HALSTEAD MANAGEMENT COMPANY, LLC 

PRIVACY POLICY 

The Terra Holdings, LLC group of affiliated companies, including the Brown Harris Stevens brokerage companies, operating as individually licensed companies in New York, Connecticut, New Jersey and Florida, Brown Harris Stevens Residential Management, LLC, and Halstead Management Company, LLC (collectively referred to herein as the “Company,” “we” or “us”) are committed to protecting the privacy of personal information we collect and the users of services and our websites, including www.bhsusa.com, www.bhsmanagement.com, www.halsteadmanagement.com and any other websites owned or and controlled by the Company or its affiliates (collectively, the “Website”). 

Scope of Policy 

This statement discloses how we collect, use, and disclose personal information collected through our Website and other business services, products, and technology, including emails, texts, electronic communications, applications (the “Services”). Different Websites collect different personal information and use different collection and sharing techniques; our brokerage and management Companies provide different Services and collect different information; however the purpose of this statement is to inform you in the broadest manner of: 

• What kinds of information we collect; 

• How such information is collected; 

• How we use the information; 

• How we use third party vendors and other third parties who may have access to information through our Website or your use of the Services; and 

• How you can access, obtain copies of, update, and delete any personal information we collect or opt out from our communications. 

By using the Website and Services, you signify your assent to this Privacy Policy. We reserve the right to change, modify, add, or remove portions of our Privacy Policy at any time. If so, any such changes will be posted on this page. Please check this page periodically for changes. Your continued use of this Website and Services following the posting of changes to the Company Privacy Policy will mean you accept those changes. 

This Privacy Policy does not apply to third parties that we do not own or control that may provide Services or to third party websites that may link to or be accessible through our Website or use of our Services. It does not apply to information collected offline or to information collected by our independent contractors/real estate agents outside of our Website. Our Website is intended for customers and residents of US properties and is not intended for children under the age of 18. If you believe we have collected information about an underage child, please contact us and we will delete it. If you have any questions about our Privacy Policy, please e-mail us at privacy@terraholdings.com. 

Types of Information Collected and How Information is Collected 

Generally, we collect: 

• Information you provide by visiting our Website or using our Services, your correspondence with us, information provided when you complete forms and registrations, and other interactions. This information may contain personally identifiable information (“PII”); 

• Information about your internet and mobile connections, devices, IP addresses, equipment, and use; 

• Information about your searches and preferences; 

• Information from our third party business partners; and 

• Information from automatic data collection technologies, including information about your use of the Services and information about your computer, internet devices and connections. 

Automatic Data Collection Technologies 

• We may use tracking technologies to collect information about your online activities across our Website and other online locations. This data, along with statistics and other information we automatically gather, helps us improve our Services. 

• To do this, we may use: 

• Cookies, which are text files stored in your computer, to make it easier for you to navigate our Services, store your passwords, etc. You may set your browser to refuse cookies, but it may affect your ability to access some of our Services. 

• Web Beacons, which are web files (gifs or pixel tags) that permit us to gather statistics about visitors, emails that are opened, etc. 

• Flash Cookies, which collect information about your preferences and navigation to and from the Website. 

Third Party Sites and Data Collection 

• We may obtain information from third parties, such as advertisers, and third party providers of Services, servers, content, and internet services. They may use Cookies, Web Beacons or other technologies. They may provide you with advertising or other content. 

• Other third parties, such as bill payment services, payroll services, sale and leasing application packagers, and others may collect your personal information in the process of assisting us in providing Services to you. 

• We may also receive information from other third party providers such as Google, Facebook, Zillow (StreetEasy) and others. We use Google Analytics to improve our Website and Services. For information on how Google uses information from sites that use their services, go to www.google.com/policies/privacy/partners/. Some sources, like www.google.com/analytics and www.facebook.com/about/privacy enable you to exercise choice about tracking online behavior. 

• If you use a third party service provider or go from our Website to a third party link, we do not control those sites. Our privacy policy and other policies do not apply, and you are subject to the third party site’s privacy policy, terms and conditions, and other provisions. Please make sure you review them. 

Use of Information 

• We retain and use your PII and other information you provide for our own internal purposes in connection with facilitating, documenting, and processing inquiries, requests, and interactions with our Website, and to fulfil any other purpose for which you provide the information and to fulfill our obligations when you use our Services. 

