Telehealth Informed Consent Policies

Care Plus—Telehealth Informed Consent

This form describes Care Plus telehealth treatment policies and includes

Your consent to receive medical treatment from Care Plus (and your other rights and responsibilities);
Your agreement to receive services using telehealth technology; and
Your agreement to pay in full any charges that are your responsibility.

Telehealth involves the use of secure electronic communications, information technology, or other means to enable a healthcare provider and a patient at different locations to communicate and share individual patient health information for the purpose of rendering clinical care. The collection, processing, and storage or personal health data will be limited to the minimum necessary to achieve this purpose, in compliance with Saudi Arabia’s Personal Data Protection Law (PDPL) and its Implementing Regulations. This “Telehealth Informed Consent” informs the patient ("patient,” “you,” or “your") concerning the treatment methods, risks, and limitations of using a telehealth platform.

Services Provided:

Telehealth services are offered by Care Plus and its affiliated entities ("Group"), and the Group's engaged providers (our “Providers” or your “Provider") and may include a patient consultation, diagnosis, treatment recommendation, prescription, and/or a referral to in-person care, as determined clinically appropriate (the “Services").
AliveCor Services, LLC and its parent AliveCor, Inc. do not provide the Services; rather, AliveCor Services, LLC performs administrative, payment, and other supportive activities for Group and our Providers.

Electronic Transmissions:

The types of electronic transmissions that may occur using the telehealth platform include, but are not limited to:

Completion, exchange, and review of medical intake forms and other clinically relevant information (for example: health records; images; output data from medical devices, e.g., KardiaMobile®, and associated software, e.g., Kardia; sound and video files; diagnostic and/or lab test results) between you and your Provider via:

Treatment recommendations by your Provider based upon such review and exchange of clinical information;
Delivery of a consultation report with a diagnosis, treatment and/or prescription recommendations, as deemed clinically relevant;
Prescription refill reminders (if applicable); and/or
Other electronic transmissions for the purpose of rendering clinical care to you.

Expected Benefits:

Improved access to care by enabling you to remain in your preferred location while your Provider consults with you. Our telehealth services are available on a flexible basis based on your location, but at least during the hours of 8am-8pm at least Mon-Fri.
Convenient access to follow-up care. If you need to receive non-emergent follow-up care related to your treatment, please contact your Provider by scheduling another appointment or contact your personal physician, and if urgent contact emergency care by dialing 997.
More efficient care evaluation and management. For example: you may schedule a visit with a board certified cardiologist within 48 hours of requesting an appointment and your Provider will have immediate access to your data from KardiaMobile in order to provide you with relevant, immediate and on-demand cardiological services.

Service Limitations:

The primary difference between telehealth and direct in-person service delivery is that telehealth does not provide direct, physical contact with the patient. Accordingly, some clinical needs may not be appropriate for a telehealth visit and your Provider will make that determination.
OUR PROVIDERS DO NOT ADDRESS MEDICAL EMERGENCIES. IF YOU BELIEVE YOU ARE EXPERIENCING A MEDICAL EMERGENCY, YOU SHOULD DIAL 9-9-7 AND/OR GO TO THE NEAREST EMERGENCY ROOM. PLEASE DO NOT ATTEMPT TO CONTACT ALIVECOR SERVICES, GROUP, OR YOUR PROVIDER. AFTER RECEIVING EMERGENCY HEALTHCARE TREATMENT, YOU SHOULD VISIT YOUR LOCAL PRIMARY CARE PROVIDER.
Our Providers are an addition to, and not a replacement for, your local primary care provider. Responsibility for your overall medical care should remain with your local primary care provider, if you have one, and we strongly encourage you to locate one if you do not.
Group does not have any in-person clinic locations.

Security Measures:

The electronic communication systems we use will incorporate network and software security protocols to protect the confidentiality of patient identification, ECG, and other electronically recorded/stored data (“Data”). We comply with the requirements of the PDPL, its Implementing Regulations and the Saudi National Cybersecurity Authority standards regarding the protection of sensitive health data, ensuring that only the necessary personnel have access to this data, ensuring that it is processed with the highest security standards and include measures to safeguard the Data and to ensure its integrity against intentional or unintentional corruption. We conduct regular data protection impact assessments, especially regarding health data processing, to ensure that appropriate safeguards are in place in compliance with the PDPL and its Implementing Regulations. All the Services delivered to the patient through telehealth will be delivered over a secure connection that complies with the requirements of the PDPL and the National Cybersecurity Authority standards. Data will be retained for the minimum period necessary to fulfill the stated purposes for which it was collected and will be securely destroyed when no longer needed, unless retention is mandated by a legal requirement, in accordance with the PDPL and its Implementing Regulations.

