NOTICE OF PROPOSED CLASS ACTION SETTLEMENT Harris, et al. v. Summit Medical Group, PLLC Case No. 2-119-25 Circuit Court for Knox County, Tennessee IF YOU RECEIVED A NOTICE OF A DATA INCIDENT FROM SUMMIT MEDICAL GROUP, PLLC THAT CERTAIN OF YOUR PERSONAL INFORMATION WAS IMPACTED IN A SEPTEMBER 2024 DATA INCIDENT, A PROPOSED CLASS ACTION SETTLEMENT MAY AFFECT YOUR RIGHTS AND ENTITLE YOU TO BENEFITS. A court has authorized this notice. This is not a solicitation from a lawyer. You are not being sued. Please read this Notice carefully and completely. • A Settlement has been reached with Summit Medical Group, PLLC (“Summit Medical” or “Defendant”) in a class action lawsuit. This case is about the targeted cyberattack on Summit Medical's computer systems that occurred in September 2024 (the “Data Incident”). Certain files that contained Private Information were potentially accessed. These files may have contained personal information such as names; contact information; demographic information; medical record numbers; provider names; dates of services; facilities of service; treatment information; prescription information; health insurance information; and/or Social Security numbers. • The lawsuit is called Harris, et al. v. Summit Medical Group, PLLC, Case No. 2-119-25. It is pending in the Circuit Court for Knox County, Tennessee (the “Litigation”). • Summit Medical denies that it did anything wrong. • The parties have agreed to settle the lawsuit (the “Settlement”) to avoid the costs and risks, disruptions, and uncertainties of continuing the Litigation. • Summit Medical's records indicate that you are a Settlement Class Member and entitled to benefits under the Settlement. You may have received a previous notice directly from Summit Medical. • Your rights are affected whether you act or don’t act. Please read this Notice carefully and completely. SUMMARY OF YOUR LEGAL RIGHTS AND OPTIONS IN THIS SETTLEMENT DEADLINE SUBMIT A CLAIM The only way to receive benefits or payments from this Settlement November 4, 2026 is by submitting a valid and timely Claim Form. The fastest way to submit your Claim Form is online at www.SummitMedicalDataSettlement.com. If you prefer, you can download the Claim Form from the Settlement Website and mail it to the Settlement Administrator. OPT-OUT OF THE You can choose to opt-out of the Settlement and receive no Cash October 20, 2026 SETTLEMENT Payment or Medical Data Monitoring. This option allows you to sue, continue to sue, or be part of another lawsuit against the Defendant related to the legal claims resolved by this Settlement. You can hire your own lawyer at your own expense. OBJECT TO THE If you do not opt-out of the Settlement, you may object to it by October 20, 2026 SETTLEMENT AND/OR writing to the Court about why you don’t like the Settlement. You may also ask the Court for permission to speak about your ATTEND A HEARING objection at the Final Approval Hearing. If you object, you may also file a claim for Settlement Class Member benefits. DO NOTHING Unless you opt-out of the Settlement, you are automatically part of No Deadline the Settlement. If you do nothing, you will not receive benefits or payments from this Settlement. You will give up the right to sue, continue to sue, or be part of another lawsuit against the Defendant related to the legal claims resolved and released by this Settlement. • These rights and options—and the deadlines to exercise them—are explained in this Notice. • The Court in charge of this case still has to decide whether to approve the Settlement. 2 Questions? Call 1-(866)-675-2936 Toll-Free or Visit www.SummitMedicalDataSettlement.com WHAT THIS NOTICE CONTAINS BASIC INFORMATION .................................................................................................... 3 WHO IS IN THE SETTLEMENT .......................................................................................... 4 THE SETTLEMENT BENEFITS........................................................................................... 4 SUBMITTING A CLAIM FORM FOR SETTLEMENT BENEFITS ................................................ 6 THE LAWYERS REPRESENTING YOU ............................................................................... 6 OPTING OUT FROM THE SETTLEMENT ............................................................................ 