PRIVACY POLICY AND NOTICE OF PRIVACY PRACTICES

Brain & Spine Center of Southeast Texas d/b/a spineTECH Effective Date: August 10, 2026 THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED, HOW YOU CAN GET ACCESS TO THIS INFORMATION, AND HOW INFORMATION MAY BE COLLECTED WHEN YOU USE OUR WEBSITE. PLEASE REVIEW IT CAREFULLY. Brain & Spine Center of Southeast Texas, doing business as spineTECH, respects the privacy of our patients and website visitors. This Privacy Policy and Notice of Privacy Practices explains: • how we may use and disclose your protected health information; • your rights regarding your health information; • our responsibilities for protecting your health information; and • certain privacy practices relating to our website at https://www.spinetech.com. This Notice applies to spineTECH and the physicians, health care professionals, employees, staff, and other workforce members who provide services through our practice. OUR RESPONSIBILITIES spineTECH is required by law to: • maintain the privacy and security of your protected health information; • provide you with this Notice describing our legal duties and privacy practices; • follow the terms of the Notice currently in effect; and • notify you if a breach occurs that may have compromised the privacy or security of your protected health information when notification is required by law. We will not use or disclose your protected health information other than as described in this Notice unless you authorize us in writing or the use or disclosure is otherwise permitted or required by law. If you give us written authorization, you may revoke that authorization in writing at any time. Your revocation will not affect actions we already took in reliance on your authorization. We reserve the right to change the terms of this Notice and to make revised provisions effective for all protected health information we maintain, including information created or received before the change. If we materially revise this Notice, the revised Notice will be made available at our offices and on our website at: https://www.spinetech.com/privacy A paper copy is also available upon request. HOW WE MAY USE AND DISCLOSE YOUR HEALTH INFORMATION Federal and state law permit us to use and disclose protected health information without your written authorization in certain circumstances. Treatment We may use or disclose your health information to provide, coordinate, or manage your medical care. For example, we may share information with another physician, hospital, imaging facility, laboratory, therapist, pharmacy, or other health care professional involved in your treatment. Payment We may use or disclose your health information to bill for health care services and obtain payment. For example, we may provide information to your health insurance plan or another responsible party to obtain payment, determine eligibility or benefits, or obtain prior authorization for treatment. Health Care Operations We may use and disclose health information as necessary to operate our medical practice and improve the quality of our services. Examples include: • evaluating patient care and outcomes; • reviewing physician or staff performance; • staff training; • credentialing; • compliance activities; • auditing; • legal and accounting services; • business planning; • billing activities; • patient safety activities; and • other administrative functions. Your medical record may include both paper and electronic records. Appointment Reminders and Communications We may use your information to communicate with you about: • appointment requests; • appointment confirmations or reminders; • scheduling changes; • treatment information; • test or imaging coordination; • requests to contact our office; • follow-up care; and • other matters related to your care or our services. Depending on the contact information you provide, we may communicate with you by: • telephone; • voicemail; • text message; • email; • mail; or • patient portal. Ordinary email and SMS/text messaging may not be encrypted or fully secure. Message and data rates imposed by your wireless provider may apply. You may request reasonable changes to the way we communicate with you by contacting our office. Family, Friends, and Others Involved in Your Care When appropriate and permitted by law, we may disclose health information relevant to your care or payment for your care to a family member, close friend, caregiver, or another person involved in your care. When you are available, we will generally provide you an opportunity to agree or object. If you are unable to tell us your preference, we may use professional judgment to determine whether a disclosure is in your best interest and permitted by law. Other Permitted or Required Uses and Disclosures We may also use or disclose health information without your written authorization when permitted or required by law, including for: • public health activities; • reporting certain diseases or conditions; • reporting suspected abuse, neglect, or domestic violence where permitted or required; • preventing or reducing a serious threat to health or safety; • health oversight activities; • research permitted under applicable law; • compliance with federal or Texas law; • workers' compensation matters; • certain law-enforcement purposes; • judicial or administrative proceedings; • responding to lawful court orders or other legal process; • organ and tissue donation; • coroners and medical examiners; • funeral directors; • military and veterans activities; • national security and intelligence activities; • correctional institutions or lawful custody; and • other governmental functions authorized by law.

