Patient Privacy Information Form for Optune Gio® and Optune Lua®

Background

Novocure Inc. is referred to as “we” or “Novocure” in this Patient Privacy Information Form (“Notice”). The use of “you” or “your” refers to the patient named in the associated Service Agreement. All capitalized terms not defined herein have the meaning defined in the Service Agreement.

Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Please contact 855-281-9301 or support@mynovocure.com if you have questions.

Purpose of This Notice

This Notice will tell you about the ways in which Novocure may use and disclose your health information that identifies you (“PHI”). We also describe your rights and certain obligations we have regarding the use and disclosure of PHI.

Our Pledge Regarding Protected Health Information

We understand that health information about you and your health is personal. We are committed to protecting health information about you. We create a record of the products and services that we provide to you. We need this record to provide you with quality products and services used in your care and to comply with certain legal requirements. This Notice applies to all of the PHI we use and disclose related to the products and services used in your care. Your personal doctor, health care provider, and other entities providing products or services to you may have different policies or notices regarding their use and disclosure of your PHI.

Our Legal Requirements

We are required by law to:

Ensure that PHI that identifies you is kept private;
Give you this Notice of our legal duties and privacy practices with respect to PHI about you;
Notify you if we are unable to agree to a requested restriction on how your information is used and disclosed;
Accommodate reasonable requests that you may make to communicate PHI by alternative means or at alternative locations;
Obtain your written authorization for purposes other than those listed below and permitted under law; and
Follow the terms of the notice that currently is in effect.

Who Will Follow Our Privacy Practices

This Notice describes Novocure’s practices and that of all Novocure employees, staff, and other company personnel for US operations only.

These entities, sites, and locations follow the terms of this Notice. Additionally, these entities, sites, and locations may share PHI with each for treatment, payment, or health care operations purposes described in this Notice.

Your Rights Regarding Protected Health Information About You

You have the following rights regarding PHI we maintain about you:

Right to Inspect and Copy

You have the right to inspect and copy PHI that may be used to make decisions about your care. Usually this includes medical and billing records. To inspect and copy PHI that may be used to make decisions about you, please contact 855-281-9301 or support@mynovocure.com. We may charge a fee for copying requested files.

We may deny your request to inspect and copy in certain circumstances. If you are denied access to PHI, you may request that the denial be reviewed. Another person chosen by us will review your request and the denial. We will comply with the outcome of that review.

Right to Amend

If you feel that PHI we have about you is incorrect or incomplete, you may ask us to amend the information. You have the right to request an amendment for as long as the information is kept by us. To request an amendment, please contact 855-281-9301 or support@mynovocure.com. You must provide a reason that supports your request. We may deny your request for an amendment if it does not include a reason to support that request. Additionally, we may deny your request if you ask us to amend information that:

Was not created by us, unless the person or entity that created the information is no longer available to make the amendment;
Is not part of the PHI kept by or for us;
Is not part of the information which you would be permitted to inspect and copy; or
Is accurate and complete.

Right to Accounting of Disclosures

You have the right to request an “accounting of disclosures.” This accounting is a list of the disclosures we made of PHI about you.

Novocure will provide an accounting of all but the following types of disclosure:

Those made for treatment, payment and health care operations;
Those made to you about your own PHI;
Those made to persons involved in your care or other notification purposes;
Those made pursuant to an authorization signed by you disclosing specific uses and disclosures;
Where the disclosures are part of a Limited Data Set (as defined in the Health Insurance Portability and Accountability Act);
Where the disclosures are incidental to an otherwise permissible disclosure;
For national security or intelligence purposes; and
To correctional institutions or law enforcement custodial situations.

To request this list or accounting of disclosures, please contact 855-281-9301 or support@mynovocure.com. We may request that you submit the request in writing. Your request must state a time period that may not be longer than six years from the date of service. Your request should indicate in what form you want the list (i.e., paper or electronic). The first list you request within a 12-month period will be free. For additional lists, we will charge you for the costs of providing the lists. We will notify you of the costs involved and you may choose to withdraw or modify your request at the time before any costs are incurred.

