Physician Code of Conduct

Koves is committed to facilitating a healthcare experience that is respectful, responsive, clinically responsible, and centered on patient safety. This Physician Code of Conduct ("Code") establishes general expectations for licensed physicians and other appropriately licensed healthcare professionals who provide or support clinical services accessible through the Koves platform.

Certain clinical services accessible through Koves may be provided or supported through third-party technology and healthcare infrastructure, including Bask Health, Inc., its affiliates, professional medical entities, and other independent healthcare organizations.

This Code is intended to promote consistency in professionalism, communication, documentation, patient safety, privacy, security, and ethical conduct. It does not replace applicable law, professional licensing obligations, the standard of care, medical board requirements, professional medical entity policies, clinical protocols, informed-consent requirements, or the independent professional judgment of a licensed healthcare provider.

Where this Code conflicts with applicable law, a licensing requirement, a medical board rule, a professional obligation, a patient-specific clinical need, or the independent professional judgment required of a healthcare provider, the applicable legal or professional requirement controls.

Patient safety and independent clinical judgment come first.

Healthcare Providers must make medical decisions solely based on the patient's circumstances, available clinical information, applicable law, appropriate clinical standards, and their own independent professional judgment.

No Healthcare Provider should prescribe, decline to prescribe, select a medication, alter a dosage, continue treatment, discontinue treatment, or make any other clinical decision because of:

• sales targets;
• conversion goals;
• revenue considerations;
• marketing objectives;
• patient pressure;
• commercial incentives;
• administrative convenience; or
• any other non-clinical factor that would improperly interfere with professional judgment.

Telehealth may be unfamiliar to some patients. Healthcare Providers should communicate clearly, respectfully, and without judgment, particularly when patients have questions about the telehealth process, treatment options, medications, eligibility, follow-up, or next steps.

Providers should make reasonable efforts to ensure patients understand the information necessary to participate meaningfully in their care.

When clinically appropriate, Healthcare Providers should provide patients with a clear explanation of relevant treatment decisions, including when:

• treatment is recommended;
• treatment is not recommended;
• a requested medication is not appropriate;
• a different treatment is recommended;
• additional information is needed;
• laboratory testing is required;
• an in-person evaluation is appropriate;
• treatment should be modified; or
• treatment should be discontinued.

Explanations should be clinically appropriate, understandable, and consistent with applicable informed-consent and professional obligations.

Healthcare Providers should follow applicable clinical protocols and use reasonable professional judgment to determine the timing, nature, and frequency of patient follow-up.

Automated reminders, messaging tools, or workflow systems may support follow-up, but they do not replace a provider's obligation to determine whether additional follow-up, reassessment, laboratory testing, referral, or escalation is clinically appropriate.

Healthcare Providers should maintain accurate, timely, and clinically appropriate documentation of patient encounters and decisions in accordance with applicable law, medical-record requirements, organizational policies, and the standard of care.

Documentation should be sufficient to reflect the basis for material clinical decisions. When a patient response, history element, system flag, or other information suggests a potential contraindication, elevated risk, ambiguity, or need for clarification, the provider should document the additional information obtained and the clinical reasoning supporting the decision made.

Documentation should not be altered, falsified, backdated, or created in a manner intended to conceal or misrepresent clinical activity.

Healthcare Providers should monitor assigned clinical communications and respond within timeframes consistent with applicable law, organizational requirements, clinical urgency, and professional standards.

If a provider anticipates being unavailable for a period that may materially affect patient care or timely responses, the provider should follow applicable coverage and escalation procedures established by the professional medical entity or clinical operations team.

Emergencies and urgent concerns should be escalated according to applicable emergency and clinical protocols.

Healthcare Providers must follow applicable identity-verification requirements before providing clinical services.

Where the applicable workflow requires review of identification, identity data, a photograph, automated verification results, or other identifying information, the provider should confirm that the information is reasonably consistent with the individual being evaluated and follow escalation procedures when discrepancies exist.

Providers should not knowingly provide treatment to an individual whose identity cannot be adequately established in accordance with applicable law or required procedures.

Before providing healthcare services through telehealth, Healthcare Providers must comply with all applicable requirements relating to:

• professional licensure;
• the patient's physical location;
• formation of the provider-patient relationship;
• telehealth consent;
• prescribing;
• medical-record documentation;
• identity verification;
• clinical evaluation requirements;
• follow-up requirements; and
• other state or federal requirements.

A provider should not provide medical advice, prescribe medication, or initiate treatment unless the provider is legally permitted to do so in the jurisdiction where the patient is located and all applicable prerequisites have been satisfied.

When there is uncertainty about a legal, licensing, operational, or protocol requirement, the provider should escalate the issue to the appropriate medical operations, compliance, legal, or clinical leadership resource before proceeding when necessary.

