Notice of Privacy Practices

This notice applies to Thryve Mental Health, Inc. ("Thryve," "we," "our" or "us") and everyone who works with us to care for you: our therapists, psychiatric providers and other licensed clinicians, our care coordinators, billing and front-desk staff, and our trainees and volunteers. It covers the health information we create or receive about you in person, by video and through the Thryve client portal.

Your health information includes anything that identifies you and relates to your past, present or future physical or mental health, the care you receive, or payment for that care. The law calls this "protected health information."

The law requires us to:

• Keep your health information private and secure.
• Give you this notice of our legal duties and privacy practices, and follow the notice currently in effect.
• Tell you promptly if a breach happens that may have compromised the privacy or security of your information.
• Not use or share your information other than as described here unless you tell us in writing that we can. You can change your mind at any time by letting us know in writing.

Where Minnesota law is stricter than federal law, we follow Minnesota law. Under the Minnesota Health Records Act, we generally ask for your consent before sharing your records outside Thryve, even for some purposes federal law would allow without it. Section 5 explains when we need your permission.

These are the main ways we use and share your health information. Not every use is listed, but everything we do falls into one of these categories.

To treat you

Your providers use your information to assess you, plan your care and track your progress. Your Thryve care team may share it with one another, for example when a therapist and a psychiatric provider coordinate your care. With your consent, or when the law allows it, we may also share it with other professionals who treat you, such as your primary care doctor or a hospital in an emergency.

To bill for your care

We use and share your information to bill and get paid by you, your health plan or another payer. For example, we give your insurer the dates of your visits, your diagnosis and the services you received, and we may ask your plan to confirm your benefits before your first session.

To run our practice

We use your information to operate the practice, improve care and train our staff. For example, we review records to check the quality of our services, and we keep an audit trail of who has opened your record.

Reminders and updates

We may contact you by email, text or through the portal to remind you of appointments, ask you to complete forms or let you know about a message from your provider. We keep these messages brief and leave details in the secure portal.

Our service partners

Some services are handled for us by outside companies, such as secure hosting, video sessions, email delivery, billing and, with your separate consent, AI tools that help your provider write session notes. These companies are called business associates. They must sign a contract promising to protect your information and to use it only for the work they do for us.

People involved in your care

If you tell us to, we may share information with a family member, friend or other person you name who is involved in your care or helps pay for it. If you can't tell us your preference, for example in an emergency, we may share what we believe is in your best interest and tell you afterward.

We may share your information, only as much as needed and only when the law permits it, in these situations:

• When the law requires it. We share information when federal, state or local law requires us to.
• To prevent serious harm. If you or someone else faces a serious and imminent threat to health or safety, we may share information with people who can help prevent or lessen it, including a person who has been threatened.
• Abuse and neglect. As mandated reporters, we report suspected abuse or neglect of a child or a vulnerable adult to the authorities.
• Public health and safety. For example, to prevent disease or to report problems with medications.
• Health oversight. To agencies that license, audit and inspect health care providers, such as the Minnesota Board of Psychology or Board of Behavioral Health and Therapy.
• Lawsuits and legal proceedings. In response to a court order. A subpoena alone isn't enough for mental health records; we ask for your written consent or a court order.
• Law enforcement. In limited cases, such as responding to a court order or warrant, or reporting a crime on our premises.
• Coroners and medical examiners. To identify a person who has died or find the cause of death.
• Specialized government functions. For military, national security or protective services, as the law allows.
• Workers' compensation. For claims under workers' compensation laws.
• Research. Only with your written permission, or when a review board approves a study under strict privacy rules.
• The U.S. Department of Health and Human Services. When it reviews whether we comply with federal privacy law.

For any use or sharing not described above, we ask for your written permission (an authorization) first. We always need it to:

• Share your records with someone outside Thryve when Minnesota law requires your consent, such as another provider who isn't treating you in an emergency, a lawyer, or an employer.
• Share most of your provider's psychotherapy notes (see section 6).
• Use your information for marketing.
• Sell your information. We never sell it.

You can cancel an authorization at any time by writing to us. Cancelling stops future sharing, but it can't undo what we already shared while it was in effect.

Psychotherapy notes

Some therapists keep personal notes about a session's conversation, separate from your medical record. The law gives these notes extra protection: we don't share them without your written permission except in a few cases the law sets out, such as to prevent serious harm or to defend ourselves in a legal action you bring.

Substance use treatment records

If you receive substance use disorder treatment that is covered by federal confidentiality rules (42 CFR Part 2), those records have additional protections. We won't use them in a civil, criminal or administrative case against you without your written consent or a court order.

Care for minors

When we care for someone under 18, a parent or legal guardian usually has the right to see their records. Minnesota law lets some minors consent to their own care and control who sees those records, and a provider may withhold information when sharing it could harm the young person. We'll explain how this applies to your family.

Session recordings

We only record or transcribe a session when you've agreed to it in a separate consent. You can withdraw that consent at any time, and your provider will stop recording your sessions.

You have the following rights about your health information. To use any of them, write to our Privacy Officer at the address in section 8, or send a message through the portal.

• See and get a copy of your records. You can ask to see or get a copy of your health and billing records, on paper or electronically. We'll respond within 30 days and may charge a reasonable, cost-based fee. In rare cases, if a provider believes seeing part of your record could seriously harm you, we may give a summary instead and tell you how to ask for a review.
• Ask us to correct your records. If you think something in your record is wrong or incomplete, you can ask us to correct it. If we say no, we'll explain why in writing within 60 days, and you can add a statement of disagreement to your record.
• Ask for confidential communications. You can ask us to contact you a certain way, for example only by email or at a different address. We'll agree to any reasonable request.
• Ask us to limit what we use or share. You can ask us not to use or share certain information for treatment, payment or our operations. We aren't required to agree, and we may say no if it would affect your care. If you pay for a service in full out of pocket, you can ask us not to share it with your health plan, and we'll agree unless the law requires us to share it.
• Get a list of who we've shared your information with. You can ask for a list of the times we've shared your information in the six years before your request, who we shared it with and why. The list leaves out sharing for treatment, payment and operations and sharing you authorized. One list a year is free; we may charge a reasonable fee for more.
• Get a copy of this notice. You can ask for a paper copy at any time, even if you agreed to receive it electronically.
• Choose someone to act for you. If you've given someone medical power of attorney, or someone is your legal guardian, that person can use your rights and make choices about your information. We'll check they have this authority first.

If you have questions about this notice, or believe your privacy rights have been violated, contact our Privacy Officer:

You can also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights:

We will not retaliate against you for filing a complaint.