HIPAA Notice of Privacy Practices

The Provider is the licensed medical practice that provides clinical services to you through the Sipra platform, and is a HIPAA "Covered Entity", a healthcare provider that creates and holds your medical records.

When this Notice says "we," "us," or "our," it refers to the Provider.

Sipra LLC ("Sipra") is the technology and operations platform supporting the Provider. Sipra runs the website, patient app, intake, scheduling, billing, customer support, and pharmacy coordination. Under HIPAA, Sipra is a Business Associate of the Provider, a company that handles Protected Health Information ("PHI") on behalf of a Covered Entity.

Sipra has signed a Business Associate Agreement ("BAA") with the Provider that limits how Sipra may use or disclose PHI and requires Sipra to protect your PHI at the same level the Provider must. The BAA was executed on To be executed prior to launch.

When you communicate with Sipra (by email to [email protected], through the patient portal, or with customer support), Sipra is acting on behalf of the Provider. Patient HIPAA inquiries, including requests to exercise your rights and complaints, are routed through [email protected] and the patient portal so Sipra can triage and forward them to the Privacy Officer.

PHI is any information that identifies you and relates to your past, present, or future health, healthcare, or payment for healthcare. PHI includes:

• Your name, date of birth, address, email, and phone number when tied to a health record.
• Your medical history, conditions, and diagnoses.
• Your prescriptions, dosages, and refill records.
• Lab and test results.
• Notes from your physician or licensed-clinician visits.
• Billing and payment information for your care.

This Notice covers your PHI held by the Provider. Information that is not PHI, for example, what you do on the Sipra website before signup, marketing email preferences, or device data, is covered by Sipra's Privacy Policy at https://sipra.com/privacy. Washington, Nevada, and Connecticut residents also have rights under Sipra's Consumer Health Data Privacy Policy at https://sipra.com/health-data-privacy. Treatment specifics are in the Telehealth and Medication Consent at https://sipra.com/telehealth-consent. The platform contract is in the Sipra Terms of Service at https://sipra.com/terms.

The Provider uses and shares your PHI to provide, coordinate, and manage your healthcare. Example: A licensed clinician reviews your intake answers, lab results, and medical history to decide whether GLP-1 medication is right for you, then sends your prescription to one of Healthcare Prosoft, LLC (operating the VSDH One Platform), Epiq Scripts LLC, Valiant Compounding Pharmacy, and Perfect RX. Treatment also includes ongoing care between visits, physician review of your recurring check-ins, dose titration decisions, and treatment-continuation decisions made under a physician-pre-authorized titration schedule.

The 503A compounding pharmacies that fill prescriptions for the Provider are independent healthcare providers and HIPAA Covered Entities in their own right. Each pharmacy gives you its own Notice of Privacy Practices when you receive a medication from it. The Provider shares only the PHI needed to fill your prescription and coordinate your care.

The Provider uses and shares your PHI to bill for services and process payments. Example: Sipra, acting as Business Associate, shares limited PHI with the payment processor to charge your subscription and handle disputes.

The Provider uses and shares your PHI for activities that keep the practice running well. Example: The Provider reviews treatment outcomes in de-identified form to improve clinical protocols, trains clinicians, audits records, and runs quality and safety reviews.

The Provider shares PHI with companies that perform services for the Provider, for example, cloud hosting, customer support tools, and CRM. Sipra is the principal Business Associate that runs the patient-facing platform. Each Business Associate signs a contract requiring it to protect your PHI at the same level the Provider must.

The Provider shares your PHI with you on request, and with friends, family, or others you have authorized, but only the information that relates to their involvement in your care or payment for it.

The Provider shares your PHI when federal, state, or local law requires it. The disclosure stays limited to what the law requires.

The Provider may share your PHI with health oversight agencies for audits, inspections, and investigations, and in response to a court or administrative tribunal order. In response to a subpoena or other lawful process, the Provider shares PHI only after making reasonable efforts to notify you or after a qualified protective order is in place.

The Provider may share your PHI with law enforcement in limited situations: as required by law, in response to a court order or warrant, to identify or locate a suspect or missing person, or to report a death the Provider believes was caused by criminal conduct.

