demand a particular prescription. The physician may refuse a requested drug when it is medically inappropriate, unsafe, unsupported by available information, prohibited by law, or outside MDTelemed’s scope. MDTelemed prohibits Schedule II-V controlled-substance prescribing through its service. This company restriction applies even where a particular controlled substance might otherwise be legally prescribable through telemedicine.

20. RIGHT TO LABORATORY, IMAGING, AND DIAGNOSTIC FOLLOW-UP

MDTelemed physicians may order laboratory tests, imaging, electrocardiography, and other diagnostic services when appropriate. Patients have the right to information about why testing is recommended and what follow-up is reasonably expected. Patients should be informed when a result requires urgent attention or when an abnormal or incomplete result changes the treatment plan. MDTelemed’s Test Results, Abnormal Results & Follow-Up Policy will define the operational workflow. Independent laboratories, imaging centers, pharmacies, specialists, and facilities may have separate charges and policies.

21. RIGHT TO BE INFORMED ABOUT COSTS

MDTelemed is launching as a cash/self-pay service. Patients have the right to see the applicable MDTelemed price or pricing method before authorizing a charge. Prices should be referenced from the current website or checkout flow rather than hard-coded into this Policy because pricing may change prospectively. Uninsured or self-pay patients may have rights under the federal Good Faith Estimate framework. MDTelemed’s Good Faith Estimate / No Surprises Act Notice will explain those rights. A membership is not health insurance. Patients have the right to clear disclosure of recurring charges, renewal terms, included services, material exclusions, and cancellation procedures before enrollment.

22. RIGHT TO CANCEL A MEMBERSHIP AS PROVIDED BY LAW AND AGREEMENT

Patients who enroll in an automatically renewing MDTelemed membership have the right to the disclosures, authorization, reminders where required, and cancellation mechanisms provided by applicable law and MDTelemed’s Membership, Automatic Renewal & Cancellation Terms. Cancellation of a membership does not authorize destruction of medical records and does not necessarily cancel separately scheduled or completed services.

23. RIGHT TO CONTINUITY AND SAFE TRANSITION OF CARE

When an ongoing physician-patient relationship exists, MDTelemed will address termination, transfer, and continuity in accordance with applicable professional and state-law requirements. Digital account suspension should not be used to evade duties concerning patient abandonment. To receive reasonable transition information when required. To obtain records as permitted by law. To receive emergency or urgent escalation instructions when clinically necessary. To understand when MDTelemed cannot continue a medication or treatment and why. The exact notice period and transition obligations vary by state and clinical circumstances; MDTelemed will not promise a universal 30-day rule unless legally and operationally appropriate.

24. RIGHTS OF PEDIATRIC AND ADOLESCENT PATIENTS

Children and adolescents have rights appropriate to their age, legal status, state law, and the service involved. Parents and guardians also have rights and responsibilities, but parental authority is not identical in every circumstance. State law may allow minors to consent independently to specified services such as certain sexual-health, pregnancy-related, mental-health, or other care, and may limit parental access to related confidential information. MDTelemed will use the 50-State Minor Consent & Confidentiality Addendum rather than a single national rule. When developmentally appropriate, MDTelemed physicians should involve pediatric patients in discussions and decisions even when legal consent is provided by a parent or guardian.

25. RIGHTS IN BEHAVIORAL AND PSYCHIATRIC CARE

Patients receiving psychiatric care have the same core rights to dignity, informed participation, privacy, appropriate escalation, and access to records, subject to specialized legal rules. Psychotherapy notes, when they meet the HIPAA definition and are maintained separately from the medical record, receive special protection and are generally excluded from the HIPAA right of access. Ordinary psychiatric progress notes are not automatically psychotherapy notes merely because they concern mental health. MDTelemed does not offer OUD/buprenorphine treatment at launch. Treating psychiatric conditions does not by itself make every MDTelemed record subject to 42 C.F.R. Part 2. If MDTelemed later becomes a Part 2 program or receives Part 2 records, it will apply the requirements that actually govern those records.

26. RIGHT TO A PERSONAL REPRESENTATIVE OR AUTHORIZED SUPPORT PERSON

Patients may have a parent, guardian, personal representative, caregiver, interpreter, or support person participate when legally authorized and clinically appropriate. MDTelemed may verify the person’s identity and authority. A patient’s preference for another person to participate does not automatically grant that person unrestricted access to the entire medical record. Access depends on authorization, personal-representative status, applicable law, and the scope of authority.

27. RIGHT TO COMPLAIN WITHOUT RETALIATION

Patients have the right to raise concerns about clinical care, privacy, billing, accessibility, discrimination, physician conduct, technology, or other services without retaliation. Complaints may be submitted to MDTelemed through the channels in the Complaints, Grievances & Appeals Policy. Patients retain any right to complain directly to a state medical board, the HHS Office for Civil Rights, consumer-protection authorities, licensing agencies, or other governmental bodies. MDTelemed will not require a patient to waive a lawful regulator complaint as a condition of receiving care or resolving an internal grievance.

28. RIGHT TO RECEIVE POLICIES AND IMPORTANT NOTICES

Patients have the right to reasonable access to the policies and notices that materially govern their care and use of MDTelemed, including the Terms of Service, Telehealth Informed Consent, Privacy Policy, HIPAA Notice of Privacy Practices, prescribing rules, emergency policy, membership terms, and applicable state addenda. Where law requires a paper copy of a notice upon request, MDTelemed will provide one in accordance with the applicable rule.

29. PATIENT RESPONSIBILITIES

Patient rights operate alongside responsibilities that help physicians provide safe and effective care. A patient or authorized representative is expected to: Provide truthful, complete, and current information to the best of the patient’s knowledge, including symptoms, medical history, medications, allergies, pregnancy status when relevant, prior diagnoses, and recent testing. Accurately identify the patient and disclose the patient’s physical location at the time of each telemedicine encounter. Tell the physician when the patient does not understand a question, instruction, diagnosis, medication direction, or follow-up plan. Inform the physician of relevant changes in symptoms or health status. Follow agreed treatment instructions or tell the physician when the patient cannot or chooses not to follow them. Complete recommended testing, referrals, follow-up, or in-person evaluation when clinically necessary. Seek emergency care promptly when directed or when an emergency develops. Use medications only as directed and disclose relevant prescriptions, over-the-counter drugs, supplements, allergies, and adverse reactions. Use the MDTelemed platform lawfully and respectfully and protect account credentials. Respect the privacy and rights of physicians, staff, and other individuals. Pay authorized self-pay charges and manage membership cancellation according to applicable terms, while retaining all lawful billing-dispute rights. Provide accurate contact information so MDTelemed can deliver clinically important communications.

30. RESPONSIBILITY TO MAINTAIN A SAFE TELEMEDICINE ENVIRONMENT

Patients should participate from a location that is reasonably private and safe when possible. A patient should not drive or operate dangerous machinery during a telemedicine encounter unless the physician is addressing an emergency and remaining connected is safer than disconnecting. Patients should disclose if another person is present when that presence could affect privacy, consent, safety, or the clinical assessment. A physician may request a private conversation with the patient when clinically or legally appropriate.

31. RESPONSIBILITY TO USE EMERGENCY SERVICES APPROPRIATELY

Patients should not use routine MDTelemed messaging or appointment functions as a substitute for 911 or emergency care. Messages may not be reviewed immediately. If a patient receives an instruction to seek emergency evaluation, the patient is responsible for acting on that instruction or communicating barriers so the physician can consider reasonable alternatives. MDTelemed cannot guarantee outcomes when recommended emergency or in-person care is declined.

32. RESPONSIBILITY TO RESPECT PRESCRIBING BOUNDARIES

Patients should not misrepresent symptoms, identity, medical history, medication history, or location to obtain a prescription. Patients should not pressure or threaten a physician to prescribe medication. Requests for controlled substances cannot be fulfilled through MDTelemed. Repeated attempts to circumvent this policy may result in service restrictions consistent with continuity-of-care obligations and applicable law.

33. RESPONSIBILITY TO REVIEW RESULTS AND FOLLOW-UP COMMUNICATIONS

Patients should monitor the contact methods they have authorized and respond to clinically important communications. MDTelemed should use reasonable processes for abnormal and urgent results, but patients also share responsibility for completing tests and maintaining current contact information. A patient should contact MDTelemed if an expected result or follow-up communication has not been received within the timeframe communicated by the physician or testing facility.

34. LIMITS OF PATIENT RIGHTS DOCUMENT

This Policy is a patient-facing summary, not an exhaustive statement of every legal right in every jurisdiction. State-specific statutes may create additional rights concerning telehealth consent, reproductive or sexual-health services, behavioral health, minors, medical records, privacy, discrimination, payment, or professional conduct. MDTelemed will maintain state addenda and internal compliance matrices so that a general national document does not falsely imply uniformity where state law differs.

35. CONTACT INFORMATION

MDTelemed LLC 304 S Jones Blvd #4872 Las Vegas, NV 89107 Business Administration / General Contact: Support@MDTelemed.com Dedicated privacy, records, billing, accessibility, and grievance contact channels may be added once operationally verified. Until then, MDTelemed should not publish email addresses that have not actually been established.

36. RELATED POLICIES

Website & Consumer Privacy Policy Terms of Use & Terms of Service Telehealth Informed Consent Prescribing & Medication Safety Policy Pediatric Care, Parent/Guardian Consent & Minor Rights Behavioral Health Services & Mental Health Privacy Emergency, Urgent Care & Crisis Policy Complaints, Grievances & Appeals Medical Records Access, Amendment & Release Policy Continuity of Care, Transfer & Termination Policy Nondiscrimination, Reasonable Accommodation & Language Access HIPAA Notice of Privacy Practices 50-State Telehealth Consent & Disclosure Addendum 50-State Minor Consent & Confidentiality Addendum Good Faith Estimate / No Surprises Act Notice AI Telescribe, Audio Capture & Documentation Consent Confirm the final accessibility and language-assistance services actually available to patients before describing specific aids or response times. Complete the 50-state telehealth patient-rights and informed-consent matrix. Complete the 50-state minor-consent, confidentiality, parental-access, guardianship, and mandatory-reporting matrix. Confirm the complaint and grievance workflow and establish dedicated contact channels if desired. Confirm the AI telescribe consent and audio-processing workflow. Confirm the records-request workflow, PDF delivery capability, amendment workflow, and HIPAA response tracking. Confirm the abnormal-test-result and critical-result escalation process. Confirm membership pricing disclosures, automatic-renewal consent, and cancellation workflow. Confirm the physician licensure verification and patient-location workflow. Have qualified health-care/privacy counsel review the final patient-facing version against applicable federal and 50-state law.

37. PRIMARY LEGAL AND REGULATORY REFERENCES

HIPAA Privacy Rule, 45 C.F.R. Parts 160 and 164, including §§ 164.520, 164.522, 164.524, 164.526, and 164.528. U.S. Department of Health and Human Services, Summary of the HIPAA Privacy Rule. U.S. Department of Health and Human Services, Individuals’ Right under HIPAA to Access their Health Information, 45 C.F.R. § 164.524. U.S. Department of Health and Human Services, Your Medical Records; HIPAA rights concerning access and amendment. U.S. Department of Health and Human Services, HIPAA guidance concerning requests for restrictions and confidential communications. Emergency Medical Treatment and Labor Act (EMTALA), 42 U.S.C. § 1395dd, applicable to covered hospital emergency departments; cited here to distinguish hospital emergency rights from MDTelemed’s non-emergency telemedicine service. Section 1557 of the Affordable Care Act, 42 U.S.C. § 18116, to the extent applicable; HHS June 1, 2026 notice concerning partial vacatur of provisions of the 2024 final rule.

38. C.F.R. Part 2, where applicable to qualifying substance-use-disorder records/programs; HHS 2024 Final Rule compliance required beginning February 16, 2026.

Applicable state medical-practice, telehealth, informed-consent, patient-record, privacy, nondiscrimination, minor-consent, behavioral-health, mandatory-reporting, and professional-conduct laws.

38.1 Primary online sources reviewed for Version 1.0

HHS — Summary of the HIPAA Privacy Rule: https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html HHS — Individuals’ Right to Access Health Information: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html HHS — Your Medical Records: https://www.hhs.gov/hipaa/for-individuals/medical-records/index.html HHS — Right to Request a Restriction: https://www.hhs.gov/hipaa/for-professionals/faq/right-to-request-a-restriction/index.html CMS — Emergency Room Rights Under EMTALA: https://www.cms.gov/priorities/your-patient-rights/emergency-room-rights HHS — 42 CFR Part 2 Final Rule Fact Sheet: https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html HHS — June 1, 2026 Section 1557 Partial Vacatur Notice: https://www.hhs.gov/press-room/informs-covered-entities-partial-vacatur-2024-aca-nondiscrimination-final-rule-tennessee-v-kennedy.html

39. END OF

MDTelemed’s principle: Telemedicine changes how care is delivered; it does not eliminate the patient’s dignity, privacy, informed-consent rights, or the physician’s professional responsibilities. Rights that cannot lawfully be waived remain protected.

TELEHEALTH INFORMED CONSENT

1. MDTELEMED LLC

Version 1.0 | September 15, 2026

National baseline consent for MD-only telemedicine; supplemented by state-specific consent and disclosure requirements

3. PURPOSE OF THIS CONSENT

This Telehealth Informed Consent explains the nature of MDTelemed LLC telemedicine services, how remote care may differ from in-person care, material benefits and risks, privacy and technology considerations, emergency limitations, patient responsibilities, and the circumstances in which a physician may recommend or require in-person evaluation. The original MDTelemed draft described video, telephone, and asynchronous messaging, emphasized convenience and remote-care limitations, prohibited controlled substances, and warned that emergencies require 911. Those concepts are preserved where accurate. The original draft also stated that telemedicine could not order laboratory testing, imaging, or electrocardiography and automatically authorized recording of consultations. Those statements are not preserved because MDTelemed has confirmed that its physicians may order diagnostic testing and that AI-assisted telescribing requires a separate, accurately described consent. This national consent is intended to be paired with MDTelemed’s 50-State Telehealth Consent & Disclosure Addendum. State law varies regarding whether consent must be written or verbal, when it must be obtained, what disclosures must be made, whether consent must be documented in the medical record, and whether special rules apply to particular services or patient populations.

4. WHAT TELEMEDICINE MEANS

Telemedicine or telehealth generally means providing health care when the patient and physician are in different physical locations and communicate using telecommunications or digital technology. MDTelemed may use one or more of the following modalities when clinically appropriate and legally permitted: Synchronous video: real-time audiovisual interaction between patient and physician. Audio-only/telephone: real-time voice communication without video. Asynchronous care: information, questionnaires, images, messages, or other clinical data are submitted and reviewed at different times. Secure messaging: electronic communication used for clinical questions, follow-up, instructions, or other appropriate care activities. Not every modality is appropriate for every patient, diagnosis, treatment, or state. The physician may require a different modality, additional information, diagnostic testing, or an in-person examination before making a diagnosis or treatment decision.

5. THE MDTelemed CLINICAL MODEL

MDTelemed’s treating clinicians are medical doctors (MDs). Clinical diagnosis, treatment, prescribing, referral, and escalation decisions are made by human physicians. MDTelemed may use AI-assisted telescribing or documentation technology to assist the physician with creating a progress note. That technology is not the treating physician. It does not replace the physician’s independent medical judgment. The details of audio capture, processing, retention, deletion, third-party processing, and patient choice must be accurately described in MDTelemed’s separate AI Telescribe, Audio Capture & Documentation Consent before launch. MDTelemed does not prescribe Schedule II-V controlled substances through the MDTelemed service. This is a company scope-of-service restriction.

6. POTENTIAL BENEFITS OF TELEMEDICINE

Potential benefits vary by patient and circumstance. They may include: Access to a physician without traveling to a medical office. More convenient access for patients with mobility, transportation, geographic, work, caregiving, or scheduling barriers. Ability to discuss symptoms, chronic conditions, medications, preventive issues, psychiatric concerns, and other health needs remotely when appropriate. Ability to coordinate prescriptions, referrals, laboratory testing, imaging, and other diagnostic services without requiring the initial physician encounter to occur in person. Reduced exposure to contagious illnesses in waiting rooms in appropriate circumstances. Ability to share photographs, records, test results, or other information electronically where supported and appropriate. These are potential benefits, not guarantees. Telemedicine may be less convenient or less clinically useful than in-person care for some conditions.

7. MATERIAL LIMITATIONS OF TELEMEDICINE

Telemedicine can limit what the physician can directly observe, touch, measure, or test. The importance of these limitations depends on the clinical problem and the modality being used.

7.1 Physical Examination Limitations

A remote physician may be unable to perform palpation, auscultation, percussion, detailed neurologic testing, otoscopic examination, abdominal examination, pelvic examination, rectal examination, certain orthopedic maneuvers, fundoscopic examination, or other hands-on assessments. Some examination components may be approximated through patient-assisted maneuvers, visual inspection, home devices, or a caregiver, but these are not always equivalent to a direct examination.

7.2 Vital Signs and Home Measurements

The physician may rely on patient-reported or home-device measurements such as temperature, blood pressure, pulse, weight, glucose, oxygen saturation, or other data. Home devices can be inaccurate, improperly used, uncalibrated, or unavailable. The physician may require repeat or professionally obtained measurements.

7.3 Diagnostic Uncertainty

A condition evaluated remotely may be misidentified, incompletely characterized, or require additional information before a reliable diagnosis can be made. A diagnosis may change after an in-person examination, laboratory testing, imaging, specialist evaluation, or evolution of symptoms.

7.4 Modality Limitations

Audio-only care provides less visual information than video. Asynchronous care lacks real-time interaction. Secure messaging can delay clarification. A physician may determine that the chosen modality is inadequate and require video, telephone, in-person care, or emergency evaluation.

8. LABORATORY TESTING, IMAGING, ECG, AND OTHER DIAGNOSTICS

Unlike the original draft, this consent recognizes that MDTelemed physicians may order laboratory tests, imaging studies, electrocardiography, and other diagnostic services when clinically appropriate and legally permitted. The test itself ordinarily must be performed by an independent laboratory, imaging center, facility, device, or other qualified service. A physician may decline to prescribe or continue treatment until required testing is completed. Failure to complete recommended testing may increase clinical risk and may limit the physician’s ability to safely continue care. Independent testing facilities may charge separate fees and may have separate privacy, scheduling, preparation, and result-delivery practices.

9. RISKS OF DELAYED OR MISSED FINDINGS

Because telemedicine can limit examination and immediate testing, there is a risk that a condition may be diagnosed later than it would be during an in-person evaluation or that a physical finding may not be detected remotely. The physician should consider these limitations in deciding whether telemedicine is appropriate. Patients should promptly report worsening symptoms, new symptoms, or failure to improve, and should follow instructions for in-person or emergency evaluation. This disclosure does not excuse a physician from the applicable standard of care and does not require a patient to assume responsibility for professional negligence.

10. TECHNOLOGY RISKS

Telemedicine depends on devices, software, telecommunications networks, electricity, microphones, cameras, speakers, and internet or telephone connectivity. Risks include: Poor audio or video quality. Interrupted or dropped connections. Device or software incompatibility. Delayed transmission or receipt of messages, images, or other information. Unauthorized access or disclosure if devices, accounts, or networks are not adequately protected. Technical failures that require rescheduling, changing modality, or obtaining in-person care. If technology interferes with safe care, the physician may stop the encounter and use another clinically and legally appropriate method or recommend in-person care.

11. PRIVACY AND CONFIDENTIALITY

Telemedicine appointments, messages, medical records, and related health information are protected by HIPAA when HIPAA applies and may also be protected by state law. MDTelemed’s HIPAA Notice of Privacy Practices and privacy policies provide additional information. HHS recommends that telehealth encounters be conducted in private settings when feasible and that reasonable safeguards be used when privacy is limited. Patients should use a reasonably private location, headphones when helpful, and a trusted device/network when possible. The patient should tell the physician if another person is present or can hear the encounter. The physician will identify known professional participants and obtain consent for observers when required.

12. PATIENT IDENTITY AND PHYSICAL LOCATION

Before or during a telemedicine encounter, MDTelemed may verify the patient’s identity and the authority of a parent, guardian, personal representative, or other person acting for the patient. The patient must accurately disclose the physical location where the patient is located at the time of the encounter. The patient’s physical location affects physician licensure, emergency planning, prescribing, mandatory reporting, and other legal obligations. If the patient is in a jurisdiction where the assigned physician is not legally authorized to provide care, the encounter may be redirected, rescheduled, or discontinued.

13. EMERGENCIES AND HIGH-ACUITY CONDITIONS

MDTelemed is not a substitute for 911, emergency medical services, or an emergency department. If the patient has symptoms suggesting an emergency, the patient should call 911 or the local emergency number and seek immediate care. Examples can include severe chest pain, severe difficulty breathing, signs of stroke, severe bleeding, loss of consciousness, severe allergic reaction, major trauma, overdose, severe confusion, suicidal intent, homicidal intent, or another rapidly dangerous condition. A physician may instruct a patient to seek emergency or urgent in-person care. If the patient refuses, the physician may document the refusal, explain material risks, involve emergency resources when legally and clinically justified, and discontinue remote management when it cannot be safely provided.

14. PSYCHIATRIC AND BEHAVIORAL HEALTH TELEMEDICINE

MDTelemed may provide psychiatric and behavioral-health care when appropriate. Telebehavioral health can involve additional privacy and safety considerations, including the need to know the patient’s location, emergency contacts or local resources when appropriate, and whether the patient has sufficient privacy to participate. A psychiatric emergency may require immediate local crisis or emergency intervention. MDTelemed does not provide OUD/buprenorphine treatment at launch and does not prescribe controlled substances. Mental-health treatment does not automatically make every MDTelemed record subject to 42 C.F.R. Part 2. Part 2 applies only when its statutory and regulatory conditions are met.

15. PEDIATRIC TELEMEDICINE

MDTelemed treats patients of all ages, including infants, children, and adolescents. The person legally authorized to consent depends on the patient’s age, legal status, state law, and type of service. A parent or legal guardian will generally consent for a minor who cannot legally consent independently, but state law may permit minors to consent to certain services and may protect confidentiality of those services. Emancipation, guardianship, foster care, custody orders, and other circumstances may affect authority. MDTelemed will use its Pediatric Care, Parent/Guardian Consent & Minor Rights Policy and 50-State Minor Consent & Confidentiality Addendum rather than the simplistic age categories in the original draft.

16. PRESCRIPTIONS AND MEDICATION RISKS

A telemedicine encounter does not guarantee a prescription. The physician may prescribe a non-controlled medication when the physician determines that prescribing is clinically appropriate, sufficient information is available, and applicable law permits it. All medications can have risks, including side effects, allergic reactions, interactions, contraindications, treatment failure, and unexpected effects. The patient should disclose medications, allergies, pregnancy status when relevant, significant medical conditions, and prior adverse reactions. The patient should seek urgent or emergency care for severe medication reactions or other dangerous symptoms.

17. REFERRALS AND IN-PERSON FOLLOW-UP

The physician may recommend primary-care follow-up, specialist evaluation, urgent care, emergency care, laboratory testing, imaging, or another in-person service. A referral or recommendation does not guarantee appointment availability, insurance coverage, pricing, or acceptance by an independent provider. Telemedicine may be used as one component of longitudinal care, but some conditions require periodic in-person assessment.

18. ALTERNATIVES TO TELEMEDICINE

Reasonable alternatives may include an in-person physician visit, urgent care, retail clinic, specialist office, emergency department, hospital, community mental-health service, or another telemedicine provider. The appropriate alternative depends on the condition and urgency. A patient may ask whether an in-person evaluation would provide a material clinical advantage. The physician may recommend in-person care even when the patient prefers telemedicine.

19. RIGHT TO ASK QUESTIONS AND PARTICIPATE

The patient may ask questions about the telemedicine process, diagnosis, treatment plan, alternatives, medications, testing, privacy, technology, and follow-up. The patient should tell the physician if information is unclear. The patient may decline a recommended treatment or test, but refusal may affect what care the physician can safely provide.

20. RIGHT TO WITHDRAW OR DECLINE TELEMEDICINE

A patient may generally decline telemedicine or withdraw consent prospectively, subject to applicable law and the practical consequences of ending an encounter. Withdrawal does not erase care already provided, records already created, lawful disclosures already made, or payment obligations already incurred. State law may prescribe a specific method for withdrawal or documentation. The 50-State Telehealth Consent & Disclosure Addendum will control where it provides a more specific rule.

21. RECORDING, AUDIO CAPTURE, AND AI TELEscribing

The original draft stated that booking a consultation automatically authorized video/audio recording and storage. Version 1.0 does not use that blanket authorization. HHS guidance recommends avoiding recording unless necessary and obtaining patient consent in advance when a telehealth session is recorded. MDTelemed intends to use AI-assisted telescribing to document progress notes. Before launch, MDTelemed must verify whether the technology merely processes a live audio stream, creates a temporary audio file, stores a recording, retains a transcript, or uses another architecture. Because state recording and eavesdropping laws differ, MDTelemed’s separate AI Telescribe, Audio Capture & Documentation Consent will state the actual technical practice and obtain any consent required for that practice. Consent to telemedicine alone is not treated as consent to every form of recording.

22. PHOTOGRAPHS, VIDEO, AND PATIENT-SUBMITTED MEDIA

Patients may be asked to submit photographs, videos, documents, device readings, or other media when clinically useful. Such information may become part of the medical record when used in care. Patients should avoid including unrelated people, identifying information, or background content when not necessary. The physician may determine that a photograph or video is inadequate for diagnosis and require an in-person examination. A photograph is not automatically equivalent to a physical examination.

23. AUDIO-ONLY TELEHEALTH

Audio-only telehealth may be used when clinically appropriate and legally permitted. HHS confirms that covered health care providers may use audio-only remote communication technologies consistent with HIPAA requirements. Audio-only care may limit visual assessment and may not be sufficient for conditions where appearance, movement, respiratory effort, rash characteristics, neurologic signs, or other visual information is important. The physician may require video or in-person care.

24. ASYNCHRONOUS AND SECURE-MESSAGING CARE

Asynchronous care and secure messaging are not real-time emergency channels. Messages may not be reviewed immediately. The physician may request additional information, convert the interaction to video or telephone, or recommend in-person care. A patient should not rely on asynchronous messaging for rapidly worsening symptoms or emergencies. State law may impose particular standards on establishing a physician-patient relationship or prescribing through asynchronous modalities. MDTelemed will apply state-specific rules rather than assume that asynchronous care is permitted identically nationwide.

25. LIMITATIONS ON DIAGNOSIS AND TREATMENT

Some diagnoses cannot be responsibly made through the available remote information. Some treatments cannot be safely initiated or continued without physical examination, vital signs, laboratory monitoring, imaging, ECG, pregnancy testing, specialist evaluation, or other information. The physician may decline a requested diagnosis, medication, medical certification, work note, testing order, referral, or other service when the physician believes the request is clinically unsupported or legally impermissible.

26. NO GUARANTEE OF OUTCOME

No medical service can guarantee a cure or particular result. Telemedicine may be successful, partially successful, unsuccessful, or require additional evaluation. A diagnosis or treatment plan may change as new information becomes available. This acknowledgement is not a waiver of the physician’s professional standard of care.

27. PATIENT RESPONSIBILITIES DURING TELEMEDICINE

Provide truthful and complete information to the best of your knowledge. Accurately identify yourself and state your current physical location. Disclose medications, allergies, relevant diagnoses, recent testing, and other requested health information. Tell the physician who else is present or able to hear the encounter when relevant to privacy or consent. Use a reasonably private, safe environment when possible. Do not participate while driving or operating dangerous machinery except when remaining connected is necessary in an emergency. Follow instructions for testing, medication, follow-up, in-person care, or emergency escalation, or tell the physician if you cannot. Keep contact information current so important results and follow-up communications can reach you. Do not use routine messaging for emergencies. Ask questions when you do not understand the plan.

28. WHAT MDTelemed AND THE PHYSICIAN MAY DO IF TELEMEDICINE IS INADEQUATE

The physician may pause or terminate the remote evaluation, change modality, request another participant with the patient’s permission where appropriate, request diagnostic testing, direct the patient to an in-person setting, or call emergency resources when legally and clinically justified. A decision that telemedicine is inadequate is a clinical safety decision and is not a denial of the patient’s dignity or right to care.

29. COSTS AND THIRD-PARTY SERVICES

MDTelemed is launching as a self-pay service. Current MDTelemed pricing is displayed on the website or purchase flow rather than fixed in this consent. Pharmacy, laboratory, imaging, specialist, emergency, hospital, and other third-party services may have separate charges. A telemedicine order or referral does not guarantee the third party’s price, availability, or acceptance. Self-pay patients may have rights to a Good Faith Estimate under applicable federal rules.

30. PRIVACY PRACTICES AND MEDICAL RECORD

The physician will document the encounter in the medical record. Telemedicine documentation may include the modality used, patient location, consent, identity verification, participants, clinical information, assessment, plan, prescriptions, testing, referrals, and follow-up as appropriate. Patients may request access to records under HIPAA and applicable state law. MDTelemed’s current patient-record delivery capability is PDF, subject to other formats when required or actually supported.

31. STATE-SPECIFIC CONSENT REQUIREMENTS

Telehealth informed-consent requirements are not uniform across the United States. HHS expressly advises providers that specific informed-consent laws vary by state. Some states require consent before the first telehealth service; some permit verbal consent documented in the record; some require written consent in specified circumstances; and some require particular disclosures. MDTelemed will therefore maintain , the 50-State Telehealth Consent & Disclosure Addendum. The patient-facing consent workflow should dynamically present any state-specific language based on the patient’s physical location and the service being provided. If the state-specific addendum conflicts with this national baseline, the more specific state requirement governs.

32. CONSENT ACKNOWLEDGMENT

The final production consent should require affirmative acknowledgment rather than passive website use. The electronic consent record should identify the patient or authorized representative, consent version, date/time, patient location or state, and the method of acceptance. The following acknowledgement is suitable as the national baseline, subject to state-specific additions:

33. AUTHORIZED REPRESENTATIVE / PARENT / GUARDIAN ACKNOWLEDGMENT

If a person consents for another patient, the final workflow should require that person to identify the relationship and affirm legal authority to consent. MDTelemed may request documentation of authority. For minors, the workflow must defer to state-specific rules concerning independent minor consent, parental access, confidentiality, emancipation, guardianship, custody, foster care, and specialized services.

34. CONTACT INFORMATION

MDTelemed LLC 304 S Jones Blvd #4872 Las Vegas, NV 89107 Business Administration / General Contact: Support@MDTelemed.com Dedicated privacy, records, accessibility, billing, and grievance contacts may be added after those channels are operationally verified.

35. RELATED MDTelemed POLICIES

Website & Consumer Privacy Policy Terms of Use & Terms of Service Patient Bill of Rights & Responsibilities Prescribing & Medication Safety Policy Pediatric Care, Parent/Guardian Consent & Minor Rights Behavioral Health Services & Mental Health Privacy Emergency, Urgent Care & Crisis Policy Medical Records Access, Amendment & Release Policy HIPAA Notice of Privacy Practices 50-State Telehealth Consent & Disclosure Addendum 50-State Minor Consent & Confidentiality Addendum AI Telescribe, Audio Capture & Documentation Consent Patient Identity Verification & Physical Location Policy Laboratory, Imaging & Diagnostic Testing Policy Test Results, Abnormal Results & Follow-Up Policy Complete and legally validate , the 50-State Telehealth Consent & Disclosure Addendum. Configure the consent workflow to identify the patient’s physical state and present state-specific language before care. Verify whether each modality—video, audio-only, asynchronous, secure messaging—is permitted for the intended services in each state and what relationship/consent rules apply. Verify the AI telescribe architecture: live processing, recording status, transcript creation, storage, retention, deletion, model-training use, vendors/processors, and patient-declination pathway. Do not activate any blanket audio/video recording consent until the recording-law analysis and technical architecture are complete. Verify the identity-verification method and authorized-representative workflow. Verify the clinical emergency escalation workflow and collection of location/emergency contact information where appropriate. Verify laboratory, imaging, ECG, referral, and result-follow-up workflows. Verify pediatric and behavioral-health consent pathways separately. Ensure the EHR records the consent version, date/time, method, state/location, and representative status where applicable. Have qualified 50-state health-care counsel review the final consent and state addendum before national launch.

36. PRIMARY LEGAL, REGULATORY, AND GUIDANCE REFERENCES

U.S. Department of Health and Human Services, Telehealth.HHS.gov, Obtaining Informed Consent — recognizes that telehealth consent requirements vary by state and recommends explaining expectations, rights, observers, and documenting consent. U.S. Department of Health and Human Services, Telehealth.HHS.gov, Develop a Privacy and Security Telehealth Strategy — recommends informed consent, identity verification, private settings, risk analysis, and advance consent for recording when recordings are used. U.S. Department of Health and Human Services, Office for Civil Rights, HIPAA and Telehealth. U.S. Department of Health and Human Services, Office for Civil Rights, Guidance on Audio-Only Telehealth — confirms audio-only telehealth may be used consistent with HIPAA and discusses identity verification and Security Rule considerations.

37. C.F.R. Parts 160 and 164 — HIPAA Privacy, Security, and Breach Notification Rules.

Applicable state medical-practice, telehealth, informed-consent, recording/eavesdropping, minor-consent, behavioral-health, prescribing, and professional-conduct laws. Original MDTelemed Informed Consent for Telemedicine — used as source material for the original intended service concepts; inaccurate limitations and blanket recording language were not carried forward.

37.1 Primary online sources reviewed for Version 1.0

HHS Telehealth — Obtaining informed consent: https://telehealth.hhs.gov/providers/preparing-patients-for-telehealth/obtaining-informed-consent HHS Telehealth — Develop a privacy and security telehealth strategy: https://telehealth.hhs.gov/providers/best-practice-guides/privacy-and-security-telehealth/develop-privacy-and-security HHS OCR — HIPAA and Telehealth: https://www.hhs.gov/hipaa/for-professionals/special-topics/telehealth/index.html HHS OCR — Guidance on Audio-Only Telehealth: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-audio-telehealth/index.html HHS OCR — Telehealth Privacy and Security Tips for Patients: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/telehealth-privacy-security/index.html

38. END OF

39. MODALITY-SPECIFIC CONSENT CONSIDERATIONS

The patient’s consent to telemedicine does not mean that every available modality is interchangeable. The physician must consider whether the information obtainable through the selected modality is adequate for the clinical question. MDTelemed may require escalation from asynchronous messaging to telephone, from telephone to video, or from any remote modality to in-person care.

39.1 Video Encounters

Video can provide clinically useful information concerning general appearance, speech, respiratory effort, movement, skin findings, affect, behavior, and other observable features. Video quality, lighting, camera angle, bandwidth, patient positioning, and device limitations can reduce reliability. The physician may ask the patient to reposition the camera, improve lighting, repeat a maneuver, or obtain in-person examination when visualization is inadequate.

39.2 Audio-Only Encounters

Audio-only care can be appropriate for selected clinical circumstances but removes visual information. The physician may determine that audio-only communication is insufficient when visual examination is material to diagnosis, risk assessment, medication decisions, or follow-up. A patient’s inability or preference not to use video does not require the physician to provide care through an inadequate modality.

39.3 Asynchronous Encounters

Asynchronous care relies on information supplied before the physician responds. The patient understands that the physician may need clarification, additional photographs or records, real-time communication, diagnostic testing, or in-person examination before completing an assessment. Asynchronous services must not be used for symptoms requiring immediate evaluation.

39.4 Secure Messaging

Secure messaging may support follow-up and appropriate clinical communication, but it is not continuously monitored and is not an emergency service. Patients should follow any response-time expectations communicated by MDTelemed and use emergency resources for urgent threats to life or safety.

40. SPECIAL CLINICAL SITUATIONS

Certain presentations require heightened caution in telemedicine. Examples may include severe or rapidly progressive symptoms, conditions requiring a hands-on examination, possible surgical emergencies, significant neurologic changes, high-risk pregnancy concerns, serious infection, acute psychiatric danger, suspected abuse, or circumstances in which the physician cannot obtain reliable history or examination information. The presence of one of these circumstances does not create a universal rule that telemedicine can never be used. Telemedicine may be used to recognize risk, provide interim guidance, or direct the patient to the correct level of care. However, the patient understands that remote evaluation may be only the first step and that delay in obtaining recommended in-person or emergency care can increase the risk of harm. When a patient is unable to communicate effectively because of age, cognitive impairment, language barrier, disability, intoxication, altered mental status, or another condition, MDTelemed may require an authorized representative, interpreter, auxiliary aid, caregiver, or in-person evaluation as appropriate and legally permitted.

41. CONSENT DOES NOT REPLACE ENCOUNTER-SPECIFIC INFORMED CONSENT

This document provides consent to the telemedicine method of delivering care. It does not replace informed consent that may be required for a particular medication, procedure, treatment, diagnostic intervention, psychiatric intervention, or other clinical decision. When a specific intervention requires additional disclosure or consent, the physician must address that intervention separately. Similarly, acceptance of this telehealth consent does not authorize disclosure of health information beyond what HIPAA, state law, a valid authorization, or another lawful basis permits. It does not authorize marketing uses of PHI, sale of PHI, research participation, or recording beyond the scope of a separate legally sufficient authorization or consent where one is required.

42. DOCUMENTATION OF CONSENT AND RECONSENT

MDTelemed should document the patient’s telehealth consent in a manner that can later demonstrate what the patient agreed to. The record should identify the consent version, date and time, patient or representative, method of consent, and any state-specific disclosure or acknowledgment required for the patient’s location. Reconsent should be obtained when required by state law or when a material change makes the prior consent inadequate—for example, a material change in recording practices, a new telehealth modality with different material risks, or a change in the legal requirements applicable to the service. MDTelemed should not repeatedly obtain consent merely for administrative convenience when applicable law does not require it, but should ensure that the operative consent remains current and documented. IMPORTANT: Telemedicine is medical care delivered through technology. It has benefits and limitations. This consent does not waive the physician’s professional duties, does not guarantee that telemedicine is appropriate for every condition, and does not authorize autonomous AI to diagnose or treat you. State-specific requirements may add to or modify this national consent. I have read or had explained to me the MDTelemed Telehealth Informed Consent. I understand the nature of telemedicine; its potential benefits, risks, and limitations; that MDTelemed is not emergency care; that a physician may require in-person evaluation or testing; that MDTelemed does not prescribe controlled substances; and that I may ask questions. I consent to receive telemedicine services from an MDTelemed MD, subject to applicable state law. I understand that any AI-assisted telescribing/audio processing is governed by a separate disclosure and consent and is not authorized solely by this telehealth consent.

50-STATE TELEHEALTH CONSENT AND DISCLOSURE ADDENDUM

1. MDTELEMED LLC

2. -STATE TELEHEALTH CONSENT & DISCLOSURE ADDENDUM

Version 1.0 | Effective September 15, 2026

IMPORTANT: This national addendum supplements, but does not replace, MDTelemed's general Telehealth Informed Consent, condition-specific informed consent, privacy notices, pediatric/minor consent procedures, behavioral-health consents, recording/AI telescribe consent, or any disclosure required by the law of the state where the patient is physically located. Telehealth law changes frequently. The treating physician must be legally authorized to practice in the patient's location and MDTelemed must apply the current jurisdiction-specific workflow at the time of care.

3. PURPOSE

MDTelemed intends to serve patients located throughout the United States. Telehealth consent, disclosure, identity, location, documentation, modality, prescribing, privacy, emergency, minor-consent, and professional-licensure rules are not uniform. This Addendum establishes a conservative national baseline and a state-routing framework.

4. PATIENT LOCATION CONTROLS LAW

For telemedicine, the patient's physical location at the time of the encounter is a central licensing and regulatory fact. A patient's home address, billing address, or state of residence does not substitute for the location where the patient is physically present during care.

5. LOCATION AT EVERY ENCOUNTER

MDTelemed requires the patient's current physical location at each encounter. The platform/physician should document the state and sufficient location information to support licensure and emergency response.

6. PHYSICIAN AUTHORITY

MDTelemed's clinical model uses MD physicians only. The physician must hold the license, registration, compact privilege, telemedicine authorization, or other lawful authority required to treat a patient physically located in the applicable jurisdiction.

7. PROVIDER IDENTITY

The patient should know the treating physician's identity and professional status. Where state law requires disclosure of license information, practice location, contact information, or board complaint information, the state workflow must present it.

8. TELEHEALTH MODALITIES

MDTelemed may use synchronous video, audio-only/telephone, asynchronous questionnaires/store-and-forward workflows, and secure messaging when clinically appropriate and legally permitted. A state's definition of telehealth may include or exclude particular technologies.

9. CONSENT BEFORE CARE

MDTelemed should obtain and document telehealth informed consent before nonemergency telehealth care when required by applicable law or MDTelemed policy. Consent may be electronic, written, or verbal only to the extent permitted by the controlling rule.

10. CONSENT CONTENT

The national consent should explain the nature of telehealth; anticipated benefits; material limitations and risks; reasonable alternatives including in-person care; privacy/security considerations; technology failure; emergency limitations; recordkeeping; patient choice; and how to discontinue telehealth.

11. STANDARD OF CARE

Telehealth does not reduce the physician's professional standard of care. The physician must determine whether the available modality permits an adequate evaluation and must escalate, refer, or require in-person/emergency care when it does not.

12. LIMITATIONS

Remote care may limit palpation, auscultation, direct visualization, neurologic/orthopedic examination, vital-sign verification, point-of-care testing, procedures, and other elements available in person. Patient-provided measurements or images can be incomplete or inaccurate.

13. TECHNOLOGY FAILURE

The patient should understand that audio/video interruption, device failure, bandwidth limitations, image quality, software failure, or communication delay may require conversion to another lawful modality, rescheduling, or in-person care.

14. PRIVACY

Telehealth can create privacy risks from people near the patient, shared devices, insecure networks, notification previews, speakers, cameras, and electronic transmission. MDTelemed will apply legally required safeguards but cannot control the patient's physical environment.

15. EMERGENCIES

MDTelemed is not a substitute for 911 or an emergency department when emergency evaluation is required. The physician may direct emergency services, emergency-department evaluation, crisis response, poison control, or another appropriate resource.

16. EMERGENCY PLAN

Because MDTelemed treats psychiatric and other potentially high-risk presentations, the physician should confirm sufficient location/contact information to activate local emergency assistance when clinically indicated.

17. PATIENT CHOICE

Where required and as a general principle, a patient may decline telehealth and seek in-person care. Refusing telehealth does not guarantee that MDTelemed can provide an in-person alternative because MDTelemed is an online service.

18. WITHDRAWAL

A patient may ask to stop a telehealth encounter. Withdrawal does not erase documentation already created, payment obligations already incurred, or actions already taken in reliance on consent.

19. QUESTIONS

Patients should have a meaningful opportunity to ask questions concerning telehealth and receive answers before proceeding.

20. DOCUMENTATION

The medical record should document consent in the manner required by the patient's state and MDTelemed policy, including the consent method and any state-specific disclosure or acknowledgment.

21. MINORS

For patients under 18, consent and confidentiality depend on the patient's state, service, emancipation status, mature-minor rules where recognized, and statutes allowing minors to consent to particular services. governs the state-specific minor architecture.

22. PARENT/GUARDIAN

When parental/guardian consent is legally required, MDTelemed should verify the representative's identity and authority. Parental access to the record is not automatically coextensive with authority to consent.

23. PSYCHIATRIC CARE

Telepsychiatry requires particular attention to privacy, suicidality, violence risk, psychosis, cognition, intoxication, access to emergency services, and whether remote care remains clinically appropriate.

24. CONTROLLED SUBSTANCES

MDTelemed's platform policy prohibits prescribing Schedule II-V controlled substances. This company restriction is more restrictive than some jurisdictions and avoids implying that a state-law telehealth allowance creates a right to receive a controlled medication.

25. NONCONTROLLED PRESCRIBING

Noncontrolled prescribing still requires a lawful physician-patient relationship, adequate evaluation, medical indication, contraindication review, documentation, and compliance with state and federal prescribing rules.

26. LABS / IMAGING

MDTelemed physicians may order laboratory tests, imaging, and other diagnostics when clinically appropriate and operationally available. Ordering creates follow-up responsibilities addressed in Policies 40 and 41.

27. AUDIO-ONLY

Audio-only care may be appropriate for some encounters but not others. MDTelemed will use audio-only only when permitted by applicable law and when the physician determines the modality can satisfy the standard of care.

28. ASYNCHRONOUS CARE

Asynchronous intake, questionnaires, images, or messages do not eliminate the requirement for an adequate evaluation. State law may restrict asynchronous prescribing or require additional interaction.

29. SECURE MESSAGING

Secure messaging can support care but may not be appropriate for urgent or emergency symptoms. Patients should not rely on asynchronous messages for emergencies.

30. AI TELESCRIBE

MDTelemed may use AI-assisted telescribing to support physician documentation. It does not replace the human MD, independently diagnose, or independently prescribe. Any audio capture/processing and recording consent requirements are addressed separately in .

31. RECORDING

Consent to telehealth is not automatically consent to record or retain audio/video. MDTelemed must obtain any separate consent required by federal or state recording/wiretap law and accurately disclose whether encounter audio is stored, transiently processed, or destroyed.

32. MEDICAL RECORDS

Telehealth encounters are documented as medical encounters. Patients may request records under and applicable law.

33. PAYMENT

MDTelemed is currently self-pay. Pricing is presented through MDTelemed's current website/checkout and may change. State consent or disclosure requirements concerning charges must be incorporated where applicable.

34. NO GUARANTEE

Telehealth consent is not a promise of diagnosis, treatment, prescription, laboratory/imaging order, referral, clinical outcome, or that telehealth will be appropriate for the presenting condition.

35. CLINICAL ESCALATION

A physician may end or limit a remote encounter and direct in-person or emergency evaluation when remote assessment is inadequate or patient safety requires escalation.

36. ACCESSIBILITY / LANGUAGE

Consent must be communicated in a manner the patient or lawful representative can understand. MDTelemed should provide disability accommodations and language assistance where legally required and operationally available.

37. STATE ROUTING

The platform should determine the patient's state before the physician encounter and display/record the current state-specific consent module. A static national checkbox alone is not sufficient where a state requires additional content, timing, form, or documentation.

38. STATE-BY-STATE TELEHEALTH ROUTING MATRIX — 50 STATES + DC

The entries below are deliberately conservative. A state entry that says 'verify' is not a claim that the state has no requirement; it means the production workflow must be validated against the current statute, medical-board rule, specialty rule, and service line immediately before launch.

39. ALABAMA

40. ALASKA

Apply Alaska physician licensure, telehealth, prescribing, records, privacy, and patient-relationship requirements. Verify current Alaska-specific consent/disclosure requirements before activation.

41. ARIZONA

Arizona law expressly requires the treating health care provider, before delivering health care through telehealth (subject to statutory exceptions), to obtain verbal or written informed consent, including electronically, from the patient or health-care decision maker. MDTelemed must document the consent and apply current exceptions and specialty rules.

42. ARKANSAS

Apply Arkansas telemedicine physician-patient-relationship, professional standard, consent, prescribing, and records requirements. Verify current Arkansas Medical Board rules before launch.

43. CALIFORNIA

California Business and Professions Code §2290.5 requires specified telehealth consent and documentation. MDTelemed's California workflow must use the current statutory consent method/content and document consent in the patient record. California-specific privacy and minor rules remain separate.

44. COLORADO

Apply Colorado Medical Board telehealth standards, professional licensure, informed-consent principles, prescribing, privacy, and records requirements. Verify any current board-specific disclosure language before activation.

45. CONNECTICUT

Apply Connecticut physician telehealth statutes and current consent, standard-of-care, prescribing, privacy, records, and consumer-health-data rules. Telehealth consent does not replace Connecticut consumer-health-data consent where separately required.

46. DELAWARE

Apply Delaware telemedicine physician standards and any current informed-consent, relationship, prescribing, documentation, and privacy requirements. Verify board regulations immediately before launch.

47. FLORIDA

Florida Statutes §456.47 defines telehealth to include synchronous and asynchronous technology and requires telehealth providers to practice consistently with scope and the prevailing professional standard for in-person care. MDTelemed must separately comply with Florida's current consent/disclosure requirements applicable to the service, specialty, prescribing, and any out-of-state telehealth registration.

48. GEORGIA

Apply Georgia Composite Medical Board telemedicine practice standards and current consent, identity, relationship, prescribing, record, and emergency requirements. Verify physician-specific consent language before activation.

49. HAWAII

Apply Hawaii telehealth statutes, physician licensing, relationship, informed-consent, prescribing, records, and privacy requirements. Verify whether current law requires particular consent documentation for the planned modality.

50. IDAHO

Apply Idaho Telehealth Access Act and physician-board requirements, including applicable provider-patient relationship, standard, consent/disclosure, prescribing, records, and privacy duties.

51. ILLINOIS

Apply Illinois telehealth and physician-practice laws, including current patient consent, professional standard, privacy, records, and prescribing requirements. Verify state-specific disclosures before launch.

52. INDIANA

Apply Indiana telehealth statutes governing provider-patient relationship, consent where applicable, prescribing, identity/location, documentation, and follow-up. Verify current physician-specific rules and any required certification/consent language.

53. IOWA

Apply Iowa Board of Medicine telemedicine rules and current consent, identity, relationship, prescribing, privacy, and documentation requirements.

54. KANSAS

Apply Kansas Telemedicine Act and Board of Healing Arts requirements. Verify current consent, professional disclosure, prescribing, records, and patient-choice provisions.

55. KENTUCKY

Apply Kentucky telehealth statutes and physician-board requirements. Kentucky law also recognizes real-time visual telehealth for certain statutory informed-consent settings. Service-specific consent requirements must be separately screened.

56. LOUISIANA

Apply Louisiana State Board of Medical Examiners telemedicine requirements, including current physician-patient relationship, consent, prescribing, identity, documentation, and referral/emergency provisions.

57. MAINE

Apply Maine telehealth and Board of Licensure in Medicine requirements, including applicable consent, privacy, records, prescribing, and standard-of-care rules.

58. MARYLAND

Apply Maryland telehealth statutes/regulations and Board of Physicians requirements. Verify consent requirements by modality and service, plus Maryland's separate sensitive/consumer-health-data privacy obligations.

59. MASSACHUSETTS

Apply Massachusetts physician, telehealth, privacy, records, prescribing, and informed-consent requirements. Verify current Board of Registration in Medicine guidance before launch.

60. MICHIGAN

Apply Michigan telehealth statutes, including current consent requirements, professional standards, prescribing, records, and patient-location/licensure rules. Configure documentation to match the current statute.

61. MINNESOTA

Apply Minnesota telehealth statutes and Board of Medical Practice requirements, including current consent, patient rights, standard, prescribing, records, and privacy rules.

62. MISSISSIPPI

Apply Mississippi State Board of Medical Licensure telemedicine regulations and current informed-consent, identity/location, relationship, prescribing, documentation, and emergency requirements.

63. MISSOURI

Apply Missouri telehealth statutes and Board of Registration for the Healing Arts requirements. Verify current consent, relationship, prescribing, records, and privacy requirements.

64. MONTANA

Apply Montana physician telemedicine, licensure, consent/informed-consent, prescribing, privacy, and records requirements; verify current board rules before activation.

65. NEBRASKA

Apply Nebraska Telehealth Act and physician requirements. Verify current telehealth consent, patient notice, relationship, prescribing, records, and modality rules before launch.

66. NEVADA

Apply Nevada telehealth law, physician licensing, medical-record/privacy, consent, and specialty-specific requirements. Nevada law includes telehealth definitions and other programs with express location/identity/consent protocols; MDTelemed should not extrapolate specialty rules beyond their scope. Patient location and consent remain documented under MDTelemed's baseline.

67. NEW HAMPSHIRE

Apply New Hampshire telemedicine physician practice, licensure, prescribing, privacy, records, and consent requirements. Verify current Board of Medicine rules and statutes before activation.

68. NEW JERSEY

Apply New Jersey telemedicine/telehealth law, including provider-patient relationship, identity, consent where applicable, standard of care, records, prescribing, and referral/follow-up requirements.

69. NEW MEXICO

Apply New Mexico Medical Board telemedicine requirements and current consent, licensure, prescribing, privacy, documentation, and emergency provisions.

70. NEW YORK

Apply New York telehealth law and Department of Health/Office of the Professions requirements, including applicable informed consent, patient rights, licensure, privacy, prescribing, and recordkeeping. Behavioral-health requirements must be separately screened.

71. NORTH CAROLINA

Apply North Carolina Medical Board telemedicine position/rules and general informed-consent, prescribing, standard-of-care, records, and privacy law. Verify current binding requirements before activation.

72. NORTH DAKOTA

Apply North Dakota Board of Medicine telemedicine requirements, including current relationship, consent/disclosure, prescribing, records, privacy, and emergency standards.

73. OHIO

Ohio physician telehealth rules require the professional to verify patient identity and physical location, communicate identity/licensure information for a previously untreated patient, document telehealth consent, perform an appropriate evaluation, document diagnosis/treatment/referrals, and provide appropriate follow-up. MDTelemed's Ohio workflow should mirror current OAC Chapter 4731-37.

74. OKLAHOMA

Apply Oklahoma physician telemedicine statutes/rules and current consent, identity, relationship, prescribing, records, privacy, and follow-up requirements. Verify current Medical Board rules before launch.

75. OREGON

Apply Oregon Medical Board telemedicine standards, patient relationship, informed-consent principles, prescribing, records, privacy, and state health/privacy requirements. Precise location data also receives separate privacy protection.

76. PENNSYLVANIA

Apply Pennsylvania's current telemedicine statutes/regulations and State Board of Medicine requirements, including consent/disclosure, standard-of-care, prescribing, privacy, and records requirements. Verify current effective provisions immediately before launch.

77. RHODE ISLAND

Apply Rhode Island telemedicine statutes and physician regulations, including current consent, identity, relationship, prescribing, privacy, and documentation requirements.

78. SOUTH CAROLINA

Apply South Carolina telemedicine statutes and Board of Medical Examiners requirements, including current relationship, consent/disclosure, prescribing, record, privacy, and standard-of-care rules.

79. SOUTH DAKOTA

Apply South Dakota telehealth/physician requirements and current consent, relationship, prescribing, documentation, privacy, and emergency rules.

80. TENNESSEE

Apply Tennessee telehealth statutes and Board of Medical Examiners requirements, including current consent, patient relationship, prescribing, privacy, records, and standard-of-care obligations.

81. TEXAS

Apply Texas telemedicine statutes, Texas Medical Board rules, and current disclosure/consent, relationship, prescribing, privacy, records, and follow-up requirements. Texas also has separate consumer privacy and sensitive-data requirements.

82. UTAH

Apply Utah telehealth statutes and physician requirements, including current consent, professional standard, prescribing, records, privacy, and modality rules.

83. VERMONT

Apply Vermont telehealth statutes, Board of Medical Practice requirements, and current informed-consent, privacy, prescribing, records, and patient-choice requirements.

84. VIRGINIA

Apply Virginia telemedicine statutes, Board of Medicine guidance/rules, informed-consent principles, prescribing, privacy, records, and continuity requirements.

85. WASHINGTON

Apply Washington physician telemedicine, Uniform Disciplinary Act, professional standard, prescribing, records, privacy, and patient-consent requirements. Separately apply My Health My Data to consumer health data when within scope.

86. WEST VIRGINIA

Apply West Virginia telehealth statutes and Board of Medicine requirements, including current provider-patient relationship, consent/disclosure, prescribing, documentation, privacy, and emergency requirements.

87. WISCONSIN

Apply Wisconsin Medical Examining Board and statutory telehealth requirements, including applicable informed consent, prescribing, records, privacy, and standard-of-care requirements.

88. WYOMING

Apply Wyoming Board of Medicine telemedicine requirements, including current relationship, consent/disclosure, prescribing, records, privacy, and emergency provisions.

89. DISTRICT OF COLUMBIA

Apply District of Columbia physician licensure, telehealth, consent, prescribing, privacy, records, and behavioral-health requirements. Verify current DC Health rules before activation.

90. U.S. TERRITORIES — SEPARATE ACTIVATION REVIEW

MDTelemed's present instruction is nationwide U.S. launch. If Puerto Rico, Guam, U.S. Virgin Islands, Northern Mariana Islands, or American Samoa are activated, each must receive a separate licensure, telehealth, consent, prescribing, privacy, records, language, and professional-entity review. 'All 50 states' does not automatically authorize practice in a territory.

91. CONDITION / SERVICE-SPECIFIC CONSENTS

General telehealth consent does not replace informed consent for a particular procedure, medication, test, treatment, psychiatric intervention, or other service when separate informed consent is required. Behavioral-health care may trigger additional consent, crisis, confidentiality, and minor-access requirements. Reproductive/sexual-health services may trigger additional minor-consent and confidentiality rules. Audio capture or recording for AI telescribing requires separate recording-law analysis. Research, experimental therapy, investigational products, genetic testing, HIV testing, and other specialized services may require separate consent under applicable law. Build a current 50-state + DC physician-specific telehealth law matrix using statutes, medical-board regulations, and binding guidance; do not rely solely on secondary surveys. For each state, record whether telehealth consent is mandatory; timing; oral/written/electronic form; required content; one-time versus recurring consent; signature requirements; documentation; exceptions; and whether audio-only/asynchronous modalities change the rule. Map patient identity and physical-location verification requirements by state. Map physician identity, license number, practice address, contact, board-complaint, and other professional disclosures by state. Map physician-patient relationship requirements and any initial synchronous/video requirements. Map noncontrolled prescribing requirements by state and medication/service line. Map audio-only and asynchronous restrictions by state and clinical service. Map psychiatric/behavioral-health telehealth consent, crisis planning, and modality rules separately from general medicine. Map pediatric/minor consent and confidentiality separately under . Map state recording/wiretap consent under after the AI telescribe's actual audio architecture is verified. Build state-specific consent modules rather than one static nationwide checkbox where requirements differ. Log consent version, state, patient location, modality, timestamp, signer, authority, physician, and required state disclosures. Ensure consent can be withdrawn prospectively and document withdrawal. Create a technology-failure protocol that preserves patient safety and state compliance. Create emergency escalation workflows tied to the patient's verified location. Verify every physician's authority to practice in the patient's state before encounter assignment. Block encounter initiation if patient location changes to a jurisdiction where the assigned physician lacks authority. Verify state requirements for forwarding records, primary-care coordination, referral, and follow-up. Verify state-specific patient billing/fee consent requirements, including Ohio's telehealth billing-consent rule where applicable. Have 50-state telehealth counsel approve the production matrix and each state consent module before national activation; establish quarterly and event-driven legal updates.

92. PRIMARY AUTHORITIES / RESEARCH ANCHORS

Arizona Revised Statutes §36-3602 — delivery of health care through telehealth; informed consent. California Business and Professions Code §2290.5 — telehealth; consent and documentation. Florida Statutes §456.47 — use of telehealth to provide services; definitions and practice standards. Ohio Administrative Code Chapter 4731-37, including Rule 4731-37-01 — telehealth services by physicians and other covered professionals. Ohio Revised Code §4743.09 — telehealth services, including consent and billing-related provisions. Kentucky Revised Statutes §311.724 — recognition of real-time visual telehealth in specified informed-consent settings. Nevada Revised Statutes Chapters 629 and 630 — health records/telehealth definitions and physician practice; Nevada specialty/program rules must be applied only within their scope. Federation of State Medical Boards, telemedicine policy resources — secondary cross-check only; controlling state statutes and board rules govern. Center for Connected Health Policy, State Telehealth Laws and Reimbursement Policies — secondary research aid only; not a substitute for controlling law. Applicable state medical practice acts, medical-board regulations, telehealth statutes, informed-consent laws, minor-consent statutes, privacy laws, prescribing laws, and recording/wiretap statutes as amended.

93. RELATED MDTelemed POLICIES

Patient Bill of Rights & Responsibilities; Telehealth Informed Consent; Pediatric Care & Minor Rights; Behavioral Health; Medical Records Access; Emergency & Crisis Response; Nondiscrimination, Disability Accessibility & Language Access; HIPAA Notice of Privacy Practices; Consumer Health Data Privacy; State Privacy Rights Supplement; Minor Consent & Confidentiality Addendum; AI Telescribe, Audio Capture & Documentation Consent; Patient Identity Verification & Physical Location; Laboratory, Imaging & Diagnostic Testing; Test Results, Abnormal Results & Follow-Up.

94. END OF

PATIENT IDENTITY - PHYSICAL LOCATION - EMERGENCY CONTACT VERIFICATION

Patient Identity / Physical Location / Emergency Contact Verification

Version 1.0 | Effective September 16, 2026

1. Policy Statement

MDTelemed adopts this policy to establish a consistent, patient-centered and legally compliant framework for patient identity / physical location / emergency contact verification. This policy must be implemented together with applicable federal law, the law of the patient's physical location, professional standards, and MDTelemed's other clinical and privacy policies.

2. Purpose

Every telemedicine encounter must begin with sufficient verification of patient identity and current physical location to support licensure, emergency response, prescribing, and continuity of care.

3. Minimum Verification

The clinician or platform should verify at least two appropriate identifiers, the patient's current state/location, and a callback method. When clinically appropriate, an emergency contact may also be confirmed.

4. Location Controls

Care must not proceed when the clinician is not authorized to practice where the patient is physically located, unless a lawful exception applies and is documented.

5. Emergency Readiness

For higher-risk presentations, the clinician should identify the nearest appropriate emergency resource or confirm the patient's ability to call 911/local emergency services.

6. Mismatch / Fraud

Material identity discrepancies, suspected impersonation, account sharing, or inability to establish who or where the patient is may require pausing or terminating the encounter.

7. Roles and Responsibilities

MDTelemed management is responsible for operational implementation and periodic review. Clinicians remain responsible for independent professional judgment and documentation. Workforce members must follow role-based access, confidentiality, escalation, and incident-reporting requirements. Material conflicts between this policy and controlling law must be escalated to compliance/legal review before the affected workflow is used.

8. Training and Monitoring

Affected personnel should receive role-appropriate training. MDTelemed may audit compliance, investigate deviations, and implement corrective action when needed.

9. Exceptions

No exception may waive a mandatory legal or patient-safety requirement. Operational exceptions should be documented and approved by an authorized leader when appropriate.

10. Primary Regulatory / Guidance References

U.S. Department of Health and Human Services, HIPAA Privacy, Security and Breach Notification Rules, 45 C.F.R. Parts 160 and 164. HHS Telehealth guidance regarding HIPAA and remote communication technologies. Applicable state medical-practice, telehealth, privacy, recording, consumer-protection and professional-licensure laws.

PATIENT FACING SCOPE OF SERVICES CONDITIONS WE DO DO NOT TREAT

1. SCOPE OF SERVICES & CONDITIONS WE DO / DO NOT TREAT

Version 2.0 | Effective September 27, 2026 | :

2. Purpose

This patient-facing policy explains what MDTelemed may provide through telemedicine, what may require in-person or higher-level care, and what patients should understand before purchasing an encounter. Telemedicine appropriateness is determined case by case by the treating physician and applicable law.

3. What MDTelemed Provides

Within the physician's licensure, clinical judgment, applicable law, available modality, and MDTelemed's approved service lines, an encounter may include: medical history and symptom evaluation; telemedicine-appropriate examination and assessment; diagnosis or differential diagnosis when clinically supportable; medical advice, counseling, education, treatment planning, and follow-up; non-controlled prescribing when clinically appropriate and legally permitted; laboratory or diagnostic testing recommendations/orders when appropriate; referral, care coordination, specialist follow-up, or in-person evaluation; urgent or emergency escalation when the presentation requires a higher level of care.

4. What MDTelemed Does Not Guarantee

MDTelemed does not guarantee a prescription, antibiotic, antiviral, refill, controlled substance, specific medication, diagnosis, test, imaging study, referral, work note, medical certification, or any other patient-requested outcome. A physician encounter is an evaluation and professional medical service—not a purchase of a prescription.

5. Conditions or Requests Outside MDTelemed Scope

MDTelemed may decline, stop, or redirect care when the requested service is prohibited by company policy, cannot legally be provided to a patient in the patient's current location, requires a hands-on examination or testing that cannot be adequately obtained remotely, requires emergency or urgent in-person care, or otherwise cannot be safely managed through telemedicine. MDTelemed does not prescribe controlled substances through the service. Other exclusions or limitations may apply to specific medications, procedures, certifications, emergencies, high-risk presentations, or jurisdiction-specific services.

6. When Telemedicine Is Not Enough

The treating physician may determine that remote evaluation is insufficient. The physician may direct the patient to emergency services, an emergency department, urgent care, primary care, a specialist, laboratory testing, imaging, or another in-person setting. Referral or escalation is a clinical disposition and may itself be the medically appropriate result of the telemedicine evaluation.

7. Emergency Conditions

MDTelemed is not a substitute for 911 or emergency medical services. A patient with a medical or psychiatric emergency should call 911 or the applicable local emergency number or go to the nearest emergency department rather than wait for an MDTelemed encounter.

8. Prescribing Boundaries

Prescribing is never guaranteed. A physician prescribes only when the medication is clinically appropriate, the evaluation is sufficient, the medication is within MDTelemed's permitted formulary/scope, and prescribing is lawful in the patient's location. MDTelemed physicians do not prescribe controlled substances through MDTelemed.

9. Patient Pharmacy Choice

The patient remains free to choose the pharmacy the patient wishes to use, subject to the pharmacy's ability and legal authority to dispense the prescription and other applicable restrictions. MDTelemed does not condition clinical care on use of a particular pharmacy and does not permit physician compensation to depend on pharmacy selection or prescription volume.

10. Patient Responsibility Before the Encounter

Patients should review MDTelemed's patient-facing scope, prescribing, controlled-substance, emergency-care, pharmacy-choice, payment/refund, membership, and other applicable policies before purchasing or beginning an encounter. I understand that MDTelemed provides physician evaluation and medical judgment and does not guarantee that my requested medication, test, diagnosis, document, referral, or other requested outcome will be provided.

11. Relationship to State and Territory Law

This national policy applies across MDTelemed's operations but is supplemented by state, District of Columbia, and U.S. territorial requirements based on the patient's physical location. A stricter jurisdiction-specific rule, professional standard, prescribing limitation, modality requirement, consent rule, or service restriction controls when applicable.

PEDIATRIC CARE - PARENT-GUARDIAN CONSENT - MINOR RIGHTS

1. MDTELEMED LLC

2. PEDIATRIC CARE, PARENT/GUARDIAN CONSENT & MINOR RIGHTS

Version 1.0 | September 15, 2026

National patient-facing baseline for patients under the applicable age of majority. State-specific minor-consent, confidentiality, custody, guardianship, mandatory-reporting, and telehealth rules control where they differ.

3. PURPOSE AND SCOPE

MDTelemed LLC provides telemedicine services to patients of all ages, including newborns, infants, children, and adolescents. Pediatric telemedicine requires more than simply obtaining a parent's signature. The treating physician must consider who has legal authority to consent, whether the minor may consent independently under applicable law, the child's developmental capacity, confidentiality, parental access to records, custody and guardianship, the adequacy of remote examination, medication safety, emergency escalation, and mandatory reporting. This Policy is a national baseline. It must be read with Telehealth Informed Consent, Prescribing & Medication Safety, Behavioral Health, Emergency/Urgent Care, HIPAA Notice of Privacy Practices, and 50-State Minor Consent & Confidentiality Addendum.

4. CORRECTIONS TO THE ORIGINAL PEDIATRIC POLICY

The original created fixed age bands: ages 0-4 required a parent present; ages 5-12 were parent-controlled; ages 13-17 could create their own account with parental consent; and age 18+ was treated as adult. It also stated that a parent must provide a Social Security number and made categorical statements that foster parents, state representatives, or facility administrators could consent. Those concepts are too rigid for nationwide use. Legal authority to consent is not determined solely by an MDTelemed age band. State law, court orders, custody documents, emancipation, the specific service, and the person's legal authority matter. Version 1.0 therefore removes a universal parental Social Security number requirement and does not assume that every foster parent, facility administrator, stepparent, grandparent, or caregiver automatically has authority to consent.

5. GENERAL RULE: WHO CONSENTS FOR A MINOR

In most nonemergency circumstances, a parent, legal guardian, or other legally authorized representative provides permission for medical care for a minor who cannot legally consent independently. The exact age of majority and exceptions are governed by state or other applicable law. HIPAA does not itself determine whether a minor can consent to treatment. State or other law determines treatment-consent authority. HIPAA generally treats a parent or other legally authorized decision-maker as the minor's personal representative, subject to important exceptions. MDTelemed may verify identity and legal authority before nonurgent care. A biological relationship alone does not always establish current legal authority. A noncustodial parent may or may not have authority depending on state law and custody orders. A caregiver's physical presence with the child does not automatically create legal authority to consent.

6. PATIENT IDENTITY AND CHILD IDENTITY

MDTelemed should verify the identity of the pediatric patient and the identity of the person providing consent using the verified identity process implemented by the platform. The company should collect only information reasonably necessary for identity and authority verification. The original policy's requirement that a parent provide a Social Security number is not carried forward. MDTelemed should not collect a parent's or child's Social Security number merely because the patient is a minor unless a specific verified business or legal need exists and the privacy/security implications have been evaluated.

7. VERIFYING PARENTAL OR GUARDIAN AUTHORITY

MDTelemed may ask the consenting adult to identify the relationship to the child and attest that the person has legal authority to consent. When circumstances create uncertainty, MDTelemed may request supporting documentation before providing nonurgent treatment. Potential documents can include a birth certificate, guardianship order, custody order, power of attorney for health care, caregiver authorization, foster-care documentation, or other legally sufficient documentation. The required document depends on applicable law and circumstances. MDTelemed should not demand documentation in every routine encounter if identity and authority can reasonably be established through a lawful workflow, but should escalate ambiguous or contested authority.

8. CONSENT BY PROXY

A parent or guardian may sometimes authorize another adult to bring or assist a child in obtaining nonurgent care. Whether proxy consent is valid, who may serve as proxy, what services the proxy may authorize, how delegation must be documented, and how long it remains valid vary by state. American Academy of Pediatrics guidance emphasizes verifying and documenting proxy authority for nonurgent pediatric care. MDTelemed therefore will not assume that a grandparent, stepparent, sibling, babysitter, teacher, coach, or other caregiver automatically has authority. If valid consent cannot be established and the condition is nonurgent, the physician may defer testing or treatment until a legally authorized decision-maker is available.

9. PEDIATRIC ASSENT

Legal consent and pediatric assent are different. When developmentally appropriate, the physician should explain the encounter and proposed care in language the child can understand and should seek the child's participation and assent. AAP policy describes parental permission and childhood assent as an active process that increasingly includes the child as developmental capacity matures. A young child may be able to express preferences even though the child cannot legally consent. A child's objection does not always control when a legally authorized adult has consented, particularly when necessary care is involved. Conversely, coercion should not substitute for age-appropriate communication and respect.

10. ADOLESCENT PARTICIPATION

Adolescents should be encouraged to participate directly in their medical care. Depending on the issue, the physician may ask to speak privately with the adolescent for part of the encounter, consistent with state law and clinical appropriateness. Private adolescent discussion can improve disclosure about mood, safety, sexual health, substance use, abuse, relationships, and other sensitive matters. It does not automatically mean that all information from the private discussion is legally confidential from a parent. The physician should explain the limits of confidentiality, including circumstances involving serious safety concerns, abuse/neglect reporting, or other disclosures required or permitted by law.

11. MINOR SELF-CONSENT

State laws create exceptions in which a minor may consent to specified health services without parental permission. The permitted services, minimum ages, conditions, documentation, and parental-notification rules vary. Examples can include some services related to sexually transmitted infections, contraception, pregnancy, sexual assault, mental health, substance-use care, and other categories. This list is illustrative, not a national rule. As of August 2026, all 50 states and Washington, DC allow minors to consent to STI testing and treatment in at least some circumstances, but age thresholds and parental-disclosure rules vary. MDTelemed must apply the patient's jurisdiction-specific rule rather than a single nationwide adolescent-consent rule.

12. EMANCIPATED MINORS

An emancipated minor may have authority to consent to the minor's own health care under applicable law. Emancipation can arise through court order or other circumstances recognized by state law. MDTelemed may request documentation or other reasonable verification when emancipation is relied upon. It should not assume that marriage, pregnancy, military service, living independently, parenthood, or financial independence creates identical emancipation status in every state. Under HIPAA, an emancipated minor's personal representative is treated according to the scope of authority granted under applicable law.

13. MATURE-MINOR DOCTRINES

Some jurisdictions recognize a mature-minor doctrine or other circumstances allowing certain minors to consent to care based on age, maturity, treatment type, or judicial/common-law rules. These doctrines are state-specific and should not be converted into a general MDTelemed rule. When a minor seeks care without parental permission under a mature-minor theory, the physician should follow the state-specific compliance pathway before nonemergency treatment.

14. EMERGENCY CARE AND ABSENT CONSENT

Telemedicine is not a substitute for emergency services. If a pediatric patient appears to require emergency evaluation, the physician should direct the family to 911, an emergency department, or other appropriate emergency resource. Emergency treatment law can permit necessary care without prior parental consent in circumstances where delay would endanger the child. Because MDTelemed itself is remote, the primary role will often be recognition and immediate escalation rather than attempting to manage the emergency online. Lack of an available parent should not cause dangerous delay in directing a child to emergency services.

15. CUSTODY, DIVORCE, AND SEPARATED PARENTS

Custody arrangements can affect authority to consent and access records. MDTelemed should not assume that physical custody, legal custody, and medical decision-making authority are identical. A parent may be asked whether a custody order limits medical decision-making. When a dispute becomes apparent, MDTelemed may request the relevant portion of a court order. MDTelemed personnel should not interpret ambiguous family-law orders beyond their role; uncertain cases should be escalated. A parent should not use the platform to circumvent a known custody restriction. If parents disagree about nonurgent treatment and the physician cannot determine who has controlling authority, the physician may defer treatment while preserving appropriate urgent/emergency escalation.

16. FOSTER CARE AND STATE CUSTODY

The original policy stated that a foster parent can consent and that a state child-protective-services representative consents for wards of the state. These statements are too categorical. Authority for children in foster care or state custody varies by jurisdiction, placement type, court order, service, and treatment. A foster parent may have authority for routine care in some circumstances but not necessarily for every medication, procedure, psychiatric intervention, reproductive-health service, or other treatment. MDTelemed should verify the applicable authorization and document the basis for consent.

17. GRANDPARENTS, STEPPARENTS, RELATIVES, AND CAREGIVERS

Grandparents, stepparents, adult siblings, relatives, nannies, and other caregivers may be deeply involved in a child's care but do not automatically possess medical decision-making authority. Where state law recognizes caregiver affidavits, delegated authority, powers of attorney, or statutory proxy hierarchies, MDTelemed may rely on them after reasonable verification. If a caregiver is present but cannot consent, the caregiver may still provide history or assist the child when permitted, while MDTelemed obtains consent from the legally authorized person.

18. PEDIATRIC TELEMEDICINE EXAMINATION LIMITATIONS

Children can deteriorate quickly, and remote examination may be more difficult in infants and young children who cannot reliably describe symptoms or cooperate with examination maneuvers. The physician should consider whether telemedicine provides sufficient information for the clinical question. Age alone does not determine suitability. Video may be required when visual assessment is clinically important. The physician may need current weight, temperature, respiratory rate, heart rate, oxygen saturation, or other measurements. Otoscopic, abdominal, neurologic, musculoskeletal, genital, ophthalmic, or other direct examination may require in-person care. A photograph is not equivalent to a complete examination. The physician may stop the telemedicine evaluation and direct in-person assessment whenever remote information is inadequate.

19. INFANTS AND YOUNG CHILDREN

For infants and young children, the adult's observations are important but do not replace objective assessment when it is clinically necessary. Feeding, urine output, activity, consolability, breathing pattern, fever, hydration, rash characteristics, and other observations may be clinically relevant. A lower threshold for in-person or emergency evaluation may be appropriate for very young infants, especially with fever, respiratory difficulty, lethargy, dehydration, abnormal behavior, or other potentially serious symptoms. This Policy intentionally avoids a universal age cutoff for telemedicine treatment because appropriateness depends on the condition, age, clinical risk, available data, and physician judgment.

20. PEDIATRIC MEDICATION SAFETY

Pediatric prescribing must account for medication indication, age, weight when relevant, allergies, formulation, renal/hepatic considerations, interactions, and caregiver ability to administer the medication safely. MDTelemed may require a current measured weight before prescribing a weight-based medication. The physician may decline treatment if the available weight is unreliable and dosing safety depends on it. Caregivers should use an appropriate dosing device and follow the prescription label. Household spoons should not be assumed to provide accurate medication measurement.

21. ANTIBIOTICS AND PEDIATRIC INFECTIONS

Antibiotics should not be prescribed solely because a caregiver expects them. Some common pediatric complaints require examination or testing before bacterial infection can be reasonably established. The physician may recommend throat testing, urinalysis/culture, otoscopic examination, chest evaluation, or other testing rather than empirical antibiotics. When an antibiotic is appropriate, dose and duration should be individualized to the infection and patient.

22. PEDIATRIC PSYCHIATRIC CARE

MDTelemed may provide psychiatric care to minors when legally and clinically appropriate. Consent authority, minor self-consent, parental involvement, confidentiality, medication management, and record access may differ by state and by type of mental-health service. The physician should assess safety, including suicidal or homicidal risk when clinically indicated. Imminent danger requires emergency/crisis escalation. MDTelemed does not prescribe controlled substances, including controlled stimulants and benzodiazepines, through its service.

