Notice of Data Incident

What Happened?

On September 10, 2026, Enara Health detected suspicious activity associated with our provider application. We immediately began an investigation and took steps to contain and remediate the situation including changing passwords, disabling impacted accounts, notifying federal law enforcement, and engaging data security and privacy professionals to assist in our investigation and response. The investigation determined that there was unauthorized access to this platform for only a limited time on September 10, 2026. There was no unauthorized activity within our network or other systems. Through our investigation, we identified that data containing your information was obtained by an unauthorized party. There is currently no evidence that any information has been misused for identity theft or fraud in connection with the Incident.

What Information Was Involved?

The impacted information varied by individual, but in general, it included: name, email, phone, date of birth, provider name, and limited instances of self-reported medical information on our app, such as information the individual provided about a medical condition, treatment information, appointment dates, or medications. Note that not every type of data listed was present for each individual, so this list may include many more types of data than pertain to you.

What We Are Doing.

We take this incident and the security of your information in our care seriously. Upon identifying this incident, we promptly began an investigation, changed passwords, disabled relevant user accounts, notified federal law enforcement, and engaged data security and privacy professionals to assist with our investigation and response. Additionally, we are reporting the incident to relevant government agencies.

What Can Impacted Individuals Do?

We encourage individuals to remain attentive against potential identity theft and fraud, regularly monitor free credit reports, review account statements, and report any suspicious activity to financial institutions. Under U.S. law, individuals are entitled to one (1) free credit report annually from each of the three (3) major credit reporting bureaus. Presented below are steps that individuals can take to protect their personal information, including health and medical information.

We take the security of information in our care seriously. If you have additional questions, you may call our toll-free assistance line at (844) 971-8639 Monday through Friday from 8:00 a.m. to 5:30 p.m., Central Time (excluding U.S. holidays).

Steps You Can Take to Protect Your Personal Information

To obtain a free credit report, individuals may visit www.annualcreditreport.com or call, toll-free, 1-877-322-8228.

Alternatively, affected individuals can contact the three (3) major credit reporting bureaus directly at the addresses below:

Free Credit Report. It is recommended that you remain vigilant for incidents of fraud and identity theft by reviewing account statements and monitoring your credit report for unauthorized activity. You may obtain a copy of your credit report, free of charge, once every twelve (12) months from each of the three (3) nationwide credit reporting agencies.

To order your annual free credit report please visit www.annualcreditreport.com or call toll free at 1-877-322-8228.

You can also order your annual free credit report by mailing a completed Annual Credit Report Request Form (available from the U.S. Federal Trade Commission’s (“FTC”) website at www.consumer.ftc.gov) to: Annual Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348-5281.

For Alabama Residents: You may contact the Attorney General’s Office for the State of Alabama, Consumer Protection Division, 501 Washington Avenue, Montgomery, AL 36104, www.alabamaag.gov, 1-800-392-5658.

For Arizona Residents: You can obtain information from the Office of the Attorney General and the FTC about fraud alerts, security freezes, and steps you can take toward preventing identity theft. Consumer Protection & Advocacy Section, 2005 North Central Avenue, Phoenix, AZ 85004, 1-602-542-5025.

For California Residents: Visit the California Office of Privacy Protection (www.oag.ca.gov/privacy) for additional information on protection against identity theft. Office of the Attorney General of California, 1300 I Street, Sacramento, CA 95814, 1-800-952-5225. This notification was not delayed as a result of any law enforcement investigation.

For Colorado Residents: You can obtain information from the Office of the Attorney General (www.coag.gov), FTC, and the credit reporting agencies about fraud alerts and security freezes. Consumer Protection 1300 Broadway, 9th Floor, Denver, CO 80203, 1-720-508-6000.

For Connecticut Residents: You may contact the Connecticut Office of the Attorney General, 165 Capitol Avenue, Hartford, CT 06106, www.ct.gov/ag, 1-860-808-5318.

For District of Columbia Residents: You can obtain information about steps to take to avoid identity theft from the FTC (contact information above) and the District of Columbia Office of the Attorney General, 400 6th Street NW, Washington, D.C. 20001, consumer.protection@dc.gov, https://oag.dc.gov/, 1-202-737-3400.