7 COMMENTING ON OR OBJECTING TO THE SETTLEMENT.................................................. 7 THE COURT’S FINAL APPROVAL HEARING ...................................................................... 9 IF I DO NOTHING ........................................................................................................... 9 GETTING MORE INFORMATION .................................................................................... 10 Basic Information 1. Why was this Notice issued? The Circuit Court for Knox County, Tennessee, authorized this Notice. You have a right to know about the proposed Settlement of this class action lawsuit, and about all of your options, before the Court decides whether to grant final approval of the Settlement. This Notice explains the lawsuit, your legal rights, what benefits are available, and who can receive them. The lawsuit is called Harris, Laura, et al. v. Summit Medical Group, PLLC, Case No. 2-119-25. It is pending in the Circuit Court for Knox County, Tennessee. The people who filed this lawsuit are called the “Plaintiffs” (or “Class Representatives”) and the company they sued, Summit Medical Group, PLLC, is called the “Defendant.” 2. What is this lawsuit about? This lawsuit alleges that during the September 2024 targeted cyberattack on Summit Medical's computer systems, certain files that contained Private Information were accessed. These files may have contained personal information such as names; contact information; demographic information; medical record numbers; provider names; dates of services; facilities of service; treatment information; prescription information; health insurance information; and/or Social Security numbers. 3. What is a class action? In a class action, one or more individuals sue on behalf of other people with similar claims. These individuals are called the “Plaintiffs” or “Class Representatives.” Together, the people included in the class action are called a “Class” or “Class Members.” One court resolves the lawsuit for all Class Members, except for those who opt out from the settlement. In this proposed Settlement, the Class Representatives are Laura Harris; Christopher Harris; Scott Campion; J.B. through parent Jade Brown; and Jade Brown. Everyone included in this Action are the Settlement Class Members. 3 Questions? Call 1-(866)-675-2936 Toll-Free or Visit www.SummitMedicalDataSettlement.com 4. Why is there a Settlement? The Court did not decide whether the Plaintiffs or the Defendant are right. Both sides have agreed to a Settlement to avoid the costs and risks of a trial and to allow the Settlement Class Members to receive benefits from the Settlement. The Plaintiffs and their attorneys think the Settlement is best for all Settlement Class Members. Who is in the Settlement? 5. Who is included in the Settlement? The Court has defined the Settlement Class as: “All living individuals in the United States whose Private Information was potentially compromised in the Data Incident, including all individuals who were mailed notice of the Data Incident from Defendant.” 6. Are there exceptions to being included? Yes. Excluded from the Class are: (a) all persons who are directors and officers of Defendant, or its respective subsidiaries and affiliated companies; (b) governmental entities; and (c) the Judge(s) assigned to the Action, the Judge’s immediate family, and Court staff. If you are not sure whether you are a Settlement Class Member, you can ask for free help any time by contacting the Settlement Administrator at: • Email: info@SummitMedicalDataSettlement.com • Call toll free, 24/7: 1-(866)-675-2936 • By mail: Summit Data Incident Settlement c/o Settlement Administrator PO Box 25226 Santa Ana, CA 92799-9958 You may also view the Settlement Agreement at www.SummitMedicalDataSettlement.com. The Settlement Benefits 7. What does the Settlement provide? All Settlement Class Members may claim Medical Data Monitoring and two Cash Payment options. Any cash payment may be decreased on a pro rata basis if more than $500,000 is claimed by eligible class members. The benefits are explained in more detail below. MEDICAL DATA MONITORING. All Settlement Class Members are eligible to enroll in two years of CyEx Medical Shield Complete. This comprehensive service comes with $1 million of medical identity theft insurance, and includes monitoring for: • healthcare insurance ID exposure • Medical Record Number (MRN) exposure • unauthorized Health Savings Account (HSA) spending If anything suspicious happens, you will be able to talk to a fraud resolution agent to help fix any problems. 