Uplift Path

Consumer Health Data Privacy Notice

Version 1.0 · Effective October 2026

This Notice describes how Uplift Path, Inc. collects, uses, shares and protects consumer health data gathered through upliftpathwellness.com (the "Website") and through general inquiries, and how you can exercise your rights over that data. Several states now regulate health-related information that sits outside the Health Insurance Portability and Accountability Act and require this information to be given in a distinct notice on its own page. This Notice is published separately for that reason.

Scope and the Boundary with HIPAA

Uplift Path, Inc. is a covered entity under the Health Insurance Portability and Accountability Act. Protected Health Information that we create, receive or maintain in the course of treatment, payment and health care operations is governed by our Notice of Privacy Practices and is expressly excluded from the state consumer health data laws described here.

This Notice covers what falls outside that boundary. Before you become a Person Served, information you give us or that we observe can still reveal something about your health. Visiting a page that describes behavioral health services, submitting a Website inquiry that mentions a mental health concern, or asking about eligibility for services can all indicate a past, present or future health status or a request for health care. Where that information is not Protected Health Information, it is treated as consumer health data under this Notice.

Categories of Consumer Health Data We Collect and Why

  • Information you type into a Website inquiry or contact form that describes a behavioral health concern, a symptom, a diagnosis, a current provider or a request for services. We use it only to respond to you and to determine whether we can serve you.

  • Information indicating that you sought or received health care from us, including the fact that you contacted us and the service area you asked about. We use it to route your inquiry to the right workforce member.

  • Precise geographic information is not collected. We collect the state, and in some cases the city, in which you are located, because behavioral health services may lawfully be delivered only in states where we hold the necessary authority. We use it solely to confirm eligibility and to direct you to crisis resources in your area.

  • Technical information associated with a visit to a service description page or a form page, such as internet protocol address, device identifier and pages viewed, to the extent that it can be linked to you and can suggest a health status. We use it to operate and secure the Website.

We do not collect biometric data, genetic data, information about gender-affirming care, information about reproductive or sexual health, or substance use disorder treatment records through the Website. Uplift Path, Inc. does not provide substance use disorder services or reproductive health care services.

Sources of Consumer Health Data

  • Directly from you, through Website forms, email, telephone and our online contact form.

  • Automatically from your device and browser when you use the Website, as described in the Cookies and Tracking Technologies Notice.

  • From a person who contacts us on your behalf, such as a family member, a referring provider or a community organization.

How We Use Consumer Health Data

We use consumer health data only to respond to your inquiry, to determine whether you are eligible for services, to arrange intake if you decide to proceed, to operate and secure the Website, and to meet legal and regulatory obligations. We do not use it to build advertising audiences, to target advertising, to infer characteristics for marketing, or to train any automated decision system.

Categories We Share and with Whom

We share consumer health data only where it is necessary for one of the purposes above, and only with the following categories of recipients:

  • Technology service providers acting on our instructions, including website hosting, secure form, email and communication providers, each under a written contract restricting their use of the data.

  • Our clinical and administrative workforce members, limited to those who need the information to respond to you.

  • Professional advisers, including legal counsel, where necessary to establish or defend legal claims.

  • Government agencies, courts or law enforcement, where disclosure is required by law or valid legal process.

Uplift Path, Inc. has no affiliates or subsidiaries with which consumer health data is shared. We do not share consumer health data with advertising platforms, data brokers, social media platforms or marketing vendors.

We Do Not Sell Consumer Health Data

We do not sell consumer health data, and we do not exchange it for anything of value. Because we do not sell it, we do not seek or maintain the separate valid authorization that a sale would require.

Geofencing

We do not use geofencing around any health care facility, and we do not use location technology to identify, track, collect data from or send messages or advertisements to anyone based on proximity to a health care facility.

Your Rights

  • To confirm whether we are collecting, sharing or selling your consumer health data, and to access that data, including a list of all third parties and affiliates with whom we have shared it and an active contact for each.

  • To withdraw your consent to our collection and sharing of your consumer health data.

  • To have your consumer health data deleted, including from our archived and backup systems, and to have us notify the recipients to whom we disclosed it so that they delete it as well.

  • To be free from discrimination or a denial of goods or services because you exercised a right under this Notice.

Where a deletion request covers information that is also part of a designated record set governed by the Health Insurance Portability and Accountability Act, or that we are required by Ohio Medicaid, Ohio behavioral health rules or other law to retain, we will explain in writing what we can delete, what we must retain, and the legal basis for retaining it.

How to Exercise Your Rights

Submit a written request to privacy@upliftpathinc.com or through the online contact form at upliftpathwellness.com/contact. State the right you are exercising and give enough detail for us to locate the information. We verify identity before acting on a request and may ask for a government-issued photograph identification, which is redacted and securely destroyed once verification is complete. We acknowledge a verified request within five (5) business days and respond within forty-five (45) calendar days, which may be extended once by a further forty-five (45) calendar days where reasonably necessary, with written notice to you of the extension and the reason for it. There is no charge for a request unless it is manifestly unfounded or excessive.

Appeals

If we decline a request in whole or in part, we will tell you why and how to appeal. An appeal is reviewed by a member of the leadership team who was not involved in the original decision, and we respond in writing within forty-five (45) calendar days of receiving it. If we deny the appeal, we will provide a method to contact the attorney general or equivalent regulator in your state.

Record Retention and Review

This Notice is reviewed at least annually and whenever the Website, our vendors, our tracking technologies, our service area or applicable law changes. Each published version is retained for at least six (6) years. Reviews and revisions are carried out by the leadership team and reported to the Board of Directors as appropriate.

Contact

Uplift Path, Inc. — Privacy Compliance Contact

If you need this Notice in an alternative format, such as large print, audio or a translated version, or require another accommodation, contact the Accessibility Advocate at advocate@upliftpathinc.com and we will make reasonable efforts to provide the material in the format needed.