23. SEXUAL AND REPRODUCTIVE HEALTH

Adolescent sexual and reproductive health requires jurisdiction-specific consent and confidentiality rules. Services can include STI testing/treatment, contraception, pregnancy-related care, sexual-assault care, and other sensitive services. The fact that a minor may legally consent to a service does not automatically answer whether a parent may receive information about it. Consent authority and information-access rights must be analyzed separately under state law and HIPAA. MDTelemed's patient portal, notifications, billing communications, pharmacy communications, and records-release processes must be designed to avoid accidental disclosure of legally protected confidential minor services.

24. SUBSTANCE-USE-RELATED CARE

Minor consent to substance-use-related services varies by state. MDTelemed does not offer buprenorphine/OUD prescribing at launch.

25. C.F.R. Part 2 applies only when its program and record requirements are met; it should not be assumed to cover every discussion of substance use in general medical or psychiatric care.

Where specialized confidentiality rules apply, MDTelemed will follow them in addition to HIPAA and state law.

26. PARENTAL ACCESS TO PEDIATRIC RECORDS

HIPAA generally permits a parent who is the minor's personal representative to access the child's medical information when access is consistent with state and other law. There are important exceptions. Under HIPAA, a parent is generally not the personal representative for information related to care when the minor lawfully consented without parental consent; when care was obtained at the direction of a court or court-authorized person; or when the parent agreed to a confidential relationship between the minor and provider. Even within those exceptions, state law can require, permit, or prohibit parental access. If state law is silent, HIPAA can permit a licensed professional to exercise professional judgment in certain circumstances. Therefore MDTelemed will not promise parents unrestricted access to every part of an adolescent's record.

27. ABUSE, NEGLECT, DOMESTIC VIOLENCE, AND ENDANGERMENT

HIPAA permits a covered entity in specified circumstances not to treat a personal representative as the individual when the provider reasonably believes the patient has been or may be subjected to abuse, neglect, or domestic violence by that representative, or that treating the person as the representative could endanger the patient, and professional judgment supports that decision. Physicians are also subject to state mandatory-reporting laws. Reporting thresholds, agencies, timing, and covered professionals vary by jurisdiction. MDTelemed should never promise absolute confidentiality when mandatory reporting or immediate safety intervention may apply.

28. PRIVATE COMMUNICATION WITH ADOLESCENTS

Where appropriate, a physician may request a portion of the visit alone with the adolescent. The physician should explain this as a routine component of adolescent care rather than as evidence of mistrust toward the parent. Before private discussion, the physician should explain confidentiality and its limits in developmentally appropriate language. If privacy cannot be achieved remotely, the physician should consider whether the sensitive service can be safely and lawfully completed.

29. PORTAL ACCOUNTS AND ELECTRONIC COMMUNICATION

Pediatric portal architecture must distinguish the child's information from the parent or proxy's access rights. A single unrestricted family login can create confidentiality problems when adolescents have legally protected services. AAP guidance on electronic pediatric communication recommends policies addressing patient/guardian consent, privacy, access rights, and the changing needs of patients as they mature. MDTelemed should implement age- and law-sensitive proxy access rather than automatically giving a parent permanent unrestricted access to an adolescent account.

30. TEXT, EMAIL, AND NOTIFICATION PRIVACY

Appointment reminders, prescription notices, test-result alerts, billing messages, and marketing communications can inadvertently disclose sensitive pediatric information. MDTelemed should minimize sensitive content in notifications and use verified communication preferences. Where a minor has a legally confidential service, the communication pathway should be reviewed to prevent unauthorized disclosure. Promotional messages require separate marketing compliance and should not reveal diagnoses or sensitive services.

31. LABORATORY, IMAGING, AND DIAGNOSTIC TESTING

MDTelemed physicians may order pediatric laboratory tests, imaging, ECG, and other diagnostics when clinically appropriate. A parent, guardian, or minor who legally consents to the underlying service should be informed about why testing is recommended and how results will be followed. Testing facilities may have their own rules regarding consent, identification, accompaniment, and release of results for minors.

32. ABNORMAL RESULTS AND FOLLOW-UP

Clinically significant pediatric results require appropriate follow-up. MDTelemed should have workflows for urgent and critical results, unsuccessful contact attempts, escalation, and documentation. Parents, guardians, or independently consenting minors should keep contact information current and respond to important clinical communications.

33. IMMUNIZATIONS

If MDTelemed provides vaccine counseling, the physician may discuss recommended immunizations, contraindications, and referral to an in-person vaccine provider. MDTelemed should not represent that it administers vaccines remotely. Consent rules for vaccination can be state- and vaccine-specific. The national policy does not assume a minor can self-consent to vaccination in every jurisdiction.

34. SCHOOL, SPORTS, CAMP, AND OTHER FORMS

A telemedicine physician may decline to complete a school, sports, camp, disability, or other certification when the physician lacks sufficient information or when an in-person examination is required. Payment for an encounter does not guarantee completion of a requested form.

35. CHRONIC DISEASE AND SPECIALTY COORDINATION

Children with complex chronic disease may require coordination with a pediatrician, subspecialist, hospital system, therapist, school, home-health service, or other care team. MDTelemed may provide appropriate telemedicine support but should not fragment care when the child's condition requires longitudinal or multidisciplinary management.

36. CHILDREN WITH DISABILITIES AND COMMUNICATION NEEDS

Children with hearing, vision, developmental, cognitive, speech, or other disabilities may require reasonable accommodations, auxiliary aids, additional time, caregiver assistance, or alternative communication methods as required by applicable law. The child's disability should not be treated as a reason to exclude the child from telemedicine when reasonable accommodations can make care appropriate; conversely, telemedicine should not be forced when the modality remains clinically inadequate.

37. PATIENT LOCATION

The child's physical location must be accurately identified at the encounter. The physician must be legally authorized to provide care where the patient is located, subject to applicable law. A family traveling across state lines should not assume that a physician who treated the child previously can automatically provide another telemedicine visit from the new state.

38. RECORDING AND AI TELEscribing

MDTelemed may use AI-assisted telescribing to assist the human MD in documenting the encounter. Any audio capture, recording, transcript retention, or processing must be accurately disclosed in the separate AI Telescribe consent. For minors, the person legally authorized to consent to recording or audio processing may depend on state law and the service. Where the minor independently controls the care or related information, MDTelemed must account for that status. Telehealth consent alone is not treated as blanket authorization for recording.

39. REFUSAL OF CARE BY PARENT OR MINOR

A parent or authorized decision-maker may generally refuse recommended nonemergency treatment, subject to laws protecting children from medical neglect and other exceptions. A physician should explain material risks of refusal and document the discussion. When refusal creates a serious risk of harm to the child, mandatory-reporting, emergency, or other legal obligations may arise. An adolescent's refusal should be taken seriously even when the parent has legal authority, and the physician should seek developmentally appropriate agreement when possible.

40. DISAGREEMENT BETWEEN CHILD AND PARENT

Pediatric decision-making can involve disagreement. The physician should clarify the medical issue, risks, alternatives, legal authority, and the child's maturity and preferences. Nonurgent care may sometimes be deferred to permit further discussion. Urgent threats to health or safety may require a different response under applicable law.

41. FINANCIAL RESPONSIBILITY

MDTelemed is currently self-pay. The person authorizing payment may be different from the person who legally controls confidential health information. Payment responsibility does not automatically create a right to access every part of the minor's medical record. MDTelemed should separate financial access from clinical-record access where required.

42. TRANSITION TO ADULT STATUS

When a patient reaches the applicable age of majority, the patient generally assumes control of the patient's HIPAA rights and medical decision-making unless another legal arrangement applies. MDTelemed should transition portal access, authorizations, proxy permissions, communication preferences, and consent documents accordingly rather than allowing parental proxy access to continue automatically.

43. PATIENT AND FAMILY RESPONSIBILITIES

Provide truthful information about the child's identity, age, physical location, symptoms, history, medications, allergies, and legal decision-maker. Disclose custody, guardianship, foster-care, emancipation, or other legal circumstances that may affect consent. Provide requested documentation when authority is reasonably uncertain. Use accurate weight and other measurements when required for safe treatment. Follow testing, medication, follow-up, in-person, and emergency recommendations. Maintain current contact information. Respect adolescent privacy when the physician requests a lawful private discussion. Do not use another person's account or misrepresent authority to consent. Tell the physician if the child is worsening or cannot safely participate by telemedicine.

44. MDTelemed RESPONSIBILITIES

Use a consent process appropriate to the patient's jurisdiction and service. Verify identity and authority to a reasonable degree before nonurgent treatment. Seek pediatric assent when developmentally appropriate. Protect legally confidential minor information. Apply a lower threshold for escalation when remote examination is inadequate or risk is high. Use pediatric medication safeguards. Maintain mandatory-reporting and emergency escalation procedures. Design portal/proxy access to account for adolescent confidentiality. Document the identity and relationship of the consenting person and relevant legal basis when appropriate. Maintain a current 50-state minor-consent and confidentiality matrix.

45. STATE-SPECIFIC ADDENDUM

Because minor consent and confidentiality law varies substantially, MDTelemed will maintain 50-State Minor Consent & Confidentiality Addendum. The addendum should address, at minimum, age of majority, emancipation, mature-minor rules, STI care, contraception, pregnancy-related care, sexual assault, mental-health services, substance-use services, parental notification/access, proxy consent, foster care/state custody, and mandatory reporting. The patient-facing workflow should use the patient's physical location and service type to trigger the correct rule. A static national checkbox is not sufficient for all pediatric services.

46. CONTACT

MDTelemed LLC 304 S Jones Blvd #4872 Las Vegas, NV 89107 Business Administration / General Contact: Support@MDTelemed.com Complete for all 50 states and DC before national pediatric launch; add territories if MDTelemed will serve them. Verify the age-of-majority rule for each jurisdiction and special exceptions. Build a legally reviewed parent/guardian/proxy identity and authority workflow. Do not collect Social Security numbers for pediatric consent unless a separately verified need exists. Create custody-dispute and contested-authority escalation procedures. Create foster-care/state-custody verification procedures. Configure adolescent portal and proxy access so confidential services are not automatically exposed. Configure notification, pharmacy, billing, and test-result workflows for confidential minor services. Build mandatory-reporting jurisdiction logic and clinician training. Verify pediatric emergency escalation and location capture. Verify pediatric medication weight safeguards. Verify AI telescribe/recording consent rules for minors by state. Have qualified pediatric health-law counsel review the national policy and each state addendum.

47. PRIMARY REFERENCES

HHS, HIPAA Privacy Rule - Personal Representatives and Minors; parents generally act as personal representatives, subject to state law and specified exceptions. HHS, Does the HIPAA Privacy Rule allow parents the right to see their children's medical records? - describes the three principal exceptions and state-law interaction. HHS, Personal Representatives - describes abuse, neglect, domestic violence, and endangerment exception. American Academy of Pediatrics, Consent by Proxy for Nonurgent Pediatric Care, reaffirmed November 2024. American Academy of Pediatrics, Informed Consent in Decision-Making in Pediatric Practice, reaffirmed January 2023. American Academy of Pediatrics, Electronic Communication of the Health Record and Information With Pediatric Patients and Their Guardians. Guttmacher Institute, Minors' Access to STI Testing and Treatment, state-law summary current August 1, 2026. Applicable state minor-consent, emancipation, guardianship, custody, foster-care, confidentiality, medical-record, telehealth, prescribing, and mandatory-reporting laws. Original MDTelemed Pediatric Consent & Minor Protections - used as source material; fixed age bands, universal SSN collection, and categorical proxy/foster authority were not retained.

48. SOURCE LINKS

HHS Personal Representatives and Minors: https://www.hhs.gov/hipaa/for-professionals/faq/personal-representatives-and-minors/index.html HHS Personal Representatives Guidance: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/personal-representatives/index.html AAP Consent by Proxy for Nonurgent Pediatric Care: https://publications.aap.org/pediatrics/article/139/2/e20163911/60328/Consent-by-Proxy-for-Nonurgent-Pediatric-Care AAP Informed Consent in Pediatric Practice: https://publications.aap.org/pediatrics/article/138/2/e20161484/52512/Informed-Consent-in-Decision-Making-in-Pediatric Guttmacher Minors' Access to STI Services: https://www.guttmacher.org/state-policy/explore/minors-access-sti-services

49. END OF

MINOR CONSENT AND CONFIDENTIALITY ADDENDUM

1. MDTELEMED LLC

2. MINOR CONSENT & CONFIDENTIALITY ADDENDUM

Version 1.0 | Effective September 15, 2026

IMPORTANT: MDTelemed treats patients of all ages. The legal authority to consent for a minor, the minor's ability to consent independently, parental access to records, and confidentiality are determined by the law applicable to the particular patient, service, and circumstances. This Addendum is a national framework; it is not a substitute for the state-specific minor-consent matrix that must be integrated into MDTelemed's clinical workflow before nationwide pediatric activation.

3. PURPOSE

This Addendum establishes MDTelemed's framework for consent, assent, confidentiality, proxy access, medical records, communications, billing, emergencies, mandated reporting, and telehealth when a patient is under the age of majority or otherwise subject to special consent rules.

4. NO SINGLE NATIONAL AGE RULE

HIPAA does not establish the age at which a child may independently consent to medical treatment. HHS explains that HIPAA defers to state or other applicable law concerning age of majority and parental authority. MDTelemed therefore will not use a single national '18 means parent / under 18 means child' rule to resolve every clinical or privacy question.

5. GENERAL RULE

In ordinary pediatric care, a parent, legal guardian, or other person authorized under applicable law usually has authority to consent for an unemancipated minor and is generally the minor's HIPAA personal representative. Important statutory and safety exceptions apply.

6. PERSONAL REPRESENTATIVE

Under 45 C.F.R. §164.502(g), a covered entity generally treats a legally authorized personal representative as the individual for HIPAA purposes to the extent of the representative's authority.

7. THREE IMPORTANT HIPAA EXCEPTIONS

A parent may not be the minor's HIPAA personal representative for particular care when: the minor lawfully consents and no other consent is required; someone other than the parent is legally authorized and consents; or the parent agrees to a confidential relationship between the minor and provider for the service.

8. STATE LAW CONTROLS PARENTAL ACCESS

HIPAA expressly defers to state or other applicable law that permits, requires, or prohibits parental access to a minor's information. MDTelemed must therefore determine parental record access separately from the question of who brought the child to the visit.

9. PROFESSIONAL JUDGMENT WHEN LAW IS SILENT

When a parent is not the personal representative for particular care and applicable law is silent on parental access, HIPAA can permit a licensed health professional to allow or deny access consistent with law and professional judgment.

10. ABUSE / ENDANGERMENT EXCEPTION

A provider may decline to treat a person as the patient's personal representative when the provider reasonably believes the patient has been or may be subjected to domestic violence, abuse, or neglect by that person, or treating that person as representative could endanger the patient, and the provider determines in professional judgment that doing so is not in the patient's best interest.

11. AUTHORITY VERIFICATION

MDTelemed should verify the identity and legal authority of the adult purporting to consent for a child. Being a biological parent, stepparent, grandparent, foster parent, sibling, babysitter, or adult accompanying the child does not automatically establish identical legal authority.

12. CUSTODY ORDERS

Custody, guardianship, foster-care, dependency, adoption, power-of-attorney, and court orders can allocate medical decision-making differently. MDTelemed may request documentation reasonably necessary to determine authority.

13. NONCUSTODIAL PARENTS

A noncustodial parent may retain medical decision-making or record-access rights depending on the governing order and state law. MDTelemed should not infer lack of rights solely from physical custody.

14. STEPPARENTS / RELATIVES

Stepparents and relatives should not be treated as legal decision-makers unless applicable law, delegation, guardianship, court order, or other valid authority supports that role.

15. EMANCIPATED MINORS

An emancipated minor may have authority to consent to care and control related health information under applicable law. The grounds and proof of emancipation vary by jurisdiction.

16. MARRIED / PREGNANT / PARENTING MINORS

Some states grant independent consent authority to minors based on marriage, pregnancy, parenthood, living apart, military status, financial independence, or other conditions. These rules are state-specific and often service-specific.

17. MINOR-CONSENT SERVICES

States commonly create exceptions allowing minors of specified ages or circumstances to consent to some services, potentially including STI/HIV services, contraception/reproductive care, pregnancy-related care, sexual-assault care, mental-health services, substance-use treatment, and other categories. The scope and age thresholds vary substantially.

18. NO OVERGENERALIZATION

A minor's legal authority to consent to one service does not automatically authorize the minor to consent to unrelated services, and confidentiality for one service does not automatically cloak the entire medical record.

19. ASSENT

Even when an adult legally consents, MDTelemed physicians should involve developmentally appropriate children and adolescents in decisions through assent when clinically appropriate. Assent is not a substitute for legally required consent.

20. ADOLESCENT PRIVATE TIME

Where clinically appropriate and lawful, physicians may ask to speak privately with an adolescent for part of an encounter. Private time can improve disclosure of safety, sexual health, substance use, mood, abuse, and other sensitive concerns.

21. LIMITS OF CONFIDENTIALITY

A minor should not be promised absolute confidentiality. Information may need to be disclosed when required or permitted by law, including mandated abuse reporting, serious safety threats, emergencies, court/legal requirements, or other statutory exceptions.

22. MENTAL HEALTH

Minor consent to outpatient or inpatient mental-health treatment, parental notification, duration/number of sessions, medication authority, and record access vary by state. MDTelemed's psychiatric service must use a state-specific behavioral-health minor-consent module.

23. SUICIDE / SELF-HARM

When a minor presents with suicidal ideation, self-harm, or another serious safety concern, confidentiality yields to lawful and clinically appropriate safety interventions. The physician should obtain location, emergency contacts, and activate local emergency/crisis resources when indicated.

24. THREATS TO OTHERS

Threat assessment, warning/protection duties, parental involvement, emergency disclosure, and reporting obligations vary by jurisdiction. MDTelemed must follow applicable law and professional standards.

25. SUBSTANCE USE

Minor consent and confidentiality for substance-use services can involve state law, HIPAA, and—when the program/records fall within its scope—42 C.F.R. Part 2. MDTelemed does not offer buprenorphine/OUD treatment under its current model and should not claim Part 2 status without a legal determination.

26. STI / HIV

States differ on the age and circumstances under which minors may consent to STI/HIV prevention, testing, diagnosis, or treatment and on whether or when parents may be informed. The ordering, result, portal, pharmacy, and billing workflows must preserve legally required confidentiality.

27. CONTRACEPTION / REPRODUCTIVE HEALTH

Minor authority and confidentiality for contraception, pregnancy testing, pregnancy care, abortion-related services, and reproductive health vary materially by state. MDTelemed must apply the law in the patient's physical location and any other law legally controlling the service.

28. SEXUAL ASSAULT

Care involving suspected sexual assault may implicate independent minor consent, forensic examination rules, evidence preservation, mandated reporting, parental notification exceptions, and emergency referral. Telemedicine must not substitute for required in-person forensic care.

29. ABUSE / NEGLECT

Physicians and other covered personnel must comply with mandatory child-abuse and neglect reporting laws. Reporting thresholds, agencies, timing, documentation, and jurisdiction vary. MDTelemed should never promise a child that suspected abuse will remain secret.

30. HUMAN TRAFFICKING / EXPLOITATION

Suspected trafficking, exploitation, or coercion requires safety-focused assessment and compliance with applicable reporting law. Communications should be designed to avoid alerting a potentially abusive controller where doing so could increase risk.

31. TELEHEALTH LOCATION

The patient's current physical location must be obtained for every encounter. For minors, location is also essential for determining physician licensure, minor-consent law, emergency response, and reporting obligations.

32. PRIVATE ENVIRONMENT

The physician should consider who is physically present, whether the minor can speak safely, whether someone is coaching responses, and whether headphones or a private room are appropriate. Privacy requests must not compromise safety.

33. IDENTITY OF MINOR

MDTelemed should use reasonable procedures to confirm the patient's identity without imposing unnecessary barriers to legally confidential services.

34. IDENTITY OF REPRESENTATIVE

When an adult provides consent, the platform should capture the adult's identity, relationship, legal authority, and any supporting documentation required by the state/workflow.

35. ELECTRONIC CONSENT

Electronic consent is acceptable only where the applicable law permits it and the workflow satisfies any signature, disclosure, timing, identity, and retention requirements.

36. PROXY PORTAL ACCESS

Parent/guardian proxy access must be configured according to legal authority and confidentiality rules. A single unrestricted parent login for all pediatric records can expose services the minor has a legal right to keep confidential.

37. SEGMENTATION

Where technically feasible and legally necessary, MDTelemed should segment or suppress confidential adolescent information from proxy views, notifications, after-visit summaries, medication lists, test results, appointment descriptions, and other outputs.

38. PORTAL TRANSITION BY AGE

Portal/proxy access should change when the patient reaches the applicable age or obtains legal authority over specified services. The system should not wait for a parent or teen to discover that access rules changed.

39. EMAIL

Email can inadvertently disclose confidential services through subject lines, appointment reminders, result notifications, invoices, or shared family accounts. MDTelemed should minimize sensitive content and honor legally required confidential communication arrangements.

40. SMS

Text messages may appear on lock screens or shared family plans. Promotional and clinical SMS consent does not resolve minor confidentiality. Sensitive service names should not be placed in messages unless legally and operationally appropriate.

41. BILLING / RECEIPTS

Even in a self-pay model, receipts, payment descriptors, refund notices, subscription notices, and account statements can reveal confidential services. Privacy engineering must address these secondary disclosures.

42. PHARMACY COMMUNICATIONS

Prescriptions can reveal confidential diagnoses or services. The physician should confirm the appropriate pharmacy/contact process and apply state minor-consent/confidentiality rules.

43. LAB / IMAGING RESULTS

Diagnostic orders and results can expose confidential care. Results-routing and proxy access must follow the law applicable to the service for which the minor independently consented.

44. MEDICAL RECORD ACCESS

must be applied with this Addendum. A parent generally may have access when acting as personal representative, but access can be limited or prohibited for particular minor-consented services or safety circumstances.

45. NPP DELIVERY

HHS states that when a parent is the minor's personal representative, providing the HIPAA Notice of Privacy Practices to the parent generally satisfies delivery. When the parent is not the personal representative because the minor lawfully consented to the care, the provider generally provides the Notice to the minor and makes the required good-faith effort to obtain acknowledgment.

46. AMENDMENT REQUESTS

Authority to request amendment of a minor's medical record follows applicable HIPAA/state rules and the person's legal authority over the relevant record. Disagreement with a physician's documentation does not authorize silent deletion or alteration.

47. CONFIDENTIAL COMMUNICATION REQUESTS

Where HIPAA or state law grants the minor or representative the right to request confidential communications, MDTelemed will evaluate and implement reasonable requests as required.

48. DISCLOSURE TO FAMILY

Family involvement is not synonymous with unrestricted record access. Disclosures should be based on personal-representative status, the patient's permission/non-objection where applicable, professional judgment, and state law.

49. EMERGENCY DISCLOSURES

HIPAA may permit disclosure to a parent or another person able to lessen a serious and imminent threat when the applicable regulatory and legal conditions are met. State law and professional duties also apply.

50. SCHOOL / CAMP / SPORTS FORMS

Requests for school, camp, athletics, or similar documentation should be released only with valid authority and minimum necessary information where applicable.

51. IMMUNIZATION INFORMATION

Consent and disclosure rules for immunization can include state registry, school, public-health, and minor-consent provisions. MDTelemed should apply service-specific rules rather than assuming ordinary record-access rules resolve every immunization disclosure.

52. PEDIATRIC PRESCRIBING

A valid consent pathway does not make a prescription clinically appropriate. The physician must still evaluate age/weight, indication, dosing, allergies, interactions, contraindications, monitoring, follow-up, and telemedicine suitability.

53. CONTROLLED SUBSTANCES

MDTelemed prohibits Schedule II-V controlled-substance prescribing for all patients, including minors.

54. AGE / WEIGHT

Pediatric medication and clinical decisions often require accurate age and weight. Patient/parent-provided measurements should be documented as reported unless independently verified.

55. NEWBORNS / INFANTS

Infants and young children generally require an authorized adult to participate. Telemedicine appropriateness must be assessed carefully because history is caregiver-dependent and examination limitations may be material.

56. FEVER IN YOUNG INFANTS

Telemedicine should not delay emergency or urgent in-person evaluation when age, fever, appearance, hydration, respiratory status, or other features make remote care unsafe.

57. DEVELOPMENTAL CAPACITY

Chronological age does not always equal decisional capacity. Developmental disability, cognitive impairment, acute psychiatric illness, intoxication, or other factors may affect communication and assent while legal consent authority remains governed by law.

58. DIVORCED / SEPARATED PARENTS

The platform should not mediate custody disputes. When authority is disputed, MDTelemed may pause nonurgent care until adequate legal documentation is obtained, while emergency care obligations remain governed by law.

59. FOSTER CARE

Foster parents, agencies, biological parents, courts, and state entities may hold different authority depending on the jurisdiction and placement order. Foster status must trigger a dedicated authority check.

60. GRANDPARENT / CAREGIVER CONSENT

Some states authorize specified caregivers or grandparents to consent through affidavit or statute. MDTelemed should validate the required form and scope before relying on it.

61. TEMPORARY DELEGATION

A parent may sometimes delegate medical decision-making to another adult. The validity, duration, form, notarization, and scope vary by state.

62. EMERGENCY TREATMENT WITHOUT PARENT

Emergency law can permit treatment when parental consent cannot be obtained. HIPAA record-access consequences are separate; HHS notes that emergency treatment without parental consent does not automatically mean the parent loses personal-representative status.

63. REFUSAL / CONFLICT

If a minor and parent disagree, the physician must identify who has legal decision-making authority, consider assent and safety, and apply state law. The clinician should not resolve a legal custody/consent dispute by intuition.

64. MATURE MINOR DOCTRINE

Some jurisdictions recognize forms of mature-minor authority through statute or case law, while others do not. MDTelemed must not invoke a generic 'mature minor doctrine' without confirming that it exists and applies to the service and jurisdiction.

65. EMANCIPATION DOCUMENTATION

When independent consent depends on emancipation, the platform should record the basis and evidence relied upon rather than merely checking 'emancipated.'

66. AGE OF MAJORITY VARIATION

Although 18 is the age of majority for many purposes in most states, state law controls and special rules can alter health-care decision-making. The platform must use a legal matrix, not a hard-coded assumption.

67. CROSS-STATE TRAVEL

A teen may live in one state but connect while physically located in another. MDTelemed must determine the law governing licensure, consent, confidentiality, prescribing, and reporting; residence alone is insufficient.

68. STATE LAW UPDATES

Minor-consent laws change frequently, especially in reproductive, gender-affirming, behavioral-health, and privacy areas. The matrix requires scheduled and event-driven legal updates.

69. NO RETALIATION

MDTelemed will not unlawfully retaliate against a minor or representative for exercising privacy or access rights.

70. COMPLAINTS

Privacy or confidentiality concerns may be sent to Support@MDTelemed.com or MDTelemed LLC, 304 S Jones Blvd #4872, Las Vegas, NV 89107. HIPAA complaints may also be submitted to HHS OCR as described in .

71. CONTACT

MDTelemed LLC 304 S Jones Blvd #4872 Las Vegas, NV 89107 Business Administration / Privacy: Support@MDTelemed.com

72. STATE-SPECIFIC MINOR-CONSENT MATRIX — REQUIRED CATEGORIES

Before pediatric activation in a state, MDTelemed's legal matrix should identify, at minimum, the following. The exact age, circumstances, parental-notification rules, record rights, and confidentiality provisions must come from current primary authority. General medical consent and age of majority. Emancipation and independent-living rules. Marriage, pregnancy, parenthood, military status, and other status-based consent. STI diagnosis/treatment and HIV testing/prevention/treatment. Contraception and reproductive-health services. Pregnancy testing and prenatal/pregnancy-related care. Abortion-related care and current judicial/statutory restrictions. Sexual-assault examination/treatment. Outpatient and inpatient mental-health treatment. Psychiatric medications where separately regulated. Substance-use disorder evaluation/treatment and Part 2 interaction. Tobacco/nicotine cessation where minor consent is addressed. Gender-affirming care and current restrictions/protections. Immunization consent. Blood donation or other special statutory services where relevant. Mandatory child-abuse/neglect reporting. Human-trafficking/exploitation reporting. Parental access to records for minor-consented services. Minor access to and amendment of records. Proxy portal and electronic health-information access. Confidential communications and explanation-of-benefits issues if insurance is later added. Pharmacy, laboratory, imaging, and HIE disclosure rules. Telehealth-specific consent requirements for minors. Recording/wiretap consent when a minor participates. Emergency treatment authority and disclosure. Custody, foster-care, caregiver affidavit, and temporary delegation rules.

73. PEDIATRIC PRIVACY ENGINEERING REQUIREMENTS

Separate patient and proxy identities; never share one credential. Store legal relationship and authority separately from emergency-contact status. Allow record-level or data-category suppression from proxy view when legally required. Prevent sensitive appointment labels from appearing in proxy calendars/notifications. Prevent confidential test names/results from leaking through push notifications, SMS, email, or portal previews. Provide state-aware proxy expiration and age-transition logic. Log every proxy view/download of pediatric records. Route questionable parental-access requests to trained privacy/records personnel. Do not expose confidential service data through billing descriptors or marketing audiences. Test pediatric privacy controls before each state goes live. Build and counsel-validate a 50-state + DC minor-consent/confidentiality matrix using current statutes, regulations, binding cases, medical-board rules, health-department guidance, and attorney-general guidance. For every service category, capture minimum age, qualifying circumstances, who may consent, whether parental notification is permitted/required/prohibited, and who controls records. Do not activate pediatric care in a state until the state matrix is implemented in the registration, encounter, portal, records, laboratory, pharmacy, messaging, and billing workflows. Create legal-authority verification pathways for parent, guardian, foster parent, caregiver affidavit, grandparent, temporary delegate, court-appointed decision-maker, emancipated minor, and minor self-consent. Create a custody-order escalation process and a nonurgent-care hold when authority cannot be established. Build adolescent confidential-service flags that flow to portal, records, messaging, labs, pharmacy, billing, and support. Implement separate minor and proxy accounts with granular access controls. Create automatic proxy-access transition rules by jurisdiction and service. Prevent customer support staff from overriding confidential-service restrictions without privacy/legal authorization. Create private-adolescent interview guidance for physicians, including explaining confidentiality and its limits. Create suicide/self-harm, violence, abuse/neglect, trafficking, and sexual-assault escalation protocols tied to verified physical location. Map mandatory reporting agencies and reporting methods by state and maintain after-hours pathways. Create state-specific psychiatric minor-consent modules before telepsychiatry activation. Create state-specific STI/HIV and reproductive-health modules before those services are activated for minors. Complete legal review of gender-affirming care before offering any such service to minors because the law is unusually dynamic and contested. Determine whether MDTelemed will permit confidential minor self-pay accounts and how identity/payment will work without unlawful disclosure. Ensure Good Faith Estimate, subscription, refund, and payment communications do not disclose confidential services to an unauthorized adult. Verify AI telescribe and recording consent when the patient is a minor; determine whether parent, minor, both, or another person must consent under the applicable recording and health law. Train physicians that HIPAA does not itself grant a minor the right to consent to treatment; state law supplies the treatment-consent rule. Train staff that parental consent authority and parental record access are related but distinct legal questions. Have pediatric health-law/privacy counsel approve the production policy and state matrix immediately before launch and institute quarterly plus event-driven updates.

74. PRIMARY AUTHORITIES / REFERENCES

75. C.F.R. §164.502(g) — HIPAA personal representatives, including unemancipated minors and abuse/endangerment exception.

76. C.F.R. §§164.510(b), 164.512(j), 164.520(c), 164.524 — family involvement, serious-threat disclosures, Notice of Privacy Practices, and access.

U.S. Department of Health and Human Services, Office for Civil Rights, Personal Representatives guidance. HHS OCR, Personal Representatives and Minors FAQs. HHS OCR, guidance concerning parents and a minor child's mental-health information.

77. U.S.C. §290dd-2 and 42 C.F.R. Part 2 — substance-use-disorder records when applicable.

Child Abuse Prevention and Treatment Act, 42 U.S.C. §5101 et seq., plus controlling state mandatory-reporting statutes. Children's Online Privacy Protection Act, 15 U.S.C. §§6501-6506 and 16 C.F.R. Part 312, where online collection falls within scope. Applicable state age-of-majority, minor-consent, emancipation, mental-health, SUD, STI/HIV, reproductive-health, sexual-assault, child-abuse, custody, foster-care, medical-record, privacy, telehealth, prescribing, and recording laws.

78. RELATED MDTelemed POLICIES

Patient Bill of Rights & Responsibilities; Telehealth Informed Consent; Pediatric Care & Minor Rights; Behavioral Health; Medical Records Access, Amendment & Release; Medical Record Retention; Emergency & Crisis Response; HIPAA Notice of Privacy Practices; Consumer Health Data Privacy; State Privacy Rights Supplement; 50-State Telehealth Consent & Disclosure Addendum; Electronic Communications & E-SIGN Consent; SMS/Text Messaging Terms & Consent; AI Telescribe, Audio Capture & Documentation Consent; Patient Identity Verification & Physical Location.

79. END OF

CAPACITY - GUARDIANSHIP - SURROGATE DECISION-MAKING

Capacity / Guardianship / Surrogate Decision-Making

Version 1.0 | Effective September 16, 2026

1. Policy Statement

MDTelemed adopts this policy to establish a consistent, patient-centered and legally compliant framework for capacity / guardianship / surrogate decision-making. This policy must be implemented together with applicable federal law, the law of the patient's physical location, professional standards, and MDTelemed's other clinical and privacy policies.

2. Purpose

This policy addresses patients who may lack decision-making capacity and the role of legally authorized representatives.

3. Capacity

Clinicians assess decision-making capacity for the specific decision; a diagnosis alone does not automatically determine capacity.

4. Surrogate Authority

When a surrogate is required, MDTelemed should identify the legally authorized person under applicable law and document the basis for authority.

5. Patient Participation

Patients should be involved in decisions to the extent feasible even when a surrogate is authorized.

6. Emergency Exception

Emergency treatment and consent rules may differ when delay threatens serious harm.

7. Privacy

Access by a surrogate should be limited to the authority granted by law and any applicable confidentiality restrictions.

8. Roles and Responsibilities

MDTelemed management is responsible for operational implementation and periodic review. Clinicians remain responsible for independent professional judgment and documentation. Workforce members must follow role-based access, confidentiality, escalation, and incident-reporting requirements. Material conflicts between this policy and controlling law must be escalated to compliance/legal review before the affected workflow is used.

9. Training and Monitoring

Affected personnel should receive role-appropriate training. MDTelemed may audit compliance, investigate deviations, and implement corrective action when needed.

10. Exceptions

No exception may waive a mandatory legal or patient-safety requirement. Operational exceptions should be documented and approved by an authorized leader when appropriate.

11. Primary Regulatory / Guidance References

U.S. Department of Health and Human Services, HIPAA Privacy, Security and Breach Notification Rules, 45 C.F.R. Parts 160 and 164. HHS Telehealth guidance regarding HIPAA and remote communication technologies. Applicable state medical-practice, telehealth, privacy, recording, consumer-protection and professional-licensure laws.

PROXY - CAREGIVER - AUTHORIZED REPRESENTATIVE ACCESS

Proxy / Caregiver / Authorized Representative Access

Version 1.0 | Effective September 16, 2026

1. Policy Statement

MDTelemed adopts this policy to establish a consistent, patient-centered and legally compliant framework for proxy / caregiver / authorized representative access. This policy must be implemented together with applicable federal law, the law of the patient's physical location, professional standards, and MDTelemed's other clinical and privacy policies.

2. Scope

This policy governs participation by parents, guardians, caregivers, interpreters, health care agents, personal representatives, and other proxies.

3. Authority

MDTelemed should verify the proxy's identity and authority to the extent appropriate to the requested access. Authority may arise from parental status, guardianship, power of attorney, patient authorization, or applicable law.

4. Patient Autonomy

When the patient has decision-making capacity, the patient's preferences control participation by others unless law provides otherwise.

5. Portal and Record Access

Proxy access should be role-based and limited to the information and functions the proxy is authorized to use.

6. Revocation and Change

A patient may revoke voluntary proxy authorization prospectively. Guardianship or legal-representative changes should be documented and access updated promptly.

7. Confidential Services

Special rules may limit proxy access to minor-consented care, reproductive health, behavioral health, SUD treatment, or other confidential services.

8. Roles and Responsibilities

MDTelemed management is responsible for operational implementation and periodic review. Clinicians remain responsible for independent professional judgment and documentation. Workforce members must follow role-based access, confidentiality, escalation, and incident-reporting requirements. Material conflicts between this policy and controlling law must be escalated to compliance/legal review before the affected workflow is used.

9. Training and Monitoring

Affected personnel should receive role-appropriate training. MDTelemed may audit compliance, investigate deviations, and implement corrective action when needed.

10. Exceptions

No exception may waive a mandatory legal or patient-safety requirement. Operational exceptions should be documented and approved by an authorized leader when appropriate.

11. Primary Regulatory / Guidance References

U.S. Department of Health and Human Services, HIPAA Privacy, Security and Breach Notification Rules, 45 C.F.R. Parts 160 and 164. HHS Telehealth guidance regarding HIPAA and remote communication technologies. Applicable state medical-practice, telehealth, privacy, recording, consumer-protection and professional-licensure laws.

BEHAVIORAL HEALTH - MENTAL HEALTH PRIVACY

1. MDTELEMED LLC

2. BEHAVIORAL HEALTH & MENTAL HEALTH PRIVACY POLICY

Version 1.0 | September 15, 2026

National patient-facing baseline for psychiatric and behavioral-health telemedicine. State-specific consent, minor, involuntary-treatment, duty-to-warn/protect, mandatory-reporting, prescribing, and privacy requirements control where more specific.

3. PURPOSE

MDTelemed LLC may provide psychiatric and behavioral-health care through telemedicine when clinically appropriate and legally permitted. This Policy explains the scope and limitations of remote behavioral-health care, confidentiality, safety and crisis escalation, medication rules, psychotherapy-note protections, substance-use-related information, pediatric issues, family involvement, and state-specific requirements. All diagnosis and treatment decisions are made by human MD physicians. MDTelemed does not provide autonomous AI diagnosis or treatment. AI-assisted telescribing may assist documentation under a separate disclosure and consent.

4. IMPORTANT CORRECTIONS TO THE ORIGINAL POLICY

The original stated that 42 C.F.R. Part 2 strictly protects SUD diagnosis/treatment records, broadly asserted that such information cannot be disclosed to anyone without a specific written consent, described criminal penalties, and contemplated buprenorphine treatment under an obsolete 'DEA X-Waiver' model. It also stated that Part 2 records should be kept separate from general medical records. fileciteturn5file3

Version 1.0 does not carry those statements forward as universal rules. The federal Part 2 rule was substantially revised in 2024, with compliance required by February 16, 2026, including closer alignment with HIPAA for treatment, payment, and health-care operations. Part 2 applies to records meeting the statutory/regulatory program criteria; it is not automatically triggered whenever an MDTelemed physician asks about alcohol or drug use. MDTelemed has also confirmed that it will not provide buprenorphine/OUD treatment at launch, and the federal X-Waiver requirement is no longer an appropriate description of current law.

5. SERVICES WITHIN SCOPE

Behavioral-health services may include psychiatric evaluation, diagnostic assessment, medication management using non-controlled medications, follow-up, supportive counseling within physician scope, screening, coordination of care, referrals, and safety assessment. Availability of a service does not mean telemedicine is appropriate for every patient. The physician may require in-person psychiatric care, emergency evaluation, psychotherapy, neuropsychological testing, laboratory testing, specialist consultation, or a higher level of care.

6. SERVICES OUTSIDE MDTelemed SCOPE AT LAUNCH

No Schedule II-V controlled substances. No controlled stimulants. No benzodiazepines or other controlled anxiolytics/sedative-hypnotics. No buprenorphine/OUD prescribing. No methadone treatment. No guarantee of psychotherapy or specialty psychiatric programs merely because behavioral-health care is offered. No emergency psychiatric facility, inpatient unit, mobile crisis service, or 911 substitute.

7. TELEPSYCHIATRY LIMITATIONS

Telepsychiatry can provide meaningful access to care, but remote assessment has limitations. The physician may have less information about the patient's environment, behavior outside the camera view, substance access, medication containers, weapons, collateral history, or subtle physical/neurologic findings. Audio-only care removes visual information. Asynchronous communication is not suitable for immediate crisis assessment. The physician may require video or in-person care if the selected modality is inadequate.

8. PATIENT PHYSICAL LOCATION

MDTelemed requires the patient's current physical location during the encounter. This is especially important in behavioral-health care because emergency response, physician licensure, crisis resources, involuntary-evaluation law, and duty-to-protect requirements depend on jurisdiction. Patients should not provide only a residence address if they are physically somewhere else. A traveling patient should disclose the actual location.

9. EMERGENCY CONTACT AND LOCAL RESOURCES

For selected psychiatric encounters, MDTelemed may request an emergency contact and may identify local emergency/crisis resources. Whether and how an emergency contact is used depends on the patient's condition, consent, professional judgment, and applicable law. A patient should not assume that MDTelemed can dispatch emergency services without an accurate location.

10. SUICIDE AND SELF-HARM RISK

When clinically indicated, the physician may assess suicidal thoughts, intent, plan, access to lethal means, prior attempts, protective factors, substance use, psychosis, agitation, and other risk factors. A positive response does not automatically mean hospitalization. Risk assessment is individualized. Conversely, a patient's denial of suicidal intent does not eliminate risk when other information indicates danger. If the physician believes the patient requires emergency evaluation, the physician may direct the patient to 911, a local emergency department, 988 or another crisis resource, or may involve people reasonably able to reduce danger when legally and clinically justified.

11. HOMICIDAL OR VIOLENCE RISK

The physician may assess threats toward others, intent, plan, access to weapons, identified targets, psychosis, intoxication, escalating behavior, and other relevant factors. State laws concerning a clinician's duty to warn or protect vary. MDTelemed will not use a single national Tarasoff rule. The physician must follow the law applicable to the patient's location and the physician's professional obligations.

12. CONFIDENTIALITY: GENERAL MENTAL-HEALTH INFORMATION

Under HIPAA, mental-health information in the ordinary medical record is generally treated like other protected health information. It is not automatically subject to a separate federal secrecy rule merely because the diagnosis is psychiatric. Treatment, payment, health-care operations, patient authorizations, required-by-law disclosures, public-health/safety provisions, and other HIPAA rules may apply, subject to state law and more protective specialized rules.

13. PSYCHOTHERAPY NOTES ARE DIFFERENT

HIPAA gives special protection to 'psychotherapy notes,' a narrowly defined category of notes recorded by a mental-health professional documenting or analyzing the contents of a counseling conversation and maintained separately from the rest of the medical record. Psychotherapy notes do not include ordinary medication prescribing/monitoring information, counseling session times, modalities/frequency, clinical-test results, or summaries of diagnosis, functional status, treatment plan, symptoms, prognosis, and progress. Most uses and disclosures of true psychotherapy notes require a specific authorization, subject to limited exceptions. Patients also do not have the same HIPAA access right to psychotherapy notes that they have to the designated record set.

14. MDTelemed PROGRESS NOTES

An MDTelemed psychiatric progress note is not automatically a HIPAA psychotherapy note. A routine medical record documenting history, mental-status findings, diagnosis, risk assessment, medications, treatment plan, and progress ordinarily remains part of the medical record. MDTelemed should not label routine psychiatric documentation 'psychotherapy notes' merely to restrict access. If physicians create separate psychotherapy notes, the system and workflow must maintain the separation required by the HIPAA definition.

15. FAMILY, FRIENDS, AND CAREGIVERS

With appropriate permission or under other HIPAA provisions, MDTelemed may communicate with family, friends, or caregivers involved in the patient's care. The information disclosed should be appropriate to the person's involvement and applicable law. For an adult patient with capacity who objects to routine family disclosure, MDTelemed generally should respect that choice unless another legal basis permits or requires disclosure. Family members may provide information to MDTelemed even when the physician cannot disclose information back to them.

16. SERIOUS AND IMMINENT THREATS

HIPAA permits a covered health-care provider, consistent with applicable law and ethical standards, to disclose necessary information when the provider has a good-faith belief that disclosure is needed to prevent or lessen a serious and imminent threat to the patient or others and the disclosure is made to someone reasonably able to reduce the threat. Potential recipients can include family, caregivers, law enforcement, an intended target, school personnel, or others depending on circumstances and law. The physician should limit disclosure to information necessary for the safety purpose. State law can impose duties beyond HIPAA's permission. MDTelemed's state matrix must therefore address duty-to-warn/protect requirements.

17. INVOLUNTARY EVALUATION AND CIVIL COMMITMENT

Emergency psychiatric holds, involuntary evaluation, civil commitment, protective custody, and related procedures are governed primarily by state law. MDTelemed itself does not operate an inpatient psychiatric facility. A remote physician may identify the need for emergency intervention and communicate with emergency services or other authorized persons as permitted or required. The legal mechanism and threshold differ by state.

18. ABUSE, NEGLECT, EXPLOITATION, AND DOMESTIC VIOLENCE

Physicians may have mandatory-reporting obligations involving child abuse/neglect, abuse or exploitation of vulnerable adults, and other circumstances defined by state law. Domestic violence involving a competent adult does not create one uniform national reporting rule. The physician must follow applicable state law, patient safety considerations, and HIPAA. MDTelemed should never promise absolute confidentiality where mandatory reporting may apply.

19. SUBSTANCE USE IN GENERAL MEDICAL OR PSYCHIATRIC CARE

Asking about alcohol, cannabis, illicit drugs, misuse of prescriptions, or prior substance-use history is part of ordinary medical and psychiatric assessment. Such information can be clinically necessary for diagnosis, interactions, withdrawal risk, suicide risk, and treatment planning. The presence of SUD information in a general medical record does not, by itself, establish that MDTelemed is a federally assisted Part 2 program or that every record is a Part 2 record.

20. C.F.R. PART 2: WHEN IT APPLIES

Part 2 protects qualifying SUD patient records maintained in connection with federally assisted programs or activities that meet Part 2's coverage criteria. MDTelemed must determine whether any MDTelemed service, organizational unit, provider function, or record falls within Part 2 before representing that Part 2 applies. If MDTelemed becomes a Part 2 program or receives Part 2 records, it must implement the current Part 2 requirements, not the superseded framework in the original draft.

21. CURRENT PART 2 CONSENT FRAMEWORK

The 2024 Part 2 Final Rule, for which compliance became required February 16, 2026, aligned important aspects of Part 2 with HIPAA. It permits a single consent for future uses and disclosures for treatment, payment, and health-care operations, with redisclosure permitted as provided by the current rule. The rule also creates specific protections for legal proceedings, separate consent requirements for SUD counseling notes, breach notification, complaint rights, and civil/criminal penalty alignment. Therefore, the original statement that Part 2 information can never be disclosed to another provider, insurer, or other recipient without a new highly specific consent is not an accurate statement of the current framework.

22. PART 2 AND LEGAL PROCEEDINGS

Current Part 2 retains strong restrictions against using qualifying SUD records to investigate or prosecute a patient or use them in specified legal proceedings against the patient without the required written consent or qualifying court order. MDTelemed should route subpoenas, warrants, court orders, law-enforcement requests, and litigation demands involving potentially protected SUD information through legal/privacy review before disclosure.

23. SUD COUNSELING NOTES

The revised Part 2 framework includes a separate consent requirement for use and disclosure of SUD counseling notes, subject to the regulation's terms. This is distinct from HIPAA psychotherapy notes, although both categories involve specially protected counseling documentation. MDTelemed should not assume the two definitions are identical.

24. BUPRENORPHINE AND OUD

MDTelemed does not offer buprenorphine or other OUD medication treatment at launch. The original policy's conditional X-Waiver section is therefore removed. fileciteturn5file3 If MDTelemed later chooses to add OUD treatment, the program must undergo a new legal, clinical, prescribing, privacy, pharmacy, emergency, and Part 2 compliance review before launch. The policy should then be revised rather than relying on this version.

25. PSYCHIATRIC MEDICATIONS

MDTelemed MDs may prescribe appropriate non-controlled psychiatric medications when the physician has sufficient information and applicable law permits. A telemedicine encounter does not guarantee medication. The physician may require laboratory testing, vital signs, ECG, pregnancy testing, prior records, pharmacy history, video assessment, specialist input, or in-person examination. Controlled stimulants, benzodiazepines, and all other Schedule II-V medications are prohibited by MDTelemed policy.

26. MEDICATION SAFETY

Psychiatric medication management may require monitoring for suicidality, activation, mania, psychosis, serotonin toxicity, withdrawal effects, metabolic changes, movement disorders, blood pressure changes, cardiac risk, pregnancy considerations, interactions, and other medication-specific risks. Patients should disclose all prescription medications, OTC products, supplements, substances, allergies, pregnancy status when relevant, and previous adverse reactions.

27. ANTIDEPRESSANTS AND SUICIDALITY

Initiation or dose changes of antidepressant therapy may require close clinical follow-up, particularly in children, adolescents, and young adults. Patients and caregivers should promptly report new or worsening suicidal thoughts, severe agitation, unusual behavioral change, or other concerning symptoms. A medication warning does not replace individualized risk assessment.

28. BIPOLAR DISORDER AND MANIA

Symptoms suggesting mania or hypomania may alter the safety of antidepressant or other treatment. The physician may assess prior episodes, decreased need for sleep, elevated or irritable mood, impulsivity, psychosis, family history, and medication/substance contributors. Severe mania, psychosis, inability to care for oneself, or dangerous behavior may require emergency or in-person psychiatric evaluation.

29. PSYCHOSIS

Telemedicine may be useful in assessing psychotic symptoms but can be insufficient when the patient is highly disorganized, agitated, intoxicated, medically unstable, unable to provide location, or unable to participate reliably. The physician may seek collateral information or emergency assistance as legally and clinically appropriate.

30. EATING DISORDERS

Eating disorders can involve serious medical instability not visible through telemedicine. Assessment may require weight trends, orthostatic vital signs, laboratory testing, ECG, physical examination, and specialty care. MDTelemed may refer or escalate when remote care cannot safely address the medical or psychiatric risk.

31. COGNITIVE IMPAIRMENT

Patients with dementia, delirium, intellectual disability, traumatic brain injury, or other cognitive impairment may require evaluation of decision-making capacity, involvement of a legally authorized representative, collateral history, or in-person assessment. Acute confusion or sudden cognitive change can represent a medical emergency and should not be assumed to be a primary psychiatric condition.

32. PEDIATRIC AND ADOLESCENT BEHAVIORAL HEALTH

For minors, consent authority and confidentiality depend on state law and the type of service. A parent is often the personal representative, but minors may independently consent to some mental-health or related services in some jurisdictions. MDTelemed will use and rather than assuming that parents always control all psychiatric information. When appropriate, adolescents may be offered private time with the physician, with an explanation of confidentiality limits.

33. PREGNANCY AND POSTPARTUM MENTAL HEALTH

Pregnancy and the postpartum period can alter psychiatric risk and medication decisions. The physician may assess pregnancy status, breastfeeding, obstetric history, medication risks, postpartum depression, psychosis, suicidality, and infant safety. Postpartum psychosis or other severe acute psychiatric symptoms can require emergency evaluation.

34. CAPACITY AND INFORMED DECISION-MAKING

A psychiatric diagnosis does not automatically mean that a patient lacks decision-making capacity. Capacity is decision-specific and clinically assessed. When a patient lacks capacity, the physician should identify the legally authorized decision-maker and follow applicable law. Emergency exceptions may apply when delay creates serious danger.

35. TELEHEALTH PRIVACY AT THE PATIENT'S LOCATION

Patients should use a reasonably private location when possible. Headphones may reduce unintended disclosure. Patients should tell the physician if another person is present or can hear the conversation. A patient living with an abusive or controlling person may not have safe privacy. The physician should use professional judgment about whether and how to continue sensitive questioning.

36. AI TELEscribing AND BEHAVIORAL HEALTH

Behavioral-health conversations can contain exceptionally sensitive information. MDTelemed's AI telescribe may assist the human physician in documenting a progress note, but autonomous AI does not diagnose or treat the patient. The separate AI Telescribe, Audio Capture & Documentation Consent must accurately state whether audio is streamed, temporarily buffered, recorded, retained, transcribed, or processed by another entity. MDTelemed must not promise technical safeguards or deletion practices that have not been verified. If a patient declines optional audio processing and an alternative documentation workflow is legally and operationally available, that process should be explained accurately.

37. RECORDING

Consent to telemedicine is not blanket consent to audio or video recording. Recording/eavesdropping laws vary by state. MDTelemed should not activate routine recording until the technical architecture and state-law consent requirements have been verified.

38. ACCESS TO MENTAL-HEALTH RECORDS

Patients generally have HIPAA access rights to mental-health information maintained in the designated record set, subject to applicable exceptions. True psychotherapy notes maintained separately are excluded from the HIPAA right of access. This does not mean that ordinary psychiatric progress notes may be withheld merely because they discuss mental health. State law may provide additional rights or restrictions.

39. AMENDMENT OF RECORDS

Patients may request amendment of qualifying PHI under HIPAA. A request does not entitle a patient to rewrite a physician's professional opinion simply because the patient disagrees with it. If an amendment is denied, HIPAA provides procedures including a statement of disagreement in appropriate circumstances.

40. COMMUNICATION WITH OTHER TREATING PROVIDERS

HIPAA generally permits sharing ordinary mental-health PHI with other treating providers for treatment and care coordination, subject to specialized laws and patient restrictions that may apply. Psychotherapy notes and qualifying Part 2 records require separate analysis under their respective rules.

41. EMPLOYERS, SCHOOLS, COURTS, AND LAW ENFORCEMENT

MDTelemed does not release behavioral-health information merely because an employer, school, attorney, insurer, family member, court litigant, or law-enforcement officer asks for it. The legal basis for disclosure must be evaluated. Authorizations, subpoenas, court orders, mandatory-reporting laws, HIPAA permissions, Part 2 restrictions, FERPA interfaces, and state mental-health confidentiality statutes may affect the result.

42. CRISIS COMMUNICATIONS

Routine portal messages, email, and asynchronous questionnaires are not continuously monitored emergency channels. A patient in immediate danger should use 911 or the local emergency number, 988 where appropriate, or an emergency department. A clinician may remain connected while emergency help is being arranged when clinically appropriate, but MDTelemed cannot guarantee uninterrupted telecommunications.

43. REFUSAL OF EMERGENCY RECOMMENDATION

If a patient refuses recommended emergency or higher-level psychiatric care, the physician may explain risks, attempt safety planning when appropriate, involve emergency contacts or authorities when legally justified, and document the refusal. MDTelemed is not required to continue routine outpatient telemedicine when the physician believes it cannot be provided safely.

44. SAFETY PLANNING

When clinically appropriate, safety planning may include warning signs, internal coping strategies, supportive people or places, professional/crisis contacts, emergency resources, and reducing access to lethal means. A safety plan is not a substitute for emergency intervention when acute risk requires immediate action.

45. WEAPONS AND LETHAL MEANS

When clinically relevant to suicide or violence risk, the physician may ask about access to firearms, medications, or other lethal means. Discussion may include temporary safe storage or separation from lethal means consistent with applicable law and the patient's circumstances. The purpose is risk reduction, not a guarantee that harm can be prevented.

46. CONTINUITY AND FOLLOW-UP

Behavioral-health treatment often requires longitudinal follow-up. The physician may recommend a specific follow-up interval, psychotherapy, primary-care coordination, psychiatry referral, laboratory monitoring, or in-person evaluation. A patient should not abruptly discontinue psychiatric medication without appropriate guidance when discontinuation could cause withdrawal or relapse.

47. DISCONTINUATION OF THE TELEMEDICINE RELATIONSHIP

When ongoing telemedicine is no longer clinically appropriate, MDTelemed should provide reasonable transition information consistent with professional obligations, urgency, state law, and the circumstances. Threatening or abusive behavior may affect platform access, but emergency safety information and legally required continuity obligations remain separately considered.

48. NONDISCRIMINATION AND ACCESSIBILITY

Patients should not be denied behavioral-health services on a prohibited discriminatory basis. Reasonable communication accommodations and auxiliary aids should be addressed under MDTelemed's accessibility and nondiscrimination policies. A disability may affect the appropriate telehealth modality but should not be treated as an automatic exclusion.

49. PATIENT RESPONSIBILITIES

Provide accurate identity and current physical location. Give truthful information about symptoms, medications, substances, allergies, diagnoses, prior treatment, and safety concerns. Tell the physician if another person is present or if privacy is compromised. Do not use routine messaging for emergencies. Follow emergency or in-person escalation instructions or tell the physician if you cannot. Do not seek controlled substances through MDTelemed. Keep contact information current. Report serious medication effects and worsening psychiatric symptoms promptly. Ask questions about confidentiality, medication, follow-up, and treatment when unclear.

50. MDTelemed RESPONSIBILITIES

Use human MD clinical judgment for diagnosis and treatment. Assess whether telemedicine is adequate for the presentation. Maintain emergency and crisis escalation procedures. Protect mental-health PHI under HIPAA and applicable state law. Correctly distinguish ordinary mental-health records, psychotherapy notes, and qualifying Part 2 records. Maintain state-specific duty-to-warn/protect and mandatory-reporting guidance. Apply the no-controlled-substance rule. Use appropriate medication monitoring. Protect minors' rights under state-specific consent/confidentiality law. Document clinically material risk assessment and disposition.

51. STATE-SPECIFIC REQUIREMENTS

Behavioral-health law varies substantially among states. MDTelemed's state compliance architecture should address telepsychiatry consent, minor consent, parental access, involuntary evaluation, emergency detention, duty to warn/protect, abuse reporting, adult-protective-services reporting, psychiatric-record confidentiality, prescribing, professional relationship requirements, and modality restrictions. The patient's physical location at the time of care should drive the applicable state workflow.

52. CONTACT

MDTelemed LLC 304 S Jones Blvd #4872 Las Vegas, NV 89107 Business Administration / General Contact: Support@MDTelemed.com Determine through counsel whether MDTelemed or any organizational unit will be a 42 C.F.R. Part 2 program. If Part 2 applies, implement the 2024 Final Rule requirements effective for compliance February 16, 2026, including current consent, notice, breach, complaint, redisclosure, legal-proceeding, and SUD counseling-note requirements. Create a 50-state duty-to-warn/protect matrix. Create a 50-state involuntary-evaluation/emergency-detention escalation matrix. Create behavioral-health mandatory-reporting workflows. Verify whether MDTelemed will provide psychotherapy or only physician psychiatric evaluation/medication management/supportive counseling. Define required suicide-risk and violence-risk assessment/documentation workflows without forcing a single instrument on every patient. Build 988/911/local-crisis resource routing based on patient location. Verify psychiatric medication monitoring requirements and high-risk medication escalation. Configure minor behavioral-health consent and confidential portal access under . Verify AI telescribe architecture and recording consent before use in psychiatric encounters. Train physicians and staff not to promise absolute confidentiality. Have qualified 50-state behavioral-health counsel review the policy and state matrices.

53. PRIMARY REFERENCES

U.S. Department of Health and Human Services, Fact Sheet: 42 CFR Part 2 Final Rule (updated January 30, 2026); compliance with applicable 2024 Final Rule requirements required February 16, 2026. U.S. Department of Health and Human Services, Understanding Confidentiality of Substance Use Disorder Patient Records or Part 2.

54. C.F.R. Part 2, Confidentiality of Substance Use Disorder Patient Records.

55. C.F.R. Parts 160 and 164, HIPAA Privacy, Security, and Breach Notification Rules.

HHS Office for Civil Rights, Mental Health and HIPAA guidance. HHS OCR, Does HIPAA provide extra protections for mental health information compared with other health information? — distinguishes ordinary mental-health PHI from psychotherapy notes. HHS OCR, serious and imminent threat guidance under 45 C.F.R. § 164.512(j). HHS, Your Medical Records — explains access rights and exclusion of psychotherapy notes. SAMHSA/988 Suicide & Crisis Lifeline resources. Applicable state psychiatric, telehealth, minor-consent, duty-to-warn/protect, involuntary-treatment, mandatory-reporting, prescribing, and confidentiality laws. Original MDTelemed Behavioral Health & 42 CFR Part 2 Compliance — used as source material; superseded Part 2/X-Waiver and categorical disclosure statements were not retained. fileciteturn5file3

56. SOURCE LINKS

HHS Part 2 Final Rule Fact Sheet: https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html HHS Understanding Part 2: https://www.hhs.gov/hipaa/part-2/index.html HHS Mental Health HIPAA Guidance: https://www.hhs.gov/hipaa/for-professionals/special-topics/mental-health/index.html HHS Psychotherapy Notes Guidance: https://www.hhs.gov/hipaa/for-professionals/faq/2088/does-hipaa-provide-extra-protections-mental-health-information-compared-other-health.html HHS Serious and Imminent Threat FAQ: https://www.hhs.gov/hipaa/for-professionals/faq/520/does-hipaa-permit-a-health-care-provider-to-disclose-information-if-the-patient-is-a-danger/index.html

57. Suicide & Crisis Lifeline: https://988lifeline.org/

58. END OF

HIPAA NOTICE OF PRIVACY PRACTICES

1. MDTELEMED LLC

2. NOTICE OF PRIVACY PRACTICES

Version 1.0 | Effective September 15, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. This Notice is intended to satisfy the HIPAA Notice of Privacy Practices requirements applicable to MDTelemed LLC to the extent MDTelemed LLC is a HIPAA covered health care provider for the relevant functions. It is distinct from the Website & Consumer Privacy Policy, which addresses broader website, tracking, cookie, consumer-data, and state privacy matters.

3. PURPOSE AND SCOPE

This Notice explains how MDTelemed LLC may use and disclose protected health information (PHI), the privacy rights available to patients, MDTelemed's legal duties, and how to contact MDTelemed or file a complaint. Because MDTelemed intends to provide telemedicine nationally, more protective state law may supplement or control particular uses, disclosures, access rights, minor confidentiality, reproductive/sexual-health information, genetic information, mental-health information, and other specially protected records.

4. WHO THIS NOTICE APPLIES TO

This Notice applies to MDTelemed LLC's covered health-care functions and to workforce members and persons acting for MDTelemed as permitted by HIPAA. The final production version must accurately identify any separate professional medical entities, organized health care arrangement, affiliated covered entities, or other entities that share this Notice. A shared or joint notice must not be implied unless the legal requirements are actually satisfied.

5. MDTelemed's TELEMEDICINE MODEL

MDTelemed provides care through human MD physicians. Services may use video, audio-only/telephone, asynchronous intake/questionnaires, and secure messaging when clinically appropriate and legally permitted. MDTelemed may order laboratory testing, imaging, and other diagnostic services. MDTelemed does not permit Schedule II-V controlled-substance prescribing through the platform.

6. AI-ASSISTED DOCUMENTATION

MDTelemed may use an AI-assisted telescribe to help document a physician-patient encounter. The AI tool is not an autonomous physician, does not independently diagnose or prescribe, and does not replace the treating MD's clinical judgment. Information processed for documentation remains subject to applicable privacy, security, contracting, and record-management requirements.

7. WHAT IS PROTECTED HEALTH INFORMATION

PHI generally includes individually identifiable health information created or received by a HIPAA covered entity or business associate that relates to health, health care, or payment for health care and is protected by HIPAA. Information may be protected by other federal or state laws even when HIPAA does not apply.

8. TREATMENT

We may use and disclose your PHI to provide, coordinate, or manage your health care. For example, your treating physician may review your history and may share relevant information with a laboratory, imaging facility, pharmacy, specialist, hospital, or another treating provider when permitted by law.

9. PAYMENT

We may use and disclose PHI for payment-related activities as permitted by law. MDTelemed is currently described as a cash/self-pay service, but payment functions can still include processing charges, responding to billing questions, issuing receipts or permitted documentation, collecting amounts owed, and handling refunds. This Notice does not promise insurance billing or network participation.

10. HEALTH CARE OPERATIONS

We may use and disclose PHI for health care operations permitted by HIPAA, such as quality assessment and improvement, patient-safety activities, physician evaluation, credentialing, compliance, auditing, legal services, business planning, customer service, training, fraud/abuse detection, and certain administrative functions.

11. BUSINESS ASSOCIATES

We may disclose PHI to business associates that perform services for or on behalf of MDTelemed when HIPAA permits and required contractual safeguards are in place. Examples can include technology, hosting, communications, payment, documentation, support, analytics used for covered functions, security, and professional services. This Notice does not invent a fixed vendor list.

12. APPOINTMENT AND CARE COMMUNICATIONS

We may contact you about appointments, follow-up, test results, referrals, care coordination, medication matters, portal activity, or other health-related communications as permitted by law. You should keep your contact information current and tell us about reasonable confidential-communication requests.

13. TREATMENT ALTERNATIVES AND HEALTH-RELATED SERVICES

HIPAA may permit communications about treatment alternatives, case management, care coordination, or health-related services. Marketing communications that require authorization will not be treated as ordinary health care operations merely because they involve health.

14. REQUIRED BY LAW

We may use or disclose PHI when required by federal, state, or other applicable law, but only to the extent and under the conditions the law requires.

15. PUBLIC HEALTH

As permitted or required by law, PHI may be disclosed for public-health activities, such as disease reporting, public-health surveillance, certain product recalls, or other authorized public-health functions.

16. ABUSE, NEGLECT, OR DOMESTIC VIOLENCE

We may make disclosures concerning suspected abuse, neglect, or domestic violence when applicable law permits or requires them and applicable safeguards are satisfied.

17. HEALTH OVERSIGHT

PHI may be disclosed to authorized health-oversight agencies for activities such as audits, investigations, inspections, licensure, disciplinary matters, or other legally authorized oversight.

18. JUDICIAL AND ADMINISTRATIVE PROCEEDINGS

We may disclose PHI in response to qualifying court or administrative processes when HIPAA and other applicable law permit or require disclosure. A subpoena or request does not automatically authorize unrestricted release of an entire medical record.

19. LAW ENFORCEMENT

We may disclose PHI for law-enforcement purposes only as permitted by HIPAA and other applicable law. Requests are evaluated according to their legal authority, scope, and any additional state protections.

20. CORONERS, MEDICAL EXAMINERS, AND FUNERAL DIRECTORS

We may disclose PHI to coroners, medical examiners, and funeral directors as permitted by law for their authorized duties.

21. ORGAN AND TISSUE DONATION

Where applicable and permitted, PHI may be disclosed to organizations involved in organ, eye, or tissue donation and transplantation.

22. RESEARCH

PHI may be used or disclosed for research only when HIPAA's authorization or applicable waiver/approval requirements are satisfied. MDTelemed does not claim that every internal analysis constitutes research.

23. SERIOUS THREAT TO HEALTH OR SAFETY

HIPAA may permit disclosure of PHI to avert a serious and imminent threat to health or safety when the regulatory requirements are met and disclosure is consistent with applicable law and professional standards.

24. SPECIALIZED GOVERNMENT FUNCTIONS

HIPAA permits specified disclosures for certain military, veterans, national-security, protective-service, correctional, and other specialized governmental functions. MDTelemed will apply these provisions only when legally applicable.

25. WORKERS' COMPENSATION

PHI may be disclosed as authorized by and to the extent necessary to comply with workers' compensation or similar programs, subject to applicable law.

26. USES AND DISCLOSURES REQUIRING AUTHORIZATION

Uses and disclosures not otherwise permitted by HIPAA or another applicable law generally require your written authorization. If you give an authorization, you may revoke it in writing as allowed by law, except to the extent action has already been taken in reliance on it.

27. PSYCHOTHERAPY NOTES

Most uses and disclosures of psychotherapy notes, when the HIPAA definition applies, require authorization subject to limited exceptions. Ordinary mental-health progress notes are not automatically 'psychotherapy notes' under HIPAA.

28. MARKETING

Uses or disclosures of PHI for marketing require authorization when HIPAA requires it. MDTelemed's promotional email or text program must be separately coordinated with HIPAA, TCPA and other communications/consumer requirements; consent to receive care is not automatically consent to every promotional communication.

29. SALE OF PHI

MDTelemed will not sell PHI in a manner that requires HIPAA authorization without obtaining the authorization required by law. The technical meaning of 'sale of PHI' is governed by HIPAA and should not be confused with every vendor payment or service arrangement.

30. FUNDRAISING

If MDTelemed conducts HIPAA-regulated fundraising, required notice and opt-out rights will be provided. No fundraising program is promised by this Notice.

31. SUBSTANCE USE DISORDER RECORDS

HIPAA Notice requirements were modified to address certain substance use disorder patient records protected by 42 CFR Part 2, with compliance changes effective in 2026. MDTelemed does not offer OUD/buprenorphine treatment under the current service model. Whether MDTelemed is itself a Part 2 program is a separate legal determination and must not be assumed merely because psychiatric care is offered.

32. PART 2 INFORMATION RECEIVED BY A HIPAA ENTITY

When MDTelemed lawfully receives records protected by 42 CFR Part 2, their use, disclosure, redisclosure, segregation, consent, and notice treatment must comply with the applicable HIPAA/Part 2 framework and any more protective law.

33. REPRODUCTIVE HEALTH NPP CHANGES

The 2024 HIPAA reproductive-health rule was substantially affected by a federal court ruling in June 2025. HHS states that several reproductive-health NPP provisions were vacated, while remaining NPP modifications were not disturbed and had a February 16, 2026 compliance date. MDTelemed will follow the current operative federal rule and will not publish vacated requirements as if they remain law.

34. MORE STRINGENT STATE LAW

HIPAA can be supplemented by state law that is more stringent. Because MDTelemed intends national practice, the Notice and operational workflows must account for applicable state restrictions rather than assume a single Nevada privacy rule governs all patients.

35. YOUR RIGHT TO INSPECT AND OBTAIN A COPY

You generally have the right to inspect and obtain a copy of PHI in a designated record set as provided by HIPAA, subject to permitted exceptions. MDTelemed has indicated that patient records can be made available in PDF format. Applicable law governs timing, fees, form/format, denials, and review rights.

36. ELECTRONIC COPY

If PHI is maintained electronically and applicable law requires an electronic copy in a requested form or format that is readily producible, MDTelemed will provide it as required. This Notice does not promise CSV, Excel, HL7, FHIR, or other formats that have not been verified as supported.

37. RIGHT TO REQUEST AMENDMENT

You may request amendment of PHI in a designated record set as permitted by HIPAA. MDTelemed may deny a request for reasons allowed by law. A request for amendment does not permit deletion or silent rewriting of the original medical record.

38. RIGHT TO AN ACCOUNTING OF DISCLOSURES

You may request an accounting of certain disclosures of PHI as provided by HIPAA. The accounting does not include every use or disclosure; statutory and regulatory exclusions apply.

39. RIGHT TO REQUEST RESTRICTIONS

You may ask MDTelemed to restrict certain uses or disclosures for treatment, payment, or health care operations. MDTelemed generally is not required to agree to every requested restriction, except where HIPAA creates a mandatory restriction.

40. SELF-PAY RESTRICTION TO HEALTH PLAN

When HIPAA's requirements are satisfied, a patient who pays a health care item or service out of pocket in full may require a covered provider not to disclose PHI about that item or service to a health plan for payment or health care operations. Because MDTelemed is currently self-pay, this right can be particularly relevant if a health-plan disclosure would otherwise occur.

41. CONFIDENTIAL COMMUNICATIONS

You may request that MDTelemed communicate with you about medical matters by alternative means or at alternative locations. Reasonable requests will be handled as required by law.

42. PAPER COPY

You have the right to obtain a paper copy of this Notice upon request even if you agreed to receive it electronically.

43. PERSONAL REPRESENTATIVES

A legally authorized personal representative may exercise privacy rights on your behalf to the extent required by HIPAA and applicable state law. Authority must be verified, and exceptions may apply in abuse, neglect, endangerment, minor-consent, or other circumstances.

44. MINORS

Parents and guardians often act as a minor's personal representative, but important exceptions exist. State law may allow minors to consent to specified services and may protect the confidentiality of those services. MDTelemed must apply the law of the relevant jurisdiction rather than automatically release every pediatric record to a parent.

45. DECEASED PERSONS

HIPAA protects a decedent's PHI for the period established by law. Personal representatives and family disclosures are governed by HIPAA and applicable state law.

46. BREACH NOTIFICATION

MDTelemed is required to provide breach notifications when the HIPAA Breach Notification Rule or other applicable law requires them. Not every security incident is legally a reportable breach; each event must be assessed under the governing standard.

47. MDTelemed'S DUTY TO PROTECT PHI

MDTelemed is required by law to maintain the privacy and security of PHI, provide this Notice where required, follow the duties and privacy practices described in the current Notice, and notify affected individuals when legally required following a breach.

48. SECURITY LANGUAGE

This Notice does not promise specific encryption algorithms, audit certifications, uptime, backup geography, MFA implementation, or security architecture that has not been independently verified. MDTelemed will maintain safeguards required by applicable law and its verified security program.

49. WEBSITE, COOKIES, PIXELS, AND TRACKING TECHNOLOGIES

Website and app tracking can raise HIPAA, FTC, state consumer-health-data, wiretap, privacy, advertising, and consent issues. MDTelemed's use of cookies, analytics, pixels, session technologies, or advertising tools must be governed by the separate Website & Consumer Privacy Policy and technical compliance program. This NPP does not authorize disclosure of PHI to advertising vendors merely because a cookie banner exists.

50. PORTAL AND ELECTRONIC COMMUNICATION

Patient portals, email, SMS, and secure messaging carry privacy and security risks. MDTelemed will use these channels according to applicable law, verified technical safeguards, and patient communication preferences where required.

51. RECORDING AND AI TELESCRIBE CONSENT

If audio is captured or processed for AI telescribing, MDTelemed must comply with applicable consent, wiretap/recording, HIPAA, state privacy, retention, and vendor-contract requirements. This Notice does not by itself substitute for any separate recording consent required by law.

52. TELEMEDICINE PRIVACY

Patients should use a reasonably private location and device when possible. MDTelemed will use reasonable safeguards, but cannot control people physically present at the patient's location, the patient's device security, or networks outside MDTelemed's control.

53. FAMILY AND FRIENDS INVOLVED IN CARE

With your agreement, opportunity to object, authorization, or as otherwise permitted by HIPAA, MDTelemed may share relevant PHI with family, friends, caregivers, or others involved in your care or payment for care. Disclosures should be limited to information relevant to that person's involvement.

54. DISASTER RELIEF

When permitted by HIPAA, MDTelemed may disclose limited PHI to authorized disaster-relief organizations or others to assist with notification and coordination.

55. COMMUNICATION PREFERENCES

You are responsible for keeping contact details accurate. Shared phones, family email accounts, voicemail, unlocked devices, and notification previews can expose information to others. Tell MDTelemed if you need a reasonable confidential-communication arrangement.

56. NO RETALIATION FOR PRIVACY COMPLAINTS

MDTelemed will not retaliate against you for exercising HIPAA rights or filing a good-faith privacy complaint.

57. COMPLAINTS TO MDTelemed

You may complain if you believe your privacy rights were violated. Send privacy complaints to: MDTelemed LLC, 304 S Jones Blvd #4872, Las Vegas, NV 89107; Support@MDTelemed.com. The production Notice should identify the formal privacy official/title and a verified phone number before publication if required by the final contact architecture.

58. COMPLAINTS TO HHS OCR

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. Filing an internal complaint is not a prerequisite to exercising a right to complain to HHS.

59. NOTICE DELIVERY

For a direct-treatment covered provider, the HIPAA Notice generally must be provided no later than the first service delivery, including electronic service delivery, with special timing for emergency treatment. MDTelemed should provide the Notice electronically during registration/first service and keep it continuously accessible on its website.

60. ACKNOWLEDGMENT OF RECEIPT

MDTelemed should make the HIPAA-required good-faith effort to obtain acknowledgment of receipt of the Notice at first service delivery. A patient's refusal to acknowledge receipt does not eliminate lawful care or lawful HIPAA uses/disclosures; MDTelemed should document the effort and reason acknowledgment was not obtained.

61. ELECTRONIC ACKNOWLEDGMENT

HIPAA permits electronic acknowledgment mechanisms. MDTelemed's registration workflow should preserve auditable evidence of the Notice version presented, date/time, patient action, and any documented refusal or inability to acknowledge.

62. WEBSITE POSTING

A covered entity maintaining a website that provides information about customer services or benefits must prominently post and make its Notice available there. MDTelemed should provide a durable, printable copy and not bury the Notice solely inside account settings.

63. NOTICE AVAILABILITY

A current copy of this Notice will be made available to any person who asks for it as required by law.

64. CHANGES TO THIS NOTICE

MDTelemed may change this Notice and its privacy practices as permitted by law. Material changes require revision and distribution/availability steps required by HIPAA. The revised Notice may apply to PHI MDTelemed already maintains to the extent permitted by law.

65. STATE-SPECIFIC ADDENDA

MDTelemed may use state-specific privacy addenda where necessary. These addenda should be incorporated into the Notice architecture and patient-location workflow so that more stringent requirements are not lost inside a generic national notice.

66. RELATIONSHIP TO WEBSITE PRIVACY POLICY

The Website & Consumer Privacy Policy governs categories of data and activities beyond HIPAA PHI, including general website visitors, cookies, analytics, advertising technologies, consumer-health-data statutes, and state consumer privacy rights. Where HIPAA and another privacy law both apply, MDTelemed will apply the controlling requirements.

67. RELATIONSHIP TO MEDICAL RECORD POLICY

Medical-record access, amendment, retention, release, proxy access, and legal holds are addressed in related MDTelemed policies. Those operational policies must remain consistent with this Notice.

68. RELATIONSHIP TO BEHAVIORAL HEALTH POLICY

Psychiatric and behavioral-health information may receive additional protection under state law. Part 2 applies only when its statutory/regulatory conditions are met; psychiatric treatment alone does not automatically make MDTelemed a Part 2 program.

