4. HIPAA NOTICE OF PRIVACY PRACTICES

THIS SECTION CONSTITUTES YOUR NOTICE OF PRIVACY PRACTICES UNDER THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA) AND THE HITECH ACT.

4.1 Protected Health Information (PHI)

Protected Health Information (PHI) is health information that can identify you as an individual and relates to: (1) your past, present, or future physical or mental health condition; (2) the provision of health care to you; or (3) past, present, or future payment for health care. PHI includes information transmitted or maintained in any form, including electronic PHI (ePHI).

4.2 Permissible Uses and Disclosures of PHI

As a Business Associate, BioPhoenix may use and disclose your PHI only as permitted by our BAAs with our clinical partners and as required by applicable law. Permitted uses include:

• Treatment: Disclosing PHI to licensed healthcare providers to facilitate your telehealth consultations and care coordination.
• Operations: Using PHI for quality assurance, compliance, and administrative functions necessary to operate the Platform.
• Business Associate Functions: Using PHI to perform contracted services on behalf of our clinical platform partners, consistent with BAA terms.
• Required by Law: Disclosing PHI when required by federal or state law, court order, or government investigation.
• Public Health Activities: Reporting to public health authorities as required by law (e.g., mandatory disease reporting).
• Abuse or Neglect Reporting: Disclosing PHI to government authorities authorized to receive reports of abuse, neglect, or domestic violence.

4.3 Uses and Disclosures Requiring Your Authorization

The following uses and disclosures require your written authorization:

• Most uses and disclosures of PHI for marketing purposes.
• Sale of PHI.
• Uses and disclosures of psychotherapy notes.
• Uses and disclosures beyond what is permitted under HIPAA’s Treatment, Payment, and Operations provisions.

You may revoke any authorization in writing at any time, except to the extent we have already acted in reliance on it.

4.4 Your HIPAA Rights

You have the following rights regarding your PHI:

• Right to Access: You have the right to inspect and obtain a copy of your PHI. We will respond to written access requests within 30 days. Requests should be submitted to privacy@aadilk.com.
• Right to Amend: You may request that we amend inaccurate or incomplete PHI. We will respond within 60 days and may deny requests in limited circumstances.
• Right to Accounting of Disclosures: You may request a list of disclosures of your PHI made by us or our clinical partners for purposes other than treatment, payment, or operations, for the six years prior to your request.
• Right to Restrict: You may request restrictions on certain uses and disclosures of your PHI. We are not required to agree to all restrictions, except when you have paid out-of-pocket and request restriction of disclosure to a health plan.
• Right to Confidential Communications: You may request that we communicate with you through alternative means or at alternative locations (e.g., contact only by email, not phone).
• Right to a Paper Copy: You may request a paper copy of this Notice at any time, even if you have agreed to receive it electronically.
• Right to Notification of Breach: In the event of a breach of your unsecured PHI, we will notify you as required by HIPAA’s Breach Notification Rule within 60 days of discovering the breach.

4.5 HIPAA Complaints

If you believe your privacy rights under HIPAA have been violated, you may file a complaint with BioPhoenix at privacy@aadilk.com or with the U.S. Department of Health and Human Services Office for Civil Rights at:

HHS Office for Civil Rights | 200 Independence Avenue, S.W. | Washington, D.C. 20201 | 1-877-696-6775 | www.hhs.gov/ocr

We will not retaliate against you for filing a complaint.