The Provider may share your PHI with a coroner or medical examiner to identify a deceased person or determine cause of death, with funeral directors as needed, and, if you are an organ donor, with organ procurement organizations.

The Provider may use or share your PHI for research only after an Institutional Review Board or Privacy Board approves the study and the privacy protections. The Provider will ask for your written authorization in most cases. The Provider may use your PHI to prepare for research as long as the PHI does not leave the organization.

The Provider may use and share your PHI to prevent or lessen a serious and imminent threat to your health or safety, or to someone else's, sharing only with someone who can prevent or lessen the threat.

The Provider may share your PHI as required by workers' compensation laws. If you are in the armed forces, the Provider may share your PHI as required by military command. The Provider may share your PHI with authorized federal officials for national security and protective services.

If you are an inmate or in the custody of law enforcement, the Provider may share your PHI with the institution or official as needed for your care or for the safety of others.

The Provider may share your PHI with a government authority if it reasonably believes you are a victim of abuse, neglect, or domestic violence. The Provider shares only what the law requires or permits, and will tell you it made the disclosure unless doing so would put you at greater risk.

A personal representative, for example, a parent of a minor patient, a court-appointed guardian, or a person you have authorized in writing or under state law, has the same right to access and authorize uses of your PHI that you do. The Provider follows state law on who qualifies.

The Provider does not currently fundraise and does not use your PHI for marketing without your written authorization. Section 7 covers the narrow exceptions HIPAA allows. The Provider does not sell your PHI. If fundraising practices change, the Provider will update this Notice and give you a clear way to opt out of future fundraising communications, as required by 45 CFR §164.514(f).

You have the right to see and get a copy of your medical and billing records (45 CFR §164.524), and to ask the Provider to send a copy directly to a third party you name.

Submit a request by emailing [email protected] or through your patient portal. The Provider responds within 30 days, with one 30-day extension allowed in writing if the Provider tells you why. The Provider may charge a reasonable cost-based fee for paper copies as permitted by law.

The Provider supports patient access to electronic health information through the Sipra patient portal in compliance with the 21st Century Cures Act and the ONC Information Blocking Rule (45 CFR Part 171). Lab results and clinical notes are released to your patient portal as soon as they are final, except where a delay is permitted by an applicable Information Blocking Rule exception (for example, a clinically necessary preventing-harm exception documented in your record). You can report a suspected information-blocking violation to the HHS Office of the Inspector General at oig.hhs.gov.

You have the right to ask the Provider to correct PHI you believe is wrong or incomplete (45 CFR §164.526). Send your request to [email protected] and explain the reason. The Provider will respond within 60 days. If the Provider denies your request, it will tell you why in writing and explain how you can add a written statement of disagreement to your record.

You have the right to a list of certain disclosures of your PHI the Provider has made in the past six years (45 CFR §164.528). The list does not include disclosures for treatment, payment, operations, or those you authorized. Your first request in any 12-month period is free; the Provider may charge a reasonable fee for additional requests.

You have the right to ask the Provider to restrict how it uses or shares your PHI for treatment, payment, or operations (45 CFR §164.522(a)). The Provider is not always required to agree, but if it agrees, it will follow the restriction except in an emergency. Section 9 describes one restriction the Provider must always honor.

You have the right to ask the Provider to contact you about your healthcare in a specific way or at a specific location, for example, calling only a particular phone number or emailing instead of calling. The Provider will agree to reasonable requests.

You have the right to be notified of a breach of your unsecured PHI, as described in Section 10.

You can request a paper copy of this Notice at any time, even if you agreed to receive it electronically. Email [email protected].

You have the right to file a complaint without being penalized. Section 12 explains how.

If you think the Provider has violated your privacy rights, file a complaint with the Privacy Officer using the contact information above. The Privacy Officer responds promptly. No specific form is required, tell the Provider what happened, when, and what you want the Provider to do.

You can also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights:

• Online: https://www.hhs.gov/hipaa/filing-a-complaint/
• Mail: 200 Independence Avenue SW, Washington, DC 20201
• Email: [email protected]
• Phone: 1-877-696-6775 (TDD 1-800-537-7697)

Filing a complaint with the Provider or HHS will not change the care you receive. The Provider does not retaliate.