69. RELATIONSHIP TO PEDIATRIC POLICY

Minor consent and confidentiality vary by state and service. Pediatric portal access, proxy access, billing communications, pharmacy communications, laboratory results, and record release must be configured to avoid exposing confidential minor services unlawfully.

70. RELATIONSHIP TO MARKETING/SMS POLICY

Clinical reminders and promotional communications are legally distinct. MDTelemed should preserve opt-in/opt-out records and apply HIPAA, TCPA, CAN-SPAM, state automatic-renewal/consumer law, and other applicable rules to the appropriate communication.

71. RELATIONSHIP TO QUALITY/PEER REVIEW

HIPAA permits qualifying health-care operations, including certain quality activities, but that does not mean every QA document is part of the patient's designated record set or that every peer-review document is privileged. addresses those distinctions.

72. NO WAIVER OF MORE PROTECTIVE RIGHTS

Nothing in this Notice is intended to waive a privacy, confidentiality, access, consent, or complaint right that applicable law makes nonwaivable.

73. EFFECTIVE DATE

74. CONTACT

MDTelemed LLC 304 S Jones Blvd #4872 Las Vegas, NV 89107 Business Administration / Privacy Contact: Support@MDTelemed.com

75. PATIENT RIGHTS — QUICK REFERENCE

Get a copy of your health information as provided by law. Ask us to correct or amend qualifying health information. Request confidential communications. Ask us to limit certain uses or disclosures. Receive the mandatory self-pay health-plan restriction when HIPAA's conditions are satisfied. Request an accounting of certain disclosures. Get a paper copy of this Notice. Choose someone legally authorized to act for you. Complain to MDTelemed or HHS OCR without retaliation. Confirm whether MDTelemed LLC itself is the HIPAA covered provider for all clinical encounters or whether one or more physician-owned professional entities deliver care. The NPP must identify the correct covered entity/entities. Resolve the stated desire for entity separation against the current instruction that the patient contracts with MDTelemed LLC. Corporate-practice-of-medicine counsel must approve the 50-state structure before the NPP describes it publicly. Appoint and identify the HIPAA privacy official/contact and verify a telephone number for the final NPP. Confirm whether MDTelemed is or will become a 42 CFR Part 2 program. Do not state that it is one without legal/operational evidence. Implement the February 16, 2026 Part 2-related NPP changes using the current HHS model language and current operative regulations. Recheck the June 2025 reproductive-health-rule vacatur and any subsequent HHS/court action immediately before launch; do not restore vacated NPP language without authority. Build a 50-state more-stringent privacy-law matrix and state-specific NPP addenda, including minors, mental health, HIV/STI, genetic, reproductive/sexual-health, biometric, consumer-health-data, and medical-record rules where applicable. Complete a technical inventory of cookies, pixels, analytics, session replay, advertising tools, SDKs, URLs, query strings, portal pages, authenticated pages, and data flows. Block impermissible PHI disclosure to tracking/advertising vendors. Verify every vendor receiving PHI, determine business-associate status, execute required BAAs, and document permitted uses/disclosures. Verify the AI telescribe vendor architecture, whether audio is recorded/stored, retention period, training/data-use terms, subprocessors, security controls, BAA, and state recording-consent workflow. Confirm exact medical-record delivery functionality. Public promises should remain PDF only unless additional formats are technically verified and legally required. Implement first-service NPP delivery and electronic acknowledgment logging, including refusal/failure documentation. Maintain version history showing exactly which NPP version each patient received. Implement rights-request workflows for access, amendment, accounting, restrictions, confidential communications, representatives, complaints, and state-law requests. Create the self-pay restriction workflow for qualifying disclosures to health plans. Coordinate breach notification with and incident response. Create pediatric proxy/confidentiality controls that prevent automatic parental disclosure where a minor controls the relevant information under law. Separate treatment communications from promotional email/SMS consent and opt-out workflows. Verify whether any fundraising, research, data commercialization, or marketing program exists before making public representations. Have qualified HIPAA, Part 2, FTC, consumer-health-data, state medical privacy, telehealth, and 50-state health-law counsel approve the production NPP.

76. PRIMARY REFERENCES

77. C.F.R. § 164.520 — HIPAA Notice of Privacy Practices.

78. C.F.R. Parts 160 and 164 — HIPAA Privacy, Security, Breach Notification, and Enforcement Rules.

U.S. Department of Health and Human Services, Office for Civil Rights, Notice of Privacy Practices for Protected Health Information. HHS, Revised February 2026 Model Notice of Privacy Practices for HIPAA Covered Health Care Providers. HHS, Model Notices of Privacy Practices — February 2026 Part 2-related updates.

79. U.S.C. § 290dd-2 and 42 C.F.R. Part 2 — confidentiality of substance use disorder patient records, when applicable.

HHS, HIPAA Privacy Rule Final Rule to Support Reproductive Health Care Privacy — current guidance regarding the June 18, 2025 partial vacatur and surviving NPP modifications. Applicable state medical-privacy, mental-health, minor-consent/confidentiality, genetic, HIV/STI, reproductive-health, consumer-health-data, biometric, breach-notification, and medical-record laws.

80. RELATED MDTelemed POLICIES

Website & Consumer Privacy Policy; Terms of Use; Patient Bill of Rights & Responsibilities; Telehealth Informed Consent; Pediatric Care & Minor Rights; Behavioral Health; Data Security & Cybersecurity; Grievances & Complaints; Medical Records Access; Records Retention; Breach/Incident Response; Third-Party Business Associates & BAAs; Quality Assurance & Peer Review; and later state/privacy addenda as adopted.

81. END OF

WEBSITE AND CONSUMER PRIVACY POLICY

1. MDTELEMED LLC

2. WEBSITE & CONSUMER PRIVACY POLICY

Version 1.0 | September 15, 2026

Applies to MDTelemed LLC websites, patient-facing digital services, communications, and related online interactions

3. PURPOSE, SCOPE, AND PRIVACY COMMITMENT

MDTelemed LLC (“MDTelemed,” “we,” “us,” or “our”) provides telemedicine services through licensed medical doctors and related digital services. This Policy explains how MDTelemed collects, uses, discloses, retains, and otherwise processes personal information when individuals visit our public website, create or use an account, communicate with us, receive administrative services, interact with our patient-facing technology, or otherwise use services to which this Policy is posted or linked. MDTelemed recognizes that information connected with health care can be exceptionally sensitive. Our privacy program is designed to distinguish among different legal categories of information rather than assuming that every item of information is governed by the same law. Depending on the context, information may be protected by HIPAA, state medical-record confidentiality laws, state consumer-health-data laws, general state privacy laws, communications laws, or other federal or state requirements. This Policy is intended to provide a clear public description of our privacy practices. It does not create a representation that a particular statute applies where the statute itself provides an exemption or exclusion. It also does not expand MDTelemed’s legal obligations beyond applicable law or an express contractual commitment.

3.1 Services Covered

This Policy applies to MDTelemed’s public website, account-registration pages, patient portal and other patient-facing online functions, telemedicine access technology, administrative communications, customer support, billing and membership interactions, electronic forms, secure messaging, and other digital services that expressly link to this Policy. MDTelemed may provide care through synchronous video, audio-only/telephone, asynchronous communications, and secure messaging when clinically appropriate and legally permitted. A patient’s physical location is collected or confirmed in connection with telemedicine care because physician licensure and other legal requirements generally depend on where the patient is physically located at the time of care.

3.2 Services and Information Not Governed Solely by This Policy

Protected Health Information (PHI) subject to HIPAA is also governed by MDTelemed’s separate Notice of Privacy Practices. Consumer health data subject to a state consumer-health-data statute may also be governed by MDTelemed’s Consumer Health Data Privacy Policy and State Privacy Rights Supplement. Employment and workforce information is governed by separate workforce policies and applicable law. Third-party websites, applications, pharmacies, laboratories, imaging facilities, and other independent services may have their own privacy practices. Clinical consent, pediatric consent, behavioral-health privacy, AI-assisted documentation, electronic communications, and other specialized topics are addressed in separate MDTelemed policies or consents where appropriate.

4. INFORMATION WE MAY COLLECT

The information MDTelemed collects depends on how an individual interacts with us. We collect only information reasonably related to providing, securing, administering, improving, and lawfully operating our services, and for other purposes described in this Policy or disclosed at the point of collection.

4.1 Identifiers and Contact Information

Name, date of birth, mailing address, email address, telephone number, and account identifiers. Usernames, authentication information, verification information, and other information used to establish or protect an account. Parent, legal guardian, caregiver, proxy, or authorized-representative information when a person acts for a patient. Physical location or state at the time of a telemedicine encounter, and other location information when required for care, safety, licensure, or legal compliance.

4.2 Health and Clinical Information

When an individual seeks medical care, MDTelemed may collect health information such as symptoms, medical history, diagnoses, medications, allergies, treatment information, photographs or other patient-submitted media, laboratory or imaging information, clinical communications, physician documentation, and information necessary to coordinate care. To the extent this information is PHI, MDTelemed handles it under HIPAA and the Notice of Privacy Practices in addition to other applicable law. MDTelemed provides clinical care through human medical doctors. MDTelemed does not represent an autonomous artificial-intelligence system as the treating physician. MDTelemed may use AI-assisted telescribing or documentation technology to assist the physician in creating clinical documentation. The specific collection, processing, and consent rules for that function are addressed in MDTelemed’s separate AI Telescribe, Audio Capture & Documentation Consent.

4.3 Payment, Membership, and Transaction Information

Billing name and address, transaction amount, payment status, membership status, refunds, credits, and related transaction records. Payment-card or bank information may be processed by payment technology used to complete transactions. MDTelemed does not state in this Policy that it stores or does not store full payment credentials unless that implementation has been technically verified. Self-pay documentation, Good Faith Estimate information, and other financial-administration information.

4.4 Communications and Support Information

Emails, text messages, secure messages, customer-service communications, complaints, grievances, survey responses, and other communications with MDTelemed. Communication preferences, including consent or opt-out choices for marketing and text messages. Information voluntarily submitted through forms, questionnaires, feedback tools, or support requests.

4.5 Device, Network, and Usage Information

When individuals use our websites or digital services, MDTelemed and service providers acting on our behalf may collect technical information such as IP address, browser type, device type, operating system, approximate location derived from network information, referring or exit pages, timestamps, pages or features viewed, interactions with content, error and diagnostic information, and security-related events. Some of this information may be collected through cookies, pixels, software development kits, local storage, logs, or similar technologies. Because health-related websites and authenticated patient services can create heightened privacy risks, MDTelemed’s use of tracking technology must be configured and governed according to applicable HIPAA and state-law requirements. A general cookie banner is not treated as a substitute for a HIPAA authorization where HIPAA requires an authorization.

4.6 Information From Other Sources

MDTelemed may receive information from a parent or guardian, authorized representative, treating or referring health professional, pharmacy, laboratory, imaging facility, payment or fraud-prevention service, communications provider, identity-verification service, or other person or entity involved in providing or supporting a requested service. The precise sources depend on the service and the patient’s choices.

5. HOW WE USE PERSONAL INFORMATION

MDTelemed may use personal information for the following purposes, subject to applicable law and, for PHI, the separate HIPAA Notice of Privacy Practices.

5.1 Provide and Administer Telemedicine Services

Create and administer patient accounts. Verify identity, age, parent/guardian authority, and patient location where appropriate. Connect a patient with an MD licensed or otherwise legally authorized to provide care in the patient’s location. Support video, audio-only, asynchronous, secure-messaging, and other permitted telemedicine modalities. Support prescriptions, referrals, laboratory testing, imaging, diagnostic testing, results management, follow-up, and care coordination when ordered or recommended by the physician. Maintain medical and administrative records as required or permitted by law.

5.2 Safety, Security, Fraud Prevention, and Compliance

Authenticate users and protect accounts. Detect, investigate, and respond to suspected fraud, abuse, unauthorized access, cybersecurity events, or violations of MDTelemed terms. Maintain audit information and other records required for security, privacy, clinical, financial, or legal compliance. Comply with court orders, subpoenas, reporting obligations, licensing requirements, and other legal processes when applicable. Protect patients, physicians, workforce members, MDTelemed, and others from threats to safety or unlawful conduct.

5.3 Communications

MDTelemed may send transactional or service-related communications concerning appointments, account activity, prescriptions, laboratory or imaging coordination, results, billing, membership, privacy or security notices, policy updates, and other operational matters. MDTelemed may also send promotional email or text communications where permitted by law and consistent with the individual’s consent and preferences. Marketing consent is not a condition of receiving medical treatment unless legally permitted and clearly disclosed.

5.4 Service Improvement and Analytics

MDTelemed may use information to understand how its services function, troubleshoot technical issues, improve usability, measure service performance, perform quality activities, and develop or improve services. Where such activities involve PHI, they must be conducted under a HIPAA permission, a valid authorization, or another lawful mechanism. MDTelemed will not characterize data as “anonymous” or “de-identified” unless the applicable legal or technical standard has actually been satisfied.

6. HOW AND WHY INFORMATION MAY BE DISCLOSED

MDTelemed does not use the word “share” to imply that every disclosure is a sale or advertising disclosure. Information may be disclosed for health care, operational, legal, security, and other purposes. PHI disclosures are additionally governed by the Notice of Privacy Practices.

6.1 Physicians and Workforce Members

Information may be made available to MDTelemed physicians and authorized workforce members who need it to provide care, administer services, perform privacy or security functions, address complaints, process payments, or carry out other authorized responsibilities. Access should be limited according to role and legitimate need.

6.2 Service Providers and Contractors

MDTelemed may use service providers to support hosting, communications, payment processing, identity verification, e-prescribing, clinical documentation, AI-assisted telescribing, analytics, security, customer support, laboratory or imaging coordination, and other functions. MDTelemed currently describes its technology stack as proprietary and does not identify specific vendors in this Policy unless their identity has been verified and disclosure is required or appropriate. When a service provider is a HIPAA business associate, MDTelemed will use a Business Associate Agreement when required by HIPAA. A vendor’s access to information must also satisfy applicable privacy, security, consumer-health-data, and contractual requirements.

6.3 Pharmacies, Laboratories, Imaging Facilities, and Other Care Participants

At the patient’s direction or as otherwise permitted by law, information may be disclosed to pharmacies, laboratories, imaging facilities, specialists, emergency services, or other health care participants to facilitate prescriptions, testing, referrals, treatment, follow-up, or care coordination.

6.4 Legal, Regulatory, Public Health, and Safety Disclosures

MDTelemed may use or disclose information when required or permitted by law, including in response to valid legal process, licensing-board requirements, public-health obligations, mandatory reporting duties, or circumstances involving serious threats to health or safety. The existence and scope of any disclosure depend on the applicable law and facts; this Policy does not promise that MDTelemed will disclose information whenever a request is made.

6.5 Corporate Transactions

If MDTelemed is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, information may be reviewed or transferred as permitted by applicable law and subject to required protections. PHI remains subject to HIPAA where HIPAA applies.

7. COOKIES, PIXELS, ANALYTICS, AND ONLINE TRACKING

MDTelemed expects to use cookies and related technologies for functions such as authentication, security, preferences, analytics, service improvement, and marketing. The actual technologies deployed may change. MDTelemed therefore does not state that any particular named advertising or analytics vendor is currently deployed unless verified.

7.1 Essential Technologies

Certain technologies may be necessary to maintain sessions, authenticate users, remember privacy preferences, prevent fraud, protect forms, balance traffic, or provide requested digital functionality. Where legally permitted, these technologies may operate without an optional advertising consent because they are necessary for the requested service or security function.

7.2 Analytics and Performance Technologies

Analytics technologies may help MDTelemed understand aggregate service usage, diagnose errors, and improve user experience. Their configuration must be assessed for the type of information transmitted, the page or service on which they operate, whether the user is authenticated, the recipient’s role, and whether HIPAA or a state privacy law requires a contract, authorization, consent, opt-out, or other control.

7.3 Advertising and Marketing Technologies

Marketing technologies may be used on appropriate public-facing portions of MDTelemed’s digital properties where legally permitted. MDTelemed will not intentionally use advertising technologies to disclose PHI for marketing without a lawful HIPAA basis, including authorization when required. Tracking technologies should not be deployed in authenticated patient areas in a manner that impermissibly discloses PHI.

7.4 Cookie and Privacy Choices

Where required, MDTelemed will provide mechanisms to accept, reject, or manage non-essential cookies and other privacy choices. Browser settings may also permit users to limit cookies. Disabling some technologies may affect functionality. A cookie preference does not replace any separate authorization or consent required by health privacy law.

8. HIPAA AND PROTECTED HEALTH INFORMATION

MDTelemed intends to operate its clinical services in compliance with HIPAA when MDTelemed is acting as a covered health care provider or otherwise subject to HIPAA. HIPAA governs PHI maintained or transmitted by a covered entity or business associate, subject to statutory and regulatory definitions and exceptions. MDTelemed’s separate Notice of Privacy Practices describes patient rights and MDTelemed’s permitted uses and disclosures of PHI. That notice, rather than this general website policy, is the primary patient-facing HIPAA notice required by 45 C.F.R. § 164.520. If this Policy and the Notice of Privacy Practices appear to conflict with respect to PHI, MDTelemed will apply the Notice of Privacy Practices and applicable law to the PHI at issue.

9. CONSUMER HEALTH DATA AND STATE PRIVACY LAWS

Several states regulate consumer health data outside traditional HIPAA frameworks. These laws can apply to health-related information, precise location information connected to health services, inferences, or other data even when the information is not PHI. They may also contain exemptions for HIPAA-regulated entities or HIPAA-regulated data, so applicability must be determined under the specific statute. MDTelemed will maintain a separate Consumer Health Data Privacy Policy and State Privacy Rights Supplement to address rights and disclosures that cannot be accurately compressed into one national statement. Those documents may address, where applicable, categories of consumer health data, sources, purposes, sharing, processors or third parties, consumer requests, appeals, consent, authorization for sale, geofencing restrictions, and material changes.

10. CHILDREN, MINORS, PARENTS, AND GUARDIANS

MDTelemed provides telemedicine services to patients of all ages, including infants, children, and adolescents. The ability of a minor to consent to treatment, control confidential information, or authorize disclosure varies substantially by state and by the type of service. MDTelemed may collect information about a parent, legal guardian, or other authorized person to establish authority to consent or act for a minor. MDTelemed will not rely on a single national age rule where state law provides a different rule for a particular service. Information concerning pediatric consent, confidential adolescent services, parent or guardian access, emancipated minors, mandatory reporting, and related matters is addressed in the Pediatric Care, Parent/Guardian Consent & Minor Rights Policy and the 50-State Minor Consent & Confidentiality Addendum.

11. AI-ASSISTED TELEscribing AND AUDIO PROCESSING

MDTelemed’s clinical model is physician-led. Medical diagnosis, treatment, prescribing decisions, referrals, and clinical judgment are made by human MD physicians, not by an autonomous AI clinician. MDTelemed may use AI-assisted telescribing technology to assist the physician in documenting an encounter. Such technology may process audio or encounter information for documentation purposes. This Privacy Policy does not state that raw audio is permanently stored, immediately deleted, used for model training, or retained for a particular period because those technical facts must be verified against the implemented system before MDTelemed makes a public promise. Before implementation, MDTelemed should document and disclose the actual audio-processing pathway, retention period, vendor or internal processing role, training use or prohibition, security controls, correction process, and patient consent/declination workflow in its AI Telescribe, Audio Capture & Documentation Consent and related internal data-flow documentation.

12. DATA SECURITY

MDTelemed uses administrative, technical, and physical safeguards designed to protect information appropriate to the nature of the information and applicable legal requirements. No internet-connected system can be guaranteed to be completely secure, and MDTelemed does not promise absolute security. The earlier MDTelemed draft referenced specific encryption algorithms, multi-factor authentication requirements, intrusion-detection systems, geographic backup arrangements, quarterly recovery testing, a 99.9% uptime commitment, and SOC 2 Type II audits. Those statements are not repeated here because MDTelemed has not yet verified that each technical specification or certification is implemented. Public privacy language should describe verified controls only. MDTelemed will maintain more detailed internal security policies, risk-management procedures, access controls, incident-response procedures, workforce safeguards, and vendor requirements as appropriate. Security practices may evolve in response to technology, risk assessments, legal requirements, and recognized security practices.

13. DATA RETENTION AND DELETION

MDTelemed retains information for periods reasonably necessary to provide services, satisfy medical-record retention requirements, comply with legal and regulatory obligations, resolve disputes, enforce agreements, maintain security and audit records, and support legitimate operational needs. Medical-record retention periods vary by state and may differ for adults and minors. Accordingly, MDTelemed does not use a single seven-year rule for every record and every state. The Medical Record Retention & Destruction Notice and MDTelemed’s internal 50-state retention schedule govern applicable clinical retention periods. A consumer request to delete information does not necessarily require deletion of medical records or other information that MDTelemed must or is permitted to retain under HIPAA, state medical-record law, litigation-hold requirements, fraud-prevention obligations, or another legal exception. Where deletion rights apply, MDTelemed will process them according to applicable law and the relevant privacy supplement.

14. INDIVIDUAL PRIVACY RIGHTS

Privacy rights vary according to the type of information, the law governing that information, and the individual’s state. Depending on applicable law, an individual may have rights to access, obtain a copy, correct, amend, delete, restrict, opt out, withdraw consent, request confidential communications, obtain an accounting or list of certain disclosures, appeal a denied privacy request, or obtain information about categories of data and recipients. HIPAA rights are described in the Notice of Privacy Practices. State consumer and consumer-health-data rights are described in the State Privacy Rights Supplement and Consumer Health Data Privacy Policy.

14.1 Submitting a Privacy Request

Unless a more specific method is provided in an applicable notice, privacy requests may be sent to Support@MDTelemed.com or mailed to MDTelemed LLC, 304 S Jones Blvd #4872, Las Vegas, NV 89107. MDTelemed may need to verify the requester’s identity and authority before acting on a request.

14.2 Authorized Agents and Representatives

Where permitted by law, an individual may use an authorized agent or personal representative. MDTelemed may request documentation sufficient to verify the representative’s authority and protect the patient from unauthorized disclosure.

14.3 Appeals

If applicable state law provides a right to appeal denial of a consumer privacy request, MDTelemed will provide an appeal process in the applicable state privacy notice and respond within the period required by that law.

15. MARKETING, EMAIL, AND TEXT MESSAGES

MDTelemed may communicate by email, text message, telephone, secure messaging, or other electronic means for administrative and care-related purposes. Because ordinary email and SMS may not always be secure, patients should avoid sending sensitive medical information through an unsecured channel when a secure channel is available. Promotional communications will be managed according to applicable consent and opt-out requirements. Individuals may opt out of promotional email using the unsubscribe mechanism provided in the message. Text-message opt-out and related terms will be addressed in MDTelemed’s SMS/Text Messaging Terms & Consent. Opting out of marketing does not necessarily stop non-marketing communications that are necessary to provide requested services, protect an account, or comply with law.

16. DO NOT SELL / SHARE AND TARGETED ADVERTISING RIGHTS

Some state laws use defined terms such as “sell,” “share,” “targeted advertising,” or “cross-context behavioral advertising.” Whether a particular disclosure falls within one of these definitions depends on the law and the actual data flow. MDTelemed will not state categorically that it “never sells” or “never shares” information for statutory purposes until its advertising, analytics, and vendor data flows have been technically and legally mapped. Where applicable law grants an opt-out right, MDTelemed will provide the required mechanism and disclosures in the State Privacy Rights Supplement or a linked privacy-choice interface. MDTelemed will not sell PHI in violation of HIPAA. Certain state consumer-health-data laws may impose separate authorization requirements on a statutory “sale” of consumer health data.

17. THIRD-PARTY WEBSITES AND SERVICES

MDTelemed services may link to or interact with independent pharmacies, laboratories, imaging centers, payment services, or other third parties. A link or technical connection does not necessarily mean MDTelemed controls that third party’s privacy practices. Individuals should review the third party’s privacy notice when the third party independently determines how it processes information. When a third party processes PHI on MDTelemed’s behalf as a business associate, HIPAA contractual requirements apply as appropriate. When a third party acts independently, different privacy rules may apply.

18. DATA TRANSFERS AND SERVICE LOCATION

MDTelemed is a United States telemedicine service. Information may be processed or stored in locations used by MDTelemed or its service providers, subject to applicable contractual and legal safeguards. This Policy does not promise that all information remains physically within a particular state or data center unless MDTelemed later verifies and adopts such a requirement.

19. PRIVACY INCIDENTS AND BREACH NOTIFICATION

MDTelemed maintains procedures to evaluate suspected privacy or security incidents. If an incident constitutes a reportable breach, MDTelemed will provide notices required by applicable law. The timing, recipients, and content of a notice depend on the law governing the affected information and the facts of the incident. MDTelemed does not promise a universal 24-hour patient notification period. HIPAA and state breach-notification laws contain different standards, and premature promises can conflict with required investigation, law-enforcement delay, or statutory timing rules. Where an incident involves information outside HIPAA, other laws may apply, including state breach laws and, for entities within its scope, the Federal Trade Commission’s Health Breach Notification Rule.

20. CHANGES TO THIS POLICY

MDTelemed may update this Policy to reflect changes in law, technology, services, or privacy practices. The revised Policy will identify its effective date. If applicable law requires additional notice, consent, or authorization before a materially different use of information, MDTelemed will follow that requirement rather than relying solely on a website posting. Archived versions may be maintained as appropriate to document the privacy terms in effect at a particular time.

21. CONTACT MDTelemed

Questions, privacy requests, or complaints concerning this Website & Consumer Privacy Policy may be directed to: MDTelemed LLC Attn: Privacy / Business Administration 304 S Jones Blvd #4872 Las Vegas, NV 89107 Email: Support@MDTelemed.com For rights involving PHI, individuals should also consult MDTelemed’s Notice of Privacy Practices, which will identify the applicable HIPAA privacy contact and the right to complain to the U.S. Department of Health and Human Services Office for Civil Rights without retaliation.

22. RELATED MDTelemed PRIVACY AND LEGAL DOCUMENTS

Terms of Use & Terms of Service Telehealth Informed Consent Pediatric Care, Parent/Guardian Consent & Minor Rights Behavioral Health Services & Mental Health Privacy Security & Privacy Safeguards Statement Medical Records Access, Amendment & Release Policy Cookie, Tracking Technology & Analytics Policy Medical Record Retention & Destruction Notice HIPAA Notice of Privacy Practices Consumer Health Data Privacy Policy State Privacy Rights Supplement Electronic Communications, Electronic Records & E-SIGN Consent SMS/Text Messaging Terms & Consent AI Telescribe, Audio Capture & Documentation Consent

23. IMPLEMENTATION CONDITIONS BEFORE PUBLICATION

This section is included in Version 1.0 as an implementation-control checklist. It should be removed from the public website version after each item is verified and the corresponding disclosures are finalized. Complete a technical data-flow inventory for the public website, authenticated patient areas, telemedicine platform, cookies, pixels, analytics, advertising tools, session-replay tools, and mobile technologies. Identify every third party that receives personal information or PHI and determine whether it is a business associate, processor, independent controller/business, or other recipient. Verify the AI telescribe data flow, including whether audio is streamed, stored, retained, deleted, or used for model training; identify all processors and contractual restrictions. Verify actual security controls before making technical claims concerning encryption standards, MFA, audit logging, intrusion detection, backups, disaster recovery, uptime, SOC 2, penetration testing, or certifications. Confirm the implemented payment architecture and whether MDTelemed ever stores full payment-card or bank credentials. Confirm all consumer privacy request mechanisms, identity-verification workflow, opt-out interfaces, cookie preference tools, and state-law appeal procedures. Confirm the final list of states in which each privacy statute applies to MDTelemed as an entity and/or to particular data, including statutory HIPAA exemptions. Publish and cross-link the HIPAA Notice of Privacy Practices, Consumer Health Data Privacy Policy, State Privacy Rights Supplement, Cookie Policy, and AI Telescribe Consent before launch. Have qualified health-care/privacy counsel review the final launch version against the actual corporate and clinical structure, state launch footprint, vendor contracts, and technical implementation.

24. LEGAL AND REGULATORY REFERENCES

Health Insurance Portability and Accountability Act (HIPAA), 42 U.S.C. § 1320d et seq.; HIPAA Privacy, Security, and Breach Notification Rules, 45 C.F.R. Parts 160 and 164.

25. C.F.R. § 164.520 — Notice of Privacy Practices for protected health information.

U.S. Department of Health and Human Services, Office for Civil Rights, Model Notice of Privacy Practices for HIPAA Covered Health Care Providers, revised February 2026. U.S. Department of Health and Human Services, Office for Civil Rights, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (current guidance, including the 2024 federal-court limitation noted by HHS). Nevada Revised Statutes Chapter 603A, including Nevada consumer health data provisions enacted by SB 370 (2023). Washington My Health My Data Act, Wash. Rev. Code ch. 19.373, as applicable. Federal Trade Commission Act, 15 U.S.C. §§ 41–58, including prohibitions on unfair or deceptive acts or practices. Federal Trade Commission Health Breach Notification Rule, 16 C.F.R. Part 318, as applicable. Electronic Signatures in Global and National Commerce Act (E-SIGN), 15 U.S.C. § 7001 et seq., for electronic records and signatures where applicable. Applicable state medical-record confidentiality, breach-notification, consumer privacy, consumer-health-data, telehealth, minor-consent, communications, and professional-practice laws.

25.1 Primary online sources reviewed for Version 1.0

HHS — Model Notices of Privacy Practices (revised February 2026): https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/model-notices-privacy-practices/index.html HHS — Model Notice of Privacy Practices for HIPAA Covered Health Care Provider: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/privacy-practices-health-care-provider/index.html HHS OCR — Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html Nevada Legislature — NRS Chapter 603A, Security and Privacy of Personal Information: https://www.leg.state.nv.us/nrs/nrs-603a.html FTC — Health Breach Notification Rule, 16 C.F.R. Part 318: https://www.ftc.gov/legal-library/browse/rules/health-breach-notification-rule

26. END OF

IMPORTANT: This Website & Consumer Privacy Policy is not MDTelemed LLC’s HIPAA Notice of Privacy Practices. The HIPAA Notice of Privacy Practices is a separate document governing protected health information under HIPAA. Additional state privacy and consumer-health-data notices may also apply and should be read together with this Policy.

CONSUMER HEALTH DATA PRIVACY

1. MDTELEMED LLC

2. CONSUMER HEALTH DATA PRIVACY POLICY

Version 1.0 | Effective September 15, 2026

This Policy addresses consumer health data that may be regulated outside, in addition to, or differently from HIPAA protected health information. It is designed as a national baseline with jurisdiction-specific requirements layered on where applicable. It does not claim that every state consumer-health-data statute applies to every MDTelemed data flow.

3. WHY THIS POLICY EXISTS

Health information can fall outside HIPAA yet remain subject to state consumer-health-data, medical-privacy, general consumer-privacy, biometric, genetic, reproductive-health, geolocation, breach-notification, and unfair/deceptive-practices laws. MDTelemed therefore separates this Consumer Health Data Privacy Policy from its HIPAA Notice of Privacy Practices and general Website & Consumer Privacy Policy.

4. RELATIONSHIP TO HIPAA

HIPAA applies to protected health information handled by covered entities and business associates within HIPAA's scope. State consumer-health-data statutes may apply to information, entities, websites, apps, inferences, location signals, or advertising/analytics activities that are not governed by HIPAA in the same manner. HIPAA status must be determined data flow by data flow.

5. NO FALSE HIPAA EXEMPTION

MDTelemed will not assume that being a health care company makes every piece of information HIPAA-exempt from state privacy law. Some statutes contain entity-level exemptions, some data-level exemptions, and some narrower exemptions. Applicability must be verified.

6. NATIONAL BASELINE

MDTelemed intends to make this Policy available nationally. Where a state law grants stronger or additional rights, MDTelemed will apply the applicable state requirements through this Policy, the State Privacy Rights Supplement, a state-specific addendum, or the operational rights-request process.

7. WASHINGTON

Washington's My Health My Data Act, Chapter 19.373 RCW, requires regulated entities within its scope to maintain a consumer health data privacy policy and imposes rules concerning collection, sharing, sale, consumer rights, processors, security, and geofencing.

8. NEVADA

Nevada's consumer health data law in NRS Chapter 603A establishes requirements concerning consumer health data privacy policies, collection, use, sharing, sale, processors, rights, and geofencing for entities and data within its scope.

9. CONNECTICUT

Connecticut's Data Privacy and Security framework contains specific provisions concerning consumer health data and consumer health data controllers. MDTelemed will apply those provisions where its activities and data fall within their scope.

10. OTHER STATES

Other states regulate health-related information through general privacy statutes, medical-information laws, reproductive-health protections, genetic/biometric laws, children's privacy laws, geolocation restrictions, or other statutes. This Policy is not a claim that Washington, Nevada, and Connecticut are the only relevant jurisdictions.

11. DEFINITION — CONSUMER HEALTH DATA

For this Policy, 'consumer health data' means health-related personal information within the definition of the law that applies to the individual and processing activity. Definitions vary by jurisdiction and can include information that identifies or is reasonably capable of being linked to a person's past, present, or future physical or mental health status.

12. HEALTH CONDITIONS AND DIAGNOSES

Consumer health data can include information concerning symptoms, health conditions, diseases, diagnoses, treatment, prognosis, medical history, or health status.

13. MEDICATION INFORMATION

Consumer health data can include information concerning medication use, medication requests, prescriptions, pharmacy activity, adherence, side effects, contraindications, or inferred medication needs.

14. MENTAL AND BEHAVIORAL HEALTH

Consumer health data can include information concerning psychiatric symptoms, mental-health conditions, counseling, behavioral interventions, substance-use history, suicide-risk screening, or other behavioral-health information.

15. REPRODUCTIVE AND SEXUAL HEALTH

Consumer health data can include reproductive, sexual-health, contraception, fertility, pregnancy, abortion-related, STI, erectile-dysfunction, gender-affirming, and other sensitive information to the extent covered by applicable law.

16. BIOMETRIC AND GENETIC INFORMATION

Health-related biometric or genetic information may be consumer health data and may also be independently regulated by biometric, genetic, medical-privacy, or general privacy statutes.

17. VITAL SIGNS AND BODY DATA

Weight, height, BMI, blood pressure, pulse, temperature, glucose, oxygen saturation, sleep, activity, menstrual-cycle information, body composition, and similar measurements can constitute health-related personal data.

18. PRECISE GEOLOCATION

Location information can become consumer health data when used to infer or indicate that a person is seeking, receiving, or considering health services. Some laws expressly regulate health-related geolocation and geofencing.

19. INFERRED AND DERIVED DATA

Consumer health data can include health status inferred or derived from browsing, searches, purchases, questionnaires, algorithms, machine learning, device signals, or other non-health data. MDTelemed will not treat inferred health information as harmless merely because the consumer did not type a diagnosis.

20. SEARCH AND BROWSING DATA

Search terms, URLs, page visits, symptom pages, treatment pages, medication pages, appointment funnels, questionnaire progress, and referral-source information can reveal or infer health interests and therefore require careful classification.

21. ACCOUNT AND IDENTITY DATA

Name, email, telephone number, postal address, device identifiers, account identifiers, IP address, and similar data can become consumer health data when linked to health-related activity.

22. PAYMENT DATA

Payment information can reveal that a consumer sought a particular health service. MDTelemed should minimize the health information attached to payment and advertising systems and should not assume payment metadata is non-sensitive.

23. COMMUNICATION DATA

Email, SMS, secure messages, support tickets, chatbot-like intake interfaces, voicemail, uploaded documents, and customer-service communications can contain consumer health data.

24. AUDIO AND TRANSCRIPT DATA

Audio captured or processed for the AI telescribe, transcripts, summaries, and physician documentation can contain highly sensitive health information. Their treatment depends on HIPAA, state health-data law, recording law, contracts, and the actual technical architecture.

25. SOURCES OF DATA

MDTelemed may receive health-related data directly from consumers; from physicians; from authorized representatives; from laboratories, imaging providers, pharmacies, or other treating providers; from devices or uploads; and from technical systems used to deliver requested services, subject to applicable law.

26. AUTOMATIC COLLECTION

Websites and apps can automatically collect device, browser, IP, cookie, SDK, referrer, event, and interaction data. MDTelemed must determine whether any automatically collected data is linked to health activity before deploying analytics or advertising technologies.

27. PURPOSE — PROVIDING REQUESTED CARE

MDTelemed may collect and use consumer health data as necessary to provide a product or service the consumer requests, including registration, clinical intake, telemedicine encounters, documentation, prescriptions, testing, referrals, follow-up, records, support, and account administration, as permitted by law.

28. PURPOSE — SAFETY

Health data may be processed as legally permitted to protect patient safety, detect emergencies, prevent medication errors, verify identity/location, address fraud, secure accounts, and investigate safety or security incidents.

29. PURPOSE — QUALITY

Health information may be used for lawful quality assessment, physician review, patient-safety activities, complaint investigation, and improvement, subject to HIPAA and other applicable restrictions.

30. PURPOSE — LEGAL COMPLIANCE

MDTelemed may process information as necessary to comply with applicable law, licensing, record-retention, subpoenas/orders, mandatory reporting, public-health duties, professional regulation, and legal claims, but will not use 'legal compliance' as a blanket justification for unrelated processing.

31. PURPOSE — ANALYTICS

Analytics used to operate and improve the service must be evaluated for the data transmitted, vendor role, purpose, consent requirements, and health-data sensitivity. Analytics does not automatically become permissible merely because it is useful.

32. PURPOSE — MARKETING

Marketing and targeted advertising involving health-related information create heightened privacy risk. MDTelemed will not use consumer health data for marketing or targeted advertising unless the processing is lawful and required notices, consent, authorization, and opt-out mechanisms are implemented.

33. COLLECTION CONSENT

Where applicable consumer-health-data law requires affirmative consent before collection, MDTelemed will obtain the legally required consent unless a statutory exception applies, such as processing necessary to provide a product or service specifically requested by the consumer.

34. SHARING CONSENT

Where a law requires separate consent before sharing consumer health data, MDTelemed will use a separate, specific consent rather than treating acceptance of general Terms of Use as consent.

35. SALE AUTHORIZATION

MDTelemed will not sell consumer health data where prohibited. Where applicable law permits sale only with a specific written authorization, MDTelemed will not rely on a general privacy-policy acceptance or cookie banner as a substitute.

36. NO CONDITIONING WHERE PROHIBITED

MDTelemed will not condition requested health care or other services on a consumer authorizing a sale of consumer health data where applicable law prohibits that conditioning.

37. CONSENT MUST BE MEANINGFUL

Consent should be freely given, specific, informed, affirmative, and obtained without prohibited dark patterns. Silence, prechecked boxes, hidden terms, or unrelated bundled acceptance should not be treated as consent when law requires an affirmative act.

38. WITHDRAWAL OF CONSENT

Where applicable law grants a right to withdraw consent, MDTelemed will provide a method to do so and will process withdrawal as required, subject to lawful retention and other exceptions.

39. CATEGORIES COLLECTED

The production version of this Policy must disclose the actual categories of consumer health data MDTelemed collects. Categories should be based on a completed data inventory rather than hypothetical technology.

40. CURRENT EXPECTED CATEGORIES

Based on the stated service model, expected categories can include identity/contact data linked to health services; symptoms and history; diagnoses; medications; allergies; mental/behavioral health; reproductive/sexual health; pediatric information; laboratory/imaging information; vital/body measurements; communications; appointment/service data; payment-related service information; patient location; and AI-telescribe encounter content.

41. ADDITIONAL CATEGORIES

MDTelemed must not silently begin collecting materially different consumer health data where applicable law requires disclosure and consent before new collection.

42. CATEGORIES OF SOURCES

The final public Policy should identify the categories of sources actually used, including consumer-provided data, treating physicians, authorized representatives, clinical partners, technical systems, and vendors where legally relevant.

43. CATEGORIES SHARED

The production Policy must identify categories of consumer health data shared and the categories or identities of recipients to the level required by applicable law.

44. TREATING PROVIDERS

Health information may be shared with physicians and other treating entities as legally permitted and necessary for requested care. MDTelemed's current patient-facing clinical model uses MD physicians only; referrals may involve outside providers.

45. LABORATORIES AND IMAGING

Information may be shared with laboratories, imaging facilities, diagnostic providers, and related services when necessary to order, perform, interpret, coordinate, bill, or follow up requested diagnostic care.

46. PHARMACIES

Information may be shared with pharmacies and e-prescribing services to transmit and manage lawful prescriptions and medication questions. MDTelemed prohibits Schedule II-V controlled-substance prescribing through the platform.

47. SERVICE PROVIDERS / PROCESSORS

Consumer health data may be processed by vendors that provide hosting, communications, identity, security, payment, documentation, support, or other services. Contracts and permitted processing must comply with applicable law.

48. AI TELESCRIBE VENDOR

Any vendor that receives encounter audio, transcript, or medical content for AI-assisted documentation must be classified correctly under HIPAA and applicable consumer-health-data law, contractually restricted, and disclosed as required.

49. ADVERTISING VENDORS

Advertising networks, pixels, social-media tools, data brokers, or cross-context advertising vendors present heightened risk. MDTelemed must not transmit consumer health data to them without a verified lawful basis and all required disclosures/consents.

50. THIRD-PARTY LINKS

A third-party site reached through a link may collect information under its own privacy practices. MDTelemed should minimize health information embedded in outbound URLs, query strings, referral parameters, or tracking tokens.

51. PROCESSOR CONTRACTS

Where consumer-health-data law requires processor contracts, MDTelemed will contractually define processing instructions, purpose, duration, confidentiality/security, deletion/return, subcontractor duties, and other required terms.

52. PROCESSOR LIMITS

A processor may not expand its use of consumer health data beyond MDTelemed's lawful instructions merely because it technically receives the data.

53. DATA MINIMIZATION

MDTelemed should collect health-related data reasonably necessary for the disclosed and lawful purpose. More data is not automatically better data.

54. PURPOSE LIMITATION

Consumer health data should not be repurposed incompatibly without satisfying applicable notice, consent, authorization, or other legal requirements.

55. RETENTION

Consumer health data will be retained according to the law and the purpose for which it is maintained. Medical-record retention obligations may prevent deletion of information that otherwise would be deletable under a consumer privacy statute.

56. DELETION CONFLICTS

A consumer-health-data deletion request does not automatically authorize MDTelemed to destroy a medical record that law requires or permits it to retain. MDTelemed will apply statutory exemptions and explain denials or limitations as required.

57. SECURITY

MDTelemed will maintain reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of consumer health data and applicable law. This Policy does not invent specific encryption algorithms, certifications, penetration-test schedules, or uptime guarantees.

58. ACCESS CONTROL

Access to consumer health data should be limited to authorized persons and systems with legitimate duties, using role-based or least-privilege principles where appropriate.

59. DATA SEGREGATION

Where law, risk, or system design requires enhanced protection for reproductive health, gender-affirming care, minors, behavioral health, Part 2 information, or other specially protected data, MDTelemed should implement appropriate logical, contractual, or workflow segregation.

60. CONSUMER RIGHT TO KNOW / CONFIRM

Where applicable law provides the right, consumers may request confirmation whether MDTelemed is collecting, sharing, or selling their consumer health data and may request information about the data and processing.

61. CONSUMER RIGHT OF ACCESS

Where applicable law provides access rights, MDTelemed will provide access to consumer health data as required, subject to identity verification, exceptions, and separate medical-record access rules.

62. LIST OF THIRD PARTIES

Washington law provides rights concerning third parties and affiliates with whom consumer health data has been shared or sold. MDTelemed must maintain records sufficient to answer applicable requests accurately.

63. CONSUMER RIGHT TO DELETE

Where applicable law provides a deletion right, MDTelemed will process verified deletion requests and instruct relevant processors/recipients as required, subject to statutory exceptions and medical-record retention duties.

64. CONSUMER RIGHT TO WITHDRAW

Where applicable law provides a right to withdraw consent for collection or sharing, MDTelemed will honor the request prospectively as required.

65. CONSUMER RIGHT TO APPEAL

Where applicable law requires an appeal process after denial of a privacy request, MDTelemed will provide the required appeal mechanism and response.

66. AUTHORIZED AGENTS

Where applicable law allows an authorized agent to submit a request, MDTelemed may verify the agent's authority and the consumer's identity as permitted by law.

67. IDENTITY VERIFICATION

MDTelemed may take reasonable steps to verify the identity or authority of a person requesting access, deletion, correction, or other rights so health data is not disclosed to an impostor.

68. NO DISCRIMINATION / RETALIATION

MDTelemed will not unlawfully discriminate or retaliate against a consumer for exercising applicable consumer-health-data privacy rights.

69. REQUEST METHOD

Until a dedicated privacy portal is operationally verified, consumer-health-data requests may be directed to Support@MDTelemed.com or by mail to MDTelemed LLC, 304 S Jones Blvd #4872, Las Vegas, NV 89107. The production site may add additional legally required methods.

70. RESPONSE TIMING

Response deadlines vary by statute. MDTelemed will use the deadline required by the law applicable to the request rather than publishing one false nationwide deadline.

71. FEES

MDTelemed will not charge a fee for consumer-health-data rights requests except where applicable law permits a fee under specified circumstances.

72. MANIFESTLY UNFOUNDED OR EXCESSIVE REQUESTS

Where a statute permits refusal or a fee for manifestly unfounded, excessive, repetitive, or abusive requests, MDTelemed will apply that exception narrowly and document the basis.

73. WASHINGTON PRIVACY POLICY DISCLOSURES

For Washington-covered processing, the public consumer health data privacy policy must clearly and conspicuously disclose the categories of consumer health data collected and purposes; categories of sources; categories of data shared; categories of third parties/affiliates with whom data is shared; purposes for sharing; how consumers exercise rights; and other disclosures required by Chapter 19.373 RCW.

74. WASHINGTON COLLECTION / SHARING

For Washington-covered processing, collection and sharing must comply with RCW 19.373.030, including consent requirements and the exception for processing necessary to provide a product or service requested by the consumer.

75. WASHINGTON DELETION

Washington provides a deletion right with statutory procedures and obligations concerning data held by processors, affiliates, and third parties. MDTelemed's operational workflow must be capable of propagating qualifying deletion requests.

76. WASHINGTON SALE

A sale of Washington consumer health data requires a valid authorization satisfying RCW 19.373.070. MDTelemed's baseline policy is not to use a general privacy acceptance as authorization for sale.

77. WASHINGTON GEOFENCING

Washington prohibits geofencing around entities that provide in-person health care services when used for specified health-data tracking, collection, notification, or advertising purposes. MDTelemed will not deploy prohibited health-care geofencing.

78. WASHINGTON PRIVATE ENFORCEMENT

Washington's My Health My Data Act is enforceable under the Washington Consumer Protection Act. This increases the importance of accurate public representations and technical compliance rather than aspirational privacy language.

79. NEVADA POLICY DISCLOSURES

For Nevada-covered processing, MDTelemed must maintain and conspicuously provide the consumer health data privacy policy required by NRS Chapter 603A, including the categories, purposes, sources, sharing, rights, and other statutory disclosures.

80. NEVADA COLLECTION

Nevada generally restricts collection of consumer health data to affirmative voluntary consent or processing necessary to provide a requested product or service, subject to the statute's details and exceptions.

81. NEVADA SHARING

Nevada imposes separate requirements for sharing consumer health data. MDTelemed will not treat collection consent as automatically satisfying a distinct sharing-consent requirement where the statute requires separation.

82. NEVADA SALE

Nevada restricts sale of consumer health data without a written authorization containing specified disclosures. MDTelemed will not condition care on such authorization where prohibited.

83. NEVADA GEOFENCING

Nevada restricts geofencing around medical facilities for specified purposes involving consumer health data and targeted messaging. MDTelemed's advertising technology must be configured not to violate these restrictions.

84. CONNECTICUT CONSUMER HEALTH DATA

Connecticut defines consumer health data to include personal data used to identify a consumer's physical or mental health condition, diagnosis, or status, including gender-affirming and reproductive or sexual health data. MDTelemed will apply Connecticut-specific duties where applicable.

85. CONNECTICUT CONSENT

Connecticut defines consent as a clear affirmative act that is freely given, specific, informed, and unambiguous and excludes certain broad terms, passive interactions, and dark-pattern consent. MDTelemed should use that standard where Connecticut law applies.

86. CONNECTICUT DATA MINIMIZATION / SAFEGUARDS

Where Connecticut law applies, processing under statutory exceptions remains subject to necessity, proportionality, relevance, limitation, and reasonable safeguards as specified by law.

87. GENERAL STATE PRIVACY LAWS

Even where a state lacks a standalone consumer-health-data act, health data may be 'sensitive data' under a comprehensive privacy law and can trigger opt-in consent, data-protection assessments, minimization, opt-out, deletion, or other duties.

88. MEDICAL INFORMATION LAWS

State medical confidentiality statutes may protect physician records independently of consumer privacy statutes. MDTelemed will not use this Policy to reduce protections provided by medical-information law.

89. REPRODUCTIVE / GENDER-AFFIRMING DATA

State shield, confidentiality, subpoena, geofencing, electronic exchange, or other laws may create special restrictions concerning reproductive or gender-affirming care. Those requirements must be mapped separately.

90. CHILDREN AND TEENS

Consumer-health-data rights involving minors can interact with COPPA, state child/teen privacy laws, parental rights, minor-consent law, confidential services, and medical-record law. MDTelemed must not use a single age rule to resolve every privacy question.

91. COPPA

If MDTelemed's online service is directed to children under 13 or has actual knowledge that it is collecting personal information online from a child under 13 in a manner within COPPA's scope, COPPA requirements must be evaluated. Pediatric medical treatment alone does not answer the COPPA applicability question.

92. ADVERTISING PIXELS

Pixels and advertising SDKs can transmit page URLs, event names, device identifiers, IP addresses, and other information that reveals health interests. MDTelemed must complete a technical inventory before activating these tools on health-related pages.

93. AUTHENTICATED PAGES

Advertising or analytics technology on authenticated patient pages presents particularly high risk because account identity and health activity may be linked. Such deployment requires explicit privacy/security review.

94. SESSION REPLAY

Session-replay tools can capture typed or displayed health information if not properly configured. MDTelemed must verify masking, exclusions, vendor data use, and legal basis before deployment.

95. URL AND QUERY-STRING HYGIENE

MDTelemed should avoid placing diagnoses, symptoms, medications, appointment reasons, patient names, email addresses, or other sensitive health information in URLs, page titles, analytics event names, or query parameters that may leak to third parties.

96. COOKIE CONSENT

A cookie banner is not a universal legal authorization to disclose consumer health data. Consent design must match the specific law and data use.

97. GLOBAL PRIVACY CONTROL

Where applicable state law recognizes universal opt-out mechanisms such as Global Privacy Control for relevant sale/sharing/targeted-advertising rights, MDTelemed should configure its privacy-choice architecture accordingly.

98. DATA BROKERS

MDTelemed should not disclose consumer health data to data brokers except where specifically lawful, contractually controlled, disclosed, and consented/authorized as required. A vendor label does not determine legal status.

99. DE-IDENTIFIED DATA

Data is not safely outside privacy law merely because obvious identifiers were removed. MDTelemed must apply the de-identification standard required by the relevant law and manage re-identification risk.

100. AGGREGATE DATA

Aggregate data should be structured so individuals are not reasonably identifiable under the applicable legal standard. Small cohorts and rare conditions can create re-identification risk.

101. RESEARCH

Research use of consumer health data requires a separate legal basis and governance appropriate to the law, study, data, consent/waiver, IRB status, and HIPAA applicability. MDTelemed will not call product analytics 'research' to bypass privacy requirements.

102. PRODUCT DEVELOPMENT

Consumer health data should not be used to train or improve unrelated products or general-purpose models unless the use is legally permitted, contractually authorized, accurately disclosed, and consented to where required.

103. AI MODEL TRAINING

MDTelemed has described the AI telescribe as documentation support. The production vendor contract and technical configuration must verify whether patient data is used for model training. This Policy does not claim 'never used for training' until that fact is verified.

104. AUTOMATED DECISION-MAKING

MDTelemed's stated clinical model is human-MD decision-making. If automated profiling or consequential decision-making is later introduced, additional privacy disclosures, assessments, opt-out rights, or consent obligations may apply.

105. DATA PROTECTION ASSESSMENTS

Some state privacy laws require assessments for processing sensitive data, targeted advertising, sale, profiling, or other high-risk processing. MDTelemed should perform and retain legally required assessments before launch of those activities.

106. VENDOR DUE DILIGENCE

Privacy review should evaluate each vendor's data inputs, outputs, retention, secondary use, subprocessors, security, location, deletion capability, incident notification, training use, advertising use, and contractual role.

107. INCIDENTS AND BREACHES

A consumer-health-data incident may trigger HIPAA, FTC Health Breach Notification Rule, state breach laws, consumer-health-data statutes, contract notice, or multiple regimes. MDTelemed will assess each incident under the laws that actually apply.

108. FTC HEALTH BREACH NOTIFICATION RULE

The FTC Health Breach Notification Rule applies to vendors of personal health records and related entities within its scope. MDTelemed must determine whether any non-HIPAA product or function falls within that rule rather than assuming HIPAA breach rules are the only federal framework.

109. UNFAIR OR DECEPTIVE PRACTICES

Privacy promises must match actual technical behavior. MDTelemed will not say data is 'never shared,' 'completely private,' 'HIPAA protected everywhere,' or 'never used for advertising' unless those statements are verified and remain true.

110. CHANGES TO PRACTICES

If MDTelemed proposes to collect new categories, share with new recipients, or use consumer health data for materially new purposes, it will update disclosures and obtain additional consent/authorization where applicable law requires it before the new processing.

111. POLICY VERSIONING

MDTelemed should retain prior versions of this Policy and record effective dates so it can establish what disclosures were in effect when data was collected.

112. NOTICE AT COLLECTION

Where applicable law requires a notice at or before collection, MDTelemed will present the required notice in the relevant workflow and will not rely solely on a footer link.

113. ACCESSIBILITY

Privacy notices and rights mechanisms should be reasonably accessible to people with disabilities and compatible with MDTelemed's digital accessibility program.

114. LANGUAGE ACCESS

Where law or MDTelemed's patient-access obligations require translated or language-accessible notices, the company should provide accurate translations and maintain consistency across versions.

115. PATIENT LOCATION

MDTelemed verifies physical location for clinical licensure and emergency purposes. Location data must not be repurposed for prohibited health advertising or geofencing.

116. EMERGENCY USE

Privacy law does not prevent lawful use of necessary information to protect life or safety where a statutory exception applies. Emergency processing should remain proportionate and documented.

117. LAW-ENFORCEMENT REQUESTS

MDTelemed will evaluate subpoenas, warrants, court orders, and law-enforcement requests under HIPAA, state medical privacy, consumer-health-data, reproductive-health, and other applicable laws. A request is not automatically valid merely because it comes from law enforcement.

118. LITIGATION AND LEGAL CLAIMS

Information may be preserved or processed as permitted by law to establish, exercise, or defend legal claims. Legal holds can override ordinary deletion schedules.

119. CORPORATE TRANSACTIONS

A merger, acquisition, financing, bankruptcy, asset transfer, or reorganization involving health data requires privacy, contract, HIPAA, and state-law review. Consumer health data should not be treated as an unrestricted commercial asset.

120. NO SALE REPRESENTATION UNTIL VERIFIED

MDTelemed's intended policy should be to avoid selling consumer health data. However, because certain statutes define 'sale' broadly and may treat non-cash exchanges as value, the production site should not publish an absolute 'we never sell' statement until all advertising, analytics, and vendor flows are mapped.

121. NO TARGETED-ADVERTISING REPRESENTATION UNTIL VERIFIED

The same principle applies to 'sharing' and targeted advertising. Technical implementation must precede categorical public claims.

122. PATIENT-FACING TRANSPARENCY

The public version should explain data practices in plain language without burying material health-data uses inside general legal terms.

123. CONTACT

MDTelemed LLC 304 S Jones Blvd #4872 Las Vegas, NV 89107 Privacy / Business Administration: Support@MDTelemed.com

124. CONSUMER HEALTH DATA RIGHTS — QUICK REFERENCE

Depending on your state and the law applicable to your information, you may have rights to confirm whether MDTelemed collects or shares consumer health data. You may have a right to access consumer health data. You may have a right to know categories or identities of third parties or affiliates receiving consumer health data. You may have a right to withdraw consent for certain collection or sharing. You may have a right to delete qualifying consumer health data, subject to medical-record retention and other legal exceptions. You may have a right to appeal a denied privacy request. You may have rights to opt out of sale, sharing, targeted advertising, or profiling under applicable state law. You may use an authorized agent where applicable law permits it. MDTelemed will not unlawfully retaliate against you for exercising applicable privacy rights. Complete a full data map from landing page through registration, intake, encounter, AI telescribe, e-prescribing, labs/imaging, messaging, billing, records, support, analytics and marketing. Inventory every cookie, pixel, tag, SDK, analytics tool, advertising platform, session-replay tool and social-media integration before activation. Determine which pages/events can reveal symptoms, diagnoses, medications, psychiatric care, reproductive/sexual health, weight management, pediatrics or other health interests. Block advertising/analytics transmission of consumer health data unless counsel and privacy engineering confirm a lawful basis and required consent/authorization. Map Washington My Health My Data Act applicability and build the required Washington disclosures, collection/sharing consent, deletion propagation, third-party list, sale authorization control and geofence prohibition. Map Nevada NRS Chapter 603A consumer-health-data applicability and build the required Nevada policy, consent, sharing, sale-authorization, rights and geofencing controls. Map Connecticut consumer-health-data controller obligations and the July 1, 2026 amendments relevant to health data, consent, minimization and safeguards. Complete a 50-state matrix for sensitive-data consent, targeted advertising, sale/sharing, universal opt-out, reproductive/gender-affirming protections, geolocation, genetic/biometric information, children/teens, medical privacy and breach law. Determine every HIPAA exemption precisely—entity-level versus data-level—before excluding any state privacy requirement. Verify the AI telescribe vendor: BAA status, consumer-health-data processor status, audio/transcript storage, retention, deletion, subprocessors, model-training use and secondary use. Verify whether MDTelemed stores audio or only processes it transiently. Align recording consent with the actual architecture. Create a processor/vendor contract template that satisfies applicable consumer-health-data statutes in addition to HIPAA BAAs. Build a rights-request system capable of access, deletion, consent withdrawal, third-party-list requests, appeals, authorized agents and state-specific deadlines. Build deletion propagation to processors, affiliates and third parties where required, while preserving medical records that law requires to be retained. Create a verified recipient ledger so MDTelemed can identify third parties/affiliates that received Washington consumer health data when required. Implement geofencing controls prohibiting health-related tracking/advertising around health care facilities where law prohibits it. Configure Global Privacy Control/universal opt-out recognition where legally required for relevant processing. Create data-protection assessments for sensitive-data processing, targeted advertising, sale, profiling and other high-risk processing where required. Separate clinical communications from promotional SMS/email and prevent health information from entering advertising audiences without lawful authority. Review URLs, page titles, referrers, analytics events and query strings for health-data leakage. Review payment metadata and receipt descriptors so they do not disclose unnecessary sensitive health information. Create privacy-by-design review gates for every new service line, vendor, tracking technology and AI feature. Create an incident matrix covering HIPAA Breach Notification, FTC Health Breach Notification Rule, state breach laws and consumer-health-data statutes. Have qualified privacy/health-law counsel with Washington, Nevada, Connecticut and nationwide state privacy expertise approve the production version before launch.

125. PRIMARY AUTHORITIES AND REFERENCES

Washington My Health My Data Act, Chapter 19.373 RCW, including RCW 19.373.020-.100. Nevada Revised Statutes Chapter 603A, consumer health data provisions enacted by SB 370, including definitions, privacy-policy, consent, sharing, sale, processor, rights, and geofencing requirements. Connecticut General Statutes Chapter 743jj, Data Privacy and Security, including consumer health data provisions and amendments effective July 1, 2026. Federal Trade Commission, Health Breach Notification Rule, 16 C.F.R. Part 318. Federal Trade Commission Act, Section 5, 15 U.S.C. §45, concerning unfair or deceptive acts or practices. HIPAA Privacy, Security, and Breach Notification Rules, 45 C.F.R. Parts 160 and 164, where applicable. Children's Online Privacy Protection Act and Rule, 15 U.S.C. §§6501-6506 and 16 C.F.R. Part 312, where applicable. Applicable state comprehensive privacy, medical-information, reproductive-health, gender-affirming-care, genetic, biometric, geolocation, breach-notification, wiretap/recording, and child/teen privacy laws.

126. RELATED MDTelemed POLICIES

Website & Consumer Privacy Policy; Data Security & Cybersecurity; Medical Records Access, Amendment & Release; Cookie, Tracking Technology & Analytics; Medical Record Retention & Destruction; Third-Party Business Associates & BAAs; HIPAA Notice of Privacy Practices; State Privacy Rights Supplement; Minor Consent & Confidentiality Addendum; Electronic Communications & E-SIGN Consent; SMS/Text Messaging Terms & Consent; AI Telescribe, Audio Capture & Documentation Consent.

127. END OF

STATE PRIVACY RIGHTS SUPPLEMENT

1. MDTELEMED LLC

Version 1.0 | Effective September 15, 2026

This Supplement is designed to accompany MDTelemed LLC's Website & Consumer Privacy Policy, Consumer Health Data Privacy Policy, HIPAA Notice of Privacy Practices, and other applicable notices. It is a national baseline for state consumer privacy rights. It does not state that every listed law applies to MDTelemed, every MDTelemed data set, or every consumer. Applicability depends on statutory thresholds, exemptions, the consumer's state, the type of information, the purpose of processing, and MDTelemed's actual data practices.

3. PURPOSE

State privacy law in the United States is a rapidly changing patchwork. This Supplement explains rights that may be available to residents of particular states and describes how MDTelemed intends to administer applicable requests without pretending that one state's law governs every patient.

4. RELATIONSHIP TO HEALTH PRIVACY

This Supplement principally addresses comprehensive state consumer privacy laws and related state rights. Health information may also be governed by HIPAA, state medical-record/confidentiality law, consumer-health-data statutes, reproductive-health protections, genetic/biometric laws, child/teen privacy laws, and breach-notification laws.

5. HIPAA EXEMPTIONS VARY

Some state comprehensive privacy statutes exempt HIPAA-regulated entities; others exempt specified HIPAA PHI or other health information rather than the entire entity. MDTelemed must evaluate each statute separately and will not use HIPAA as a blanket nationwide exemption.

6. WHO IS A CONSUMER

The definition of 'consumer' differs by state. Many comprehensive statutes protect residents acting in an individual or household context and exclude employment or commercial contexts. This Supplement uses 'consumer' generically; the controlling statute determines eligibility.

7. PERSONAL DATA / PERSONAL INFORMATION

State laws use terms such as personal data and personal information. They generally concern information linked or reasonably linkable to an identified or identifiable person, subject to statutory exclusions such as deidentified or publicly available information.

8. SENSITIVE DATA

Depending on the state, sensitive data can include health conditions, mental or physical health, sex life, sexual orientation, gender identity, race/ethnicity, religious beliefs, citizenship/immigration status, genetic or biometric data, precise geolocation, and children's data. MDTelemed's clinical model makes sensitive-data classification especially important.

9. MDTelemed DATA CONTEXT

MDTelemed may process identity/contact information, account data, device and browsing information, telemedicine intake information, health information, communications, payment-related information, patient physical location, and other information necessary to operate the service. Actual categories and recipients must match the production data inventory.

10. RIGHT TO CONFIRM PROCESSING

Where applicable law grants this right, a consumer may request confirmation whether MDTelemed processes personal data concerning that consumer.

11. RIGHT TO ACCESS

Where applicable, a consumer may request access to personal data. Access to medical records may also be governed by HIPAA and state medical-record law and should be routed through the appropriate records workflow.

12. RIGHT TO KNOW

Some statutes permit consumers to request categories or specific pieces of personal information, sources, purposes, categories of recipients, and other information concerning processing.

13. RIGHT TO CORRECT

Where applicable, consumers may request correction of inaccurate personal data, subject to the nature of the data and purpose of processing. A request to amend a physician-authored medical record may instead be governed by HIPAA/state medical-record amendment rules.

14. RIGHT TO DELETE

Where applicable, consumers may request deletion of personal data. This right is not absolute. Medical-record retention, legal holds, fraud/security, transaction completion, legal compliance, and other statutory exceptions can require or permit continued retention.

15. RIGHT TO PORTABILITY

Where applicable, consumers may obtain qualifying personal data in a portable and, to the extent technically feasible, readily usable format.

16. RIGHT TO OPT OUT OF SALE

Where applicable, consumers may direct MDTelemed not to sell personal data as 'sale' is defined by the controlling statute. Definitions vary and can extend beyond transfers for cash.

17. RIGHT TO OPT OUT OF TARGETED ADVERTISING

Where applicable, consumers may opt out of processing personal data for targeted advertising. MDTelemed must distinguish targeted advertising from contextual advertising and from communications about services requested by the patient.

18. RIGHT TO OPT OUT OF PROFILING

Where applicable, consumers may opt out of certain profiling in furtherance of decisions producing legal or similarly significant effects. MDTelemed's stated model uses human MD clinical decision-making, but nonclinical automated processing must still be assessed.

19. RIGHT TO LIMIT SENSITIVE PERSONAL INFORMATION

California residents may have a right under the CCPA to limit certain uses/disclosures of sensitive personal information. Whether the right is triggered depends on MDTelemed's actual processing and statutory exceptions.

20. RIGHT TO NONDISCRIMINATION

Where applicable, MDTelemed will not unlawfully discriminate or retaliate against a consumer for exercising a privacy right. This does not require MDTelemed to provide a service that cannot reasonably be provided without information necessary for that service.

21. AUTHORIZED AGENTS

Some laws permit authorized agents to exercise specified rights. MDTelemed may verify the agent's authority and, where permitted, confirm the consumer's identity or instructions.

22. PARENTS, GUARDIANS, CONSERVATORS

Privacy rights for children and persons subject to guardianship/conservatorship interact with state family law, minor-consent law, medical confidentiality, HIPAA personal-representative rules, COPPA, and state child/teen privacy laws. Authority must be verified.

23. REQUEST VERIFICATION

MDTelemed may use reasonable verification appropriate to the sensitivity of the requested data. It should not disclose health or identity data merely because a requester knows a name and email address.

24. REQUEST CHANNEL

Until a dedicated privacy-rights portal is operationally verified, requests may be submitted to Support@MDTelemed.com or mailed to MDTelemed LLC, 304 S Jones Blvd #4872, Las Vegas, NV 89107. Additional methods will be provided where applicable law requires them.

25. NO NEW ACCOUNT REQUIREMENT

Where applicable law prohibits requiring a consumer to create a new account solely to submit a rights request, MDTelemed will not impose that requirement.

26. RESPONSE PERIODS

State response periods differ. MDTelemed will apply the deadline, permissible extension, and notice requirements of the statute governing the request instead of publishing a misleading single nationwide deadline.

27. APPEALS

Many state laws require an internal appeal mechanism when a controller denies a request. MDTelemed will provide an appeal process where required and information concerning regulatory complaints when the statute requires it.

28. FEES

Applicable privacy requests generally must be handled without charge, subject to statutory provisions allowing fees or refusal for excessive, repetitive, manifestly unfounded, or abusive requests.

29. UNIVERSAL OPT-OUT MECHANISMS

Several states require covered controllers to honor qualifying browser/device-based universal opt-out mechanisms for sale and/or targeted advertising. MDTelemed must configure its production privacy technology to recognize applicable signals.

30. GLOBAL PRIVACY CONTROL

Global Privacy Control is recognized for opt-out purposes in jurisdictions including California and Colorado. MDTelemed should test GPC end-to-end rather than merely display a privacy link.

31. COOKIE / TRACKER PREFERENCES

Cookie consent tools, opt-out links, GPC handling, advertising platform settings, and server-side tracking must operate consistently. A front-end preference that does not stop downstream disclosure is not an effective privacy control.

32. SENSITIVE DATA CONSENT

Several states require consent before processing sensitive data. Health information, precise location, genetic/biometric information, and children's data can trigger heightened rules.

33. DATA PROTECTION ASSESSMENTS

Certain state laws require documented assessments for targeted advertising, sale, sensitive-data processing, profiling, or other high-risk processing. MDTelemed should complete required assessments before launching the activity.

34. DATA MINIMIZATION

State laws increasingly impose collection and processing limits. MDTelemed should collect information reasonably necessary and proportionate to lawful disclosed purposes and should not retain personal data indefinitely merely because storage is inexpensive.

35. PURPOSE LIMITATION

Materially new uses can require updated notice, consent, or another lawful basis. MDTelemed should not repurpose clinical or health-related data for unrelated advertising or product development without legal review.

36. SECURITY

Covered state laws generally require reasonable security appropriate to the nature and volume of personal data. governs MDTelemed's security framework; this Supplement does not invent unverified technical controls.

37. THIRD-PARTY RECIPIENTS

Privacy notices may require categories of third parties, and some states provide rights concerning specific recipients. MDTelemed must maintain an accurate vendor/recipient inventory.

38. CALIFORNIA — CCPA/CPRA

If MDTelemed is a 'business' subject to the California Consumer Privacy Act, as amended, California consumers can have rights to know, delete, correct, opt out of sale/sharing, limit certain uses/disclosures of sensitive personal information, and be free from discrimination. The CCPA also requires applicable privacy notices and recognizes opt-out preference signals such as GPC.

39. CALIFORNIA — HEALTH DATA CAUTION

California privacy analysis must account for statutory exemptions and separate health-information regimes. MDTelemed must determine which information is PHI, California medical information, or otherwise exempt and which website, tracking, marketing, account, or other data remains within CCPA scope.

40. CALIFORNIA — NOTICE AT COLLECTION

Where CCPA applies, the production architecture must provide required notice at or before collection and accurately identify categories and purposes. A generic footer policy may not substitute for a required point-of-collection notice.

41. CALIFORNIA — SALE / SHARING

Where applicable, MDTelemed must provide legally compliant mechanisms to opt out of sale or sharing and must not characterize advertising/analytics transfers without analyzing California's statutory definitions.

42. CALIFORNIA — SENSITIVE PI

California's sensitive-personal-information framework can apply to precise geolocation, racial/ethnic origin, religious beliefs, genetic data, certain account credentials, and information concerning health, sex life, or sexual orientation. The production notice and Limit right must be configured where legally triggered.

43. COLORADO — CPA

Where the Colorado Privacy Act applies, Colorado consumers can have rights of access, correction, deletion, portability, and opt-out of sale, targeted advertising, and specified profiling. Processing sensitive data requires consent in circumstances governed by the CPA.

44. COLORADO — UNIVERSAL OPT OUT

Colorado requires covered controllers to accept qualifying universal opt-out mechanisms for sale and targeted advertising. Colorado currently recognizes GPC as a valid UOOM under its rules.

45. CONNECTICUT — CTDPA

Where Connecticut's privacy law applies, residents may have rights to access, correct, delete, portability, and opt out of sale, targeted advertising, and specified profiling. Connecticut also contains special protections for consumer health data and minors that must be evaluated separately.

46. DELAWARE — DPDPA

Where Delaware's Personal Data Privacy Act applies, MDTelemed will provide the rights, notice, consent, opt-out, appeal, and sensitive-data protections required by that statute. Applicability and health-data exemptions must be determined rather than presumed.

47. FLORIDA — DIGITAL BILL OF RIGHTS

Florida's Digital Bill of Rights has a distinctive scope and threshold structure. MDTelemed will apply Florida-specific rights only if the statute covers MDTelemed and the relevant processing; Florida residency alone does not establish applicability.

48. INDIANA — ICDPA

Indiana's Consumer Data Protection Act became effective January 1, 2026. Where applicable, MDTelemed will administer statutory access/confirmation, correction, deletion, portability, opt-out, sensitive-data, notice, and appeal requirements.

49. IOWA — ICDPA

Where Iowa's Consumer Data Protection Act applies, MDTelemed will provide the rights and controller obligations required by Iowa law, taking account of the statute's particular scope, exemptions, and rights rather than importing another state's rules.

50. KENTUCKY — KCDPA

Kentucky's Consumer Data Protection Act became effective January 1, 2026. Where applicable, MDTelemed will apply Kentucky-specific consumer rights, sensitive-data, opt-out, notice, processor, assessment, and appeal requirements.

51. MARYLAND — MODPA

Maryland's Online Data Privacy Act became effective October 1, 2025. Maryland expressly treats consumer health data, sex life, sexual orientation, gender identity, genetic/biometric information, precise geolocation, and children's data as sensitive data and provides access/knowledge, correction, deletion, opt-out, nondiscrimination, and data-use limitation protections.

52. MINNESOTA — MCDPA

Where Minnesota's Consumer Data Privacy Act applies, consumers can have rights to know/access, correct, delete, portability, opt out of sale/targeted advertising/certain profiling, obtain certain third-party information, and question significant profiling decisions. Minnesota also requires privacy notices and heightened protection for sensitive data.

53. MINNESOTA — RESPONSE / APPEAL

Minnesota generally requires covered controllers to respond within 45 days, subject to a permitted extension, and to maintain an appeal process. The Minnesota Attorney General's pre-enforcement warning period ended in 2026.

54. MONTANA — MCDPA

Where Montana's Consumer Data Privacy Act applies, MDTelemed will provide applicable access, correction, deletion, portability, opt-out, consent, notice, processor, assessment, and appeal rights. Thresholds and amendments must be checked at the time of production.

55. NEBRASKA — NDPA

Nebraska's Data Privacy Act has broad business coverage subject to statutory exclusions and includes consumer rights and controller obligations. MDTelemed must evaluate health-data and entity exemptions and apply the statute where relevant.

56. NEW HAMPSHIRE — SB 255

Where New Hampshire's comprehensive privacy law applies, MDTelemed will administer applicable access, correction, deletion, portability, opt-out, sensitive-data consent, notice, processor, assessment, and appeal requirements.

57. NEW JERSEY — NJDPA

Where New Jersey's Data Privacy Act applies, MDTelemed will implement applicable access, correction, deletion, portability, targeted-advertising/sale/profiling opt-outs, sensitive-data consent, universal opt-out, notice, assessment, and appeal requirements.

58. OREGON — OCPA

Where Oregon's Consumer Privacy Act applies, Oregon consumers have rights to access, obtain a copy, correct, delete, opt out of sale/targeted advertising/certain profiling, and obtain specified information about recipients. Oregon treats mental/physical health, sexuality, genetic/biometric data, location data, and children's data as sensitive.

59. OREGON — GEOLOCATION

As of January 1, 2026, Oregon prohibits sale of precise geolocation data as defined by Oregon law. MDTelemed's patient-location collection for licensure/emergency purposes must not be repurposed into prohibited sale.

60. RHODE ISLAND — DTPPA

Rhode Island's Data Transparency and Privacy Protection Act became effective January 1, 2026. Where applicable, MDTelemed will implement the statute's privacy-notice, rights, sensitive-data, processor, and opt-out obligations.

61. TENNESSEE — TIPA

Where Tennessee's Information Protection Act applies, MDTelemed will provide applicable confirmation/access, correction, deletion, portability, opt-out, sensitive-data, notice, processor, assessment, and appeal protections.

62. TEXAS — TDPSA

Texas's Data Privacy and Security Act grants covered Texas consumers rights to confirm/access, correct, delete, portability, and opt out of targeted advertising, sale, and specified profiling. Texas requires a clear privacy notice and has special provisions concerning sensitive data.

63. TEXAS — SMALL BUSINESS RULE

Texas generally exempts SBA-defined small businesses from much of the TDPSA but restricts sale of sensitive data by a small business without consent. MDTelemed must not assume small-business status without a verified analysis.

64. UTAH — UCPA

Where Utah's Consumer Privacy Act applies, MDTelemed will administer the rights and controller obligations Utah law provides, recognizing that Utah's rights and thresholds differ from states such as California and Colorado.

65. VIRGINIA — VCDPA

Where Virginia's Consumer Data Protection Act applies, consumers have rights to confirm/access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and specified profiling. Sensitive-data processing can require consent.

66. OTHER ENACTED STATE LAWS

The U.S. privacy landscape continues to expand. As of September 2026, additional comprehensive state laws have been enacted, including laws with later effective dates. MDTelemed's compliance matrix must track enactments and effective dates rather than freezing the website to a one-time list.

67. VERMONT

Vermont enacted a comprehensive privacy law in June 2026 with a January 1, 2028 effective date. It is included in MDTelemed's forward compliance inventory but should not be represented as currently effective in September 2026.

68. FUTURE LAWS / AMENDMENTS

MDTelemed will periodically review enacted statutes, amendments, regulations, attorney-general guidance, court decisions, and effective dates. This Supplement should be revised when changes materially affect consumer rights or MDTelemed's obligations.

69. STATE-SPECIFIC HEALTH DATA

separately addresses consumer health data statutes and health-related privacy. State comprehensive privacy rights do not replace Washington My Health My Data, Nevada consumer-health-data requirements, Connecticut health-data provisions, or other specialized health laws.

70. MEDICAL RECORDS

governs medical-record access/amendment/release. A general consumer deletion right should not be used to delete physician documentation contrary to medical-record retention or integrity requirements.

71. PATIENT LOCATION DATA

MDTelemed collects physical location for licensure, clinical, and emergency purposes. Precise location can be sensitive personal data. It should be limited to legitimate purposes and protected against sale or targeted advertising as required.

72. PSYCHIATRIC INFORMATION

Mental-health data can be sensitive personal data under comprehensive privacy statutes and can also be protected by separate health confidentiality laws. MDTelemed must apply the more specific or protective rule where applicable.

