NOTICE OF PROPOSED CLASS ACTION SETTLEMENT United States District Court for the District of Arizona Hulewat et al. v. Medical Management Resource Group LLC d/b/a American Vision Partners, et al. Case No. 2:24-cv-00377-DJH A Court has authorized this Long Form Notice (“Notice”). This is not a solicitation from a lawyer. If You Are One of the Approximately 1.6 million U.S. Residents Whose Personal Information Was Compromised in the Data Breach, You Are a Settlement Class Member in a Class Action Settlement  A Court authorized this Notice, to those that are eligible to receive benefits from a proposed class action settlement. The Action is titled Hulewat et al. v. Medical Management Resource Group LLC d/b/a American Vision Partners, et al., Case No. 2:24-cv-00377-DJH and is pending in the United States District Court for the District of Arizona. The persons that filed the class action lawsuit are called Plaintiffs and the companies they sued are Medical Management Resource Group, L.L.C.; Barnet Dulaney Perkins Eye Center, PC; Marc Ellman, M.D., P.A. d/b/a Southwest Eye Institute; Southwestern Eye Center, Ltd.; and Eye Associates of Nevada d/b/a Wellish Vision Institute (“Defendant” or “American Vision” or “AVP”). Defendant denies any wrongdoing whatsoever.  Who is a Settlement Class Member? All Persons who are members of the Injunctive Relief Class and the Damages Settlement Class. There are two (2) settlement classes in this settlement: Damages Settlement Class Member: Approximately 258,070 U.S. residents whose Social Security numbers and other personal information were compromised in the Data Breach. Excluded from the Damages Class are the Defendant, their representatives, any judicial officer presiding over the matter, such judicial officers’ immediate family members and staff, and any Settlement Class Member who timely and validly requests to opt-out from the settlement. The Damages Settlement Class Members are eligible to submit a Claim to under the Damages Class Benefits. Injunctive Relief Class: All individuals whose personal information is collected or maintained by Defendant. Excluded from the Injunctive Relief Class are the Defendant, their representatives, any judicial officer presiding over the matter, such judicial officers’ immediate family members and staff, and any Settlement Class Member who timely and validly requests to opt-out from the settlement. Questions? Go to www.AmericanVisionSettlement.com or call (833) 630-5366 -1-  Damages Settlement Class Members under the Settlement Agreement will be eligible to receive one of the following Damages Class Benefits: ❖ Pro-Rata Cash Payment: Damages Settlement Class Members may submit a Claim for a pro rata cash payment. The Settlement Administrator will make pro rata settlement payments, which may increase or decrease the pro rata cash payment, subject to the Settlement Fund cap; OR ❖ Out-of-Pocket Expense Claims: Damages Settlement Class Members may submit a Claim for reimbursement of documented out-of-pocket losses reasonably and fairly traceable to the Data Breach, subject to an individual cap of $3,000 per claimant. DEFENDANT AGREES TO IMPLEMENT AND MAINTATIN CYBERSECURITY MEASURES FOR A MINIMUM PERIOD OF TIME FOR INJUCTIVE RELIEF CLASS MEMBERS DESCRIBED IN QUESTION 8 BELOW.  To obtain more information visit www.AmericanVisionSettlement.com or call (833) 630- 5366. Please read this Notice carefully. Your legal rights will be affected, and you have a choice to make at this time. Summary of Legal Rights Deadlines Submit a Claim Form The only way a Damages Settlement Submitted or postmarked on or Class Member can receive Damages before November 12, 2026. Class Benefits from the settlement. Exclude Yourself by Receive no benefits from the Mailed and postmarked on or Opting Out of the settlement. This is the only option before October 13, 2026. Settlement Class that allows you to keep your right to bring any other lawsuit against the Defendant relating to the Data Breach. Object to the Settlement You can write the Court about why Mailed and postmarked on or and/or Attend the Final you agree or disagree with the before October 13, 2026. Fairness Hearing settlement or the attorneys’ fees and Service Awards. The Court cannot order a different settlement. You can also ask to speak at the Final Fairness Hearing on December 10, 2026 at 10:00 a.m. MT, about the fairness of the settlement, with or without your own attorney. Do Nothing Those eligible will not receive any N/A Damages Class Benefits from this class action settlement, but will remain a Settlement Class Member and be bound by the releases.  