USES GENERALLY REQUIRING YOUR AUTHORIZATION Except where otherwise permitted or required by law, we generally will obtain your written authorization before: • using or disclosing protected health information for certain marketing purposes; • selling protected health information; • using or disclosing most psychotherapy notes, if applicable; or • using or disclosing your information for another purpose not described in this Notice. SUBSTANCE USE DISORDER RECORDS Federal law provides additional protection for certain records relating to substance use disorder treatment that are protected under 42 CFR Part 2. To the extent spineTECH receives or maintains records protected by Part 2, those records will be handled in accordance with applicable federal requirements. Certain Part 2 records may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you unless you provide appropriate written consent or disclosure is authorized by an appropriate court order and other applicable legal requirements are satisfied. YOUR PRIVACY RIGHTS You have certain rights concerning your protected health information. Inspect or Obtain a Copy of Your Medical Record You may ask to inspect or obtain an electronic or paper copy of your medical record and other health information we maintain about you. We generally will provide access or a copy within the time required by law. We may charge a reasonable, cost-based fee where permitted. Certain limited information may not be available for inspection or copying under applicable law. Request an Amendment If you believe information in your medical record is incorrect or incomplete, you may ask us to amend it. We may deny the request in certain circumstances, including if we believe the information is accurate and complete or if we did not create the information. If your request is denied, we will provide an explanation as required by law. Request Confidential Communications You may ask us to communicate with you in a particular way or at a particular location. For example, you may request that we call a specific telephone number or mail information to a different address. We will accommodate reasonable requests as required by law. Request Restrictions You may ask us not to use or disclose certain information for treatment, payment, or health care operations. We generally are not required to agree to such requests. However, if you pay for a health care service in full out of pocket, you may ask us not to disclose information concerning that service to your health plan for payment or health care operations purposes. We will honor that request unless disclosure is required by law. Obtain an Accounting of Certain Disclosures You may request a list of certain disclosures of your protected health information made during the six years before your request. The accounting generally will not include disclosures for treatment, payment, health care operations, disclosures made directly to you, disclosures made pursuant to your authorization, or certain other disclosures excluded by law. You are entitled to one accounting during a 12-month period without charge. We may charge a reasonable fee for additional requests as permitted by law. Obtain a Paper Copy of This Notice You may request a paper copy of this Notice at any time, even if you have received it electronically. Have Someone Act for You If another person has legal authority to act for you, such as through a medical power of attorney or legal guardianship, that person may exercise applicable privacy rights on your behalf. We may require documentation verifying that authority. PRIVACY COMPLAINTS If you believe your privacy rights have been violated, you may file a complaint with spineTECH. Contact: Privacy Officer Brain & Spine Center of Southeast Texas d/b/a spineTECH Email: [email protected] Telephone: (409) 234-7088 You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. spineTECH will not retaliate against you for filing a privacy complaint or exercising your privacy rights.

WEBSITE PRIVACY The following provisions apply specifically to use of https://www.spinetech.com. Information You Provide Through Our Website Our Website may allow you to: • request an appointment; • submit a Contact Us form; • obtain information about our practice and medical services; and • access a link to our patient portal. Our general Contact Us forms are intended for general inquiries and administrative communications. Please do not submit protected health information or highly sensitive personal information through a general Contact Us form. Please do not include: • detailed medical histories; • diagnoses; • medical records; • test or imaging results; • full insurance identification numbers; • Social Security numbers; • driver's license or government identification numbers; • credit card or bank information; or • other sensitive financial or identification information. If you need to communicate medical information, please contact our office or use a communication method specifically designated by spineTECH for that purpose. If protected health information is nevertheless provided to or received by spineTECH, applicable legal protections are not eliminated merely because the information was submitted through a general website form. Information Collected Automatically When you visit our Website, certain technical information may be collected automatically, including: • IP address; • device and browser information; • operating system; • pages visited; • referring website; • approximate geographic information; • dates and times of visits; and • information regarding Website use and navigation. This information may be collected through cookies, server logs, and similar technologies. Google Analytics We use Google Analytics to help us understand Website traffic, usage, and performance. Google Analytics may collect technical and usage information through cookies and similar technologies. spineTECH does not authorize Google Analytics to collect the contents of information submitted through Website forms or authenticated patient portal information. Microsoft Clarity We use Microsoft Clarity to help us understand Website navigation, usability, and interactions. Clarity may use cookies and similar technologies to collect technical and Website interaction information. spineTECH does not authorize Microsoft Clarity to collect the contents of information submitted through Website forms or authenticated patient portal information. We may limit or disable analytics technologies on particular pages or features where appropriate based on the nature of the information involved and applicable law. Cookies Our Website may use cookies and similar technologies to: • operate Website features; • maintain security; • understand Website traffic; • evaluate Website performance; • identify technical problems; and • improve Website functionality and usability. Your browser may allow you to block or delete cookies. Doing so may affect certain Website features. Patient Portal — healow Our Website provides a link to the healow patient portal. Selecting the patient portal may redirect you away from spinetech.com to a separate website, application, or environment operated through healow. The healow environment maintains its own terms, privacy notices, and security practices. Health information maintained by spineTECH through the patient portal remains subject to applicable health information privacy requirements and this Notice where applicable. We encourage you to review the privacy policy and terms presented by healow when using that service. Third-Party Websites Our Website may contain links to external websites or services. Except where a third party is acting on behalf of spineTECH and applicable law provides otherwise, spineTECH does not control the privacy, security, or information practices of independent third-party websites. Use of those websites is subject to their respective terms and privacy policies. Sale and Advertising Use of Health Information spineTECH does not sell protected health information. We do not authorize protected health information submitted to us through patient communications to be used for third-party targeted advertising. Google Analytics and Microsoft Clarity are used for Website analytics, performance, and usability purposes rather than for allowing those providers to receive patient-submitted medical information for targeted advertising. MEDICAL EMERGENCIES DO NOT USE OUR WEBSITE, CONTACT FORM, EMAIL, TEXT MESSAGE, OR PATIENT PORTAL FOR A MEDICAL EMERGENCY. Electronic communications may not be reviewed immediately. If you believe you are experiencing a medical emergency, call 911 or seek immediate emergency medical care. QUESTIONS OR CONCERNS If you have questions regarding this Notice, your privacy rights, or spineTECH's privacy practices, please contact: Privacy Officer Brain & Spine Center of Southeast Texas d/b/a spineTECH Beaumont Office 711 S. 11th St., Suite 102 Beaumont, Texas 77701 Telephone: (409) 234-7088 The Woodlands / Shenandoah Office 111 Vision Park Blvd., Suite 270 Shenandoah, Texas 77384 Telephone: (936) 647-0202 Email: [email protected] Website: https://www.spinetech.com Privacy Policy / Notice of Privacy Practices: https://www.spinetech.com/privacy Effective Date: August 10, 2026