4 Questions? Call 1-(866)-675-2936 Toll-Free or Visit www.SummitMedicalDataSettlement.com CASH PAYMENTS. Settlement Class Members who have documented losses may claim a payment from Cash Payment A – Documented Losses. Additionally, Settlement Class Members who spent time responding to the Data Incident may claim a payment from Cash Payment B – Lost Time. Cash Payment A – Documented Losses. If you incurred actual, documented out-of-pocket losses due to the Data Incident, you can get back up to $2,500.00. The losses must have occurred between September 2024, and November 4, 2026. This benefit covers out-of-pocket expenses like: • losses because of identity theft or fraud • fees for credit reports, credit monitoring, or freezing and unfreezing your credit • cost to replace your IDs • postage to contact banks by mail You need to send proof, like receipts, to show how much you spent or lost. Your personal certifications, declarations, or affidavits do not constitute reasonable documentation to make a valid claim, but you may include that to provide clarification, context, or support for other submitted reasonable documentation showing that your expenses were because of the Data Incident. You cannot claim a payment for expenses that have already been reimbursed by a third party. Cash Payment B – Lost Time. Settlement Class Members who spent time responding to the Data Incident may claim up to three hours, at $15.00 per hour, for a maximum of $45.00. You must have spent the time on tasks related to the Data Incident. Some examples include things like: • changing your passwords • investigating suspicious activity in your accounts • researching the Data Incident You must attest that the time claimed was spent as a result of the Data Incident. If you have questions about these benefits, you can ask for free help any time by contacting the Settlement Administrator at: • Email: info@SummitMedicalDataSettlement.com • Call toll free, 24/7: 1-(866)-675-2936 • By mail: Summit Data Incident Settlement c/o Settlement Administrator PO Box 25226 Santa Ana, CA 92799-9958 8. What claims am I releasing if I stay in the Settlement Class? If you stay in the Settlement Class, you won’t be able to be part of any other lawsuit against Summit Medical about the issues that this Settlement covers. The “Releases” section of the Settlement Agreement (Section XI) describes the legal claims that you give up if you remain in the Settlement Class. The Settlement Agreement is available at www.SummitMedicalDataSettlement.com. 5 Questions? Call 1-(866)-675-2936 Toll-Free or Visit www.SummitMedicalDataSettlement.com Submitting a Claim Form for a Settlement Payment 9. How do I submit a claim for a Settlement benefit? The fastest way to submit your Claim Form is online at www.SummitMedicalDataSettlement.com. If you prefer, you can download a printable Claim Form from the website and mail it to the Settlement Administrator at: Summit Data Incident Settlement c/o Settlement Administrator PO Box 25226 Santa Ana, CA 92799-9958 You may also contact the Settlement Administrator to request a Claim Form by telephone, toll free, 1-(866)-675-2936, by email info@SummitMedicalDataSettlement.com, or by U.S. mail at the address above. 10. Are there any important Settlement payment deadlines? If you are submitting a Claim Form online, you must do so by November 4 ,2026. If you are submitting a claim by U.S. mail, the completed and signed Claim Form, including supporting documentation, must be postmarked no later than November 4 ,2026. 11. When will the Settlement benefits be issued? The Court will hold a Final Approval Hearing on November 19, 2026, (see Question 18). If the Court approves the Settlement, there may be appeals. We do not know if appeals will be filed, or how long it will take to resolve them if they are filed. Settlement payments will be distributed if the Court grants final approval, and after any appeals are resolved. Please be patient. The Lawyers Representing You 12. Do I have a lawyer in the case? Yes, the Court has appointed attorneys J. Gerard Stranch, IV of Stranch, Jennings & Garvey, PLLC; Jeff Ostrow of Kopelowitz Ostrow, P.A.; Lisa A. White of Mason LLP; and Tyler J. Bean of Siri & Glimstad LLP, to represent you and other Settlement Class Members (“Class Counsel”). 