Possible Risks:

Delays in evaluation and treatment could occur due to deficiencies or failures of the equipment and technologies, or provider availability.
In the event of an inability to communicate as a result of a technological or equipment failure, please contact technical support at 966-500195720 and/or write an email to support@careplussaudiarabia.com.
In rare events, your Provider may determine that the transmitted information is of inadequate quality, thus necessitating a rescheduled telehealth consult or an in-person meeting with your local primary care doctor.
In very rare events, security protocols could fail, causing a breach of privacy of personal medical information.

Patient Acknowledgments:

I further acknowledge and understand the following:

Prior to the telehealth visit, I have been provided the opportunity to review my Provider's credentials.
If I am experiencing a medical emergency, I will be directed to dial 9-9-7 immediately and my Provider is not able to connect me directly to any local emergency services.
I may elect to seek services from a medical group with in-person clinics as an alternative to receiving telehealth services.
I have the right to withhold or withdraw my explicit consent to the collection, processing, and transmission of my personal data, including sensitive health data, in the course of my care at any time without affecting my right to future care or treatment as per the PDPL and its Implementing Regulations. I understand that the withdrawal of consent will not affect the lawfulness of processing carried out before its withdrawal, in accordance with the PDPL and its Implementing Regulations. I understand that absent the withdrawing of my consent given herein, that this consent will apply to all subsequent telehealth consultations with Group as already consented upon and falling under the initial purpose explained to me.
Applicable laws, decisions, guidelines and regulations requires health care providers to protect the privacy and the security of health information. I am entitled to all confidentiality protections under applicable laws, decisions, guidelines and regulations. I understand all medical reports resulting from the telehealth visit are part of my medical record.
Group will take steps to make sure that my health information is not seen by anyone who should not see it. Telehealth may involve electronic communication or transmission of my personal health information to other health practitioners, including those located outside Saudi Arabia subject to compliance with the PDPL and its Implementing regulations’ requirements for cross-border data transfers. My personal data will not be transferred outside the Kingdom without an adequate purpose, adequate levels of protection measures in place or my explicit consent as per the PDPL and its Implementing Regulations. I consent to Group using and disclosing my health information for the specified purposes of my treatment (e.g., prescription information) and care coordination, to receive reimbursement for the services provided to me, for Group's health care operations and any other stated purposes in this policy. In accordance with the PDPL and its Implementing Regulations, I have been informed about the legal basis for collecting and processing my health information, and I understand that this data will not be used for any other purposes without my explicit consent.
Dissemination of any patient-identifiable images or information from the telehealth visit to researchers or other educational entities will not occur without my prior and specific consent unless authorized by state or federal law.
There is a risk of technical failures during the telehealth visit beyond the control of Group.
In choosing to participate in a telehealth visit, I understand that some parts of the Services involving tests (e.g., ECG reviews, labs or bloodwork) may be conducted at another location such as a testing facility, at the direction of my Provider.
Persons may be present during the telehealth visit other than my Provider in order to operate the telehealth technologies. Third-party data processors, such as those responsible for handling the telehealth technologies or managing patient data, may be involved in processing my personal health information. I will be informed of their role and the legal basis for their involvement. All third-party processors are required to comply with Saudi Arabia’s PDPL, including implementing the necessary security measures to protect my personal data. If another person is present during the telehealth visit, I will be informed of the individual's presence and his/her role.
My Provider will explain my diagnosis and its evidentiary basis, and the risks and benefits of various treatment options.
I have the right to request a copy of my medical records and access, correct, or delete my personal data as per my rights under the PDPL and its implementing regulations. I can request to obtain or send a copy of my medical records, to correct or delete my personal data to my primary care or other designated health care provider by contacting Group at: support@careplussaudiarabia.com to affirmatively request a copy to be sent. A copy will be provided to me at reasonable cost of preparation, shipping and delivery.
If I am acting on behalf of a minor or an individual who lacks legal capacity, I confirm that I have the legal authority to consent to telehealth services and the processing of their personal data on their behalf. I understand that the rights under the PDPL and its Implementing Regulations apply to both the Data Subject and their legal guardian, including the right to access, correct, or delete the data.
It is necessary to provide my Provider a complete, accurate, and current medical history. I understand that I can log into my Kardia account at any time to access, amend, or review my health information stored in my file. In accordance with the PDPL and its Implementing regulations, I also have the right to request my personal data in a readable, electronic format.
There is no guarantee that I will be issued a prescription and that the decision of whether a prescription is appropriate will be made in the professional judgement of my Provider. If my Provider issues a prescription, I have the right to select the pharmacy of my choice.

