NOTICE OF PRIVACY PRACTICES

Stotland Medical LLC is the provider organization responsible for your medical care. It engages and manages the licensed physicians who review your intake and make treatment decisions, and it is the custodian of your medical records. Stotland Medical LLC is a Wyoming limited liability company.

ElliotMeds LLC operates the website, the intake system, and the administrative and technology services that support your care. ElliotMeds LLC acts as a business associate of Stotland Medical LLC under a written agreement, which means it may handle your health information only for permitted purposes and must safeguard it. ElliotMeds LLC does not provide medical care and does not make treatment decisions.

In this notice, "we" and "us" mean Stotland Medical LLC.

We are required by law to maintain the privacy of your protected health information, to provide you with this notice of our legal duties and privacy practices, and to notify you following a breach of unsecured protected health information. We are required to abide by the terms of the notice currently in effect.

"Protected health information" means information that identifies you and relates to your physical or mental health, the health care you receive, or payment for that care. This notice calls it "your health information."

For treatment

We use and disclose your health information to provide and coordinate your care. For example, the physician reviewing your file uses the medical history, medications, allergies, and other information you provide in your intake to decide whether treatment is appropriate for you, and we disclose the prescription and the clinical information necessary to fill it to the pharmacy that prepares your medication.

For payment

We use and disclose your health information to obtain payment for the services provided to you. For example, we transmit the information necessary to process your payment and, where a refund is due, to issue it.

For health care operations

We use and disclose your health information for our own operations, including quality review, reviewing the qualifications and performance of our physicians, and business and administrative management.

To business associates

We use vendors and service providers who perform functions on our behalf and who may handle your health information in doing so, including technology, hosting, payment processing, and communications providers. ElliotMeds LLC is one of these and operates under a written business associate agreement with us.

Other uses and disclosures permitted or required without your authorization

Subject to the conditions and limits the law places on each, we may use or disclose your health information:

• When required by law.
• For public health activities, including reporting adverse events, product defects, or problems with a medication to the U.S. Food and Drug Administration.
• To report abuse, neglect, or domestic violence, as required or permitted by law.
• For health oversight activities by agencies authorized to audit, investigate, license, or inspect.
• In judicial and administrative proceedings, in response to a court order, or to a subpoena or discovery request that satisfies the requirements of the Privacy Rule.
• For law enforcement purposes, in the limited circumstances the law permits.
• To coroners, medical examiners, and funeral directors.
• For organ, eye, and tissue donation.
• For research, only where an institutional review board or privacy board has approved a waiver, or where the information has been de-identified.
• To avert a serious and imminent threat to your health or safety or that of another person.
• For specialized government functions, including military and national security activities.
• For workers' compensation, as authorized by law.

We will obtain your written authorization before:

• Using or disclosing psychotherapy notes, if any exist.
• Using or disclosing your health information for marketing purposes, other than a face-to-face communication or a promotional gift of nominal value.
• Selling your health information. We do not sell your health information.

Any other use or disclosure not described in this notice will be made only with your written authorization. You may revoke an authorization in writing at any time, except to the extent we have already acted in reliance on it.

Some of the information you give us may be protected by a separate federal law, 42 C.F.R. Part 2, which governs records of substance use disorder diagnosis, treatment, or referral. This can happen even though we do not provide addiction treatment — for example, if you list a medication used to treat a substance use disorder among your current medications, or if a record from a Part 2 program is shared with us.

Where information is protected by Part 2, its protections are stricter than HIPAA's, and some uses and disclosures this notice otherwise permits are materially limited:

• Court and legal proceedings. Part 2 information may not be used or disclosed in any civil, criminal, administrative, or legislative proceeding against you, and may not be used to investigate or prosecute you, except with your specific written consent that meets Part 2's requirements or a court order that meets Part 2's requirements. A subpoena alone is not enough.
• Redisclosure is restricted. Anyone who receives Part 2 information from us is prohibited from redisclosing it except as Part 2 permits.
• Your consent may be revoked. You may revoke a Part 2 consent at any time, in writing or orally, except to the extent we have already acted in reliance on it.
• You may request a list of disclosures made with your consent, going back up to three years.
• You may complain about a violation of Part 2 to us, or to the Secretary of the U.S. Department of Health and Human Services.