73. REPRODUCTIVE / SEXUAL HEALTH

Information concerning reproductive health, sexual health, sex life, sexual orientation, and gender identity may receive heightened protection under multiple state regimes. MDTelemed should not route these data into general advertising audiences.

74. PEDIATRIC DATA

Because MDTelemed treats patients of all ages, age-aware privacy controls are required. The company must distinguish clinical consent from online-data consent and must evaluate COPPA and state child/teen privacy requirements.

75. BIOMETRIC / GENETIC DATA

If MDTelemed later deploys face geometry, voiceprints, fingerprint authentication, genetic services, or similar technologies, separate state biometric/genetic laws may require additional notice, consent, retention schedules, security, or prohibitions.

76. FINANCIAL INCENTIVES / LOYALTY

If MDTelemed offers discounts, loyalty programs, or financial incentives tied to collection, retention, or disclosure of personal information, California and other state requirements may require separate analysis and notice.

77. TARGETED ADVERTISING ARCHITECTURE

Before targeted advertising is enabled, MDTelemed must determine which state residents are covered, whether health/sensitive data enters the audience or conversion flow, which vendors receive data, whether opt-in or opt-out applies, and whether UOOM/GPC signals must be honored.

78. SERVER-SIDE TRACKING

Moving tracking from the browser to a server does not eliminate privacy obligations. MDTelemed must map server-side conversion APIs and similar tools as carefully as pixels.

79. MOBILE SDKs

Mobile analytics and advertising SDKs can collect persistent identifiers, location, events, and device data. They require the same state-law review as website trackers.

80. DO NOT SELL / SHARE LINK

If California or another applicable law requires a conspicuous opt-out link, MDTelemed will provide the required mechanism. The final label and workflow should reflect actual processing and statutory terminology.

81. YOUR PRIVACY CHOICES

A centralized 'Your Privacy Choices' interface is recommended so consumers can submit state privacy requests, manage sale/sharing/targeted-advertising preferences, and exercise applicable rights without navigating multiple policies.

82. APPEAL CHANNEL

Where state law requires appeals, MDTelemed should provide a simple appeal method linked from any denial notice and should track statutory response deadlines.

83. REGULATOR COMPLAINTS

Where required, an appeal denial will identify how the consumer can contact the applicable state attorney general or other privacy regulator. HIPAA complaints remain governed separately by .

84. RECORDKEEPING

MDTelemed should retain evidence of privacy requests, verification, responses, appeals, consent, withdrawals, opt-out signals, policy versions, notices, assessments, and vendor configurations for legally appropriate periods.

85. TRAINING

Workforce members handling support, marketing, product, engineering, privacy, records, or clinical operations should be trained to recognize state privacy requests and route them promptly.

86. CONFLICTS

If this Supplement conflicts with a mandatory state right, the mandatory state law controls. If a more specific MDTelemed notice applies to particular data, that notice should be read together with this Supplement.

87. NO WAIVER

Nothing in MDTelemed's Terms of Use or another agreement is intended to waive a state privacy right that applicable law makes nonwaivable.

88. CHANGES

MDTelemed may update this Supplement as laws or practices change. The effective date will be identified. Additional notice or consent will be provided when applicable law requires it.

89. CONTACT

MDTelemed LLC 304 S Jones Blvd #4872 Las Vegas, NV 89107 Privacy / Business Administration: Support@MDTelemed.com

90. STATE PRIVACY RIGHTS — PRACTICAL SUMMARY

Access / confirmation rights are common but not identical across states. Correction rights exist in many states, but medical-record amendments use separate health-record procedures. Deletion rights are common but subject to legal exceptions, including medical-record retention. Portability rights exist in many comprehensive privacy statutes. Sale and targeted-advertising opt-outs are common; statutory definitions differ. Profiling opt-outs exist in many states for decisions producing legal or similarly significant effects. Sensitive-data processing frequently requires consent or enhanced safeguards. Universal opt-out signals such as GPC must be honored where applicable law requires them. Appeal rights exist in many states and require operational tracking. Health, precise location, genetic/biometric, and children's information frequently receive heightened protection. Determine whether MDTelemed satisfies each state's controller/business applicability thresholds using actual prior-year processing volumes, revenue, data-sale activity, entity structure, nonprofit/for-profit status, and other statutory criteria. Create a 50-state exemption matrix distinguishing entity-level HIPAA exemptions, data-level PHI exemptions, medical-information exemptions, GLBA/FCRA/employment exclusions, and other exclusions. Inventory all personal-data categories collected on public pages, registration, intake, authenticated portals, encounters, support, billing, marketing, AI telescribe, labs/imaging, and records. Map every third-party recipient and classify sale, sharing, targeted advertising, processor/service-provider disclosure, treatment disclosure, and other purpose under each applicable statute. Verify whether MDTelemed engages in any statutory 'sale' or 'sharing' before publishing categorical statements. Build a Your Privacy Choices page and rights-request portal without requiring a new account where prohibited. Implement California CCPA Notice at Collection and any required Do Not Sell or Share / Limit Sensitive PI mechanisms based on actual practices. Implement and test Global Privacy Control and every other universal opt-out mechanism MDTelemed is legally required to honor. Create state-aware consent controls for sensitive personal data and secondary uses. Create a state-aware rights engine for access, correction, deletion, portability, recipient-list requests, opt-outs, profiling rights, authorized agents, and appeals. Configure statutory response and appeal timers rather than using one national deadline. Create medical-record deletion exception routing so consumer privacy deletion requests do not improperly destroy clinical records. Implement age-assurance/age-aware controls appropriate to pediatric online services without collecting unnecessary identity data. Complete COPPA and state child/teen privacy analysis before collecting online personal information directly from minors. Complete data protection assessments required for sensitive data, targeted advertising, sale, profiling, AI/automated decision-making, and other high-risk processing. Map precise-geolocation collection and ensure it is not sold or repurposed contrary to Oregon, consumer-health-data, or other state restrictions. Review Meta, Google, TikTok, advertising pixels, analytics, session replay, SDKs, conversion APIs, and server-side tracking before activation on any health-related property. Confirm that opt-out settings propagate to all browser-side and server-side vendors. Create a vendor contract/privacy addendum covering state processor duties, assistance with consumer requests, security, deletion/return, subprocessors, audits, and purpose limitations. Maintain a legislative-change process for new laws, amendments, rules, enforcement guidance, and future effective dates, including Vermont's 2028 law. Have qualified national privacy and health-care counsel validate the state matrix and production disclosures immediately before launch.

91. PRIMARY AUTHORITIES / CURRENT OFFICIAL GUIDANCE

California Consumer Privacy Act, Cal. Civ. Code §1798.100 et seq.; California Attorney General, CCPA consumer guidance. Colorado Privacy Act, Colo. Rev. Stat. §6-1-1301 et seq.; Colorado Attorney General CPA rules and Universal Opt-Out Mechanism guidance. Connecticut Data Privacy Act, Conn. Gen. Stat. §42-515 et seq., as amended. Delaware Personal Data Privacy Act, 6 Del. C. Chapter 12D. Florida Digital Bill of Rights, Fla. Stat. Chapter 501, Part V. Indiana Consumer Data Protection Act, Ind. Code §24-15-1-1 et seq. Iowa Consumer Data Protection Act, Iowa Code Chapter 715D. Kentucky Consumer Data Protection Act, KRS Chapter 367. Maryland Online Data Privacy Act, Md. Code, Commercial Law §14-4601 et seq.; Maryland Attorney General privacy guidance. Minnesota Consumer Data Privacy Act, Minn. Stat. Chapter 325M; Minnesota Attorney General consumer/controller guidance. Montana Consumer Data Privacy Act, Mont. Code Ann. Title 30, Chapter 14, Part 28, as amended. Nebraska Data Privacy Act, Neb. Rev. Stat. §§87-1101 et seq. New Hampshire comprehensive consumer privacy law, RSA Chapter 507-H. New Jersey Data Privacy Act, N.J.S.A. 56:8-166.4 et seq. Oregon Consumer Privacy Act, ORS 646A.570-646A.589; Oregon Department of Justice privacy guidance. Rhode Island Data Transparency and Privacy Protection Act, R.I. Gen. Laws Chapter 6-48.1. Tennessee Information Protection Act, Tenn. Code Ann. §47-18-3301 et seq. Texas Data Privacy and Security Act, Tex. Bus. & Com. Code Chapter 541; Texas Attorney General guidance. Utah Consumer Privacy Act, Utah Code Title 13, Chapter 61. Virginia Consumer Data Protection Act, Va. Code §59.1-575 et seq.; Virginia Attorney General guidance. Washington My Health My Data Act, Chapter 19.373 RCW, for specialized consumer-health-data rights. Nevada NRS Chapter 603A, including consumer-health-data provisions. Vermont Data Privacy and Online Surveillance Act (enacted 2026; effective January 1, 2028, subject to statutory provisions). IAPP U.S. State Privacy Legislation Tracker, used as a secondary current-state cross-check; controlling statutes and official regulator materials govern.

92. RELATED MDTelemed POLICIES

Website & Consumer Privacy Policy; Data Security & Cybersecurity; Medical Records Access, Amendment & Release; Cookie, Tracking Technology & Analytics; Medical Record Retention & Destruction; Third-Party Business Associates & BAAs; Nondiscrimination, Disability Accessibility & Language Access; Website, Mobile App & Digital Accessibility; HIPAA Notice of Privacy Practices; Consumer Health Data Privacy Policy; Minor Consent & Confidentiality Addendum; Electronic Communications & E-SIGN Consent; SMS/Text Messaging Terms & Consent; AI Telescribe, Audio Capture & Documentation Consent.

93. END OF

DATA SECURITY AND CYBERSECURITY

1. MDTELEMED LLC

2. DATA SECURITY & CYBERSECURITY POLICY

Version 1.0 | September 15, 2026

Patient-facing national baseline. This Policy describes MDTelemed LLC's security governance and legal commitments without making unverified technical certifications or guarantees. Specific technical controls must match the production environment and documented risk analysis before public publication.

3. PURPOSE

MDTelemed LLC handles highly sensitive medical, identity, communications, payment, and account information. This Policy explains the framework MDTelemed uses to protect electronic protected health information (ePHI) and other sensitive information, respond to cybersecurity events, manage vendors and access, and provide legally required breach notifications. Security is a continuing risk-management process; no Internet-connected system can truthfully promise absolute security.

4. WHY THOSE CLAIMS WERE REMOVED

5. HIPAA SECURITY RULE FRAMEWORK

To the extent MDTelemed is a HIPAA covered entity or business associate with respect to ePHI, it must comply with the HIPAA Security Rule, 45 C.F.R. Part 164, Subpart C. The Security Rule requires administrative, physical, and technical safeguards appropriate to the regulated entity and its risks. It requires risk analysis and risk management, workforce safeguards, access controls, audit controls, integrity protections, authentication, transmission security, contingency planning, security-incident procedures, evaluation, and business-associate arrangements where applicable.

6. RISK ANALYSIS

MDTelemed should conduct and document an accurate and thorough assessment of reasonably anticipated risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. Risk analysis should identify where ePHI is created, received, maintained, or transmitted; the systems and vendors involved; reasonably anticipated threats; existing safeguards; likelihood and impact; and residual risk.

7. RISK MANAGEMENT

Risk analysis is not a one-time document. MDTelemed should reduce identified risks and vulnerabilities to a reasonable and appropriate level, assign remediation owners, track material findings, reevaluate risk after significant technology or business changes, and periodically assess whether safeguards remain effective.

8. ADMINISTRATIVE SAFEGUARDS

Administrative safeguards should include designated security responsibility, workforce authorization and supervision, workforce security, security-awareness and training, incident procedures, contingency planning, periodic evaluation, sanctions for policy violations, and appropriate vendor/contract management. Exact job titles and organizational assignments should reflect MDTelemed's actual staffing.

9. SECURITY RESPONSIBILITY

MDTelemed should designate a responsible security official or function with authority to coordinate HIPAA Security Rule compliance, cybersecurity governance, risk management, incident response, vendor-security review, workforce training, and remediation. The public policy should not invent the name or title of an individual until formally appointed.

10. WORKFORCE ACCESS

Access to sensitive information should be limited to authorized workforce members and service providers whose duties require access. Access should be granted, modified, reviewed, and terminated through documented procedures. MDTelemed should use the minimum necessary principle where applicable under HIPAA and avoid broad standing access without operational need.

11. ROLE-BASED AND LEAST-PRIVILEGE ACCESS

Where technically supported and appropriate, systems should use role-based or other least-privilege access controls. Physicians, billing personnel, customer support, administrators, developers, security personnel, and vendors may require different access. The precise permissions must be defined from actual workflows rather than the original policy's unsupported promise that providers can see 'own patients only.'

12. AUTHENTICATION

MDTelemed should use authentication controls appropriate to system risk and should verify that persons seeking access are who they claim to be. Strong authentication can include passwords, passkeys, MFA, device controls, federated identity, or other mechanisms. This Policy does not promise a particular password length or MFA implementation until verified.

13. PRIVILEGED ACCESS

Administrative, developer, database, cloud-console, and other privileged accounts create elevated risk. MDTelemed should restrict privileged access, separate administrative from routine use where appropriate, monitor high-risk activity, and promptly revoke unnecessary privileges.

14. ACCESS TERMINATION

Access should be disabled promptly when a workforce member, contractor, or vendor no longer requires it. Termination procedures should address user accounts, tokens, API credentials, remote access, devices, keys, shared secrets, and other means of system access.

15. TECHNICAL SAFEGUARDS

Technical safeguards should protect ePHI and other sensitive information against unauthorized access, alteration, destruction, or transmission. They may include access controls, audit mechanisms, integrity controls, authentication, encryption, network protections, endpoint safeguards, application security, monitoring, and secure configuration as supported by the verified architecture.

16. ENCRYPTION

The current HIPAA Security Rule treats encryption implementation specifications as addressable rather than a blanket requirement to use one named algorithm in every circumstance. Addressable does not mean optional: the regulated entity must determine through risk analysis whether encryption is reasonable and appropriate and, if not, document the decision and use an appropriate equivalent measure when reasonable and appropriate. MDTelemed should use strong industry-standard encryption appropriate to its environment, but this public Policy will not claim 'AES-256 everywhere' or 'TLS 1.2+' until technically verified.

17. DATA IN TRANSIT

Sensitive data transmitted over electronic networks should be protected against unauthorized access and interception using reasonable and appropriate transmission-security measures. The technical team should verify supported TLS versions, certificate management, API protections, secure messaging, video transport, email/SMS limitations, and third-party interfaces before publication of specific claims.

18. DATA AT REST

Stored ePHI and sensitive personal information should be protected based on risk, including databases, object storage, files, backups, endpoints, logs, caches, temporary files, and exports. Encryption, access controls, key management, and other protections should be documented from the actual production architecture.

19. KEY AND SECRET MANAGEMENT

Encryption keys, API keys, credentials, signing secrets, database passwords, tokens, and certificates should be managed securely, access-limited, rotated or replaced as appropriate, and not embedded insecurely in public code or routine communications. Exact key-management technology should not be represented publicly until verified.

20. AUDIT CONTROLS

HIPAA requires mechanisms to record and examine activity in information systems containing or using ePHI. MDTelemed should maintain audit capabilities appropriate to its systems and investigate anomalous or unauthorized activity. The original promise that every PHI event records timestamp, user ID, action, IP address and device for six years is not retained until the actual logging design and retention schedule are verified.

21. SECURITY MONITORING

MDTelemed should use reasonable monitoring to detect security incidents, suspicious access, malicious activity, configuration problems, or other threats. Monitoring may include platform logs, cloud security tools, endpoint telemetry, network monitoring, identity alerts, vendor notifications, or other controls appropriate to the architecture. This Policy does not falsely promise a specific intrusion-detection system.

22. LOG PROTECTION

Security and audit logs can themselves contain PHI, identifiers, IP addresses, authentication data, and operational secrets. Access to logs should be restricted, logs should be protected against inappropriate alteration or deletion, and retention should be based on legal, security, operational, and contractual requirements.

23. INTEGRITY

MDTelemed should implement policies and technical measures designed to protect ePHI from improper alteration or destruction. Integrity controls are particularly important for clinical notes, medication information, orders, results, identity information, and audit evidence.

24. AVAILABILITY

Security includes availability. MDTelemed should plan for system failures, ransomware, vendor outages, disasters, connectivity loss, and other events that could interrupt access to information or telemedicine services. This Policy does not promise 99.9% availability because that SLA has not been verified.

25. BACKUP AND RECOVERY

MDTelemed should maintain backup, recovery, and contingency capabilities appropriate to the systems and information involved. Backup frequency, encryption, immutability, geographic distribution, recovery point objectives, recovery time objectives, and test frequency must be verified before they are publicly promised.

26. CONTINGENCY PLANNING

Contingency planning should address data backup, disaster recovery, emergency-mode operations, criticality analysis, restoration priorities, communications, alternative workflows, and testing/revision. Clinical operations should have downtime procedures so technology failures do not create unsafe delays in emergency care.

27. VULNERABILITY MANAGEMENT

MDTelemed should identify and remediate material vulnerabilities in systems and applications using a risk-based process. This may include patch management, vulnerability scanning, penetration testing, dependency review, secure configuration, and remediation tracking as appropriate to the environment.

28. PATCH AND UPDATE MANAGEMENT

Operating systems, browsers, applications, libraries, cloud components, endpoints, and infrastructure should be maintained and updated according to risk. Critical vulnerabilities may require expedited remediation. MDTelemed should avoid promising a universal patch deadline unless it has an operational standard capable of meeting it.

29. SECURE SOFTWARE DEVELOPMENT

If MDTelemed develops proprietary software, security should be integrated into design, development, testing, deployment, and change management. Practices may include code review, dependency management, secrets protection, access controls, testing, environment separation, secure configuration, and remediation of identified weaknesses.

30. CHANGE MANAGEMENT

Material changes to clinical, identity, payment, analytics, AI, cloud, EHR, e-prescribing, laboratory, messaging, or other systems should be reviewed for privacy and security implications before production deployment when feasible.

31. VENDOR AND BUSINESS-ASSOCIATE SECURITY

Vendors may create, receive, maintain, or transmit ePHI or other sensitive data for MDTelemed. MDTelemed should identify vendors, determine whether a Business Associate Agreement is required, perform reasonable due diligence, contract for appropriate privacy/security obligations, define incident-notification responsibilities, and monitor material vendor risk.

32. BUSINESS ASSOCIATE AGREEMENTS

When HIPAA requires a Business Associate Agreement, MDTelemed should execute the agreement before permitting the business associate to handle ePHI. A BAA is not a substitute for security due diligence and does not eliminate MDTelemed's own compliance responsibilities.

33. PROPRIETARY TECHNOLOGY DOES NOT ELIMINATE VENDOR RISK

Even if MDTelemed describes its platform as proprietary, production systems commonly depend on hosting, domain, telecommunications, payment, email/SMS, laboratory, e-prescribing, analytics, identity, security, or other service providers. The vendor inventory should reflect actual data flows rather than a generic statement that everything is proprietary.

34. CLOUD SECURITY

If cloud services are used, MDTelemed should document which entities host or process ePHI, contractual roles, access boundaries, encryption and key responsibilities, logging, backup, incident response, data location where relevant, and secure deletion/termination procedures.

35. ENDPOINT SECURITY

Workstations, laptops, mobile devices, and other endpoints used by physicians or workforce members can expose sensitive information. MDTelemed should establish appropriate endpoint safeguards, access controls, screen/privacy practices, update requirements, loss/theft response, and remote-access controls based on risk.

36. REMOTE WORK

Telemedicine is inherently distributed. Workforce members should use approved systems and reasonable privacy/security practices when working remotely. Public spaces, shared computers, insecure communications, unattended screens, and unauthorized local downloads can create risk.

37. PHISHING AND SOCIAL ENGINEERING

Workforce training should address phishing, credential theft, malicious attachments, impersonation, business-email compromise, fraudulent support requests, and social engineering. Suspected attempts should be reported through an established internal security channel.

38. RANSOMWARE

Ransomware can affect confidentiality, integrity, and availability and may constitute or result in a reportable breach. MDTelemed should maintain prevention, detection, containment, backup/recovery, forensic, legal, and notification procedures appropriate to ransomware risk.

39. AI TELESCRIBE SECURITY

MDTelemed plans to use an AI-assisted telescribe to help human MD physicians document progress notes. The AI is not an autonomous clinician. Before deployment, MDTelemed must verify what audio, transcript, note, metadata, and identifiers are transmitted; which entities process them; whether a BAA is required; retention and deletion behavior; model-training/data-use terms; access controls; security architecture; and incident-notification obligations.

40. AUDIO AND RECORDING

Security policy must match the actual telescribe architecture. Streaming audio for processing, temporary buffering, retained audio, transcription, and a permanent recording are not interchangeable concepts. MDTelemed should not tell patients that recordings are deleted, encrypted in a particular manner, or never retained unless those statements have been technically verified and contractually supported.

41. PATIENT PORTAL

MDTelemed has confirmed that patients are intended to have portal access to records in PDF format. Portal security should include appropriate authentication, authorization, session management, secure transmission, access logging, and recovery procedures based on verified implementation.

42. ACCOUNT SECURITY FOR PATIENTS

Patients should use unique credentials, protect access devices, avoid sharing passwords or authentication codes, log out of shared devices, keep contact information current, and promptly report suspected account compromise. MDTelemed should never ask patients to send passwords through ordinary email.

43. IDENTITY VERIFICATION

MDTelemed should use reasonable identity-verification measures appropriate to the service and risk. Security procedures should avoid unnecessary collection of sensitive identifiers merely because they might help identification. Identity-verification claims should match the actual system.

44. PAYMENT SECURITY

Payment-card security obligations depend on the actual payment architecture and processor. MDTelemed should determine its PCI DSS responsibilities and accurately disclose whether card data is entered into or passes through MDTelemed systems. The original statement that a PCI DSS Level 1 processor handles payments and cards are never stored by MDTelemed is not retained as an unverified fact.

45. ANALYTICS, COOKIES, AND TRACKING

MDTelemed expects to use cookies, analytics, and marketing technologies. Health-related browsing, appointment, portal, or clinical data can create substantial privacy and security risk when transmitted to tracking technologies. MDTelemed must inventory trackers, map data flows, prevent impermissible PHI disclosures, obtain legally required consent, honor opt-outs, and align this Policy with the Cookie/Tracking and Privacy Policies.

46. EMAIL AND SMS

Email and SMS can have privacy and security limitations. MDTelemed should distinguish transactional, clinical, security, and marketing communications and avoid placing unnecessary sensitive information in insecure channels. Authentication and verification should be used before disclosing protected information where appropriate.

47. DATA MINIMIZATION

MDTelemed should collect, retain, and expose only information reasonably necessary for legitimate clinical, legal, security, payment, operational, and patient-service purposes. Data minimization reduces breach impact and unnecessary privacy risk.

48. RETENTION AND SECURE DISPOSAL

Medical records, HIPAA documentation, security records, financial records, consent evidence, logs, and other data may have different retention requirements. MDTelemed should maintain a legally reviewed retention schedule. When information or media are eligible for disposal, they should be destroyed or rendered unreadable and unrecoverable using methods appropriate to the media and data.

49. SECURITY INCIDENT DEFINITION

A security incident can include attempted or successful unauthorized access, use, disclosure, modification, destruction, interference with system operations, malware, credential compromise, lost devices, vendor incidents, misdirected communications, inappropriate internal access, or other events affecting information security. Not every security incident is a legally reportable breach.

50. INCIDENT RESPONSE

MDTelemed should maintain a documented incident-response process for detection, reporting, triage, containment, preservation of evidence, investigation, eradication, recovery, legal/privacy assessment, communications, notification, remediation, and lessons learned. The original promise that an 'Incident Response Team' will always be activated within exactly 24 hours is not retained unless an operational service level is formally adopted.

51. BREACH ASSESSMENT UNDER HIPAA

A HIPAA 'breach' generally involves an impermissible acquisition, access, use, or disclosure of unsecured PHI that compromises its security or privacy, subject to regulatory exceptions. HIPAA provides a presumption of breach unless the covered entity or business associate demonstrates through the required risk assessment that there is a low probability the PHI has been compromised or an exception applies.

52. HIPAA INDIVIDUAL NOTICE

When HIPAA requires individual breach notification, notice must be provided without unreasonable delay and no later than 60 calendar days after discovery. The notice must contain the information required by 45 C.F.R. § 164.404, including a description of what happened, types of information involved, protective steps individuals should consider, mitigation/prevention steps, and contact information.

53. HIPAA NOTICE TO HHS

For a breach affecting 500 or more individuals, the covered entity must notify the HHS Secretary without unreasonable delay and no later than 60 calendar days after discovery. For breaches affecting fewer than 500 individuals, notification to the Secretary may be made annually and is due no later than 60 days after the end of the calendar year in which the breach was discovered.

54. HIPAA MEDIA NOTICE

If a breach affects more than 500 residents of a state or jurisdiction, HIPAA generally requires notice to prominent media outlets serving that state or jurisdiction, in addition to individual notice. The original wording 'threshold: 500+ residents' conflated different HIPAA notification thresholds and is corrected here.

55. BUSINESS ASSOCIATE BREACHES

A HIPAA business associate must notify the covered entity after discovering a breach of unsecured PHI. Contract terms should address timing, information sharing, cooperation, investigation, and which party will perform required notifications. MDTelemed should not assume a vendor will automatically handle all notifications.

56. STATE BREACH LAWS

State breach-notification laws can apply independently of HIPAA and may protect information beyond PHI. They vary in definitions, regulator notice, timing, content, credit-monitoring obligations, consumer-reporting-agency notice, and sector-specific requirements. MDTelemed's national launch requires a current 50-state plus DC and applicable-territory breach-notification matrix.

57. THE SHORTEST DEADLINE MAY CONTROL

HIPAA's outside 60-day individual-notice period does not mean MDTelemed can wait 60 days in every case. HIPAA requires notice without unreasonable delay, and state laws may impose shorter or differently triggered deadlines. Incident counsel should identify the applicable jurisdictions and deadlines immediately.

58. FTC HEALTH BREACH NOTIFICATION RULE

The FTC Health Breach Notification Rule applies to specified vendors of personal health records, PHR-related entities, and service providers that are not covered by HIPAA for the relevant activity. The 2024 amendments clarified application to many health apps and connected technologies. MDTelemed should analyze whether any non-HIPAA product, service, or data flow falls within the FTC rule rather than assuming HIPAA displaces every possible FTC obligation.

59. FTC RULE TIMING

For entities covered by the FTC Health Breach Notification Rule, affected individuals generally must be notified without unreasonable delay and no later than 60 calendar days after discovery. For breaches involving 500 or more individuals, FTC notification is generally due at the same time individuals are notified; the Rule also provides media-notice requirements in specified circumstances.

60. CONSUMER-PROTECTION ACCURACY

Security representations must be truthful. MDTelemed should not market itself as 'military-grade,' 'unhackable,' '100% secure,' 'HIPAA certified,' 'SOC 2 certified,' or make similar claims unless the terminology is accurate, substantiated, and approved. Security promises can themselves become enforceable consumer representations.

61. SOC 2

SOC 2 is an independent attestation framework, not a substitute for HIPAA compliance. The original policy stated that MDTelemed undergoes an annual SOC 2 Type II audit. That claim must be removed from the public policy unless MDTelemed actually has a current applicable report and can substantiate the representation.

62. SECURITY CERTIFICATIONS

MDTelemed should maintain a verified register of security certifications, attestations, penetration-test reports, audit reports, and vendor certifications. Only current, applicable, appropriately scoped claims should be published.

63. BREACH COMMUNICATIONS

Incident communications should be coordinated so that patients receive accurate information without speculation. MDTelemed should not prematurely state that data were or were not accessed until the investigation supports the conclusion. Required notices should not be delayed for public-relations convenience.

64. LAW ENFORCEMENT DELAY

HIPAA permits delay of breach notification when a law-enforcement official states that notification would impede a criminal investigation or cause damage to national security, subject to regulatory requirements. Any such delay should be documented and handled with counsel.

65. MEDICAL IDENTITY THEFT

A breach can expose patients to medical identity theft as well as financial identity theft. Depending on the information involved, patient notices may recommend monitoring medical records, explanation-of-benefits statements, financial accounts, passwords, credit reports, or other relevant safeguards.

66. INCIDENT EVIDENCE

MDTelemed should preserve relevant logs, system images, communications, vendor notices, access records, configuration information, and other evidence needed to investigate an incident. Evidence preservation should be coordinated with legal and forensic requirements.

67. CYBER INSURANCE

If MDTelemed purchases cyber insurance, the policy's notice, panel-vendor, consent, forensic, ransom, and coverage requirements should be integrated into incident response. This public Policy does not represent that cyber insurance is currently in force.

68. SECURITY TRAINING

Workforce members should receive security and privacy training appropriate to their roles and risk. Training should cover account security, phishing, PHI handling, remote work, incident reporting, social engineering, approved communication channels, and patient privacy.

69. SANCTIONS

MDTelemed should maintain appropriate sanctions for workforce members who fail to comply with security policies. Sanctions should be consistent, documented, and appropriate to the nature and severity of the violation, while preserving fair investigation procedures.

70. SECURITY COMPLAINTS AND REPORTS

Patients who believe their MDTelemed account or information has been compromised should contact MDTelemed promptly. Security concerns, suspicious messages, account takeover, or privacy complaints may be sent to Support@MDTelemed.com until a dedicated verified security/privacy contact is established.

71. NO RETALIATION

MDTelemed should not retaliate against a patient or workforce member for making a good-faith privacy or security complaint, reporting a suspected incident, or exercising rights protected by law.

72. PATIENT RESPONSIBILITIES

Patients share a practical role in account security but are not responsible for MDTelemed's legal security obligations.

73. MDTelemed RESPONSIBILITIES

MDTelemed is responsible for maintaining reasonable and appropriate safeguards, evaluating risks, controlling authorized access, managing vendors, responding to incidents, and providing required notifications according to applicable law.

74. NATIONAL COMPLIANCE ARCHITECTURE

For a 50-state launch, cybersecurity cannot be governed solely by HIPAA. MDTelemed should map HIPAA, state medical-information laws, state general breach laws, consumer health-data laws, general privacy statutes, payment-security obligations, communications laws, and any applicable FTC requirements to its actual data flows.

75. CHANGES TO THIS POLICY

MDTelemed may update this Policy as technology, law, threats, and operations change. A public revision should not silently claim that a new technical control existed before it was implemented. Version history should preserve the effective date of material changes.

76. CONTACT

MDTelemed LLC 304 S Jones Blvd #4872 Las Vegas, NV 89107 Business Administration / Privacy & Security Contact: Support@MDTelemed.com

77. PATIENT ACCOUNT SECURITY PRACTICES

Use a unique password or other credential for MDTelemed and do not reuse it across unrelated services. Do not share passwords, one-time codes, recovery links, or authentication tokens. Use device locks and current operating-system/browser security updates. Avoid accessing sensitive records on public or untrusted computers when possible. Be cautious of messages asking for credentials, payment, or sensitive medical information. Verify that communications claiming to be from MDTelemed are legitimate before following unusual instructions. Log out of shared devices and protect downloaded PDF medical records. Promptly report a lost device, suspicious login, unauthorized record access, or account takeover. Keep email address and telephone information current so account-recovery and security notices reach you. Perform and document the HIPAA Security Rule enterprise risk analysis covering all ePHI systems and vendors. Confirm whether MDTelemed LLC is acting as covered entity, business associate, or both for each relevant data flow; correct accordingly. Inventory every system that creates, receives, maintains, or transmits ePHI or consumer health data. Verify encryption at rest: algorithms, scope, databases, files, object storage, endpoints, backups, logs, and key management. Verify encryption in transit: TLS versions, video transport, APIs, portals, email/SMS pathways, certificates, and vendor connections. Verify MFA/passkey requirements for physicians, administrators, workforce, and privileged accounts. Verify actual password and session-management controls before publishing any numerical requirements. Verify RBAC/least-privilege architecture and exactly which roles can access which patient data. Verify audit-log events, fields, protection, monitoring, and retention periods. Verify alerting, SIEM/monitoring, endpoint security, vulnerability scanning, penetration testing, patch management, and secure-development practices. Verify backup frequency, encryption, immutability, geographic redundancy, RPO/RTO, restoration testing, and disaster-recovery procedures. Do not publish a 99.9% uptime SLA unless contractually and operationally approved. Determine whether MDTelemed has or will obtain SOC 2 Type II; do not claim an audit exists until a current report exists. Identify cloud hosting provider(s), EHR, video, e-prescribing, laboratory, payment, SMS/email, identity, analytics, and AI telescribe vendors and execute BAAs where required. Verify AI telescribe audio/transcript retention, deletion, training use, subprocessors, security, BAA, and incident obligations. Inventory Google Analytics, Meta Pixel, TikTok Pixel, Google Ads, session replay, cookies, SDKs, and all other trackers; prevent impermissible PHI/health-data transmission. Complete a PCI DSS responsibility analysis with the actual payment processor and integration architecture. Create a formal incident-response plan, incident severity framework, escalation contacts, forensic process, evidence-preservation plan, communications plan, and tabletop testing schedule. Create a 50-state + DC + territory breach-notification matrix and consumer-health-data law matrix. Create an HHS/OCR breach-assessment and reporting workflow for <500 and 500+ individual breaches. Evaluate applicability of the FTC Health Breach Notification Rule to any non-HIPAA MDTelemed activity or product. Create vendor security due-diligence and incident-notification standards. Create a legally reviewed retention and secure-disposal schedule. Establish dedicated Privacy Officer/Security Officer contacts if MDTelemed chooses to publish those roles. Have qualified HIPAA/privacy/cybersecurity counsel and the production security/engineering lead jointly sign off before publishing technical claims.

78. PRIMARY REFERENCES

79. C.F.R. Part 164, Subpart C — HIPAA Security Rule.

80. C.F.R. §§ 164.400-414 — HIPAA Breach Notification Rule.

U.S. Department of Health and Human Services, Summary of the HIPAA Security Rule. HHS OCR, Guidance on Risk Analysis Requirements under the HIPAA Security Rule. HHS OCR, Is the use of encryption mandatory in the Security Rule? HHS OCR, Breach Notification Rule guidance. HHS OCR, Submitting Notice of a Breach to the Secretary (reviewed February 13, 2026). Federal Trade Commission, Health Breach Notification Rule, 16 C.F.R. Part 318, including 2024 amendments. FTC, Complying with the Health Breach Notification Rule. National Institute of Standards and Technology, SP 800-66 Rev. 2, Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide. Applicable state data-breach, medical-information, consumer-health-data, privacy, and cybersecurity laws. Original MDTelemed Data Security & Cybersecurity Policy — used as source material; unverified technical specifications, SOC 2 claims, SLA claims, and inaccurate breach-timing language were not retained as facts.

81. SOURCE LINKS

HHS Security Rule summary: https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html HHS Risk Analysis guidance: https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html HHS Encryption FAQ: https://www.hhs.gov/hipaa/for-professionals/faq/2001/is-the-use-of-encryption-mandatory-in-the-security-rule/index.html HHS Breach Notification: https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html HHS Breach Reporting: https://www.hhs.gov/hipaa/for-professionals/breach-notification/breach-reporting/index.html FTC Health Breach Notification Rule: https://www.ftc.gov/legal-library/browse/rules/health-breach-notification-rule FTC HBNR compliance guidance: https://www.ftc.gov/business-guidance/resources/complying-ftcs-health-breach-notification-rule-0 NIST SP 800-66 Rev. 2: https://csrc.nist.gov/pubs/sp/800/66/r2/final

82. END OF

SECURITY INCIDENT - BREACH RESPONSE AND PATIENT NOTIFICATION

Security Incident / Breach Response and Patient Notification

Version 1.0 | Effective September 16, 2026

1. Policy Statement

MDTelemed adopts this policy to establish a consistent, patient-centered and legally compliant framework for security incident / breach response and patient notification. This policy must be implemented together with applicable federal law, the law of the patient's physical location, professional standards, and MDTelemed's other clinical and privacy policies.

2. Purpose

This policy establishes detection, containment, investigation, risk assessment, documentation, notification, and remediation for privacy/security incidents.

3. Immediate Actions

Suspected compromise should be promptly escalated, access contained where appropriate, evidence preserved, and affected systems assessed.

4. HIPAA Breach Analysis

Incidents involving unsecured PHI must be evaluated under the HIPAA Breach Notification Rule and applicable state law.

5. Patient Notice

When notification is required, notices must satisfy applicable timing, content, and delivery requirements.

6. Vendor Incidents

Contracts should require timely vendor reporting and cooperation with investigation and notification obligations.

7. Post-Incident Review

Material incidents should result in corrective-action tracking and reassessment of relevant safeguards.

8. Roles and Responsibilities

MDTelemed management is responsible for operational implementation and periodic review. Clinicians remain responsible for independent professional judgment and documentation. Workforce members must follow role-based access, confidentiality, escalation, and incident-reporting requirements. Material conflicts between this policy and controlling law must be escalated to compliance/legal review before the affected workflow is used.

9. Training and Monitoring

Affected personnel should receive role-appropriate training. MDTelemed may audit compliance, investigate deviations, and implement corrective action when needed.

10. Exceptions

No exception may waive a mandatory legal or patient-safety requirement. Operational exceptions should be documented and approved by an authorized leader when appropriate.

11. Primary Regulatory / Guidance References

U.S. Department of Health and Human Services, HIPAA Privacy, Security and Breach Notification Rules, 45 C.F.R. Parts 160 and 164. HHS Telehealth guidance regarding HIPAA and remote communication technologies. Applicable state medical-practice, telehealth, privacy, recording, consumer-protection and professional-licensure laws.

12. C.F.R. §§ 164.400–414 (HIPAA Breach Notification Rule), as applicable.

MEDICAL RECORDS - ACCESS - AMENDMENT - RELEASE

1. MDTELEMED LLC

2. MEDICAL RECORDS ACCESS, AMENDMENT & RELEASE POLICY

Version 1.0 | September 15, 2026

Patient-facing national baseline. This Policy is designed to protect lawful patient access while avoiding promises about portals, export formats, release channels, fees, or interoperability functions that MDTelemed has not verified. MDTelemed has confirmed PDF as its intended patient-record delivery format.

3. PURPOSE

This Policy explains how patients and legally authorized representatives may request access to, copies of, amendments to, and lawful disclosures of medical and billing information maintained by MDTelemed LLC. It also explains important HIPAA limitations, identity verification, representatives, minors, behavioral-health records, release authorizations, legal process, electronic access, fees, and information-blocking principles.

4. MDTelemed'S COMMITMENT

MDTelemed will not intentionally obstruct lawful patient access to records. Requests will be processed under HIPAA, applicable state law, federal information-blocking rules where applicable, specialized confidentiality laws, and valid legal restrictions.

5. DESIGNATED RECORD SET

Under HIPAA, the designated record set generally includes medical records and billing records maintained by or for a covered health-care provider and other records used, in whole or in part, to make decisions about individuals. Whether a particular item is within the designated record set depends on its function and maintenance, not merely its file name.

6. RECORDS GENERALLY AVAILABLE FOR ACCESS

Subject to applicable exceptions, a patient's accessible records may include physician progress notes, histories, assessments, diagnoses, medication information, allergies, orders, laboratory and imaging reports received by MDTelemed, referrals, treatment plans, patient-submitted information incorporated into the record, and billing/payment records within the designated record set.

7. RECORDS NOT AUTOMATICALLY WITHIN THE HIPAA ACCESS RIGHT

HIPAA excludes psychotherapy notes and information compiled in reasonable anticipation of, or for use in, a civil, criminal, or administrative action or proceeding from the access right in 45 C.F.R. § 164.524. Other information may fall outside the designated record set. State law may provide broader or different rights.

8. PSYCHOTHERAPY NOTES

Psychotherapy notes have a narrow HIPAA definition: notes recorded by a mental-health professional documenting or analyzing the contents of counseling conversation during a private counseling session or group/joint/family counseling session, maintained separately from the rest of the medical record. Medication information, session start/stop times, modalities/frequencies, test results, and summaries of diagnosis, functional status, treatment plan, symptoms, prognosis, and progress are excluded from that definition.

9. ORDINARY PSYCHIATRIC PROGRESS NOTES

An ordinary psychiatric progress note is not automatically a HIPAA 'psychotherapy note' merely because it concerns mental health. MDTelemed should classify records based on the federal definition and applicable state law rather than using a broad behavioral-health label to deny access.

10. PATIENT REQUESTS

Patients may request records using the patient-facing mechanism MDTelemed ultimately implements. Until a dedicated records address is operationally verified, requests may be directed to Support@MDTelemed.com or mailed to MDTelemed LLC, 304 S Jones Blvd #4872, Las Vegas, NV 89107. The final website should provide a clear records-request pathway.

11. PORTAL ACCESS

MDTelemed has indicated that patients will have a portal and that PDF delivery will be supported. The original promise of 'instant download' should not be published until the production portal is tested and records made available through it are defined. Portal access can supplement, but should not unlawfully replace, other required access mechanisms.

12. PDF FORMAT

MDTelemed's confirmed intended patient-record delivery format is PDF. If a patient requests an electronic copy and the PHI is readily producible in the requested electronic form and format, HIPAA requires provision in that form and format; if it is not readily producible, MDTelemed and the individual should agree on a readable electronic alternative as required by the rule.

13. CSV, TEXT, EXCEL, HL7, AND FHIR

The original promised text, CSV, and FHIR exports. MDTelemed has not verified those capabilities and previously confirmed PDF as the supported patient-record format. Those export promises are therefore removed. If federal law later requires access through a certified health IT capability applicable to MDTelemed, the technical and legal requirements should be implemented and this Policy updated.

14. PAPER COPIES

If paper copies are requested and required to be provided under applicable law, MDTelemed should provide them or arrange an appropriate method. A patient should not be forced to accept an electronic format when the governing access rule entitles the patient to another readily producible form.

15. IDENTITY VERIFICATION

MDTelemed may take reasonable steps to verify the identity of a person requesting PHI and the authority of a person acting for a patient. Verification must not be used as an unreasonable barrier to access.

16. NO UNREASONABLE ID REQUIREMENTS

HIPAA permits reasonable identity verification but access procedures should not create unnecessary obstacles. MDTelemed should avoid demanding notarization, in-person appearance, or burdensome documentation unless a specific legal or factual circumstance justifies it.

17. PERSONAL REPRESENTATIVES

A person authorized under applicable law to act on behalf of an individual in making health-care decisions may have rights as the individual's HIPAA personal representative, subject to statutory exceptions. Guardianship, health-care powers of attorney, custody, and other authority should be verified as appropriate.

18. MINORS

Access to a minor's records is not governed by a single national parental-access rule. State law determines when a parent or guardian is the personal representative and when a minor may consent independently or control confidentiality for particular services. and govern the pediatric/minor framework.

19. EMANCIPATED AND SELF-CONSENTING MINORS

Where a minor lawfully consents to care without parental consent, or another HIPAA exception applies, the parent may not automatically control access to all information related to that care. State-specific minor-consent and confidentiality law must be applied.

20. DECEASED PATIENTS

Access and disclosure after death depend on HIPAA personal-representative rules, estate authority, state law, and the purpose of the request. MDTelemed should verify the requester's legal authority before releasing records.

21. REQUESTS BY CAREGIVERS OR FAMILY

A family relationship alone does not necessarily authorize unrestricted access to another adult's records. MDTelemed may rely on a valid authorization, personal-representative authority, HIPAA permissions for involvement in care/payment, or another lawful basis depending on the request.

22. ACCESS TIMEFRAME

HIPAA currently requires action on an access request no later than 30 calendar days after receipt. If MDTelemed cannot act within that period, one extension of no more than 30 additional calendar days is permitted if the individual receives a timely written explanation of the delay and the date by which action will be completed.

23. STATE LAW MAY BE FASTER

Some states impose shorter medical-record access or copying deadlines. MDTelemed's national workflow must therefore apply the faster or otherwise more protective state requirement where it governs. A 30-day HIPAA ceiling should not be treated as permission to ignore a shorter state deadline.

24. ACCESS FEES

HIPAA permits only a reasonable, cost-based fee for certain labor, supplies, postage, and preparation of an agreed summary or explanation, subject to the regulation and HHS guidance. State law may impose additional limits. MDTelemed should not use record-copy fees as a barrier to patient access.

25. NO SEARCH/RETRIEVAL FEE UNDER HIPAA ACCESS CALCULATION

For HIPAA individual access, HHS guidance limits what can be included in a reasonable cost-based fee. MDTelemed should not automatically pass through broad administrative, retrieval, infrastructure, verification, or record-maintenance costs as access fees.

26. ADVANCE FEE NOTICE

If MDTelemed charges a permissible access fee, the patient should be informed in advance when practicable. The final fee schedule should be legally reviewed against HIPAA and each applicable state law before publication.

27. DIRECTING RECORDS TO ANOTHER PERSON

A patient may request that records be sent to another person or entity. The exact legal mechanism depends on whether the request is made under the HIPAA access right, a HIPAA authorization, state law, or another rule. MDTelemed should honor legally sufficient directions without imposing unnecessary friction.

28. HIPAA RIGHT TO DIRECT ELECTRONIC PHI

The scope of the HIPAA right to direct records to third parties has changed through statute, litigation, and rulemaking history. MDTelemed should follow the current version of 45 C.F.R. § 164.524 and current HHS guidance at the time of the request rather than relying on outdated summaries.

29. AUTHORIZATIONS FOR RELEASE

When HIPAA requires an authorization, it must contain the elements required by 45 C.F.R. § 164.508 and must be written in plain language. MDTelemed should not use blanket authorizations that are broader than necessary or combine authorizations in ways prohibited by law.

30. CORE AUTHORIZATION ELEMENTS

A valid HIPAA authorization generally identifies the information to be disclosed, the persons or classes authorized to make and receive the disclosure, the purpose or applicable at-the-request-of-the-individual statement, expiration, signature/date, and required statements regarding revocation, conditioning, and potential redisclosure.

31. REVOCATION OF AUTHORIZATION

An individual generally may revoke a HIPAA authorization in writing, except to the extent MDTelemed has already taken action in reliance on it or another regulatory exception applies. Revocation does not retroactively retrieve information already lawfully disclosed.

32. TREATMENT, PAYMENT, AND HEALTH-CARE OPERATIONS

HIPAA generally permits covered entities to use and disclose PHI for treatment, payment, and health-care operations without obtaining a separate authorization, subject to the Privacy Rule and specialized restrictions. A patient records-release authorization should not be demanded for every routine treatment disclosure.

33. TREATMENT COORDINATION

MDTelemed physicians may share relevant PHI with other treating providers when permitted by HIPAA and other applicable law. Specialized mental-health, substance-use, reproductive-health, genetic, HIV/STI, minor, or other confidentiality rules may require additional analysis.

34. SUBSTANCE USE DISORDER RECORDS

If MDTelemed creates or receives records subject to 42 C.F.R. Part 2, those records may have additional confidentiality requirements. MDTelemed has stated that it will not provide buprenorphine/OUD treatment, but Part 2 applicability depends on program status and records—not solely on whether buprenorphine is prescribed.

35. REPRODUCTIVE HEALTH PRIVACY

Requests involving reproductive-health information require current HIPAA and state-law review. Federal requirements in this area have changed through rulemaking and litigation; MDTelemed should not rely on static boilerplate when responding to subpoenas, investigations, or requests potentially involving lawful reproductive health care.

36. HIV, STI, GENETIC, AND OTHER SPECIALLY PROTECTED INFORMATION

States may impose special authorization, consent, redisclosure, or access rules for HIV/STI, genetic, mental-health, developmental-disability, sexual-assault, reproductive-health, or other sensitive information. MDTelemed must use state-specific release rules where applicable.

37. LAW ENFORCEMENT REQUESTS

MDTelemed does not release a patient's complete medical record merely because law enforcement asks. The legal basis, scope, identity of requester, HIPAA permission/requirement, warrant/court order/subpoena status, specialized confidentiality law, and applicable state protections must be evaluated.

38. SUBPOENAS

A subpoena is not automatically equivalent to a patient authorization or court order. HIPAA's judicial/administrative proceeding rules and state law may require satisfactory assurances, a qualified protective order, notice, court process, or another condition before disclosure.

39. COURT ORDERS

When disclosure is required by a valid court order, MDTelemed should disclose only the PHI expressly authorized or required by the order unless another lawful basis supports additional disclosure.

40. ATTORNEY REQUESTS

An attorney representing a patient does not automatically obtain records solely by identifying as counsel. MDTelemed should obtain a legally sufficient authorization or other authority unless disclosure is otherwise permitted or required by law.

41. INSURERS, EMPLOYERS, AND SCHOOLS

MDTelemed should not disclose records to an employer, school, insurer, or other third party merely upon request. The disclosure must have a valid legal basis, authorization, or HIPAA permission as applicable.

42. PUBLIC HEALTH AND REQUIRED REPORTING

HIPAA permits or requires certain disclosures for public-health, abuse/neglect, health oversight, judicial, law-enforcement, and other purposes specified in the Privacy Rule. This Policy does not create a patient veto over disclosures MDTelemed is legally required to make.

43. MINIMUM NECESSARY

For many HIPAA uses/disclosures, MDTelemed must make reasonable efforts to limit PHI to the minimum necessary. The minimum-necessary standard generally does not apply to disclosures to or requests by a health-care provider for treatment, disclosures to the individual, uses/disclosures pursuant to an authorization, or certain other exceptions.

44. PATIENT ACCESS IS NOT MINIMUM-NECESSARY LIMITED

MDTelemed should not improperly apply the minimum-necessary rule to shrink a patient's own lawful HIPAA access request. The access right has its own scope and exceptions.

45. AMENDMENT RIGHT

Under 45 C.F.R. § 164.526, an individual has the right to request amendment of PHI or a record about the individual in a designated record set for as long as MDTelemed maintains the information, subject to regulatory grounds for denial.

46. AMENDMENT REQUEST PROCESS

MDTelemed may require amendment requests to be in writing and to provide a reason supporting the requested amendment, provided patients are informed of that requirement in advance. Until a dedicated records email is verified, requests may be sent to Support@MDTelemed.com.

47. AMENDMENT TIMEFRAME

HIPAA requires MDTelemed to act on an amendment request no later than 60 days after receipt. If it cannot act within 60 days, it may extend once by no more than 30 days if it provides a timely written explanation and completion date. The original vague '30-60 days' statement is replaced with the actual federal rule.

48. GROUNDS FOR DENIAL OF AMENDMENT

MDTelemed may deny an amendment request if it determines that the information was not created by MDTelemed, unless the originator is no longer available to act; is not part of the designated record set; would not be available for inspection under § 164.524; or is accurate and complete.

49. PROFESSIONAL OPINIONS

The amendment right is not a right to force a physician to replace a professional judgment merely because the patient disagrees. A factual error may warrant correction; a disputed clinical opinion may instead be addressed through the HIPAA disagreement process when amendment is denied.

50. ACCEPTED AMENDMENTS

When an amendment is accepted, MDTelemed must make the appropriate amendment to the affected PHI or record, identify the affected records, append or otherwise provide a link to the location of the amendment, inform the individual, and make reasonable efforts to notify persons identified by the individual and others known to have relied or foreseeably may rely on the information as specified by the rule.

51. ORIGINAL ENTRY PRESERVATION

Medical-record integrity generally favors preserving the original entry and adding a dated correction/amendment or appropriate linkage rather than silently deleting or overwriting historical documentation. MDTelemed should maintain an auditable correction process consistent with law and its EHR architecture.

52. DENIED AMENDMENTS

If an amendment is denied, MDTelemed must provide a timely written denial in plain language containing the basis for denial, the individual's right to submit a statement of disagreement, the process for doing so, the ability to request that the amendment request and denial accompany future disclosures if no disagreement is submitted, and complaint information required by HIPAA.

53. STATEMENT OF DISAGREEMENT

A patient may submit a reasonable statement disagreeing with a denied amendment. MDTelemed may reasonably limit its length. MDTelemed may prepare a written rebuttal but must provide a copy of any rebuttal to the individual.

54. FUTURE DISCLOSURES AFTER AMENDMENT DISPUTE

HIPAA specifies how amendment requests, denials, statements of disagreement, and rebuttals are linked to or included with certain future disclosures. MDTelemed's EHR workflow should implement those requirements rather than merely placing an informal note in the chart.

55. DENIAL OF ACCESS

HIPAA recognizes grounds for denying access. Some are unreviewable; some give the individual a right to review by a licensed health-care professional who did not participate in the original denial decision. MDTelemed must classify the denial correctly.

56. UNREVIEWABLE DENIALS

Examples in § 164.524 include psychotherapy notes, information compiled for legal proceedings, certain records of correctional institutions, certain research circumstances, certain Privacy Act records, and information obtained under a promise of confidentiality where access would be reasonably likely to reveal the source, subject to the exact regulatory conditions.

57. REVIEWABLE DENIALS

HIPAA provides review rights for specified denials involving likely endangerment to life or physical safety, likely substantial harm to another referenced person, or certain personal-representative circumstances. The review must be performed by another licensed health-care professional designated by MDTelemed who did not participate in the original denial.

58. PARTIAL ACCESS

If only part of the requested information is subject to denial, MDTelemed must provide access to the remainder after excluding the denied information, to the extent required by HIPAA.

59. WRITTEN DENIAL

A HIPAA access denial must be timely, written in plain language, state the basis, explain review rights when applicable, and explain how to complain to MDTelemed or HHS as required by the regulation.

60. INFORMATION BLOCKING

The 21st Century Cures Act and ONC information-blocking regulations prohibit certain actors from engaging in practices likely to interfere with access, exchange, or use of electronic health information when the actor knows or should know the practice is likely to interfere, unless an exception applies. Applicability depends on whether MDTelemed or a relevant entity is an actor covered by the rule.

61. INFORMATION-BLOCKING ACTORS

ONC's rule applies to defined health-care providers, health information networks/health information exchanges, and developers of certified health IT. MDTelemed should confirm which legal entity and technology components fall within those definitions rather than simply declaring blanket Cures Act compliance.

62. ELECTRONIC HEALTH INFORMATION

The information-blocking rule's EHI scope is defined by federal regulation and has evolved over time. MDTelemed should configure access and exchange processes around the current regulatory definition and any applicable exceptions.

63. INFORMATION-BLOCKING EXCEPTIONS

ONC has regulatory exceptions, including preventing harm, privacy, security, infeasibility, health IT performance, content and manner, fees, and licensing. An exception is not a blanket excuse; its conditions must be met.

64. NO 'FRICTIONLESS' GUARANTEE

The original Policy promised that patients could transfer records electronically 'without friction.' That is not a defensible operational guarantee. MDTelemed instead commits not to impose unreasonable or unlawful barriers and to support access/exchange capabilities actually implemented and legally required.

65. API/FHIR ACCESS

MDTelemed should not promise FHIR/API access unless the production health IT and applicable federal requirements support it. If MDTelemed uses certified health IT subject to standardized API obligations, its implementation should be separately validated.

66. LABORATORY AND IMAGING RECORDS

MDTelemed may order laboratory tests and imaging. Results maintained by MDTelemed may fall within its designated record set. The testing laboratory or imaging facility may separately maintain records and have independent access obligations.

67. EXTERNAL RECORDS

Records received from another provider and maintained in MDTelemed's designated record set may be subject to the patient's HIPAA access right even though MDTelemed did not create them. 'We did not create it' is not, by itself, a HIPAA access-denial ground.

68. EXTERNAL RECORDS AND AMENDMENT

For amendment, however, MDTelemed may deny a request concerning information it did not create unless the originator is no longer available to act on the requested amendment, subject to the rule.

69. AI TELESCRIBE MATERIALS

MDTelemed's AI telescribe assists clinical documentation. Whether raw audio, transcript drafts, intermediate outputs, or other artifacts are retained and whether any become part of the designated record set depends on the actual technical architecture, record-use practices, and applicable law. MDTelemed must not promise access to or destruction of artifacts whose status has not been verified.

70. FINAL SIGNED CLINICAL NOTE

The physician-finalized clinical note maintained as part of the medical record is generally treated as part of the clinical record/designated record set, subject to applicable law. The physician remains responsible for reviewing and finalizing documentation.

71. RECORDING OF ENCOUNTERS

If MDTelemed records encounter audio or video, the recording's legal status, retention, access, and disclosure must be determined under the actual AI telescribe architecture, recording consent, designated-record-set analysis, state recording laws, and retention policy. This Policy does not invent a blanket rule.

72. ACCOUNT TERMINATION

Closing, suspending, or terminating a patient's MDTelemed account does not extinguish lawful medical-record access rights. MDTelemed must preserve a mechanism for former users to request records.

73. PATIENT DEATH OR BUSINESS CLOSURE

MDTelemed must maintain lawful record-custody and access arrangements if the business closes, changes ownership, or ceases a service line. State medical-record custody laws may require notices, custodians, transfer procedures, or specific retention.

74. RECORD RETENTION

governs record retention and destruction. A request for deletion under a consumer privacy law does not automatically require deletion of medical records that MDTelemed must or may lawfully retain.

75. LEGAL HOLDS

Records subject to litigation hold, investigation, audit, preservation duty, or other legal requirement may need to be retained beyond an ordinary destruction date. Preservation does not necessarily eliminate the patient's access rights.

76. AUDIT TRAIL

MDTelemed should maintain an auditable record of material access, release, amendment, and correction actions appropriate to its system and legal obligations. Exact logging technology should not be promised until verified.

77. CONFIDENTIAL COMMUNICATIONS

HIPAA provides rights concerning requests for confidential communications in specified circumstances. MDTelemed's records-release workflow should coordinate with patient communication preferences and .

78. ACCOUNTING OF DISCLOSURES

HIPAA provides a right to an accounting of certain disclosures, subject to exclusions and time limits. This is distinct from a copy-of-records request and should be handled under the Notice of Privacy Practices and privacy workflow.

79. RESTRICTION REQUESTS

Patients may request restrictions on certain uses/disclosures under HIPAA. Most restriction requests need not be agreed to, but HIPAA contains a mandatory restriction in specified circumstances involving disclosure to a health plan where the individual has paid the provider in full out of pocket for the item/service and the other regulatory conditions are met.

80. CASH/SELF-PAY MODEL

MDTelemed currently operates on a cash/self-pay basis. This does not eliminate HIPAA record rights or the need to handle future payer-related disclosures correctly if the business model changes.

81. COMPLAINTS

A patient who believes MDTelemed improperly denied or delayed access, mishandled an amendment, or improperly disclosed records may use and may complain to HHS OCR where HIPAA applies. MDTelemed will not retaliate for exercising protected HIPAA rights.

82. NO WAIVER THROUGH TERMS OF USE

MDTelemed's Terms of Use, arbitration provisions, account rules, or membership terms should not purport to waive non-waivable HIPAA access, amendment, complaint, or other statutory rights.

83. CONTACT

MDTelemed LLC 304 S Jones Blvd #4872 Las Vegas, NV 89107 Medical Records / Business Administration: Support@MDTelemed.com Do not send emergency medical requests to this address.

84. PATIENT RECORDS REQUEST CHECKLIST

Identify the patient whose records are requested. Specify the records or date range requested when possible. Specify whether the request is for inspection, a copy, or transmission to another recipient. Choose PDF or another form/format that MDTelemed confirms is readily producible or otherwise agrees to provide. Provide destination information if records are to be sent elsewhere. Complete reasonable identity verification. If acting for another person, provide sufficient evidence of authority. Use a HIPAA authorization when the requested disclosure requires one. Do not include unnecessary sensitive medical details in ordinary unsecured email. Contact MDTelemed if a request has not been addressed within the legally applicable timeframe. Create and test the patient portal records-download workflow; confirm exactly which records are available and whether access is immediate. Confirm PDF generation, accessibility, completeness, metadata, and secure delivery. Do not advertise CSV, text, Excel, HL7, FHIR, API, or bulk export until technically supported and legally validated. Establish a dedicated records-request workflow; Support@MDTelemed.com remains the verified contact unless a dedicated address is actually created. Build HIPAA 30-day access tracking plus one permitted 30-day extension, with state-law overrides for faster deadlines. Build HIPAA 60-day amendment tracking plus one permitted 30-day extension. Create access-denial templates distinguishing reviewable from unreviewable denials and a licensed-professional review workflow. Create amendment acceptance, denial, statement-of-disagreement, rebuttal, and future-disclosure linkage workflows. Create a 50-state medical-record access, fee, minor-access, sensitive-record, subpoena, and retention matrix. Create personal-representative/guardian/parent authority verification procedures. Create legally compliant HIPAA authorization and revocation forms. Create subpoena, court-order, law-enforcement, attorney, insurer, employer, school, public-health, and mandatory-reporting release workflows. Verify whether MDTelemed/the clinical entity is an information-blocking 'health care provider' actor and whether its health IT creates additional certified-health-IT/API obligations. Inventory all retained AI telescribe artifacts and determine designated-record-set, retention, access, amendment, discovery, and deletion status. Determine whether encounter audio/video is retained; if so, classify it and align Policies 19 and 38. Create business-closure/record-custodian procedures for every state where required. Define lawful record-copy fee schedules; do not publish a national fee until HIPAA and state limits are reconciled. Implement former-patient access after account termination. Align with Policies 01, 06, 07, 11, 18, 19, 29, 33, and 38. Have qualified HIPAA, health-information-exchange, information-blocking, behavioral-health, and 50-state health-care counsel review the final production workflow.

85. PRIMARY LEGAL AND REGULATORY REFERENCES

HIPAA Privacy Rule, 45 C.F.R. § 164.524 — individual access to protected health information. HIPAA Privacy Rule, 45 C.F.R. § 164.526 — amendment of protected health information. HIPAA Privacy Rule, 45 C.F.R. § 164.508 — uses and disclosures requiring authorization. HIPAA Privacy Rule, 45 C.F.R. § 164.502 and § 164.514(d) — uses/disclosures, personal representatives, and minimum necessary. HIPAA Privacy Rule, 45 C.F.R. § 164.528 — accounting of disclosures. HIPAA Privacy Rule, 45 C.F.R. § 164.522 — restrictions and confidential communications. HHS Office for Civil Rights, Individuals' Right under HIPAA to Access their Health Information. 21st Century Cures Act, 42 U.S.C. § 300jj-52, and ONC Information Blocking Regulations, 45 C.F.R. Part 171. ONC, Information Blocking Exceptions.

86. C.F.R. Part 2 where substance-use-disorder records are within scope.

Applicable state medical-record access, copying-fee, minor confidentiality, mental-health, HIV/STI, genetic, reproductive-health, subpoena, retention, and record-custody laws. Original MDTelemed Medical Records Access & 21st Century Cures Act — used as source material; 'absolute' access, instant-download, FHIR/CSV/text, frictionless-transfer, and amendment-timing statements were corrected.

87. SOURCE LINKS

HIPAA Access Rule (45 C.F.R. § 164.524): https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.524 HIPAA Amendment Rule (45 C.F.R. § 164.526): https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.526 HIPAA Authorization Rule (45 C.F.R. § 164.508): https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508 HHS HIPAA Right of Access guidance: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html HHS Medical Records rights: https://www.hhs.gov/hipaa/for-individuals/medical-records/index.html ONC Information Blocking: https://www.healthit.gov/topic/information-blocking eCFR 45 C.F.R. Part 171: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-D/part-171

88. C.F.R. Part 2: https://www.ecfr.gov/current/title-42/chapter-I/subchapter-A/part-2

89. END OF

MEDICAL RECORD RETENTION AND DESTRUCTION

1. MDTELEMED LLC

2. MEDICAL RECORD RETENTION & DESTRUCTION NOTICE

Version 1.0 | September 15, 2026

National patient-facing baseline. MDTelemed intends to serve patients of all ages in all 50 states. Medical-record retention is not governed by one universal seven-year rule. The applicable retention period can depend on the patient's state, age, record type, physician/practice status, service, litigation or investigation, and other law. MDTelemed therefore uses the applicable legally reviewed state-specific retention schedule rather than publishing unsupported universal periods.

3. PURPOSE

This Policy explains MDTelemed LLC's approach to retaining, preserving, archiving, accessing, and securely disposing of medical records and related information. It is designed to prevent premature destruction while avoiding unsupported claims about retention periods, backup schedules, destruction vendors, or technical methods.

4. SCOPE

This Policy applies to records maintained by or for MDTelemed that are subject to medical-record, HIPAA, privacy, professional-practice, contractual, evidentiary, tax, corporate, employment, security, or other retention obligations. Different categories may have different retention periods.

5. MEDICAL RECORD DEFINITION

The medical record may include physician-finalized encounter notes, histories, diagnoses, treatment plans, prescriptions, medication lists, allergies, orders, laboratory and imaging results maintained by MDTelemed, referrals, clinically relevant patient communications, consent documentation, and other information maintained as part of the clinical record under applicable law.

6. DESIGNATED RECORD SET

HIPAA's designated record set is a regulatory concept and is not necessarily identical to every item stored in every MDTelemed system. MDTelemed should identify which records fall within a designated record set based on actual use and applicable law.

7. ONE NATIONAL RETENTION PERIOD IS NOT SAFE

State medical-record retention requirements vary. Some distinguish physicians from facilities, adults from minors, and active from inactive records; some calculate periods from the last encounter, age of majority, creation date, or another event. MDTelemed will apply the governing rule rather than assume seven years is always sufficient.

8. -STATE RETENTION SCHEDULE

Before national launch, MDTelemed must maintain a legally reviewed retention matrix for every jurisdiction in which it treats patients. The matrix should identify adult and minor rules, triggering events, special record categories, practice closure requirements, and any longer rule that applies to the actual MDTelemed structure.

9. LONGER CONTROLLING PERIOD

Where more than one retention requirement applies, MDTelemed should preserve the record for the longest period required by applicable law or a valid preservation obligation, unless counsel determines another rule controls.

10. MINIMUM IS NOT AUTOMATIC DESTRUCTION DATE

Expiration of a statutory minimum does not mean MDTelemed must immediately destroy the record. Litigation, investigation, audit, contractual, patient-safety, corporate, or other lawful reasons may require or justify longer retention.

11. ADULT RECORDS

Adult records will be retained according to the applicable state-specific rule and any superseding federal or preservation requirement. This Policy intentionally does not publish a single adult retention number.

12. PEDIATRIC RECORDS

Because MDTelemed treats patients from birth onward, pediatric retention requires special handling. Many jurisdictions use age-of-majority or post-majority calculations, but the formulas vary. A single 'majority plus two years' or 'majority plus five years' rule is not adopted nationally.

13. NEWBORNS AND INFANTS

Records created during infancy may need to remain available for substantially longer than ordinary adult records under applicable state rules. The retention engine should calculate destruction eligibility from the patient's date of birth and governing jurisdiction when required.

14. ADOLESCENT CONFIDENTIAL SERVICES

Records involving services for which a minor may consent independently may carry special confidentiality requirements. Retention does not eliminate confidentiality, and destruction rules must be coordinated with .

15. BEHAVIORAL HEALTH RECORDS

Psychiatric and behavioral-health records may be subject to general medical-record rules plus state-specific confidentiality or retention provisions. MDTelemed should not assume all behavioral-health material follows an ordinary adult medical-record schedule.

16. PSYCHOTHERAPY NOTES

HIPAA treats psychotherapy notes differently from the general medical record when the regulatory definition is met. MDTelemed must determine whether it creates or maintains such notes; they should not be conflated with ordinary progress notes.

17. SUBSTANCE-USE-DISORDER INFORMATION

MDTelemed does not offer buprenorphine/OUD treatment at launch, but patient records may contain substance-use information. If records subject to 42 C.F.R. Part 2 are ever created or received, retention and disclosure must be evaluated under the applicable Part 2 framework and state law.

18. REPRODUCTIVE, SEXUAL, HIV/STI, GENETIC AND OTHER SENSITIVE INFORMATION

Specially protected information may have additional confidentiality, disclosure, segregation, or access requirements. Retention must preserve those protections for as long as the information is maintained.

19. LABORATORY RECORDS

Laboratory orders and results maintained in MDTelemed's medical record are retained under the applicable clinical schedule. An independent laboratory may have separate retention obligations for its own records.

20. IMAGING RECORDS

Imaging reports and related clinical information maintained by MDTelemed are subject to applicable retention rules. The imaging facility may independently retain source images and records under different rules.

21. EKG AND OTHER DIAGNOSTICS

Diagnostic reports or tracings actually maintained by MDTelemed should be classified and retained under the appropriate schedule. The Policy does not claim that MDTelemed permanently stores every source file produced by an outside diagnostic vendor.

22. PRESCRIPTION RECORDS

Prescription and medication documentation maintained as part of the clinical record should be preserved for the applicable period. Additional pharmacy or e-prescribing system requirements may apply to independent entities.

23. CONTROLLED SUBSTANCES

MDTelemed prohibits Schedule II-V controlled-substance prescribing through its service. This company rule does not eliminate the need to retain documentation when a patient reports controlled-substance use or requests a controlled drug.

24. INFORMED CONSENT

Telehealth consent, pediatric/guardian consent, recording/audio-processing consent, privacy acknowledgments, and other legally significant consents should be retained for the period required by applicable law and the underlying transaction or clinical record.

25. TELEHEALTH LOCATION AND MODALITY RECORDS

Where required, records demonstrating the patient's physical location, treating physician, modality, consent, and jurisdictional authority may be important evidence of lawful telemedicine practice and should be retained under the applicable schedule.

26. PHYSICIAN-FINALIZED NOTE

The final physician-reviewed and signed clinical note is a core medical record. AI assistance does not reduce the physician's responsibility for the final documentation.

27. AI TELESCRIBE

MDTelemed uses AI-assisted telescribing for documentation; medical decisions are made by human MD physicians. The retention status of raw audio, transcripts, temporary processing files, intermediate AI outputs, and metadata must be determined from the actual technical architecture and rather than invented here.

28. RAW AUDIO

This Policy does not state that raw encounter audio is immediately deleted, retained permanently, or retained for a fixed period. MDTelemed must technically verify whether audio is recorded or streamed, where it exists, who receives it, and when it is deleted before making a public representation.

29. AUDIO OR VIDEO RECORDINGS

If an encounter recording is retained, MDTelemed must determine whether it is part of the medical record or designated record set, what state recording laws apply, what consent was obtained, and what retention schedule controls.

30. TRANSCRIPTS AND DRAFTS

Draft transcripts or intermediate documentation are not automatically equivalent to the physician-finalized medical record. MDTelemed must define whether they are retained, for how long, and whether they are used to make decisions about individuals.

31. PATIENT PORTAL

Patient portal availability does not define the legal retention period. A record may need to remain preserved after it is no longer visible in an active portal interface.

32. ACCOUNT CLOSURE

Closing a patient account does not authorize destruction of medical records that MDTelemed must or may lawfully retain.

33. MEMBERSHIP CANCELLATION

Cancelling a membership stops future membership treatment as provided by ; it does not erase clinical records or shorten statutory retention.

34. PHYSICIAN DEPARTURE

A physician's departure does not authorize deletion of the records of patients the physician treated. MDTelemed must preserve lawful custody and access arrangements under Policies 15 and 18.

35. BUSINESS CLOSURE

If MDTelemed closes, sells, reorganizes, or ceases a service line, medical records cannot simply disappear. Applicable state law may require a custodian, patient notice, board notice, transfer arrangements, publication, or continued access.

36. MERGER OR ACQUISITION

Records may be transferred in a lawful corporate transaction subject to HIPAA, state law, contractual restrictions, professional-practice rules, and patient rights. A sale does not nullify retention obligations.

37. DECEASED PATIENTS

HIPAA protects a deceased individual's PHI for 50 years following death. Medical-record retention obligations are a separate question; the fact that HIPAA privacy protection continues does not itself require every clinical record to be retained for 50 years.

38. HIPAA DOCUMENTATION RETENTION

HIPAA requires certain policies, procedures, communications, actions, activities, and designations required to be documented under the Privacy Rule to be retained for six years from creation or the date last in effect, whichever is later. This six-year HIPAA documentation rule should not be misrepresented as the universal medical-record retention period.

39. HIPAA SECURITY DOCUMENTATION

Where HIPAA Security Rule documentation requirements apply, required documentation must be retained as specified by the Security Rule. This is distinct from the state-law medical-record schedule.

40. NOTICE OF PRIVACY PRACTICES

MDTelemed should preserve versions of its Notice of Privacy Practices and required documentation concerning acknowledgments or good-faith efforts as applicable, using the governing HIPAA documentation rule.

41. AUTHORIZATIONS

Patient authorizations and related documentation should be retained as required by HIPAA and applicable law. Revocation of an authorization does not require destruction of the authorization or records of actions already taken in reliance on it.

42. ACCESS REQUESTS

Records of HIPAA access requests, responses, denials, extensions, and review processes should be retained according to applicable HIPAA documentation and operational requirements.

43. AMENDMENT REQUESTS

Requests to amend, acceptances, denials, statements of disagreement, rebuttals, and related actions should be retained and linked to the affected information as required by HIPAA.

44. ACCOUNTINGS OF DISCLOSURES

Documentation needed to provide an accounting of disclosures should be retained for the period required by HIPAA. The accounting period and the underlying medical-record retention period are different concepts.

45. COMPLAINTS AND GRIEVANCES

Complaint files may be subject to HIPAA documentation, quality, risk, employment, litigation, and state requirements. They should follow a legally reviewed schedule rather than automatically being destroyed with the medical record.

46. CREDENTIALING RECORDS

Physician credentialing files have different legal and operational purposes from patient medical records. They should be retained under a separate schedule accounting for credentialing cycles, contracts, professional actions, litigation, and applicable law.

47. QUALITY AND PEER REVIEW

Quality and peer-review records require a separate retention and privilege analysis. Labeling a document 'peer review' does not automatically make it privileged or dictate how long it must be retained.

48. BILLING AND PAYMENT RECORDS

Billing, tax, chargeback, fraud, accounting, and payment documentation may have retention requirements separate from the medical record. Payment-card data should not be retained merely because other business records are retained.

49. WEBSITE AND CONSUMER PRIVACY RECORDS

Cookie consent, privacy requests, opt-outs, marketing consents, advertising records, and other consumer-data records should follow applicable privacy and consumer-protection retention requirements.

50. SMS AND ELECTRONIC COMMUNICATIONS

Clinically relevant communications may become part of the medical record. Marketing consent/opt-out records and administrative messages may follow different schedules. MDTelemed must classify communications based on purpose and legal significance.

51. SECURITY LOGS

Authentication, audit, access, security-event, and system logs should be retained according to the security program and applicable law. This Policy does not invent a specific log-retention period before the system architecture and risk analysis are verified.

52. BACKUPS

Backups support resilience and recovery but do not replace the authoritative record-retention system. MDTelemed has not verified the original daily/weekly/monthly/yearly backup schedule and therefore does not publish those intervals as facts.

53. BACKUP DELETION

When a record becomes eligible for destruction, backup copies should be addressed through a documented lifecycle that accounts for immutable or rotating backups, restoration processes, legal holds, security, and applicable law. Immediate deletion from every backup may not be technically feasible.

54. RESTORED BACKUPS

If an old backup is restored, information previously disposed of in the active environment should not silently re-enter ordinary production use contrary to the approved retention/destruction process. Restoration procedures should account for deletion reconciliation.

55. LEGAL HOLDS

A legal hold suspends ordinary destruction for potentially relevant information. Holds may arise from litigation, threatened litigation, subpoenas, government investigations, audits, complaints, adverse events, or other preservation duties.

56. NO DESTRUCTION AFTER NOTICE OF A CLAIM

Personnel must not destroy relevant information after MDTelemed knows or reasonably should know that it must be preserved for a legal matter. Ordinary retention schedules are subordinate to valid preservation duties.

57. REGULATORY INVESTIGATIONS

Records relevant to an HHS OCR, state medical board, attorney general, FTC, law-enforcement, licensing, or other authorized investigation may require preservation beyond ordinary schedules.

58. SERIOUS ADVERSE EVENTS

Records related to death, hospitalization, suicide attempt, severe medication reaction, diagnostic delay, or another serious outcome should be evaluated for preservation and risk-management needs before routine destruction.

59. PATIENT COMPLAINTS

A complaint can create a preservation issue even if no lawsuit has been filed. The responsible compliance/risk function should determine whether a hold is appropriate.

60. LIFTING A LEGAL HOLD

Information on hold should not return to routine destruction until the authorized legal/compliance function confirms that the preservation obligation has ended.

61. PATIENT REQUESTS FOR DELETION

A patient may have deletion rights under certain consumer privacy laws, but those rights commonly contain exceptions. A deletion request does not automatically override medical-record retention, HIPAA, legal-hold, fraud-prevention, security, or other lawful retention.

62. HIPAA DOES NOT CREATE A GENERAL RIGHT TO DELETE THE MEDICAL RECORD

HIPAA provides rights such as access and amendment; it does not generally require a covered entity to delete an accurate medical record at the patient's request.

63. AMENDMENT VERSUS DELETION

When a patient disputes clinical information, the proper mechanism may be amendment under rather than deletion. Accepted amendments should preserve record integrity rather than conceal the historical record.

64. CORRECTIONS AND LATE ENTRIES

Corrections should be traceable and should not obliterate the original content in a manner inconsistent with law or professional documentation standards.

65. DUPLICATE RECORDS

Duplicate data should be managed carefully so destruction of one copy does not unintentionally destroy the authoritative record or, conversely, leave uncontrolled copies outside the retention system.

66. RECORD INVENTORY

MDTelemed should maintain a data/records inventory identifying system of record, record owner, legal category, jurisdiction, retention trigger, retention period, hold status, disposal method, and vendor location where feasible.

67. AUTOMATED RETENTION

Automated retention tools may be used only after rules are validated. An automated deletion job must not rely on a simplistic 'seven years from creation' rule for all patients.

68. MANUAL DESTRUCTION

Manual destruction should require authorized personnel, documented eligibility, hold checking, and an auditable process. Individual physicians or staff should not independently delete records because they believe they are old.

