Notice of Privacy Practices

This Notice of Privacy Practices ("Notice") describes how AlignYOU may use and disclose your protected health information ("PHI") and how you can access this information. Please review it carefully.

AlignYOU is required by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations to maintain the privacy of your PHI, to provide you with this Notice of our legal duties and privacy practices, and to follow the terms of the Notice currently in effect.

This Notice applies to:

• All clinical providers and staff of AlignYOU
• All employees, contractors, and volunteers who access or handle your health information
• Business associates who perform services on our behalf and have access to your PHI, including CharmTracker (our EHR and scheduling platform) and laboratory partners

We may use and disclose your PHI without your authorization for the following purposes:

Treatment: We may use and disclose your PHI to provide, coordinate, and manage your healthcare. This includes sharing information among our providers (physicians, physician assistants, registered dietitians, and other clinical staff), as well as with external providers involved in your care. For example, we may share your PHI with a specialist to whom we refer you, a laboratory performing tests on your behalf, or a pharmacy filling your prescriptions.

Payment: We may use and disclose your PHI to bill and collect payment for the services we provide. This may include sharing information with your health insurance plan, verifying coverage, submitting claims, and managing accounts. For example, we may share your diagnosis and treatment information with your insurance company to obtain payment for services.

Healthcare Operations: We may use and disclose your PHI for our internal operations, including quality improvement, staff training, credentialing, auditing, compliance activities, and business management.

Appointment Reminders and Health-Related Communications: We may contact you to provide appointment reminders, information about treatment alternatives, or other health-related benefits and services that may be of interest to you.

As Required by Law: We will disclose your PHI when required to do so by federal, state, or local law.

Public Health Activities: We may disclose your PHI for public health activities, including reporting to public health authorities for preventing or controlling disease, injury, or disability.

Health Oversight: We may disclose your PHI to a health oversight agency for activities authorized by law, including audits, investigations, inspections, and licensure actions.

Judicial and Administrative Proceedings: We may disclose your PHI in response to a court order, subpoena, or other lawful process.

Law Enforcement: We may disclose your PHI to law enforcement officials under limited circumstances as permitted by HIPAA.

Coroners, Medical Examiners, and Funeral Directors: We may disclose your PHI to a coroner, medical examiner, or funeral director as authorized by law.

Serious Threats to Health or Safety: We may use and disclose your PHI when necessary to prevent a serious and imminent threat to your health or safety or the health or safety of the public or another person.

Workers' Compensation: We may disclose your PHI as authorized by workers' compensation laws.

Except as described above, we will not use or disclose your PHI without your written authorization. Uses and disclosures that require your authorization include:

• Marketing purposes
• Sale of your PHI
• Most uses of psychotherapy notes, if applicable
• Other uses and disclosures not described in this Notice

You may revoke an authorization at any time by submitting a written request to our office. Revocation will not affect any uses or disclosures made in reliance on the authorization prior to revocation.

You have the following rights regarding your PHI:

Right to Inspect and Copy: You have the right to inspect and obtain a copy of your PHI maintained in our records, including medical and billing records. Requests must be submitted in writing. We may charge a reasonable fee for copying and mailing. We may deny your request in limited circumstances; if so, you may request a review of the denial.

Right to Amend: If you believe that PHI we have about you is incorrect or incomplete, you may request an amendment. Requests must be submitted in writing with a reason for the amendment. We may deny the request if the information was not created by us, is not part of your medical record, is accurate and complete, or is not available for inspection.

Right to an Accounting of Disclosures: You have the right to receive a list of certain disclosures we have made of your PHI. This accounting does not include disclosures for treatment, payment, healthcare operations, or disclosures you authorized in writing. Requests must be submitted in writing. The first accounting in any 12-month period is free; subsequent requests may be subject to a reasonable fee.

Right to Request Restrictions: You have the right to request that we restrict how we use or disclose your PHI for treatment, payment, or healthcare operations. You may also request restrictions on disclosures to individuals involved in your care. We are not required to agree to your request, except that we must agree to restrict disclosures to a health plan if you paid for the service in full out of pocket and the disclosure is not required by law.

Right to Request Confidential Communications: You have the right to request that we communicate with you about health matters through a particular means or at a certain location. For example, you may ask that we contact you only at a certain phone number or email address. We will accommodate reasonable requests.

Right to a Paper Copy of This Notice: You have the right to obtain a paper copy of this Notice at any time, even if you have agreed to receive it electronically. You may request a copy by contacting our office.

Right to Be Notified of a Breach: You have the right to be notified if there is a breach of your unsecured PHI. We will notify you as required by law.

We are required to:

• Maintain the privacy and security of your PHI
• Provide you with this Notice of our legal duties and privacy practices
• Follow the terms of the Notice currently in effect
• Notify you if there is a breach of your unsecured PHI

We will not use or disclose your PHI without your authorization except as described in this Notice. We reserve the right to change the terms of this Notice and to make new provisions effective for all PHI we maintain. If we make a material change to this Notice, we will make the revised Notice available at our office and on our website.

AlignYOU uses CharmTracker as our electronic health record (EHR) system and patient portal. CharmTracker operates under a Business Associate Agreement (BAA) with AlignYOU in compliance with HIPAA. Your PHI stored in CharmTracker is protected by administrative, technical, and physical safeguards. Access to the patient portal is secured by individual login credentials. You are responsible for maintaining the confidentiality of your portal login information.

If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights.

To file a complaint with AlignYOU:
Contact our Privacy Officer at admin@alignedhealthpractice.com or 317.210.3722.

To file a complaint with HHS:
U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue, S.W.
Washington, D.C. 20201
Phone: 1-877-696-6775

You will not be penalized or retaliated against for filing a complaint.

For questions about this Notice or to exercise any of your rights, please contact:

AlignYOU — Privacy Officer
300 E Main St, Suite E
Carmel, IN 46032
Phone: 317.210.3722
Fax: 317.296.7211
Email: admin@alignedhealthpractice.com