To exercise any of these, contact us using the information in Section 7.

Inspect and obtain a copy. You may inspect and obtain a copy of your health information, including an electronic copy where we maintain it electronically. We will respond within 30 days. We may charge a reasonable, cost-based fee for copies. In limited circumstances we may deny a request, and where the law provides for it you may request review of the denial.

Request an amendment. If you believe your health information is incorrect or incomplete, you may request that we amend it. The request must be in writing and must state the reason. We may deny it in certain circumstances; if we do, we will explain why in writing, and you may submit a statement of disagreement that we will include in your record.

An accounting of disclosures. You may request a list of certain disclosures we made in the six years before your request. Disclosures for treatment, payment, and health care operations, and those you authorized, are not included. For information protected by Part 2, you may request a list of disclosures made with your consent going back up to three years.

Request restrictions. You may ask us to limit how we use or disclose your health information. We are not required to agree, with one exception: if you pay for a service in full and out of pocket, you may require us not to disclose information about that service to a health plan for payment purposes.

Request confidential communications. You may ask us to communicate with you by a particular method or at a particular address. We will accommodate reasonable requests.

A paper copy of this notice. You may request one at any time, even if you agreed to receive this notice electronically.

Notification of a breach. We will notify you if a breach of your unsecured health information occurs.

Complain without retaliation. See Section 7.

We are required by law to maintain the privacy of your health information, to provide this notice, to abide by the terms of the notice currently in effect, and to notify you of a breach of unsecured health information.

We reserve the right to change this notice and to make the revised notice effective for health information we already hold as well as information we receive in the future. If we materially change this notice, we will post the revised notice at this address and make it available on request. The effective date appears at the top.

We do not prescribe controlled substances.

We have not experienced a breach of unsecured protected health information.

Records we keep. Your medical intake, clinical records, prescription records, consent records, signed documents, and transaction records are retained for the periods required by applicable federal and state law. These are retained even if you close your account or ask us to delete your information, because law requires it. Closing your account does not delete them.

Records we delete on a schedule. Information that is not subject to mandatory retention is removed automatically:

• Inquiry and contact records from people who did not become patients: date of birth and treatment interest removed after 30 days; the record deleted after 90 days.
• Abandoned shopping carts: 14 days.
• Security and rate-limiting records: 7 days.

Backups. Our database is backed up daily and those backups are retained for seven days. Documents you upload, such as identification or laboratory results, are stored separately from the database and are not covered by that backup schedule.

Requesting deletion. You may ask us to delete your information. We will delete what is not subject to mandatory retention and tell you specifically what we retained and why. We will not tell you information has been deleted when it has not.

Privacy Official: Mitchell Brandon Stotland, HIPAA Privacy Officer, Stotland Medical LLC
Telephone: 616-730-1838
Email: [email protected]

To complain to us: submit your complaint in writing to the Privacy Official above. Describe what happened and when.

To complain to the federal government: you may file with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue SW, Washington, D.C. 20201, by telephone at 1-877-696-6775, or online at www.hhs.gov/ocr/privacy/hipaa/complaints/.

We will not retaliate against you for filing a complaint.

We provide services to patients in all fifty states. Where a state's law gives you greater privacy protection than federal law, we follow the state law.

California. If you are in California, the Confidentiality of Medical Information Act gives you protections in addition to those described above, including limits on disclosing your medical information without your authorization that are in some respects stricter than HIPAA's.

Washington. Washington's My Health My Data Act governs certain health data that is not protected health information under HIPAA. Practices for that data are described in ElliotMeds LLC's separate Consumer Health Data Privacy Policy.