• We use your PII to perform our management and brokerage duties, including reporting, processing, payments, and notifications. 

• We do not sell your PII to third parties, nor do we create profiles that are used for employment or housing approval purposes. 

• We also use information from both our own and third-party sources to improve our Services, by storing preferences, speeding up searches, and recognizing you when you return to our Website. 

• We use information to do research, develop new processes and services, to fulfill our obligations, and satisfy legal requirements. 

• In addition, your information may be used to provide updates about our products, services, and promotions, as well as to fulfill our contractual and legal obligations to clients, such as sellers, buyers, landlords, tenants, managed buildings, and others. We may use your e-mail or text address to send you special announcements and notifications of new real estate listings or offers that may be of interest to you. 

Information Sharing and Disclosure 

We share information in the circumstances described below: 

• AGENTS. We may share your information with our team of Company brokers and agents, who may use this information to contact you about our brokerage services. 

• AFFILIATES. We may provide information to our affiliated businesses, including Vanderbilt Appraisal, Vanderbilt Insurance, and our management and sales divisions, to the extent their services may be useful to you and that information, on an aggregated basis, may be useful to improve their activities. 

• BUSINESS TRANSFERS. If any part or all of our business is sold, we may have to provide information to the purchaser in order that they may continue to provide Services to you. Any such transfer is subject to all applicable laws and governmental regulations regarding the transfer and sale of such data. 

• THIRD PARTY ENTITIES. We work with third party vendors, partners, and service providers and may combine their data with our data to provide better Services, products, and experience to our clients and agents. To the extent necessary in providing our Services, fulfilling our obligations to you and our clients, or responding to your requests, we share your information with such third party entities to help us provide the Services. We may also share data with third parties for business purposes, including without limitation cyber security, fraud prevention, bill collection, contract enforcement, distribution, financial, accounting, and legal purposes. 

• LEGAL OBLIGATIONS. We release information when necessary to comply with any law, regulation, legal process, governmental request, or reporting obligation. We share information to comply with MLS/RLS listing requirements; to enforce our Terms and Conditions of Use and this Privacy Policy; and to protect the rights, property, or safety of the Company, our clients and customers and the public. Information will be shared with governmental entities, professionals, and others as required by our legal and contractual obligations. 

• COMMUNICATIONS. By providing us with contact information, you consent to communications, electronically or otherwise, from us and our Agents regarding our Services. We may share your contact information with our client landlords, property owners, buyers, sellers, and others, who may contact you to the extent necessary to satisfy their obligations to you or engage in communications in connection to your request for real estate services. 

Artificial Intelligence 

Artificial intelligence (AI) is of growing use in all businesses. The Company believes that AI should be used to speed and improve its responses but remains dedicated to providing the most professional available human staff and agents to satisfy its client and customer needs. The Company does not provide files to third parties for machine learning purposes or use AI to create profiles for automated decision making. 

Accessing, Updating or Deleting Information and Opt-Out Instructions 

• If you wish to access, update, or delete contact information or preferences, please send an email to privacy@terraholdings.com. Any deletions are subject to our legal obligations. We cannot always ensure that such corrections or deletions will be made in our database, that our Agents will delete all information, and that you will cease receiving all communications but we will endeavor to comply and will satisfy all legal obligations. 

• If you do not want to receive promotional emails, you can click the unsubscribe button in any email. 

• You may set your browser to block cookies or alert you when cookies are sent. We will honor the Do Not Track signal from your browser, but this may adversely affect your experience of the Website or ability to receive Services. 

• We cannot control third parties sending you advertising, but they may offer their own opt-out options. The Network Advertising Initiative also has information on how to block advertisements from their members on their website: https://optout.networkadvertising.org/. 

• Residents of certain US states may have additional rights under applicable privacy laws. These rights may include: 

• Right to request personal information collected about them 

• Right to request deletion or correction of personal information 

• Right to request access to their personal information in a portable format 

• Right to opt out of sharing personal information with third parties 

• Right to appeal a business’s refusal to take action on a request. 

You may submit a request to exercise your state specific privacy rights by contacting privacy@terraholdings.com. Please provide evidence of your residency in the applicable state. If you are using an agent to make your request, you must verify your identity and provide written proof of authorization. 

• For California residents, please see our California Privacy Policy on our Website. 

• For residents outside of the United States, your country’s laws, including those of the European Economic Area, the United Kingdom, and Switzerland, may provide additional protections. If you have any concerns, please contact us at privacy@terraholdings.com and we will consider any additional requests. 

