WELLNEST MEDICINE LLC

PRIVACY AND INFORMATION SECURITY INCIDENT RESPONSE POLICY

Policy Owner: WellNEST Medicine LLC
Effective Date: November 1, 2026
Review Frequency: At least annually and following a material incident or significant change in applicable requirements.

1. PURPOSE

This policy establishes procedures for identifying, reporting, investigating, containing and responding to suspected privacy and information security incidents involving WellNEST information systems, Participant information, coaching records, administrative records and third-party service providers.

The policy is intended to support reasonable information security practices, protect Participant information and facilitate compliance with applicable federal and Arizona privacy and breach notification requirements.

2. SCOPE

This policy applies to:

  • WellNEST owners, managers and authorized personnel.

  • Physician coaches providing services on behalf of WellNEST.

  • Employees and contractors with access to WellNEST information.

  • Third-party service providers handling information on WellNEST's behalf, to the extent provided by applicable agreements.

3. INCIDENT IDENTIFICATION

An incident requiring internal reporting may include:

  • Suspected unauthorized access to Participant information.

  • Lost or stolen devices containing business or Participant information.

  • Unauthorized disclosure of coaching communications.

  • Misaddressed emails containing sensitive information.

  • Compromised user accounts or passwords.

  • Unauthorized downloads, copying or transfer of records.

  • Malware, ransomware or other suspected system compromise.

  • Unauthorized recording or distribution of coaching sessions.

  • A suspected breach reported by Squarespace or another service provider.

An incident must be reported internally even if it is not ultimately determined to constitute a legally reportable breach.

4. IMMEDIATE REPORTING

Anyone who discovers or reasonably suspects an incident involving WellNEST information must promptly notify the designated WellNEST privacy or security contact.

Reports should include, when known:

  • Date and approximate time discovered.

  • Systems, accounts or devices involved.

  • Types of information potentially affected.

  • Individuals or Participants potentially affected.

  • Known or suspected unauthorized access or disclosure.

  • Steps already taken to contain the incident.

Individuals must not independently investigate beyond their authority, destroy potentially relevant evidence or make external notifications on behalf of WellNEST without authorization.

5. INITIAL CONTAINMENT

WellNEST will take reasonable steps to contain and assess suspected incidents.

Depending on the circumstances, actions may include:

  • Disabling compromised accounts or credentials.

  • Revoking unauthorized access.

  • Contacting the relevant technology provider.

  • Securing affected devices or records.

  • Preserving relevant system logs and evidence.

  • Restricting further disclosure or transfer.

  • Engaging appropriate technical, legal or forensic assistance.

Containment efforts should avoid unnecessary destruction of evidence or interruption of unaffected services.

6. INVESTIGATION AND ASSESSMENT

WellNEST will assess:

  • What occurred and when.

  • Whether unauthorized access, acquisition or disclosure occurred.

  • Whether computerized personal information was involved.

  • Whether information was encrypted or otherwise protected.

  • The categories and approximate quantity of information involved.

  • The number and location of potentially affected individuals.

  • Whether the information could reasonably create identity theft, financial, privacy or other harm.

  • Which vendors, systems or personnel were involved.

  • Which legal or contractual notification obligations may apply.

The investigation and legal assessment will be documented.

7. LEGAL AND CONTRACTUAL NOTIFICATION REVIEW

WellNEST will consult appropriate legal counsel when an incident may trigger notification obligations.

The assessment will consider, as applicable:

  • Arizona Revised Statutes §§ 18-551 and 18-552.

  • Federal privacy and consumer protection requirements.

  • The FTC Health Breach Notification Rule, if applicable.

  • HIPAA obligations, if WellNEST is acting in a covered capacity.

  • Applicable contractual notification requirements.

  • Other state or federal requirements based on affected individuals and information.

For a qualifying Arizona breach, the applicable notification period will be calculated from the statutory determination point, subject to applicable exceptions and law enforcement delays.

Where a third-party service provider maintains information on behalf of WellNEST, contractual requirements should require prompt notice and cooperation.

8. NOTIFICATION AND COMMUNICATION

If notification is legally required, WellNEST will coordinate appropriate notices to affected individuals and governmental or other entities within applicable deadlines.

Notices will contain information required by applicable law and will be provided through legally permissible methods.

Where appropriate, WellNEST will coordinate notifications with affected technology providers, insurers and legal counsel.

No employee, physician coach or contractor may independently represent that a legal breach has or has not occurred on behalf of WellNEST without authorization.

9. DOCUMENTATION

WellNEST will maintain an incident record documenting:

  • Initial report.

  • Investigation timeline.

  • Systems and information involved.

  • Containment measures.

  • Findings and legal assessment.

  • Notification decisions.

  • Notices issued, if applicable.

  • Corrective actions.

  • Final resolution.

Records will be retained in accordance with applicable legal requirements and WellNEST's record-retention policy.

10. THIRD-PARTY SERVICE PROVIDERS

WellNEST will maintain reasonable procedures for receiving incident notifications from relevant vendors.

Where appropriate, vendor agreements should require:

  • Prompt notice of suspected incidents.

  • Cooperation in investigations.

  • Preservation of relevant records.

  • Reasonable assistance with legally required notifications.

  • Disclosure of material security incidents affecting WellNEST information.

11. CORRECTIVE ACTION AND REVIEW

Following an incident, WellNEST will evaluate whether additional safeguards, training, access restrictions, vendor changes or other corrective measures are appropriate.

Material incidents will be reviewed to identify lessons learned and reduce the likelihood of recurrence.

12. POLICY REVIEW

This policy will be reviewed at least annually and updated as appropriate to reflect changes in WellNEST's services, technology providers, information practices and applicable legal requirements.

WELLNEST MEDICINE LLC