Last updated: January 1, 2026 · Effective: January 1, 2026

1. Introduction

MUUD Health, Inc. ("MUUD Health," "we," "our") operates the MUUD Health Clinical Intelligence Platform, MUUD Ring wearable, and MUUD mobile application. This Privacy Policy describes how we collect, use, and protect your information in compliance with HIPAA (45 CFR §164), CCPA (California Civil Code §1798.100 et seq.), and applicable state law.

2. Information We Collect

Protected Health Information (PHI): Clinical notes, assessment scores (PHQ-9, GAD-7), diagnoses (ICD-10), biometric data from MUUD Ring (HRV, sleep, readiness, heart rate), session dates and types, and any information entered into the SOAP note editor. PHI is encrypted at rest (AES-256-GCM) and in transit (TLS 1.3).

Account Information: Name, email address, professional credentials (license number, NPI, taxonomy code), practice information, and authentication credentials.

Usage Data: Portal access logs, session duration, feature usage — retained for security auditing under 45 CFR §164.312(b).

3. How We Use Your Information

We use collected information to provide clinical intelligence services, maintain the audit trail required by HIPAA, process billing through Square, deliver telehealth functionality via Whereby (under BAA), send clinical alerts, and improve platform features. We do not sell PHI or use it for advertising.

4. Data Sharing

PHI is shared only with Business Associates operating under a BAA: Whereby (telehealth), Square (billing infrastructure — billing data only, not PHI), and cloud infrastructure partners under appropriate agreements. We do not share PHI with third parties for marketing purposes.

5. Data Retention

Clinical records are retained for a minimum of 7 years following the last treatment date, or 10 years for records involving clients who were minors at the time of treatment, consistent with California Business and Professions Code §4980.49 and HIPAA minimum retention standards.

6. Your Rights (CCPA)

California residents have the right to: (a) know what personal information is collected; (b) request deletion of personal information (subject to HIPAA retention requirements); (c) opt out of the sale of personal information (we do not sell information); (d) non-discrimination for exercising these rights. To exercise rights, contact care@muudhealth.com.

7. Security

MUUD Health implements administrative, physical, and technical safeguards as required by the HIPAA Security Rule (45 CFR §164.300–314), including AES-256-GCM encryption, TLS 1.3 transport security, role-based access control, MFA requirement (NIST SP 800-63B AAL2), and immutable audit logging.

8. Contact

Privacy inquiries: care@muudhealth.com · Clinical line: (323) 609-5936 (Spruce Health) · MUUD Health, Inc., Los Angeles, CA 90068

Last updated: January 1, 2026 · Governing law: California

1. Acceptance

By accessing the MUUD Health Clinical Intelligence Platform, you agree to these Terms of Service. If you are accessing on behalf of an organization, you represent that you have authority to bind that organization.

2. Authorized Use

The Platform is licensed exclusively to licensed mental health professionals and authorized staff for clinical documentation, client management, and related healthcare delivery activities. Unauthorized access, reverse engineering, or sharing of credentials is prohibited.

3. HIPAA Compliance Obligations

Provider users are Covered Entities or members of a Covered Entity's workforce. You agree to use the Platform only for permitted purposes under HIPAA, to maintain the minimum necessary standard when accessing PHI, and to report suspected breaches to MUUD Health immediately via care@muudhealth.com.

4. Billing and Seat Licenses

Organization accounts are billed on a per-seat basis through Square at the rate specified in your subscription agreement. Seat counts include all Provider and Super Admin roles. Viewer roles are included at no additional charge. Billing is managed exclusively through Square; no other payment processor is used.

5. Limitation of Liability

MUUD Health is a clinical documentation and intelligence platform, not a licensed healthcare provider. Provider users are solely responsible for all clinical decisions. MUUD Health is not liable for clinical outcomes, misdiagnosis, or harm resulting from clinical decisions made using Platform data.

6. Termination

MUUD Health may terminate access for violation of these Terms, non-payment, or conduct that poses HIPAA compliance risk. Upon termination, PHI is retained per the retention schedule in the Privacy Policy; non-PHI account data is deleted within 30 days.