For Illinois Residents: You can obtain information from the Office of the Attorney General, credit reporting agencies, and the FTC about fraud alerts and security freezes (contact information above). You may contact the Illinois Office of the Attorney General, 100 West Randolph Street, Chicago, IL 60601, https://illinoisattorneygeneral.gov/about/email_ag.jsp, 1-800-964-3013.

For Indiana Residents: You may contact the Indiana Attorney General’s Office, Consumer Protection Division, 302 W. Washington Street, 5th Floor, Indianapolis, IN 46204, www.in.gov/attorneygeneral, 1-800-382-5516.

For Iowa Residents: You may contact the Iowa Office of the Attorney General, 1305 E. Walnut Street, Des Moines, IA 50319, consumer@ag.iowa.gov; www.iowaattorneygeneral.gov, 1-888-777-4590. You are advised to report any suspected identity theft to law enforcement or to the Iowa Attorney General.

For Kansas Residents: You may contact the Kansas Office of the Attorney General, Consumer Protection Division, 120 SW 10th Ave, 2nd Floor, Topeka, KS 66612-1597, https://ag.ks.gov/, 1-800-432-2310.

For Kentucky Residents: You may contact the Kentucky Office of the Attorney General, Consumer Protection Division, 1024 Capital Center Drive, Suite 200, Frankfort, Kentucky 40601, www.ag.ky.gov, 1-800-804-7556.

For Maryland Residents: You may obtain information about steps you can take to avoid identity theft from the FTC (contact information above) and the Maryland Office of the Attorney General, Consumer Protection Division, 200 St. Paul Place, Baltimore, MD 21202, www.marylandattorneygeneral.gov, 1-888-743-0023.

For Massachusetts Residents: You may contact the Office of the Massachusetts Attorney General, 1 Ashburton Place, Boston, MA 02108, 1-617-727-8400, www.mass.gov/ago/contact-us.html. You have the right to obtain a police report if you are a victim of identity theft.

For Minnesota Residents: You may contact the Minnesota Office of the Attorney General, 445 Minnesota Street, Suite 1400, St. Paul, MN 55101, www.ag.state.mn.us, 1-800-657-3787.

For Missouri Residents: You may contact the Missouri Office of the Attorney General, Consumer Protection, 207 W. High St., P.O. Box 899, Jefferson City, MO 65102, www.ago.mo.gov, 1-800-392-8222.

For Nevada Residents: You may contact the Nevada Office of the Attorney General, Bureau of Consumer Protection, 100 N. Carson St, Carson City, NV 89701, www.ag.nv.gov, 1-702-486-3132.

For New Mexico Residents: Consumers have rights pursuant to the FCRA, such as the right to be told if information in their credit file has been used against them, the right to know what is in their credit file, the right to ask for their credit score, and the right to dispute incomplete or inaccurate information. Further, pursuant to the FCRA, the consumer reporting bureaus must correct or delete inaccurate, incomplete, or unverifiable information; consumer reporting agencies may not report outdated negative information; access to consumers’ files is limited; consumers must give consent for credit reports to be provided to employers; consumers may limit “prescreened” offers of credit and insurance based on information in their credit report; and consumers may seek damages from violators. Consumers may have additional rights under the FCRA not summarized here. Identity theft victims and active-duty military personnel have specific additional rights pursuant to the FCRA. We encourage consumers to review their rights pursuant to the FCRA by writing, Consumer Response Center, Room 130-A, Federal Trade Commission, 600 Pennsylvania Ave. N.W., Washington, D.C. 20580, or by visiting www.consumerfinance.gov/f/201504_cfpb_summary_your-rights-under-fcra.pdf.

For New York Residents: You may obtain information regarding security breach response and identity theft prevention and protection information from the FTC (contact information above) and the New York Office of the Attorney General, Office of the Attorney General, The Capitol, Albany, NY 12224-0341, https://ag.ny.gov, 1-800-771-7755.

For North Carolina Residents: You may obtain information about preventing identity theft from the FTC (contact information above) and the North Carolina Office of the Attorney General, Consumer Protection Division, 9001 Main Service Center, Raleigh, NC 27699-9001, www.ncdoj.gov, 1-877-566-7266 or 1-919-716-6400. You are advised to report any suspected identity theft to law enforcement or to the North Carolina Attorney General.

