HIPAA Notice of Privacy Practices

We are required by law to maintain the privacy of your PHI, provide you with this Notice of our legal duties and privacy practices, and follow the practices described in this Notice while it is in effect. We reserve the right to change our privacy practices and the terms of this Notice. Revised Notices will be posted on our website and available upon request.

Treatment

We use your PHI to provide, coordinate, and manage your healthcare, including telehealth visits, prescription processing, and care follow-up. We may share your PHI with pharmacists, specialists, or other providers involved in your care.

Payment

We may use and disclose your PHI to bill and receive payment for services, including submitting claims to insurers and verifying coverage.

Healthcare Operations

We may use your PHI for quality improvement, training, compliance reviews, and other operational activities.

Other Permitted Disclosures

We may also disclose PHI as required by law (e.g., public health reporting, law enforcement, court orders), to avert a serious threat to health or safety, or with your written authorization for other purposes.

Uses and Disclosures That Require Your Written Authorization

We will obtain your written authorization before using or disclosing your PHI for:

• Marketing — any communication about a product or service that encourages you to purchase or use it, except face-to-face communications and promotional gifts of nominal value.
• Sale of PHI — any disclosure of PHI in exchange for direct or indirect remuneration (we do not sell PHI).
• Psychotherapy notes — notes recorded by a mental health professional documenting a private counseling session, kept separate from the medical record.

You may revoke a written authorization at any time, in writing, except to the extent we have already acted in reliance on it.

• Right to Access: You may request a copy of your medical records and PHI. We will respond within 30 days.
• Right to Amend: You may request that we correct inaccurate or incomplete PHI.
• Right to an Accounting of Disclosures: You may request a list of certain disclosures we have made of your PHI.
• Right to Restrict: You may request restrictions on how we use or disclose your PHI, though we are not always required to agree.
• Right to Confidential Communications: You may request that we contact you at a specific phone number or address.
• Right to a Paper Copy: You may request a paper copy of this Notice at any time.
• Right to File a Complaint: If you believe your privacy rights have been violated, you may file a complaint with us or with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights at www.hhs.gov/ocr. We will not retaliate against you for filing a complaint.

We make reasonable efforts to use, disclose, and request only the minimum amount of PHI necessary to accomplish the intended purpose.

We implement administrative, physical, and technical safeguards to protect electronic PHI from unauthorized access, use, or disclosure, in accordance with the HIPAA Security Rule.

You have the right to be notified in writing, without unreasonable delay and in no case later than 60 days after discovery, if there is a breach of your unsecured protected health information. Notifications will describe what happened, the types of information involved, steps you should take to protect yourself, what we are doing to investigate and mitigate the breach, and how to contact us. This is required by the HIPAA Breach Notification Rule (45 CFR §§164.400–414) and §164.520(b)(1)(iv)(F).

To exercise your rights or report a privacy concern, contact our HIPAA Privacy Officer:

Privacy Officer, EverSpring Care / EverSpring Pharmacy
1884 Lackland Hill Parkway, Suite 6
St. Louis, MO 63146
Email: info@everspringrx.com
Phone: 855-284-1038