There is no guarantee that I will be treated by a Group provider. My Provider reserves the right to deny care for potential misuse of the Services or for any other reason if, in the professional judgment of my Provider, the provision of the Services is not medically or NOTICE OF PRIVACY PRACTICES CARE PLUS COVERED ENTITY

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices (the “Notice”) describes how Care Plus, and the members of its Affiliated Covered Entity (collectively “we” or “our”) may use and disclose your protected health information to carry out treatment, payment or business operations and for other purposes that are permitted or required by applicable laws and regulations. An Affiliated Covered Entity is a group of health care providers under common ownership or control that designates itself as a single entity for purposes of compliance with the Ministry of Health KSA. We have elected to voluntarily substantially comply with the standards set forth in MOH KSA. The members of the Care Plus Affiliated Covered Entity will share protected health information with each other for the treatment, payment, and health care operations of the Care Plus Affiliated Covered Entity and as permitted by MOH KSA and this Notice of Privacy Practices. For a complete list of the members of the Care Plus Affiliated Covered Entity, please contact the Care Plus Office at support@careplussaudiarabia.com

“Protected health information” or “PHI” is information about you, including demographic information, that may identify you and that relates to your past, present or future physical health or condition, treatment or payment for health care services. This Notice also describes your rights to access and control your protected health information.

USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION:

Your protected health information may be used and disclosed by our health care providers, our staff, and others outside of our office that are involved in your care and treatment for the purpose of: (1) providing treatment to you; (2) obtain payment for your care; (3) support our healthcare operations; and (4) any other use or disclosure authorized or required by applicable laws and regulations.

1. TREATMENT: We will use and disclose your protected health information to provide, coordinate, or manage your health care and any related services. This includes the coordination or management of your health care with a third party with your consent. For example, your protected health information may be provided to a health care provider to whom you have been referred to ensure the necessary information is accessible to diagnose or treat you.

2. PAYMENT: Your protected health information may be used to bill or obtain payment for your health care services. This may include certain activities that your health insurance plan may undertake before it approves or pays for your services, such as: making a determination of eligibility or coverage for insurance benefits and reviewing services provided to you for medical necessity.

3. HEALTH CARE OPERATIONS: We may use or disclose, as needed, your protected health information in order to support the business activities of this office. These activities include, but are not limited to, improving quality of care, providing information about treatment alternatives or other health-related benefits and services, developing or maintaining and supporting computer systems, legal services, and conducting audits and compliance programs, including fraud, waste and abuse investigations.

4. USES AND DISCLOSURES REQUIRED BY LAW We may use or disclose your protected health information to the extent required by applicable laws and regulations.

DISCLOSURES THAT DO NOT REQUIRE YOUR AUTHORIZATION:

1. public health or safety protection: for purposes including preventing and controlling disease, reporting child abuse or neglect, reporting domestic violence, reporting to the Food and Drug Administration regarding the quality, safety and effectiveness of a regulated product or activity, and addressing emergencies where disclosure is necessary to protect the life or health of an individual as per the PDPL and its Implementing Regulations.

2. health care oversight purposes: if requested by a public authority or oversight agency for purposes of audits, investigations, inspections, licensing and disciplinary actions relating to the healthcare system, government benefit programs, or for security purposes, in compliance with the PDPL and its Implementing regulations.

3. in connection with legal proceedings:

4. law enforcement purposes: in response to an order from a court or administrative agency, legal proceeding, or when required by law.

5. National Security and Intelligence: to authorized government officials for lawful intelligence, counterterrorism, or national security activities, as permitted by Saudi Arabian law. 6. To Protect your safety or the safety of others: when disclosure is necessary to prevent or lessen a serious and imminent threat to your health or safety or the health or safety of another person or the public.

7. in case of death: to coroners, medical examiners and funeral directors for purposes such as identification, determining the cause of death and fulfilling duties relating to death of the user.

8. organ procurement: to coroners, medical examiners, or funeral directors as needed to carry out their duties, or to authorized medical entities for the purposes of organ donation and transplantation, in accordance with applicable regulations under the supervision of the Saudi Center for Organ Transplantation.

9. for the detection or prevention of criminal activities such as fraud as permitted by applicable regulations, including investigations by government or regulatory bodies to enforce legal compliance;

10. Public entity requests: to public authorities or government entities if required for the protection of public interests, security, or compliance with legal obligations under Saudi Arabian law.

11. Certain military activity and national security purposes: or persons who are, or were, in the military to ensure proper execution of a military mission or determining entitlement to benefits. PHI may also be disclosed to officials for intelligence and national security purposes.

12. workers’ compensation reporting: as authorized by, and to the extent necessary to comply with, workers’ compensation programs and other similar programs relating to work- related illnesses or injuries;

13. other required uses and disclosures. when required by the Secretary of the Department of Health and Human Services Under the law, the Saudi Ministry of Health or other regulatory authorities to ensure compliance with applicable regulations or for investigations into the requirements of the Health Insurance Portability and Accountability Act (HIPAA) and public health, safety and legal matters. State laws may further restrict these disclosures.

