HIPAA Notice of Privacy Practices

PHI is individually identifiable health information we create, receive, maintain, or transmit in connection with providing health care services to you. This includes information about your past, present, or future physical health conditions; the treatment and services you receive from us; and payment for your care — when that information can be linked to you by name, date of birth, address, or other identifying details.

We may use and disclose your PHI for the following purposes without requiring your separate written authorization:

Treatment: We may use and disclose your PHI to provide, coordinate, and manage your aesthetic medical care. For example, we may share relevant health information with other healthcare providers involved in your treatment, or with specialists to whom we refer you.

Payment: We may use and disclose your PHI to bill and collect payment for services rendered. This may include sharing information with your insurance company or payment processor to obtain reimbursement or verify coverage eligibility.

Health Care Operations: We may use and disclose your PHI for our internal business activities, including quality assessment, staff training, compliance reviews, and administrative functions necessary to operate our practice.

Appointment Reminders: We may contact you to remind you of upcoming appointments via phone, text, or email.

Treatment Alternatives: We may use your PHI to inform you of treatment options, products, or health-related services that may benefit you.

As Required by Law: We will disclose your PHI when required to do so by federal, state, or local law, including to public health authorities, law enforcement, or in response to a court order or subpoena.

Serious Threats to Health or Safety: We may disclose PHI when necessary to prevent or lessen a serious and imminent threat to your health or safety or the health or safety of the public.

Other uses and disclosures of your PHI not described in this Notice will be made only with your written authorization, including:

• Most disclosures of psychotherapy notes
• Disclosures for marketing purposes (other than face-to-face communications or promotional gifts of nominal value)
• Sale of PHI
• Any use or disclosure not otherwise described in this Notice

You may revoke any written authorization at any time, except to the extent we have already taken action in reliance on it.

You have the following rights with respect to your PHI:

Right to Access: You have the right to inspect and obtain a copy of your PHI maintained in our records. Requests must be submitted in writing. We will respond within 30 days. A reasonable fee may apply for copies.

Right to Amend: You have the right to request that we amend your PHI if you believe it is incorrect or incomplete. We may deny your request under certain circumstances and will explain any denial in writing.

Right to an Accounting of Disclosures: You have the right to request a list of certain disclosures we have made of your PHI within the last six years, other than for treatment, payment, and health care operations purposes.

Right to Restrict Disclosures: You may request restrictions on how we use or disclose your PHI for treatment, payment, or health care operations. We are not required to agree to your request, except we must agree to restrict disclosure to a health plan if you pay out-of-pocket in full for a service.

Right to Confidential Communications: You may request that we communicate with you about your PHI by alternative means or at an alternative location (e.g., a different phone number or address).

Right to a Paper Copy of This Notice: You may request a paper copy of this Notice at any time, even if you previously agreed to receive it electronically.

Right to Notification of Breach: You have the right to be notified if there is a breach of unsecured PHI affecting you.

San Diego Chic Medical Spa is required by law to:

• Maintain the privacy of your PHI
• Provide you with this Notice of our privacy practices
• Abide by the terms of this Notice as currently in effect
• Notify you in the event of a breach of unsecured PHI

We reserve the right to change our privacy practices and this Notice at any time, provided such changes are permitted by law. We reserve the right to make such changes effective for all PHI we maintain, including PHI we created or received before the change. When we make a material change to our privacy practices, we will post the revised Notice on our website and make it available in our office.

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights. To file a complaint with us, contact our Privacy Officer at the address below. To file a complaint with the federal government, visit hhs.gov/ocr/privacy/hipaa/complaints or call 1-800-368-1019.

You will not be retaliated against for filing a complaint.

For questions, concerns, or to exercise any of your rights described in this Notice, please contact:

Note: This Notice of Privacy Practices is provided for informational purposes. San Diego Chic Medical Spa recommends consulting with a qualified healthcare attorney to ensure full HIPAA compliance for your specific practice. This document does not constitute legal advice.