Data Security 

We endeavor to keep your information safe and employ industry standard security measures to prevent unauthorized access, use, and transmittal. We comply with all applicable federal, state, and local laws and regulations regarding PII data security and safe data PII disposal practices. However, we cannot guarantee that any data is entirely safe, and that equipment or software failure or that unauthorized entry or theft will not occur. Every user must take care to protect the user’s equipment and passwords, and to promptly sign on and off from the Website and Services. Company has no liability for data security incidents whether involving information we, our Agents, and our third party providers maintain, or which result from your use of third party services. No transmission or storage of information, especially PII, on the internet or through the Website can be guaranteed secure and users must take care in transmitting any PII. 

CALIFORNIA NOTICE AT COLLECTION AND PRIVACY POLICY 

This California Notice at Collection and Privacy Policy (“CA Privacy Policy”) applies solely to California residents and describes their rights under the California Consumer Protection Act, as amended (“CCPA”), and other California laws. Note, the Company does not directly operate in California, and this Policy applies only to the extent that we collect personal information or personally identifiable information (collectively, “Personal Information”) about you in the context of your interactions with the Brown Harris Stevens brokerage and management companies and the Halstead Management Company (collectively, the “Company”) in other jurisdictions.  

Personal Information 

The following chart describes Personal Information that has or may have been collected by the Company during the past 12 months. While the Company does not sell any Personal Information, as “sell” is defined under the CCPA, it may be disclosed to others, including its “Service Providers”, which include partnership advertisers, providers of internet services, data analytics, operating systems and platforms, cloud storage, data providers, web hosts, payment processors, email distributers, financial and accounting servicers, internet providers, cyber security advisors, law firms, and customer relationship management providers.  The Company obtains Personal Information from its real estate agents, from you directly through forms, from surveys and your use of Company Services, and from its Service Providers.  The Company’s “Housing Clients” include i. sellers, landlords, buyers, and tenants for whom the Company provides brokerage services and the boards of the buildings in which buyers and tenants seek admission, and ii. buildings for whom the Company provides management services, including without limitation housing fee collections, construction supervision, HR functions, tax reporting, and medical and building insurance placement. In the course of providing services to Housing Clients, the Company provides Personal Information to Service Providers, unions, medical service and insurance providers, law firms, and governmental entities. If the Company collects additional forms of Personal Information, or uses it for purposes that are not compatible with those described below, it will amend this CA Privacy Policy, so please check this site periodically.  We do not build profiles or sell Personal Information.  

General Personal Information 

Sensitive Personal Information 

Please note that the Company does not collect any Sensitive Personal Information for the purpose of inferring characteristics about any consumer. Therefore, we are not required to include a “Limit My Sensitive Personal Information” link on our Website. 

Data Retention 

We will retain your Personal Information and documentation for the retention period required by law, and may occasionally retain it beyond the required period, if deemed to be reasonably necessary to fulfill an ongoing business need (for example, account recovery), or to comply with applicable tax, legal or accounting requirements.  To determine the appropriate retention period for your Personal Information, we consider various factors, such as the amount, nature, and sensitivity of your information; the potential risk of unauthorized access, use or disclosure; the purposes for which we collect or process your Personal Information; and applicable legal requirements.   

When we dispose of Personal Information, we use reasonable procedures designed to erase or render it unreadable (for example, shredding documents and wiping electronic media). 

Note that Personal Information does not include publicly available information that is lawfully made available from government records, or information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media; or information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience; or de-identified or aggregated consumer information. 

California Privacy Rights: Shine the Light Law 

California’s Shine the Light law (Cal. Civ. Code § 1798.83) permits users of the Services that are California residents to request certain information regarding our disclosure of Personal Information to third parties for their direct marketing purposes. To make such a request or opt-out, please send an e-mail to privacy@terraholdings.com. 

California Privacy Rights: Online Privacy Protection Act (“CalOPPA”) 

California’s Online Privacy Protection Act (Bus. & Prof. Code § 22575) requires operators of a commercial website or online service that collect personally identifiable information as defined under CalOPPA (“PII”) about California consumers through the Internet to satisfy certain requirements. If you want to review and request changes to the handling of your PII, collected through the Site (as defined in the Privacy Policy) or our Services, please send an email to privacy@terraholdings.com. 