69. DESTRUCTION STANDARD

When records are lawfully eligible for disposal, MDTelemed should use methods reasonably designed to render PHI unreadable, indecipherable, and not reconstructable, consistent with applicable HIPAA safeguards and recognized media-sanitization practices.

70. PAPER RECORDS

If MDTelemed maintains paper containing PHI, secure disposal may include shredding, pulping, pulverizing, or another method that makes the information unreadable and not reasonably reconstructable. The company should use a vetted vendor where outsourcing occurs.

71. ELECTRONIC MEDIA

Electronic media should be cleared, purged, destroyed, or otherwise sanitized using a method appropriate to the media, sensitivity, reuse decision, threat model, and applicable guidance. One legacy overwrite algorithm is not mandated for every modern storage technology.

72. ORIGINAL DoD 5220.22-M CLAIM

The original Policy required the DoD 5220.22-M multiple-overwrite standard. That is not retained as a universal mandate. Modern SSDs, cloud storage, encrypted storage, mobile devices, and managed infrastructure require media-appropriate sanitization methods.

73. NIST MEDIA SANITIZATION

MDTelemed's technical program should use current authoritative media-sanitization guidance, including NIST SP 800-88 Rev. 1 or its successor/current revision, as appropriate to the implemented technology and legal requirements.

74. THIRD-PARTY DESTRUCTION VENDORS

A destruction vendor should be appropriately vetted and contractually obligated to protect PHI. If the vendor is a business associate, a compliant BAA is required. This Policy does not claim that MDTelemed currently uses a NAID AAA-certified vendor unless verified.

75. CERTIFICATES OF DESTRUCTION

MDTelemed should obtain and retain appropriate evidence of destruction for material disposal events where operationally appropriate. A certificate does not substitute for vendor due diligence, BAA requirements, or an accurate inventory.

76. CHAIN OF CUSTODY

Physical media awaiting destruction should be secured and tracked to prevent loss, theft, or unauthorized access. Vendor pickup and transfer processes should be appropriate to risk.

77. REUSE OF DEVICES

Before reuse, reassignment, return, resale, or disposal of devices that may contain PHI, MDTelemed should apply an approved sanitization process appropriate to the device and data.

78. CLOUD ENVIRONMENTS

Cloud deletion depends on provider architecture, replication, snapshots, encryption, backup, and contractual controls. MDTelemed should verify actual cloud deletion and retention behavior before promising immediate or irreversible erasure.

79. CRYPTOGRAPHIC ERASURE

Cryptographic erasure may be appropriate for some encrypted media or cloud architectures when implemented and validated correctly. The policy should not claim it is used unless the technical design confirms it.

80. VENDOR TERMINATION

When a vendor relationship ends, MDTelemed should address return or destruction of PHI as required by the BAA and applicable law, including infeasibility provisions where relevant.

81. BUSINESS ASSOCIATE AGREEMENTS

HIPAA BAAs must require appropriate return or destruction of PHI at termination where feasible and continued protections where return or destruction is infeasible, consistent with 45 C.F.R. § 164.504(e).

82. MINIMUM NECESSARY AND RETENTION

The minimum-necessary principle governs many uses and disclosures of PHI but is not itself a rule requiring deletion at the earliest possible moment. Retention must be based on applicable legal and operational requirements.

83. SECURITY DURING RETENTION

Records must remain protected throughout the retention period. Long-term archival status does not reduce confidentiality, integrity, or access-control obligations.

84. ACCESS TO ARCHIVED RECORDS

Archived records should remain retrievable as required for patient access, treatment, legal obligations, audits, or other lawful purposes. Retention that makes required records practically inaccessible can create compliance problems.

85. PATIENT ACCESS BEFORE DESTRUCTION

Where applicable state law requires patient notice or an opportunity to obtain records before practice closure or destruction, MDTelemed should follow that jurisdiction-specific requirement.

86. DESTRUCTION DOES NOT CANCEL PRIOR DISCLOSURES

Lawful destruction of MDTelemed's copy does not erase copies previously and lawfully disclosed to another provider, laboratory, pharmacy, patient, regulator, or other recipient.

87. DOCUMENTING DESTRUCTION

The destruction process should record sufficient information to establish what category or batch was destroyed, when, under which authority/schedule, by whom or which vendor, and whether holds were checked, without unnecessarily recreating the destroyed PHI.

88. UNAUTHORIZED DESTRUCTION

Premature, accidental, malicious, or unauthorized deletion of medical records is a compliance and patient-safety incident and should be escalated under security, privacy, risk, and incident-response procedures.

89. RANSOMWARE OR CORRUPTION

Loss of records through ransomware, corruption, or system failure is not lawful 'destruction' under a retention policy. MDTelemed should maintain resilience and recovery controls appropriate to its risk analysis.

90. DATA MIGRATION

When changing EHRs or platforms, MDTelemed must preserve required records, metadata needed for integrity, accessibility, and relevant audit information. Migration should be validated before legacy systems are retired.

91. FORMAT OBSOLESCENCE

Long-term records should remain reasonably accessible despite software or format changes. MDTelemed should plan migration or preservation so required records do not become unreadable before their retention period expires.

92. PATIENT DEATH, GUARDIANSHIP AND REPRESENTATIVES

Retention does not determine who may access a record. Access by estates, personal representatives, parents, guardians, or others is governed by HIPAA and applicable state law.

93. RESEARCH

If records are retained or used for research, MDTelemed must follow applicable HIPAA authorization/waiver, IRB/privacy-board, de-identification, data-use agreement, and state-law requirements. A research purpose should not be invented after the fact to avoid a valid deletion obligation.

94. DE-IDENTIFICATION

Properly de-identified information under HIPAA is not PHI under the Privacy Rule, but de-identification must meet the applicable standard. Removal of a name alone is not sufficient.

95. ANALYTICS

Retention of analytics or derived data depends on whether the information remains identifiable, the governing privacy law, stated purpose, consent/authorization, vendor role, and actual data flows.

96. SECURITY INCIDENT EVIDENCE

Logs, forensic images, incident records, and breach-investigation materials may need retention beyond ordinary system-log schedules. They should be protected because they may themselves contain sensitive information.

97. AUDITABILITY

MDTelemed should be able to demonstrate that retention and destruction rules are implemented consistently, that holds suspend destruction, and that disposal events are authorized and documented.

98. PERIODIC REVIEW

The retention schedule should be reviewed when state law changes, new service lines launch, new record types are created, vendors change, AI workflows change, or MDTelemed expands into a new legal/regulatory framework.

99. NO FALSE SECURITY CLAIMS

This public Policy does not claim AES-256, TLS 1.2+, SOC 2 Type II, specific backup geographies, specific recovery-test intervals, or any other technical control that MDTelemed has not verified.

100. CONTACT

MDTelemed LLC 304 S Jones Blvd #4872 Las Vegas, NV 89107 Business Administration / Records & Privacy: Support@MDTelemed.com Build and counsel-review a 50-state + DC retention matrix tied to MDTelemed's actual entity/practice structure, including adult, minor, behavioral-health, sensitive-record, physician departure, and practice-closure rules. Do not rely on the original California 7 / New York 6 / Texas 2 / Florida 5 / default 7-year table without jurisdiction-specific legal verification. Map every clinical and nonclinical record category to a system of record, retention trigger, governing jurisdiction, minimum period, destruction eligibility rule, and legal-hold override. Verify whether MDTelemed is a HIPAA covered entity, hybrid entity, business associate, or another structure for each relevant operation and align documentation schedules accordingly. Verify the proprietary EHR/platform's retention, archival, deletion, audit-log, snapshot, and restoration behavior. Verify the AI telescribe architecture: raw audio, streaming, temporary storage, transcript drafts, model inputs/outputs, vendor copies, training use, and deletion timing. Create a formal legal-hold procedure and assign authority to issue, modify, and release holds. Create automated destruction controls that cannot execute until jurisdiction, patient age, record type, trigger date, and hold status have been checked. Create a backup-deletion reconciliation process for restored data. Adopt a current, media-appropriate sanitization standard based on NIST guidance and actual infrastructure rather than a blanket DoD 5220.22-M promise. Vet any destruction vendor, determine business-associate status, execute a BAA where required, and verify certifications before naming them publicly. Create certificates/evidence-of-destruction and chain-of-custody procedures. Create a business-closure/record-custodian plan for every state requiring patient, board, newspaper, custodian, or other notice. Coordinate with Policies 01, 10, 15, 18, 21, 29, 30, 31, 33, and 38. Have qualified 50-state health-care/privacy/records-retention counsel validate the production schedule before national launch.

101. PRIMARY LEGAL, REGULATORY & TECHNICAL REFERENCES

102. C.F.R. § 164.530(j) — HIPAA Privacy Rule documentation retention requirements.

103. C.F.R. § 164.316(b)(2) — HIPAA Security Rule documentation retention requirements.

104. C.F.R. § 164.524 — HIPAA individual right of access to PHI in a designated record set.

105. C.F.R. § 164.526 — HIPAA amendment rights and related record requirements.

106. C.F.R. § 164.528 — accounting of disclosures and documentation requirements.

107. C.F.R. § 164.504(e) — business associate contractual requirements, including return/destruction at termination where feasible.

108. C.F.R. § 164.502(f) — protection of a deceased individual's PHI for 50 years following death.

HHS guidance on disposal of protected health information. NIST Special Publication 800-88, Guidelines for Media Sanitization, current applicable revision/successor. Applicable state medical-practice, medical-record retention, pediatric/minor, behavioral-health, sensitive-health-information, privacy, physician departure, and practice-closure laws and medical-board rules. Original MDTelemed Medical Records Retention & Destruction — used as source material; its state table, seven-year default, pediatric formula, NAID AAA vendor claim, DoD 5220.22-M mandate, and fixed backup schedules were not retained as verified national or technical facts.

109. SOURCE LINKS

eCFR 45 C.F.R. § 164.530: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.530 eCFR 45 C.F.R. § 164.316: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.316 eCFR 45 C.F.R. § 164.524: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.524 eCFR 45 C.F.R. § 164.526: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.526 eCFR 45 C.F.R. § 164.528: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.528 eCFR 45 C.F.R. § 164.504: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.504 HHS FAQ — Disposal of Protected Health Information: https://www.hhs.gov/hipaa/for-professionals/faq/575/what-does-hipaa-require-of-covered-entities-when-they-dispose-information/index.html NIST Media Sanitization publications: https://csrc.nist.gov/publications/

110. RELATED MDTelemed POLICIES

Website & Consumer Privacy Policy; Security & Privacy Safeguards Statement; Medical Records Access, Amendment & Release; Continuity of Care, Transfer & Termination; Third-Party Business Associates & BAAs; HIPAA Notice of Privacy Practices; Consumer Health Data Privacy Policy; State Privacy Rights Supplement; 50-State Minor Consent & Confidentiality Addendum; AI Telescribe, Audio Capture & Documentation Consent.

111. END OF

MARKETING COMMUNICATIONS EMAIL SMS TELEPHONE

1. MARKETING COMMUNICATIONS / EMAIL / SMS / TELEPHONE

Version 1.0 | Effective September 16, 2026

2. Purpose and Scope

MDTelemed adopts this policy to distinguish clinical and transactional communications from promotional marketing communications and to establish requirements for lawful use of email, SMS/text messaging, telephone calls, prerecorded or artificial voice communications, and similar channels. This policy applies to MDTelemed workforce members, contractors, vendors, marketing partners, and technology systems used to communicate with patients, prospective patients, members, and other consumers.

3. Core Principle

Clinical care, appointment, billing, security, account, and other service-related communications must be distinguished from advertising or promotional marketing. MDTelemed will not treat a patient's agreement to receive medically necessary or transactional communications as blanket consent to receive unrelated marketing.

4. Service and Transactional Communications

MDTelemed may use approved communication channels for operational and care-related purposes when permitted by applicable law and the patient's communication preferences. Examples may include: Appointment confirmations, reminders, rescheduling notices, and visit-access instructions. Clinical follow-up messages and notifications that a result or secure message is available. Prescription, pharmacy, laboratory, or referral-related service communications. Account, billing, payment, membership, and renewal notices. Security alerts, password-reset messages, identity-verification communications, and suspected-fraud notices. Material changes to Terms, Privacy Notices, policies, or patient rights where notice is required. Customer-support communications requested by the patient.

5. Marketing Communications

Marketing communications include promotional messages whose principal purpose is to encourage the purchase or use of a product or service, subject to applicable HIPAA, consumer-protection, telemarketing, and communications laws. Marketing campaigns must be reviewed and configured so that the legal basis for contacting the recipient is documented.

6. Patient Marketing Consent

Where affirmative consent is legally required for promotional texts, telephone calls, prerecorded or artificial-voice communications, email marketing, or another marketing channel, MDTelemed must obtain and retain the required consent before sending the communication. When MDTelemed uses a patient-facing marketing consent, the selected operational approach is a one-time consent rather than a new signature before every marketing communication. The consent remains subject to revocation, scope limitations, applicable law, and any material changes to the communication program.

7. Marketing Consent Is Not a Condition of Treatment

When required by law, MDTelemed will not condition medically necessary treatment, access to clinical care, or eligibility for ordinary telemedicine services on agreement to receive optional marketing communications.

8. Clear Disclosure

A marketing-consent request should clearly identify MDTelemed, the communication channel being authorized, the general nature of the communications, any material frequency or recurring-message information required by law, and how the patient may revoke or opt out.

9. SMS / Text Messages

Promotional text messaging may be used only through an approved program that addresses applicable consent, identification, opt-out, recordkeeping, carrier/message-rate disclosure, and other legal requirements. MDTelemed should not include unnecessary sensitive medical information in ordinary SMS messages. When a communication contains sensitive clinical information, a secure communication method should be used when appropriate.

10. Telephone Calls

Marketing calls, prerecorded calls, artificial-voice calls, autodialed communications, or similar technologies may be subject to heightened consent and telemarketing requirements. MDTelemed must not deploy such campaigns without appropriate compliance review and documented authority.

11. Email Marketing

Commercial marketing email must use truthful sender information and subject lines and must include required identification and unsubscribe mechanisms. Opt-out requests must be honored within the legally required period.

12. Clinical and Marketing Message Separation

Whenever practicable, MDTelemed should maintain separate preferences and message classifications for clinical/service communications and promotional marketing. A patient who opts out of marketing should continue to receive communications reasonably necessary for requested care, patient safety, billing, account administration, legal notices, or other non-marketing purposes when permitted by law.

13. HIPAA Marketing Restrictions

Protected Health Information (PHI) may not be used or disclosed for marketing except as permitted by the HIPAA Privacy Rule and other applicable law. When a HIPAA authorization is required for a marketing use of PHI, MDTelemed must obtain a valid authorization before the use or disclosure. Marketing teams, advertising vendors, analytics providers, and campaign platforms do not receive access to PHI merely because they support MDTelemed's marketing operations.

14. No Sale of Patient Information

MDTelemed will not sell patient PHI or disclose identifiable patient medical information to marketers or data brokers for unrelated commercial targeting except where expressly permitted by law and supported by any required patient authorization.

15. Sensitive Health Information

Marketing systems should not create or use audience segments based on diagnoses, medications, reproductive health, mental health, substance-use treatment, genetic information, sexual health, disability, or other highly sensitive health information unless the proposed use has undergone appropriate privacy and legal review and is lawfully authorized.

16. Website and Advertising Tracking

Advertising pixels, remarketing technologies, and similar tracking tools must not be deployed in authenticated clinical areas or other locations where they would improperly disclose PHI or sensitive health information. Public-site analytics and advertising technologies must comply with MDTelemed's Privacy and Cookie/Tracking policies.

17. Marketing Vendors

Any vendor that sends communications or processes personal information on MDTelemed's behalf must be appropriately reviewed and contractually restricted. If a vendor is acting as a HIPAA Business Associate, a compliant Business Associate Agreement must be in place before the vendor receives PHI in that role.

18. Referral and Affiliate Partners

Referral, affiliate, or promotional partners may use only MDTelemed-approved claims and communication methods. Partners may not send unlawful spam, use patient lists, obtain PHI for marketing, impersonate MDTelemed, or make unsupported clinical, pricing, compliance, or outcome claims.

19. Testimonials and Endorsements

Marketing communications containing testimonials, endorsements, influencer content, ratings, or patient stories must comply with MDTelemed's Testimonials / Reviews / Endorsements policy. Any material connection, compensation, or incentive must be disclosed as required by law.

20. Accuracy of Marketing Claims

Marketing statements must be truthful, non-misleading, and supported. MDTelemed and its partners must not promise guaranteed clinical outcomes, guaranteed diagnoses, guaranteed prescriptions, guaranteed reimbursement, guaranteed wait times, or regulatory compliance beyond what can be substantiated.

21. Price and Membership Advertising

Marketing of prices, memberships, free trials, discounts, or bundled services must accurately disclose material limitations, recurring charges, renewal terms, eligibility criteria, and cancellation requirements when applicable. Marketing must remain consistent with MDTelemed's Payment / Billing / Membership / Auto-Renewal policy.

22. Geographic and Service Availability Claims

Marketing must not imply that MDTelemed may treat a patient in every location merely because the website or app is accessible there. Service availability may depend on the patient's physical location, clinician licensure, pharmacy availability, law, and operational coverage.

23. Prescribing Claims

Marketing may not promise that a patient will receive a prescription, antibiotic, antiviral, controlled substance, test, referral, or any specific treatment. Clinical decisions remain solely with the treating clinician based on the individual encounter.

24. Emergency Disclaimer

Marketing materials must not imply that MDTelemed replaces 911, emergency departments, or other emergency services. When appropriate to the marketing context, MDTelemed should state that the service is not for emergencies.

25. Minors

Marketing directed to minors or involving minor patient information requires heightened review. MDTelemed should not knowingly use a minor's PHI for marketing without the authority required by applicable law.

26. Opt-Out and Revocation

Recipients must be provided legally required methods to stop optional marketing communications. MDTelemed should process opt-out and revocation requests promptly and maintain suppression controls designed to prevent future unauthorized marketing through the affected channel.

27. Scope of Revocation

Revocation of marketing consent does not necessarily terminate communications that are necessary to complete a pending transaction, deliver requested healthcare, provide required legal notices, respond to a patient request, protect account security, or otherwise communicate for a non-marketing purpose permitted by law.

28. Preference Management

Where operationally feasible, patients should be able to manage marketing preferences separately by channel. MDTelemed should avoid requiring a patient to close the entire account merely to stop optional promotional communications.

29. Do-Not-Call and Suppression Controls

MDTelemed and its vendors must apply applicable federal and state do-not-call, internal suppression, revocation, and consent rules to telephone marketing campaigns.

30. Frequency and Quiet Hours

Marketing frequency and delivery times must comply with applicable law and should avoid unreasonable or harassing communication patterns. Automated campaigns should include controls to prevent duplicate or excessive messaging.

31. Wrong Number / Reassigned Number

When MDTelemed learns that a telephone number or email address no longer belongs to the intended recipient, the communication record should be updated and further marketing suspended as appropriate.

32. Consent Records

MDTelemed should retain evidence of legally required marketing consent, including the consent language presented, date/time, communication channel, source, patient or consumer identifier, and version of the disclosure where operationally feasible.

33. Revocation Records

Marketing opt-outs and revocations should be recorded in a manner that can be propagated to relevant systems, vendors, and campaigns.

34. Vendor Synchronization

Marketing vendors should receive updated suppression and consent status sufficiently promptly to avoid continued unauthorized communications. MDTelemed remains responsible for appropriate vendor oversight.

35. Security

Marketing databases and communication platforms must be protected according to the sensitivity of the personal information they contain. Marketing access should be role-based and limited to personnel with legitimate responsibilities.

36. Workforce Access

Workforce members may not download, copy, export, or use patient contact lists for personal, unauthorized, or third-party marketing.

37. Staff Personal Communications

MDTelemed staff and clinicians should not use personal texting, personal email, or private social-media accounts to send MDTelemed marketing unless specifically authorized and compliant with company policy.

38. Social Media Direct Messages

Promotional direct messages through social platforms are subject to the same principles of truthful identification, lawful consent, privacy protection, and opt-out as other marketing channels.

39. Patient Referrals

Marketing compensation arrangements must not pay for patient referrals or otherwise violate federal or state anti-kickback, patient-brokering, fee-splitting, or professional-practice restrictions.

40. Promotions and Sweepstakes

Any sweepstakes, contest, giveaway, or promotional incentive requires separate legal review for official rules, eligibility, disclosures, privacy, taxation, and healthcare fraud-and-abuse implications.

41. Reviews and Reputation Management

MDTelemed must not suppress, purchase, fabricate, or manipulate reviews through deceptive practices. Incentives, if used lawfully, may not be conditioned on a positive review and must be disclosed when required.

42. Complaint Handling

Complaints regarding unwanted communications, misleading advertising, privacy, or consent must be routed to the appropriate compliance, privacy, marketing, or customer-service function and investigated as appropriate.

43. Regulatory Requests

MDTelemed will cooperate with lawful regulatory inquiries concerning marketing communications and maintain records reasonably necessary to demonstrate its consent and opt-out practices.

44. Training

Personnel involved in marketing, communications, sales, patient acquisition, and campaign administration should receive training appropriate to their roles, including privacy, consent, claims substantiation, and opt-out requirements.

45. Monitoring and Auditing

MDTelemed may monitor campaigns, consent records, opt-out processing, vendor performance, complaint trends, and marketing claims to identify noncompliance and implement corrective action.

46. Violations

Violations of this policy may result in removal from campaigns, suspension of access, retraining, disciplinary action, vendor remediation or termination, corrective patient communications, or legal/compliance escalation.

47. Relationship to Other Policies

This policy should be read together with MDTelemed's Website & Consumer Privacy Policy; HIPAA Notice of Privacy Practices; Cookie / Tracking Technology / Analytics Policy; SMS / Text Messaging Terms & Consent; Electronic Communications / E-SIGN Consent; Payment / Billing / Membership / Auto-Renewal Policy; Testimonials / Reviews / Endorsements Policy; and Referral / Affiliate / Marketing Partner Terms.

48. Exceptions

No business or marketing objective authorizes a violation of HIPAA, telemarketing law, consumer-protection law, patient privacy, or valid opt-out rights. Material exceptions require appropriate compliance/legal review.

49. Policy Review

This policy should be reviewed at least annually and when MDTelemed materially changes its marketing channels, vendors, tracking technologies, consent architecture, membership model, or applicable law.

50. Primary Regulatory / Guidance References

Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, 45 C.F.R. Parts 160 and 164, including applicable marketing and authorization requirements. Telephone Consumer Protection Act (TCPA), 47 U.S.C. § 227, and applicable FCC rules. Telemarketing Sales Rule, 16 C.F.R. Part 310, as applicable. CAN-SPAM Act, 15 U.S.C. §§ 7701–7713, as applicable to commercial email. Federal Trade Commission Act § 5, 15 U.S.C. § 45, including deceptive or unfair advertising practices. FTC Endorsement Guides, 16 C.F.R. Part 255, where endorsements or testimonials are used. Applicable state telemarketing, texting, privacy, consumer-protection, medical-information, and do-not-call laws.

AI TELESCRIBE - AMBIENT LISTENING - DOCUMENTATION CONSENT

AI Telescribe / Ambient Listening / Documentation Consent

Version 1.0 | Effective September 16, 2026

1. Policy Statement

MDTelemed adopts this policy to establish a consistent, patient-centered and legally compliant framework for ai telescribe / ambient listening / documentation consent. This policy must be implemented together with applicable federal law, the law of the patient's physical location, professional standards, and MDTelemed's other clinical and privacy policies.

2. Purpose and Scope

This policy governs use of an AI-assisted telescribe or ambient documentation tool during MDTelemed encounters. The tool assists the treating professional with documentation; it is not the treating clinician and does not independently diagnose, prescribe, order testing, or replace professional judgment.

3. One-Time Patient Consent

Before first use for a patient, MDTelemed should present a clear disclosure that an AI documentation tool may listen to and process encounter audio to assist with creation of the medical record. MDTelemed's selected workflow is a one-time acknowledgment/consent at onboarding or before the first AI-assisted encounter, with renewed consent when the material terms change, when required by applicable law, or when a new use falls outside the original consent.

4. Patient Choice

A patient who declines AI-assisted documentation should be offered a reasonable alternative documentation workflow when operationally available. Declining the AI scribe should not be represented as declining medically necessary care.

5. Recording Distinction

The consent must distinguish transient ambient processing from an audio recording that is retained. If audio is retained, separate recording-law requirements and any applicable all-party consent rules must be satisfied.

6. Clinical Responsibility

The treating clinician must review, correct, and approve the final note. AI-generated content may contain omissions, transcription errors, incorrect inferences, or fabricated content and may not be relied upon without clinician verification.

7. Sensitive Encounters

Clinicians should use heightened judgment for behavioral health, sexual/reproductive health, substance-use treatment, minors, intimate examinations, domestic violence, and other highly sensitive encounters. The patient may request that AI listening be stopped.

8. Documentation

The record should document consent status in a durable manner so the patient is not unnecessarily asked to sign at every routine visit.

9. Revocation

Patients may revoke future AI-listening consent prospectively. Revocation does not invalidate processing that lawfully occurred before revocation.

10. Roles and Responsibilities

MDTelemed management is responsible for operational implementation and periodic review. Clinicians remain responsible for independent professional judgment and documentation. Workforce members must follow role-based access, confidentiality, escalation, and incident-reporting requirements. Material conflicts between this policy and controlling law must be escalated to compliance/legal review before the affected workflow is used.

11. Training and Monitoring

Affected personnel should receive role-appropriate training. MDTelemed may audit compliance, investigate deviations, and implement corrective action when needed.

12. Exceptions

No exception may waive a mandatory legal or patient-safety requirement. Operational exceptions should be documented and approved by an authorized leader when appropriate.

13. Primary Regulatory / Guidance References

U.S. Department of Health and Human Services, HIPAA Privacy, Security and Breach Notification Rules, 45 C.F.R. Parts 160 and 164. HHS Telehealth guidance regarding HIPAA and remote communication technologies. Applicable state medical-practice, telehealth, privacy, recording, consumer-protection and professional-licensure laws.

14. C.F.R. §§ 164.400–414 (HIPAA Breach Notification Rule), as applicable.

CLINICAL AI - DECISION SUPPORT - HUMAN OVERSIGHT

Clinical AI / Decision Support / Human Oversight

Version 1.0 | Effective September 16, 2026

1. Policy Statement

MDTelemed adopts this policy to establish a consistent, patient-centered and legally compliant framework for clinical ai / decision support / human oversight. This policy must be implemented together with applicable federal law, the law of the patient's physical location, professional standards, and MDTelemed's other clinical and privacy policies.

2. Purpose

This policy governs any AI-generated differential, risk flag, coding suggestion, treatment prompt, or other clinical decision-support feature used by MDTelemed.

3. Human Oversight

AI output is advisory. The licensed clinician remains responsible for diagnosis, treatment, prescribing, testing, referral, coding, and disposition.

4. No Autonomous Care

AI must not independently communicate a diagnosis or treatment decision to a patient as though it were the treating clinician.

5. Validation

Clinicians should evaluate AI suggestions against the actual history, examination limitations, available data, and standard of care.

6. High-Risk Use

Emergency triage, suicide risk, stroke, sepsis, anaphylaxis, and other time-sensitive conditions must not rely on AI as the sole monitoring or detection mechanism.

7. Roles and Responsibilities

MDTelemed management is responsible for operational implementation and periodic review. Clinicians remain responsible for independent professional judgment and documentation. Workforce members must follow role-based access, confidentiality, escalation, and incident-reporting requirements. Material conflicts between this policy and controlling law must be escalated to compliance/legal review before the affected workflow is used.

8. Training and Monitoring

Affected personnel should receive role-appropriate training. MDTelemed may audit compliance, investigate deviations, and implement corrective action when needed.

9. Exceptions

No exception may waive a mandatory legal or patient-safety requirement. Operational exceptions should be documented and approved by an authorized leader when appropriate.

10. Primary Regulatory / Guidance References

U.S. Department of Health and Human Services, HIPAA Privacy, Security and Breach Notification Rules, 45 C.F.R. Parts 160 and 164. HHS Telehealth guidance regarding HIPAA and remote communication technologies. Applicable state medical-practice, telehealth, privacy, recording, consumer-protection and professional-licensure laws.

PRESCRIBING AND MEDICATION SAFETY

1. MDTELEMED LLC

2. PRESCRIBING & MEDICATION SAFETY POLICY

Version 1.0 | September 15, 2026

PATIENT-FACING NATIONAL BASELINE. State-specific prescribing, pharmacy, minor-consent, and professional-practice requirements control where more restrictive.

3. PURPOSE

This Policy explains how MDTelemed LLC physicians approach prescription medications in telemedicine. It is designed to promote clinically appropriate prescribing, medication safety, informed patient participation, antimicrobial stewardship, monitoring, follow-up, and lawful prescribing across all U.S. jurisdictions in which MDTelemed operates. A telemedicine visit does not guarantee a prescription. Medication decisions are made by a human MD using professional medical judgment. A physician may prescribe, decline to prescribe, continue, bridge, modify, discontinue, or require additional evaluation before prescribing when clinically and legally appropriate.

4. MDTelemed PRESCRIBING MODEL

Treating clinicians are MD physicians. MDTelemed may prescribe non-controlled prescription medications when clinically appropriate and legally permitted. MDTelemed does not prescribe Schedule II, III, IV, or V controlled substances through its service. MDTelemed does not provide buprenorphine/OUD prescribing at launch. No patient is entitled to a requested medication merely because the medication is non-controlled. The physician may require video, vital signs, laboratory testing, imaging, ECG, prior records, pharmacy information, specialist input, or an in-person examination before prescribing.

5. CONTROLLED-SUBSTANCE PROHIBITION

MDTelemed’s prohibition applies to all federally controlled Schedule II–V medications, regardless of whether federal or state telemedicine law might otherwise permit a particular prescription. This is an MDTelemed scope-of-service rule. Examples include many opioids; stimulants such as amphetamine products; benzodiazepines; zolpidem; tramadol; testosterone and anabolic steroids; pregabalin; and certain codeine-containing products. Drug schedules can change, so examples are illustrative rather than exhaustive. A physician should verify controlled status when uncertain. A medication is not permissible merely because a patient previously received it from another clinician. Patients using a controlled medication prescribed elsewhere should disclose it because it may affect diagnosis, interactions, withdrawal risk, psychiatric assessment, or treatment planning. MDTelemed may coordinate or refer but will not issue the controlled prescription.

6. PRESCRIPTION DECISION STANDARD

Before prescribing, the physician should obtain information reasonably sufficient to support the decision. Depending on the medication and condition, this can include: Indication and working diagnosis. Medication allergies and prior adverse drug reactions. Current prescription drugs, over-the-counter products, supplements, and relevant substances. Relevant medical, psychiatric, surgical, pregnancy, and family history. Age and weight where dosing depends on them. Renal or hepatic function when material. Relevant vital signs or objective measurements. Contraindications, clinically important interactions, duplicate therapy, and therapeutic monitoring. Adequacy of the telemedicine modality and remote examination. Prior treatment response, adherence, and reasons for stopping or changing therapy. Need for testing, follow-up, specialist care, or in-person examination. Not every item is required for every prescription. The required information is medication- and patient-specific.

7. MEDICATION RECONCILIATION

Patients should provide the most accurate medication list available, including dose and frequency when known. Physicians may reconcile the list against available records, pharmacy history, prescription-drug-monitoring information when legally relevant, or other reliable sources. Medication reconciliation reduces, but cannot eliminate, the risk of omissions, duplication, interactions, and dosing errors. Patients should promptly report discrepancies.

8. ALLERGIES AND ADVERSE REACTIONS

Patients must disclose known medication allergies, intolerances, and serious prior reactions. The physician should distinguish, when possible, between a true allergy, predictable side effect, intolerance, and uncertain historical reaction because that distinction can affect safe treatment. Severe allergic symptoms such as airway swelling, severe difficulty breathing, collapse, or rapidly progressive systemic reaction require emergency care.

9. DRUG-DRUG, DRUG-DISEASE, AND DRUG-PREGNANCY RISK

A physician should consider clinically meaningful interactions and contraindications using the information reasonably available. Interaction software may assist but does not replace physician judgment. Pregnancy, possible pregnancy, breastfeeding, renal impairment, hepatic disease, arrhythmia risk, seizure disorders, bleeding risk, immunosuppression, and other conditions may materially alter prescribing decisions. The physician may require pregnancy testing, laboratory testing, ECG, or in-person assessment before treatment.

10. PEDIATRIC PRESCRIBING

Pediatric medication decisions must account for age, weight when relevant, formulation, dosing limits, developmental ability to take the medication, allergies, caregiver understanding, and the adequacy of remote assessment. Parents or guardians should not estimate a child’s weight when accurate weight is clinically necessary and a reliable measurement can reasonably be obtained. Some pediatric symptoms require direct examination or testing before medication is appropriate. State minor-consent and confidentiality rules apply to medications connected to services for which a minor may independently consent.

11. OLDER ADULTS AND POLYPHARMACY

Older adults may have increased susceptibility to adverse drug effects because of renal or hepatic changes, frailty, falls, cognitive impairment, drug burden, and interactions. Physicians should consider geriatric prescribing principles, including potentially inappropriate medications, without treating any screening list as an automatic prohibition. Dose reduction, monitoring, deprescribing, caregiver involvement, or coordination with the patient’s longitudinal clinician may be appropriate.

12. ANTIBIOTIC STEWARDSHIP

MDTelemed supports outpatient antibiotic stewardship. Antibiotics should be prescribed when the physician determines that bacterial infection is sufficiently likely and antibiotic treatment is indicated; they should not be prescribed merely because a patient requests them. When antibiotics are appropriate, selection should consider likely pathogen, site of infection, allergy history, local or relevant resistance patterns when available, patient factors, guideline recommendations, dose, route, and evidence-based duration. Telemedicine can create diagnostic limitations for conditions that depend on otoscopy, throat testing, urinalysis/culture, lung examination, wound evaluation, or other objective findings. The physician may require testing or in-person evaluation rather than prescribing empirically. Patients should take antibiotics exactly as currently directed and contact the physician/pharmacist if instructions change, a dose is missed, or a serious reaction occurs.

13. ANTIVIRALS, ANTIFUNGALS, AND OTHER ANTI-INFECTIVES

Antiviral and antifungal treatment may be appropriate when the diagnosis, timing, patient risk factors, contraindications, and treatment window support use. Some infections require laboratory confirmation, culture, examination, renal-dose adjustment, pregnancy considerations, or escalation. Treatment failure, recurrent infection, immunocompromise, systemic illness, or atypical presentation may require in-person evaluation or specialist care.

14. CARDIOVASCULAR AND CHRONIC-DISEASE MEDICATIONS

MDTelemed may manage or bridge selected medications for hypertension, dyslipidemia, diabetes, thyroid disease, gastrointestinal disease, respiratory disease, and other chronic conditions when sufficient information and monitoring are available. A refill is not automatically appropriate simply because the patient has taken a drug before. The physician may require recent blood pressure, pulse, laboratory data, ECG, examination, medication adherence information, or longitudinal follow-up. Abrupt interruption of some chronic medications can cause harm. When clinically appropriate, a physician may consider a limited bridge while arranging necessary follow-up; this is not a guarantee of continuation.

15. PSYCHIATRIC MEDICATIONS

MDTelemed may treat psychiatric conditions with non-controlled medications when clinically appropriate. The physician should assess diagnosis, symptom severity, safety, prior medication response, adverse effects, interactions, adherence, and appropriate follow-up. Certain psychiatric medications require monitoring for suicidality, activation, mania, serotonin toxicity, metabolic effects, QT risk, withdrawal phenomena, or other medication-specific concerns. MDTelemed does not prescribe benzodiazepines, controlled stimulants, or other Schedule II–V psychiatric medications. Acute danger to self or others requires crisis/emergency escalation rather than routine medication management.

16. WEIGHT MANAGEMENT AND GLP-1 MEDICATIONS

MDTelemed may prescribe FDA-approved weight-management or diabetes medications, including GLP-1–based therapies, when clinically appropriate and within the physician’s lawful scope. Patients may require weight/BMI information, medical history, medication review, laboratory assessment, contraindication screening, counseling about adverse effects, and longitudinal monitoring. The exact requirements depend on the drug and patient. FDA has specifically warned telehealth companies about misleading promotion of compounded GLP-1 drugs. Compounded drugs are not FDA-approved and are not the same as FDA-approved generic drugs. MDTelemed marketing and consent materials must never state or imply otherwise. If MDTelemed ever facilitates compounded semaglutide or tirzepatide, it must first establish a legally compliant pharmacy/compounding workflow and patient disclosures. FDA has reported dosing errors and adverse events with compounded injectable GLP-1 products. This Policy does not represent that MDTelemed currently dispenses or supplies compounded GLP-1 products.

17. COMPOUNDED MEDICATIONS

Compounded medications require separate caution. FDA-approved drugs undergo FDA review for safety, effectiveness, and manufacturing quality; compounded drugs generally do not undergo that premarket approval process. A compounded drug should not be marketed as FDA-approved, 'generic' merely because it contains a similar active ingredient, or clinically proven equivalent to an FDA-approved product unless such a statement is legally and scientifically supportable. MDTelemed should not prescribe or facilitate a compounded product until the pharmacy source, applicable federal/state compounding framework, labeling, patient disclosure, dosing process, adverse-event pathway, and quality controls have been verified.

18. OFF-LABEL PRESCRIBING

A physician may sometimes prescribe an FDA-approved medication for a use, dose, population, or circumstance not included in FDA-approved labeling when lawful and supported by medical judgment. Off-label use is not inherently improper, but it requires an adequate clinical rationale and appropriate discussion of material risks, alternatives, and uncertainty. MDTelemed marketing must not convert a physician’s lawful off-label discretion into false or misleading drug promotion.

19. HIGH-RISK NON-CONTROLLED MEDICATIONS

Some non-controlled medications can cause substantial harm if started, restarted, stopped, or monitored incorrectly. Examples can include anticoagulants, insulin and other glucose-lowering agents, antiarrhythmics, immunosuppressants, antiepileptic drugs, lithium, systemic steroids, thyroid hormone, and medications requiring laboratory or ECG surveillance. The absence of controlled-substance status does not make a medication automatically suitable for telemedicine. The physician may decline initiation, provide only a bridge, require specialist coordination, or require in-person assessment.

20. SEIZURE MEDICATIONS

Interruption of antiseizure therapy may create substantial risk. The physician should determine the exact medication, dose, duration of interruption, seizure history, pregnancy status where relevant, interactions, and monitoring requirements. Some medications require special restart considerations after interruption. A patient should not independently resume a prior dose after a prolonged interruption without appropriate medical guidance.

21. SYSTEMIC CORTICOSTEROIDS

Systemic corticosteroids can be appropriate for selected conditions but repeated or prolonged courses may create significant risks, including metabolic, infectious, psychiatric, gastrointestinal, bone, ocular, and adrenal effects. Repeated requests for prednisone or methylprednisolone should prompt reassessment of the underlying condition and whether in-person evaluation or longitudinal specialty/primary care is needed.

22. SEXUAL-HEALTH, CONTRACEPTIVE, AND HAIR-LOSS MEDICATIONS

MDTelemed may prescribe appropriate non-controlled sexual-health, contraceptive, and hair-loss medications after evaluating contraindications and necessary monitoring. Examples may include erectile-dysfunction medications, contraceptives, finasteride, or oral minoxidil when clinically appropriate. The physician may require blood pressure, pregnancy assessment, cardiovascular risk evaluation, laboratory testing, or in-person examination depending on the medication and patient.

23. INTERNET, LONGEVITY, AND PATIENT-REQUESTED THERAPIES

A patient may request medications discussed on social media, podcasts, online forums, or longevity programs. A physician is not required to prescribe a medication because it is popular, available elsewhere, or requested by name. Requests involving metformin for nonstandard indications, rapamycin/sirolimus, thyroid hormone without established indication, ivermectin, peptides, beta-blockers for performance-related uses, compounded products, or other nonstandard therapies require individualized assessment of evidence, legality, safety, monitoring, and alternatives. MDTelemed should not offer investigational or unapproved substances as though they were FDA-approved treatments.

24. REFILLS AND BRIDGE PRESCRIPTIONS

A refill request is a clinical request, not an administrative entitlement. The physician may review diagnosis, adherence, effectiveness, adverse effects, monitoring, recent examinations, and whether another clinician is managing the condition. A short bridge may be appropriate when abrupt interruption could cause harm and sufficient information exists to prescribe safely. The quantity and duration should be clinically justified and should not imply permanent assumption of longitudinal management.

25. EARLY REFILLS, LOST MEDICATION, AND DUPLICATE THERAPY

Early-refill or lost-medication requests may require clarification of adherence, dosing, pharmacy dispensing, insurance or travel circumstances, misuse risk, and whether another prescriber is involved. Controlled medications remain prohibited regardless of explanation. The physician may decline duplicate therapy or a replacement prescription when safety cannot be established.

26. PHARMACY SELECTION AND ELECTRONIC PRESCRIBING

Patients may generally identify a lawful pharmacy, subject to legal, technical, medication, and geographic limitations. A prescription transmitted electronically is not a guarantee that the pharmacy has the medication in stock or will dispense it. MDTelemed is not itself represented by this Policy as a pharmacy. Patients should use appropriately licensed pharmacies. FDA warns consumers that unsafe online pharmacies may sell counterfeit, unapproved, or improperly stored medications. If a pharmacy contacts MDTelemed for clarification, substitution, interaction, or safety concerns, the physician may modify, cancel, or replace a prescription when clinically appropriate.

27. MEDICATION SUBSTITUTION AND FORMULARY ISSUES

Pharmacists may request or make substitutions when authorized by law. Insurance formularies are not currently the core MDTelemed payment model because MDTelemed is self-pay, but pharmacy benefit coverage may still affect a patient’s medication cost. A lower-cost alternative, generic equivalent, different dosage form, or therapeutically appropriate alternative may be discussed. The physician retains responsibility for clinical prescribing decisions.

28. MEDICATION COUNSELING

Counseling should be proportionate to the medication and patient. It may include purpose, dose, route, frequency, duration, common adverse effects, serious warning signs, interactions, precautions, missed-dose instructions, monitoring, pregnancy considerations, and when to stop or seek care. The prescription label and pharmacy counseling remain important. Patients should ask the pharmacist or physician when instructions are unclear.

29. MONITORING

Some medications require follow-up laboratory testing, vital signs, symptom assessment, ECG, weight, glucose data, pregnancy testing, therapeutic drug levels, or other monitoring. The physician should communicate material monitoring requirements. Failure to complete required monitoring may make continued prescribing unsafe and can result in a prescription being withheld or limited.

30. ABNORMAL RESULTS AND MEDICATION CHANGES

Abnormal laboratory, imaging, ECG, or other diagnostic results may require dose adjustment, medication discontinuation, additional testing, specialist referral, or urgent evaluation. Patients should maintain current contact information and respond to clinically important communications. MDTelemed’s Test Results, Abnormal Results & Follow-Up Policy governs result-management workflows.

31. MEDICATION ERRORS

If a patient believes the wrong medication, strength, dose, directions, or pharmacy was used, the patient should contact MDTelemed and the dispensing pharmacy promptly. The patient should not take a medication when there is a material unresolved discrepancy. Potentially dangerous ingestion, overdose, severe reaction, or acute deterioration requires emergency services or Poison Control as appropriate, not routine portal messaging.

32. ADVERSE EVENTS

Patients should report suspected adverse medication effects. The physician may recommend stopping, continuing, reducing, replacing, monitoring, or obtaining urgent evaluation depending on the reaction. Serious adverse events may be reportable to FDA MedWatch or other authorities. MDTelemed should establish an internal escalation and documentation process before launch.

33. MEDICATION STORAGE, SHARING, AND DISPOSAL

Patients should store medications according to labeling and pharmacy instructions, protect them from children and unauthorized access, and should not share prescription medications with another person. Unused medications should be disposed of using FDA-, DEA-, pharmacy-, or community-recommended methods appropriate to the product. Medication-specific instructions control when available.

34. PATIENT RESPONSIBILITIES

Provide accurate medication, allergy, and medical-history information. Tell the physician about prescriptions from other clinicians. Use medication only for the patient for whom it was prescribed and as directed. Do not alter dose, frequency, formulation, or route without appropriate guidance. Complete required monitoring and follow-up. Report serious side effects, treatment failure, or worsening symptoms. Do not seek controlled substances through MDTelemed. Do not misrepresent symptoms, identity, location, history, or prior prescriptions to obtain medication. Ask questions when instructions are unclear. Use a licensed pharmacy and review the dispensed label before taking the medication.

35. PHYSICIAN RESPONSIBILITIES

Prescribe only when an adequate clinical basis exists. Account for telemedicine limitations and escalate when remote care is inadequate. Avoid controlled-substance prescribing through MDTelemed. Document material clinical reasoning, medication, dose, instructions, and follow-up. Use appropriate stewardship for anti-infective medications. Consider interactions, allergies, contraindications, monitoring, age, pregnancy, and organ function when relevant. Respond appropriately to pharmacy safety questions and significant adverse events. Avoid misleading representations about FDA approval, compounded drugs, or medication efficacy.

36. STATE-SPECIFIC LAW

Prescribing requirements vary by state and may depend on the patient’s physical location, modality, physician-patient relationship, type of medication, diagnosis, age, and whether examination or testing is required. MDTelemed will maintain state-specific compliance rules rather than assume one national prescribing rule. Where state law is more restrictive than this Policy, the state rule controls.

37. NO AUTOMATED PRESCRIBING

MDTelemed does not use autonomous AI to prescribe medication. AI-assisted telescribing may assist documentation, but the treating MD is responsible for the prescription decision. Patient questionnaires, clinical decision support, interaction alerts, or software recommendations do not substitute for physician review.

38. MARKETING AND MEDICATION CLAIMS

Advertising must not guarantee a prescription, guarantee weight loss or other clinical outcome, misstate FDA approval, conceal material risks, or imply that a compounded drug is the same as an FDA-approved drug. Medication marketing should be reviewed for FDA, FTC, state professional-practice, pharmacy, and consumer-protection implications before publication.

39. CONTACT

MDTelemed LLC 304 S Jones Blvd #4872 Las Vegas, NV 89107 Business Administration / General Contact: Support@MDTelemed.com Confirm final e-prescribing vendor and workflow. Confirm pharmacy-network functionality and whether patients may select any licensed pharmacy. Build the controlled-substance hard stop and audit process. Create a state-by-state prescribing matrix for all four telehealth modalities. Define high-risk medication categories requiring CMO review, specialist coordination, or mandatory objective monitoring. Confirm whether MDTelemed will prescribe compounded medications at launch. If yes, create a separate compounding policy and pharmacy due-diligence program. Confirm the GLP-1 workflow, baseline data, monitoring, adverse-event escalation, and pharmacy source. Define antibiotic stewardship metrics using current CDC outpatient/telemedicine guidance. Create medication-error, pharmacy-callback, adverse-event, and recall workflows. Verify pediatric dosing safeguards and weight-entry validation. Verify medication interaction and allergy-alert functionality in the proprietary platform. Have qualified health-care/pharmacy counsel review state prescribing requirements before 50-state launch.

40. PRIMARY REFERENCES

U.S. Drug Enforcement Administration, Drug Scheduling — federal controlled-substance schedules and examples. Centers for Disease Control and Prevention, Core Elements of Outpatient Antibiotic Stewardship (updated 2026), including telemedicine-specific stewardship resources. U.S. Food and Drug Administration, Buying & Using Medicine Safely and BeSafeRx resources. U.S. Food and Drug Administration, FDA’s Concerns with Unapproved GLP-1 Drugs Used for Weight Loss (2026). U.S. Food and Drug Administration, FDA to Telehealth Companies: What to Know When Promoting Compounded Drugs (2026). U.S. Food and Drug Administration, safety communications concerning dosing errors with compounded injectable semaglutide. Applicable state medical-practice, telemedicine, pharmacy, e-prescribing, minor-consent, and prescribing laws. Original MDTelemed Prescribing Policy & Medication Safety — source for initial intended medication categories, controlled-substance prohibition, safety checks, and antibiotic-stewardship concept. fileciteturn3file9

41. SOURCE LINKS

DEA Drug Scheduling: https://www.dea.gov/drug-information/drug-scheduling CDC Core Elements of Outpatient Antibiotic Stewardship: https://www.cdc.gov/antibiotic-use/hcp/core-elements/outpatient-antibiotic-stewardship.html FDA Buying & Using Medicine Safely: https://www.fda.gov/drugs/information-consumers-and-patients-drugs/buying-using-medicine-safely FDA Concerns with Unapproved GLP-1 Drugs: https://www.fda.gov/drugs/drug-alerts-and-statements/fdas-concerns-unapproved-glp-1-drugs-used-weight-loss FDA Guidance to Telehealth Companies Promoting Compounded Drugs: https://www.fda.gov/drugs/human-drug-compounding/fda-telehealth-companies-what-know-when-promoting-compounded-drugs

42. END OF

CONTROLLED SUBSTANCES - DEA COMPLIANCE - PROHIBITION

1. MDTELEMED LLC

2. CONTROLLED SUBSTANCES & DEA COMPLIANCE — PROHIBITION POLICY

Version 1.0 | September 15, 2026

MDTelemed LLC has adopted a business and clinical rule prohibiting its physicians from prescribing, dispensing, administering, furnishing, or otherwise issuing controlled-substance prescriptions through the MDTelemed service. This internal prohibition is intentionally stricter than what federal or state law may permit in some circumstances.

3. PURPOSE

This Policy establishes MDTelemed's patient-facing and operational controlled-substance rule and distinguishes the company's voluntary prohibition from federal DEA rules that may permit controlled-medication prescribing under specified circumstances.

4. COMPANY RULE — NO SCHEDULE II-V PRESCRIBING

MDTelemed physicians may not prescribe Schedule II, III, IV, or V controlled substances through MDTelemed, regardless of whether a federal telemedicine pathway or a particular state law might otherwise permit the prescription.

5. SCHEDULE I

Schedule I substances have no currently accepted medical use under federal scheduling law and are not prescribed as medications under the federal Controlled Substances Act. MDTelemed does not prescribe or furnish Schedule I substances.

6. SCHEDULE II

Prohibited Schedule II examples include oxycodone, hydrocodone, fentanyl, methadone, amphetamine/dextroamphetamine, methylphenidate and other Schedule II drugs. The examples are illustrative, not exhaustive.

7. SCHEDULE III

Prohibited Schedule III examples include testosterone, anabolic steroids, ketamine, and qualifying codeine combination products. A medication's controlled status is determined by current federal and applicable state scheduling, not by this example list.

8. SCHEDULE IV

Prohibited Schedule IV examples include alprazolam, diazepam, lorazepam, zolpidem and tramadol. The original draft incorrectly placed tramadol in Schedule V.

9. SCHEDULE V

Prohibited Schedule V examples include certain low-codeine cough preparations and other federally scheduled products. Schedule V does not mean 'non-controlled.'

10. STATE SCHEDULING

States can classify or regulate substances differently or more restrictively than federal law. MDTelemed's no-controlled-substance rule applies whenever the medication is controlled under applicable federal or state law.

11. NO BUPRENORPHINE/OUD EXCEPTION

MDTelemed will not provide buprenorphine or other controlled medications for opioid use disorder through the platform at launch. This is a deliberate company scope decision.

12. X-WAIVER CORRECTION

The original stated that an X-Waiver was required for a buprenorphine exception. The federal X-Waiver requirement was eliminated in 2023. MDTelemed therefore will not publish an obsolete X-Waiver requirement.

13. FEDERAL LAW MAY PERMIT MORE THAN MDT POLICY

Federal law currently provides circumstances in which appropriately registered practitioners may prescribe controlled medications through telemedicine. MDTelemed nevertheless prohibits its physicians from using those pathways through MDTelemed.

14. TELEMEDICINE FLEXIBILITIES

DEA and HHS have extended certain federal telemedicine controlled-medication flexibilities through December 31, 2026. Their existence does not change MDTelemed's stricter prohibition.

15. NO IMPLICATION THAT TELEMEDICINE CONTROLLED PRESCRIBING IS ALWAYS ILLEGAL

MDTelemed will not tell patients that all telemedicine controlled-substance prescribing is categorically illegal. The accurate statement is that MDTelemed does not offer it.

16. C.F.R. §1306.04

Federal controlled-substance prescriptions must satisfy the legitimate-medical-purpose and usual-course-of-professional-practice requirements of applicable federal law. That provision is not, by itself, a universal telemedicine prohibition.

17. DEA REGISTRATION

A physician's DEA registration does not override MDTelemed's prohibition. Even a physician who is otherwise federally and state-authorized to prescribe controlled substances may not do so through MDTelemed.

18. PHYSICIAN PERSONAL PRACTICE

This Policy governs care delivered through MDTelemed. Whether a physician may lawfully prescribe controlled substances outside MDTelemed through a separate practice is outside the patient-facing scope of this Policy and does not create authority to prescribe them through MDTelemed.

19. PATIENT REQUESTS

Patients may disclose controlled-substance use and may ask about controlled medications. Physicians may evaluate the clinical issue, document the request, provide education, recommend appropriate non-controlled alternatives when clinically suitable, and refer the patient for appropriate in-person or other lawful care.

20. NO GUARANTEE OF ALTERNATIVE MEDICATION

The controlled-substance prohibition does not guarantee that a non-controlled substitute will be clinically appropriate or prescribed.

21. ADHD

MDTelemed may evaluate symptoms or provide appropriate non-controlled care within lawful scope, but will not prescribe controlled stimulants such as amphetamine products or methylphenidate through the service.

22. ANXIETY AND INSOMNIA

MDTelemed will not prescribe controlled benzodiazepines or controlled hypnotics. Physicians may assess the condition and use non-controlled treatment or referral when clinically appropriate.

23. PAIN

MDTelemed will not prescribe controlled opioid analgesics. Acute or chronic pain requiring controlled medication, procedural treatment, or hands-on assessment may require referral or in-person care.

24. TESTOSTERONE

Because testosterone is federally controlled, MDTelemed will not prescribe testosterone through the service even if a patient has a prior diagnosis or prescription.

25. KETAMINE

MDTelemed will not prescribe, dispense, furnish, or arrange controlled ketamine treatment through its service.

26. TRAMADOL

Tramadol is a Schedule IV controlled substance under federal scheduling and is prohibited by MDTelemed.

27. CODEINE PRODUCTS

Controlled codeine products are prohibited. Scheduling varies by formulation and concentration; clinicians should rely on current authoritative scheduling rather than memory.

28. PREGABALIN AND OTHER SCHEDULE V DRUGS

Schedule V medications remain controlled substances and are prohibited under this Policy.

29. CONTROLLED COUGH MEDICATIONS

A cough medication is not automatically non-controlled. Products containing scheduled narcotics are prohibited.

30. CONTROLLED WEIGHT-LOSS OR OTHER DRUGS

Any medication that is controlled under applicable law is prohibited even if used for weight management, sleep, psychiatric, endocrine, pain, neurologic, or another indication.

31. REFILLS

MDTelemed will not refill or renew a controlled-substance prescription written by another clinician.

32. BRIDGE PRESCRIPTIONS

MDTelemed will not issue a controlled-substance 'bridge' prescription, even when a patient reports that the regular prescriber is unavailable.

33. LOST OR STOLEN MEDICATION

MDTelemed will not replace lost, stolen, destroyed, confiscated, spilled, or prematurely depleted controlled medication.

34. EARLY REFILLS

MDTelemed will not issue early controlled-substance refills.

35. OUT-OF-STATE PRESCRIPTIONS

MDTelemed's prohibition applies nationally and does not change because the patient or physician is in a state with broader telemedicine controlled-substance authority.

36. AUDIO-ONLY

Controlled substances may not be prescribed through MDTelemed by telephone/audio-only encounters.

37. VIDEO

Controlled substances may not be prescribed through MDTelemed by video encounters.

38. ASYNCHRONOUS

Controlled substances may not be prescribed through MDTelemed based on asynchronous questionnaires, store-and-forward review, portal communications, or messaging.

39. SECURE MESSAGING

A controlled prescription may not be issued through secure messaging or as a follow-up to a prior MDTelemed encounter.

40. E-PRESCRIBING HARD STOP

The proprietary prescribing workflow should prevent selection or transmission of controlled medications through MDTelemed whenever technically feasible.

41. FORMULARY CONTROL

The prescribing formulary should identify controlled status using a maintained authoritative drug database and block controlled products, including combination products.

42. GENERIC/BRAND MAPPING

Hard stops must account for generic names, brand names, strengths, formulations and combination products so a controlled drug cannot bypass the restriction through naming differences.

43. SCHEDULE CHANGES

Drug scheduling changes over time. MDTelemed should update its drug database promptly when DEA or applicable state authorities schedule, reschedule, or deschedule substances.

44. STATE-CONTROLLED SUBSTANCES

The system should account for substances controlled by a state even if not identically scheduled federally.

45. MANUAL PRESCRIPTIONS

Physicians may not circumvent the electronic hard stop by issuing a paper, verbal, faxed, external EHR, pharmacy portal, personal e-prescribing, or other controlled prescription on behalf of an MDTelemed encounter.

46. OUTSIDE COMMUNICATION

A physician may not instruct a patient to contact the physician's separate practice merely to evade MDTelemed's controlled-substance restriction.

47. REFERRALS

When controlled-substance evaluation is clinically appropriate, MDTelemed may refer the patient to an appropriate local physician, psychiatrist, pain specialist, addiction specialist, emergency department, urgent care, or other service.

48. REFERRAL IS NOT ENDORSEMENT OF A PRESCRIPTION

Referral means evaluation by another clinician; it does not mean MDTelemed recommends that a controlled medication be prescribed.

49. WITHDRAWAL RISK

Abrupt discontinuation of some controlled medications can be medically dangerous. A patient reporting impending benzodiazepine, barbiturate, opioid, or other withdrawal should be clinically assessed and directed to an appropriate level of care rather than simply told that MDTelemed does not prescribe the drug.

50. BENZODIAZEPINE WITHDRAWAL

Potential benzodiazepine withdrawal can involve seizures, delirium, autonomic instability, or other serious complications and may require urgent or emergency evaluation.

51. OPIOID WITHDRAWAL/OUD

Patients with opioid use disorder or withdrawal should receive clinically appropriate assessment, harm-reduction education where appropriate, and referral to evidence-based treatment. MDTelemed's decision not to provide buprenorphine does not diminish the importance of treatment.

52. OVERDOSE

Suspected overdose, severe sedation, respiratory depression, altered mental status, or other life-threatening drug effects require emergency evaluation.

53. NALOXONE

Naloxone is not federally scheduled as a controlled substance. MDTelemed's controlled-substance prohibition therefore does not itself bar clinically appropriate naloxone prescribing or education, subject to applicable law and clinical judgment.

54. PATIENT'S EXISTING CONTROLLED MEDICATIONS

Patients should disclose controlled medications they already take. The physician may consider them for interactions, contraindications, withdrawal risk, diagnosis and treatment planning.

55. MEDICATION RECONCILIATION

Documenting a patient's controlled medication is not the same as prescribing it. Accurate medication reconciliation remains required.

56. PDMP

Where applicable law, clinical circumstances, or state rules require or support prescription drug monitoring program review, physicians should comply with the applicable workflow. MDTelemed's no-prescribing rule does not automatically eliminate every PDMP-related clinical obligation.

57. DRUG-SEEKING LABELS

A request for a controlled medication should not automatically be characterized as drug-seeking behavior or substance use disorder. Clinicians should document objective facts and clinical reasoning without stigmatizing unsupported conclusions.

58. FALSE INFORMATION

Patients may not intentionally misrepresent identity, location, symptoms, diagnoses, prior prescriptions, pharmacy information, or medication history to circumvent the policy.

59. MULTIPLE ACCOUNTS

Creating multiple accounts or using another person's account to obtain medication is prohibited and may trigger security and clinical review.

60. PHARMACY REQUESTS

A pharmacy request to clarify or substitute a controlled product must not result in issuance of a controlled prescription through MDTelemed.

61. CONTROLLED-SUBSTANCE SAMPLES

MDTelemed does not distribute controlled-substance samples through the service.

62. DISPENSING

MDTelemed does not use the platform to dispense controlled substances to patients.

63. ADMINISTRATION

MDTelemed does not arrange remote administration of controlled substances as part of its ordinary direct-to-consumer service.

64. COMPOUNDED PRODUCTS

A compounded product is not exempt merely because it is compounded. If it contains a controlled substance, it is prohibited.

65. DEA SCHEDULE LOOKUP

When controlled status is uncertain, physicians and pharmacy personnel should verify the current DEA schedule and applicable state schedule before prescribing.

66. CLINICAL DECISION SUPPORT

Software may flag controlled status, but the physician remains responsible for recognizing prohibited prescribing. A missing software alert is not permission.

67. AI

MDTelemed's AI telescribe is documentation support only. It may not authorize, recommend autonomously, transmit, or independently generate a controlled-substance prescription.

68. AI TRANSCRIPTION ERRORS

If the AI-generated note incorrectly states that a controlled drug was prescribed, the physician must correct the medical record promptly. The final note must accurately reflect what occurred.

69. PATIENT RECORD

A patient's request for a controlled medication and the physician's response may be documented when clinically relevant.

70. NO PUNITIVE DOCUMENTATION

Documentation should be factual. The policy should not be used to insert accusatory language into the chart solely because a patient requested a controlled drug.

71. VIOLATION TRIAGE

A suspected physician violation should trigger prompt clinical, compliance and technical review. The response should distinguish an attempted order blocked before transmission, a documentation error, an inadvertent transmission, and intentional circumvention.

72. PATIENT SAFETY FIRST

If a controlled prescription is transmitted in error, MDTelemed should address patient and pharmacy safety promptly while preserving evidence and determining whether cancellation or other corrective action is possible.

73. PRESERVATION

Relevant prescription, audit, communication, pharmacy and medical-record evidence should be preserved according to applicable retention and investigation requirements.

74. PHYSICIAN ACCESS SUSPENSION

MDTelemed may immediately restrict prescribing or platform access when necessary to prevent ongoing patient risk or suspected intentional circumvention, consistent with contracts and applicable law.

75. INVESTIGATION

The CMO/compliance function should investigate facts before making final disciplinary or reporting conclusions.

76. NO AUTOMATIC TERMINATION PROMISE

The original Policy mandated immediate termination for every violation. Version 1.0 permits proportionate action based on facts, patient safety, intent, recurrence, law, contract and credentialing requirements.

77. NO AUTOMATIC CRIMINAL REFERRAL

The original Policy promised 'criminal referral' for every violation. MDTelemed will make law-enforcement or regulatory reports only when required by law or appropriately determined after factual/legal review.

78. DEA REPORTING

Not every internal policy violation automatically creates the same DEA reporting duty. MDTelemed will comply with actual federal reporting requirements and make voluntary reports when legally appropriate.

79. STATE MEDICAL BOARD REPORTING

Board-reporting obligations vary by state and event. MDTelemed will not publish a false universal rule that every suspected prescribing violation must be reported to every board.

80. NPDB CORRECTION

The original Policy promised mandatory NPDB reporting. NPDB reporting is governed by specific federal reporting categories and eligible reporting entities; it is not a universal report for every internal prescribing violation.

81. CRIMINAL PENALTIES

The original Policy cited a specific statute and imprisonment/fine figures as though they applied uniformly. Criminal exposure depends on the actual conduct and charged statute. This Policy does not publish a universal criminal penalty.

82. EMPLOYMENT/CONTRACT CONSEQUENCES

A substantiated violation may result in education, warning, monitoring, prescribing restriction, suspension, termination, credentialing action, reporting, or other response as permitted or required by law and contract.

83. GOOD-FAITH ERROR

A good-faith documentation or formulary classification error should be distinguished from intentional unlawful prescribing, while still being corrected and investigated appropriately.

84. RETALIATION

MDTelemed should not retaliate against staff or physicians for good-faith reporting of a controlled-substance safety or compliance concern.

85. WHISTLEBLOWING

Nothing in this Policy prohibits lawful reports to regulators, law enforcement, professional boards, or other authorities.

86. PATIENT COMPLAINTS

Patients may complain if they believe a controlled prescription was improperly offered, denied in a discriminatory manner, or otherwise mishandled. governs internal grievances.

87. NONDISCRIMINATION

The prohibition applies consistently without discrimination based on disability, diagnosis, history of substance use disorder, race, sex, age, or other protected status.

88. OUD AS A MEDICAL CONDITION

Patients with opioid use disorder should be treated respectfully and clinically. MDTelemed's service limitation is not a moral judgment and should not be used to stigmatize patients.

89. PSYCHIATRIC PATIENTS

Patients with ADHD, anxiety, insomnia, panic disorder, or other psychiatric conditions may receive appropriate evaluation and non-controlled treatment within MDTelemed's scope; controlled medications remain excluded.

90. CHRONIC PAIN PATIENTS

Patients with chronic pain may receive appropriate non-controlled assessment and management within telemedicine limitations, but MDTelemed will not prescribe controlled analgesics.

91. ENDOCRINE/SEXUAL HEALTH

Testosterone and other controlled hormonal products remain prohibited even when clinically common in men's health or endocrine practice.

92. PEDIATRIC PATIENTS

The same controlled-substance prohibition applies to pediatric and adolescent patients.

93. EMERGENCY CARE

MDTelemed is not an emergency controlled-medication source. Patients with severe withdrawal, overdose, seizures, respiratory depression, acute agitation, dangerousness, or other emergencies should use emergency services.

94. CONTINUITY OF CARE

When MDTelemed cannot continue a patient's controlled medication, the physician should avoid misleading the patient into believing the medication will be refilled later and should provide clinically appropriate referral/transition guidance.

95. NO ABANDONMENT

The company policy does not authorize patient abandonment. Physicians should manage urgent clinical consequences of medication interruption appropriately even though they cannot prescribe the controlled medication.

96. RECORD REQUESTS

Patients may obtain records documenting their medication history and MDTelemed encounter under applicable records policies.

97. MARKETING

MDTelemed advertising must not imply that controlled substances, stimulants, benzodiazepines, testosterone, ketamine, opioids, or buprenorphine are available through the service.

98. SEARCH ENGINE/ADVERTISING TERMS

Paid-search, landing-page, affiliate, influencer, and social-media campaigns should be reviewed so they do not misleadingly attract patients seeking prohibited controlled medications.

99. AFFILIATES

Affiliates or marketing partners may not represent that MDTelemed provides controlled substances.

100. PHARMACY RELATIONSHIPS

No pharmacy relationship may be structured to evade the prohibition or steer patients toward controlled-substance prescribing outside approved care.

101. FINANCIAL INCENTIVES

Physician compensation, productivity metrics, patient-retention goals, or marketing incentives must not encourage controlled-substance prescribing.

102. AUDIT

MDTelemed should periodically audit prescribing data for controlled-drug identifiers, suspicious substitutions, external prescription routes, and attempts to bypass formulary controls.

103. NEAR MISSES

Blocked or attempted controlled orders should be analyzed as near misses when appropriate to improve controls.

104. TRAINING

Physicians and relevant staff should receive training on the prohibition, current scheduling, controlled combination products, withdrawal emergencies, referral, documentation, and reporting escalation.

105. ONBOARDING

The controlled-substance rule should be included in physician onboarding and contractual clinical policies.

106. ATTESTATION

MDTelemed may require physicians to attest that they understand and will comply with the prohibition.

107. CHANGE IN BUSINESS MODEL

MDTelemed may not begin controlled-substance prescribing merely by changing website text. Any future program requires a new legal, clinical, DEA, state, pharmacy, privacy, diversion-control, malpractice, technology and compliance review.

108. FUTURE BUPRENORPHINE PROGRAM

If MDTelemed later elects to offer buprenorphine/OUD treatment, this Policy must be formally revised before launch; current federal rules, state law, DEA registration, telemedicine rules, training requirements, Part 2 implications and clinical protocols must then be reassessed.

109. FUTURE ADHD/STIMULANT PROGRAM

Any future stimulant program requires a separate controlled-substance compliance architecture and cannot operate under this prohibition version.

110. FUTURE TESTOSTERONE PROGRAM

Any future testosterone program likewise requires formal policy revision and controlled-substance compliance review.

111. FEDERAL RULE CHANGES

DEA telemedicine rules are evolving. MDTelemed must monitor DEA/HHS rulemaking and not assume the temporary 2026 framework will remain unchanged after December 31, 2026.

112. STATE LAW CHANGES

State controlled-substance, PDMP, e-prescribing and telehealth rules also change. MDTelemed's internal prohibition simplifies but does not eliminate state compliance monitoring.

113. NO LEGAL ADVICE TO PATIENTS

This Policy explains MDTelemed's service limitation; it does not advise patients about whether another clinician may lawfully prescribe a controlled medication.

114. NO GUARANTEE OF SERVICE

A patient's need for a non-controlled medication does not guarantee MDTelemed can safely manage the underlying condition by telemedicine.

115. CONTACT

MDTelemed LLC 304 S Jones Blvd #4872 Las Vegas, NV 89107 Business Administration / Compliance Contact: Support@MDTelemed.com

116. PATIENT-FACING SUMMARY

MDTelemed does not prescribe Schedule II-V controlled substances. This includes controlled opioids, stimulants, benzodiazepines, testosterone, ketamine, tramadol and controlled cough products. MDTelemed does not provide buprenorphine/OUD controlled-medication treatment at launch. The rule applies to video, telephone, asynchronous and secure-message care. MDTelemed may still evaluate your condition, consider non-controlled options when medically appropriate, and refer you to appropriate care. Do not stop a controlled medication abruptly without appropriate medical guidance; some withdrawal syndromes can be dangerous. Call 911 or seek emergency care for overdose, severe withdrawal, seizures, respiratory depression, severe confusion, or another emergency. The fact that MDTelemed prohibits controlled substances does not mean telemedicine controlled-substance prescribing is illegal in every circumstance; it means MDTelemed has chosen not to offer it. Configure the e-prescribing system to hard-block all federally and state-controlled Schedule II-V products. Validate controlled status for brand, generic, combination, compounded and state-only controlled products. Confirm the drug database updates promptly after federal/state scheduling changes. Prevent bypass through external prescription modules, paper/fax/verbal workflows or physician personal e-prescribing accounts used for MDTelemed encounters. Create near-miss and controlled-prescription incident reporting. Create a withdrawal/emergency referral protocol for benzodiazepines, opioids, barbiturates and other clinically significant withdrawal risks. Determine state-by-state PDMP obligations that may remain relevant even under a no-controlled-prescribing model. Create pharmacy callback procedures for attempted controlled substitutions. Train physicians that the federal X-Waiver was eliminated and must not appear in patient-facing materials. Monitor the federal telemedicine controlled-medication rules because current temporary flexibilities expire December 31, 2026 unless changed. Create a legally reviewed reporting matrix for DEA, state boards, NPDB, law enforcement, credentialing entities and malpractice carriers; do not automate reports based only on an internal policy violation. Coordinate with Prescribing, Behavioral Health, Emergency/Crisis, Credentialing, Records, Licensure and Quality/Peer Review. Audit marketing, SEO, affiliate and social media content for prohibited controlled-medication representations. Have qualified DEA/CSA, telehealth, pharmacy and 50-state medical regulatory counsel review the production controls before launch.

117. PRIMARY REFERENCES

Controlled Substances Act, 21 U.S.C. §§801 et seq.

118. C.F.R. Parts 1300-1321, including 21 C.F.R. §1306.04.

U.S. Drug Enforcement Administration, Drug Scheduling. U.S. Drug Enforcement Administration, Controlled Substances Act resources. U.S. Drug Enforcement Administration, DEA Applauds the Repeal of the X-Waiver (January 17, 2023). DEA/HHS, Fourth Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Medications, extending applicable flexibilities through December 31, 2026. Applicable state controlled-substance, medical-practice, telemedicine, PDMP, e-prescribing and pharmacy laws. Original MDTelemed DEA Compliance & Controlled Substance Prohibition — source material; obsolete X-Waiver language, tramadol misclassification, categorical reporting promises and universal criminal-penalty claims were not retained.

119. RELATED MDTelemed POLICIES

Prescribing & Medication Safety; Behavioral Health; Emergency, Urgent Care & Crisis; Physician Credentialing; Medical Record Retention; State Licensure & Multi-State Telemedicine; Quality Assurance & Peer Review; AI Telescribe, Audio Capture & Documentation Consent.

120. END OF

MEDICATION ADVERSE EVENT - ALLERGY - SAFETY ESCALATION

Medication Adverse Event / Allergy / Safety Escalation

Version 1.0 | Effective September 16, 2026

1. Policy Statement

MDTelemed adopts this policy to establish a consistent, patient-centered and legally compliant framework for medication adverse event / allergy / safety escalation. This policy must be implemented together with applicable federal law, the law of the patient's physical location, professional standards, and MDTelemed's other clinical and privacy policies.

2. Purpose

This policy provides a standardized response to reported medication allergies, adverse reactions, treatment failures, and medication-related safety concerns.

3. Triage

Potential anaphylaxis, severe cutaneous reactions, respiratory compromise, altered mental status, severe bleeding, or other emergency symptoms require immediate emergency escalation.

4. Documentation

The clinician should document the suspected medication, reaction, timing, severity, relevant co-medications, and disposition.

5. Medication List

Confirmed allergies and clinically significant adverse reactions should be reconciled in the patient's record.

6. Reporting

Serious or reportable events should be escalated through applicable pharmacovigilance, FDA MedWatch, pharmacy, manufacturer, or internal safety processes when appropriate.

7. Roles and Responsibilities

MDTelemed management is responsible for operational implementation and periodic review. Clinicians remain responsible for independent professional judgment and documentation. Workforce members must follow role-based access, confidentiality, escalation, and incident-reporting requirements. Material conflicts between this policy and controlling law must be escalated to compliance/legal review before the affected workflow is used.

8. Training and Monitoring

Affected personnel should receive role-appropriate training. MDTelemed may audit compliance, investigate deviations, and implement corrective action when needed.

9. Exceptions

No exception may waive a mandatory legal or patient-safety requirement. Operational exceptions should be documented and approved by an authorized leader when appropriate.

10. Primary Regulatory / Guidance References

U.S. Department of Health and Human Services, HIPAA Privacy, Security and Breach Notification Rules, 45 C.F.R. Parts 160 and 164. HHS Telehealth guidance regarding HIPAA and remote communication technologies. Applicable state medical-practice, telehealth, privacy, recording, consumer-protection and professional-licensure laws.

PATIENT FACING PHARMACY CHOICE NON STEERING POLICY

1. PHARMACY CHOICE & NON-STEERING POLICY

Version 2.0 | Effective September 27, 2026

2. Patient Freedom of Choice

THE PATIENT IS FREE TO CHOOSE ANY PHARMACY THE PATIENT WISHES TO USE, SUBJECT TO THE PHARMACY'S LEGAL AUTHORITY, AVAILABILITY, AND ABILITY TO DISPENSE THE PRESCRIPTION. MDTelemed will not require a patient to use a particular pharmacy as a condition of receiving clinical care and will not pressure or improperly steer a patient to a particular pharmacy.

3. Clinical Independence

A physician's decision whether to prescribe, what to prescribe, and whether a medication is medically appropriate must be independent of the pharmacy selected by the patient. Physician compensation, clinical access, treatment recommendations, and prescribing decisions must not depend on pharmacy selection, prescription volume, or use of an affiliated or suggested pharmacy.

4. Information MDTelemed May Provide

MDTelemed may provide neutral factual information about pharmacy availability, hours, delivery, kiosk access, medication availability, formulary, convenience, or other operational factors. Providing factual options does not eliminate the patient's right to select another pharmacy.

5. Affiliated or Related Pharmacy

If an affiliated, partner, kiosk, remote-dispensing, or other pharmacy option is presented, it must be handled in accordance with applicable pharmacy, patient-choice, disclosure, referral/steering, fee-splitting, financial-interest, and consumer-protection requirements. The availability of an affiliated pharmacy does not create an exception to MDTelemed's prescribing rules or controlled-substance prohibition.

PHARMACY - E-PRESCRIBING - DISPENSING COORDINATION

Pharmacy / E-Prescribing / Dispensing Coordination

Version 1.0 | Effective September 16, 2026

1. Policy Statement

MDTelemed adopts this policy to establish a consistent, patient-centered and legally compliant framework for pharmacy / e-prescribing / dispensing coordination. This policy must be implemented together with applicable federal law, the law of the patient's physical location, professional standards, and MDTelemed's other clinical and privacy policies.

2. Purpose

This policy governs electronic prescribing and coordination with pharmacies while preserving independent clinical and pharmacy judgment.

3. Prescription Accuracy

Clinicians must verify patient, medication, strength, route, frequency, duration, quantity, allergies, contraindications, and relevant interaction information before transmission.

4. Pharmacy Choice

Patients should generally retain pharmacy choice subject to availability, law, payer requirements, and the specific service model.

5. No Guaranteed Dispensing

A prescription does not guarantee that a pharmacy will dispense a medication. Pharmacists retain their independent legal and professional obligations.

6. Substitutions and Clarifications

Pharmacy requests for clarification or substitution must be handled by authorized clinical personnel and documented when clinically material.

7. Kiosk / Remote Dispensing

Any MDTelemed-affiliated kiosk or remote dispensing workflow must operate under applicable pharmacy licensure, pharmacist supervision, labeling, counseling, storage, security, and inventory requirements.

8. Roles and Responsibilities

MDTelemed management is responsible for operational implementation and periodic review. Clinicians remain responsible for independent professional judgment and documentation. Workforce members must follow role-based access, confidentiality, escalation, and incident-reporting requirements. Material conflicts between this policy and controlling law must be escalated to compliance/legal review before the affected workflow is used.