For Oregon Residents: Oregon Department of Justice, 1162 Court Street NE, Salem, OR 97301-4096, www.doj.state.or.us/, 1-877-877-9392. You are advised to report any suspected identity theft to law enforcement, the FTC, and the Oregon Attorney General.

For Pennsylvania Residents: You may contact the Pennsylvania Office of the Attorney General, Bureau of Consumer Protection, 15th Floor, Strawberry Square, Harrisburg, PA 17120, www.attorneygeneral.gov, 1-800-441-2555.

For Rhode Island Residents: You may contact the Rhode Island Office of the Attorney General, Consumer Protection Division, 150 South Main Street, Providence, RI 02903, www.riag.ri.gov, 1-401-274-4400. You have the right to file or obtain any police report in regard to this incident.

For South Carolina Residents: You may contact the South Carolina Department of Consumer Affairs, 293 Greystone Boulevard, Suite 400, Columbia, SC 29210, 1-800-922-1594.

For Texas Residents: You may contact the Texas Office of the Attorney General, Office of the Attorney General, PO Box 12548, Austin, TX 78711-2548, www.texasattorneygeneral.gov, 1-800-621-0508.

For Wyoming Residents: This notification was not delayed as a result of any law enforcement investigation.

Fraud Alert. You may place a fraud alert in your file by calling one (1) of the three (3) nationwide credit reporting agencies above. A fraud alert tells creditors to follow certain procedures, including contacting you before they open any new accounts or change your existing accounts. For that reason, placing a fraud alert can protect you, but also may delay you when you seek to obtain credit.

Security Freeze. You may obtain a security freeze on your credit report, free of charge, to protect your privacy and ensure that credit is not granted in your name without your knowledge. You may also submit a declaration of removal to remove information placed in your credit report as a result of being a victim of identity theft pursuant to the Fair Credit Reporting Act.

The security freeze will prohibit a consumer reporting agency from releasing any information in your credit report without your express authorization or approval. The security freeze is designed to prevent credit, loans, and services from being approved in your name without your consent. When you place a security freeze on your credit report, you will be provided with a personal identification number, password, or similar device to use if you choose to remove the freeze on your credit report or to temporarily authorize the release of your credit report to a specific party or parties or for a specific period of time after the freeze is in place.

To place a security freeze on your credit report, you may be able to use an online process, an automated telephone line, or a written request to any of the three (3) credit reporting agencies listed above. The following information must be included when requesting a security freeze (note that if you are requesting a credit report for your spouse, this information must be provided for him/her as well): (i) full name, with middle initial and any suffixes; (ii) Social Security number; (iii) date of birth; (iv) current address and any previous addresses for the past five (5) years; and (v) any applicable incident report or complaint with a law enforcement agency or the Department of Motor Vehicles. The request must also include a copy of a government-issued identification card and a copy of a recent utility bill or bank or insurance statement. It is essential that each copy be legible, and display your name, current mailing address, and the date of issue.

FTC and State Attorneys General Offices. If you believe you are the victim of identity theft or have reason to believe your personal information has been misused, you should immediately contact the FTC and/or the Attorney General’s office in your home state. You may also contact these agencies for information on how to prevent or avoid identity theft. Contact information for the Consumer Response Center of the FTC is 600 Pennsylvania Avenue, NW, Washington, DC 20580, 1-877-IDTHEFT (438-4338) or www.ftc.gov/bcp/edu/microsites/idtheft/.

Protecting Medical Information.

If you are concerned about protecting your medical information, the following practices can provide additional safeguards to protect against medical identity theft.

  • Only share your health insurance cards with your health care providers and other family members who are covered under your insurance plan or who help you with your medical care.
  • Review your “explanation of benefits statement” which you receive from your health insurance company. Follow up with your insurance company or care provider for any items you do not recognize. If necessary, contact the care provider on the explanation of benefits statement and ask for copies of medical records from the date of the potential access (noted above) to current date.
  • Ask your insurance company for a current year-to-date report of all services paid for you as a beneficiary. Follow up with your insurance company or the care provider for any items you do not recognize.