California Privacy Rights: California Consumer Privacy Act of 2018 (“CCPA”) as amended by the California Privacy Rights Act (“CPRA”) 

As defined under the CCPA and further revised by the CPRA, if you are a California “Consumer,” you have certain rights with respect to the collection, use, transfer, retention, selling, sharing, and processing of your Personal Information.  To exercise any of the rights below, please contact us directly at privacy@terraholdings.com.Only you or your Authorized Agent (as defined herein), may make a verifiable consumer request related to your Personal Information. 

We collect Personal Information from our real estate agents and Service Providers, as well as from you directly.   

California Consumer Rights  

California consumers have the following rights, subject to applicable exceptions:  

• The right to request information about Personal Information collected about you; 

• The right to request disclosure of categories of Personal Information we disclose; 

• The right to access Personal Information in a portable format; 

• The right to opt out of the sharing or selling of Personal Information to a third party; 

• The right to correct your inaccurate Personal Information; 

• The right to request deletion of Personal Information; and 

• The right to not to be discriminated against for exercising your privacy rights. 

To exercise any of these rights, contact us at privacy@terraholdings.com. You may have to validate your identity and California residency status and/or the authority of the person exercising these rights on your behalf. You may request this information twice in a 12-month period. You may also click on the unsubscribe link on any commercial email you receive from the Company.  

You have the right to request that the Company and our service providers not sell or share certain Personal Information that the Company has collected from you to a third party, except for information required by law, or necessary to conduct certain business purposes, such as HR, tax reporting and other functions. You can exercise that right or request an opt out at any time by contacting privacy@terraholdings.com.  We do not sell your PII.  

If you have any questions or concerns, please contact us at privacy@terraholdings.com. 

NOTICE OF PRIVACY PRACTICES 

THIS NOTICE OF PRIVACY PRACTICES DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY. 

This Notice of Privacy Practices (the “Notice“) describes the legal obligations of Terra Holdings, LLC (the “Plan“) and your legal rights regarding your protected health information held by the Plan under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the Health Information Technology for Economic and Clinical Health Act (HITECH Act). Among other things, this Notice describes how your protected health information may be used or disclosed to carry out treatment, payment, or health care operations, or for any other purposes that are permitted or required by law. 

We are required to provide this Notice of Privacy Practices to you pursuant to HIPAA. The HIPAA Privacy Rule protects only certain medical information known as “protected health information.” Generally, protected health information (“PHI”) is health information, including demographic information, collected from you or created or received by a health care provider, a health care clearinghouse, a health plan, or your employer on behalf of a group health plan, from which it is possible to individually identify you and that relates to: 

1. Your past, present, or future physical or mental health or condition; 

1. The provision of health care to you; or 

1. The past, present, or future payment for the provision of health care to you. 

Contact Information 

If you have any questions about this Notice or about our privacy practices, and for any correspondence or requests related to the contents of this Notice, please contact 

Judith Caplan – Senior Vice President, Human Resources 

Phone: (212) 508-7304 

Email: jcaplan@terraholdings.com  

Effective Date 

This Notice is effective February 6, 2026. 

Our Responsibilities 

We are required by law to: 

1. maintain the privacy of your PHI; 

1. provide you with certain rights with respect to your PHI; 

1. provide you with a copy of this Notice of our legal duties and privacy practices with respect to your PHI; and 

1. follow the terms of the Notice that is currently in effect. 

We reserve the right to change the terms of this Notice and to make new provisions regarding your PHI that we maintain, as allowed or required by law. If we make any material change to this Notice, we will provide you with a copy of our revised Notice of Privacy Practices. 

How We May Use and Disclose Your PHI 

Under the law, we may use or disclose your PHI under certain circumstances without your permission. The following categories describe the different ways that we may use and disclose your PHI. For each category of uses or disclosures we will explain what we mean and present some examples. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information will fall within one of the categories. Note that we will use and disclose PHI as described below unless otherwise prohibited or restricted by applicable state or other law, and that information can lose its protected status as PHI once re-disclosed by a recipient. 

• For Treatment. When and as appropriate, we may use or disclose medical information about you to facilitate medical treatment or services by health care providers. We may disclose medical information about you to providers, including doctors, nurses, technicians, medical students, or other hospital personnel who are involved in taking care of you. For example, we might disclose information about you with physicians who are treating you. 