9. Training and Monitoring

Affected personnel should receive role-appropriate training. MDTelemed may audit compliance, investigate deviations, and implement corrective action when needed.

10. Exceptions

No exception may waive a mandatory legal or patient-safety requirement. Operational exceptions should be documented and approved by an authorized leader when appropriate.

11. Primary Regulatory / Guidance References

U.S. Department of Health and Human Services, HIPAA Privacy, Security and Breach Notification Rules, 45 C.F.R. Parts 160 and 164. HHS Telehealth guidance regarding HIPAA and remote communication technologies. Applicable state medical-practice, telehealth, privacy, recording, consumer-protection and professional-licensure laws.

LABORATORY - IMAGING - DIAGNOSTIC TEST ORDERING AND RESULTS MANAGEMENT

Laboratory / Imaging / Diagnostic Test Ordering and Results Management

Version 1.0 | Effective September 16, 2026

1. Policy Statement

MDTelemed adopts this policy to establish a consistent, patient-centered and legally compliant framework for laboratory / imaging / diagnostic test ordering and results management. This policy must be implemented together with applicable federal law, the law of the patient's physical location, professional standards, and MDTelemed's other clinical and privacy policies.

2. Purpose

This policy establishes safe ordering, tracking, review, communication, and escalation of diagnostic testing initiated or managed through MDTelemed.

3. Clinical Appropriateness

Testing should be ordered only when clinically indicated and when the clinician can reasonably ensure follow-up. Telemedicine limitations must be considered when a physical examination or immediate diagnostic study is required.

4. Closed-Loop Results

MDTelemed should maintain a closed-loop process for receipt, clinician review, patient communication, abnormal-result escalation, and documentation.

5. Critical Results

Critical or time-sensitive results require prompt escalation using available contact methods and emergency procedures when appropriate.

6. Patient Responsibility

Patients should be instructed how and when to obtain testing, how results will be communicated, and what to do if symptoms worsen before results are available.

7. External Testing

When a patient obtains tests outside MDTelemed's integrated systems, the patient may need to ensure results are transmitted to the treating clinician.

8. Roles and Responsibilities

MDTelemed management is responsible for operational implementation and periodic review. Clinicians remain responsible for independent professional judgment and documentation. Workforce members must follow role-based access, confidentiality, escalation, and incident-reporting requirements. Material conflicts between this policy and controlling law must be escalated to compliance/legal review before the affected workflow is used.

9. Training and Monitoring

Affected personnel should receive role-appropriate training. MDTelemed may audit compliance, investigate deviations, and implement corrective action when needed.

10. Exceptions

No exception may waive a mandatory legal or patient-safety requirement. Operational exceptions should be documented and approved by an authorized leader when appropriate.

11. Primary Regulatory / Guidance References

U.S. Department of Health and Human Services, HIPAA Privacy, Security and Breach Notification Rules, 45 C.F.R. Parts 160 and 164. HHS Telehealth guidance regarding HIPAA and remote communication technologies. Applicable state medical-practice, telehealth, privacy, recording, consumer-protection and professional-licensure laws.

EMERGENCY - URGENT CARE - CRISIS RESPONSE

1. MDTELEMED LLC

2. EMERGENCY, URGENT CARE & CRISIS RESPONSE POLICY

Version 1.0 | September 15, 2026

Patient-facing national baseline. MDTelemed is a telemedicine service, not a hospital emergency department, ambulance service, 911 public-safety answering point, or crisis-response agency. State-specific emergency, psychiatric hold, duty-to-warn/protect, mandatory-reporting, and physician-practice requirements control where more specific.

3. PURPOSE

This Policy explains what patients should do in a medical or psychiatric emergency, how MDTelemed physicians respond when an emergency or crisis is identified during remote care, why accurate physical location is essential, when emergency services or other persons may be contacted, and when telemedicine must stop or transition to in-person or higher-level care. The central safety principle is simple: a telemedicine encounter must never create dangerous delay in emergency evaluation or treatment.

4. IF YOU BELIEVE YOU ARE HAVING AN EMERGENCY

Do not wait for an MDTelemed appointment, portal response, text message, asynchronous questionnaire review, prescription response, or physician callback. Call 911 or the local emergency number immediately, or go to the nearest appropriate emergency department, when delay could threaten life, limb, pregnancy, neurologic function, or the safety of the patient or another person. If you are outside the United States or in a location where 911 is not the emergency number, use the local emergency number.

5. EXAMPLES OF POSSIBLE MEDICAL EMERGENCIES

The following examples are not exhaustive and are not a diagnostic checklist. Seek emergency help for severe, sudden, rapidly worsening, or otherwise alarming symptoms, including: Chest pain, pressure, crushing discomfort, or symptoms concerning for heart attack. Severe difficulty breathing, blue/gray lips, severe wheezing, choking, or inability to speak normally because of breathlessness. Signs of stroke such as sudden facial droop, arm or leg weakness, numbness, severe imbalance, confusion, vision loss, or difficulty speaking. Loss of consciousness, unresponsiveness, new severe confusion, or seizure with concerning features. Severe bleeding, major trauma, suspected internal bleeding, or serious head injury. Severe allergic reaction or anaphylaxis, especially with throat/tongue swelling, breathing difficulty, faintness, or rapidly progressive symptoms. Poisoning, overdose, dangerous medication ingestion, or severe intoxication. Severe abdominal pain with instability, rigid abdomen, persistent vomiting, blood in vomit or stool, or other concerning features. Pregnancy-related emergency symptoms such as severe bleeding, severe pain, seizure, loss of consciousness, or other symptoms requiring immediate obstetric/emergency assessment. Severe dehydration, heat illness, hypothermia, burns, electrical injury, or environmental exposure. Any condition in which the patient, caregiver, or physician reasonably believes immediate emergency evaluation is needed.

6. TIME-SENSITIVE CONDITIONS

Some emergencies are especially time-sensitive. Stroke, acute coronary syndrome, sepsis, anaphylaxis, major hemorrhage, ectopic pregnancy, testicular torsion, retinal vascular emergencies, severe asthma, meningitis, and other conditions can worsen while a patient waits online. MDTelemed should not encourage patients with potentially time-sensitive emergencies to complete prolonged questionnaires or wait for a routine telemedicine queue.

7. TELEMEDICINE IS NOT AN EMERGENCY DEPARTMENT

MDTelemed does not operate a hospital emergency department and cannot provide the physical resources of emergency medicine, including immediate bedside examination, resuscitation, intravenous medications, oxygen delivery, emergency imaging, emergency surgery, blood products, continuous monitoring, or ambulance transport. A telemedicine physician may recognize an emergency and assist with escalation, but remote recognition is not a substitute for definitive emergency evaluation.

8. EMTALA

The federal Emergency Medical Treatment and Labor Act (EMTALA) imposes screening, stabilization, and appropriate-transfer obligations on Medicare-participating hospitals with emergency departments when individuals present seeking emergency examination or treatment. MDTelemed's direct-to-consumer platform is not itself a hospital emergency department merely because a physician advises a patient about an emergency. Patients who present to covered hospital emergency departments have EMTALA protections regardless of ability to pay, subject to the statute and regulations.

9. PATIENT PHYSICAL LOCATION IS REQUIRED

MDTelemed requires the patient's current physical location during an encounter. The patient should provide where the patient actually is, not merely a home address or state of residence. Location is clinically critical during emergencies because the physician may need to identify the correct emergency medical service, crisis system, hospital, poison resource, law-enforcement agency, or other local response. Location also affects physician licensure and state-specific emergency and psychiatric law. If a patient refuses to provide a usable location during a high-risk encounter, the physician may be unable to continue safely.

10. CALLBACK INFORMATION

MDTelemed should maintain a current callback number or other reliable real-time contact method during synchronous encounters. If the connection fails during an emergency, the physician may use available contact information to attempt reconnection or escalation. Patients should keep contact information current and should not intentionally block emergency callback attempts.

11. WHEN AN EMERGENCY IS IDENTIFIED DURING A VISIT

If the physician identifies a possible emergency, the physician should focus first on immediate safety rather than completing a routine telemedicine workflow. Confirm the patient's current location and available callback information when feasible. Explain why emergency or urgent in-person evaluation is recommended. Direct the patient or caregiver to call 911/local emergency services or proceed to an appropriate emergency facility when indicated. Determine whether the patient can safely make the call or travel without creating additional risk. Consider contacting emergency services directly when clinically and legally appropriate. Consider involving a responsible adult, emergency contact, caregiver, or other person who can reduce risk when permitted. Remain connected when doing so improves safety and is operationally feasible; do not use a rigid rule requiring immediate disconnection. Document the emergency concern, information available, recommendations, patient response, communications, and disposition.

12. DO NOT DRIVE YOURSELF WHEN UNSAFE

Patients should not drive themselves when symptoms, intoxication, medication effects, altered consciousness, severe pain, neurologic impairment, psychiatric instability, or other circumstances make driving unsafe. A physician may recommend ambulance transport or another safe transportation arrangement depending on the situation.

13. PATIENT REFUSAL OF EMERGENCY CARE

A competent adult may refuse recommended emergency evaluation in many circumstances, but refusal does not make the medical risk disappear. When a patient refuses, the physician may explain the suspected danger, foreseeable consequences of delay, alternatives, and reasons for escalation; assess decision-making capacity when relevant; encourage involvement of a trusted person; and document the refusal. Where a serious and imminent threat, incapacity, mandatory-reporting duty, or other legal exception applies, the physician may take additional protective action permitted or required by law.

14. DECISION-MAKING CAPACITY

Capacity is decision-specific. A patient may lack capacity because of delirium, severe intoxication, psychosis, cognitive impairment, neurologic illness, hypoxia, severe metabolic disturbance, or other causes. A psychiatric diagnosis alone does not establish incapacity. When capacity is impaired, the physician should follow applicable law regarding emergency treatment, personal representatives, surrogate decision-makers, and protective intervention.

15. LOSS OF CONNECTION DURING AN EMERGENCY

A dropped video or phone connection can itself become a safety problem. If a high-risk patient disconnects unexpectedly, the physician may attempt immediate callback and may contact emergency services or another appropriate person when the known facts justify that action. MDTelemed cannot guarantee that a disconnected patient can always be located or that local responders can be dispatched, which is why accurate location and callback information are essential.

16. MEDICAL EMERGENCIES INVOLVING CHILDREN

Infants and children can deteriorate rapidly and may not communicate symptoms reliably. MDTelemed may use a lower threshold for emergency or in-person escalation when age, symptoms, vital signs, appearance, hydration, breathing, behavior, or examination limitations create concern. A parent or guardian should not delay emergency care while attempting to obtain telemedicine authorization or a routine pediatric visit. When a child faces an emergency and a parent is unavailable, emergency-care law may permit necessary intervention without prior parental permission. MDTelemed's role is often rapid recognition and escalation.

17. PREGNANCY-RELATED EMERGENCIES

Pregnancy can involve emergencies requiring immediate obstetric or emergency evaluation. Severe bleeding, severe abdominal or pelvic pain, syncope, seizure, severe headache with concerning features, severe shortness of breath, chest pain, or other acute symptoms may require emergency care. MDTelemed should not attempt to resolve potentially unstable pregnancy emergencies solely through remote reassurance.

18. ALLERGIC REACTION AND ANAPHYLAXIS

A severe allergic reaction may progress rapidly. Throat or tongue swelling, breathing difficulty, wheezing, faintness, or rapidly progressive multisystem symptoms can require immediate emergency treatment. Patients prescribed epinephrine should follow their individualized emergency instructions. Use of epinephrine does not eliminate the need for emergency evaluation when anaphylaxis is suspected.

19. POISONING AND OVERDOSE

Suspected poisoning or overdose can require immediate emergency response. Patients should not wait for a routine MDTelemed visit. Depending on the substance and circumstances, emergency services and/or a poison-control resource may be appropriate. MDTelemed should avoid giving a single universal instruction for every ingestion because the safest response depends on the substance, dose, symptoms, age, and location.

20. ACUTE INTOXICATION OR WITHDRAWAL

Severe intoxication, altered mental status, respiratory depression, seizure, delirium, severe agitation, or dangerous withdrawal can require emergency care. MDTelemed does not offer buprenorphine/OUD treatment at launch and does not prescribe controlled substances. Telemedicine may be inadequate for acute alcohol, sedative, opioid, stimulant, or other substance-related emergencies.

21. SUICIDAL THOUGHTS

Suicidal thoughts range from passive thoughts of death to imminent intent with a plan and access to lethal means. The physician should not use a single phrase such as 'suicidal ideation' as an automatic substitute for individualized risk assessment. When clinically indicated, assessment may include intent, plan, means, timing, prior attempts, recent behavior, substance use, psychosis, agitation, protective factors, supports, and ability to participate in a safety plan. Immediate danger may require 911/local emergency services or emergency-department evaluation. In the United States, 988 provides suicide and crisis support, but 988 is not a replacement for 911 when immediate physical intervention is required.

22. SUICIDE & CRISIS LIFELINE

In the United States, patients experiencing suicidal, mental-health, or substance-use crisis may call or text 988 or use the 988 Lifeline's supported communication channels. When there is immediate danger, a medical emergency, an active suicide attempt, severe violence risk, or another situation requiring immediate physical response, 911/local emergency services may be the appropriate resource. MDTelemed should not promise that 988 will dispatch a particular local service; crisis-system capabilities vary geographically.

23. HOMICIDAL OR VIOLENT THREATS

Threats toward another person require individualized assessment of credibility, intent, plan, means, target, imminence, psychosis, intoxication, prior violence, and other relevant factors. The original policy's universal statement that the physician 'MUST call 911' for every expression of intent/plan is replaced by a jurisdiction-sensitive standard. Depending on risk and applicable law, protective actions may include emergency services, law enforcement, crisis teams, family/caregivers, an identifiable target, or other persons reasonably able to reduce the threat. A physician should not delay necessary protective action merely to complete a routine telemedicine visit.

24. DUTY TO WARN OR PROTECT

There is no single nationwide Tarasoff rule. Duties to warn or protect arise from state statutes, regulations, case law, and professional standards, and they differ materially among jurisdictions. MDTelemed must maintain a current state-specific duty-to-warn/protect matrix. The patient's physical location should trigger the applicable workflow. HIPAA does not itself create a general duty to warn. It permits disclosures in specified circumstances, including when a provider has a good-faith belief that disclosure is necessary to prevent or lessen a serious and imminent threat and disclosure is made to someone reasonably able to reduce the threat, consistent with applicable law and ethical standards.

25. HIPAA AND SERIOUS/IMMINENT THREATS

Where HIPAA applies, 45 C.F.R. § 164.512(j) permits necessary disclosure of protected health information when a covered provider has a good-faith belief that disclosure is necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public and disclosure is made to a person reasonably able to prevent or lessen the threat. Potential recipients may include law enforcement, family, caregivers, or another appropriate person, depending on the circumstances. Disclosure should be limited to information appropriate to the safety purpose and consistent with applicable law. HHS states that HIPAA defers to health professionals' good-faith professional judgment concerning the nature and severity of the threat.

26. INVOLUNTARY PSYCHIATRIC EVALUATION

Emergency psychiatric detention, involuntary evaluation, protective custody, and civil commitment are governed by state law. The criteria, authorized initiators, required documentation, designated facilities, timelines, and judicial procedures differ. An MDTelemed physician should not tell a patient that the physician personally 'orders a hold' nationwide unless the physician actually has that authority under the applicable jurisdiction's law. When emergency psychiatric intervention is warranted, MDTelemed should use the legally appropriate local pathway.

27. MINORS IN PSYCHIATRIC CRISIS

A minor's psychiatric emergency may require parental/guardian involvement, emergency services, mandatory reporting, or other protective action. Minor consent and confidentiality rules vary by state and service. A parent is not guaranteed absolute confidentiality control where state law allows a minor to consent independently or where safety/reporting exceptions apply. and the state-specific minor-consent matrix apply in addition to this Policy.

28. ABUSE, NEGLECT, AND EXPLOITATION

Emergency encounters may reveal suspected child abuse or neglect, vulnerable-adult abuse or exploitation, domestic violence, trafficking, or other safety threats. Mandatory-reporting duties vary by state and circumstance. MDTelemed must maintain state-specific reporting workflows and should not promise confidentiality that would prevent a legally required report. When immediate danger exists, emergency intervention may be necessary in addition to mandatory reporting.

29. DOMESTIC VIOLENCE AND COERCIVE CONTROL

A patient may be unable to speak freely because an abusive or controlling person is present. The physician should consider privacy and immediate safety before asking sensitive questions. If the patient is in immediate danger, the physician may recommend emergency assistance. Mandatory reporting of adult domestic violence is not governed by one uniform national rule and must be handled under applicable state law.

30. SEXUAL ASSAULT

Recent sexual assault may require emergency or specialized in-person evaluation for injury treatment, forensic evidence collection, pregnancy prevention, STI/HIV prophylaxis, toxicology, advocacy, and safety planning. Telemedicine may provide support and guidance but should not delay time-sensitive forensic or medical services. Consent and mandatory-reporting rules differ for adults and minors and vary by jurisdiction.

31. SEVERE PSYCHIATRIC DECOMPENSATION

Severe psychosis, mania, agitation, catatonia, delirium, inability to care for basic needs, dangerous impulsivity, or profound disorganization may make routine outpatient telemedicine unsafe. The physician may require emergency or in-person evaluation even when the patient denies suicidal or homicidal intent.

32. DELIRIUM IS A MEDICAL EMERGENCY UNTIL PROVEN OTHERWISE

Acute confusion can result from infection, hypoxia, medication toxicity, metabolic disturbance, stroke, intoxication, withdrawal, or other medical causes. It should not automatically be labeled as psychiatric. Sudden altered mental status often requires urgent or emergency medical assessment.

33. NEUROLOGIC EMERGENCIES

New focal weakness, facial droop, speech difficulty, sudden severe headache, seizure with concerning features, acute vision loss, severe new imbalance, or sudden confusion can represent neurologic emergencies. A telemedicine physician should avoid false reassurance based solely on limited remote examination when emergency imaging or neurologic evaluation may be needed.

34. CARDIOPULMONARY EMERGENCIES

Chest pain, severe shortness of breath, syncope, cyanosis, severe palpitations with instability, or other concerning cardiopulmonary symptoms may require emergency assessment. A normal-appearing video image does not exclude acute coronary syndrome, pulmonary embolism, arrhythmia, hypoxemia, or other serious disease.

35. SEPSIS AND SERIOUS INFECTION

Severe infection can present with fever or hypothermia, confusion, weakness, breathing difficulty, low blood pressure symptoms, reduced urine output, or rapid deterioration. Telemedicine cannot provide definitive sepsis testing or resuscitation. High-risk patients may need emergency evaluation even when symptoms initially appear nonspecific.

36. URGENT BUT NOT NECESSARILY EMERGENT CONDITIONS

Some conditions require prompt in-person care without necessarily requiring 911. The physician may recommend same-day urgent care, an in-person primary-care visit, specialty evaluation, laboratory testing, imaging, or emergency department evaluation depending on risk. The distinction between 'urgent' and 'emergency' is a clinical judgment based on the available information and can change if symptoms worsen.

37. TELEMEDICINE EXAMINATION LIMITATIONS

Remote care cannot reproduce every component of a hands-on examination. The physician may be unable to palpate an abdomen, assess pulses, perform an otoscopic exam, obtain an ECG, measure orthostatic vital signs, perform a complete neurologic examination, or obtain immediate laboratory/imaging results. If the missing examination or test is material to excluding a dangerous condition, the physician should escalate rather than pretend the limitation does not matter.

38. AUDIO-ONLY LIMITATIONS

Audio-only care removes visual assessment and may be inadequate for high-risk symptoms. The physician may require video or in-person evaluation. A patient should not interpret completion of a telephone encounter as proof that an emergency has been excluded.

39. ASYNCHRONOUS MESSAGING IS NOT FOR EMERGENCIES

Questionnaires, portal messages, email, and secure messages are not continuously monitored emergency channels. Patients should not send a message and wait when immediate medical or psychiatric help is needed. MDTelemed should display emergency warnings at appropriate points in asynchronous workflows.

40. PATIENTS WHO ARE ALONE

When a high-risk patient is alone, the physician may ask whether a trusted person can come to the patient's location or remain with the patient while emergency assistance is arranged. Whether another person should be involved depends on the clinical situation, patient preference when feasible, privacy law, and the seriousness of the threat.

41. EMERGENCY CONTACTS

MDTelemed may request emergency-contact information for selected services. Providing an emergency contact does not authorize unrestricted disclosure of the patient's medical record. In an emergency, information may be shared with an emergency contact when permitted by HIPAA and other applicable law and when clinically appropriate.

42. COMMUNICATION WITH EMS, ED, OR HOSPITAL

When emergency transfer occurs, the physician may communicate relevant information to emergency responders or receiving clinicians for treatment and continuity of care as permitted by law. Information may include presenting symptoms, medications, allergies, relevant history, risk assessment, and the reason for escalation. The physician should not delay emergency activation merely to assemble a complete record.

43. MEDICAL RECORD DOCUMENTATION

Emergency documentation should accurately reflect what was known and done without hindsight reconstruction. Patient identity and current physical location when available. Presenting symptoms and material history. Relevant telemedicine observations and limitations. Risk assessment or emergency concern. Advice given and rationale. 911/EMS, 988, crisis-team, law-enforcement, caregiver, or other contacts made when applicable. Patient acceptance or refusal of recommendations. Loss of connection and callback attempts. Disposition and follow-up instructions. Any legally required report or protective disclosure.

44. DOCUMENTATION SHOULD NOT OVERSTATE CERTAINTY

The physician should distinguish suspected emergency conditions from confirmed diagnoses. For example, a remote physician may document 'concern for acute coronary syndrome' rather than claiming a confirmed myocardial infarction without diagnostic evidence. Similarly, a risk assessment may identify concern for imminent self-harm without claiming certainty about future behavior.

45. RECORDS FROM EMERGENCY OR HOSPITAL CARE

After emergency evaluation, MDTelemed may request or receive hospital, emergency-department, laboratory, imaging, or specialist records when permitted by HIPAA and applicable law. The original policy stated that hospital records are obtained 'with patient authorization.' Authorization may be one lawful pathway, but HIPAA also generally permits provider-to-provider disclosures for treatment without a separate authorization, subject to specialized laws that may apply. MDTelemed should use the legally appropriate pathway rather than unnecessarily delaying continuity of care.

46. RETURN TO TELEMEDICINE AFTER AN EMERGENCY

MDTelemed may resume telemedicine after an emergency when the treating physician determines that remote care is appropriate and the patient does not require a higher level of care. The original policy's universal requirement that every patient 'must obtain in-person follow-up' after every emergency is replaced with individualized follow-up. Many emergencies do require in-person follow-up, but the timing and type depend on the condition, discharge plan, and clinical circumstances. MDTelemed should not contradict a hospital discharge plan without appropriate clinical review.

47. MEDICATIONS AFTER EMERGENCY CARE

A patient should provide MDTelemed with an updated medication list after emergency-department or hospital treatment. Medication changes, new diagnoses, renal/hepatic changes, pregnancy status, or new interactions may affect prescribing. MDTelemed will not prescribe Schedule II-V controlled substances.

48. REFUND AND BILLING

The original promised that an emergency-terminated visit would always be free and refunded. That is not retained as a universal clinical-policy promise because billing terms should be governed by the verified Payment, Billing, Membership & Auto-Renewal Policy and the services actually rendered. A patient should never delay emergency care because of concern about an MDTelemed charge. Billing questions can be addressed after immediate safety needs are handled. Where MDTelemed cannot provide the purchased service because emergency escalation supersedes routine care, the applicable refund or credit rule should be applied consistently with and applicable law.

49. EMERGENCY CARE AND MEMBERSHIP STATUS

Emergency recommendations do not depend on whether a patient is a member, has exhausted membership benefits, has a failed payment, or has an outstanding balance. MDTelemed does not condition its safety advice on the patient's ability to pay.

50. NO GUARANTEE OF EMS RESPONSE TIME OR DESTINATION

MDTelemed cannot guarantee how quickly emergency services will arrive, which responders will be dispatched, or which hospital will receive the patient. Local emergency systems control dispatch, transport, destination, and response protocols.

51. PUBLIC SAFETY EVENTS AND DISASTERS

During natural disasters, mass-casualty events, power failures, cyber incidents, communications outages, or declared emergencies, MDTelemed services may be interrupted and local emergency resources may be strained. Patients should follow official emergency-management instructions and should not rely on the platform as their sole source of emergency communication.

52. TECHNICAL FAILURE

A platform outage, failed camera, failed microphone, loss of power, or internet interruption may make remote evaluation impossible. If the patient may be experiencing an emergency, the patient should seek emergency help rather than wait for technical troubleshooting. MDTelemed should maintain a downtime and emergency-continuity procedure appropriate to its actual technology architecture.

53. AI TELESCRIBE DURING EMERGENCY ENCOUNTERS

MDTelemed may use an AI-assisted telescribe to support documentation by the human MD. The AI is not the emergency decision-maker and does not replace physician judgment, 911, EMS, emergency-department evaluation, or crisis services. Emergency escalation should never be delayed to complete an AI-generated note or transcript. Audio capture, processing, retention, and recording practices must be accurately described in the separate AI Telescribe consent after the technical architecture is verified.

54. CONTROLLED SUBSTANCES AND CRISIS CARE

MDTelemed's policy prohibits Schedule II-V controlled-substance prescribing. Emergency or crisis status does not create an exception to that platform rule. Patients requiring controlled medication as part of emergency treatment should be evaluated by an appropriate in-person or emergency service.

55. PATIENT RESPONSIBILITIES

Call 911/local emergency services or seek emergency care rather than waiting for MDTelemed when an emergency is suspected. Provide the actual current physical location at the encounter. Keep a reliable callback number current. Tell the physician promptly if symptoms are severe, worsening, or different from the original reason for the visit. Do not drive when symptoms or impairment make driving unsafe. Follow emergency or urgent in-person recommendations or tell the physician if unable or unwilling to do so. Do not use asynchronous messaging as an emergency channel. Provide updated medication and hospital-discharge information after emergency care. Tell the physician if weapons, medications, substances, or other lethal means are relevant to an acute safety concern. Call 988 for appropriate U.S. suicide/crisis support and 911 when immediate physical intervention is required.

56. MDTelemed RESPONSIBILITIES

Train MD physicians to recognize telemedicine red flags and escalate appropriately. Require patient physical location and reliable contact information in encounters where needed for safety. Maintain a medical-emergency escalation workflow. Maintain a behavioral-health crisis workflow. Maintain state-specific duty-to-warn/protect guidance. Maintain state-specific involuntary-evaluation and mandatory-reporting guidance. Document emergency recommendations and material communications. Protect PHI while permitting lawful safety disclosures. Do not require immediate disconnection when remaining connected improves safety. Do not allow billing, membership, or routine documentation processes to delay emergency escalation.

57. -STATE EMERGENCY AND CRISIS COMPLIANCE ARCHITECTURE

Because MDTelemed intends to operate nationally, a single national paragraph is insufficient for psychiatric and protective emergencies. Before launch, MDTelemed should maintain a jurisdiction-specific matrix covering at least: Emergency psychiatric evaluation/hold criteria and who may initiate the process. Designated crisis receiving facilities and relevant state terminology. Duty to warn/protect statutes and case law. Child-abuse reporting. Vulnerable-adult abuse/exploitation reporting. Domestic-violence and injury-reporting requirements. Firearm- or weapon-related reporting obligations where applicable. Minor consent/confidentiality in psychiatric emergencies. Law-enforcement and EMS contact pathways. Telehealth-specific emergency-plan requirements. Physician documentation requirements.

58. CONTACT

MDTelemed LLC 304 S Jones Blvd #4872 Las Vegas, NV 89107 Business Administration / General Contact: Support@MDTelemed.com Do not use the business-administration email address for an emergency. Email is not an emergency-response channel. Build and legally review the 50-state emergency psychiatric hold/involuntary evaluation matrix. Build and legally review the 50-state duty-to-warn/protect matrix. Build mandatory-reporting matrices for child abuse, vulnerable-adult abuse/exploitation, and other reportable injuries/events. Verify the platform captures actual patient physical location at each encounter and makes it visible to the treating MD. Verify emergency callback workflow and failed-connection escalation. Create a location-based 911/EMS and crisis-resource workflow; do not assume every 911 system accepts the same type of remote caller information. Determine whether the platform will collect emergency contacts and how consent/disclosure will work. Train physicians on 988 versus 911 use and on not treating 988 as a substitute for immediate emergency response. Create pediatric emergency escalation standards. Create pregnancy emergency escalation standards. Create overdose/poisoning workflow and verify how Poison Control resources will be presented. Create emergency handoff documentation templates. Align refund language with final rather than promising an automatic refund in every emergency. Verify AI telescribe behavior during emergencies and ensure documentation technology never delays escalation. Have qualified 50-state health-law counsel review the public policy and operational matrices before national launch.

59. PRIMARY REFERENCES

60. C.F.R. § 164.512(j), HIPAA Privacy Rule - uses and disclosures to avert a serious threat to health or safety.

U.S. Department of Health and Human Services, OCR FAQ: disclosure to law enforcement, family members, or others when a patient presents a serious and imminent danger. U.S. Department of Health and Human Services, OCR FAQ: duty to warn is derived from state law, court decisions, and ethical standards; HIPAA permits appropriate safety disclosure. Centers for Medicare & Medicaid Services, Emergency Medical Treatment & Labor Act (EMTALA) overview and patient emergency-room rights. Substance Abuse and Mental Health Services Administration / 988 Suicide & Crisis Lifeline resources. Applicable state emergency psychiatric evaluation, civil commitment, duty-to-warn/protect, mandatory-reporting, telehealth, licensure, and confidentiality laws. Original MDTelemed Emergency Protocols & Crisis Response - used as source material; categorical termination, 911, duty-to-warn, involuntary-hold, refund, and follow-up language was revised.

61. SOURCE LINKS

HHS serious and imminent threat FAQ: https://www.hhs.gov/hipaa/for-professionals/faq/520/does-hipaa-permit-a-health-care-provider-to-disclose-information-if-the-patient-is-a-danger/index.html HHS duty-to-warn FAQ: https://www.hhs.gov/hipaa/for-professionals/faq/2098/if-doctor-believes-patient-might-hurt-himself-or-herself-or-someone-else-it-duty-provider.html HHS serious/imminent professional judgment FAQ: https://www.hhs.gov/hipaa/for-professionals/faq/3002/what-constitutes-serious-imminent-threat-that-would-permit-health-care-provider-disclose-phi-to-prevent-harm-patient-public-without-patients-authorization-permission/index.html CMS EMTALA overview: https://www.cms.gov/medicare/regulations-guidance/legislation/emergency-medical-treatment-labor-act CMS emergency-room rights: https://www.cms.gov/priorities/your-patient-rights/emergency-room-rights

62. Suicide & Crisis Lifeline: https://988lifeline.org/

63. END OF

CHAPERONE - SENSITIVE EXAMINATION - INTIMATE CARE +

Chaperone / Sensitive Examination / Intimate Care

Version 1.0 | Effective September 16, 2026

1. Policy Statement

MDTelemed adopts this policy to establish a consistent, patient-centered and legally compliant framework for chaperone / sensitive examination / intimate care. This policy must be implemented together with applicable federal law, the law of the patient's physical location, professional standards, and MDTelemed's other clinical and privacy policies.

2. Purpose

This policy addresses sensitive or intimate care delivered through telemedicine, including encounters involving breasts, genitalia, rectal complaints, sexual health, or other circumstances where a chaperone may be appropriate.

3. Telemedicine Limits

Clinicians must not ask patients to perform unnecessary exposure or self-examinations. Images or video should be limited to what is clinically necessary and lawful.

4. Chaperones

A trained chaperone IF available may be offered when appropriate under professional standards, organizational policy, patient preference, or state law.

5. Consent

The clinician should explain what visual examination is requested, why it is needed, and alternatives, and obtain the patient's agreement before proceeding.

6. Documentation

Document the presence or declination of a chaperone and clinically relevant consent when applicable.

7. Roles and Responsibilities

MDTelemed management is responsible for operational implementation and periodic review. Clinicians remain responsible for independent professional judgment and documentation. Workforce members must follow role-based access, confidentiality, escalation, and incident-reporting requirements. Material conflicts between this policy and controlling law must be escalated to compliance/legal review before the affected workflow is used.

8. Training and Monitoring

Affected personnel should receive role-appropriate training. MDTelemed may audit compliance, investigate deviations, and implement corrective action when needed.

9. Exceptions

No exception may waive a mandatory legal or patient-safety requirement. Operational exceptions should be documented and approved by an authorized leader when appropriate.

10. Primary Regulatory / Guidance References

U.S. Department of Health and Human Services, HIPAA Privacy, Security and Breach Notification Rules, 45 C.F.R. Parts 160 and 164. HHS Telehealth guidance regarding HIPAA and remote communication technologies. Applicable state medical-practice, telehealth, privacy, recording, consumer-protection and professional-licensure laws.

CONTINUITY OF CARE - TRANSFER - TERMINATION

1. MDTELEMED LLC

2. CONTINUITY OF CARE, TRANSFER & TERMINATION POLICY

Version 1.0 | September 15, 2026

National patient-facing baseline. Because MDTelemed intends to serve patients in all 50 states, continuity, physician-patient relationship termination, notice, prescription bridging, records, minors, behavioral health, and abandonment requirements must be supplemented by state-specific operational rules. This Policy does not invent one nationwide notice period where state law and clinical circumstances differ.

3. PURPOSE

This Policy explains how MDTelemed LLC and its treating MD physicians address continuity of care, physician departure, transfer of care, patient-requested discontinuation, account closure, physician-patient relationship termination, service discontinuation, pending results, medication needs, records, referrals, and safe transition.

4. WHY THE ORIGINAL WAS TOO RIGID

Continuity and abandonment obligations depend on whether a physician-patient relationship exists, whether treatment is active or episodic, the patient's condition, medication risk, pending tests, local availability of alternative care, state law, contractual obligations, and the reason for termination. A rigid national seven-day or 30-day rule can be wrong in particular states or clinical circumstances.

5. COMPANY AND PHYSICIAN RESPONSIBILITIES

MDTelemed LLC provides the platform and administrative framework. Clinical decisions concerning whether ongoing treatment is medically appropriate, whether a bridge is safe, what follow-up is required, and when escalation is necessary remain the responsibility of the treating licensed MD physician within applicable law and professional standards.

6. PHYSICIAN-PATIENT RELATIONSHIP

Continuity duties arise from the actual clinical relationship and governing law, not merely from account creation. An account holder who has never received medical care may have different rights and obligations from a patient in an active course of treatment.

7. EPISODIC VERSUS ONGOING CARE

A single acute telemedicine encounter may be episodic and may end after the physician provides the treatment plan and appropriate follow-up instructions. Chronic disease management, serial psychiatric care, medication monitoring, active diagnostic workup, repeated visits, and pending results may create stronger continuity needs.

8. NO PATIENT ABANDONMENT

MDTelemed and its physicians should not terminate an established treatment relationship in a manner that constitutes patient abandonment. The precise legal standard varies by state, but safe termination generally requires attention to reasonable notice, urgency, ongoing treatment needs, access to alternative care, records, and clinically necessary transition.

9. PATIENT SAFETY OVERRIDES ADMINISTRATIVE CONVENIENCE

Billing disputes, membership cancellation, physician departure, account restrictions, staffing changes, platform migration, or business decisions should not be allowed to create an avoidable gap in clinically necessary care where professional duties require transition measures.

10. PATIENT'S RIGHT TO END CARE

A competent adult patient generally may stop using MDTelemed or seek care elsewhere, subject to financial obligations already incurred and applicable law. Patients should not be forced to remain in an ongoing physician relationship.

11. MEMBERSHIP CANCELLATION IS NOT THE SAME AS CLINICAL TERMINATION

Cancelling a recurring membership concerns future contractual billing and access under the membership terms. It does not erase medical records, revoke every authorization, cancel already rendered services, or automatically resolve active clinical issues.

12. ACCOUNT CLOSURE

MDTelemed should provide a mechanism for users to request account closure consistent with privacy, medical-record, billing, security, and legal-retention obligations. Account closure does not mean that records subject to legal retention requirements are deleted.

13. NO UNIVERSAL 30-DAY PATIENT CLOSURE REQUIREMENT

The original Policy required a patient to give 30 days' notice to close an account. That is not retained as a universal rule. Membership cancellation timing is governed by and applicable automatic-renewal law; clinical transition depends on the patient's active care needs.

14. PHYSICIAN DEPARTURE

When an MDTelemed physician leaves, becomes unavailable, loses required licensure, is suspended, dies, becomes impaired, or otherwise cannot continue care, MDTelemed should identify affected active patients and determine what notice and transition are required.

15. NO UNIVERSAL NOTICE TO EVERY PATIENT SEEN IN 12 MONTHS

The original rule requiring notice to all patients seen in the preceding 12 months is not retained as a national fact. The affected population should be determined using state law, practice status, active treatment, pending matters, medication needs, and reasonable patient expectations.

16. TIMING OF DEPARTURE NOTICE

Notice should be provided sufficiently in advance when practicable to support safe transition and in the manner required by applicable state law. Sudden death, emergency suspension, illness, or immediate loss of authority may make advance notice impossible; the response must then focus on prompt patient safety and continuity.

17. CONTENT OF TRANSITION NOTICE

When appropriate, a notice may explain that the physician is no longer available, how MDTelemed will address active care, how to obtain records, how to contact MDTelemed, what to do for urgent needs, and how to seek another physician. MDTelemed should not promise automatic assignment to a replacement physician unless that operational model is verified.

18. PHYSICIAN REASSIGNMENT

A patient should not be told that a new physician has been 'assigned' if no qualified physician has actually accepted responsibility. Any replacement physician must be appropriately licensed or otherwise authorized for the patient's current location and must exercise independent clinical judgment.

19. PATIENT CHOICE OF NEW CLINICIAN

Patients may choose to transition to another MDTelemed physician when available or to an outside physician or practice. MDTelemed should not improperly obstruct transfer because a patient chooses a competitor.

20. RECORD ACCESS DURING TRANSITION

Patients retain medical-record access rights under HIPAA and applicable law. governs access, amendment, authorization, and release. Termination or account restriction must not be used to defeat legally required records access.

21. RECORD TRANSFER

Records may be sent to the patient or an authorized recipient in accordance with HIPAA and applicable state law. The patient may be required to provide a valid authorization when the disclosure is not otherwise permitted by law.

22. PDF CAPABILITY

MDTelemed has confirmed PDF as the patient-facing record format currently intended to be supported. This Policy does not promise FHIR, HL7, CSV, Excel, direct EHR import, or another electronic format unless implemented or legally required.

23. NO UNIVERSAL 3-5 DAY TRANSFER PROMISE

The original three-to-five-business-day complete-transfer promise is not retained. HIPAA and state law impose specific access requirements and sometimes shorter or different rules. MDTelemed should meet the applicable legal deadline and process clinically urgent transfer needs appropriately.

24. HIPAA RIGHT OF ACCESS

For HIPAA-covered records, 45 C.F.R. § 164.524 generally requires action on an access request no later than 30 calendar days after receipt, with one additional 30-day extension when the regulatory conditions are satisfied. State law may require faster access.

25. TREATMENT DISCLOSURES

HIPAA generally permits covered providers to disclose PHI for treatment without a separate patient authorization, subject to applicable law. Sensitive categories and state laws may impose additional restrictions. The operational workflow must distinguish patient-access requests from provider-to-provider treatment disclosures.

26. PENDING LABORATORY RESULTS

A relationship should not be closed without addressing laboratory results already ordered or received. MDTelemed should maintain responsibility rules for result review, patient notification, escalation, and documentation even when a physician departs.

27. PENDING IMAGING

Imaging ordered before termination should be tracked to completion or clearly transferred to another responsible clinician when clinically and legally appropriate. Critical or unexpected results require timely escalation.

28. PENDING PATHOLOGY OR SPECIALIZED TESTING

Delayed-result testing can return after the initiating encounter or physician's departure. MDTelemed should maintain a work queue or equivalent process so clinically important results are not orphaned.

29. CRITICAL RESULTS

Critical results should be handled under a defined escalation process that does not depend solely on the availability of the ordering physician. Attempts to contact the patient and any escalation should be documented.

30. ABNORMAL NONCRITICAL RESULTS

Noncritical abnormalities still require appropriate follow-up. Closure of a membership or account does not erase an already identified clinical responsibility.

31. UNCOMPLETED TESTS

If a patient has not completed recommended testing, the record should reflect the recommendation, clinically material risks, reminders or follow-up when appropriate, and any decision to transfer responsibility.

32. REFERRALS

Existing referrals should be reviewed during transition. MDTelemed should distinguish merely providing a referral from assuming responsibility for guaranteeing that an outside specialist accepts or sees the patient.

33. OUTSIDE PROVIDERS

Laboratories, imaging centers, pharmacies, specialists, hospitals, and other outside providers may be independent entities. MDTelemed should provide reasonable transition information but cannot guarantee third-party availability, pricing, scheduling, or acceptance.

34. PRESCRIPTION CONTINUITY

Medication continuity is clinical, not automatic. A physician should consider the risks of abrupt interruption, the medication's indication, monitoring requirements, contraindications, available information, state law, and whether a short bridge is safe.

35. NO AUTOMATIC REFILLS

Termination or physician departure does not create an entitlement to an automatic refill. A physician may require reassessment, laboratory monitoring, in-person evaluation, specialist management, or another clinically appropriate condition before prescribing.

36. HIGH-RISK MEDICATION INTERRUPTIONS

Particular care is warranted when abrupt interruption could create material harm, including certain anti-seizure medications, chronic systemic corticosteroids, psychiatric medications, endocrine therapies, anticoagulation, transplant/cancer therapies, or other medically consequential regimens. The appropriate response is patient-specific.

37. CONTROLLED SUBSTANCES

MDTelemed does not prescribe Schedule II-V controlled substances. Continuity planning should not imply that MDTelemed will bridge or assume controlled-substance prescribing. Patients requiring such treatment should be directed to appropriate lawful care.

38. PSYCHIATRIC CARE

Because MDTelemed treats psychiatric conditions, termination planning should consider relapse risk, medication discontinuation, suicidality, psychosis, functional deterioration, follow-up availability, and the need for emergency or in-person care.

39. PSYCHIATRIC CRISIS

A patient in an acute psychiatric emergency should not be handled as an ordinary administrative termination. Crisis response, emergency escalation, and local resources take priority.

40. SUICIDAL OR HOMICIDAL RISK

When credible acute risk is identified, clinicians should follow the applicable emergency/crisis protocol and state law. A dangerousness concern can justify limits on routine telemedicine care but does not eliminate the need for an appropriate safety response.

41. MINORS

For pediatric patients, transition decisions must account for parent/guardian authority, minor consent rights, confidentiality, custody, guardianship, state law, and the child's clinical needs.

42. MINOR CONFIDENTIALITY

Where a minor can consent to a service independently under state law, a parent may not necessarily control every record, communication, or transition decision. should provide state-specific rules.

43. PREGNANCY AND REPRODUCTIVE CARE

Active pregnancy, reproductive-health treatment, abnormal testing, medication exposure, or time-sensitive care can require expedited transition. Privacy protections may also vary by jurisdiction.

44. CHRONIC DISEASE

Patients with diabetes, hypertension, cardiovascular disease, pulmonary disease, renal disease, thyroid disease, or other chronic illness may need ongoing monitoring. Termination should identify clinically significant unresolved issues and follow-up needs.

45. WEIGHT MANAGEMENT / GLP-1 CARE

Patients receiving longitudinal weight-management treatment may require medication monitoring, adverse-effect review, laboratory follow-up, dose decisions, and transition planning. Membership cancellation should not be treated as a substitute for appropriate medication instructions.

46. SEXUAL HEALTH

STI testing, contraception, erectile-dysfunction treatment, and other sexual-health services may involve pending tests, partner considerations, contraindications, and confidentiality issues. Transition should preserve legally required privacy.

47. DERMATOLOGY

Dermatologic care may involve serial images, treatment response, pathology, medication monitoring, or escalation to in-person evaluation. A physician should identify unresolved issues before ending active care.

48. PRIMARY CARE

If MDTelemed provides ongoing primary-care functions, termination obligations may be broader than for a single urgent-care encounter. Longitudinal medication lists, chronic disease, preventive needs, pending referrals, and diagnostic workups should be considered.

49. URGENT CARE

An episodic urgent-care relationship may appropriately conclude after the encounter when the patient receives diagnosis/treatment information, return precautions, and appropriate follow-up. The physician should not imply ongoing monitoring that the service will not provide.

50. TELEMEDICINE LIMITATIONS

A physician may terminate or transfer telemedicine management when the condition requires a hands-on examination, procedure, diagnostic capability, monitoring, emergency intervention, or other service that cannot safely be provided through MDTelemed.

51. PATIENT RELOCATION

Because the patient's physical location determines licensure and other legal requirements, a patient who travels or relocates may become temporarily or permanently ineligible to receive care from a particular physician. MDTelemed should attempt appropriate transition rather than asking the patient to misstate location.

52. PHYSICIAN LICENSURE CHANGE

If a physician no longer has legal authority to treat a patient in the patient's location, the physician should not continue treatment merely to avoid inconvenience. MDTelemed should identify a legally authorized alternative when available or direct the patient to outside care.

53. PLATFORM OR TECHNOLOGY FAILURE

A material outage may interrupt access. MDTelemed should maintain contingency procedures for urgent communications, pending results, scheduled encounters, and records when reasonably possible. The platform is not an emergency service.

54. BUSINESS CLOSURE

If MDTelemed discontinues operations, the company must address custody and availability of medical records, active patients, pending results, notices, prescriptions, privacy, and state-specific practice-closure requirements. A generic website shutdown is not an adequate clinical closure plan.

55. SERVICE-LINE CLOSURE

If MDTelemed stops a particular service line—such as psychiatry, pediatrics, weight management, or primary care—it should identify active patients affected and implement a transition plan appropriate to clinical risk and state requirements.

56. TERMINATION BY MDTelemed OR A PHYSICIAN

An established relationship may be ended for legitimate reasons such as inability to provide appropriate care remotely, repeated nonadherence that makes care unsafe, persistent failure to complete required monitoring, material breakdown of the therapeutic relationship, threatening behavior, fraud, boundary violations, or other lawful grounds.

57. NONDISCRIMINATION

Termination must not be based on unlawful discrimination. Disability, race, color, national origin, sex, age, religion, or another protected status must not be used as a pretext for denying care in violation of applicable law.

58. DISABILITY AND ACCOMMODATION

Before terminating solely because a patient has difficulty using technology or communicating, MDTelemed should consider reasonable accommodation obligations and whether an accessible alternative can be provided.

59. LANGUAGE ACCESS

Communication barriers should not automatically be characterized as noncompliance. Where applicable, language-access obligations should be considered before adverse clinical or account action.

60. NONPAYMENT

Nonpayment may support limits on future nonemergency services when lawful, but MDTelemed should distinguish financial account action from professional duties concerning active treatment, pending results, records, emergencies, and safe transition.

61. THREATS AND VIOLENCE

Credible threats or dangerous conduct may require immediate restriction or termination for safety. Advance notice that would create a danger need not be treated as a rigid prerequisite; continuity measures should be tailored to the circumstances.

62. HARASSMENT

Severe or repeated harassment may justify ending the relationship. A patient complaint, negative review, emotional distress, psychiatric symptom, or disagreement with care should not automatically be labeled harassment.

63. FRAUD OR IDENTITY MISUSE

Material identity fraud, prescription fraud, payment fraud, or deliberate misrepresentation may justify immediate action. MDTelemed should still preserve required records access and address clinically urgent unresolved matters.

64. REQUESTING A CONTROLLED SUBSTANCE

A patient does not commit misconduct merely by asking whether a controlled medication is available. MDTelemed should explain its no-controlled-substance policy. Fraud, diversion, threats, or repeated attempts to circumvent controls are separate issues.

65. PATIENT NONADHERENCE

A patient may decline recommendations. Termination for nonadherence should consider whether the patient's choices make continued care unsafe, whether risks were explained, whether barriers can be addressed, and whether a reasonable transition is required.

66. LOSS OF CONTACT

Patients should maintain current contact information. If a patient cannot be reached, MDTelemed should use reasonable contact attempts proportionate to clinical risk and document them. The number and modality of attempts should be defined operationally rather than invented in this public policy.

67. NOTICE OF TERMINATION

When an ongoing relationship is terminated by MDTelemed or a physician, notice should comply with applicable state law and professional standards. It should generally identify the effective date, transition instructions, records access, urgent/emergency instructions, and how to seek alternative care, as appropriate.

68. STATE-SPECIFIC NOTICE PERIODS

MDTelemed will not publish a single national termination notice period as if it controlled all 50 states. The operational system should apply the patient's jurisdiction-specific rule and permit longer notice when clinically appropriate.

69. DELIVERY OF NOTICE

Depending on applicable law and circumstances, notice may need to be delivered by mail, certified mail, electronic communication, portal, or another method. MDTelemed should preserve evidence of required notice.

70. ALTERNATIVE CARE INFORMATION

When required or appropriate, transition information may include methods for locating another clinician, local health systems, specialty resources, or emergency services. MDTelemed should avoid guaranteeing that a specific outside clinician will accept the patient.

71. EMERGENCY CARE DURING TRANSITION

MDTelemed is not an emergency department. Patients with emergency symptoms should call 911 or seek the nearest appropriate emergency facility regardless of whether a transition period is underway.

72. URGENT CARE DURING TRANSITION

Clinically urgent needs arising before an effective termination date should be triaged according to clinical risk. The existence of a termination notice does not justify ignoring an urgent communication that MDTelemed has undertaken to receive.

73. AFTER THE EFFECTIVE DATE

After a relationship has properly ended, MDTelemed is not necessarily responsible for indefinite clinical management. Continuing obligations may nevertheless exist concerning records, privacy, billing, legally required notices, previously received results, or other matters.

74. ACCOUNT SUSPENSION

Administrative suspension does not automatically terminate a physician-patient relationship. The system should distinguish account access controls from clinical relationship status.

75. ACCOUNT TERMINATION

Permanent account termination should trigger review for active clinical relationships, pending tests, prescriptions, referrals, records requests, scheduled care, and transition duties before the account is simply disabled.

76. RECORD ACCESS AFTER ACCOUNT TERMINATION

Former patients retain record-access rights to the extent provided by HIPAA and state law. A login ban should not become a records-access ban.

77. PRIVACY AFTER TERMINATION

HIPAA and other privacy obligations continue after the relationship or membership ends. MDTelemed may retain records and other information as required or permitted by law.

78. MEDICAL RECORD RETENTION

Termination does not authorize destruction of the medical record. Records should be retained under and applicable state law.

79. AI TELESCRIBE RECORDS

If AI-assisted telescribing is used during an encounter, the resulting clinical note remains subject to applicable medical-record rules. Audio-processing, recording, retention, and consent are governed separately by and should not be guessed in this Policy.

80. BILLING AFTER TERMINATION

Charges for services already provided, refunds, credits, recurring membership cancellation, and future billing are governed by Policies 08 and 36 and applicable law. Clinical termination does not create an automatic forfeiture or refund rule.

81. COMPLAINTS DURING TERMINATION

A patient may complain about termination or transition under . MDTelemed should not retaliate against a patient for a good-faith complaint, medical-board report, privacy complaint, billing dispute, or request for records.

82. APPEAL OR RECONSIDERATION

MDTelemed should establish an internal process for reconsideration of significant account or clinical termination decisions where appropriate. This Policy does not invent a guaranteed appeal deadline or outcome before the workflow is finalized.

83. QUALITY AND RISK REVIEW

Terminations involving serious adverse outcomes, threats, physician impairment, abandonment allegations, repeated failed transitions, critical-result failures, or patient safety concerns should be referred for appropriate quality/risk review.

84. DOCUMENTATION

The record should document clinically relevant reasons for termination or transfer, patient notice when required, unresolved issues, medication decisions, pending tests, referrals, transition instructions, emergency precautions, and significant communications.

85. DO NOT ALTER THE RECORD TO JUSTIFY TERMINATION

Medical records must remain accurate. Personnel must not retrospectively change clinical documentation to manufacture a basis for termination. Corrections and late entries must follow proper documentation standards.

86. CONFIDENTIALITY OF INTERNAL REVIEW

Internal quality, peer-review, legal, employment, and risk-management records may have different confidentiality and privilege protections from the patient's medical record. MDTelemed should not place unnecessary privileged analysis into the clinical chart.

87. DECEASED OR INCAPACITATED PATIENTS

Continuity and records issues involving a deceased or incapacitated patient require verification of the legally authorized personal representative or other authority under HIPAA and state law.

88. GUARDIANSHIP AND CAREGIVERS

A caregiver's involvement does not automatically make that person the patient's legal representative. Transition communications should verify authority where protected information will be disclosed.

89. COORDINATION WITH PHARMACIES

MDTelemed may communicate lawful prescription and transition information to pharmacies as permitted. A pharmacy's refusal, stock shortage, or independent policy does not automatically obligate an MDTelemed physician to prescribe an unsafe alternative.

90. COORDINATION WITH LABS AND IMAGING CENTERS

Orders, results, and follow-up may involve independent facilities. MDTelemed should define who receives results and how responsibility is reassigned when the ordering physician leaves.

91. TRANSFER TO HIGHER LEVEL OF CARE

A physician may direct a patient to urgent care, emergency care, hospital evaluation, specialist care, or in-person examination when telemedicine is insufficient. This is a clinical escalation, not punitive termination.

92. REFUSAL OF HIGHER-LEVEL CARE

If a patient refuses recommended emergency or in-person evaluation, the physician should document the recommendation, material risks discussed, the patient's response, and reasonable safety instructions. Refusal does not automatically require immediate relationship termination.

93. PATIENT RESPONSIBILITIES

Patients should provide accurate contact information and physical location, complete clinically important testing, monitor authorized communications, seek emergency care when directed, request refills before running out when feasible, and promptly arrange alternative care after receiving a transition notice.

94. MDTelemed RESPONSIBILITIES

MDTelemed should maintain workflows for physician departure, termination notice, pending-result coverage, records access, prescription review, urgent escalation, privacy, patient complaints, and state-specific requirements.

95. CONTACT

MDTelemed LLC 304 S Jones Blvd #4872 Las Vegas, NV 89107 Business Administration / Continuity Questions: Support@MDTelemed.com Do not use this administrative email for medical emergencies. Build a 50-state physician-patient relationship termination/abandonment matrix, including notice periods, delivery methods, exceptions, record notices, practice closure, physician departure, and required board/patient notifications. Classify MDTelemed encounters operationally as episodic versus longitudinal and define when an active physician-patient relationship remains open. Create a physician-departure patient-impact report identifying active medications, pending labs/imaging/pathology, referrals, future appointments, recent abnormal results, and high-risk diagnoses. Establish cross-coverage for results when the ordering physician is unavailable or departs. Create critical-result and abnormal-result escalation procedures with documented contact attempts. Create medication bridge guidance by medication class; do not use a universal refill duration. Create special transition pathways for psychiatry, pediatrics, pregnancy/reproductive care, seizure disorders, chronic steroids, anticoagulation, transplant/cancer therapy, and other high-risk treatment. Verify that no workflow permits Schedule II-V controlled-substance prescribing. Create termination-notice templates that dynamically apply state requirements rather than hard-coding 30 days. Create emergency exceptions for credible threats, violence, fraud, physician impairment, immediate licensure loss, or other situations where ordinary advance notice is impossible or unsafe. Create a process to preserve records access after account suspension or termination. Verify PDF record delivery and align transfer workflows with ; do not promise FHIR/EHR import until implemented. Align membership/account closure with so cancellation can be completed as required without falsely requiring 30 days' advance notice. Create business-closure and service-line-closure plans addressing record custody, active care, pending results, privacy, and state notifications. Create a relocation/licensure workflow triggered by the patient's physical location at every encounter. Create documentation templates for transfer, termination, patient refusal, failed contact, and transition instructions. Establish reconsideration/appeal procedures for significant account or relationship termination decisions. Coordinate with Policies 03, 05, 07, 08, 09, 11, 12, 15, 19, 24, 28, 32, 33, 36, 38, and 39. Have qualified 50-state health-care, medical-licensure, privacy, behavioral-health, pediatric, consumer-protection, and risk-management counsel review the final operational implementation.

96. PRIMARY LEGAL, REGULATORY & PROFESSIONAL REFERENCES

97. C.F.R. § 164.524 — HIPAA individual right of access to protected health information.

98. C.F.R. § 164.506 — HIPAA uses and disclosures for treatment, payment, and health-care operations.

99. C.F.R. § 164.508 — HIPAA uses and disclosures requiring authorization.

100. C.F.R. § 164.502 — HIPAA general rules and personal representatives.

AMA Code of Medical Ethics Opinion 1.1.3, Patient Rights, including continuity of care concepts. AMA Code of Medical Ethics Opinion 1.1.5, Terminating a Patient-Physician Relationship. Federation of State Medical Boards and individual state medical-board statutes, regulations, policies, and guidance concerning termination, abandonment, medical records, telemedicine, and physician departure. Applicable state medical-practice, telehealth, patient-abandonment, medical-record, practice-closure, minor-consent, behavioral-health, prescription, consumer-protection, disability, and nondiscrimination laws. Original MDTelemed Continuity of Care & Provider Departure — used as source material; universal 12-month patient notification, 24-hour/7-day departure notice, 3-5 business-day complete record transfer, FHIR/EHR transfer, 30-day patient account closure notice, and automatic no-early-termination-fee language were not retained as verified national rules.

101. SOURCE LINKS

HIPAA Access Rule, 45 C.F.R. § 164.524: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.524 HIPAA Treatment/Payment/Operations Rule, 45 C.F.R. § 164.506: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.506 HIPAA Authorization Rule, 45 C.F.R. § 164.508: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.508 HHS HIPAA Right of Access: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html AMA Code of Medical Ethics Opinion 1.1.5, Terminating a Patient-Physician Relationship: https://code-medical-ethics.ama-assn.org/ethics-opinions/terminating-patient-physician-relationship Federation of State Medical Boards state-board directory: https://www.fsmb.org/contact-a-state-medical-board/

102. END OF

AFTER-HOURS - PATIENT MESSAGING - CLINICAL RESPONSE TIME +

After-Hours / Patient Messaging / Clinical Response Time

Version 1.0 | Effective September 16, 2026

1. Policy Statement

MDTelemed adopts this policy to establish a consistent, patient-centered and legally compliant framework for after-hours / patient messaging / clinical response time. This policy must be implemented together with applicable federal law, the law of the patient's physical location, professional standards, and MDTelemed's other clinical and privacy policies.

2. Purpose

This policy sets expectations for asynchronous messages, after-hours contacts, response times, and urgent symptoms.

3. Not Emergency Monitoring

Portal, email, SMS, and routine support channels are not continuously monitored

4. Urgent Symptoms

Patients should be instructed to call 911 or seek emergency care for emergencies rather than waiting for a portal response.

5. Response Standards

MDTelemed should define operational response targets for routine clinical and administrative messages without promising a response time that operations cannot reliably meet.

6. Handoffs

Unresolved clinical issues should be handed off to the appropriate oncoming clinician/team with documentation sufficient for continuity.

7. Roles and Responsibilities

MDTelemed management is responsible for operational implementation and periodic review. Clinicians remain responsible for independent professional judgment and documentation. Workforce members must follow role-based access, confidentiality, escalation, and incident-reporting requirements. Material conflicts between this policy and controlling law must be escalated to compliance/legal review before the affected workflow is used.

8. Training and Monitoring

Affected personnel should receive role-appropriate training. MDTelemed may audit compliance, investigate deviations, and implement corrective action when needed.

9. Exceptions

No exception may waive a mandatory legal or patient-safety requirement. Operational exceptions should be documented and approved by an authorized leader when appropriate.

10. Primary Regulatory / Guidance References

U.S. Department of Health and Human Services, HIPAA Privacy, Security and Breach Notification Rules, 45 C.F.R. Parts 160 and 164. HHS Telehealth guidance regarding HIPAA and remote communication technologies. Applicable state medical-practice, telehealth, privacy, recording, consumer-protection and professional-licensure laws.

REASONABLE ACCOMMODATION - ACCESSIBLE CLINICAL ENCOUNTER SUPPORT

Reasonable Accommodation / Accessible Clinical Encounter Support

Version 1.0 | Effective September 16, 2026

1. Policy Statement

MDTelemed adopts this policy to establish a consistent, patient-centered and legally compliant framework for reasonable accommodation / accessible clinical encounter support. This policy must be implemented together with applicable federal law, the law of the patient's physical location, professional standards, and MDTelemed's other clinical and privacy policies.

2. Purpose

This policy operationalizes reasonable accommodations for patients with disabilities during telemedicine encounters, beyond general website accessibility.

3. Examples

Accommodations may include accessible communication formats, qualified interpreters where required, captioning, relay services, extra time, caregiver assistance, keyboard navigation, screen-reader compatibility, or alternative workflows.

4. Clinical Equivalence

A disability should not be used as a reason to deny telemedicine when an effective reasonable accommodation can permit safe care.

5. Limits

When telemedicine cannot safely provide an effective clinical assessment even with accommodation, the patient should receive appropriate referral to an accessible in-person setting.

6. Requests

Accommodation requests should be documented and routed without unnecessary delay.

7. Roles and Responsibilities

MDTelemed management is responsible for operational implementation and periodic review. Clinicians remain responsible for independent professional judgment and documentation. Workforce members must follow role-based access, confidentiality, escalation, and incident-reporting requirements. Material conflicts between this policy and controlling law must be escalated to compliance/legal review before the affected workflow is used.

8. Training and Monitoring

Affected personnel should receive role-appropriate training. MDTelemed may audit compliance, investigate deviations, and implement corrective action when needed.

9. Exceptions

No exception may waive a mandatory legal or patient-safety requirement. Operational exceptions should be documented and approved by an authorized leader when appropriate.

10. Primary Regulatory / Guidance References

U.S. Department of Health and Human Services, HIPAA Privacy, Security and Breach Notification Rules, 45 C.F.R. Parts 160 and 164. HHS Telehealth guidance regarding HIPAA and remote communication technologies. Applicable state medical-practice, telehealth, privacy, recording, consumer-protection and professional-licensure laws.

NONDISCRIMINATION - ACCESSIBILITY - LANGUAGE ACCESS

1. MDTELEMED LLC

2. NONDISCRIMINATION, DISABILITY ACCESSIBILITY & LANGUAGE ACCESS POLICY

Version 1.0 | September 15, 2026

National patient-facing baseline. MDTelemed LLC intends to provide equal access to its telemedicine services and to comply with applicable federal and state nondiscrimination, disability-access, effective-communication, and language-access requirements. This Policy does not claim that any unverified accessibility feature, interpreter vendor, dedicated accessibility email address, WCAG conformance level, or response-time SLA currently exists.

3. PURPOSE

This Policy describes MDTelemed LLC's commitment to nondiscrimination, equal access, reasonable modifications, effective communication, digital accessibility, language access, accommodations for patients and appropriate companions, complaint handling, and the additional implementation controls required for a nationwide telemedicine service.

4. NONDISCRIMINATION

MDTelemed will not unlawfully exclude, deny services to, provide materially unequal service to, or otherwise discriminate against a patient because of a characteristic protected by applicable law.

5. PROTECTED CHARACTERISTICS

Depending on applicable federal, state, or local law, protected characteristics may include race, color, national origin, ancestry, ethnicity, religion or creed, sex, pregnancy, sexual orientation, gender identity or expression, age, disability, genetic information, military or veteran status, marital/familial status, or other legally protected status. State and local protections may be broader.

6. APPLICATION TO THE PATIENT JOURNEY

Nondiscrimination applies to registration, scheduling, identity verification, access to physicians, modality selection, clinical evaluation, prescribing decisions, testing/referrals, communications, pricing, payment, membership, records, grievances, account administration, and termination of services.

7. CLINICAL DISTINCTIONS ARE NOT AUTOMATICALLY DISCRIMINATION

Physicians may make individualized clinical decisions based on medically relevant factors such as age, pregnancy, anatomy, disability-related physiology, medication interactions, renal/hepatic function, or disease risk when clinically appropriate. The reason must be clinical rather than a pretext for unlawful discrimination.

8. EQUAL CLINICAL STANDARD

A disability, language difference, race, sex, age, or other protected characteristic does not justify a lower standard of medical care. The modality or accommodation may change; professional responsibility does not.

9. ADA TITLE III

Health-care providers and medical offices can be places of public accommodation under ADA Title III. MDTelemed will evaluate its patient-facing services, including digital access, under applicable ADA requirements.

10. SECTION 504

If MDTelemed or a relevant program receives federal financial assistance that triggers Section 504 of the Rehabilitation Act, applicable Section 504 nondiscrimination and accessibility obligations must be satisfied. Applicability must be determined from actual funding/contracting facts.

11. SECTION 1557

Section 1557 of the Affordable Care Act can impose nondiscrimination obligations on covered health programs and activities. Applicability depends on the statutory/regulatory framework and MDTelemed's actual funding and operations. Because portions of the 2024 rule have been subject to litigation, injunctions, and stays, MDTelemed should verify current enforceable requirements before launch and after material legal developments.

12. STATE CIVIL-RIGHTS LAW

All 50 states and other jurisdictions may impose additional disability, public-accommodation, language, medical-practice, consumer, or civil-rights requirements. This national baseline does not replace required state-specific supplements.

13. DISABILITY

MDTelemed does not deny care merely because a person has a physical, sensory, intellectual, developmental, psychiatric, cognitive, neurological, or other disability protected by applicable law.

14. REASONABLE MODIFICATIONS

MDTelemed will make reasonable modifications to policies, practices, or procedures when necessary to provide access to a person with a disability, unless a legally recognized exception applies.

15. FUNDAMENTAL ALTERATION

The ADA does not require a modification that would fundamentally alter the nature of the goods or services. A clinical safety requirement should be distinguished from administrative convenience.

16. UNDUE BURDEN

Applicable law may recognize undue-burden limitations for particular auxiliary aids/services. Such determinations should be made under the governing legal standard, documented where appropriate, and should not be used as a blanket reason to refuse accessible care.

17. EFFECTIVE COMMUNICATION

MDTelemed will take appropriate steps to communicate effectively with patients who have hearing, vision, speech, or other communication disabilities. The appropriate aid depends on the nature, length, complexity, context, and person's usual method of communication.

18. AUXILIARY AIDS AND SERVICES

Depending on need and verified availability, auxiliary aids/services may include qualified sign-language or oral interpreters, video remote interpreting, real-time captioning, written materials, accessible electronic text, large print, qualified readers, relay services, text-based communication, or other effective methods.

19. NO AUTOMATIC ONE-SIZE-FITS-ALL ACCOMMODATION

An aid that works for one patient may be ineffective for another. A text chat may be adequate for a brief administrative exchange but insufficient for a complex psychiatric history, informed consent, medication counseling, or serious diagnosis.

20. CONSULTATION WITH THE PATIENT

For Title III effective communication, MDTelemed should consult with the person with a disability whenever possible about the appropriate aid or service. The method selected must actually result in effective communication.

21. TIMELINESS

Auxiliary aids and services must be provided in an accessible format, in a timely manner, and in a way that protects privacy and independence as required by applicable law.

22. NO SURCHARGE FOR REQUIRED ADA ACCESS

MDTelemed will not impose a surcharge on a person with a disability to cover the cost of measures required to provide nondiscriminatory treatment or effective communication under the ADA.

23. COMPANIONS WITH DISABILITIES

Effective-communication obligations can extend to an appropriate companion with a disability when MDTelemed should communicate with that companion, such as a parent, guardian, surrogate, spouse, or other appropriate person.

24. PATIENT INTERPRETER RESPONSIBILITY

MDTelemed will not require a patient with a disability to bring another person to interpret for the patient when MDTelemed is legally responsible for effective communication.

25. FAMILY AND FRIENDS AS DISABILITY INTERPRETERS

Reliance on an accompanying adult to interpret for a person with a disability is limited under ADA rules. It may be appropriate in an imminent-threat emergency when no interpreter is available, or in a non-emergency when the individual specifically requests the adult, the adult agrees, and reliance is appropriate.

26. MINOR CHILDREN AS DISABILITY INTERPRETERS

MDTelemed will not rely on a minor child to interpret or facilitate communication for a person with a disability except in the narrow emergency circumstances recognized by applicable ADA rules.

27. QUALIFIED INTERPRETERS

When an interpreter is required for effective communication, the interpreter must be capable of interpreting effectively, accurately, and impartially, using necessary specialized vocabulary. Complex medical discussions can require a qualified medical/sign-language interpreter.

28. VIDEO REMOTE INTERPRETING

If video remote interpreting is used, MDTelemed must verify that the technology and service meet applicable performance requirements and are clinically effective for the encounter. VRI should not be treated as adequate merely because a video window can technically open.

29. TELECOMMUNICATIONS RELAY SERVICES

MDTelemed should accept calls placed through applicable telecommunications relay services and train staff not to reject or mishandle relay calls because they appear unfamiliar or take longer.

30. DEAF AND HARD-OF-HEARING PATIENTS

Depending on the encounter, access may require ASL or other qualified interpretation, captions, relay services, text, written communication, or another effective method. Complex history-taking, consent, psychiatric assessment, and treatment counseling may require more than typed notes.

31. BLIND AND LOW-VISION PATIENTS

Patient-facing information should be made available in accessible formats appropriate to the patient's needs. Digital content should be designed to work with common assistive technologies where reasonably achievable and required.

32. SPEECH DISABILITIES

Patients with speech disabilities should be afforded additional time or alternate communication pathways when needed. Staff should not treat slower communication as noncooperation.

33. COGNITIVE AND INTELLECTUAL DISABILITIES

Communication should be adapted to the patient's needs without infantilizing the patient. Capacity is decision-specific and should not be presumed absent merely because a patient has an intellectual, developmental, psychiatric, or cognitive diagnosis.

34. MOBILITY DISABILITIES

A digital service should avoid unnecessary interaction barriers for users who cannot use a mouse, touch gestures, or conventional device controls. Actual keyboard and assistive-technology compatibility must be tested before public claims are made.

35. NEURODIVERGENCE

Reasonable modifications may include clear instructions, reduced unnecessary sensory/cognitive complexity, additional processing time, or alternate communication when required by the individual's disability and compatible with safe care.

36. SERVICE ANIMALS

If MDTelemed later operates physical sites, kiosks, clinics, or other locations subject to ADA service-animal rules, access policies must comply with applicable law. Purely online operations do not eliminate the need to address accessibility at any physical patient touchpoint.

37. DIGITAL ACCESSIBILITY

MDTelemed recognizes that inaccessible websites, apps, forms, portals, video controls, authentication, scheduling, payment, records, and messaging can prevent patients with disabilities from obtaining telemedicine services.

38. WEB ACCESSIBILITY GOVERNANCE

MDTelemed should establish a documented digital-accessibility standard and testing program. This Policy does not claim conformance with WCAG 2.1 AA, WCAG 2.2 AA, or another technical standard until the production website/app has been tested and the claim is supportable.

39. WCAG AS TECHNICAL BENCHMARK

WCAG is a widely used technical accessibility benchmark. Whether a particular WCAG version or conformance level is legally required depends on the governing law and entity. MDTelemed may adopt WCAG 2.2 AA as an internal target after technical and legal approval, but should not misstate it as a universal statutory requirement for every private health-care website.

40. SCREEN READERS

The original Policy promised screen-reader compatibility. The production site/app should be tested with representative screen readers and browser/device combinations before that promise is published.

41. ALT TEXT

Meaningful images that convey information should have appropriate text alternatives where required by the adopted accessibility standard. Decorative images should be implemented so they do not create unnecessary screen-reader noise.

42. HEADINGS AND LANDMARKS

Digital content should use meaningful semantic structure so assistive-technology users can navigate forms, policies, clinical instructions, and records efficiently.

43. KEYBOARD ACCESS

Interactive functions should be operable without requiring a mouse where required by the adopted standard. Focus order and visible focus should be tested.

44. COLOR AND CONTRAST

Clinical alerts, errors, status indicators, and required actions should not depend on color alone. Text and controls should meet the approved contrast standard.

45. TEXT RESIZING AND REFLOW

Patients should be able to enlarge text and use common zoom/reflow functions without losing essential information or functionality within the adopted accessibility requirements.

46. CAPTIONS

Prerecorded patient-facing video content should be captioned where required. Live clinical captioning should be selected based on effective-communication needs, privacy, accuracy, and applicable law.

47. AUDIO DESCRIPTION

Audio description may be appropriate for video content when important visual information is not otherwise communicated. MDTelemed should not promise universal audio description until the content inventory and implementation are verified.

48. FORMS

Registration, consent, payment, symptom intake, identity verification, and record-request forms should have programmatically associated labels, clear instructions, accessible errors, and an accessible correction process under the adopted standard.

49. TIME LIMITS

Automatic timeouts can create barriers. Where a timeout is necessary for privacy/security, MDTelemed should provide appropriate warnings/extensions where required and reconcile accessibility with security rather than promising 'no auto-timeout.'

50. CAPTCHA AND BOT PROTECTION

Security controls should provide an accessible alternative when a CAPTCHA or anti-bot mechanism cannot be used by a person with a disability.

51. MULTIFACTOR AUTHENTICATION

Authentication should be designed with accessible options. Security requirements should not unnecessarily exclude patients who cannot use a particular sensory or motor interaction.

52. DOCUMENT ACCESSIBILITY

Patient-facing PDFs and downloadable forms should be made accessible where required and feasible. If a document is not accessible, MDTelemed should provide an effective alternate format.

53. MEDICAL RECORDS

A patient who is entitled to a medical record should not lose access merely because the standard PDF is inaccessible to that patient's assistive technology. and accessibility procedures should coordinate alternate formats.

54. MOBILE ACCESSIBILITY

Native or mobile-web experiences should be tested for screen-reader gestures, orientation, text scaling, focus, touch-target usability, labels, and other applicable accessibility requirements.

55. VIDEO PLATFORM ACCESSIBILITY

The telehealth interface should be evaluated for accessible join flow, camera/microphone controls, chat, captions, interpreter participation, error messages, and reconnection procedures.

56. ACCESSIBILITY OF THIRD-PARTY TOOLS

MDTelemed should not assume that a third-party video, payment, identity, analytics, scheduling, or support tool is accessible merely because the vendor advertises accessibility. Material patient-facing components require due diligence and testing.

57. ACCESSIBILITY PROCUREMENT

Accessibility should be a procurement criterion for third-party patient-facing technology. Contracts may require accessibility representations, documentation, remediation cooperation, and notice of material changes.

58. LANGUAGE ACCESS

Patients whose primary language is not English may require language assistance. Applicable duties depend on the legal framework, including whether Section 1557 or other federal/state law applies.

59. LEP / LIMITED ENGLISH PROFICIENCY

Where legally required, MDTelemed will take reasonable steps or provide meaningful access for individuals with limited English proficiency using qualified language assistance appropriate to the interaction.

60. QUALIFIED LANGUAGE INTERPRETERS

A qualified spoken-language interpreter should have appropriate proficiency, interpret effectively, accurately, and impartially, and use necessary specialized vocabulary. Clinical interpretation should not be delegated casually to unqualified personnel.

61. MACHINE TRANSLATION

Automated translation can be useful for low-risk content but may be unsafe for complex medical communication. Where applicable law requires accuracy review or qualified human review for critical content, MDTelemed should implement it.

62. FAMILY AS LANGUAGE INTERPRETERS

Even outside disability law, relying on family or friends for clinical language interpretation can create accuracy, privacy, coercion, and safety problems. MDTelemed should use qualified language assistance when legally required or clinically necessary.

63. CHILDREN AS LANGUAGE INTERPRETERS

Children should not be used as routine interpreters for medical encounters. Emergency exceptions and specific legal standards must be respected.

64. LANGUAGE ASSISTANCE COST

Where federal or state law requires language assistance to be provided without charge to the patient, MDTelemed will not charge the patient for that required assistance.

65. VITAL DOCUMENTS

Where applicable law requires translation of vital documents, MDTelemed should identify which documents are vital for the relevant population and provide accurate translations through an approved process.

66. NOTICES OF LANGUAGE ASSISTANCE

If Section 1557 or another law requires notices of language assistance, MDTelemed must provide the current required notice in the required languages, locations, formats, and cadence. The exact 2026 requirement should be legally verified before launch because the regulatory landscape has been litigated.

67. INTERPRETER PRIVACY

Interpreters and accessibility vendors who handle PHI must be integrated into HIPAA/privacy workflows, including BAAs where required and appropriate confidentiality controls.

68. PSYCHIATRIC CARE

Because MDTelemed intends to treat psychiatric conditions, communication access is especially important for suicide assessment, psychosis, capacity, medication counseling, informed consent, and safety planning. An inadequate communication modality should trigger a change in modality or escalation.

69. PEDIATRIC CARE

Because MDTelemed treats patients from birth onward, accessibility and language needs may involve the child, parent, guardian, or other legally authorized representative. The identity and legal authority of the decision-maker remain governed by and state law.

70. SENSITIVE SERVICES

Sexual health, reproductive health, behavioral health, STI/HIV, genetic, and other sensitive services require attention to interpreter neutrality, confidentiality, coercion, and the patient's lawful privacy rights.

71. ACCOMMODATION DOES NOT OVERRIDE CLINICAL SAFETY

An accommodation should facilitate access to safe care. If a requested modality cannot provide the information necessary for safe diagnosis or treatment, the physician may recommend another accessible modality or appropriate in-person evaluation.

72. NO DENIAL FOR ADMINISTRATIVE CONVENIENCE

Staff should not deny an accommodation merely because it takes longer, requires coordination, or differs from the ordinary workflow.