USES THAT REQUIRE YOUR AUTHORIZATION:

Other permitted and required uses and disclosures will be made only with your consent, authorization or opportunity to object unless permitted or required by law. Without your explicit consent, we are expressly prohibited from using or disclosing your protected health information for marketing purposes. We may not sell your protected health information without your explicit consent. Your protected health information will not be used for fundraising. If you provide us with an authorization for certain uses and disclosures of your information, you may revoke such authorization, at any time, in writing, except to the extent that we have taken an action in reliance on the use or disclosure indicated in the authorization.

YOUR RIGHTS WITH RESPECT TO YOUR PROTECTED HEALTH INFORMATION:

You have the right to inspect and copy your protected health information.

You may request access to or an amendment of your protected health information.

You have the right to request a restriction on the use or disclosure of your protected health/personal information. Your request must be in writing and state the specific restriction requested and to whom you want the restriction to apply. We are not required to agree to a restriction that you may request, except if the requested restriction is on a disclosure to a health plan for a payment or health care operations purpose regarding a service that has been paid in full out-of-pocket.

You have the right to request to receive confidential communications from us by alternative means or at an alternate location. We will comply with all reasonable requests submitted in writing which specify how or where you wish to receive these communications.

You have the right to request an amendment of your protected health information. If we deny your request for amendment, you have the right to file a statement of disagreement with us. We may prepare a rebuttal to our statement and we will provide you with a copy of any such rebuttal.

You have the right to receive an accounting of certain disclosures of your protected health information that we have made, paper or electronic, except for certain disclosures which were pursuant to an authorization, for purposes of treatment, payment, healthcare operations (unless the information is maintained in an electronic health record); or for certain other purposes. You have the right to obtain a paper copy of this Notice, upon request, even if you have previously requested its receipt electronically by e-mail.

REVISIONS TO THIS NOTICE:

We reserve the right to revise this Notice and to make the revised Notice effective for protected health information we already have about you as well as any information we receive in the future.

You are entitled to a copy of the Notice currently in effect. Any significant changes to this Notice will be posted on our web site. You then have the right to object or withdraw as provided in this Notice.

BREACH OF HEALTH INFORMATION:

We will notify you and the relevant authorities in Saudi Arabia in the event of a breach, damage, or illegal access to your personal health information, that may harm your data or infringe upon your rights and interests, in compliance with the PDPL and its Implementing Regulations. Notification will be made to you without undue delay and no later than 60 days from the breach discovery, and within 72 hours to the relevant Authorities, and will include a brief description of the breach, how the breach occurred, the protected health information involved, the potential risks arising from the Breach on your protected health information and measures taken to prevent or limit those risks and their impact and contact information of the Controller and his Data Protection Officer for you to ask questions. Additional recommendations or advice will be provided to assist you in taking appropriate measures to avoid the identified risks or limit their impact.

COMPLAINTS:

Complaints about this Notice or how we handle your protected health information should be directed to our Data Protection Officer at [DPO email address/contact info]. We are committed to address your concerns in compliance with the PDPL and its Implementing Regulations. If you are not satisfied with the manner in which a complaint is handled you may submit a formal complaint to the Saudi Data and Artificial Intelligence Authority, calling 920033174, emailing info@sdaia.gov.sa or visiting https://sdaia.gov.sa/en/Contact/Pages/Complaints.aspx We will not retaliate against you for filing a complaint.

We must follow the duties and privacy practices described in this Notice. We will maintain the privacy of your protected health information and to notify affected individuals following a breach of unsecured protected health information. If you have any questions about this Notice, please contact our Care Plus Officer at support@careplussaudiarabia.com

By signing below or electronically agreeing, you confirm the following:

1. You have read and understood the Telehealth Informed Consent Policies, including the information about the telehealth services offered, the use of electronic communications, and the handling of your personal and health information.

2. You explicitly consent to the collection, processing, and transfer of your personal data, including health information, as described in the [link to the Privacy Policy and in accordance with the Saudi Arabian Personal Data Protection Law (PDPL). This includes, but is not limited to:

- The collection and processing of your personal data to provide telehealth services, such as consultations, diagnosis, and treatment recommendations, as described in the Telehealth Informed Consent Policies.

- The use of electronic communications to share and transmit your personal data, including health information, between you and your healthcare provider.

- The sharing of your personal data with third-party service providers, such as health practitioners or diagnostic services, as necessary for the provision of the telehealth services.

- The transfer of your personal data outside of Saudi Arabia, where necessary, in accordance with the PDPL, to countries that provide an adequate level of protection or with appropriate safeguards in place.

3. You acknowledge that you have been informed of your rights under the PDPL, including your right to access, correct, delete, or restrict the processing of your personal data, as described in our Privacy Policy. These rights include:

- The right to access your personal data held by us.

- The right to correct any inaccurate or incomplete personal data.