• For Payment. We may use or disclose your protected health information to determine your eligibility for Plan benefits, to facilitate payment for the treatment and services you receive from health care providers, to determine benefit responsibility under the Plan, or to coordinate Plan coverage. For example, we may tell your health care provider about your medical history to determine whether a particular treatment is experimental, investigational, or medically necessary, or to determine whether the Plan will cover the treatment. We may also share your protected health information with a utilization review or pre-certification service provider. Likewise, we may share your protected health information with another entity to assist with the adjudication or subrogation of health claims or to another health plan to coordinate benefit payments. 

• For Health Care Operations. We may use and disclose your protected health information for other Plan operations. These uses and disclosures are necessary to run the Plan. For example, we may use medical information in connection with conducting quality assessment and improvement activities; underwriting, premium rating, and other activities relating to Plan coverage; submitting claims for stop-loss (or excess-loss) coverage; conducting or arranging for medical review, legal services, audit services, and fraud and abuse detection programs; business planning and development such as cost management; and business management and general Plan administrative activities. However, we will not use your genetic information for underwriting purposes. 

• Substance Use Disorder (SUD) Treatment Information. Some of your health information may be part of a SUD patient record and subject to additional protections under federal law (42 CFR Part 2) governing confidentiality of SUD patient records. 

If we receive or maintain any information about you from a SUD treatment program that is covered by 42 CFR Part 2 (a “Part 2 Program”) through a general consent you provide to the Part 2 Program to use and disclose the SUD patient record for purposes of treatment, payment or health care operations, we may use and disclose your SUD patient record for treatment, payment and health care operations purposes as described in this Notice. If we receive or maintain your SUD patient record through specific consent you provide to us or another third party, we will use and disclose your SUD patient record only as expressly permitted by you in your consent as provided to us. In no event will we use or disclose your SUD patient record, or testimony that describes the information contained in your SUD patient record, in any civil, criminal, administrative, or legislative proceedings by any Federal, State, or local authority, against you, unless authorized by your consent or the order of a court after it provides you notice of the court order. 

• To Business Associates. We may contract with individuals or entities known as Business Associates to perform various functions on our behalf or to provide certain types of services. In order to perform these functions or to provide these services, Business Associates will receive, create, maintain, transmit, use, and/or disclose your PHI, but only after they agree in writing with us to implement appropriate safeguards regarding your PHI. For example, we may disclose your PHI to a Business Associate to process your claims for Plan benefits or to provide support services, such as utilization management, pharmacy benefit management, or subrogation, but only after the Business Associate enters into a Business Associate contract with us. 

• Treatment Alternatives or Health-Related Benefits and Services. We may use and disclose your protected health information to send you information about treatment alternatives or other health-related benefits and services that might be of interest to you. As Required by Law. We will disclose your PHI when required to do so by federal, state, or local law. For example, we may disclose your PHI when required by national security laws or public health disclosure laws. 

• To Avert a Serious Threat to Health or Safety. We may use and disclose your PHI when necessary to prevent a serious threat to your health and safety, or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent the threat. For example, we may disclose your PHI in a proceeding regarding the licensure of a physician. 

• To Plan Sponsors. For the purpose of administering the plan, we may disclose PHI to certain employees of the Employer. However, those employees will only use or disclose that information as necessary to perform plan administration functions or as otherwise required by HIPAA, unless you have authorized further disclosures. Your PHI cannot be used for employment purposes without your specific authorization. 

Special Situations 

In addition to the above, the following categories describe other possible ways that we may use and disclose your PHI without your specific authorization. For each category of uses or disclosures, we will explain what we mean and present some examples. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted to use and disclose information will fall within one of the categories. 

• Organ and Tissue Donation. If you are an organ donor, we may release your PHI after your death to organizations that handle organ procurement or organ, eye, or tissue transplantation or to an organ donation bank, as necessary to facilitate organ or tissue donation and transplantation. 

• Military. If you are a member of the armed forces, we may release your PHI as required by military command authorities. We may also release PHI about foreign military personnel to the appropriate foreign military authority. 

• Workers’ Compensation. We may release your PHI for workers’ compensation or similar programs, but only as authorized by, and to the extent necessary to comply with, laws relating to workers’ compensation and similar programs that provide benefits for work-related injuries or illness. 

