Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Scope and our responsibilities

Travera, Inc. is a HIPAA covered entity. This notice applies to protected health information we create, receive, maintain, or transmit in providing laboratory testing and related services. Our Privacy Policy and applicable consumer-health-data notice address other personal information, including website information outside HIPAA. Independent clinicians and telehealth providers have their own notices; this is not a joint notice for those providers. We may disclose protected health information electronically through the permitted treatment, payment, operations, and other pathways described below. We obtain authorization for electronic disclosures when applicable law requires it.

We must protect the privacy and security of your protected health information, provide this notice of our duties and practices, follow the notice currently in effect, and notify you as required following a breach of unsecured protected health information. Acknowledging receipt of this notice does not authorize marketing, waive your rights, or replace an authorization required by law. Declining to acknowledge receipt does not by itself prevent you from receiving testing or exercising your privacy rights.

Treatment, payment, and operations

We may use and disclose information for these purposes as permitted by law and subject to any stricter protections described below:

● Treatment: coordinate physician orders, sample collection, testing, and care. For requests initiated through MDI, reports are made available in the patient portal and are accessible to the ordering clinician. For other physician orders, we send reports to the ordering clinician. We may also share reports with treating providers as legally permitted. These permitted disclosures do not guarantee automatic delivery to, or review or interpretation by, your treating oncologist.

● Payment: administer charges, collect payment, and arrange financial assistance. For example, we use the ordered test, reportability and recollection status, and your accepted pricing to apply our Billing Policy, itemize included physician review and collection charges, and process waivers, credits, or refunds. This notice does not authorize charges or change the no-bill protection in the Billing Policy. Travera does not currently accept medical insurance.

● Health care operations: manage our laboratory, review quality, train staff, maintain security, and conduct compliance activities. For example, qualified staff may investigate a laboratory quality issue. We may also contact you about our own health-related services, such as longitudinal monitoring or repeat testing, when permitted by law and consistent with your communication preferences. Such information does not determine clinical appropriateness or require you to purchase a service.

● Service providers: vendors may handle protected health information only for legally permitted functions under appropriate confidentiality and security requirements, including business associate agreements where required. We limit operations-related uses, disclosures, and requests to the minimum necessary as applicable. Website analytics or communications vendors receive no independent right to use protected health information for advertising; a cookie banner or privacy-policy acknowledgment does not substitute for a required HIPAA authorization.

Other permitted or required disclosures

We may use or disclose information for the following purposes only when applicable legal conditions are met. A request alone does not establish a right to receive your records.

● Public health and safety: report disease, adverse events, product problems, or suspected abuse or neglect, and help prevent a serious threat to health or safety.

● Oversight and law: comply with required reporting, authorized audits and inspections, or requests from HHS to assess privacy compliance.

● Legal proceedings and law enforcement: respond to qualifying court or administrative orders, subpoenas, or other legally permitted requests, subject to required safeguards.

● Research: conduct or support research only with a lawful basis and any required authorization, review-board waiver, or other approval. Testing or website use does not enroll you in research.

● Other authorized purposes: workers’ compensation, organ or tissue donation, coroners, medical examiners, funeral directors, and specified military, national-security, protective-service, or correctional functions, when applicable.

Your choices and written authorization

You may tell us whether to share relevant information with family, friends, or others involved in your care or payment, or for disaster relief. We generally give you an opportunity to agree or object. If you cannot express a preference, we may make a legally permitted disclosure in your best interest using professional judgment.

Marketing uses requiring authorization, sale of protected health information, and most uses or disclosures of psychotherapy notes require written authorization. Travera does not sell personal information. Other uses and disclosures not described in this notice will be made only with your written authorization.