13. Should I get my own lawyer? You will not be charged for Class Counsel’s services. If you want your own lawyer, you may hire one at your expense. 14. How will Class Counsel be paid? Class Counsel will ask the court to approve up to $575,000.00 as reasonable attorneys' fees and costs of litigation. This amount will be paid by Summit Medical. Class Counsel will also ask for Service Award payments of $2,500.00 for each of the Class Representatives. Service Award payments will also be paid by Summit Medical. 6 Questions? Call 1-(866)-675-2936 Toll-Free or Visit www.SummitMedicalDataSettlement.com Opting-Out from the Settlement 15. How do I opt out of the Settlement? If you do not want to be part of the Settlement, you must formally exclude yourself from the Settlement. This is called an Opt-Out Request. If you opt-out, you are telling the Court that you do not want to be part of the Settlement. You will not be eligible to receive any Settlement benefits if you opt-out. However, you will keep any rights you may have to sue Summit Medical on your own about the legal issues in this case. The deadline to opt-out from the Settlement is October 20, 2026. To be valid, your Opt-Out Request must have the following information: (1) the name of the Litigation: Harris, et al. v. Summit Medical Group, PLLC, Case No. 2-119-25, pending in the Circuit Court for Knox County, Tennessee; (2) your full name, mailing address, telephone number, and email address; (3) personal signature; and (4) the words “Opt-Out Request” or a clear and similar statement that you do not want to participate in the Settlement. You may only exclude yourself—not any other person. Mail your Request for Exclusion to the Settlement Administrator at: Summit Data Incident Settlement ATTN: Exclusion Request PO Box 25226 Santa Ana, CA 92799-9958 Your Opt-Out Request must be submitted and postmarked by October 20, 2026. Commenting on or Objecting to the Settlement 16. How do I tell the Court if I do not like the Settlement? If you are a Settlement Class Member and do not like part or all of the Settlement, you can object to it. Objecting means telling the Court your reasons for why you think the Court should not approve the Settlement. The Court will consider your views. You cannot object if you have opted-out from the Settlement (see Question 15) You must provide the following information for the Court to consider your objection: (1) the name of the Litigation: Harris, et al. v. Summit Medical Group, PLLC, Case No. 2-119-25, pending in the Circuit Court for Knox County, Tennessee; (2) your full name, mailing address, telephone number, and email address (if any); 7 Questions? Call 1-(866)-675-2936 Toll-Free or Visit www.SummitMedicalDataSettlement.com (3) all grounds for the objection, accompanied by any legal support for the objection known to the objector or objector’s counsel; (4) the number of times the objector has objected to a class action settlement within the five years preceding the date that the objector files the objection, the caption of each case in which the objector has made such objection, and a copy of any orders related to or ruling upon the objector’s prior objections that were issued by the trial and appellate courts in each listed case; (5) the identity of all counsel who represent the objector, including any former or current counsel who may be entitled to compensation for any reason related to the objection to the Settlement and/or the Application for Attorneys’ Fees, Costs, and Service Awards, and whether they will appear at the Final Approval Hearing; (6) the number of times in which the objector’s counsel and/or the objector’s counsel’s law firm have objected to a class action settlement within the five years preceding the date of the filed objection, the caption of each case in which counsel or the firm has made such objection and a copy of any orders related to or ruling on the objection issued by the trial and appellate courts in each such listed case; (7) a list of all persons who will be