• Public Health Risks. We may disclose your PHI for public health activities. These activities generally include the following: 

1. to prevent or control disease, injury, or disability; 

1. to report births and deaths; 

1. to report child abuse or neglect; 

1. to report reactions to medications or problems with products; 

1. to notify people of recalls of products they may be using; 

1. to notify a person who may have been exposed to a disease or may be at risk for contracting or spreading a disease or condition; 

1. to notify the appropriate government authority if we believe that a patient has been the victim of abuse, neglect, or domestic violence. We will only make this disclosure if you agree, or when required or authorized by law. 

• Health Oversight Activities. We may disclose your PHI to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws. Lawsuits and Disputes. If you are involved in a lawsuit or a dispute, we may disclose your PHI in response to a court or administrative order. We may also disclose your PHI in response to a subpoena, discovery request, or other lawful process by someone involved in a legal dispute, but only if efforts have been made to tell you about the request or to obtain a court or administrative order protecting the information requested. 

• Law Enforcement. We may disclose your PHI if asked to do so by a law-enforcement official,  

1. in response to a court order, subpoena, warrant, summons, or similar process; 

1. to identify or locate a suspect, fugitive, material witness, or missing person; 

1. about the victim of a crime if, under certain limited circumstances, we are unable to obtain the victim’s agreement;  

1. about a death that we believe may be the result of criminal conduct; and  

1. about criminal conduct. 

• Coroners, Medical Examiners, and Funeral Directors. We may release PHI to a coroner or medical examiner. This may be necessary, for example, to identify a deceased person or determine the cause of death. We may also release medical information about patients to funeral directors, as necessary to carry out their duties. 

• National Security and Intelligence Activities. We may release your PHI to authorized federal officials for intelligence, counterintelligence, and other national security activities authorized by law. 

• Inmates. If you are an inmate of a correctional institution or are in the custody of a  law-enforcement official, we may disclose your PHI to the correctional institution or law-enforcement official if necessary (a) for the institution to provide you with health care; (b) to protect your health and safety or the health and safety of others; or (c) for the safety and security of the correctional institution. 

• Research. We may disclose your PHI to researchers when: 

1. the individual identifiers have been removed; or 

1. an institutional review board or privacy board has reviewed the research proposal and established protocols to ensure the privacy of the requested information and approves the research. 

Required Disclosures 

The following is a description of disclosures of your PHI we are required to make.  

• Government Audits. We are required to disclose your PHI to the Secretary of the United States Department of Health and Human Services when the Secretary is investigating or determining our compliance with the HIPAA privacy rule. 

• Disclosures to You. When you request, we are required to disclose to you the portion of your PHI that contains medical records, billing records, and any other records used to make decisions regarding your health care benefits. We are also required, when requested, to provide you with an accounting of most disclosures of your PHI if the disclosure was for reasons other than for payment, treatment, or health care operations, and if the PHI was not disclosed pursuant to your individual authorization. 

Other Disclosures 

• Personal Representatives. We will disclose your PHI to individuals authorized by you, or to an individual designated as your personal representative, attorney-in-fact, etc., so long as you provide us with a written notice/authorization and any supporting documents (i.e., power of attorney). Note: Under the HIPAA privacy rule, we do not have to disclose information to a personal representative if we have a reasonable belief that: 

1. you have been, or may be, subject to domestic violence, abuse, or neglect by such person; or 

1. treating such person as your personal representative could endanger you; and 

1. in the exercise of professional judgment, it is not in your best interest to treat the person as your personal representative. 

• Spouses and Other Family Members. With only limited exceptions, we will send all mail to the employee. This includes mail relating to the employee’s spouse and other family me covered under the Plan and includes mail with information on the use of Plan benefits by the employee’s spouse and other family members and information on the denial of any Plan benefits to the employee’s spouse and other family members. If a person covered under the Plan has requested Restrictions or Confidential Communications (see below under “Your Rights”), and if we have agreed to the request, we will send mail as provided by the request for Restrictions or Confidential Communications. 

• Authorizations. Other uses or disclosures of your PHI not described above will only be made with your written authorization. For example, in general and subject to specific conditions, we will not use or disclose your psychiatric notes; we will not use or disclose your PHI for marketing; and we will not sell your PHI, unless you give us a written authorization. You may revoke written authorizations at any time, so long as the revocation is in writing. Once we receive your written revocation, it will only be effective for future uses and disclosures. It will not be effective for any information that may have been used or disclosed in reliance upon the written authorization and prior to receiving your written revocation. 