Optional emails describing Travera’s own health-related services generally do not require a separate HIPAA marketing authorization when they meet the applicable exception and we receive no third-party financial remuneration for the communication. You may decline or unsubscribe without affecting testing, reports, or otherwise available services. We honor your recorded preferences and any applicable authorization limits. If a proposed use falls outside the permitted exception or a stricter law requires consent, we obtain the required separate authorization before proceeding. An email preference does not authorize testing or marketing calls or texts.

You may revoke an authorization in writing to our Privacy Officer using the contact details below. Revocation applies on receipt, except to action already taken in reliance on the authorization.

Additional protections for sensitive records

Where applicable federal or state law gives information greater protection—including HIV-related, genetic, mental-health, substance-use-disorder, or reproductive-health information—we follow those restrictions and obtain any required separate consent. HIPAA permission alone does not override a stricter applicable state restriction. State medical-record protections, including applicable Washington and California requirements, may apply even where consumer privacy laws exempt the information.

If we receive or maintain substance-use-disorder treatment records protected by 42 CFR Part 2, those records and testimony about their contents may not be used or disclosed in civil, criminal, administrative, or legislative proceedings against you without your written consent or a qualifying court order issued after notice and an opportunity to be heard for you or the record holder. The order must be accompanied by a subpoena or other legal requirement compelling disclosure. These protections also apply to investigations against you. General permission for treatment, payment, or operations does not remove these restrictions.

Access, copies, and corrections

Contact our Privacy Officer to inspect or obtain paper or electronic copies of health information in records covered by your access rights, including completed laboratory reports. We verify identity and representative authority. We generally act within 30 calendar days; if HIPAA permits a single extension of up to 30 additional days, we explain the reason and completion date in writing within the initial period. We follow any shorter applicable deadline. We explain permitted denials and available review rights. Any fee must be permitted by law and based on allowable costs; marketing acceptance and payment of an outstanding testing bill are not conditions of your HIPAA access right.

You may request an amendment in writing, explaining what is inaccurate or incomplete and why. If we deny the request, we will explain in writing and tell you how to submit a statement of disagreement. An amendment does not necessarily erase the original record.

A legally authorized personal representative may exercise your rights, subject to verification and applicable exceptions. Caregiver status alone does not establish that authority.

Restrictions and confidential communications

You may request limits on use or disclosure for treatment, payment, operations, or involvement of others in your care. We generally need not agree, but must honor a request not to disclose information to a health plan for payment or operations when it relates solely to an item or service paid out of pocket in full and disclosure is not required by law. Tell us about the restriction before the disclosure occurs.

You may request a reasonable alternative contact method or location, such as a different mailing address or telephone number. We accommodate reasonable requests and do not require you to explain why. Ask us for a secure method before sending sensitive records.

Accounting and copies of this notice

You may request an accounting of disclosures covered by HIPAA’s accounting right during the preceding six years or a shorter requested period. It generally excludes treatment, payment, operations, authorized disclosures, and other legal exceptions. The first accounting in a 12-month period is free; we will explain any permitted charge for additional requests before proceeding.

You may request a paper copy of this notice at any time, even if you agreed to electronic delivery. The current notice is also available on our website and from our Privacy Officer.

Questions, requests, and complaints

To exercise these rights, ask a question, revoke authorization, or complain, contact Travera, Inc., Attention: Privacy Officer, 200 Boston Ave., Suite 1500, Medford, MA 02155; info@travera.com; 781-874-0808. Tell us the request or concern and how to reach you. We will explain any applicable request requirements, exceptions, or review rights.

You may also complain to the U.S. Department of Health and Human Services Office for Civil Rights through its online complaint process, by calling 1-877-696-6775, or by writing to 200 Independence Avenue, S.W., Washington, D.C. 20201. You need not complain to Travera first. We will not retaliate against you for a complaint or exercising your rights.

Changes to this notice

We may revise this notice and apply the revised practices, as legally permitted, to information we already hold and receive later. We post the current notice with its effective date and make copies available on request. We provide additional notice when required. A revision does not retroactively expand a signed authorization.