Your rights and options as a Settlement Class Member – and the deadlines to exercise your rights – are explained in this Notice. Questions? Go to www.AmericanVisionSettlement.com or call (833) 630-5366 -2-  The Court still will have to decide whether to approve the Settlement. Damages Class Benefits will be made available only if the Court approves the Settlement and after any possible appeals are resolved. What This Notice Contains Basic Information .............................................................................................................................. 4 Who is in the Settlement ................................................................................................................... 5 The Damages Class Benefits—What You Get if You Qualify ...................................................... 5 How Do You Submit a Claim ........................................................................................................... 7 Excluding Yourself from the Settlement ......................................................................................... 8 Objecting to the Settlement .............................................................................................................. 9 The Lawyers Representing You ....................................................................................................... 9 The Court’s Final Fairness Hearing ............................................................................................. 10 If You Do Nothing ........................................................................................................................... 11 Additional Information ................................................................................................................... 11 Questions? Go to www.AmericanVisionSettlement.com or call (833) 630-5366 -3- BASIC INFORMATION 1. Why is there a Notice? The Court authorized this Notice because you have a right to know about the settlement, and all of your options, before the Court decides whether to give final approval to the settlement. This Notice explains the nature of the Action that is the subject of the settlement, the general terms of the settlement, and your legal rights and options. Judge Diane J. Humetewa of the United States District Court for the District of Arizona is overseeing this case captioned as Hulewat et al. v. Medical Management Resource Group. L.L.C. d/b/a American Vision Partners, et al., Case No. 2:24-cv-00377-DJH. The people who brought the lawsuit are called the “Plaintiffs.” The companies being sued, Medical Management Resource Group, L.L.C.; Barnet Dulaney Perkins Eye Center, PC; Marc Ellman, M.D., P.A. d/b/a Southwest Eye Institute; Southwestern Eye Center, Ltd.; and Eye Associates of Nevada d/b/a Wellish Vision Institute (collectively, “American Vision” or “AVP”) are called the “Defendant.” 2. What is the Action about? The Action arises from a cyberattack which Defendant discovered on or about November 14, 2023, wherein an unauthorized third party gained access to Defendant’s computer network and the information of approximately 1,600,000 individuals, or the “Data Breach.” Specifically, Plaintiffs allege that as a result of the Data Breach, the cybercriminals may have gained access to Plaintiffs’ and the Settlement Class Member’s personal information including names, dates of birth, Social Security numbers, and contact information, personally identifiable information, or PII, and medical treatment and health insurance information, which is protected health information, or PHI or Private Information, as defined by the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Defendant denies any wrongdoing whatsoever. No court or other judicial body has made any judgment or other determination that Defendant has done anything wrong. 3. Why is this a class action? In a class action, one or more people called “Plaintiffs” sue on behalf of all people who have similar claims. Together, all of these people are called a “Settlement Class,” and the individuals are called “Settlement Class Members.” One court resolves the issues for all Settlement Class Members, except for those who exclude themselves from the Settlement Class. The Plaintiffs in this case are Linda Hulewat, Karen Foti Williams, Ralph Gallegos, Michael Martinez, Lynnae Anderson, Marie Therese Montoya, Charles Peterson, Robert Kirk, Marilyn Zajacka, Lynda Israel, Latricia Pelt, Barry Pelt, Ken Waters, Robert Ahrensdorf, and David Yeager. 4. Why is there a settlement? The Court has not decided in favor of the Plaintiffs or Defendant. Instead, both sides agreed to the settlement. The settlement avoids the cost and risk of a trial and related appeals, while providing benefits to Settlement Class Members. The Plaintiffs appointed to represent the Settlement Class, and the attorneys for the Settlement Class, “Class Counsel,” think the settlement is best for all Settlement Class Members. Questions? Go to www.AmericanVisionSettlement.com or call (833) 630-5366 -4- WHO IS IN THE SETTLEMENT? 