73. REASONABLE ADVANCE NOTICE

MDTelemed may request reasonable advance notice when time is needed to arrange an aid or service, but excessive notice requirements should not become a barrier. Unscheduled requests should be addressed to the extent possible.

74. URGENT CARE REQUESTS

An urgent patient should not be told to wait days for an accessibility response when a safe, lawful, effective accommodation can reasonably be arranged sooner. Emergency symptoms require emergency escalation.

75. ACCESSIBILITY REQUEST CHANNEL

Until a dedicated accessibility address is verified, patients may contact Support@MDTelemed.com. MDTelemed should establish a dedicated accessibility workflow before launch. The original Support@MDTelemed.com address is not represented here as active unless verified.

76. NO UNVERIFIED 3-5 DAY SLA

The original Policy promised a 3-5 business-day response. This replacement does not publish that deadline until staffing, escalation, weekends/holidays, urgent requests, and tracking are operationally verified.

77. ACCESSIBILITY REQUEST CONTENT

Patients should be able to state the barrier encountered, requested accommodation, preferred communication method, upcoming appointment timing, and contact information. MDTelemed should request only information reasonably necessary to address the accommodation.

78. NO UNNECESSARY MEDICAL PROOF

MDTelemed should not demand disability documentation when the need for an accommodation is obvious or when such documentation is not legally necessary. Any verification process must comply with applicable law.

79. ACCESSIBILITY COMPLAINTS

Patients may report an accessibility or discrimination concern without retaliation. Complaints should be routed to the appropriate compliance owner, investigated, documented, and resolved promptly.

80. NONRETALIATION

MDTelemed will not retaliate against a patient for requesting an accommodation, using an interpreter or relay service, reporting discrimination, filing a grievance, or contacting a government civil-rights agency.

81. FEDERAL COMPLAINT RIGHTS

Depending on the issue and applicable law, a patient may have the right to file a complaint with the U.S. Department of Justice, HHS Office for Civil Rights, or another federal agency. MDTelemed's internal process does not eliminate external complaint rights.

82. STATE COMPLAINT RIGHTS

State civil-rights, attorney general, medical board, health department, consumer-protection, or other agencies may also have jurisdiction.

83. DOCUMENTATION OF ACCOMMODATIONS

MDTelemed should document material accommodation requests, what was provided, timing, interpreter/vendor information where appropriate, communication effectiveness, refusals or alternatives, and clinically relevant limitations.

84. MINIMUM NECESSARY / PRIVACY

Accessibility documentation should not expose more health or disability information than necessary. Disability information can itself be sensitive.

85. TRAINING

Patient-facing staff and physicians should receive role-appropriate training on nondiscrimination, effective communication, relay calls, interpreter use, disability etiquette, language access, accommodation escalation, privacy, and emergency workflows.

86. PHYSICIAN TRAINING

Physicians should know how to pause an encounter when communication is inadequate, request interpreter/accessibility support, document the limitation, and escalate to another modality or in-person care.

87. SUPPORT TRAINING

Support personnel should not hang up on relay calls, refuse an interpreter, tell a patient to 'bring someone,' or route disability requests into ordinary technical support without appropriate escalation.

88. QUALITY ASSURANCE

MDTelemed should monitor accessibility complaints, failed accommodation requests, interpreter delays, inaccessible workflows, digital defects, and repeat barriers and use those findings for remediation.

89. ACCESSIBILITY TESTING

Testing should include automated scans and manual testing by qualified personnel. Automated tools alone cannot establish complete accessibility.

90. USER TESTING

Where practicable, MDTelemed should include people with disabilities and assistive-technology users in usability testing of critical patient journeys.

91. RELEASE TESTING

Material website/app releases affecting registration, consent, video, payment, messaging, records, or other patient functions should include accessibility regression testing.

92. REMEDIATION PRIORITY

Accessibility defects that block appointment access, clinical communication, informed consent, emergency instructions, payment, or medical records should receive priority over cosmetic defects.

93. ACCESSIBILITY STATEMENT

The website should contain a concise accessibility statement describing MDTelemed's commitment, how to request help, how to report a barrier, and available verified contact methods. It should not claim technical conformance that has not been tested.

94. ALTERNATIVE ACCESS

If a digital function is temporarily inaccessible, MDTelemed should provide an effective alternative method where required and feasible, without charging the patient for the accessibility failure.

95. RECORD OF POLICY VERSIONS

MDTelemed should retain prior versions of this Policy and accessibility statements so it can establish what representations were made at a particular time.

96. EMPLOYMENT SECTION SEPARATED

The original included employment Title I requirements. Those are important but should principally reside in an internal workforce Equal Employment Opportunity/ADA accommodation policy rather than a patient-facing policy. MDTelemed's employment obligations are not waived by their removal from the public patient document.

97. CONTRACTORS AND PHYSICIANS

MDTelemed should separately analyze whether physicians and other workers are employees or independent contractors and which employment/civil-rights laws apply. Labels alone do not determine legal status.

98. MARKETING

Advertising should not imply that persons with disabilities, older adults, non-English speakers, or other protected groups are unwelcome or categorically inappropriate for telemedicine.

99. ALGORITHMIC DISCRIMINATION

If MDTelemed later uses automated systems for scheduling, fraud detection, eligibility, risk scoring, or other patient decisions, it should test for unlawful discriminatory effects and provide appropriate human review.

100. AI TELESCRIBE

The AI telescribe is a documentation tool, not a patient-facing autonomous clinician. Its use should not interfere with interpreters, captions, accessibility aids, or accurate attribution of who communicated what.

101. INTERPRETER + AI WORKFLOW

When an interpreter participates, the documentation system should distinguish patient statements, interpreter-mediated communication, and physician statements as appropriate. MDTelemed should test whether audio/transcription workflows accurately handle interpreted encounters.

102. CLINICAL RECORD

The medical record should document clinically material communication limitations and accommodations without stigmatizing language.

103. NO GUARANTEE THAT TELEMEDICINE FITS EVERY ENCOUNTER

Nondiscrimination does not require a physician to provide remote care when the clinical problem cannot be safely evaluated remotely. The patient should be offered an appropriate accessible pathway rather than simply rejected because of disability.

104. POLICY CONFLICTS

If another MDTelemed policy conflicts with a controlling nondiscrimination or accessibility requirement, applicable law controls and MDTelemed should revise the conflicting policy.

105. CONTACT

MDTelemed LLC 304 S Jones Blvd #4872 Las Vegas, NV 89107 Current verified general contact: Support@MDTelemed.com

106. PATIENT-FACING ACCESSIBILITY SUMMARY

MDTelemed does not unlawfully discriminate in access to telemedicine services. Patients may request reasonable disability accommodations and effective communication. Required ADA auxiliary aids/services are not subject to a disability surcharge. MDTelemed will not require a patient with a disability to bring a personal interpreter when MDTelemed has the legal responsibility to provide effective communication. Qualified interpreters or other aids may be necessary for complex medical discussions. Patients and appropriate companions with communication disabilities may have effective-communication rights. Language assistance may be available or legally required depending on applicable law and MDTelemed's program status. An accommodation request does not guarantee that a clinically inadequate telemedicine modality must be used; MDTelemed should instead identify a safe accessible alternative. Patients may report discrimination or accessibility barriers without retaliation. Until a dedicated accessibility channel is verified, Support@MDTelemed.com is the contact listed in this Policy. Determine conclusively which MDTelemed entities/programs are subject to ADA Title III, Section 504, Section 1557, and state/local civil-rights laws. Recheck the current litigation/enforcement status of every material 2024 Section 1557 provision immediately before launch; do not rely on an obsolete summary. Adopt an internal digital-accessibility standard after counsel/engineering review; consider WCAG 2.2 AA as a technical target without falsely describing it as a universal statutory requirement. Conduct manual and automated accessibility testing of the complete production patient journey. Test with current screen readers on representative Windows, macOS, iOS/iPadOS, and Android combinations. Test keyboard-only operation, focus, labels, forms, errors, contrast, zoom/reflow, captions, authentication, payment, portal PDF access, and video controls. Verify actual availability and procurement of ASL/VRI, CART/live captioning, spoken-language interpreters, TRS/VRS acceptance, and other auxiliary aids. Establish a 24/7 or clinically appropriate escalation process for urgent accommodation requests consistent with the service's hours. Create and verify a dedicated accessibility contact address before publishing one; do not assume Support@MDTelemed.com exists. Set a response-time standard only after operational capacity is proven; remove the original unverified 3-5 business-day promise unless adopted. Create interpreter/vendor BAAs and privacy terms where required. Create an interpreter-access workflow inside the physician encounter interface. Test AI telescribe performance during interpreted, captioned, relay, accented, speech-impaired, and multilingual encounters. Determine whether the AI telescribe or any speech-recognition vendor creates differential accuracy/accessibility risks. Create alternate accessible medical-record formats and test the PDF portal workflow. Identify and translate legally required vital documents and language-assistance notices where applicable. Create state-specific nondiscrimination/language-access addenda where required. Create an internal employment EEO/ADA policy separate from this patient-facing . Train physicians and support staff before launch and document completion. Create an accessibility complaint and remediation log with severity, owner, due date, resolution, and recurrence analysis. Require accessibility due diligence in patient-facing vendor procurement and change control. Coordinate with Policies 04, 10, 11, 13, 15, 18, 21, 29, 31, 33, and 38. Have qualified ADA/civil-rights, health-care, Section 1557, language-access, digital-accessibility, and 50-state counsel review the production policy and implementation.

107. PRIMARY LEGAL & REGULATORY REFERENCES

Americans with Disabilities Act, Title III, 42 U.S.C. §§ 12181-12189.

108. C.F.R. Part 36, including § 36.302 (reasonable modifications) and § 36.303 (auxiliary aids and services/effective communication).

Rehabilitation Act of 1973 § 504, 29 U.S.C. § 794, where applicable. Affordable Care Act § 1557, 42 U.S.C. § 18116, and current implementing/enforceable regulations where applicable. U.S. Department of Justice, ADA Requirements: Effective Communication. U.S. Department of Justice, Guidance on Web Accessibility and the ADA. U.S. DOJ and HHS, Guidance on Nondiscrimination in Telehealth: Federal Protections to Ensure Accessibility to People with Disabilities and Limited English Proficient Persons. HHS Office for Civil Rights, current Section 1557 and language-access materials. Applicable state/local public-accommodation, disability, civil-rights, language-access, medical-practice, telehealth, and consumer-protection laws. Original MDTelemed Non-Discrimination & ADA Compliance — used as source material; unverified accessibility features, dedicated email, response SLA, and employment provisions were not retained as current patient-facing facts.

109. SOURCE LINKS

ADA.gov — Effective Communication: https://www.ada.gov/resources/effective-communication/ ADA.gov — Title III Regulations: https://www.ada.gov/law-and-regs/regulations/title-iii-regulations/ ADA.gov — Web Accessibility Guidance: https://www.ada.gov/resources/web-guidance/ HHS OCR — Section 1557: https://www.hhs.gov/civil-rights/for-individuals/section-1557/index.html HHS/DOJ — Nondiscrimination in Telehealth guidance: https://www.hhs.gov/civil-rights/for-individuals/disability/guidance-on-nondiscrimination-in-telehealth/index.html HHS OCR — Language Access: https://www.hhs.gov/civil-rights/for-individuals/special-topics/limited-english-proficiency/index.html

110. RELATED MDTelemed POLICIES

Telehealth Informed Consent; Data Security & Cybersecurity; Grievances & Complaints; System Requirements & Technical Compatibility; Medical Records Access, Amendment & Release; Continuity of Care; Third-Party Business Associates & BAAs; HIPAA Notice of Privacy Practices; State Privacy Rights Supplement; 50-State Minor Consent & Confidentiality Addendum; AI Telescribe, Audio Capture & Documentation Consent.

111. END OF

WEBSITE - MOBILE APP ACCESSIBILITY - WCAG

1. MDTELEMED LLC

2. WEBSITE, MOBILE APP & DIGITAL ACCESSIBILITY POLICY

Version 1.0 | September 15, 2026

National patient-facing digital-accessibility baseline. This Policy does NOT claim that MDTelemed's current website or app already conforms to WCAG 2.1 AA or WCAG 2.2 AA, has been certified by an accessibility specialist, has been tested with every named screen reader, or is checked after every deployment. Those were goals stated in the original draft but have not been independently verified. MDTelemed should publish a formal conformance claim only after the production digital experience is tested and the claim is supportable.

3. PURPOSE

This Policy establishes MDTelemed LLC's approach to accessibility of its website, mobile application, patient portal, telehealth interface, registration and scheduling flows, consent forms, payment interfaces, records, messages, videos, documents, and other digital content used by patients and consumers.

4. WHY A FALSE CONFORMANCE CLAIM IS RISKY

A WCAG conformance statement is a representation about an actual digital product, not a marketing aspiration. W3C does not certify claims; the content provider is responsible for the accuracy of a conformance statement. MDTelemed should therefore avoid claiming Level AA conformance until the complete production experience has undergone appropriate testing.

5. RELATIONSHIP TO

addresses nondiscrimination, disability accommodations, effective communication, and language access. focuses specifically on digital accessibility. The two policies should be implemented together.

6. APPLICABLE LEGAL FRAMEWORK

Digital-accessibility obligations may arise from the Americans with Disabilities Act, Section 504 of the Rehabilitation Act when MDTelemed or an applicable program receives HHS federal financial assistance, Section 1557 where applicable, state public-accommodation and civil-rights laws, consumer-protection laws, contractual obligations, and other requirements.

7. ADA TITLE III

The U.S. Department of Justice has explained that the ADA applies to goods, services, privileges, or activities offered by public accommodations and that inaccessible web content can create barriers to equal access. Whether a particular technical standard is required for a private entity can depend on the legal context.

8. SECTION 504 TECHNICAL STANDARD

HHS's 2024 Section 504 final rule requires covered recipients of HHS federal financial assistance, subject to regulatory exceptions and limitations, to make covered web content and mobile applications conform to WCAG 2.1 Level AA.

9. SECTION 504 DEADLINE EXTENSION

On May 7, 2026, HHS extended the Section 504 web and mobile accessibility compliance deadlines by one year. HHS states that recipients with 15 or more employees now have until May 11, 2027, and recipients with fewer than 15 employees until May 10, 2028. MDTelemed must verify whether it is a covered recipient and which deadline applies.

10. WCAG 2.2

W3C published WCAG 2.2 as a Recommendation in 2023 and updated it in December 2024. WCAG 2.2 adds success criteria to WCAG 2.1 and W3C encourages use of the latest WCAG 2 version.

11. WCAG 2.2 AS INTERNAL TARGET

Even when a law references WCAG 2.1 AA, MDTelemed may choose WCAG 2.2 AA as its internal engineering target because content that meets WCAG 2.2 also meets the earlier 2.1 requirements, subject to the applicable technical interpretation and exceptions.

12. NO AUTOMATIC WCAG 2.2 LEGAL CLAIM

MDTelemed should not state that WCAG 2.2 AA is the mandatory standard under every law. Section 504 currently references WCAG 2.1 AA, while other legal obligations may not specify a particular WCAG version.

13. FOUR WCAG PRINCIPLES

Accessible digital content should be perceivable, operable, understandable, and robust. These principles should guide design, engineering, testing, content production, and procurement.

14. ACCESSIBILITY BY DESIGN

Accessibility should be incorporated into product requirements, design systems, component libraries, development, content, testing, release management, procurement, and quality assurance rather than treated as a post-launch repair project.

15. COMPLETE PATIENT JOURNEY

Testing must include the entire patient journey, not merely the public homepage: marketing pages, registration, identity verification, account creation, login, appointment selection, intake, consent, telehealth joining, video/audio controls, chat, interpreter participation, prescriptions, laboratory/imaging orders where displayed, billing, membership, messages, medical-record downloads, complaints, account settings, cancellation, and sign-out.

16. WEBSITE AND APP

Accessibility applies to web content, mobile web, native mobile applications, and other digital interfaces MDTelemed provides or makes available, subject to applicable law.

17. THIRD-PARTY CONTENT AND TOOLS

Third-party payment, identity, video, chat, analytics, scheduling, pharmacy, laboratory, or other embedded components can create accessibility barriers. Outsourcing a function does not necessarily outsource MDTelemed's patient-access obligation.

18. ACCESSIBLE PROCUREMENT

Patient-facing technology procurement should require accessibility information, testing evidence, known-issue disclosure, remediation commitments, and cooperation with MDTelemed's accessibility program.

19. VPAT / ACR DOCUMENTATION

Where available, MDTelemed may request a Voluntary Product Accessibility Template or Accessibility Conformance Report from vendors. Such documents are evidence, not proof; MDTelemed should test critical integrations itself.

20. CONFORMANCE CLAIMS

If MDTelemed publishes a WCAG conformance claim, it should identify the version, level, scope, date, pages/apps included, known exclusions or exceptions, testing methodology, and whether the claim covers third-party embedded content.

21. NO 'CERTIFIED ACCESSIBLE' WITHOUT BASIS

The original policy referred to a 'WCAG 2.1 certified specialist.' WCAG itself does not create one universal official W3C certification of individuals or websites. MDTelemed should describe actual qualifications and testing performed rather than imply a nonexistent W3C certification.

22. COLOR CONTRAST

WCAG 2.1/2.2 Level AA generally requires a contrast ratio of at least 4.5:1 for normal text and at least 3:1 for large-scale text, subject to listed exceptions. MDTelemed should test actual styles rather than rely on a single example such as black text on white.

23. LARGE TEXT DEFINITION

WCAG's large-scale text threshold is not simply '14pt+'. The applicable threshold depends on font size and weight. Production designers should use the standard's actual CSS/pixel-equivalent criteria.

24. NON-TEXT CONTRAST

Interface components and meaningful graphical objects can require minimum contrast against adjacent colors. Buttons, form borders, focus indicators, charts, icons, and status states should be included in testing.

25. COLOR NOT SOLE MEANS

Required fields, errors, warnings, medication alerts, selected states, test-result status, and other information should not be communicated by color alone.

26. TEXT RESIZE

Text should remain usable when resized as required by the adopted standard without loss of content or functionality, except where an exception legitimately applies.

27. REFLOW

Responsive interfaces should support reflow and zoom without requiring unnecessary two-dimensional scrolling for ordinary text content under the applicable WCAG success criteria.

28. IMAGES OF TEXT

MDTelemed should avoid using images of text where actual text can provide the same presentation, subject to recognized exceptions.

29. ALT TEXT

Informative images should have text alternatives conveying equivalent purpose. Decorative images should be ignored by assistive technology where appropriate.

30. COMPLEX IMAGES

Charts, diagrams, infographics, and clinically meaningful images may require more detailed text alternatives or adjacent descriptions than a short alt attribute can provide.

31. MEDICAL IMAGES

Patient-submitted clinical photographs are not ordinary decorative web content. Their accessibility, confidentiality, and clinical use should be handled according to the care workflow rather than altered in ways that compromise diagnostic integrity.

32. HEADINGS

Pages should use semantic headings in a logical hierarchy so screen-reader and keyboard users can navigate efficiently.

33. LANDMARKS

Appropriate HTML landmarks such as main, nav, header, footer, and complementary regions can improve navigation when used correctly.

34. PAGE TITLES

Each page or screen should have an informative title or equivalent identifying context, especially within multi-step clinical and administrative workflows.

35. LINK PURPOSE

Links should communicate meaningful purpose from their text or programmatic context. Repeated ambiguous links such as 'click here' should be avoided.

36. SKIP LINKS

Long pages should provide efficient keyboard/screen-reader navigation to bypass repeated content where required by the adopted standard.

37. KEYBOARD OPERABILITY

All core functionality should be operable through a keyboard interface without requiring specific timing for individual keystrokes, except where a function fundamentally depends on a path-based input and an exception applies.

38. NO KEYBOARD TRAPS

Keyboard focus should not become trapped in dialogs, video controls, date pickers, chat widgets, cookie banners, modals, or third-party components.

39. VISIBLE FOCUS

Keyboard users should be able to identify which element currently has focus. Focus indicators should not be removed merely for visual aesthetics.

40. FOCUS ORDER

Focus should move in an order that preserves meaning and operability, particularly in intake forms, consent, appointment booking, payment, and telehealth controls.

41. WCAG 2.2 FOCUS NOT OBSCURED

WCAG 2.2 adds Level AA requirements addressing focus not being fully obscured by author-created content. Sticky headers, cookie banners, chat launchers, and modal overlays should not hide the active control.

42. DRAGGING MOVEMENTS

WCAG 2.2 adds a Level AA success criterion requiring a single-pointer alternative to dragging movements where dragging is used and no exception applies.

43. TARGET SIZE

WCAG 2.2 includes a Level AA minimum target-size requirement, with exceptions. Small icons for close, camera, microphone, chat, calendar, and prescription actions should be tested.

44. POINTER GESTURES

Multipoint or path-based gestures should have simpler alternatives where required. Mobile interfaces should not rely solely on complex swipes, pinches, or drags.

45. MOTION ACTUATION

Features activated by device motion should have conventional interface alternatives where applicable.

46. SCREEN READERS

MDTelemed should test critical flows with representative screen readers. The original draft named NVDA, JAWS, VoiceOver, and TalkBack; these remain appropriate examples, but public claims should reflect tests actually performed.

47. SCREEN-READER TEST MATRIX

The engineering program should define representative browser/assistive-technology combinations based on actual patient platforms, such as NVDA with Chrome/Firefox, JAWS with Chrome/Edge, VoiceOver with Safari on macOS/iOS, and TalkBack with Chrome on Android.

48. ACCESSIBLE NAMES

Buttons, icons, links, form controls, tabs, toggles, dialogs, and video controls need meaningful accessible names that match or sensibly correspond to visible labels.

49. NAME ROLE VALUE

Custom controls must expose the appropriate accessible name, role, state, and value to assistive technologies.

50. STATUS MESSAGES

Success, error, waiting-room, upload progress, prescription status, payment confirmation, and similar messages should be programmatically exposed without forcing focus changes when WCAG requires it.

51. FORMS

Inputs should have programmatic labels, instructions, required-field indicators, and clear groupings. Placeholder text should not be the sole label.

52. ERROR IDENTIFICATION

Errors should be identified in text and associated with the relevant field. 'Red border only' is inadequate.

53. ERROR SUGGESTIONS

When MDTelemed can identify a correction, the interface should provide useful suggestions unless doing so would compromise security or purpose.

54. ERROR PREVENTION

For legally or financially significant submissions, or where data can be changed or deleted, the interface should provide review, confirmation, reversibility, or another WCAG-compliant error-prevention mechanism when required.

55. CONSISTENT HELP

WCAG 2.2 adds requirements concerning consistent placement of help mechanisms when such mechanisms repeat across pages.

56. REDUNDANT ENTRY

WCAG 2.2 includes a success criterion reducing unnecessary re-entry of information already provided in the same process, subject to exceptions. This can be especially important for patients with cognitive, motor, and memory disabilities.

57. ACCESSIBLE AUTHENTICATION

WCAG 2.2 adds Level AA accessible-authentication requirements intended to reduce reliance on cognitive function tests without alternatives. Login, password reset, one-time codes, CAPTCHA, and identity verification should be reviewed accordingly.

58. CAPTCHA

If CAPTCHA or bot prevention is used, MDTelemed should provide accessible alternatives and avoid making patients solve an inaccessible challenge to obtain health care.

59. MULTIFACTOR AUTHENTICATION

MFA should support accessible methods and not rely solely on interactions that a patient with a disability cannot perform.

60. IDENTITY VERIFICATION

Identity-proofing vendors can create facial-recognition, document-upload, camera, motor, cognitive, or vision barriers. The workflow should include an accessible alternative where legally and operationally appropriate.

61. TIME LIMITS

Session timeouts may be necessary for security. Where WCAG requires, users should receive warning and an opportunity to extend, adjust, or disable time limits unless an exception applies.

62. NO FALSE 'NO AUTO-TIMEOUT' PROMISE

The original Policy promised extended time with 'no auto-timeout.' That may conflict with privacy/security requirements. MDTelemed should instead design accessible timeout controls consistent with both WCAG and security risk.

63. MOVING, BLINKING OR AUTO-UPDATING CONTENT

Users should be able to pause, stop, hide, or control moving or auto-updating content when required. Waiting-room timers, carousels, promotional banners, and live status content must be reviewed.

64. FLASHING CONTENT

MDTelemed should avoid content that flashes at frequencies or thresholds associated with seizure risk under WCAG.

65. AUDIO CONTROL

Audio that starts automatically and continues beyond the WCAG threshold must provide appropriate control. MDTelemed should generally avoid unexpected autoplay audio.

66. PRERECORDED VIDEO

Prerecorded video with meaningful audio should include captions where required. Audio-only content should have transcripts where required.

67. AUDIO DESCRIPTION

Prerecorded video may require audio description or an equivalent alternative for meaningful visual information under applicable success criteria.

68. LIVE VIDEO

Live telemedicine is fundamentally interactive content rather than ordinary prerecorded media. Accessibility should focus on interpreter participation, captions when required/effective, accessible controls, chat, keyboard operation, device access, and effective communication.

69. LIVE CAPTIONING

Automated captions can be helpful but may not satisfy effective-communication obligations for a complex medical encounter when accuracy is inadequate. governs the legal communication accommodation.

70. SIGN-LANGUAGE INTERPRETER PARTICIPATION

The telehealth platform should support addition of a qualified sign-language interpreter or other necessary participant where required. HHS has specifically identified telehealth systems that cannot accommodate interpreters as an accessibility concern.

71. CHAT ACCESSIBILITY

Chat should be keyboard and screen-reader accessible, announce new messages appropriately, identify speakers, and not require rapid timed responses without accommodation.

72. FILE UPLOADS

Patients should be able to upload required documents or images through an accessible interface. Drag-and-drop should not be the only method.

73. DOWNLOADS

Download links should identify the document and format. If a downloadable document is required for a patient's care or rights, the document itself should be accessible or an effective alternative provided.

74. PDF ACCESSIBILITY

Policy PDFs, consent forms, Good Faith Estimates, privacy notices, medical records, invoices, and other important PDFs should be tagged and structured appropriately when PDF is used as the delivery format.

75. MEDICAL RECORD PDF

MDTelemed has confirmed PDF as its intended patient-record download format. The production workflow should support accessible PDF generation or provide an effective alternative format for patients who cannot use the standard PDF.

76. TABLES

Data tables should use proper headers and relationships so screen readers can understand rows and columns. Layout tables should not be used in ways that create confusing reading order.

77. DATA VISUALIZATIONS

Graphs and dashboards should provide accessible labels, summaries, table alternatives, or another equivalent method for communicating clinically meaningful values.

78. ICONS

Icons such as microphone, camera, lock, download, calendar, pharmacy, notification, and menu controls need accessible names and sufficient visual distinction.

79. TOUCH TARGETS

Mobile touch targets should be large enough and sufficiently separated to reduce accidental activation, including critical clinical controls.

80. ORIENTATION

Content should generally not restrict operation to a single display orientation unless a specific orientation is essential.

81. RESPONSIVE DESIGN

Accessibility testing should cover mobile, tablet, desktop, portrait/landscape where applicable, zoom, magnification, browser text scaling, and OS-level accessibility settings.

82. LANGUAGE OF PAGE

Pages should identify the default human language programmatically so screen readers can apply correct pronunciation rules.

83. LANGUAGE CHANGES

Passages in another language should identify that language programmatically when required.

84. PLAIN LANGUAGE

WCAG does not make every plain-language technique a Level AA requirement, but clear, concise language is particularly important for health, consent, medication, emergency, billing, and privacy content.

85. COGNITIVE ACCESSIBILITY

MDTelemed should reduce unnecessary complexity, maintain consistent navigation, avoid deceptive or confusing controls, and provide clear instructions. WCAG does not address every need of people with cognitive disabilities, so usability review should go beyond checklist compliance.

86. CONSISTENT NAVIGATION

Navigation mechanisms repeated across pages should appear in a consistent relative order unless the user initiates a change.

87. CONSISTENT IDENTIFICATION

Components performing the same function should be identified consistently across the platform.

88. CHANGE ON FOCUS

Simply moving focus to a component should not unexpectedly trigger a material context change unless the user has been advised appropriately.

89. CHANGE ON INPUT

Changing a form value should not unexpectedly cause navigation, submission, payment, or another significant context change without warning.

90. MODALS AND DIALOGS

Dialogs should move focus appropriately when opened, trap focus only while active, provide an accessible name, allow predictable closing, and return focus sensibly.

91. COOKIE BANNERS

Cookie/consent interfaces must themselves be accessible. Users should be able to reject or manage optional tracking with keyboard and assistive technology as easily as they can accept it.

92. PRIVACY CHOICES

Privacy request, opt-out, consent withdrawal, and Do Not Sell/Share controls should be accessible. A disabled patient should not receive fewer privacy choices because the preference center is inaccessible.

93. PAYMENT

Checkout and payment workflows should be accessible, including card fields, hosted payment frames, error messages, address entry, authentication, confirmation, and cancellation.

94. MEMBERSHIP CANCELLATION

If membership can be purchased online, cancellation controls should not be less accessible than enrollment. governs automatic-renewal requirements.

95. APPOINTMENT SCHEDULING

Calendar widgets, date/time controls, filters, availability grids, and appointment confirmation should be usable with screen readers, keyboard input, magnification, and common mobile accessibility settings.

96. INTAKE QUESTIONNAIRES

Long questionnaires should use clear sections, headings, progress information, accessible error handling, save/resume where operationally appropriate, and avoid unnecessary re-entry.

97. CONSENT FORMS

Electronic informed-consent forms must allow users to read, navigate, understand, sign/acknowledge, and retain required information accessibly.

98. EMERGENCY CONTENT

Emergency warnings and crisis resources should be highly perceivable, accessible to assistive technology, and not depend solely on color, imagery, sound, or mouse interaction.

99. ACCESSIBILITY OF CONTACT INFORMATION

Telephone numbers, email addresses, mailing addresses, and support options should be presented in accessible text. A contact method that itself depends on inaccessible interaction is not sufficient.

100. ACCESSIBILITY STATEMENT

MDTelemed should publish a concise accessibility statement identifying its commitment, current technical target after approved, how to request assistance, how to report a barrier, and verified contact information.

101. NO DEDICATED EMAIL UNTIL VERIFIED

The original policy listed Support@MDTelemed.com. Until that address is created, monitored, secured, and integrated into the complaint workflow, the verified contact remains Support@MDTelemed.com.

102. RESPONSE TIME

The original five-day response commitment is removed as an unverified SLA. MDTelemed should establish risk-based response targets that prioritize barriers preventing access to urgent health care, consent, appointments, records, or billing.

103. ACCESSIBILITY BUG SEVERITY

Blocking defects affecting appointment access, telehealth entry, interpreter use, informed consent, emergency information, medical records, or payment should be treated as high priority. Cosmetic issues should not displace patient-safety barriers.

104. ACCESSIBILITY INCIDENT RESPONSE

If a production release creates a material barrier, MDTelemed should investigate, provide an effective alternative where required, remediate, test, and communicate as appropriate.

105. ACCESSIBILITY COMPLAINTS

Patients may report a barrier without retaliation under and . The complaint process should capture the affected page/screen, device, browser, assistive technology, action attempted, impact, urgency, and preferred contact method when provided.

106. AUTOMATED TESTING

Automated testing tools such as axe, WAVE, Lighthouse, or other scanners can identify many accessibility defects but cannot establish full WCAG conformance by themselves.

107. MANUAL TESTING

Manual testing is necessary for keyboard interaction, focus management, semantic meaning, screen-reader usability, error recovery, complex widgets, video workflows, cognitive usability, and other issues automated tools cannot reliably assess.

108. SCREEN-READER TESTING

Critical patient flows should be manually tested using a defined screen-reader/browser/device matrix. Results should be documented and retested after material changes.

109. MOBILE ASSISTIVE-TECHNOLOGY TESTING

Testing should include VoiceOver and TalkBack on supported mobile devices if those platforms are offered.

110. MAGNIFICATION AND LOW-VISION TESTING

Testing should include zoom, text resizing, browser magnification, high-contrast settings, OS display scaling, and other relevant low-vision configurations.

111. VOICE INPUT AND SWITCH ACCESS

Critical flows should be tested with representative voice-control and switch-access technologies where feasible and material to supported platforms.

112. EVERY DEPLOYMENT CLAIM REMOVED

The original policy promised automated checks on every deployment. That is an excellent engineering objective but should not be published until the CI/CD pipeline actually enforces it and failures block or flag releases as intended.

113. CONTINUOUS INTEGRATION

MDTelemed should integrate accessibility linting/static analysis and automated browser testing into CI/CD for reusable components and critical flows where technically feasible.

114. DESIGN SYSTEM

Reusable components should have documented accessibility behavior and be centrally maintained so fixes propagate across the product.

115. COMPONENT TESTING

Buttons, inputs, dropdowns, tabs, modals, tables, date pickers, menus, tooltips, toasts, accordions, file uploads, and video controls should have repeatable accessibility tests.

116. QUARTERLY AUDIT CLAIM REMOVED

The original policy promised quarterly manual audits by a specialist. MDTelemed should choose an audit cadence based on release frequency, risk, legal obligations, and available qualified resources rather than publishing a schedule before it exists.

117. INDEPENDENT AUDIT

Periodic independent review can add value, particularly before launch and after major redesigns. The auditor's scope and methodology should be documented.

118. REMEDIATION TRACKING

Accessibility defects should be entered into a tracked remediation system with severity, owner, due date, environment, affected users, legal/clinical impact, fix, validation, and closure evidence.

119. REGRESSION TESTING

Resolved accessibility defects should be added to regression testing where practical so the same barrier is not repeatedly reintroduced.

120. KNOWN ISSUES

Where a significant issue cannot be immediately fixed, MDTelemed should assess whether an accessible alternative, notice, workaround, feature restriction, or expedited remediation is necessary.

121. CONFORMING ALTERNATE VERSIONS

Under the HHS Section 504 rule, conforming alternate versions are allowed only in specified circumstances when direct accessibility is not possible due to technical or legal limitations and regulatory conditions are met. A telephone number should not be treated as a universal substitute for an accessible digital experience.

122. EQUIVALENT FACILITATION

HHS's Section 504 rule permits alternate designs, methods, or techniques that provide substantially equivalent or greater accessibility and usability. MDTelemed should document any reliance on equivalent facilitation.

123. SECTION 504 EXCEPTIONS

HHS's rule contains limited exceptions for categories such as certain archived web content, certain preexisting conventional electronic documents, certain third-party content, and certain social media content. Each exception has conditions and should not be overgeneralized.

124. MINIMAL-IMPACT NONCONFORMANCE

HHS's Section 504 rule includes a narrow provision for nonconformance having minimal impact on access. MDTelemed should not use this as a general excuse for unresolved defects.

125. SOCIAL MEDIA

MDTelemed should make its own social-media posts accessible to the extent required, including meaningful image descriptions and captions where appropriate. The company does not control whether an external social-media platform itself is fully accessible.

126. KIOSKS

If MDTelemed later deploys kiosks or other physical digital interfaces, kiosk accessibility requires separate technical and legal review. A website policy alone is insufficient.

127. SUPPORT PERSONNEL

Technical support should be trained to identify an accessibility barrier rather than repeatedly asking a patient to retry an interaction that cannot work with the patient's assistive technology.

128. DEVELOPMENT TRAINING

Designers, developers, QA engineers, product managers, content writers, and marketers should receive role-appropriate accessibility training.

129. CLINICAL TEAM TRAINING

Physicians should know how to respond when a digital barrier affects history-taking, informed consent, communication, or safe participation in the encounter.

130. CHANGE MANAGEMENT

Material changes to authentication, scheduling, payments, video, records, chat, forms, navigation, design systems, or embedded vendors should trigger accessibility review.

131. MERGERS AND NEW VENDORS

Acquisitions, platform migrations, white-label technology, or new patient-facing vendors require accessibility due diligence before rollout.

132. ANALYTICS

Accessibility analytics may help identify device or flow problems but should not be used to infer disability status unnecessarily. Privacy rules continue to apply.

133. PRIVACY OF ACCESSIBILITY DATA

Information that reveals a disability, assistive technology, accommodation, or accessibility complaint can be sensitive. MDTelemed should limit access and collection to legitimate purposes.

134. AI-GENERATED CONTENT

AI-generated website text, images, alt text, captions, summaries, or code must be reviewed before publication. Automated generation can create inaccurate descriptions or inaccessible markup.

135. AI TELE-SCRIBE INTERFACE

The physician-facing AI telescribe interface should also be accessible to workforce members as required by applicable employment law, but that internal workforce obligation is separate from the patient-facing scope of this Policy.

136. DOCUMENT RETENTION

Accessibility audit reports, complaints, remediation records, conformance claims, training records, vendor documentation, and significant testing evidence should be retained under an approved schedule.

137. NO RETALIATION

MDTelemed will not retaliate against a patient for reporting an accessibility problem, requesting an accommodation, filing a complaint, or exercising disability rights.

138. NO SURCHARGE

MDTelemed will not charge a person with a disability an additional fee for accessibility measures that applicable law requires MDTelemed to provide.

139. CLINICAL LIMITATIONS

Digital accessibility does not mean every medical condition can be safely treated online. If a remote examination remains clinically inadequate even after accessibility barriers are addressed, the physician may require in-person or higher-level care.

140. ALTERNATE ACCESS DURING OUTAGE

A technical outage affecting accessibility should trigger clinically appropriate alternate access where feasible; patients with emergencies should use emergency services rather than await restoration.

141. VERSIONING

MDTelemed should date and version this Policy and any public conformance statement so the company can identify which representation applied at a given time.

142. CONTACT

MDTelemed LLC 304 S Jones Blvd #4872 Las Vegas, NV 89107 Current verified accessibility / business administration contact: Support@MDTelemed.com Adopt a formal internal accessibility target; strongly consider WCAG 2.2 Level AA while preserving legal mapping to WCAG 2.1 AA where a regulation specifically requires 2.1. Determine whether MDTelemed or any clinical entity receives HHS federal financial assistance and is subject to the Section 504 web/mobile technical standard. Confirm the correct Section 504 compliance deadline under HHS's May 7, 2026 interim final rule. Recheck Section 1557 litigation and enforceable requirements immediately before launch. Perform a complete automated and manual audit of all public pages and authenticated patient flows. Test the exact production platform, not staging mockups alone. Test representative browser/screen-reader combinations: NVDA, JAWS, VoiceOver and TalkBack where those platforms are supported. Test keyboard-only operation, switch access where feasible, voice control, zoom/reflow, text resizing, high-contrast/forced-colors behavior, focus, forms, authentication, CAPTCHA, payment, scheduling, video, chat and records. Test WCAG 2.2 additions including focus not obscured, dragging movements, target size, consistent help, redundant entry and accessible authentication. Audit every third-party embedded patient-facing tool and require remediation or an accessible alternative for material barriers. Create tagged accessible templates for policies, notices, consents, Good Faith Estimates, billing documents and medical-record PDFs. Create an accessibility test gate in CI/CD and define whether failures warn or block release. Build an accessible design system and component test suite. Create an accessibility bug taxonomy and severity/SLA framework based on clinical and legal impact. Establish an independent accessibility audit cadence after launch. Create and verify a dedicated accessibility email only after the mailbox is active, monitored and integrated into the complaint workflow. Do not publish a five-day response promise unless operationally supported. Create an accessibility statement that accurately describes the target, current limitations, help channel and complaint process. Create an accessible alternate-access plan for temporary defects. Train support, product, engineering, QA, content and clinical teams. Create retention procedures for audit evidence and remediation records. Coordinate with Policies 10, 11, 13, 15, 16, 21, 24, 29, 31, 33, 36 and 38. Have qualified digital-accessibility/ADA, health-care, Section 504/1557 and 50-state counsel review the final production policy and conformance statement.

143. PRIMARY REFERENCES

Americans with Disabilities Act, Title III, 42 U.S.C. §§ 12181-12189 and 28 C.F.R. Part 36. U.S. Department of Justice, Guidance on Web Accessibility and the ADA. HHS, Nondiscrimination on the Basis of Disability in Programs or Activities Receiving Federal Financial Assistance, Section 504 Final Rule, 45 C.F.R. Part 84. HHS, May 7, 2026 Interim Final Rule extending Section 504 web/mobile accessibility compliance deadlines. HHS Section 504 rule provisions governing web content, mobile applications, exceptions, conforming alternate versions, equivalent facilitation and minimal-impact nonconformance. Web Content Accessibility Guidelines (WCAG) 2.1 and WCAG 2.2, W3C Web Accessibility Initiative. W3C WCAG 2 Overview and What's New in WCAG 2.2. Applicable state and local public-accommodation, disability, consumer-protection, telehealth and civil-rights laws. Original MDTelemed Website Accessibility & WCAG 2.1 AA Compliance - used as source material; its existing-conformance claim, testing assertions, audit cadence, dedicated email and five-day SLA were not retained as verified facts.

144. SOURCE LINKS

DOJ Web Accessibility Guidance: https://www.ada.gov/resources/web-guidance/ ADA Title III Regulations: https://www.ada.gov/law-and-regs/regulations/title-iii-regulations/ HHS Section 504: https://www.hhs.gov/civil-rights/for-individuals/disability/section-504-rehabilitation-act-of-1973/index.html HHS May 7, 2026 deadline extension: https://www.hhs.gov/press-room/hhs-extends-mobile-and-web-accessibility-deadline.html W3C WCAG Overview: https://www.w3.org/WAI/standards-guidelines/wcag/ W3C WCAG 2.2: https://www.w3.org/TR/WCAG22/ W3C What's New in WCAG 2.2: https://www.w3.org/WAI/standards-guidelines/wcag/new-in-22/

145. RELATED MDTelemed POLICIES

Data Security & Cybersecurity; Grievances & Complaints; System Requirements & Technical Compatibility; Medical Records Access, Amendment & Release; Cookie, Tracking Technology & Analytics; Third-Party Business Associates & BAAs; Nondiscrimination, Disability Accessibility & Language Access; HIPAA Notice of Privacy Practices; State Privacy Rights Supplement; Minor Consent & Confidentiality; Membership & Automatic Renewal; AI Telescribe, Audio Capture & Documentation Consent.

146. END OF

GOOD FAITH ESTIMATE - NO SURPRISES - SELF-PAY PATIENT RIGHTS

Good Faith Estimate / No Surprises / Self-Pay Patient Rights

Version 1.0 | Effective September 16, 2026

1. Policy Statement

MDTelemed adopts this policy to establish a consistent, patient-centered and legally compliant framework for good faith estimate / no surprises / self-pay patient rights. This policy must be implemented together with applicable federal law, the law of the patient's physical location, professional standards, and MDTelemed's other clinical and privacy policies.

2. Purpose

This policy addresses federal Good Faith Estimate obligations for uninsured or self-pay patients and related patient-provider dispute rights.

3. Eligibility

When applicable, uninsured or self-pay individuals who schedule care sufficiently in advance or request an estimate must receive a Good Faith Estimate of expected charges within the required timeframe.

4. Content

The estimate should identify the expected items/services and charges required by applicable rules and should not be represented as a guarantee when unanticipated care may be needed.

5. Dispute Rights

Patients should receive required information about the federal patient-provider dispute resolution process when a billed amount substantially exceeds the Good Faith Estimate.

6. Emergency Care

Good Faith Estimate requirements differ for emergency care and should not delay emergency evaluation.

7. Roles and Responsibilities

MDTelemed management is responsible for operational implementation and periodic review. Clinicians remain responsible for independent professional judgment and documentation. Workforce members must follow role-based access, confidentiality, escalation, and incident-reporting requirements. Material conflicts between this policy and controlling law must be escalated to compliance/legal review before the affected workflow is used.

8. Training and Monitoring

Affected personnel should receive role-appropriate training. MDTelemed may audit compliance, investigate deviations, and implement corrective action when needed.

9. Exceptions

No exception may waive a mandatory legal or patient-safety requirement. Operational exceptions should be documented and approved by an authorized leader when appropriate.

10. Primary Regulatory / Guidance References

U.S. Department of Health and Human Services, HIPAA Privacy, Security and Breach Notification Rules, 45 C.F.R. Parts 160 and 164. HHS Telehealth guidance regarding HIPAA and remote communication technologies. Applicable state medical-practice, telehealth, privacy, recording, consumer-protection and professional-licensure laws. Centers for Medicare & Medicaid Services, Good Faith Estimate and patient-provider dispute resolution guidance under the No Surprises Act.

PAYMENT - BILLING - MEMBERSHIP - AUTO-RENEWAL

1. MDTELEMED LLC

2. PAYMENT, BILLING, MEMBERSHIP & AUTO-RENEWAL POLICY

Version 1.0 | September 15, 2026

Patient-facing national baseline. Current prices, membership features, promotions, and payment methods are shown in the applicable checkout or pricing page and may change. State-specific automatic-renewal, cancellation, consumer-protection, and health-care billing laws control where more protective.

3. PURPOSE

This Policy explains how MDTelemed LLC charges for self-pay telemedicine services, how patients are informed of prices before purchase, how memberships and recurring billing work, how cancellation and refunds are handled, what happens when a payment fails or is disputed, and the rights of uninsured or self-pay patients under applicable federal and state law. MDTelemed is launching as a cash/self-pay service. This Policy therefore does not promise insurance participation, Medicare or Medicaid billing, or reimbursement.

4. IMPORTANT CORRECTIONS TO THE ORIGINAL POLICY

Those statements are not carried forward as facts because MDTelemed has confirmed that launch is self-pay, pricing should be taken from the website because it may change, and the technical/payment infrastructure has not been independently verified. Version 1.0 therefore requires clear checkout disclosures without inventing prices, processor certifications, payment methods, refund timelines, or insurance relationships.

5. CURRENT PRICING

The price applicable to a service is the price displayed to the patient in the MDTelemed website, application, scheduling flow, membership enrollment page, or checkout interface before the patient authorizes payment. Because prices and service configurations may change, this Policy does not hard-code dollar amounts. MDTelemed should preserve the version of the price and material terms presented at the time of purchase so a later billing dispute can be evaluated accurately. No hidden mandatory fee should be added after the patient authorizes payment unless the patient affirmatively agrees or law permits it. Taxes, third-party laboratory charges, imaging charges, pharmacy costs, or other external charges should be identified separately when known and when MDTelemed is not the entity charging them. A displayed starting price should not be used if material circumstances routinely make the actual price higher without clear disclosure.

6. SELF-PAY STATUS

MDTelemed is launching on a self-pay basis. Payment to MDTelemed is for MDTelemed services identified at checkout. A patient's separate health insurance coverage does not mean MDTelemed will submit a claim. If MDTelemed later becomes participating or nonparticipating with insurers, Medicare, Medicaid, employer plans, or other payors, this Policy must be revised before those billing representations are made.

7. PRICE DISCLOSURE BEFORE PAYMENT

Before charging a patient, MDTelemed should clearly disclose the material financial terms applicable to the transaction, including the amount or method for determining the amount, whether the charge is one-time or recurring, what the patient receives, and material cancellation/refund restrictions. For memberships, recurring terms must be presented before billing information is submitted and before enrollment is completed.

8. PAYMENT AUTHORIZATION

By affirmatively completing checkout, the patient authorizes MDTelemed and its payment service providers to charge the selected payment method for the amount and transaction disclosed at checkout. For a recurring membership, authorization must specifically cover recurring charges. Agreement to a one-time visit is not treated as consent to a recurring membership. MDTelemed should retain reliable electronic evidence of the transaction, including material terms, amount, date/time, and affirmative authorization.

9. PAYMENT METHODS

MDTelemed may accept payment methods displayed at checkout. This Policy does not promise acceptance of Visa, Mastercard, American Express, Discover, ACH, Apple Pay, Google Pay, HSA, FSA, or any other particular method until the payment configuration is verified. A payment method may be unavailable because of processor, issuer, jurisdiction, fraud-prevention, technical, or account restrictions.

10. PAYMENT PROCESSOR AND CARD INFORMATION

MDTelemed may use one or more third-party payment processors. The public policy should identify material payment-data practices accurately once the processor architecture is confirmed. The original policy's statements that MDTelemed uses a PCI DSS Level 1 processor and that cards are never stored on MDTelemed servers were technical assertions that have not yet been verified. fileciteturn6file0 They are intentionally omitted as promises. MDTelemed should not describe encryption, tokenization, PCI certification, card-storage architecture, or security controls in public materials until verified by the technical team and relevant vendor documentation.

11. HSA AND FSA PAYMENTS

Telemedicine can constitute a medical expense eligible for payment from an HSA or FSA when the applicable tax and plan requirements are satisfied. However, MDTelemed does not provide tax advice and does not guarantee that a particular charge is eligible for reimbursement from a patient's HSA, FSA, HRA, or other tax-advantaged arrangement. The patient is responsible for confirming eligibility with the plan administrator or tax adviser. IRS rules governing HSA eligibility and remote care have changed over time and should not be reduced to a blanket guarantee.

12. WHEN PAYMENT IS COLLECTED

The scheduling or checkout flow should state whether payment is collected when the visit is booked, immediately before the encounter, when the encounter begins, after completion, or under another verified arrangement.

Version 1.0 does not repeat the original statement that every payment is necessarily collected before every consultation because the production workflow has not been independently verified.

13. MEMBERSHIP OPTION

MDTelemed intends to offer an optional membership available across its supported jurisdictions, subject to applicable law. The membership terms shown at enrollment should specify: Membership price and billing interval. Whether the membership automatically renews. Services or benefits included. Any visit, service, usage, or eligibility limits. Excluded services. How to cancel. When cancellation becomes effective. Whether unused benefits carry over. Refund policy. How price or material term changes will be communicated. MDTelemed should not use the word 'unlimited' unless the service is genuinely unlimited under clearly disclosed conditions and operational capacity supports the representation.

14. MEMBERSHIP IS NOT HEALTH INSURANCE

An MDTelemed membership is not health insurance, a health plan, or a guarantee that all health-care needs will be covered. It does not replace emergency services, hospitalization, specialist care, laboratory services, imaging, pharmacy costs, or other health-care coverage unless expressly stated. Patients should not cancel health insurance based solely on enrollment in an MDTelemed membership.

15. AUTOMATIC RENEWAL

If a patient selects an automatically renewing membership, MDTelemed may charge the authorized payment method at each disclosed renewal interval until the patient cancels, subject to applicable law. Before enrollment, the automatic-renewal feature, amount or pricing method, billing frequency, cancellation method, and material terms must be clear and conspicuous. The patient's affirmative consent to recurring billing should be captured separately enough to demonstrate informed agreement.

16. FEDERAL NEGATIVE-OPTION PRINCIPLES

Recurring subscriptions are a form of negative-option marketing because charges continue until the consumer takes action to cancel. Federal consumer-protection law prohibits deceptive or unfair enrollment and billing practices. As of September 2026, MDTelemed should not rely on outdated descriptions of the FTC's 2024 'Click-to-Cancel' rule as though every provision remains an operative nationwide rule. The FTC is again reviewing the Negative Option Rule in 2026. MDTelemed should instead comply with currently effective federal law, including applicable FTC Act and Restore Online Shoppers' Confidence Act requirements, while also meeting state automatic-renewal laws. Regardless of regulatory changes, MDTelemed's operational standard should be straightforward: disclose recurring terms before enrollment, obtain affirmative consent, do not misrepresent the offer, and provide a simple cancellation mechanism.

17. ONLINE ENROLLMENT AND ONLINE CANCELLATION

When a patient enrolls in a membership online, MDTelemed should provide an online cancellation mechanism that is easy to locate and use, subject to the specific requirements of applicable state law. MDTelemed should not require a patient who enrolled online to navigate unnecessary retention calls, repeated screens, or materially more burdensome steps merely to stop future recurring charges. A cancellation confirmation should be provided or made available and the effective cancellation date should be clear.

18. STATE AUTOMATIC-RENEWAL LAWS

Automatic-renewal laws vary substantially by state. They can regulate pre-enrollment disclosures, affirmative consent, acknowledgment notices, renewal reminders, trial conversion, price changes, cancellation methods, online cancellation, retention of consent, and remedies. Because MDTelemed intends to offer memberships in all states, it must maintain a 50-state automatic-renewal compliance matrix. The production membership workflow should apply the rule for the patient's jurisdiction rather than relying only on this national policy. Where state law gives a patient greater cancellation or notice rights than this Policy, the state requirement controls.

19. CANCELLATION OF MEMBERSHIP

Patients may cancel an automatically renewing membership using the cancellation mechanism displayed in their account or membership terms, and any additional method required by applicable law. Cancellation stops future renewals according to the disclosed terms. Whether access continues through the paid billing period, terminates earlier at the patient's request, or qualifies for a prorated refund must be stated in the membership terms and must comply with applicable law. MDTelemed should not continue charging after a valid cancellation has become effective.

20. FREE TRIALS AND PROMOTIONAL PERIODS

If MDTelemed offers a free or discounted trial that converts to a paid membership, the enrollment flow must clearly disclose the trial length, the date or circumstance when billing begins, the recurring price after the trial, and how to cancel before being charged. The company should not use a 'free' claim if the consumer must pay an undisclosed mandatory fee or if material conversion terms are obscured. Any renewal reminder required by applicable state law must be provided in the required timing and form.

21. MEMBERSHIP PRICE CHANGES

If MDTelemed changes a recurring membership price, it should provide advance notice in the manner and timeframe required by applicable law and the membership agreement. Where affirmative consent is required for the new price, MDTelemed should not treat silence as consent. The exact implementation must follow the governing state rule.

22. ONE-TIME VISIT CANCELLATION

The cancellation and refund rules for a scheduled one-time visit should be disclosed before payment. Version 1.0 does not adopt the original universal rule that every cancellation less than 24 hours before an appointment is nonrefundable. fileciteturn6file0 MDTelemed may establish a reasonable cancellation/no-show policy, but it must be accurately displayed, consistently administered, and modified when law or exceptional circumstances require.

23. PROVIDER OR MDTelemed CANCELLATION

If MDTelemed cannot provide a purchased visit because no appropriately licensed physician is available, a technical failure attributable to MDTelemed prevents the encounter, or MDTelemed cancels for another company-side reason before substantive service is provided, the applicable refund or rescheduling remedy should be stated and applied. The patient should not be charged for a service MDTelemed did not provide merely because an appointment existed.

24. CLINICALLY INAPPROPRIATE TELEMEDICINE

A physician may determine after beginning an evaluation that telemedicine is clinically inadequate and direct the patient to in-person or emergency care. Whether a visit fee is refundable in that circumstance should depend on the disclosed policy, services actually rendered, applicable law, and fairness considerations. MDTelemed should not promise a diagnosis or prescription as the condition for earning a visit fee.

25. NO GUARANTEE OF PRESCRIPTION

Payment for an encounter does not purchase a prescription. A physician may decline a requested medication, test, referral, diagnosis, certification, or other requested outcome when it is clinically inappropriate or legally impermissible. A patient is paying for the professional medical evaluation and services described at checkout, not for a guaranteed clinical result.

26. NO-SHOWS AND LATE ARRIVALS

MDTelemed may establish no-show and late-arrival rules. They should define what constitutes a no-show, any grace period, whether the visit can be rescheduled, and any applicable charge or forfeiture. The rules should account for documented MDTelemed platform outages or other circumstances in which the patient reasonably attempted to attend.

27. REFUNDS

Refund eligibility depends on the transaction terms, reason for refund, services provided, and applicable law. MDTelemed should state the operative refund rule before purchase rather than relying on an undisclosed internal policy. Approved refunds should ordinarily be returned through the original payment method when feasible. Processing time may depend on the payment processor and financial institution; MDTelemed should not promise a fixed number of business days unless verified.

28. DUPLICATE OR ERRONEOUS CHARGES

Patients should promptly report suspected duplicate, incorrect, or unauthorized charges. MDTelemed should investigate transaction records and correct confirmed billing errors. A billing inquiry should not affect the quality of a patient's clinical care.

29. CHARGEBACKS

Patients may have rights under card-network rules and federal/state law to dispute charges with their financial institution. MDTelemed may provide transaction documentation in response to a chargeback. MDTelemed should not threaten patients for exercising lawful charge-dispute rights. Fraudulent chargebacks or deliberate payment misrepresentations may be addressed through lawful account and collection procedures.

30. FAILED PAYMENTS

If an authorized payment fails, MDTelemed may request an updated payment method, retry the charge when lawfully authorized, suspend membership renewal, or decline nonemergency future services until payment arrangements are resolved. The company should not represent that emergency medical care is available through MDTelemed based on payment status; MDTelemed is not an emergency service.

31. OUTSTANDING BALANCES AND COLLECTIONS

If MDTelemed permits balances to remain outstanding, collection practices must comply with applicable federal and state law. MDTelemed should verify whether and when it will use internal collections or third-party collection agencies before making public representations. Medical billing disputes should be investigated before an amount is treated as delinquent when appropriate.

32. GOOD FAITH ESTIMATES FOR SELF-PAY PATIENTS

Federal No Surprises Act rules generally require health-care providers and facilities to give uninsured or self-pay individuals a Good Faith Estimate of expected charges when care is scheduled sufficiently in advance or when the individual requests an estimate. CMS states that when care is scheduled 3-9 business days in advance, the estimate generally must be provided within 1 business day; when scheduled 10 or more business days in advance, generally within 3 business days; and an estimate requested before scheduling generally must be provided within 3 business days. Because MDTelemed is launching self-pay, the Good Faith Estimate workflow is a material compliance requirement and should be built into scheduling and billing operations.

33. PATIENT-PROVIDER DISPUTE RESOLUTION

Under the federal self-pay billing protections, an uninsured or self-pay patient may be eligible for the federal patient-provider dispute resolution process when a provider's billed charges are at least $400 more than that provider's Good Faith Estimate, subject to the program's eligibility requirements and deadlines. CMS currently states that a patient generally must initiate an eligible dispute within 120 days of the initial bill. MDTelemed must not contractually misrepresent or eliminate statutory billing-dispute rights.

34. THIRD-PARTY COSTS

A telemedicine visit may lead to prescriptions, laboratory tests, imaging, specialist referrals, emergency care, or other services furnished by independent entities. Unless MDTelemed expressly collects those charges, those entities establish and bill their own prices. A pharmacy's drug price, laboratory fee, imaging charge, or specialist fee is not automatically included in the MDTelemed visit or membership price. The Good Faith Estimate rules applicable to co-providers and co-facilities should be implemented according to current federal guidance rather than promises in this Policy that exceed current operational requirements.

35. SUPERBILLS AND RECEIPTS

MDTelemed may provide receipts and may provide a superbill or other documentation when the functionality is actually available. The original policy's categorical promise that a free superbill containing NPI, ICD-10 and CPT information is always provided is not retained as a verified launch feature. fileciteturn6file0 If a superbill is provided, it is documentation of services and charges; it is not a promise that an insurer will reimburse the patient.

36. OUT-OF-NETWORK REIMBURSEMENT

Because MDTelemed is self-pay at launch, a patient who independently submits documentation to an insurer does so subject to that plan's rules. MDTelemed does not guarantee reimbursement, application to a deductible, or any particular benefit. Patients should contact their health plan directly regarding out-of-network benefits.

37. CODING

If CPT, ICD-10-CM, or other codes appear on a receipt or superbill, they should accurately reflect documented services and diagnoses. Coding should not be altered merely to increase the likelihood of reimbursement. A patient's disagreement with an insurer's coverage decision does not authorize MDTelemed to change a clinically or factually correct code.

38. MINORS AND PAYMENT

A parent, guardian, or other person may pay for a minor's care without automatically receiving unrestricted access to all of the minor's health information. Where a minor lawfully receives confidential services, billing, portal, receipt, pharmacy, and notification workflows must be designed to respect applicable confidentiality requirements.

39. PRIVACY OF PAYMENT INFORMATION

Payment information and billing records may contain personal and health-related information. MDTelemed will handle information according to its privacy policies and applicable law. The company should minimize unnecessary disclosure of diagnoses or sensitive services in transaction descriptors, receipts, notifications, or communications when law permits.

40. FRAUD PREVENTION

MDTelemed may use reasonable fraud-prevention measures to verify identity, payment authorization, and unusual transactions. Such measures should be proportionate and should not be represented as specific technologies unless verified. MDTelemed may decline or hold a transaction when there is a reasonable concern about fraud, identity theft, or unauthorized payment.

41. PROMOTIONAL CODES, CREDITS, AND DISCOUNTS

Promotional offers should clearly state eligibility, expiration, exclusions, whether they apply to one-time or recurring charges, and whether they can be combined. Credits ordinarily have no cash value unless required by law or expressly stated. MDTelemed should not advertise a discount that is illusory or based on a fictitious regular price.

42. GIFT CARDS OR PREPAID VALUE

If MDTelemed later offers gift cards, prepaid credits, or stored value, it must first evaluate federal and state gift-card, unclaimed-property, expiration, fee, and refund laws. This Policy does not represent that such products currently exist.

43. TAXES

If a tax is legally applicable to a transaction, it may be collected as disclosed. MDTelemed should verify the tax treatment of memberships, technology components, and health-care services by jurisdiction before charging tax. This Policy does not represent that every telemedicine service is taxable or tax-exempt.

44. RECEIPTS AND TRANSACTION HISTORY

MDTelemed should provide or make available reasonable documentation of completed charges. The production system should allow the company to reconstruct what was purchased, the amount, applicable membership terms, and the patient's authorization. Records should be retained according to applicable accounting, medical-record, consumer-protection, tax, chargeback, and litigation-hold requirements.

45. PRICE ERRORS

If an obvious technical error displays an incorrect price, MDTelemed should not automatically charge a different amount without patient authorization. The company may cancel the transaction and offer the patient the correct price, subject to applicable law. A pricing error should be corrected transparently and promptly.

46. BILLING COMMUNICATIONS

MDTelemed may send transactional communications concerning receipts, failed payments, upcoming renewals, cancellations, price changes, or other billing matters. Marketing consent is distinct from communications reasonably necessary to administer an existing transaction or membership, subject to applicable law.

47. ACCESSIBILITY AND LANGUAGE

Material financial terms should be presented in a manner reasonably accessible to patients. Where applicable law requires language access or disability accommodation, MDTelemed should provide appropriate assistance. A patient should be able to obtain clarification of material billing terms before authorizing payment.

48. COMPLAINTS AND BILLING QUESTIONS

Patients may direct billing questions and complaints to MDTelemed LLC at Support@MDTelemed.com until a separate verified billing address or support channel is established. MDTelemed LLC 304 S Jones Blvd #4872 Las Vegas, NV 89107 Patients may also have rights to contact government regulators, financial institutions, card issuers, or the CMS No Surprises Help Desk. MDTelemed will not prohibit a patient from exercising lawful external complaint rights.

49. ARBITRATION AND STATUTORY RIGHTS

MDTelemed may use a separately drafted arbitration agreement where legally enforceable. This Payment Policy does not itself create a waiver of statutory billing, chargeback, regulatory complaint, or federal patient-provider dispute-resolution rights. Any arbitration provision should be reviewed separately for health-care, consumer, state, and federal enforceability and should not be hidden inside billing language.

50. CHANGES TO THIS POLICY

MDTelemed may update this Policy prospectively. A policy update does not retroactively change a completed one-time transaction or automatically alter an existing recurring membership when law or the membership agreement requires advance notice or renewed consent. Material recurring-billing changes should be communicated as required by applicable law.

51. PATIENT RESPONSIBILITIES

Review the price and material terms before authorizing payment. Use a payment method the patient is authorized to use. Review recurring membership terms before enrollment. Cancel through an available lawful method when the patient no longer wants renewal. Keep billing and contact information current. Promptly report duplicate, erroneous, or unauthorized charges. Keep Good Faith Estimates and receipts for comparison. Understand that payment does not guarantee a prescription, diagnosis, referral, or other requested clinical outcome. Confirm HSA/FSA eligibility independently when using tax-advantaged funds.

52. MDTelemed RESPONSIBILITIES

Disclose material price and recurring terms before charging. Obtain affirmative authorization for one-time and recurring charges. Provide a practical cancellation mechanism and comply with state automatic-renewal laws. Stop future recurring charges after cancellation becomes effective. Investigate credible billing errors. Maintain the required Good Faith Estimate workflow for uninsured/self-pay patients. Preserve transaction and consent evidence. Avoid unverified claims about payment-security technology or processor certification. Do not guarantee insurance reimbursement. Separate payment rights from confidential medical-record access when required. Verify the actual website prices and all membership tiers/features immediately before publication. Verify payment processor(s), accepted payment methods, card-storage/tokenization architecture, and PCI responsibilities. Complete a 50-state automatic-renewal/cancellation matrix before membership launch. Configure clear affirmative recurring-billing consent and retention of consent evidence. Implement online cancellation for online memberships and any additional state-required methods. Configure state-specific renewal/trial/price-change notices. Create and test the No Surprises Act Good Faith Estimate workflow for self-pay patients. Create the patient-provider dispute-resolution response workflow. Decide and publish the actual one-time visit cancellation/no-show/refund rules. Decide whether membership refunds are prorated, nonrefundable after billing, or governed otherwise, subject to state law. Verify whether superbills will be available and what fields/formats they contain. Verify HSA/FSA acceptance before advertising it. Verify transaction descriptors and privacy controls for sensitive services. Have consumer-protection/health-care counsel review membership enrollment, renewal, cancellation, and state-specific terms.

53. PRIMARY REFERENCES

Centers for Medicare & Medicaid Services, No Surprises Act / Good Faith Estimate guidance for uninsured or self-pay individuals. CMS, What is a Good Faith Estimate? — current timing and content guidance. CMS, Patient-Provider Dispute Resolution — eligibility when billed charges are at least $400 above the applicable Good Faith Estimate, subject to federal requirements. Federal Trade Commission, Negative Option Rule materials and 2026 rulemaking review. Federal Trade Commission, consumer guidance on free trials, auto-renewals, and negative-option subscriptions. Restore Online Shoppers' Confidence Act, 15 U.S.C. §§ 8401-8405. Internal Revenue Service, Publication 969 and current HSA/telehealth guidance. Applicable state automatic-renewal, consumer-protection, health-care billing, gift-card, privacy, and cancellation laws. Original MDTelemed Payment & Billing Policy — used as source material; unverified fixed pricing, insurance, processor, refund, and superbill representations were not retained. fileciteturn6file0

54. SOURCE LINKS

CMS self-pay medical bill rights: https://www.cms.gov/initiatives/your-patient-rights/medical-bill-rights/know-your-medical-bill-rights/know-your-medical-bill-rights-when-not-using-insurance CMS Good Faith Estimate: https://www.cms.gov/initiatives/your-patient-rights/medical-bill-rights/get-help/medical-bill-guides-resources/what-good-faith-health-insurance-estimate CMS provider payment resolution: https://www.cms.gov/initiatives/no-surprise-billing/overview/policies-resources/providers-payment-resolution-patients FTC Negative Option Rule: https://www.ftc.gov/legal-library/browse/rules/negative-option-rule FTC subscription consumer guidance: https://consumer.ftc.gov/articles/getting-and-out-free-trials-auto-renewals-and-negative-option-subscriptions IRS Publication 969: https://www.irs.gov/publications/p969

55. END OF

REFUND CREDIT PAYMENT

1. PAYMENT, BILLING, REFUND & VISIT CREDIT POLICY

Version 2.0 | Effective September 27, 2026

2. Purpose and Core Rule

EXCEPT WHERE A REFUND IS SPECIFICALLY REQUIRED BY APPLICABLE LAW, COURT ORDER, REGULATORY ORDER, OR OTHER NON-WAIVABLE LEGAL REQUIREMENT, ALL FEES FOR A COMPLETED PHYSICIAN ENCOUNTER ARE NON-REFUNDABLE. MDTelemed charges for access to a physician's professional medical evaluation, clinical judgment, advice, assessment, treatment planning, and disposition—not for a guaranteed prescription, diagnosis, test, referral, work note, medical certification, or other outcome requested by the patient. By purchasing and proceeding with an encounter, the patient acknowledges that clinical outcomes cannot be guaranteed and that dissatisfaction with a physician's independent medical judgment does not create a right to a monetary refund.

3. What Constitutes a Completed Clinical Service

A clinical service is considered provided when an MDTelemed physician has substantively evaluated the patient or the patient's presenting concern and has exercised professional medical judgment. A prescription is not required for a clinical service to have been provided. History-taking, symptom review, review of medications/allergies, records, photographs, test information, or other clinical information. Medical assessment, differential diagnosis, diagnosis when appropriate, risk assessment, counseling, education, anticipatory guidance, or treatment planning. Medical advice, including advice that medication is unnecessary, contraindicated, unsafe, not indicated, or not legally available through MDTelemed. Recommendation of non-prescription/supportive care, testing, follow-up, monitoring, referral, specialist evaluation, urgent care, emergency department evaluation, or another level of care. A clinical determination that the patient's condition cannot safely or appropriately be treated through telemedicine or falls outside MDTelemed's scope. NO PRESCRIPTION DOES NOT MEAN NO TREATMENT. A PHYSICIAN'S PROFESSIONAL EVALUATION, MEDICAL ADVICE, CLINICAL JUDGMENT, AND DISPOSITION ARE CLINICAL SERVICES EVEN WHEN NO MEDICATION IS PRESCRIBED.

4. Physicians Are Not Prescription Vendors

MDTelemed physicians are licensed physicians—not prescription vendors. They are never required to prescribe medication merely because a patient requested a medication, paid for an encounter, previously received the medication elsewhere, joined a membership, expected a prescription, or believes a prescription is necessary. Medication is prescribed only when the treating physician independently determines that it is medically appropriate, within MDTelemed's scope, supported by an adequate evaluation, and permitted by applicable law and MDTelemed policy. MDTelemed does not guarantee antibiotics, antivirals, steroids, erectile-dysfunction medications, weight-management medications, refills, or any other specific medication. MDTelemed prohibits controlled-substance prescribing through its service under its Controlled Substances & DEA Compliance Prohibition Policy.

5. Dissatisfaction Is Not a Refund Basis

Patient dissatisfaction with the physician's clinical judgment or with the outcome of an encounter is not, by itself, grounds for a refund. This includes dissatisfaction because the physician: did not prescribe the medication, antibiotic, refill, test, imaging study, referral, work note, medical certification, or other item requested by the patient; recommended over-the-counter or supportive treatment rather than prescription medication; recommended additional testing or an in-person examination; referred the patient to urgent care, an emergency department, a specialist, primary care, or another higher or different level of care; determined that telemedicine was not clinically sufficient or that MDTelemed does not treat the requested condition or provide the requested service; or provided medical advice with which the patient disagrees.

6. Referral, Escalation and 'Cannot Treat Remotely' Determinations

Referral or escalation is a clinical disposition. Advising a patient to seek emergency, urgent, specialist, or in-person care is an exercise of medical judgment and does not mean that no service was provided. Similarly, after substantive physician evaluation, informing a patient that a condition cannot safely or appropriately be managed through MDTelemed is a clinical determination and does not automatically create a refund right. Federal telehealth guidance recognizes tele-triage as remote screening used to determine a patient's condition and the care needed, including whether additional treatment or emergency-department care is appropriate.

7. Patient Responsibility Before Purchase

Before purchasing or using an MDTelemed encounter, the patient is responsible for reviewing the patient-facing policies and disclosures made reasonably available by MDTelemed, including the Scope of Services & Conditions We Do/Do Not Treat Policy, Prescribing & Medication Safety Policy, Controlled Substances Prohibition, Emergency/Urgent Care Policy, Pharmacy Choice Policy, and this Refund/Credit Policy.

8. MDTelemed Failure to Provide an Encounter

If a paid encounter does not occur because MDTelemed cannot provide the physician encounter—for example, an MDTelemed operational failure, absence of an appropriately authorized physician, or an MDTelemed platform failure that prevents the encounter—MDTelemed's standard remedy is one replacement visit credit. The replacement visit credit is the normal remedy. A monetary refund will be issued only when specifically required by applicable law, court order, regulatory order, or another non-waivable legal requirement. A replacement credit does not entitle the patient to a particular physician, prescription, diagnosis, treatment, or outcome.

9. One-Time Courtesy Visit Credit

Following review of a patient grievance, MDTelemed may, in its discretion, issue one complimentary future visit credit as a customer-service accommodation. Unless required by law, the credit is not convertible to cash and is not a monetary refund. A patient may receive no more than one courtesy visit credit arising from dissatisfaction with a completed encounter. Issuance of a credit is not an admission of error, inadequate care, liability, or entitlement to any future credit.

10. Grievance and Clinical Review

Patients who believe an encounter warrants review may submit a grievance to Support@MDTelemed.com. The grievance should identify the encounter and explain the concern without including unnecessary sensitive information in an unsecured message. MDTelemed will review the relevant medical record and circumstances and will provide the patient with the outcome within five business days, unless additional investigation, patient safety review, professional review, or a legally required process reasonably requires additional time. Clinical disagreements are reviewed as clinical matters. Customer-service personnel may not promise a prescription, reverse a physician's clinical judgment, or condition a credit on a physician changing the medical record.

11. No Circumvention of Legal Rights

This Policy establishes MDTelemed's standard commercial refund and credit rules. It does not prevent a refund, restitution, charge correction, or other remedy when such relief is specifically required by controlling law, a court, a regulator, or another non-waivable legal requirement.

12. Cross-Referenced Policies

MDTelemed Scope of Services & Conditions We Do/Do Not Treat Policy. MDTelemed Prescribing & Medication Safety. MDTelemed Controlled Substances & DEA Compliance Prohibition. MDTelemed Emergency, Urgent Care & Crisis Response. MDTelemed Pharmacy Choice & Non-Steering Policy. MDTelemed Grievances, Complaints & Appeals.

13. Primary Reference

Telehealth.HHS.gov, Tele-triage: tele-triage involves remotely screening patients to determine the patient's condition and the care needed; it may be used to help determine whether a patient should seek additional treatment or emergency-department care. Federal and state consumer-protection requirements, court orders, regulatory orders, and other non-waivable legal requirements control if they require a monetary remedy notwithstanding this Policy.

GRIEVANCES - COMPLAINTS - APPEALS

1. MDTELEMED LLC

2. GRIEVANCES, COMPLAINTS & APPEALS POLICY

Version 1.0 | September 15, 2026

Patient-facing national baseline. Patients may raise concerns without retaliation and without surrendering external regulatory, privacy, billing, professional-licensing, consumer-protection, or legal rights. State-specific complaint rights and mandatory response procedures control where more protective.

3. PURPOSE

MDTelemed LLC wants patients, parents/guardians, authorized representatives, caregivers where appropriate, and other users to have a clear way to report concerns about clinical care, privacy, billing, accessibility, discrimination, technology, communications, physician conduct, patient safety, prescriptions, records, membership, or other aspects of MDTelemed services. This Policy explains how concerns are received, triaged, investigated, answered, appealed when an internal appeal is available, and escalated when patient safety or law requires.

4. COMPLAINT, GRIEVANCE, INQUIRY, AND APPEAL

For this Policy, a 'complaint' or 'grievance' is an expression of dissatisfaction or concern that the patient wants MDTelemed to address. An 'inquiry' is generally a request for information or clarification that may be resolved without a formal investigation. An 'appeal' is a request for internal reconsideration of a determination when MDTelemed offers an appeal pathway or applicable law requires one. These labels do not reduce rights granted by law.

5. WHO MAY FILE

A patient may file a complaint. A parent, guardian, personal representative, legally authorized representative, or other person may file or assist where permitted by law. MDTelemed may need to verify identity or authority before disclosing protected health information or discussing confidential details.

6. NO RETALIATION

MDTelemed will not retaliate against a patient for making a good-faith complaint, exercising privacy rights, contacting a licensing board or regulator, requesting records, disputing a bill, reporting a safety concern, requesting disability accommodation, or asserting another right protected by law.

7. CARE WILL NOT BE CONDITIONED ON SILENCE

Patients are not required to waive the right to complain as a condition of receiving medically appropriate care. A clinician may establish lawful clinical boundaries or terminate a treatment relationship for legitimate reasons, but not merely because a patient made a protected good-faith complaint.

8. HOW TO CONTACT MDTelemed

Until additional complaint channels are operationally verified, complaints may be sent to Support@MDTelemed.com or mailed to MDTelemed LLC, 304 S Jones Blvd #4872, Las Vegas, NV 89107. Patients should not use these non-emergency channels for medical emergencies.

9. EMERGENCIES ARE NOT COMPLAINTS

If a patient is experiencing a medical or psychiatric emergency, the patient should call 911/local emergency services or use other appropriate crisis resources rather than waiting for a complaint response. A complaint concerning an emergency encounter can be submitted after immediate safety needs are addressed.

10. WHAT INFORMATION HELPS

A complaint can be investigated more efficiently when it identifies the patient or account when appropriate, date of service, physician or service involved, description of the concern, relevant communications or documents, desired resolution, and a reliable way to respond. A patient is not required to use legal terminology or identify the policy allegedly violated.

11. ANONYMOUS REPORTS

MDTelemed may accept and evaluate anonymous safety or compliance reports when sufficient information is available, but anonymity can limit the company's ability to verify facts, obtain additional information, communicate an outcome, or investigate a patient-specific record.

12. ACCESSIBILITY

MDTelemed should provide reasonable assistance to patients who need an accessible complaint process because of disability or communication needs. Complaint access should be coordinated with applicable disability and nondiscrimination requirements.

13. LANGUAGE ACCESS

Where law requires language assistance, MDTelemed should provide an appropriate mechanism for patients with limited English proficiency to raise concerns. The final operational process should identify available language-support resources rather than promise services that have not been contracted.

14. MINORS

Complaints involving minors require attention to parental authority, minor consent, confidentiality, and state law. A parent who can complain about care is not automatically entitled to confidential information that the minor is legally entitled to control.

15. CONFIDENTIALITY OF THE COMPLAINT PROCESS

Complaint information may become part of operational, compliance, quality, privacy, billing, or clinical records. MDTelemed should limit access to persons with a legitimate need and should not promise that every complaint is legally privileged or completely confidential.