Your Rights 

You have the following rights with respect to your PHI: 

• Right to Inspect and Copy. You have the right to inspect and copy certain PHI that may be used to make decisions about your Plan benefits. If the information you request is maintained electronically, and you request an electronic copy, we will provide a copy in the electronic form and format you request, if the information can be readily produced in that form and format; if the information cannot be readily produced in that form and format, we will work with you to come to an agreement on form and format. If we cannot agree on an electronic form and format, we will provide you with a paper copy. 

To inspect and copy your PHI, you must submit your request in writing. If you request a copy of the information, we may charge a reasonable fee for the costs of copying, mailing, or other supplies associated with your request. 

We may deny your request to inspect and copy in certain very limited circumstances. If you are denied access to your medical information, you may request that the denial be reviewed by submitting a written request. 

• Right to Amend. If you feel that the PHI we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by or for the Plan. 

To request an amendment, your request must be made in writing. In addition, you must provide a reason that supports your request. 

We may deny your request for an amendment if it is not in writing or does not include a reason to support the request. In addition, we may deny your request if you ask us to amend information that: 

1. is not part of the medical information kept by or for the Plan; 

1. was not created by us, unless the person or entity that created the information is no longer available to make the amendment; 

1. is not part of the information that you would be permitted to inspect and copy; or 

1. is already accurate and complete. 

If we deny your request, you have the right to file a statement of disagreement with us and any future disclosures of the disputed information will include your statement. 

• Right to an Accounting of Disclosures. You have the right to request an “accounting” of certain disclosures of your PHI. The accounting will not include:  

1. disclosures for purposes of treatment, payment, or health care operations; 

1. disclosures made to you; 

1. disclosures made pursuant to your authorization;  

1. disclosures made to friends or family in your presence or because of an emergency;  

1. disclosures for national security purposes; and  

1. disclosures incidental to otherwise permissible disclosures. 

To request this list or accounting of disclosures, you must submit your request in writing. Your request must state the time period you want the accounting to cover, which may not be longer than six years before the date of the request. Your request should indicate in what form you want the list (for example, paper or electronic). The first list you request within a 12-month period will be provided free of charge. For additional lists, we may charge you for the costs of providing the list. We will notify you of the cost involved and you may choose to withdraw or modify your request at that time before any costs are incurred. 

• Right to Request Restrictions. You have the right to request a restriction or limitation on your PHI that we use or disclose for treatment, payment, or health care operations. You also have the right to request a limit on your PHI that we disclose to someone who is involved in your care or the payment for your care, such as a family member or friend. For example, you could ask that we not use or disclose information about a surgery that you had. 

Except as provided in the next paragraph, we are not required to agree to your request. However, if we do agree to the request, we will honor the restriction until you revoke it or we notify you. We will comply with any restriction request if 

1. except as otherwise required by law, the disclosure is to a health plan for purposes of carrying out payment or health care operations (and is not for purposes of carrying out treatment); and  

1. the PHI pertains solely to a health care item or service for which the health care provider involved has been paid in full by you or another person. 

To request restrictions, you must make your request in writing. In your request, you must tell us 

1. what information you want to limit;  

1. whether you want to limit our use, disclosure, or both; and  

1. to whom you want the limits to apply-for example, disclosures to your spouse. 

• Right to Request Confidential Communications. You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail. 

To request confidential communications, you must make your request in writing. We will not ask you the reason for your request. Your request must specify how or where you wish to be contacted. We will accommodate all reasonable requests. 

• Right to Be Notified of a Breach. You have the right to be notified in the event that we (or a Business Associate) discover a breach of unsecured PHI. 

• Right to a Paper Copy of This Notice. You have the right to a paper copy of this notice. You may ask us to give you a copy of this notice at any time. Even if you have agreed to receive this notice electronically, you are still entitled to a paper copy of this notice. 

Complaints 

If you believe that your privacy rights have been violated, you may file a complaint with the Plan or with the Office for Civil Rights of the United States Department of Health and Human Services. To file a complaint with the Plan, contact the person listed in the Contact Information section of this Notice. All complaints must be submitted in writing. 

You will not be penalized, or in any other way retaliated against, for filing a complaint with the Office for Civil Rights or with us. 

If you have any questions or concerns, please contact us at privacy@terraholdings.com. 

Last Updated: February 6, 2026