5. How do I know if I am part of the settlement? You are affected by the settlement and potentially a Settlement Class Member if you are a Person who is a member of the Injunctive Relief Class and/or the Damages Settlement Class. There are two (2) settlement subclasses in this settlement: Damages Settlement Class Member: Approximately 258,070 U.S. residents whose Social Security numbers and other personal information were compromised in the Data Breach. Excluded from the Damages Class are Defendant, their representatives, any judicial officer presiding over the matter, such judicial officers’ immediate family members and staff, and any Settlement Class Member who timely and validly requests to opt-out from the settlement. The Damages Settlement Class Members are eligible to submit a Claim under the Damages Class Benefits. Injunctive Relief Class: All individuals whose personal information is collected or maintained by Defendant. Excluded from the Injunctive Relief Class are Defendant, their representatives, any judicial officer presiding over the matter, such judicial officers’ immediate family members and staff, and any Settlement Class Member who timely and validly requests to opt-out from the settlement. 6. What if I am not sure whether I am included in the settlement? If you are not sure whether you are included in the settlement, you may call (833) 630-5366 with questions. You may also write with questions to: Settlement Administrator - 83312 c/o Kroll Settlement Administration LLC P.O. Box 225391 New York, NY 10150-5391 THE DAMAGES CLASS BENEFITS–WHAT YOU GET IF YOU QUALIFY 7. What does the settlement provide? The settlement provides the Damages Settlement Class Members the opportunity to submit a Claim for Damages Class Benefits on or before the Claims Deadline. The Damages Class Benefits include: (1) Pro-Rata Cash Payments; OR (2) Out-of-Pocket Expense Claims. These benefits shall be paid from the $1,750,000 non-reversionary Settlement Fund. 8. What Damages Class Benefits are available under the settlement? Damages Settlement Class Members that submit a valid and timely Claim Form may select one of the following Damages Class Benefits: a) Pro-Rata Cash Payment: Damages Settlement Class Members may submit a Claim for a pro rata cash payment. The Settlement Administrator will make pro rata settlement payments, which may increase or decrease the pro rata cash payment, subject to the Settlement Fund cap; OR Questions? Go to www.AmericanVisionSettlement.com or call (833) 630-5366 -5- b) Out-of-Pocket Expense Claims: Damages Settlement Class Members may submit a Claim for reimbursement of documented out-of-pocket losses reasonably and fairly traceable to the Data Breach, subject to a $3,000 cap per claimant.  Out-of-Pocket-Expense Claims will include, without limitation, unreimbursed losses relating to fraud or identity theft; professional fees including attorneys’ fees, accountants’ fees, and fees for credit repair services; costs associated with freezing or unfreezing credit with any credit reporting agency; credit monitoring costs that were incurred on or after November 2023 that the claimant attests were caused or otherwise incurred as a result of the Data Breach, through the date of Claim submission; and miscellaneous expenses such as notary, data charges (if charged based on the amount of data used) fax, postage, copying, mileage, cell phone charges (only if charged by the minute), and long-distance telephone charges.  Damages Settlement Class Members with Out-of-Pocket-Expense Claims must submit documentation and attestation supporting their Claims. This may include receipts or other documentation, not “self-prepared” by the claimant, that documents the costs incurred. o “Self-prepared” documents such as handwritten receipts are, by themselves, insufficient to receive reimbursement, but may be considered to add clarity or support to other submitted documentation. Settlement Class Members cannot be reimbursed for expenses if they have been reimbursed for the same expenses by another source, including compensation provided in connection with the credit monitoring and identity theft protection product offered as part of the notification letter provided by Defendant or otherwise.  Out-of-Pocket Expense Claims must include an attestation that the monetary losses are fairly traceable to the Data Breach and were not incurred due to some other event or reason. DEFENDANT AGREES TO IMPLEMENT AND MAINTATIN CYBERSECURITY MEASURES FOR A MINIMUM PERIOD OF TIME FOR INJUCTIVE RELIEF CLASS MEMBERS DESCRIBED BELOW: c) Injunctive Relief: As additional consideration for the dismissal and release of injunctive claims by the Injunctive Relief Class, Defendants agree to implement and maintain the following cybersecurity measures for a minimum period of time to be addressed in a long- form settlement agreement. The value of these cybersecurity measures is approximately $2,787,630. These business practice commitments shall constitute contractually enforceable obligations of the Settlement Agreement, with all costs of implementation and maintenance to be borne solely by Defendant, separate and apart from the Damages Class Settlement Fund:  Chief Information Officer. Creation and maintenance of a Chief Information Officer (CIO) role, responsible for managing AVP’s information technology environment and mitigating cybersecurity risks, working in coordination with AVP’s Security Officer.  