Right to Request Restrictions

You have the right to request a restriction or limitation on the PHI we use or disclose about you for treatment, payment, or health care operations. You also have the right to request a limit on the PHI we disclose about you to someone who is involved in your care or the payment for your care, like a family member or friend. You may restrict disclosures of PHI to a health plan if you have paid out of pocket in full for the health care item or service. We are not required to agree to your request. If we do agree, we will comply with your request unless the information is needed to provide you emergency treatment. Please contact 855-281-9301 or support@mynovocure.com to request restrictions. We may request a written request. You must tell us i) what information you want to limit, ii) whether you want to limit our use, disclosure, or both, and iii) to whom you want the limits to apply, for example, disclosures to your spouse.

Right to Request Confidential Communications

You have the right to request that we communicate with you about medical matters in a certain way or at a certain location. For example, you can ask that we only contact you at work or by mail. Please contact 855-281- 9301 or support@mynovocure.com to request confidential communications. We may request a written request. We will accommodate all reasonable requests. Your request must specify how or where you wish to be contacted.

Right to Revoke Authorization

You have the right, in those instances where written authorization is required, to revoke such authorization to use or disclose PHI except to the extent action has already been taken. Such revocation must be in writing.

Right to a Paper Copy of This Notice

You have the right to a paper copy of this Notice. You may ask us to give you a copy of this Notice at any time. Even if you have agreed to receive this Notice electronically, you are still entitled to a paper copy of this Notice. Please contact 855-281-9301 or support@mynovocure.com to request a paper copy.

How We May Use and Disclose Protected Health Information About You

The following categories describe different ways that we are permitted to use and disclose PHI as a health care provider. Certain of these categories may not apply to our business and we may not actually use or disclose your PHI for such purposes. Not every use or disclosure in a category will be listed. However, all of the ways we are permitted or required to use and disclose PHI, without your authorization, will fall within one of the categories.

For Treatment

We may use or disclose PHI about you to assist health care professionals and providers to provide you with medical treatment or services. For example, we may receive and provide PHI related to your use of our products or services to your physician and the staff at your physician’s practice to assist your physician in maintaining appropriate use of the device.

For Payment

We may use and disclose PHI about you so that the products and services we provide you may be billed to and payment may be collected from you, an insurance company, or a third party. For example, we may need to receive from or disclose to your health plan, Medicare, or the medical facility you resided in information about the products and services we provided to you so they or another responsible payor can pay us. This may specifically include information required for the Prescription Order Form, Assignment of Benefits, MRIs, and medical record information. We may also tell your health care provider or plan about a product or service you are going to receive to obtain prior approval or to determine whether your provider or plan will cover that product or service.

For Marketing Purposes

At times, Novocure may, for the benefit of the clients, patients, and market it serves, issue information, solicitations for fundraising, or marketing materials on its products and services. Your rights under the Privacy Rule include your ability to request restrictions or revoke the inclusion of your information at any time in all communications as well as opting into or opting out of any marketing or fundraising activities, uses, and disclosures of PHI for marketing purposes, including subsidized treatment communications, disclosures that constitute a sale of PHI, and other uses and disclosures not described in this Privacy Notice or allowed by the Privacy Rule.

For Health Care Operations

We may use and disclose PHI about you for our health care operations and we may use and disclose PHI about you to other health care providers involved in your care for certain health care operations they have to undertake. These uses and disclosures are necessary to run our company and make sure that users of our products receive the most cost-effective and therapeutic products possible. Examples of health care operations activities by Novocure include, but are not limited to: delivery, pick-up, and service functions; billing and collection efforts; internal auditing; internal employee training; business planning (e.g., analysis of product use and utility; development/ improvement of reimbursement methods); assessing the quality of care and outcomes in your case and similar cases; and quality assurance/improvement activities. We may also combine PHI about many patients to decide what additional products and services we should offer, what products and services are not needed, and to justify how effective our products are in the care of individuals such as you. We may also disclose information to medical facilities and independent researchers for review and learning purposes. We may remove information that identifies you from this set of PHI so others may use it to study health care and health care delivery without learning who the specific patients are.

Notice/Reminders

We may use and disclose PHI to contact you or arrange for your health care provider to contact you regarding product delivery, maintenance, in-service, or pick-up.