Providers should review patients and clinical tasks in a manner designed to promote timely care while appropriately prioritizing urgent or clinically significant matters.

When clinical urgency is comparable, patients who have been waiting longer should generally be addressed before newer routine matters when consistent with applicable workflow rules.

Unless a second opinion, handoff, escalation, supervisory review, or other appropriate clinical involvement is requested or required, a provider should avoid independently altering the care of a patient who is actively being managed by another Healthcare Provider through the same encounter or workflow.

Providers should complete each consultation with sufficient attention and should avoid simultaneously managing multiple encounters in a way that could compromise patient safety, documentation quality, or professional judgment.

Providers should review medication information reasonably available to them and remain alert to:

• drug-drug interactions;
• drug-disease interactions;
• allergies;
• contraindications;
• duplicate therapy;
• prior adverse reactions;
• relevant laboratory information;
• pregnancy-related considerations where applicable;
• substance-use information where clinically relevant; and
• other patient-specific risks.

Providers should review prior plans, relevant historical information, and other available clinical information when reasonably necessary to make a safe treatment decision.

A provider should not prescribe a medication or recommend treatment when material information needed to make a safe decision remains unresolved.

If information is incomplete, inconsistent, ambiguous, or suggests elevated risk, the provider should obtain appropriate clarification, request additional information, require testing, conduct further communication, seek consultation, or refer the patient for in-person evaluation as clinically appropriate.

When a provider is uncertain about a medication interaction, contraindication, protocol issue, or patient-safety concern, the provider should consult an appropriate clinical resource or seek a second opinion when necessary.

Providers should evaluate the patient as a whole and consider relevant underlying or coexisting conditions when making treatment decisions.

Mental and behavioral health concerns should be addressed with the same seriousness as physical health concerns when they are relevant to the patient's presentation, safety, or proposed treatment.

If a patient's responses indicate a possible emergency, acute safety concern, risk of self-harm, risk of harm to others, or another condition requiring urgent intervention, the provider should follow the applicable emergency, escalation, and referral protocols.

Healthcare Providers should remain familiar with applicable condition-specific protocols, prescribing guidance, operational procedures, and clinical resources made available by the applicable professional medical entity or healthcare organization.

Protocols are intended to support, not replace, independent professional judgment.

All medical decisions must remain solely within the independent professional judgment of the treating Healthcare Provider and consistent with the applicable standard of care.

Providers must protect account credentials and authentication mechanisms associated with clinical systems.

Providers must not:

• share passwords or authentication credentials;
• permit unauthorized persons to use their account;
• circumvent access controls;
• leave an authenticated clinical session unattended in an insecure environment; or
• use another provider's credentials.

Suspected compromise of credentials should be reported promptly through the applicable security or operational channel.

Providers must protect patient information in accordance with HIPAA, applicable state privacy laws, professional confidentiality obligations, organizational policies, and any applicable Business Associate Agreements or other contractual requirements.

Patient information should only be accessed, used, or disclosed when reasonably necessary and legally permitted for the applicable purpose.

Providers must not disclose patient information to unauthorized persons or use patient information for personal, commercial, or other unauthorized purposes.

PHI and other confidential patient information must only be transmitted, stored, accessed, or discussed using methods and systems authorized for the applicable healthcare environment.

Providers should not:

• send PHI through unauthorized personal email accounts;
• send PHI through unauthorized messaging applications;
• store PHI on unauthorized devices or services;
• copy PHI into unauthorized software tools;
• share screenshots containing PHI outside approved systems;
• allow unauthorized individuals to view patient information; or
• discuss identifiable patient information where unauthorized persons may overhear.

Providers should use appropriate screen privacy, workstation security, device security, and physical safeguards when accessing patient information.

Healthcare Providers who provide services accessible through Koves are expected to comply with the ethical and professional standards applicable to their profession.

Patient welfare and safety must remain the primary clinical priority.

Providers should not recommend or prescribe a treatment that they believe is medically inappropriate, unsafe, unnecessary, or inconsistent with the applicable standard of care.

Clinical compensation structures, where applicable, should not alter the provider's independent judgment regarding whether a prescription or treatment is appropriate.

Providers should not use access to patients through the Platform to improperly divert or self-refer patients to a separate personal practice, business, product, or service for the provider's own financial benefit.

When an outside referral is clinically appropriate, the provider should follow applicable referral policies, professional obligations, patient choice requirements, and applicable law.

Providers must not practice medicine or provide clinical services while impaired by alcohol, illegal drugs, medication, fatigue, illness, or another condition that materially compromises professional judgment, patient safety, or the ability to provide competent care.

A provider who is not fit to practice safely should stop providing clinical services and follow applicable coverage, reporting, and professional requirements.