Information Security Training Specialist. Retention of a dedicated Information Security Training Specialist, specifically responsible for managing cybersecurity training across the enterprise in consultation with the Security Officer. Questions? Go to www.AmericanVisionSettlement.com or call (833) 630-5366 -6-  Cybersecurity Steering Committee. Operation of a cross-functional Cybersecurity Steering Committee, consisting of the company’s Security Officer, CIO, CEO, General Counsel, and other senior management personnel, tasked with overseeing AVP’s cybersecurity program and meeting periodically to manage and coordinate cybersecurity governance and risk management issues.  Enhanced Cybersecurity Training. Implementation and maintenance of an enterprise-wide cybersecurity training program, including a supplemental Security Awareness Policy and course for all employees.  Penetration Testing. In addition to monthly vulnerability scanning, engagement of an independent third-party vendor to conduct periodic penetration testing of AVP’s systems, leveraging the Common Vulnerability Scoring System (CVSS) framework to classify the severity of identified risks.  Enhanced Data Classification Policies. Implementation and maintenance of enhanced data classification policies and backend data classification solutions to streamline management of, and access to, electronic protected health information (ePHI), including additional access controls to reduce AVP’s potential attack surface.  Third-party management of SIEM, SOC, and firewall. Implementation of additional cybersecurity measures run by an external security provider, including SIEM, SOC, and management of corporate firewall.  Email Security. Implementation of improved email security gateway.  Disaster Recovery Solution. Implementation of improved disaster recovery solution.  Security Risk Assessments. Performance of regular security risk assessments with external vendors to evaluate the effectiveness of AVP’s cybersecurity program and remediate or reasonably mitigate any identified vulnerabilities.  Amended Security Policies. Adoption, implementation, and ongoing maintenance of amended security policies, including an updated incident response policy and related protocols to govern detection, response, and remediation of future security incidents. HOW DO YOU SUBMIT A CLAIM? 9. How do I get a Damages Class Benefit? To receive Damages Class Benefits, you must complete and submit a Claim Form online at www.AmericanVisionSettlement.com or by mail to Settlement Administrator – 83312 , c/o Kroll Settlement Administration LLC, P.O. Box 225391, New York, NY 10150-5391. Read the Claim Form instructions carefully, fill out the Claim Form, provide the required documentation, and submit online by November 12, 2026 or by mail postmarked by November 12, 2026. TO RECEIVE AN ELECTRONIC OR ACH PAYMENT FOR YOUR VALID CLAIM, YOU MUST FILE A CLAIM FORM ONLINE AT WWW.AMERICANVISIONSETTLEMENT.COM. Questions? Go to www.AmericanVisionSettlement.com or call (833) 630-5366 -7- 10. When will I get my Damages Class Benefit? The Court will hold a Final Fairness Hearing on December 10, 2026 at 10:00 a.m. MT to decide whether to approve the settlement. If the Court approves the settlement, there may be appeals from that decision and resolving them can take time. It also takes time for all of the Claim Forms to be processed. Please be patient. Damages Class Benefits will be distributed after the settlement has obtained Court approval and the time for all appeals has expired. 11. What am I giving up as part of the settlement? Defendant and its affiliates will receive a Release from all claims that could have been or that were brought against Defendant relating to the Data Breach. Thus, if the Settlement becomes final and you do not exclude yourself from the Settlement, you will be a Settlement Class Member and you will give up your right to sue Defendant, Defendant’s past or present parents, subsidiaries, divisions, and related or affiliated entities, and each of their respective predecessors, successors, directors, officers, principals, agents, attorneys, insurers, and reinsurers, and includes, without limitation, any Person related to any such entity who is, was or could have been named as a defendant in