16. PRIVACY COMPLAINTS

A patient who believes MDTelemed violated HIPAA privacy requirements may complain to MDTelemed and may also complain to the U.S. Department of Health and Human Services Office for Civil Rights. HIPAA prohibits retaliation for filing a complaint with OCR or for certain protected participation in investigations.

17. HIPAA COMPLAINT DEADLINE

HHS states that an OCR HIPAA complaint generally must be filed within 180 days of when the complainant knew the act or omission occurred, although OCR may extend the period for good cause. MDTelemed should not tell patients that they must exhaust the company's internal complaint process before contacting OCR.

18. PRIVACY OFFICIAL

HIPAA requires covered entities to designate a privacy official responsible for developing and implementing privacy policies and procedures and a contact person or office responsible for receiving privacy complaints and providing information about privacy practices. MDTelemed must formally designate and operationalize these roles before launch; this public policy uses the verified BusinessAdmin contact until a dedicated public contact is approved.

19. SECURITY COMPLAINTS

Suspected account compromise, unauthorized access, phishing, lost credentials, privacy exposure, or other security incidents should be triaged promptly to the security/privacy function. A security complaint may trigger incident-response and breach-assessment procedures under .

20. CLINICAL QUALITY COMPLAINTS

Clinical complaints may involve diagnosis, treatment, medication, testing, referral, follow-up, telemedicine appropriateness, communication, documentation, or professional conduct. They should be reviewed by personnel with appropriate clinical competence and independence from the matter where feasible.

21. PATIENT-SAFETY EVENTS

A complaint suggesting ongoing danger, serious adverse event, unsafe prescribing, impairment, abuse, exploitation, self-harm, violence, or another immediate risk should be escalated promptly rather than waiting in an ordinary customer-service queue.

22. PRESCRIBING COMPLAINTS

A patient's disagreement with a physician's decision not to prescribe a requested drug does not itself establish misconduct. The review should determine whether the clinical assessment, documentation, applicable law, MDTelemed prescribing policy, and standard of care were followed.

23. CONTROLLED-SUBSTANCE REQUESTS

MDTelemed prohibits prescribing Schedule II-V controlled substances through its platform. A complaint cannot require an MDTelemed physician to violate that platform rule or applicable law.

24. BILLING COMPLAINTS

Billing complaints should be coordinated with . Patients retain applicable rights concerning erroneous charges, recurring subscriptions, chargebacks, Good Faith Estimates, patient-provider dispute resolution, state consumer protections, and other billing remedies. Internal complaint review does not erase those rights.

25. MEMBERSHIP AND AUTO-RENEWAL COMPLAINTS

Complaints about recurring charges, cancellation, renewal notices, trial conversion, price changes, or membership representations should be reviewed against the enrollment record and applicable state automatic-renewal law. A complaint should not be used to obstruct an otherwise valid cancellation request.

26. MEDICAL RECORDS COMPLAINTS

Complaints concerning access, amendment, transmission, or confidentiality of records should be coordinated with the Privacy/HIPAA and Records policies. The complaint process should not be used to delay a valid HIPAA access request.

27. ACCESS REQUESTS ARE SEPARATE RIGHTS

A patient does not need to characterize a records request as a complaint to exercise HIPAA access rights. Conversely, filing a complaint does not automatically constitute a valid authorization to disclose records to a third party.

28. DISCRIMINATION COMPLAINTS

Complaints alleging discrimination, exclusion, unequal treatment, disability-access problems, language-access failures, or retaliation should be routed to the appropriate compliance function and handled under applicable federal and state civil-rights law.

29. SEXUAL MISCONDUCT, HARASSMENT, OR BOUNDARY COMPLAINTS

Allegations of sexual misconduct, harassment, exploitation, or serious boundary violations require prompt safeguarding, preservation of evidence, appropriate clinical/administrative separation, and legally appropriate reporting. MDTelemed should not predetermine that every allegation automatically requires a specific external report without evaluating the governing law.

30. IMPAIRED OR UNSAFE PHYSICIAN CONCERNS

Reports suggesting physician impairment, diversion, incompetence, fraud, or a significant patient-safety threat should be escalated to medical leadership/compliance and evaluated under credentialing, quality, reporting, and state-law obligations.

31. TELEMEDICINE-SPECIFIC COMPLAINTS

Complaints may involve patient location verification, modality, inability to perform a necessary examination, connectivity, delayed escalation, inappropriate asynchronous care, privacy during video visits, or failure to recommend in-person care. Review should consider the limitations and applicable standards of telemedicine rather than treating the encounter as merely a technology transaction.

32. AI TELESCRIBE COMPLAINTS

Patients may complain about the AI-assisted telescribe, including notice/consent, accuracy, recording or audio handling, transcript errors, privacy, retention, or data use. Because the AI is provider-facing and the physician remains responsible for the medical note, clinical inaccuracies should be reviewed against the encounter and finalized medical record.

33. TECHNOLOGY COMPLAINTS

Platform outages, failed video/audio, portal problems, login failures, record-download issues, or other technical concerns should be investigated using actual system information. MDTelemed should not promise a 99.9% SLA or other technical performance standard unless separately verified and adopted.

34. MARKETING COMPLAINTS

Complaints about advertising, testimonials, pricing, email/SMS marketing, cookies, pixels, or promotional claims should be reviewed for accuracy, consent, opt-out compliance, and applicable consumer-protection/privacy requirements.

35. TRIAGE

MDTelemed should triage complaints based on severity, not simply date received. Immediate patient-safety, privacy/security, abuse, discrimination, physician-impairment, or regulatory concerns may require accelerated handling.

36. ACKNOWLEDGMENT

MDTelemed should acknowledge complaints within a reasonable timeframe and should establish an operational service standard. The original three-business-day promise may be adopted if staffing and systems can reliably support it, but Version 1.0 does not misstate that voluntary target as a universal legal requirement.

37. INVESTIGATION

An investigation may include review of the complaint, medical record, encounter documentation, communications, billing records, audit data, applicable policies, physician response, staff information, vendor information, and other relevant evidence. The scope should be proportionate to the allegation.

38. FAIRNESS

The investigator should approach the complaint without presuming either that the patient is correct or that the physician/company is correct. Relevant evidence should be evaluated objectively. A disagreement in outcome is not proof of negligence, and a favorable clinical outcome does not prove that care was appropriate.

39. CLINICAL REVIEW

When the complaint requires medical judgment, review should be performed or overseen by an appropriately qualified physician. Administrative personnel should not independently determine whether a physician met the medical standard of care.

40. CONFLICTS OF INTEREST

When feasible, a person who is the subject of a serious complaint should not be the sole person deciding its merits. MDTelemed should use an independent reviewer or appropriate leadership escalation when conflicts could materially impair fairness.

41. PRESERVATION OF EVIDENCE

Once MDTelemed knows of a complaint that may involve litigation, regulatory investigation, serious patient harm, privacy/security breach, or other material dispute, relevant records should be preserved according to applicable legal-hold and record-retention procedures.

42. MEDICAL RECORD INTEGRITY

A complaint must not lead to improper deletion or rewriting of the original medical record. Legitimate corrections or late entries should follow the record-amendment and documentation process and preserve auditability.

43. COMMUNICATION WITH THE PHYSICIAN

A physician may be asked to provide factual information or a clinical response. The process should distinguish peer-review/quality activities from ordinary complaint correspondence and should be structured to preserve applicable protections where available.

44. PEER REVIEW

Some clinical complaints may warrant quality-assurance or peer-review evaluation under . Peer-review privilege and immunity are state- and fact-specific; MDTelemed should not promise that every complaint investigation is privileged or immune from discovery.

45. RESPONSE TIME

MDTelemed should resolve complaints as promptly as reasonably practicable, with priority based on risk and any legally required deadline. Complex matters may require additional time. If a delay is material, the patient should receive a reasonable status update when appropriate.

46. WRITTEN RESPONSE

For formal complaints, MDTelemed should ordinarily provide a written or otherwise durable response when appropriate. The response may summarize the concern, explain the review, state the determination or resolution, identify corrective steps that can appropriately be disclosed, and explain available internal or external options.

47. LIMITS ON DISCLOSING INTERNAL PERSONNEL ACTION

A patient may be informed that a concern was reviewed and that appropriate action was taken, but privacy, employment, peer-review, credentialing, legal, and other restrictions may prevent disclosure of confidential personnel discipline or internal quality records.

48. APOLOGIES AND COMMUNICATION

A respectful response may acknowledge the patient's experience or communication failure without making unsupported factual or legal admissions. MDTelemed should not use scripted defensive language where a transparent explanation or correction is appropriate.

49. CORRECTIVE ACTION

Depending on findings, corrective action may include education, workflow change, record correction/addendum, refund or billing correction, technical remediation, policy revision, credentialing action, enhanced supervision, quality review, vendor remediation, security action, or another appropriate response.

50. INTERNAL APPEAL

MDTelemed may offer an internal appeal of specified complaint determinations. The appeal should identify the determination challenged and any new information or claimed error. The company should define the actual appeal process operationally before promising fixed deadlines.

51. CMO REVIEW

The original policy assigned appeals to the Chief Medical Officer. That is a reasonable model for clinical matters if MDTelemed actually has a designated CMO with authority and an appropriate conflict-free process. Nonclinical appeals may be better handled by privacy, billing, compliance, or executive personnel depending on subject.

52. APPEAL DOES NOT SUSPEND EXTERNAL RIGHTS

A patient does not need to complete an internal appeal before contacting a regulator, licensing board, law-enforcement agency, OCR, consumer-protection authority, or other external body when the law allows direct filing.

53. STATE MEDICAL BOARDS

Patients may file complaints with the state medical board or other physician-licensing authority that has jurisdiction. Because MDTelemed operates nationally, the applicable board may depend on where the patient was physically located and where the physician is licensed.

54. FEDERATION OF STATE MEDICAL BOARDS RESOURCE

The Federation of State Medical Boards maintains a directory of state medical boards that can help patients locate the appropriate licensing authority. FSMB itself is not a substitute for the state board's complaint process.

55. HHS OFFICE FOR CIVIL RIGHTS

Patients may file HIPAA privacy or security complaints with HHS OCR when applicable. MDTelemed will not require patients to waive this right or retaliate for its exercise.

56. CIVIL-RIGHTS COMPLAINTS

Depending on the allegation and applicable program, patients may have rights to complain to HHS OCR or another federal/state civil-rights authority concerning prohibited discrimination. MDTelemed's internal process does not replace those rights.

57. STATE ATTORNEYS GENERAL AND CONSUMER AGENCIES

State attorneys general and consumer-protection agencies may receive complaints concerning deceptive practices, subscriptions, billing, privacy, security, advertising, or other consumer matters within their jurisdiction.

58. FEDERAL TRADE COMMISSION

The FTC receives reports concerning fraud, deceptive practices, privacy/security representations, negative-option subscriptions, and other consumer issues within its authority. Not every health-care dispute falls within FTC jurisdiction.

59. PROFESSIONAL LIABILITY AND LEGAL RIGHTS

Patients may consult an attorney or exercise other lawful rights. MDTelemed should not describe internal grievance review or arbitration as the only remedy available unless a valid agreement and applicable law actually provide that result.

60. ARBITRATION

The original policy directed patients after CMO review to arbitration under . Version 1.0 does not state that every complaint must be arbitrated. Any arbitration/class-action-waiver framework should be separately drafted, conspicuously presented, affirmatively agreed to where required, and evaluated for enforceability under federal and state health-care and consumer law.

61. LAW ENFORCEMENT

Complaints involving credible threats, violence, fraud, identity theft, abuse, exploitation, cybercrime, or other potentially criminal conduct may be referred to law enforcement when appropriate or required. MDTelemed should not threaten criminal referral merely to discourage complaints.

62. MANDATORY REPORTING

Certain complaint facts may trigger mandatory reports to child-protection agencies, adult-protective services, health departments, licensing authorities, law enforcement, or other entities. Reporting obligations vary by jurisdiction and circumstance and should be evaluated under the applicable state-specific matrix.

63. NPDB AND PROFESSIONAL REPORTING

The National Practitioner Data Bank has specific federal reporting requirements for certain professional review actions and medical-malpractice payments. A patient complaint by itself does not automatically require an NPDB report. MDTelemed should evaluate reporting based on the actual action and governing law.

64. CONFIDENTIALITY VERSUS TRANSPARENCY

MDTelemed should provide meaningful information about how a complaint was handled while protecting PHI, other patients' information, personnel information, security-sensitive information, peer-review material, and legally privileged communications.

65. COMPLAINT DATA AND QUALITY IMPROVEMENT

Aggregate complaint information can identify recurring problems. MDTelemed should periodically analyze complaint themes, severity, response times, physician patterns, technology failures, billing issues, privacy concerns, and corrective-action effectiveness.

66. PATTERN DETECTION

Repeated complaints about the same physician, workflow, medication practice, technical failure, marketing claim, or billing issue should be evaluated as a pattern rather than treated as unrelated isolated events when the evidence supports linkage.

67. SERIOUS ADVERSE EVENTS

A complaint reporting hospitalization, emergency transfer, severe medication reaction, diagnostic delay, death, suicide attempt, or other serious outcome should receive appropriate clinical and risk-management review. An adverse outcome does not automatically establish negligence, but it may require escalation.

68. REGULATORY COOPERATION

MDTelemed should respond truthfully and lawfully to authorized regulatory investigations and preserve required records. Patient authorization is not always required for legally authorized regulatory disclosures.

69. RECORD RETENTION

Complaint files should be retained according to a legally reviewed retention schedule that accounts for HIPAA documentation, medical records, quality/peer review, billing, consumer-protection, employment, litigation-hold, and state-law requirements. Version 1.0 does not invent one universal retention period.

70. PROTECTION AGAINST FALSE OR MALICIOUS REPORTS

MDTelemed may investigate knowingly false, fraudulent, threatening, extortionate, or abusive submissions. However, a complaint should not be labeled malicious merely because it is unsubstantiated, emotionally expressed, or critical of MDTelemed.

71. ACCOUNT TERMINATION DURING A COMPLAINT

A pending complaint does not create immunity from legitimate account restrictions for fraud, threats, abuse, safety risks, or other serious violations. Any termination should be based on documented legitimate grounds rather than retaliation for protected complaint activity.

72. CONTINUITY OF CARE

If the patient-clinician relationship is ended while a complaint is pending, MDTelemed and the physician should consider continuity-of-care, medication, records, referral, abandonment, emergency, and state-law obligations.

73. COMPLAINTS BY FAMILY MEMBERS

Family members may raise safety concerns even when they are not authorized to receive information. MDTelemed may listen to information without necessarily being permitted to disclose the patient's PHI in return.

74. DECEASED PATIENTS

Complaints involving a deceased patient may require verification of the personal representative or other authority under HIPAA and state law before protected information is disclosed.

75. COMPLAINTS ABOUT THIRD PARTIES

A complaint may concern a pharmacy, laboratory, imaging facility, payment processor, technology vendor, or other independent entity. MDTelemed should investigate its own role and, when appropriate, direct the patient to the third party without falsely accepting responsibility for matters outside MDTelemed's control.

76. DOCUMENTATION OF THE COMPLAINT PROCESS

MDTelemed should document the date received, subject, risk level, responsible reviewer, relevant evidence, actions taken, communications, determination, corrective action, appeal if any, and closure. The final complaint-management system should support reliable auditability.

77. PATIENT RESPONSIBILITIES

Patients are encouraged to provide truthful information, relevant dates and documents, a reliable contact method, and sufficient detail to permit investigation. Patients should notify MDTelemed if the concern involves an immediate safety risk. Patients are not required to prove malpractice or cite a statute in order to complain.

78. MDTelemed RESPONSIBILITIES

MDTelemed should provide an accessible complaint route, protect patients from retaliation, triage serious matters promptly, use qualified clinical review where needed, preserve record integrity, respect privacy, investigate fairly, correct substantiated problems, communicate reasonably, and preserve external rights.

79. STATE-SPECIFIC RIGHTS

Some states impose complaint notices, patient-bill-of-rights requirements, telehealth disclosures, professional-board notices, facility complaint processes, response deadlines, or other obligations. MDTelemed's 50-state launch requires a state-specific complaint-rights matrix rather than reliance on this national baseline alone.

80. CONTACT

MDTelemed LLC 304 S Jones Blvd #4872 Las Vegas, NV 89107 General / Complaint Contact: Support@MDTelemed.com Do not use this address or email as an emergency-response channel.

81. EXAMPLES OF MATTERS PATIENTS MAY REPORT

Concern about diagnosis, treatment, medication, testing, referral, or follow-up. Concern that telemedicine was inappropriate for the clinical problem. Concern about a physician's communication, professionalism, or conduct. Concern about privacy, confidentiality, recording, AI telescribe, or unauthorized access. Concern about billing, refunds, Good Faith Estimates, memberships, cancellation, or recurring charges. Concern about disability access, language access, or discrimination. Concern about inability to obtain or correct records. Concern about platform failure, portal access, or technical problems. Concern about marketing, email/SMS, cookies, tracking, or promotional claims. Concern about patient safety, emergency escalation, abuse, exploitation, impairment, or other serious risk. Decide whether to create a dedicated Support@MDTelemed.com address or retain Support@MDTelemed.com. Do not publish mdtelemed.com/complaints until the complaint portal actually exists and is tested. Do not publish a telephone complaint number until staffed and verified. Designate the HIPAA Privacy Official and complaint contact required by 45 C.F.R. § 164.530. Designate complaint ownership for clinical, billing, privacy/security, accessibility/civil-rights, technology, and marketing matters. Determine whether the original 3-business-day acknowledgment target is operationally sustainable. Determine standard internal resolution targets and when extensions/status updates are required. Define the internal appeal process, eligibility, deadlines, reviewer, and conflict-of-interest rules. Confirm whether a Chief Medical Officer will formally review clinical appeals. Build a complaint case-management/tracking system before promising unique tracking numbers. Create severity levels and immediate escalation triggers for safety, privacy breach, abuse, impairment, sexual misconduct, and serious adverse events. Integrate complaint workflows with incident response, billing, quality/peer review, medical records, and risk management. Build a 50-state complaint-rights and medical-board notice matrix. Build mandatory-reporting and professional-reporting decision trees; do not automatically report every complaint. Verify accessibility and language-assistance mechanisms. Create litigation-hold/evidence-preservation triggers. Establish complaint-record retention schedule with counsel. Have qualified 50-state health-care/privacy/consumer-protection counsel review the final public policy and operational procedure.

82. PRIMARY REFERENCES

83. C.F.R. § 164.530(d) — HIPAA requirement for covered entities to provide a process for individuals to make complaints concerning privacy policies/procedures or compliance.

84. C.F.R. § 164.530(a) — designation of privacy official and contact person/office.

85. C.F.R. § 160.306 — complaints to HHS OCR.

86. C.F.R. § 160.316 — prohibition against intimidation and retaliation.

U.S. Department of Health and Human Services, Filing a Complaint with OCR. Federation of State Medical Boards, Contact a State Medical Board directory. Federal Trade Commission, ReportFraud/consumer complaint resources. National Practitioner Data Bank, federal reporting guidance for medical malpractice payments and professional review actions. Applicable state medical-practice, telehealth, patient-rights, consumer-protection, privacy, civil-rights, mandatory-reporting, and complaint laws. Original MDTelemed Grievance & Complaints Policy — used as source material; unverified portal/email/telephone channels and universal voluntary deadlines were not retained as established facts.

87. SOURCE LINKS

HHS OCR complaint page: https://www.hhs.gov/hipaa/filing-a-complaint/index.html HHS HIPAA administrative requirements: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/introduction/index.html eCFR 45 C.F.R. § 164.530: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.530 eCFR 45 C.F.R. § 160.306: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-160/subpart-C/section-160.306 FSMB state medical board directory: https://www.fsmb.org/contact-a-state-medical-board/ FTC ReportFraud: https://reportfraud.ftc.gov/ NPDB reporting guidance: https://www.npdb.hrsa.gov/guidebook/

88. END OF

USER CONDUCT - PLATFORM BEHAVIOR

1. MDTELEMED LLC

2. USER CONDUCT & PLATFORM BEHAVIOR POLICY

Version 1.0 | September 15, 2026

Patient-facing national baseline. This Policy establishes reasonable safety, integrity, privacy, and platform-use expectations while preserving patient rights to complain, obtain records, seek emergency care, communicate honestly about their experience, and exercise rights protected by law.

3. PURPOSE

MDTelemed LLC provides medical care through human MD physicians using video, audio-only, asynchronous questionnaires/chat, and secure messaging. Safe remote care requires truthful information, respectful communication, appropriate account use, and protection of the platform and other persons. This Policy defines unacceptable conduct and explains proportionate responses.

4. SCOPE

This Policy applies to patients, parents/guardians, authorized representatives, caregivers participating in encounters, account holders, visitors using interactive platform features, and other persons who access MDTelemed systems. Separate workforce and physician conduct policies govern MDTelemed personnel.

5. CORE STANDARD

Users must not use MDTelemed to threaten people, commit fraud, unlawfully access systems, interfere with care, impersonate others, exploit minors or vulnerable persons, distribute malware, misuse prescriptions, or engage in other unlawful or materially unsafe conduct.

6. RESPECTFUL COMMUNICATION

Patients may be upset, frustrated, frightened, disagree with a physician, challenge a bill, criticize MDTelemed, request another opinion, or file a complaint. Disagreement or criticism alone is not misconduct. Conduct becomes actionable when it crosses into credible threats, targeted harassment, discriminatory abuse, sexual misconduct, stalking, repeated disruptive behavior, or other behavior that materially threatens safety or prevents care.

7. NO NON-DISPARAGEMENT RULE

MDTelemed does not prohibit patients from posting honest reviews or expressing truthful opinions about their experience. The federal Consumer Review Fairness Act restricts businesses from using standardized consumer contract terms that bar or penalize honest consumer reviews. This Policy therefore does not treat a negative review as misconduct merely because it is negative.

8. FALSE OR UNLAWFUL CONTENT

Nothing in the preceding section requires MDTelemed to tolerate content that is unlawful, contains another person's confidential information, is knowingly fraudulent, constitutes a true threat, unlawfully infringes rights, or falls outside protections provided by applicable law. Disagreement with an opinion is not by itself proof that the opinion is false.

9. THREATS AND VIOLENCE

Credible threats of violence, threats directed at physicians or staff, threats against other patients, weapon-related threats, stalking, or conduct indicating imminent danger may result in immediate safety escalation, account restriction, emergency intervention, or contact with appropriate authorities when permitted or required by law.

10. CRISIS STATEMENTS ARE NOT AUTOMATIC MISCONDUCT

A patient who discloses suicidal thoughts, homicidal thoughts, psychosis, severe distress, or another psychiatric crisis is not automatically violating this Policy. Such statements may require clinical risk assessment and emergency/crisis response under . The company should distinguish a symptom or plea for help from abusive conduct.

11. HARASSMENT

Repeated unwanted communications, targeted intimidation, doxxing, sexually explicit harassment, or abusive communications that materially interfere with operations may be restricted. A single emotionally charged complaint should not automatically be labeled harassment.

12. DISCRIMINATORY ABUSE

MDTelemed may restrict conduct that targets a physician, employee, patient, or other person with abusive or threatening language based on protected characteristics. At the same time, MDTelemed must comply with applicable nondiscrimination laws in providing its own services.

13. SEXUAL MISCONDUCT

Sexual harassment, exposure intended to harass rather than support a clinically necessary examination, sexual propositions, sexual threats, or other misconduct directed toward physicians or staff may result in immediate termination of an encounter and appropriate follow-up. Clinically necessary visual examination should be handled professionally and with informed consent.

14. IMPERSONATION

Users may not knowingly impersonate another person, falsely assume another patient's identity, or use another person's credentials to obtain care or records without authorization. Parents, guardians, caregivers, proxies, and personal representatives may act for another person only when legally authorized.

15. MINORS AND REPRESENTATIVES

Because MDTelemed treats patients of all ages, account access must respect parental authority, minor-consent law, confidentiality rights, guardianship, and personal-representative rules. A parent's access rights are not identical in every state or for every service.

16. ACCURATE IDENTITY INFORMATION

Patients should provide accurate identifying information reasonably necessary for care, records, prescriptions, billing, and legal compliance. Deliberate material falsification may make care unsafe and can lead to suspension or termination.

17. CURRENT PHYSICAL LOCATION

Patients must provide their actual current physical location when required for an encounter. Knowingly misrepresenting location can create physician-licensure, emergency-response, prescribing, and standard-of-care problems and may require the encounter to stop.

18. TRUTHFUL CLINICAL INFORMATION

Patients should provide materially accurate symptoms, medical history, allergies, medications, pregnancy information, relevant substance use, and other information requested for care. Physicians understand that patients may forget details or make mistakes; inadvertent inaccuracies are not treated the same as deliberate deception.

19. PRESCRIPTION FRAUD

Users may not forge, alter, duplicate, sell, divert, or fraudulently obtain prescriptions, or knowingly provide false information for the purpose of obtaining medication. Suspected prescription fraud may be investigated and may be reported where appropriate or required.

20. CONTROLLED SUBSTANCES

MDTelemed does not prescribe Schedule II-V controlled substances. Repeated requests for a controlled medication are not automatically criminal misconduct, but fraud, threats, diversion, forged prescriptions, or attempts to circumvent the platform prohibition may trigger account action.

21. PHARMACY AND PRESCRIPTION CONDUCT

Patients should not manipulate prescription information, impersonate pharmacy personnel, or falsely claim authorization from an MDTelemed physician. Legitimate requests to correct an e-prescription, change a pharmacy, or clarify a medication are not misconduct.

22. UNAUTHORIZED ACCESS

Users may not access or attempt to access accounts, records, administrative functions, databases, APIs, systems, or information for which they are not authorized. Accidental discovery of a security issue should be reported rather than exploited.

23. SECURITY TESTING

Users should not conduct penetration testing, vulnerability scanning, automated probing, credential attacks, scraping that burdens systems, or other security testing without written authorization. MDTelemed should establish a responsible vulnerability-disclosure process before inviting security research.

24. MALWARE AND DISRUPTION

Users may not introduce malware, ransomware, malicious code, denial-of-service traffic, destructive payloads, or other mechanisms intended to impair systems, compromise data, or interfere with care.

25. CREDENTIAL SECURITY

Users should protect passwords, authentication codes, recovery links, and devices. Users should not knowingly provide credentials to unauthorized persons. Suspected account takeover should be reported promptly.

26. SHARED DEVICES

Patients using shared computers or phones should protect their privacy, log out when finished, and safeguard downloaded records. MDTelemed cannot control what another person with lawful access to a patient's device may see.

27. RECORDING TELEMEDICINE ENCOUNTERS

Recording laws vary by jurisdiction. Federal law generally contains a one-party-consent exception for certain interceptions, while some states impose broader all-party consent requirements. MDTelemed therefore does not state that every patient recording is automatically a federal crime.

28. MDTelemed RECORDING RULE

Patients should not record audio or video of an MDTelemed encounter unless the recording is lawful and any consent required by applicable law and MDTelemed's applicable encounter procedure has been obtained. A physician may decline to proceed with a nonessential recording when lawful and clinically appropriate, subject to disability-access, patient-rights, evidence-preservation, and other applicable requirements.

29. AI TELESCRIBE DISTINCTION

MDTelemed's provider-facing AI telescribe is used to assist the human MD with clinical documentation. Its audio processing or recording architecture must be accurately disclosed in the separate consent/privacy materials. A platform-approved telescribe process is not equivalent to unrestricted patient recording or publication of an encounter.

30. SCREENSHOTS AND PHOTOGRAPHS

Patients should not capture or publish images that expose another person's confidential information. A patient may have legitimate reasons to preserve information shown to them, but privacy, intellectual-property, recording, and platform rules may apply depending on what is captured.

31. OTHER PERSONS PRESENT

Patients should tell the physician when another person is present or participating when relevant to privacy, consent, clinical care, or safety. Secret third-party participation can compromise confidentiality and informed consent.

32. PRIVACY OF OTHER PATIENTS

Users must not attempt to access, photograph, record, publish, or disclose another patient's protected or confidential information obtained through MDTelemed.

33. SECURE MESSAGING

Secure messaging should be used for legitimate health-care and service communications. It must not be used for threats, spam, malware, unlawful solicitations, impersonation, or deliberate flooding intended to impair operations.

34. ASYNCHRONOUS CHANNELS ARE NOT EMERGENCY CHANNELS

Users must not rely on questionnaires, portal messages, email, or routine support communications for emergency response. governs emergency and crisis escalation.

35. AUTOMATION AND BOTS

Users may not use unauthorized bots, scripts, scraping tools, automated account creation, credential-stuffing tools, or similar automation that compromises security, privacy, service integrity, or system availability.

36. FRAUDULENT TRANSACTIONS

Users may not knowingly use stolen payment credentials, commit chargeback fraud, manipulate promotions, create deceptive duplicate identities, or otherwise use the platform to commit payment fraud. Legitimate billing disputes and lawful chargebacks are not misconduct.

37. MEMBERSHIP ABUSE

Memberships are personal unless MDTelemed expressly offers a family or other multi-user arrangement. Users may not resell access, create unauthorized subaccounts, or systematically use another person's membership contrary to the published plan terms.

38. COMMERCIAL MISUSE

Users may not use patient-facing features to advertise unrelated products, recruit customers, distribute spam, harvest contact information, or operate an unauthorized commercial service.

39. ILLEGAL PURPOSES

The platform may not be knowingly used to facilitate fraud, trafficking, exploitation, identity theft, cybercrime, prescription diversion, or other unlawful conduct. The company should not label conduct 'illegal' without a reasonable basis.

40. INTELLECTUAL PROPERTY

MDTelemed may protect copyright, trademarks, software, proprietary workflows, and other intellectual property. However, the original statement that 'copying policies' automatically constitutes copyright infringement was overbroad. Applicable copyright law, licenses, fair use, public-domain material, and other rights determine whether particular copying is lawful.

41. PATIENT MEDICAL RECORDS

Nothing in this Policy limits a patient's lawful right to obtain, use, or transmit copies of the patient's own medical records. MDTelemed should not assert intellectual-property rights to obstruct legally required patient access.

42. REVIEWS AND TESTIMONIALS

MDTelemed will not condition service on surrender of a consumer's right to provide an honest review. MDTelemed may moderate content on its own controlled channels when lawful, but it should not use moderation to manufacture a misleading impression of uniformly positive consumer sentiment.

43. REVIEW MANIPULATION

Users may not knowingly create fake reviews, impersonate another patient in a review, accept undisclosed compensation to post deceptive content where disclosure is required, or use automated systems to manipulate ratings. MDTelemed likewise should comply with the FTC's Consumer Reviews and Testimonials Rule.

44. COMPLAINTS ARE PROTECTED

Filing a grievance, reporting a physician, contacting HHS OCR, contacting a medical board, disputing a bill, requesting records, or seeking legal advice is not misconduct merely because MDTelemed disagrees with the complaint.

45. ACCESSIBILITY AND ASSISTIVE TECHNOLOGY

Use of screen readers, captions, relay services, interpreters, assistive devices, or other accessibility tools is not prohibited automation or third-party participation. MDTelemed must account for applicable disability-access and effective-communication obligations.

46. CAREGIVERS AND INTERPRETERS

A caregiver, interpreter, parent, guardian, or support person may participate when appropriate. The physician may confirm the patient's consent and the participant's role, subject to applicable law.

47. CLINICAL BOUNDARIES

Patients may ask questions and disagree with treatment recommendations. Physicians may set reasonable boundaries regarding abusive conduct, inappropriate requests, medically unnecessary treatment, or requests outside the clinician's lawful scope.

48. REFUSAL TO PRESCRIBE

A physician's refusal to prescribe a requested medication does not authorize threats, harassment, fraud, or manipulation. The patient may seek a second opinion, file a complaint, or obtain care elsewhere, subject to applicable clinical and legal constraints.

49. APPOINTMENT DISRUPTION

Repeated intentional disruption of encounters, abusive conference participants, deliberate exposure of confidential material, or conduct making a safe examination impossible may lead the physician to end the encounter. The record should document the reason.

50. TECHNICAL DIFFICULTIES ARE NOT MISCONDUCT

Ordinary connectivity problems, device failures, difficulty using technology, disability-related access issues, or misunderstanding platform functions are not user misconduct. MDTelemed should provide reasonable troubleshooting or alternate modalities when clinically and legally appropriate.

51. SAFETY-BASED ENCOUNTER TERMINATION

A physician may end or redirect an encounter when continuation is unsafe, abusive, clinically inappropriate, unlawful, or impossible. If an emergency is present, the physician should follow rather than simply disconnecting.

52. ACCOUNT RESTRICTION

MDTelemed may temporarily restrict features or account access when reasonably necessary to protect safety, investigate fraud/security concerns, comply with law, or prevent material platform abuse. Restrictions should be proportionate and should preserve legally required access to medical records.

53. SUSPENSION

Temporary suspension may be appropriate while serious allegations are investigated. MDTelemed should consider whether the patient has active clinical needs, pending results, prescriptions, referrals, records requests, or continuity-of-care obligations.

54. TERMINATION

Permanent account termination may be appropriate for serious or repeated misconduct, including credible violence threats, intentional system compromise, material identity fraud, prescription fraud, exploitation, or severe repeated abuse. Termination should not be retaliatory.

55. NO AUTOMATIC THREE-STRIKE RULE

The original first/second/third-offense ladder is not retained as an inflexible national promise. MDTelemed should use a risk-based approach: education or warning for minor conduct; proportionate restriction for repeated or material conduct; immediate action for severe threats, fraud, cyberattack, exploitation, or other high-risk behavior.

56. NOTICE OF ACCOUNT ACTION

When appropriate and safe, MDTelemed should tell the user that an account has been restricted, suspended, or terminated and provide a general reason. Notice may be limited when disclosure would compromise security, another person's privacy, an investigation, or legal obligations.

57. OPPORTUNITY TO RESPOND

For non-emergency, non-security-critical matters, MDTelemed should ordinarily allow the user to explain disputed facts before permanent termination when practicable. Immediate temporary action may precede that opportunity when needed for safety or security.

58. APPEAL OF ACCOUNT ACTION

MDTelemed should establish an internal review mechanism for significant account restrictions or termination, particularly when facts are disputed. The operational procedure should identify the reviewer, timeframes, and exceptions rather than inventing a process in the public policy.

59. CONTINUITY OF CARE

Account discipline does not eliminate professional duties concerning continuity of care, abandonment, pending results, urgent needs, records, or appropriate transition. Clinical relationship termination must comply with applicable state law and professional standards.

60. RECORD ACCESS AFTER TERMINATION

A former user remains entitled to medical-record access to the extent required by HIPAA and applicable law. Account termination should not be used to block legally required record access.

61. EMERGENCY ACCESS

A suspended or terminated account is not an emergency service. Patients experiencing emergencies must use 911/local emergency resources regardless of account status.

62. REFUNDS AND BILLING AFTER TERMINATION

Whether a charge, credit, or refund is due after account action is governed by , the services actually provided, membership terms, and applicable law. This Policy does not create an automatic forfeiture of all payments.

63. PRESERVATION OF EVIDENCE

MDTelemed may preserve relevant account activity, communications, logs, recordings where lawfully retained, and other evidence when investigating threats, fraud, cyber incidents, complaints, or anticipated litigation, subject to privacy and retention law.

64. REPORTING TO AUTHORITIES

MDTelemed may report conduct to law enforcement, regulators, licensing bodies, child/adult protective services, or other authorities when reporting is required or legally appropriate. It should not use threats of reporting as a routine tool to suppress criticism or complaints.

65. NO AUTOMATIC CRIMINAL REFERRAL

The original policy's language implying automatic criminal consequences is replaced. MDTelemed is not the prosecutor. The company may preserve evidence and report suspected unlawful conduct when appropriate; government authorities determine whether investigation or prosecution occurs.

66. COOPERATION WITH LEGAL PROCESS

MDTelemed may respond to valid subpoenas, warrants, court orders, regulatory demands, and other legal process consistent with HIPAA and applicable law. The company should not disclose more information than authorized or required.

67. SECURITY INCIDENTS

Conduct involving account takeover, credential theft, malicious access, malware, or suspected compromise should be handled under in addition to this Policy.

68. GRIEVANCES ABOUT ENFORCEMENT

A patient who believes this Policy was applied unfairly may use 's grievance process and retains external rights provided by law.

69. NON-RETALIATION

MDTelemed will not characterize protected complaints, honest reviews, privacy-rights requests, disability accommodations, medical-board reports, or other protected activity as misconduct merely to justify adverse account action.

70. CHILD SAFETY

Users must not use MDTelemed to exploit, groom, threaten, sexualize, or otherwise endanger a child. Suspected abuse or exploitation may trigger immediate safety action and mandatory reporting.

71. VULNERABLE ADULT SAFETY

Exploitation, coercion, identity misuse, or abuse involving a vulnerable adult may trigger protective measures and mandatory reporting depending on state law.

72. DOMESTIC VIOLENCE AND COERCION

A patient may be participating under coercion. Physicians should distinguish victim behavior from perpetrator misconduct and prioritize privacy and safety. State reporting rules vary.

73. FRAUD DETECTION AND FALSE POSITIVES

Automated or manual fraud controls can make mistakes. MDTelemed should provide reasonable review of disputed account actions when safe and should not permanently label a patient fraudulent solely because an automated system generated an alert.

74. PLATFORM MODERATION

If MDTelemed hosts community, chat, review, or other user-generated content in the future, it should publish specific moderation rules and distinguish removal of content from termination of medical services. This version does not invent features not yet verified.

75. CHANGES TO THIS POLICY

MDTelemed may revise this Policy as services, technology, law, and safety needs evolve. Material changes should be versioned and communicated as required by applicable law or contract.

76. CONTACT

MDTelemed LLC 304 S Jones Blvd #4872 Las Vegas, NV 89107 Business Administration / Conduct Concerns: Support@MDTelemed.com Do not use this email for medical emergencies.

77. EXAMPLES OF PROHIBITED OR RESTRICTABLE CONDUCT

Credible threats of violence, stalking, or targeted intimidation. Sexual harassment or deliberately abusive sexual conduct toward a physician or staff member. Knowingly impersonating another patient or using stolen identity information. Forging, altering, diverting, selling, or fraudulently obtaining prescriptions. Knowingly misrepresenting physical location to circumvent licensure or safety controls. Attempting unauthorized access to another person's records or MDTelemed administrative systems. Deploying malware, denial-of-service attacks, credential attacks, or unauthorized security scanning. Using stolen payment information or engaging in deliberate payment fraud. Publishing another patient's confidential medical information obtained through the platform. Using the platform to facilitate exploitation, trafficking, fraud, or other unlawful activity. Repeated targeted harassment that materially interferes with care or operations.

78. CONDUCT THAT IS NOT, BY ITSELF, A VIOLATION

Posting an honest negative review. Filing a complaint or medical-board report. Disputing a bill or recurring charge in good faith. Asking for medical records. Seeking a second opinion. Disagreeing with a diagnosis or treatment recommendation. Requesting a medication, including a controlled medication, without fraud or abuse. Disclosing suicidal thoughts or another psychiatric symptom while seeking help. Experiencing technical difficulty. Using lawful accessibility tools, interpreters, caregivers, or support persons. Making an inadvertent factual error and correcting it. Consulting an attorney or regulator. Have 50-state counsel review patient recording/consent rules and build a state recording matrix. Decide whether MDTelemed will categorically prohibit patient recording as a contractual condition where lawful, permit it with consent, or allow physician-by-physician decisions; coordinate with disability/accessibility counsel. Verify the AI telescribe audio/recording architecture and align with the separate AI consent. Create a documented account warning/restriction/suspension/termination procedure with severity tiers. Create an appeal/reconsideration process for material account actions. Create continuity-of-care and physician-patient relationship termination workflows for all 50 states. Ensure suspended/terminated users retain legally required medical-record access. Create credible-threat, stalking, sexual misconduct, child/vulnerable-adult safety, prescription fraud, and cyberattack escalation procedures. Build state mandatory-reporting matrices. Create a responsible vulnerability disclosure/security contact process. Confirm whether community/review/user-generated-content features will exist; do not publish moderation promises for nonexistent features. Align conduct enforcement with non-retaliation and grievance rights. Align billing/refunds after termination with . Review the Terms of Use to ensure it does not contain an unlawful consumer non-disparagement/gag clause. Review marketing/review practices against the FTC Consumer Reviews and Testimonials Rule. Have health-care, consumer-protection, privacy, cyber, disability-access, and 50-state counsel review the final public version.

79. PRIMARY REFERENCES

80. U.S.C. § 2511 — federal interception law and consent exceptions; state law may be more restrictive.

81. U.S.C. § 45b — Consumer Review Fairness Act protections concerning consumer form-contract review restrictions.

Federal Trade Commission, Consumer Review Fairness Act: What Businesses Need to Know. Federal Trade Commission, Rule on the Use of Consumer Reviews and Testimonials, 16 C.F.R. Part 465.

82. C.F.R. § 164.524 — HIPAA right of access to protected health information.

83. C.F.R. § 164.530(g) — HIPAA prohibition on retaliation for exercising specified privacy rights.

Applicable state recording/interception, telehealth, medical-practice, patient-abandonment, mandatory-reporting, privacy, consumer-protection, and civil-rights laws. Original MDTelemed User Conduct & Platform Behavior Policy — used as source material; categorical criminal-recording language, automatic copyright claim, and rigid three-strike discipline were revised.

84. SOURCE LINKS

85. U.S.C. § 2511: https://www.law.cornell.edu/uscode/text/18/2511

FTC Consumer Review Fairness Act guidance: https://www.ftc.gov/business-guidance/resources/consumer-review-fairness-act-what-businesses-need-know FTC Consumer Reviews and Testimonials Rule: https://www.ftc.gov/legal-library/browse/rules/rulemaking-use-consumer-reviews-testimonials HHS HIPAA Right of Access: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/access/index.html eCFR 45 C.F.R. § 164.530: https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.530

86. END OF

INTERNATIONAL ACCESS - PATIENT LOCATION OUTSIDE THE UNITED STATES

International Access / Patient Location Outside the United States

Version 1.0 | Effective September 16, 2026

1. Policy Statement

MDTelemed adopts this policy to establish a consistent, patient-centered and legally compliant framework for international access / patient location outside the united states. This policy must be implemented together with applicable federal law, the law of the patient's physical location, professional standards, and MDTelemed's other clinical and privacy policies.

2. Scope

MDTelemed's clinical service is designed for jurisdictions in which its clinicians and operating entities are authorized to provide care.

3. Patient Location

A patient physically outside an authorized U.S. jurisdiction should not receive routine MDTelemed clinical care unless the company has affirmatively implemented and approved that jurisdiction.

4. Travel

Existing patients traveling internationally should be directed to local care for urgent needs and informed that prescribing, licensure, privacy, and malpractice rules may prevent MDTelemed from treating them.

5. Technology Access

Website or account accessibility from abroad does not mean MDTelemed is authorized to practice medicine in that location.

6. Roles and Responsibilities

MDTelemed management is responsible for operational implementation and periodic review. Clinicians remain responsible for independent professional judgment and documentation. Workforce members must follow role-based access, confidentiality, escalation, and incident-reporting requirements. Material conflicts between this policy and controlling law must be escalated to compliance/legal review before the affected workflow is used.

7. Training and Monitoring

Affected personnel should receive role-appropriate training. MDTelemed may audit compliance, investigate deviations, and implement corrective action when needed.

8. Exceptions

No exception may waive a mandatory legal or patient-safety requirement. Operational exceptions should be documented and approved by an authorized leader when appropriate.

9. Primary Regulatory / Guidance References

U.S. Department of Health and Human Services, HIPAA Privacy, Security and Breach Notification Rules, 45 C.F.R. Parts 160 and 164. HHS Telehealth guidance regarding HIPAA and remote communication technologies. Applicable state medical-practice, telehealth, privacy, recording, consumer-protection and professional-licensure laws.

COOKIE - TRACKING TECHNOLOGY - ANALYTICS

1. MDTELEMED LLC

2. COOKIE, TRACKING TECHNOLOGY & ANALYTICS POLICY

Version 1.0 | September 15, 2026

National patient/consumer-facing baseline. MDTelemed expects to use cookies, analytics, advertising technologies, and related data collection, but the exact production vendors and configurations have not yet been technically verified. This Policy therefore explains categories, legal constraints, and user choices without falsely claiming that named trackers, URLs, opt-out mechanisms, or data flows already exist.

3. PURPOSE

This Policy explains how MDTelemed LLC may use cookies, pixels, tags, SDKs, local storage, analytics tools, session technologies, advertising technologies, device identifiers, and similar online tracking technologies across public websites, patient-facing digital services, and applications. It should be read with , , , and .

4. WHY THOSE CLAIMS WERE REMOVED

In a telemedicine environment, cookie or tracking data can become highly sensitive depending on the page, user state, identifiers, events, and recipient. A session token, IP address, appointment event, URL, search term, device identifier, form field, diagnosis-related event, or authenticated-page activity may implicate HIPAA or state health/privacy law. MDTelemed should never promise 'no PHI' merely because a vendor describes data as analytics.

5. WHAT IS A COOKIE

A cookie is a small data element a website stores or accesses through a browser or device. Cookies may support authentication, security, preferences, analytics, measurement, personalization, advertising, or other functions. Some are first-party; others may be associated with third parties.

6. OTHER TRACKING TECHNOLOGIES

Online tracking can occur through pixels/web beacons, tags, JavaScript, SDKs, local or session storage, device identifiers, advertising IDs, server-side event transmission, fingerprinting, link decoration, conversion APIs, session-replay tools, log files, and similar technologies. This Policy uses 'tracking technologies' broadly to include these mechanisms.

7. STRICTLY NECESSARY / ESSENTIAL TECHNOLOGIES

MDTelemed may use technologies reasonably necessary to authenticate users, maintain sessions, protect forms, prevent fraud, remember privacy choices, balance traffic, secure accounts, detect abuse, and deliver functions a user requests. Whether a particular technology legally qualifies as necessary depends on its actual purpose and configuration.

8. ESSENTIAL DOES NOT MEAN UNREGULATED

Calling a technology 'essential' does not exempt MDTelemed from HIPAA, security, data-minimization, state privacy, consumer-health-data, or other legal requirements. Necessary technologies should collect and transmit only information reasonably required for their function.

9. SESSION AND AUTHENTICATION DATA

Session identifiers may be linked to an authenticated individual or health-care interaction. The original statement that session cookies 'do NOT contain PHI' was too categorical. Even when the cookie value is an opaque token, the overall disclosure or recipient-side linkage must be assessed.

10. ANALYTICS

Analytics may measure visits, navigation, performance, errors, conversion, device/browser characteristics, geographic region, referral source, or feature use. MDTelemed must evaluate analytics separately for public informational pages, appointment/intake flows, login/registration pages, authenticated portals, telemedicine interfaces, and mobile applications.

11. PERFORMANCE AND DIAGNOSTICS

Performance tools may collect timing, error, crash, browser, device, or network information to diagnose technical problems. Those tools should be configured to avoid unnecessary capture of health information, credentials, free-text fields, medical content, or other sensitive information.

12. SESSION REPLAY

Session-replay technology can recreate or approximate a user's interaction with a website or app and may capture clicks, scrolling, text entry, form interaction, or page content depending on configuration. MDTelemed should not deploy session replay on sensitive or authenticated health-care surfaces without documented privacy/security review, field masking, contractual controls, and a lawful basis.

13. HEATMAPS

Heatmaps can aggregate clicks, movement, scrolling, or engagement. Even an apparently aggregate feature can be generated from event-level data transmitted to a vendor. MDTelemed must evaluate the underlying collection, not merely the final visualization.

14. ADVERTISING AND MARKETING TECHNOLOGIES

MDTelemed may use advertising technologies on appropriate public-facing portions of its digital properties when lawful. Such technologies may support campaign attribution, frequency measurement, audience building, remarketing, or advertising optimization. Their use on health-related pages requires heightened review.

15. NO BLANKET AUTHORIZATION TO SHARE HEALTH INFORMATION FOR ADS

A general privacy policy, Terms of Use acceptance, or ordinary cookie banner does not by itself constitute a HIPAA-compliant authorization to disclose PHI to an advertising vendor. HHS OCR expressly states that a cookie banner's accept/reject choice is not a HIPAA authorization.

16. AUTHENTICATED PATIENT AREAS

HHS OCR states that tracking technologies on user-authenticated pages generally have access to PHI. MDTelemed should therefore treat patient portals, authenticated telehealth interfaces, appointment information, prescription information, billing information, and similar authenticated areas as high-risk environments.

17. TRACKING VENDORS AND HIPAA BUSINESS ASSOCIATES

If a tracking vendor creates, receives, maintains, or transmits PHI on behalf of MDTelemed for a covered function or qualifying service, the vendor may be a HIPAA business associate. Where required, MDTelemed must have a Business Associate Agreement and a Privacy Rule permission for the disclosure.

18. A BAA DOES NOT CURE EVERY DISCLOSURE

A Business Associate Agreement does not automatically make every data transfer lawful. MDTelemed must still ensure the vendor is actually acting in a business-associate capacity, the disclosure is permitted, the information is appropriately limited, and required Security Rule safeguards are implemented.

19. DE-IDENTIFICATION AFTER RECEIPT IS NOT ENOUGH

HHS OCR explains that it is not sufficient for a vendor to receive PHI first and promise to de-identify it later when the initial disclosure itself lacks a lawful basis. MDTelemed must evaluate what leaves its systems at the moment of disclosure.

20. PUBLIC / UNAUTHENTICATED PAGES

Not every visit to a public health-related webpage necessarily creates PHI. HHS's current guidance reflects a 2024 federal court decision vacating the portion of OCR guidance that treated the combination of an IP address and a visit to an unauthenticated health-condition/provider webpage as automatically sufficient in specified circumstances. MDTelemed should apply current law rather than an overbroad rule.

21. LOGIN AND REGISTRATION PAGES

Even before authentication, login or registration pages can transmit identifying information. OCR notes that credentials or registration information entered on such pages may constitute individually identifiable health information/PHI in relevant circumstances. Third-party tracking on these surfaces requires heightened review.

22. MOBILE APPLICATIONS

If MDTelemed deploys a mobile application, SDKs may collect device IDs, advertising IDs, network/location information, app events, crash information, and user-entered data. Mobile SDK inventories should be reviewed with the same rigor as website trackers.

23. LOCATION DATA

MDTelemed requires the patient's actual physical location for clinical/legal purposes. Precise geolocation can also be sensitive personal information or consumer health data under state law. Location collected for care, emergency response, fraud prevention, or legal compliance should not automatically be repurposed for advertising.

24. SEARCH TERMS AND PAGE CONTENT

Search queries, URLs, page titles, appointment types, intake selections, diagnosis-related content, medication-related content, and form fields can reveal or support inferences about health. Tracking configuration should prevent unnecessary transmission of sensitive URL parameters and page/event content.

25. FORM FIELDS

Advertising or analytics scripts should not capture medical history, symptoms, medications, diagnoses, free-text clinical descriptions, payment credentials, government identifiers, authentication secrets, or other sensitive form content unless the collection is specifically lawful, necessary, and appropriately protected.

26. SERVER-SIDE TRACKING

Moving tracking from a browser to a server or customer-data platform does not automatically eliminate privacy obligations. Server-side event pipelines can still disclose personal information, consumer health data, or PHI and must be inventoried and governed.

27. GOOGLE ANALYTICS

The original policy represented Google Analytics as deployed. This version does not confirm deployment. If MDTelemed uses Google Analytics or a successor product, the exact configuration, data streams, consent settings, retention, advertising features, account linkage, contractual role, and placement on health-related surfaces must be reviewed before publication.

28. HOTJAR

The original policy represented Hotjar as deployed. This version does not confirm deployment. If session replay, heatmap, or feedback technology is used, MDTelemed must verify masking/redaction and prevent impermissible capture of PHI or sensitive health data.

29. MIXPANEL

The original policy represented Mixpanel as deployed. This version does not confirm deployment. Product analytics event names and properties can themselves disclose health-related activity and must be reviewed before transmission.

30. META/FACEBOOK PIXEL

The original policy represented Facebook Pixel as deployed. This version does not confirm deployment. Any Meta advertising technology must undergo health/privacy review before use, particularly on appointment, condition, treatment, intake, login, portal, prescription, or conversion events.

31. GOOGLE ADS

The original policy represented Google Ads tracking as deployed. This version does not confirm deployment. Conversion tags, enhanced conversions, remarketing lists, audience signals, and URL/event data should be reviewed for sensitive information before activation.

32. LINKEDIN AND OTHER AD NETWORKS

The original policy represented LinkedIn tracking as deployed. This version does not confirm deployment. The same rule applies to LinkedIn, TikTok, Snap, X, Microsoft Ads, affiliates, data brokers, and future advertising platforms: no deployment on sensitive surfaces without documented legal/technical approval.

33. TELEHEALTH ENFORCEMENT RISK

Tracking is not a theoretical risk. In July 2026 the FTC, California, and Utah sued Hims & Hers, alleging among other things that the telehealth provider shared sensitive health information with advertising platforms through customer lists and third-party tracking technologies despite privacy representations. Allegations are not findings of liability, but the action demonstrates the enforcement risk of mismatched privacy promises and advertising data flows.

34. FTC ACT

The FTC Act prohibits unfair or deceptive acts or practices. If MDTelemed promises that health information is private, not shared for advertising, de-identified, or excluded from trackers, the actual technology must match that representation.

35. HEALTH BREACH NOTIFICATION RULE

Depending on the product/entity/data and whether HIPAA applies, the FTC Health Breach Notification Rule may apply to certain vendors of personal health records and related entities. The FTC amended the Rule in 2024 to address health apps and connected technologies. The FTC rescinded its 2021 policy statement in September 2026 because the updated Rule superseded that policy statement.

36. STATE CONSUMER PRIVACY LAWS

State comprehensive privacy laws may regulate targeted advertising, sale, sharing, sensitive data, profiling, universal opt-out mechanisms, consent, disclosures, and consumer rights. Applicability varies by statute, thresholds, entity status, data type, and HIPAA exemptions.

37. CALIFORNIA

Where the CCPA/CPRA applies, California consumers may have rights to opt out of sale or sharing of personal information, including sharing for cross-context behavioral advertising, and may have rights concerning sensitive personal information. MDTelemed must determine which statutory entity/data exemptions apply to its health-care operations.

38. GLOBAL PRIVACY CONTROL / OPT-OUT PREFERENCE SIGNALS

Where applicable law requires recognition of user-enabled opt-out preference signals, MDTelemed's consent-management and advertising architecture should honor them as required. The precise implementation must be tested across browsers and devices.

39. CALIFORNIA COOKIE BANNER LIMITATION

California's 2026 regulations explain that a cookie banner or cookie controls are not, by themselves, necessarily an acceptable method for a request to limit use/disclosure of sensitive personal information. MDTelemed should not assume one generic banner satisfies every California right.

40. WASHINGTON MY HEALTH MY DATA

Washington's My Health My Data Act regulates consumer health data outside traditional HIPAA contexts and includes requirements concerning privacy policies, consent for certain collection/sharing, authorization for sale, consumer rights, processors, and geofencing. Applicability and HIPAA-related exemptions must be analyzed for MDTelemed's actual data.

41. NEVADA CONSUMER HEALTH DATA

MDTelemed is based in Nevada. Nevada has consumer-health-data requirements in addition to general privacy rules. should provide the detailed consumer-health-data disclosures and rights applicable to MDTelemed after entity/data applicability is confirmed.

42. OTHER STATE HEALTH DATA LAWS

Other states have enacted or may enact consumer-health-data, reproductive-health, biometric, genetic, precise-geolocation, or comprehensive privacy laws. should maintain the state-specific rights supplement rather than falsely implying that California and Washington are the only relevant jurisdictions.

43. GDPR

The original title labeled the policy 'GDPR/CCPA.' MDTelemed currently describes a U.S. telemedicine service. GDPR should not be represented as automatically applicable merely because a website can be viewed from Europe. If MDTelemed intentionally offers services to or monitors individuals in the EEA/UK in a manner triggering those laws, a separate international privacy analysis is required.

44. COOKIE CONSENT

MDTelemed should obtain opt-in consent for nonessential tracking where required by applicable law and should provide opt-out or preference mechanisms where required. The legal standard depends on jurisdiction, technology, purpose, and data.

45. CONSENT MUST MATCH REAL CHOICES

A banner should not say 'Reject All' if rejection still activates nonessential trackers. Consent logs should reflect the user's actual choice and should be tested after deployments and tag changes.

46. NO DARK PATTERNS

Privacy interfaces should not manipulate users into accepting tracking through misleading buttons, unequal visual treatment, repeated obstruction, confusing double negatives, hidden controls, or other deceptive design.

47. WITHDRAWING CONSENT

Where consent is the legal basis, users should be able to withdraw it through a reasonably accessible mechanism, subject to applicable law. Withdrawal should stop future optional processing covered by the withdrawal; it cannot necessarily undo disclosures already lawfully made.

48. COOKIE PREFERENCE CENTER

MDTelemed should implement a preference center or equivalent control if needed for the deployed technologies and applicable laws. The original mdtelemed.com/ccpa-opt-out URL should not be published until that endpoint actually exists.

49. DO NOT SELL OR SHARE

If MDTelemed is a business subject to a state law requiring a 'Do Not Sell or Share' mechanism, the website should display the legally required link/control or honor an approved alternative method. The exact wording and placement should be determined after applicability analysis.

50. SENSITIVE PERSONAL INFORMATION

Health information, precise geolocation, account credentials, financial information, genetic information, biometrics, communications, and other categories may receive heightened protection under different laws. The category definitions are jurisdiction-specific.

51. CHILDREN

Because MDTelemed treats children, digital tracking must account for COPPA where applicable to online services directed to children under 13 or where the operator has actual knowledge it collects personal information from a child under 13, as well as state child/teen privacy laws. Clinical consent by a parent does not automatically satisfy every online-tracking requirement.

52. TEEN PRIVACY

State privacy laws may provide heightened protections for known minors or teenagers, including opt-in requirements for sale/sharing or targeted advertising. MDTelemed should identify age signals it actually knows and avoid unnecessary profiling of minors.

53. AUTHENTICATED CHILD ACCOUNTS

Third-party advertising tracking should not be deployed in pediatric authenticated areas in a manner that impermissibly discloses PHI or violates child privacy law. Pediatric tracking should be treated as especially sensitive.

54. PAYMENT PAGES

Payment pages can expose transaction, service, or identity information. Advertising and analytics scripts should be minimized and carefully reviewed on checkout, membership, and billing surfaces. Payment-card data must be handled under the actual payment architecture and applicable security obligations.

55. MEMBERSHIP FUNNEL

MDTelemed offers memberships. Marketing teams may wish to measure signup conversions, but event labels, URL parameters, intake answers, condition-specific campaigns, and membership selections can reveal health interests. Attribution must be designed to avoid unnecessary health-data disclosure.

56. EMAIL AND SMS TRACKING

Marketing email may use pixels or tracked links, and SMS links may contain identifiers. governs messaging consent; this Policy governs tracking embedded in or triggered by communications. Health-related campaigns require privacy review.

57. SOCIAL MEDIA EMBEDS

Embedded videos, social widgets, share buttons, maps, chat widgets, or other third-party content may transmit data when a page loads or a user interacts. MDTelemed should inventory such embeds and delay nonessential activation where consent is required.

58. CHAT TOOLS

Customer-service chat or chatbot technology can capture free text containing health information even when the tool was intended only for administrative questions. MDTelemed has stated there will be no autonomous clinical AI; any administrative chat tool must still be evaluated for privacy and HIPAA implications.

59. AI TELESCRIBE IS SEPARATE

MDTelemed's provider-facing AI telescribe is a clinical documentation function, not an advertising tracker. Its audio processing, recording, vendors, retention, and consent are governed principally by and the HIPAA/privacy framework. Telescribe data must not be repurposed for advertising without a lawful basis.

60. DATA MINIMIZATION

MDTelemed should configure trackers to collect the least information reasonably necessary for the approved purpose. Event names and parameters should avoid diagnoses, medication names, symptoms, appointment reasons, or other sensitive health details unless specifically required and lawful.

61. RETENTION

Tracking data should not be retained indefinitely by default. MDTelemed should define retention based on purpose, legal requirements, vendor capability, security, analytics needs, and consumer rights. Vendor defaults should be reviewed rather than automatically accepted.

62. ACCESS CONTROLS

Access to analytics and advertising accounts should be limited to personnel with legitimate duties. Account permissions, administrator roles, authentication, and offboarding should be managed as part of the security program.

63. VENDOR CONTRACTS

Contracts should address permitted use, confidentiality, security, retention/deletion, subcontractors, breach/security incidents, consumer requests, sale/sharing restrictions, targeted advertising, and HIPAA BAAs where required.

64. VENDOR'S OWN USE

A vendor that receives data for its own independent advertising, profiling, product development, or cross-customer purposes may have a different legal role than a processor/service provider/business associate. MDTelemed must understand and contractually govern downstream use.

65. DATA BROKERS

MDTelemed should not disclose patient or consumer health information to data brokers for advertising or monetization without specific legal review and all required consent/authorization. Some state consumer-health-data laws impose especially strict sale requirements.

66. AUDIENCE LISTS

Uploading customer or patient email addresses, telephone numbers, or other identifiers to advertising platforms for matching or audience creation can disclose sensitive relationships or health interests. Such practices require explicit privacy/legal review and should not occur merely because a marketing platform offers the feature.

67. LOOKALIKE AUDIENCES

Lookalike/similar-audience functions can infer characteristics from seed audiences. Health-related seed lists should not be used without documented legal analysis and appropriate authorization/consent where required.

68. CONVERSION EVENTS

Events such as 'appointment booked,' 'psychiatry visit,' 'GLP-1 intake,' 'ED treatment,' 'pregnancy consultation,' or medication purchase can reveal health information. Conversion measurement should use privacy-preserving event design and avoid sending sensitive labels to advertising vendors.

69. URL HYGIENE

Sensitive information should not be placed in URLs, query strings, referrer headers, page titles, analytics labels, or campaign parameters where it may be unintentionally transmitted.

70. TAG MANAGEMENT

If MDTelemed uses a tag-management system, publishing permissions should be restricted and changes reviewed. A new marketing tag can create a new disclosure without changing the visible website.

71. CHANGE MANAGEMENT

Privacy review should be required before deploying or materially reconfiguring a tracker, pixel, SDK, session-replay tool, advertising integration, conversion API, or data pipeline. A once-a-year cookie inventory is insufficient for a rapidly changing digital platform.

72. AUTOMATED SCANNING

MDTelemed should periodically scan public and authenticated digital properties to identify cookies, tags, pixels, SDKs, network calls, and unexpected vendor domains. Scans should supplement, not replace, manual data-flow analysis.

73. TEST ACCOUNTS

Authenticated tracking should be tested using controlled test accounts to determine what data actually leaves login, registration, appointment, intake, portal, billing, prescription, records, and telemedicine surfaces.

74. PRIVACY IMPACT ASSESSMENT

High-risk tracking deployments should undergo documented privacy/security assessment addressing data categories, recipients, purpose, legal basis, patient expectations, state rights, HIPAA, vendor role, retention, security, and alternatives.

75. BREACH AND INCIDENT RESPONSE

An impermissible tracking disclosure can require HIPAA breach analysis, FTC Health Breach Notification Rule analysis where applicable, state breach analysis, consumer-health-data analysis, contractual notification, remediation, and regulatory reporting.

76. PRIVACY REQUESTS

Users may have rights to access, delete, correct, opt out, limit, withdraw consent, or appeal under applicable state laws. should provide the state-specific rights and verified request mechanisms.

77. UNIVERSAL OPT-OUT MECHANISMS

Where required, MDTelemed should process recognized universal opt-out preference signals and propagate the choice to relevant sale/sharing/targeted-advertising systems. Implementation should be documented and tested.

78. BROWSER SETTINGS

Users can often block or delete cookies through browser settings, but browser controls may not stop every tracking technology, server-side disclosure, mobile SDK, or account-based processing. MDTelemed should not present browser deletion as a complete privacy solution.

79. EFFECT OF DISABLING COOKIES

Blocking essential technologies may impair authentication or requested functions. Rejecting optional analytics or advertising technologies should not prevent access to medically necessary functionality unless the technology is genuinely necessary for that function.

80. GLOBAL USERS

Website access from outside the United States does not necessarily mean MDTelemed offers medical services there. If international targeting begins, MDTelemed should perform GDPR, UK GDPR, ePrivacy, and other jurisdiction-specific analyses before expanding this policy.

81. NO SALE CLAIMS

MDTelemed should not publish 'we never sell your data' unless counsel and engineering have confirmed that every relevant transfer falls outside each applicable statute's definition of sale. Some privacy laws define sale or sharing more broadly than ordinary cash transactions.

82. NO DE-IDENTIFIED-ONLY CLAIMS

MDTelemed should not claim all analytics are de-identified unless de-identification is performed before disclosure and meets the applicable legal standard. Pseudonymous identifiers are not necessarily de-identified data.

83. NO PHI-TO-TRACKERS CLAIMS WITHOUT TESTING

The original categorical 'NO PHI transmitted to analytics platforms' statement should remain removed until recurring technical testing verifies the claim across every relevant page, event, app, SDK, and server-side integration.

84. TRANSPARENCY

Once the production inventory is complete, the public cookie notice should identify categories of technologies, purposes, retention where required, third parties or categories of recipients where required, and available choices. A dynamic cookie table may be preferable to hard-coding rapidly changing vendor names into this legal policy.

85. CHANGES TO THIS POLICY

MDTelemed may revise this Policy as technologies, vendors, laws, and services change. Where law requires consent, authorization, or notice before a materially different use, a website update alone will not substitute for that requirement.

86. CONTACT

MDTelemed LLC Attn: Privacy / Business Administration 304 S Jones Blvd #4872 Las Vegas, NV 89107 Support@MDTelemed.com

87. PRIMARY LEGAL AND REGULATORY REFERENCES

HIPAA Privacy, Security, and Breach Notification Rules, 45 C.F.R. Parts 160 and 164. HHS OCR, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates, current guidance, including the 2024 federal-court limitation identified by HHS. Federal Trade Commission Act, 15 U.S.C. § 45, concerning unfair or deceptive acts or practices. FTC Health Breach Notification Rule, 16 C.F.R. Part 318, as amended. California Consumer Privacy Act / CPRA and implementing regulations, as applicable. Washington My Health My Data Act, Wash. Rev. Code ch. 19.373, as applicable. Nevada consumer health data and privacy provisions, NRS Chapter 603A, as applicable. Children's Online Privacy Protection Act and Rule, 15 U.S.C. §§ 6501-6506 and 16 C.F.R. Part 312, as applicable. Other applicable state comprehensive privacy, consumer-health-data, biometric, genetic, geolocation, child/teen, reproductive-health, and breach-notification laws. Original MDTelemed Cookie Tracking & Analytics Policy (GDPR/CCPA) — used as source material; named-vendor deployment, no-PHI/de-identified-only, opt-out URL, five-business-day response, and automatic GDPR applicability claims were not retained as facts.

88. SOURCE LINKS

HHS OCR Online Tracking Technologies Guidance: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/hipaa-online-tracking/index.html FTC Health Privacy: https://www.ftc.gov/business-guidance/privacy-security/health-privacy FTC Health Breach Notification Rule: https://www.ftc.gov/legal-library/browse/rules/health-breach-notification-rule California Privacy Protection Agency: https://cppa.ca.gov/ Washington My Health My Data Act information: https://www.atg.wa.gov/protecting-washingtonians-personal-health-data-and-privacy FTC COPPA: https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa FTC July 2026 Hims & Hers enforcement announcement: https://www.ftc.gov/news-events/news/press-releases/2026/07/ftc-states-act-against-hims-hers-deceptive-unlawful-privacy-practices

89. END OF

LIABILITY - INDEMNIFICATION - DISPUTE RESOLUTION

1. MDTELEMED LLC

2. LIABILITY, INDEMNIFICATION & DISPUTE RESOLUTION POLICY

Version 1.0 | September 15, 2026

3. PURPOSE

This Policy establishes MDTelemed LLC's baseline framework for allocation of contractual risk, limitation of liability, indemnification, dispute resolution, consumer arbitration, medical-professional liability, technology limitations, third-party services, and preservation of nonwaivable patient rights

4. CLINICAL STANDARD OF CARE IS NOT DISCLAIMED

Nothing in this Policy is intended to disclaim, reduce, or contract around a physician's applicable professional standard of care where the law does not permit that result. Telemedicine changes the modality of care; it does not eliminate professional responsibility.

5. NO GUARANTEE OF CLINICAL OUTCOME

Medicine involves uncertainty. MDTelemed and its physicians do not guarantee a diagnosis, cure, medication response, symptom resolution, test result, referral outcome, absence of adverse effects, or any other particular clinical result.

6. NO GUARANTEE OF PRESCRIPTION

Use of MDTelemed does not guarantee that a physician will prescribe medication, refill medication, order testing, provide a work note, make a referral, certify a condition, or provide another requested outcome.

7. TELEMEDICINE LIMITATIONS

Remote care can limit palpation, auscultation, direct examination, point-of-care testing, imaging, immediate laboratory testing, procedures, and other elements available in person. A physician may determine that telemedicine is insufficient and direct the patient to in-person, urgent, emergency, or specialist care.

8. PATIENT DUTY TO PROVIDE ACCURATE INFORMATION

Patients should provide materially accurate and complete information about identity, physical location, symptoms, history, medications, allergies, pregnancy status when relevant, prior diagnoses, test results, and other information reasonably requested for care.

9. PATIENT FAILURE TO DISCLOSE INFORMATION

A patient's intentional or material failure to disclose information may affect clinical decision-making. This provision does not automatically eliminate a physician's independent duties or create a blanket defense to professional negligence.

10. FOLLOW-UP AND ESCALATION

Patients are responsible for following reasonable instructions concerning emergency escalation, in-person evaluation, testing, medication monitoring, referrals, and follow-up. Failure to follow instructions may create clinical risk, but the legal consequences depend on the facts and applicable law.

11. EMERGENCIES

MDTelemed is not a substitute for 911 or an emergency department. Patients with a medical or psychiatric emergency should use emergency services. A contractual disclaimer does not authorize MDTelemed to ignore an emergency recognized during an encounter.

12. TECHNOLOGY IS NOT MEDICINE

Website, app, scheduling, payment, messaging, identity-verification, AI, and communications technologies support care but are not themselves the physician's medical judgment.

13. TECHNOLOGY AVAILABILITY

MDTelemed does not promise that every digital function will be uninterrupted, latency-free, error-free, compatible with every device, or continuously available. Planned maintenance, vendor failures, internet outages, device problems, cyber incidents, force-majeure events, and other interruptions may occur.

14. REASONABLE TECHNOLOGY SAFEGUARDS

The original draft purported to disclaim 'technology security.' MDTelemed will not use that formulation. MDTelemed must implement reasonable and appropriate privacy and security safeguards required by applicable law; governs security and cybersecurity.

15. NO ABSOLUTE CYBERSECURITY GUARANTEE

No information system can truthfully promise zero risk of unauthorized access or cyberattack. MDTelemed does not guarantee absolute security, but this statement does not waive statutory privacy, breach-notification, security, contractual, or negligence obligations.

16. THIRD-PARTY INTERNET AND DEVICES

MDTelemed is generally not responsible for failures caused solely by a patient's internet service, cellular carrier, device, operating system, browser, camera, microphone, power supply, or other technology outside MDTelemed's control, subject to applicable law.

17. THIRD-PARTY VENDORS

MDTelemed may rely on technology, payment, communications, laboratory, pharmacy, identity, cloud, e-prescribing, or other vendors. Vendor use does not automatically eliminate MDTelemed's own contractual, privacy, security, selection, oversight, or statutory obligations.

18. EXTERNAL CLINICAL PROVIDERS

A laboratory, imaging center, pharmacy, specialist, hospital, emergency department, or other independent provider may make independent decisions and may have its own terms, fees, privacy practices, and professional obligations.

19. NO CONTROL OVER INDEPENDENT THIRD PARTIES

To the extent permitted by law, MDTelemed is not responsible for independent acts or omissions of third parties it does not control merely because a physician recommended, referred, transmitted information to, or interacted with that third party. Agency and vicarious-liability questions depend on actual facts and law.

20. PROFESSIONAL LIABILITY INSURANCE

MDTelemed should maintain and require professional-liability coverage appropriate to its actual clinical model and contractual obligations. Coverage limits, carriers, retroactive dates, tail obligations, and state-specific requirements are operational matters and should not be invented in the public policy.

21. GENERAL LIABILITY AND CYBER COVERAGE

The company should evaluate general liability, cyber/privacy, technology errors and omissions, directors and officers, employment, crime, and other coverage appropriate to its risks. Insurance does not replace legal compliance.

22. PRIVACY AND SECURITY RIGHTS

Nothing in this Policy eliminates rights or remedies under HIPAA, state medical-privacy laws, consumer health-data laws, breach-notification statutes, biometric/privacy laws, or other applicable privacy and security requirements.

23. CONSUMER-PROTECTION RIGHTS

Nothing in this Policy authorizes deceptive, unfair, fraudulent, or misleading conduct or waives consumer rights that applicable law makes nonwaivable.

24. INFORMED CONSENT

Telehealth informed consent is governed by and applicable state law. A patient's agreement to telemedicine is not a blanket waiver of negligent care.

25. ASSUMPTION OF RISK - LIMITED CONCEPT

Patients may accept inherent limitations and reasonably disclosed risks of telemedicine. Version 1.0 does not state that a patient assumes 'ALL RISK' of using MDTelemed.

26. SERVICE-FEE REFUNDS

Refunds, duplicate charges, failed services, memberships, and billing disputes are governed principally by . A refund of a visit fee does not necessarily resolve or release an unrelated legal claim unless a valid settlement expressly provides otherwise.

27. NO AUTOMATIC RELEASE BY REFUND

MDTelemed should not condition an ordinary billing correction or refund on a broad release of medical-malpractice, privacy, discrimination, or other unrelated claims unless separately reviewed and lawfully agreed.

28. DISPUTE-RESOLUTION GOAL

MDTelemed should attempt to resolve routine service, billing, access, and administrative disputes promptly and fairly before escalation, without obstructing statutory complaint rights or urgent legal remedies.

29. INFORMAL NOTICE PROCESS

A final Terms of Service may require written notice of certain contractual disputes and a reasonable informal resolution period before arbitration or litigation, provided the process is not used to shorten nonwaivable deadlines or create an unreasonable barrier.

30. PATIENT GRIEVANCES

governs patient complaints and grievances. A patient need not waive legal or regulatory rights merely to submit a grievance.

31. BUSINESS ASSOCIATE AGREEMENTS

A HIPAA Business Associate Agreement allocates specified privacy/security responsibilities but is not a substitute for a complete commercial indemnification and liability analysis.

32. AI TELESCRIBE

MDTelemed's AI-assisted telescribe supports documentation. It does not independently diagnose, prescribe, or replace the treating physician. Liability allocation for AI vendors and documentation errors must match the actual technical workflow and contracts.

33. PHYSICIAN REVIEW OF AI OUTPUT

The treating physician is responsible for reviewing and finalizing the clinical note. The platform should not use a patient-facing disclaimer to excuse a known documentation defect that materially affects care.

34. AI HALLUCINATIONS AND TRANSCRIPTION ERRORS

AI systems can omit, mistranscribe, or generate incorrect content. MDTelemed should implement safeguards, physician review, correction mechanisms, audit processes, and vendor controls rather than merely disclaim all AI accuracy.

35. RELIANCE ON PATIENT-UPLOADED CONTENT

Photos, documents, home measurements, wearable data, and patient-entered information may be incomplete or inaccurate. The physician determines whether such information is adequate for clinical use.

36. HOME DEVICES

MDTelemed does not guarantee the accuracy of a patient's thermometer, blood-pressure cuff, pulse oximeter, scale, glucose meter, wearable, or other home device. Clinicians should escalate when reliable objective measurements are necessary.

37. LINKS AND EDUCATIONAL MATERIAL

Educational content and third-party links do not create a guarantee that every linked resource is continuously accurate or available. Clinical instructions specific to the patient control over generic educational content when inconsistent.

38. FORCE MAJEURE

A final agreement may excuse certain non-clinical performance delays caused by events beyond reasonable control, but force-majeure language should not excuse statutory duties, known safety obligations, or conduct within MDTelemed's reasonable control.

39. ACCOUNT SUSPENSION

MDTelemed may suspend or terminate access for fraud, abuse, threats, security misuse, nonpayment, or material policy violations, subject to applicable law and appropriate continuity-of-care considerations.

40. CONTINUITY OF CARE

Account termination does not authorize unsafe abandonment of an established clinical relationship. governs continuity, transition, records, refills where appropriate, and emergency instructions.

41. SURVIVAL

Provisions concerning payment obligations, confidentiality, IP, dispute resolution, lawful indemnification, records, and other terms may survive account termination where appropriate and enforceable.

42. NO THIRD-PARTY BENEFICIARIES

Unless a final agreement expressly states otherwise or law requires otherwise, patient-facing contractual terms generally should not create unintended rights in unrelated third parties.

43. CONTACT

MDTelemed LLC 304 S Jones Blvd #4872 Las Vegas, NV 89107 Business Administration / General Contact: Support@MDTelemed.com

44. PATIENT-FACING SUMMARY

MDTelemed does not guarantee a diagnosis, prescription, cure, or particular treatment outcome. Telemedicine has limitations, and a physician may require in-person, urgent, emergency, laboratory, imaging, or specialist evaluation. Agreeing to telemedicine is not a blanket waiver of negligent medical care.