Providers are responsible for maintaining all licenses, registrations, certifications, credentials, prescribing authority, continuing education, and other qualifications required for the services they provide.

Providers must not provide services in a jurisdiction where they lack the authority required by applicable law.

To the extent required by applicable agreements, policies, credentialing requirements, or law, providers should promptly notify the appropriate professional medical entity, credentialing organization, medical operations team, compliance team, or other designated party of material events that could affect their ability or authorization to provide clinical services.

Depending on applicable requirements, such events may include:

• licensing investigations or actions;
• medical board complaints or disciplinary actions;
• hospital privilege restrictions;
• professional liability claims or judgments;
• DEA or prescribing-authority restrictions;
• exclusion or debarment from government programs;
• criminal charges or convictions where reportable;
• credentialing changes;
• loss or material limitation of malpractice coverage; or
• other events required to be disclosed under applicable agreements or law.

Providers should disclose and appropriately manage conflicts of interest that could reasonably affect, or appear to affect, independent professional judgment.

Providers should not allow a financial, personal, commercial, or other improper interest to determine a patient's clinical care.

Providers should treat patients professionally and respectfully and comply with applicable federal and state nondiscrimination requirements.

Clinical decisions should be based on medically relevant considerations and not on unlawful discrimination or bias.

Providers must prescribe only when legally authorized and when the provider determines, in independent professional judgment, that the prescription is clinically appropriate.

Providers should comply with all applicable requirements concerning:

• patient evaluation;
• telehealth prescribing;
• state prescribing law;
• federal prescribing law;
• controlled substances where applicable;
• prescription monitoring programs where required;
• documentation;
• informed consent;
• laboratory monitoring;
• follow-up; and
• other prescribing requirements.

No patient is entitled to receive a prescription merely because the patient requested, paid for, or enrolled in a service.

Where compounded medications may be considered, providers should make prescribing decisions in accordance with applicable law, current clinical information, patient-specific circumstances, and independent professional judgment.

Providers should ensure that patients receive disclosures or counseling required by applicable law or professional standards.

Compounded medications do not undergo FDA premarket review.

The Platform is not intended to replace emergency medical services.

If a provider identifies information suggesting a medical or psychiatric emergency, imminent safety risk, or another situation requiring urgent in-person care, the provider should follow applicable emergency protocols and direct or escalate the patient to an appropriate level of care.

Depending on the circumstances, this may include directing the patient to call 911, go to an emergency department, contact an appropriate crisis service, seek urgent in-person evaluation, or involve emergency contacts or authorities where legally and clinically appropriate.

Clinical activity may be subject to quality assurance, peer review, credentialing review, compliance review, documentation review, or other oversight performed by the applicable professional medical entity, healthcare organization, or authorized clinical leadership.

Providers are expected to cooperate with appropriate quality and safety processes while preserving patient confidentiality and all applicable privileges and protections.

Healthcare Providers are responsible for complying with all laws, rules, regulations, professional standards, protocols, and policies applicable to their clinical activities.

These may include requirements relating to:

• professional licensing;
• telehealth;
• prescribing;
• medical records;
• HIPAA and patient privacy;
• informed consent;
• fraud, waste, and abuse;
• professional ethics;
• patient abandonment and continuity of care;
• mandatory reporting;
• credentialing;
• quality assurance; and
• other applicable healthcare requirements.

Nothing in this Code is intended to permit Koves, Bask Health, an administrative service provider, a pharmacy, a marketing organization, or any other non-clinical party to control or improperly influence a Healthcare Provider's independent professional judgment.

Healthcare Providers remain solely responsible for clinical decisions within the scope of their professional role.

This Code may be revised from time to time to reflect changes in law, clinical operations, technology, professional standards, patient-safety practices, or applicable policies.

The "Last Revised" date displayed at the top identifies the most recent version.

Where a provider is subject to a separate professional medical entity policy, provider agreement, clinical protocol, or credentialing requirement, those materials may impose additional or more specific obligations.

Questions regarding Koves administrative or technology matters may be directed to:

Koves LLC
Email: hello@koves.co
Website: Koves.co

Questions concerning clinical protocols, provider obligations, credentialing, patient-specific medical decisions, or professional medical entity requirements should be directed to the applicable clinical organization, medical operations team, or professional medical entity through the designated provider channel.

THIS CODE DOES NOT CREATE A RIGHT TO PRACTICE MEDICINE THROUGH KOVES, DOES NOT MODIFY A PROVIDER'S LEGAL SCOPE OF PRACTICE, AND DOES NOT REPLACE APPLICABLE LAW, PROFESSIONAL STANDARDS, CLINICAL PROTOCOLS, OR INDEPENDENT MEDICAL JUDGMENT.