any of the actions in the Action, other than any Person who is found by a court of competent jurisdiction to be guilty under criminal law of initiating, causing, aiding or abetting the criminal activity occurrence of the Data Breach or who pleads nolo contendere to any such charge, in its capacity as such and assigns of each of them as well as covered entities associated with the Data Breach. These Releases are described in Section 7 of the Settlement Agreement, which is available at www.AmericanVisionSettlement.com. If you have any questions, you can talk to Class Counsel listed in Question 17 for free or you can talk to your own lawyer. EXCLUDING YOURSELF FROM THE SETTLEMENT If you do not want to be part of the settlement, then you must take steps to exclude yourself from the Settlement Class. This is sometimes referred to as “opting out” of the Settlement Class. 12. If I exclude myself, can I get benefits from this settlement? No. If you exclude yourself, you will not be entitled to receive any benefits from the settlement. 13. If I do not exclude myself, can I sue the Related Entities for the same thing later? No. Unless you exclude yourself, you give up any right to sue Defendant and any other Related Entities for any claim that could have been or was brought relating to the Data Breach. You must exclude yourself from the settlement to start your own lawsuit or to be part of any different lawsuit relating to the claims in this case. 14. How do I exclude myself from the settlement? To exclude yourself, send a request to opt-out or written notice of intent to opt-out that says you want to be excluded from the Settlement. The request to opt-out must be individually signed and timely submitted to the Settlement Administrator at the address below. The written notice must clearly manifest the Settlement Class Member’s intent to opt-out of the Settlement Class. All Persons who do not opt-out of the Settlement Class shall be bound by the terms of this Settlement Agreement and Judgment entered. You must mail your request to opt-out to the Settlement Administrator Questions? Go to www.AmericanVisionSettlement.com or call (833) 630-5366 -8- postmarked by October 13, 2026, to: Settlement Administrator - 83312 c/o Kroll Settlement Administration LLC P.O. Box 225391 New York, NY 10150-5391 OBJECTING TO THE SETTLEMENT 15. How do I tell the Court that I do not like the settlement? You can tell the Court that you do not agree with the settlement, or some part of it by objecting to the Settlement. Objections must be sent to the Settlement Administrator at the address listed below, postmarked by no later than October 13, 2026. The objector or his or her counsel may also file their objection with the Court through the Court’s ECF system, with service on Class Counsel and Defendant’s Counsel, to be made through the ECF system. Defendant’s Counsel Settlement Administrator Class Counsel (optional) (optional) Settlement Administrator - Gary M. Klinger (pro hac vice) Craig Joel Mariam 83312 MILBERG PLLC GORDON& REES LLP c/o Kroll Settlement 227 W. Monroe Street, Suite 2100 Two North Central Administration LLC Chicago, IL 60606 Avenue Suite 2200 P.O. Box 225391 Phoenix, AZ 85004 Raina C. Borrelli New York, NY 10150-5391 STRAUSS BORRELLI PLLC 980 N. Michigan Avenue, Suite 1610 Chicago, IL 60611 Terence R. Coates MARKOVITS, STOCK & DEMARCO, LLC 119 E. Court Street, Suite 530 Cincinnati, OH 45202 J. Austin Moore (pro hac vice) STUEVE SIEGEL HANSON LLP 460 Nichols Road, Suite 200 Kansas City, MO 64112 The objection must include all of the following: i) the objector’s full name and address; ii) the case name and docket number: Hulewat et al. v. Medical Management Resource Group, L.L.C. d/b/a American Vision Partners, et al., Case No. 2:24-cv-00377-DJH; iii) a written statement of all grounds for the objection, including whether the objection applies only to the objector, to a subset of the Damages Settlement Class, or to the entire Damages Settlement Class, accompanied by any legal support for the objection the objector believes applicable; iv) the identity of any and all counsel representing the objector in connection with the objection; v) a statement whether the objector and/or his or her counsel will appear at the Final Fairness Hearing; and Questions? Go to www.AmericanVisionSettlement.com or call (833) 630-5366 -9- vi) the objector’s signature or the signature of the objector’s duly authorized attorney or other duly authorized representative (if any) representing him or her in connection with the objection. 