Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

1About This Notice

This Notice of Privacy Practices ("Notice") describes the privacy practices of the licensed professional entity (the "Provider Group") that delivers clinical services to patients accessing care through the BIOBYLTLABS LLC platform, and the individually licensed clinicians it employs or contracts with ("Providers"). Throughout this Notice, "we," "us," and "our" refer to the Provider Group and its Providers. BIOBYLTLABS LLC is the management services organization that provides non-clinical administrative coordination to the Provider Group. BIOBYLTLABS LLC is a Business Associate of the Provider Group under HIPAA and handles PHI only as permitted by the applicable Business Associate Agreement.

2Our Duties Regarding Your PHI

We are required by law to maintain the privacy of Protected Health Information ("PHI") about you, to provide you with this Notice explaining our legal duties and privacy practices, and to notify you following a breach of unsecured PHI. We are required to follow the terms of the Notice currently in effect. We reserve the right to change this Notice and to make a revised Notice effective for PHI we already maintain as well as any information we receive in the future.

3Uses and Disclosures for Treatment, Payment, and Health Care Operations

Treatment

We may use and disclose your PHI to provide, coordinate, or manage your healthcare and any related services. This includes coordination with pharmacies, other physicians, laboratories, or other providers involved in your care. In some cases, this coordination may occur through a Health Information Exchange (HIE) or other shared health information system.

Payment

We may use and disclose your PHI to bill and obtain payment for healthcare services. Because the BioBylt Labs program is generally cash-pay, this typically involves the processing of your payment method through our payment processor. Where applicable, we may share PHI with another payor or benefits administrator at your request.

Health Care Operations

We may use and disclose your PHI to support our business operations, including quality improvement, clinician credentialing, legal and accounting services, compliance and audit activities, and service development. These activities are referred to in HIPAA as "health care operations."

4Uses and Disclosures That Do Not Require Your Authorization

HIPAA permits or requires us to use or disclose your PHI without your authorization in specific circumstances, including:

As required by law.
For public health activities, including reporting of disease, injury, birth, and death, and public health surveillance.
To report suspected abuse, neglect, or domestic violence, in accordance with applicable law.
For health oversight activities authorized by law, including audits, investigations, inspections, and licensure.
In response to a court or administrative order, subpoena, discovery request, or other lawful process.
For law enforcement purposes where permitted by law.
To coroners, medical examiners, and funeral directors as necessary to carry out their duties.
For organ, eye, or tissue donation.
For research, where an Institutional Review Board has approved a waiver of authorization.
To avert a serious threat to health or safety.
For specialized government functions, including military, national security, and correctional purposes.
For workers' compensation as authorized by law.

We may also use or disclose de-identified information, which does not identify you and cannot reasonably be used to identify you, without your authorization.

5Uses and Disclosures That Require Your Authorization

Most other uses and disclosures of your PHI require your written authorization. We will not sell your PHI, use or disclose psychotherapy notes, or use PHI for marketing communications that involve financial remuneration from a third party, without your authorization. You may revoke a previously provided authorization in writing at any time, except to the extent we have already acted in reliance on it.

6Artificial Intelligence

We may use artificial intelligence and other automated tools to support clinical and operational activities — for example, to assist clinicians with drafting notes or identifying potential drug interactions, or to improve triage and scheduling. AI tools are used under configurations intended to protect the confidentiality of PHI and are supervised by qualified personnel. All clinical decisions are made by a licensed clinician exercising independent medical judgment.

7Communications by Email or Text

We use reasonable safeguards to protect the privacy of your information. You should be aware that email and text messages, particularly messages sent outside secure portals, may not be encrypted and could potentially be intercepted by a third party. If you prefer not to receive clinical or administrative communications by email or text, please notify us at the contact information below and we will make reasonable efforts to accommodate alternative communication methods.

8Your Rights Regarding Your PHI

Right to access. You have the right to inspect and obtain a copy of your PHI in a designated record set. We may charge a reasonable cost-based fee for copies as permitted by law.
Right to request amendment. You may request an amendment of your PHI if you believe it is inaccurate or incomplete. We may deny a request under certain circumstances and will explain any denial in writing.
Right to an accounting of disclosures. You have the right to request an accounting of certain disclosures of your PHI made during the six (6) years preceding your request. Disclosures for treatment, payment, and health care operations and certain other categories are excluded. The first accounting within any 12-month period is provided free; additional requests may be subject to a reasonable, cost-based fee, and we will notify you of the fee before it is incurred.
Right to request restrictions. You may request that we limit how we use or disclose your PHI. We are not required to agree to a requested restriction, except that we must agree to restrict disclosure to a health plan for payment or health care operations purposes regarding services for which you have paid out of pocket in full.
Right to confidential communications. You may ask us to communicate with you about your PHI by alternative means or at an alternative location (for example, only by mail to a specific address).
Right to notification of breach. You have the right to be notified following a breach of your unsecured PHI. Notice will be provided no later than sixty (60) days after we discover the breach and will include a brief description of what happened, the types of information involved, steps you can take to protect yourself, steps we are taking, and contact information.
Right to a paper copy of this Notice. You may obtain a paper copy of this Notice at any time, even if you previously agreed to receive it electronically.

How to request access to your medical records. To request a copy of your medical records, email medicalrecords@biobyltlabs.com or use the secure messaging function in the platform. BioBylt Labs operates the medicalrecords@biobyltlabs.com inbox solely as administrative support; medical records are maintained by the Provider Group, and your request will be routed to the Provider Group's records custodian for response within the timeframes required by applicable law. To exercise any of the other rights described above, submit a written request to the Privacy Officer contact information in Section 11.

9Complaints

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer using the contact information in Section 11, or with the Secretary of the U.S. Department of Health and Human Services at: Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Room 509F HHH Building, Washington, D.C. 20201. Telephone: 1-877-696-6775. Website: [www.hhs.gov/hipaa]. We will not retaliate against you for filing a complaint.

10Changes to This Notice

We reserve the right to revise this Notice and to apply the revised Notice to PHI we already maintain as well as any information we receive in the future. A current copy of this Notice is posted at biobyltlabs.com. You are entitled to a copy of the Notice currently in effect upon request.

11Contact the Privacy Officer

Questions about this Notice or about the handling of your PHI should be directed to the Privacy Officer of the Provider Group, care of:

support@biobyltlabs.com

Mail

BIOBYLTLABS LLC, Attn: HIPAA Privacy Officer (mailing address published at biobyltlabs.com)

This document is provided for general informational purposes and should be reviewed by qualified legal counsel before publication. Terms are subject to change; the effective date above reflects the current version.