This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

Effective date of this notice: October 12, 2026
Questions about this notice: Privacy Officer · 833.320.1091 · hello@revealmri.com

This is a joint notice of Reveal MRI, Inc. (“Reveal MRI”) and White Coat Wellness, PLLC (“White Coat”), the medical practice whose licensed clinicians provide your pre-scan medical review and medical oversight. Together, “we” and “us” mean both. Reveal MRI and White Coat work together to provide your care and share your health information with each other as needed for treatment, payment and health care operations. This notice also covers our imaging locations, staff, radiologists and independent contractors, including through our patient dashboard at my.revealmri.com. We are required by law to keep your protected health information (“PHI”) private, to give you this notice of our legal duties and privacy practices, to follow the notice currently in effect, and to notify you if a breach affects your unsecured PHI. Each of us remains responsible for its own compliance.

1. How we may use and share your health information without your written authorization

• Treatment. To perform your MRI, CT or lab services; for your pre-scan telehealth review; for radiologists to read your images; and, if you ask us to, to share your results with other providers who treat you. Otherwise, your results are given to you, and you decide who to share them with. If your results show a critical or urgent finding and we cannot reach you promptly, we may contact your physician or emergency services with the information needed for your care.
• Payment. Reveal MRI is cash-pay and does not bill insurance. We use your information to collect payment from you, a card processor, or a financing company you choose.
• Health care operations. Quality review, peer review of image reads, staff training, accreditation, audits, legal services, equipment troubleshooting, customer service and running our business.
• Business associates. Vendors that perform services for us (such as cloud hosting, the patient dashboard, teleradiology, laboratory partners including for the Galleri® test, payment processing, scheduling and shipping) may receive PHI only under a written Business Associate Agreement requiring them to protect it.
• Appointment reminders, results and service information. To contact you about your appointment, preparation, results and follow-up.
• People involved in your care. To a family member, friend or other person you identify who is involved in your care or payment, unless you object. In an emergency or if you cannot agree, we use professional judgment.
• As required by law and for public interest purposes, as permitted by HIPAA: public health reporting and preventing disease; reporting abuse, neglect or domestic violence; health oversight audits and inspections; FDA reporting; lawsuits and legal proceedings (court order, subpoena); law enforcement; coroners, medical examiners and funeral directors; organ and tissue donation; research approved under HIPAA rules; preventing a serious threat to health or safety; military, veterans, national security and protective services; workers’ compensation; and correctional institutions.
• De-identified information. We may create and use information that no longer identifies you (for example, de-identified images) for quality improvement, research and service development. De-identified information is not PHI.

2. Uses that require your written authorization

We will not do any of the following without your signed authorization: use or share your PHI for marketing (including testimonials, photos, videos, case studies or social media featuring you); sell your PHI; or share psychotherapy notes. Any use not described in this notice also requires your authorization. You may revoke an authorization in writing at any time, except to the extent we already acted on it. We will never require you to sign a marketing authorization to receive care.

3. Specially protected information

Some federal and state laws give extra protection to certain information, such as HIV/AIDS status, genetic and genomic test results (including multi-cancer early detection blood tests), mental health, substance use disorder treatment records, and reproductive and sexual health information. Where a law is stricter than HIPAA, we follow the stricter law.

4. Your rights

• Get a copy of your records, including images and your Reveal Report, on paper or electronically. We will respond within 30 days (with up to one 30-day extension if we tell you why). We may charge a reasonable, cost-based fee.
• Ask us to correct information you believe is wrong or incomplete. We may say no, but will tell you why in writing within 60 days.
• Ask for confidential communications, such as a different phone number, address or contact method. We will agree to reasonable requests.
• Ask us to limit what we use or share. We are not required to agree, but if we do, we will honor it except in an emergency. Because all Reveal MRI services are paid out of pocket, we do not send your information to a health plan unless you ask us to or the law requires it.
• Get a list of disclosures we made in the prior six years, other than for treatment, payment, operations and certain other purposes. One list per year is free.
• Get a paper copy of this notice at any time, even if you agreed to receive it electronically.
• Choose someone to act for you. A medical power of attorney or legal guardian may exercise your rights. We will verify their authority.
• Be notified of a breach of your unsecured PHI.

To use any right, send a written request to the Privacy Officer at the address or email below.

5. Email, text, telehealth and the patient dashboard

Our patient dashboard and telehealth visits use secure, access-controlled systems. Standard email and text messages are not fully secure and could be read by others. If you ask us to communicate by unencrypted email or text, we will honor your request after telling you about this risk. Our public website uses cookies and analytics tools as described in our Website Privacy Policy at revealmri.com/privacy. We do not permit advertising or analytics vendors to use your PHI for their own purposes, and we share PHI with technology vendors only as HIPAA allows. Your PHI is stored in the United States. No system is perfectly secure, but we use administrative, physical and technical safeguards required by HIPAA.

6. Changes to this notice

We may change this notice, and the change will apply to all information we have about you. The current notice is posted at our locations and on our website, and you may request a copy at any time.

7. Questions and complaints

If you believe your privacy rights were violated, you may file a complaint with us or with the federal government. We will not retaliate against you for filing a complaint.