16. What is the difference between objecting and asking to be excluded? Objecting is telling the Court that you do not like the settlement or parts of it and why you do not think it should be approved. You can object only if you are a Settlement Class Member. Excluding yourself is telling the Court that you do not want to be part of the Settlement Class and do not want to receive any benefit from the settlement. THE LAWYERS REPRESENTING YOU 17. Do I have a lawyer in this case? Yes. The Court appointed Gary M. Klinger of Milberg PLLC, Raina C. Borrelli of Strauss Borrelli PLLC, Terence Coates of Markovits, Stock & DeMarco, LLC, and J. Austin Moore of Stueve Siegel Hanson LLP as Class Counsel to represent the Settlement Class in settlement negotiations. If you want to be represented by your own lawyer, you may hire one at your own expense. 18. How will the Class Counsel be paid? Class Counsel shall submit a motion to the Court requesting attorneys’ fees, in the amount of 33.33% of the value of the settlement, inclusive of the value of the relief made available to the Injunctive Relief Class, and reasonable litigation costs. Any such award would compensate Class Counsel for investigating the facts, litigating the case, and negotiating the settlement and will be the only payment to them for their efforts in achieving this settlement and for their risk in undertaking this representation on a wholly contingent basis. Class Counsel shall apply to the Court for Service Awards for the Plaintiffs of up to $2,500 each. The Service Awards approved by the Court shall be paid by the Settlement Administrator out of the Settlement Fund directly to the Plaintiffs. Any attorneys’ fees, costs, and/or Service Awards awarded by the Court shall be paid by Defendant from the Settlement Fund and must be approved by the Court. The Court may award less than the amounts requested. THE COURT’S FINAL FAIRNESS HEARING 19. When and where will the Court decide whether to approve the settlement? The Court will hold a Final Fairness Hearing on December 10, 2026 at 10:00 a.m. MT, at the Sandra Day O’Connor U.S. Courthouse, Courtroom 605, 401 W. Washington St., Phoenix, AZ 85003-2161 as ordered by the Court. At this hearing, the Court will consider whether the settlement is fair, reasonable, and adequate. If there are timely and valid objections, the Court will consider them and will listen to people who have asked to speak at the hearing if such a request has been properly made. The Court will also rule on the attorneys’ fees and costs and Service Awards payments. After the hearing, the Court will decide whether to approve the settlement. We do not know how long these decisions will take. The hearing may be moved to a different date or time without additional notice, so Class Counsel recommends checking the Settlement Website www.AmericanVisionSettlement.com, or calling (833) 630-5366. Questions? Go to www.AmericanVisionSettlement.com or call (833) 630-5366 - 10 - 20. Do I have to attend the hearing? No. Class Counsel will present the Settlement Class to the Court. You or your own lawyer are welcome to attend at your expense, but you are not required to do so. If you send an objection, you do not have to visit the Court to talk about it. As long as you filed your written objection on time with the Court and mailed it according to the instructions provided in Question 15, the Court will consider it. 21. May I speak at the hearing? You may ask the Court for permission to speak at the Final Fairness Hearing. To do so, you must file an objection according to the instructions in Question 15, including all the information required. Your objection must be mailed to the Settlement Administrator, at the mailing address listed above, postmarked by no later than October 13, 2026. IF YOU DO NOTHING 22. What happens if I do nothing? If you do nothing, you will not receive any benefits from this settlement. If the settlement is granted final approval and becomes Final, you will not be able to start a lawsuit, continue with a lawsuit, or be part of any other lawsuit against Defendant or the other Related Entities based on any claim that could have been or that was brought relating to the Data Breach. ADDITIONAL INFORMATION 23. How do I get more information? This Notice summarizes the settlement. More details are in the Settlement Agreement itself. A copy of the Settlement Agreement is available at www.AmericanVisionSettlement.com. You may also call the Settlement Administrator with questions or to receive a Claim Form at (833) 630-5366. 24. What if my contact information changes or I no longer live at my address? It is your responsibility to inform the Settlement Administrator of your updated information. You may do so at the address below, calling toll-free (833) 630-5366 or at the Contact Us page of the Settlement Website: Settlement Administrator - 83312 c/o Kroll Settlement Administration LLC P.O. Box 225391 New York, NY 10150-5391 PLEASE DO NOT CONTACT THE COURT, CLERK OF THE COURT OR CLASS COUNSEL FOR INFORMATION ABOUT THE CLASS ACTION SETTLEMENT Questions? Go to www.AmericanVisionSettlement.com or call (833) 630-5366 - 11 -