called to testify at the Final Approval Hearing in support of the objection (if any); (8) a statement confirming whether the objector and/or objector’s counsel intends to personally appear and/or testify at the Final Approval Hearing; and (9) your signature (if you have hired your own lawyer, their signature is not sufficient). For your objection to be considered, it must meet each of these requirements. To be considered by the Court, you must file your complete objection with the Clerk of Court by October 20, 2026. You must also send a copy of the objection by U.S. Mail to the Settlement Administrator, Class Counsel, and Defendant’s Counsel. Clerk of the Court Settlement Administrator Clerk of the Court Summit Data Incident Settlement State of Tennessee in the Circuit Court of Knox ATTN: Objections County, Tennessee Civil Division PO Box 25226 400 Main Street, M30 Santa Ana, CA 92799-9958 Knoxville, TN 37902 8 Questions? Call 1-(866)-675-2936 Toll-Free or Visit www.SummitMedicalDataSettlement.com Class Counsel Counsel for Defendants J. Girard Stranch, IV Carrie Dettmer Slye Stranch, Jennings & Garvey PLLC Baker & Hostetler LLP 223 Rosa L. Parks Ave., Ste. 200 312 Walnut St., Ste. 3200 Nashville, TN 37203 Cincinnati, OH 45202 Jeff Ostrow Kopelowitz Ostrow P.A. 1 West Las Olas Blvd., Ste. 500 Fort Lauderdale, FL 33301 Lisa A. White Mason LLP 5335 Wisconsin Ave., NW, Ste. 640 Washington, DC 20015 Tyler J. Bean Siri & Glimstad LLP 745 Fifth Ave., Ste. 500 New York, NY 10151 17. What is the difference between objecting and opting-out? Objecting is telling the Court that you do not like something about the Settlement. You can object to the Settlement only if you do not opt-out from the Settlement. Opting out from the Settlement is stating to the Court that you do not want to be part of the Settlement. If you opt-out of the Settlement, you cannot object to it because the Settlement no longer affects you. The Court’s Final Approval Hearing 18. When is the Court’s Final Approval Hearing? The Court will hold a final approval on November 19, 2026, at 10:00am Eastern Time, at the Circuit Court for Knox County, Tennessee, at 400 Main Street, Suite M30, Knoxville, TN 37902. At the Final Approval Hearing, the Court will decide whether to approve the Settlement. The court will also decide Class Counsel’s request for an attorney’s fees and costs award and the request for Service Awards to the Class Representatives. The Court will also consider any timely objections to the Settlement. If you are a Settlement Class Member, you or your lawyer may ask permission to speak at the hearing at your own cost (See Question 16). The date and time of this hearing may change without further notice. Please check www.SummitMedicalDataSettlement.com for updates. 9 Questions? Call 1-(866)-675-2936 Toll-Free or Visit www.SummitMedicalDataSettlement.com 19. Do I have to come to the Final Approval Hearing? No. Class Counsel will answer any questions the Court may have. You may attend at your own expense if you wish, but you do not have to. If you file an objection, you do not have to come to the Final Approval Hearing to talk about it; the Court will consider it as long as it was filed on time. You may also pay your own lawyer to attend, but you do not have to. If I Do Nothing 20. What happens if I do nothing at all? If you do nothing, you will not receive a benefit from this Settlement. You will also give up the rights described in Question 8. Getting More Information 21. How do I get more information? This Notice is a summary of the proposed Settlement. The full Settlement Agreement and other related documents are available at the Settlement Website, www.SummitMedicalDataSettlement.com If you have additional questions, you can ask for free help any time by contacting the Settlement Administrator at: • Email: info@SummitMedicalDataSettlement.com • Call toll free, 24/7: 1-(866)-675-2936 • By mail: Summit Data Incident Settlement c/o Settlement Administrator PO Box 25226 Santa Ana, CA 92799-9958 You can obtain copies of publicly filed documents by visiting the office of the Clerk of the Court, 400 Main Street, Suite M30, Knoxville, TN 37902. DO NOT CONTACT THE COURT OR CLERK OF COURT REGARDING THIS SETTLEMENT 10 Questions? Call 1-(866)-675-2936 Toll-Free or Visit www.SummitMedicalDataSettlement.com