Individuals Involved in Your Care or Payment for Your Care

We may disclose your PHI to a family member, other relative, close personal friend of yours, or any other person identified by you. This PHI will be directly relevant to such person’s involvement with your care or payment for your health care when you are present for, or otherwise available prior to, a disclosure and you are able to make health care decisions, if: (i) we obtain your agreement; (ii) we provide you with the opportunity to object to the disclosure and you failed to do so; or (iii) we infer from the circumstances, based upon professional judgment, that you do not object to the disclosure. We may obtain your oral agreement or disagreement to a disclosure. However, if you are not present, or the opportunity to agree or object to the disclosure cannot practicably be provided because of your incapacity or an emergency circumstance, we may, in the exercise of professional judgment, determine whether the disclosure is in your best interests. If it is determined to be in your best interests, we will only disclose PHI that is directly relevant to the person’s involvement with your health care.

Research

Under certain circumstances, we may use and disclose PHI about you for research purposes. For example, a research project may involve comparing the health and recovery of all patients who received a product or service for the same condition. We may also disclose PHI about you to people preparing to conduct a research project, for example to help them look for patients with specific medical circumstances. We will in most circumstances ask for your specific authorization if the researcher will have access to your name, address or other identifying information that reveals who you are.

As Required by Law

We will disclose PHI about you when required to do so by federal, state, or local law. For example, we may disclose information for judicial and administrative proceedings pursuant to legal authority; to report information related to victims of abuse, neglect, or domestic violence; or to assist law enforcement officials in their law enforcement duties.

Government Functions

We may use and disclose PHI about you as required for specialized government functions such as protection of public officials, reporting to various branches of the armed services, or national security activities authorized by law.

To Avert a Serious Threat to Health or Safety

We may use and disclose PHI about you when necessary to prevent a serious threat to your health and safety or the health and safety of the public or another person. Any disclosure, however, would only be to someone able to help prevent the threat.

Business Transfers

There may arise in the course of business the acquisition or sale of our business assets (Business Transfers). Such Business Transfers may involve the sale or purchase of PHI. Also, in the event that Novocure Inc. or its parent entity, or any subsidiary of Novocure Limited are acquired or substantially all of its assets are acquired, PHI likely will be one of the transferred assets.

Workers’ Compensation

We may release PHI about you for workers’ compensation or similar programs. These programs provide benefits for work-related injuries or illness.

Public Health Activities

We may use or disclose your PHI to a health oversight agency for activities authorized by law. These oversight activities include, for example, audits, investigations, inspections, and licensure. These activities are necessary for the government to monitor the health care system, government programs, and compliance with civil rights laws.

Lawsuits and Disputes

If you are involved in a lawsuit or a dispute, we may disclose PHI about you in response to a court or administrative order. We may also disclose PHI about you in response to a subpoena, discovery request, or other lawful process by someone else involved in the dispute, but only if efforts have been made to tell you about the request and obtain your written authorization or to obtain an order protecting the information requested.

Other Uses of Protected Health Information

Other uses and disclosures of PHI not covered by this Notice or otherwise permitted by laws that apply to us will be made only with your written authorization. Your authorization will not be required if Novocure uses or discloses health information for purposes other than as covered by this Notice or permitted by law if Novocure removes any information that individually identifies you before disclosing the remaining information.

If you provide us authorization to use or disclose PHI about you, you may revoke that permission, in writing, at any time. If you revoke your permission, we will no longer use or disclose PHI about you for the reasons covered by your written authorization. You understand that we are unable to take back any disclosures we have already made with your permission, and that we are required to retain our records of the products and services that we provided to you.

Changes to This Notice

We reserve the right to change our information practices and to make the new provisions effective for all PHI we maintain. We also reserve the right to change this Notice at any time. We reserve the right to make the revised or changed Notice effective for PHI we already have about you as well as any information we receive in the future. You may request the current version of our privacy practices by contacting 855-281-9301 or support@mynovocure.com.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the Department of Health and Human Services. To file a complaint with us, you must submit it in writing to Novocure. Please contact 855-281-9301 or support@mynovocure.com to request the current mailing instructions for Novocure.

Updated: June 2025