7. Contact

Legal inquiries: care@muudhealth.com · MUUD Health, Inc., Los Angeles, CA 90068

HIPAA Business Associate Agreement · 45 CFR §164.504(e) · Effective January 1, 2026

Parties

This Business Associate Agreement ("BAA") is entered into between the Covered Entity (the healthcare organization or individual licensed provider subscribing to the MUUD Health Clinical Intelligence Platform, "CE") and MUUD Health, Inc., a California corporation ("Business Associate" or "BA").

1. Definitions

Terms used but not defined herein have the meanings set forth in HIPAA (42 U.S.C. §1320d et seq.) and the HIPAA Regulations (45 CFR Parts 160 and 164). "Protected Health Information" or "PHI" means individually identifiable health information transmitted or maintained by BA on behalf of CE.

2. Permitted Uses and Disclosures

BA may use or disclose PHI only as necessary to provide the Platform services described in the Subscription Agreement, as required by law, for BA's proper management and administration, or to carry out BA's legal responsibilities. BA shall not use or disclose PHI in a manner that would violate the Privacy Rule if done by CE.

3. Safeguards

BA agrees to implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of electronic PHI it creates, receives, maintains, or transmits on behalf of CE, as required by the Security Rule (45 CFR §164.306). Safeguards include AES-256-GCM encryption at rest, TLS 1.3 in transit, role-based access control, MFA (NIST SP 800-63B AAL2), and immutable audit logging (45 CFR §164.312(b)).

4. Reporting

BA shall report to CE any use or disclosure of PHI not permitted by this BAA without unreasonable delay and in no case later than 60 days following discovery. BA shall report Security Incidents and provide breach notification consistent with the Breach Notification Rule (45 CFR §164.410).

5. Subcontractors

BA shall require any subcontractors that create, receive, maintain, or transmit PHI on behalf of BA to agree to the same restrictions and conditions as those in this BAA. Current subcontractors with BAA coverage: Whereby (telehealth video infrastructure); cloud hosting providers under appropriate agreements.

6. Access and Audit Rights

BA shall make available its internal practices, books, and records relating to PHI to the Secretary of HHS as required by law. BA shall make PHI available to CE as necessary to fulfill CE's obligations under 45 CFR §164.524 (individual access) and §164.526 (amendment).

7. Term and Termination

This BAA is effective as of the Subscription Effective Date and terminates upon expiration or termination of the Subscription Agreement. Upon termination, BA shall destroy or return all PHI unless retention is required by law, in which case protections shall extend to that retained PHI.

8. Governing Law

This BAA is governed by the laws of the State of California, consistent with HIPAA. Any dispute shall be resolved in the state or federal courts located in Los Angeles County, California.

Contact

BAA inquiries and breach reporting: care@muudhealth.com · MUUD Health, Inc., Los Angeles, CA 90068

45 CFR §164.520 · Effective January 1, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our Duty to Safeguard Your Health Information

We are required by law to maintain the privacy of your Protected Health Information (PHI) and to provide you with this Notice about our legal duties and privacy practices. We must follow the terms of this Notice currently in effect.

How We May Use and Disclose Health Information

Treatment: We may use your PHI to provide, coordinate, or manage your health care. For example, we may share PHI with other treating providers on your care team.

Payment: We may use and disclose your PHI for billing and payment activities. Billing is processed through Square; PHI is not transmitted to Square — only billing metadata (session codes, amounts).

Healthcare Operations: We may use and disclose your PHI for quality assessment, training, accreditation, licensing, and other healthcare operations activities.

Telehealth: Your PHI may be transmitted via HIPAA-compliant telehealth technology (Whereby, operating under BAA). Video sessions are encrypted end-to-end and are not recorded without your explicit written consent.

Biometric Data: MUUD Ring biometric data (HRV, sleep, readiness, heart rate) constitutes PHI when combined with your identity and is treated with the same protections as all clinical records.

Your Rights

You have the right to: (1) inspect and copy your PHI; (2) request amendments to your PHI; (3) receive an accounting of disclosures; (4) request restrictions on certain uses and disclosures; (5) receive this Notice in an alternative format; (6) file a complaint with HHS if you believe your privacy rights have been violated.

Contact

Privacy Officer: care@muudhealth.com · (323) 609-5936 (Spruce Health) · MUUD Health, Inc., Los Angeles, CA 90068

HHS Office for Civil Rights: hhs.gov/ocr · 1-800-368-1019