WHAT IS PROTECTED HEALTH INFORMATION (“PHI”)?

PHI is information that identifies you, and relates to your past, present or future physical and mental health or conditions, the delivery of healthcare to you, or the past present, or future payment for your healthcare. PHI includes both medical information and individually identifiable information, including your name, address, telephone number, or Social Security number. We protect this information in electronic, written, or oral formats.

We understand the importance of protecting your PHI and restrict access to authorized workforce members who need that information for your treatment, for payment purposes and for health care operations. We will not disclose your PHI without your authorization unless it is necessary to provide your health benefits, administer our services, or as required or permitted by law. If we need to disclose your PHI, we will follow the policies described in the Notice to protect your privacy.

HOW WE USE AND DISCLOSE YOUR PROTECTED HEALTH INFORMATION

Your protected health information may be used and disclosed by affiliated Heuro providers, our staff, and others that are involved in your care and treatment for the purpose of providing health care services to you, to support our business operations, to obtain payment for your care, and any other use authorized or required by law. We never market or sell personal information.

Uses and Disclosures of PHI That Do Not Require Prior Disclosure:

• Treatment: We will use and disclose your protected health information to provide, coordinate, or manage your health care and any related services. This includes the coordination or management of your health care with a third party. For example, your protected health information may be provided to any other health care provider with whom you have an existing treatment relationship to ensure the necessary information is accessible to diagnose or treat you.

• Payment: Your protected health information may be used to bill or obtain payment for your health care services. For example, we may use your PHI in connection with processing payments for services provided to you.

• Health Care Operations. We may use or disclose, as needed, your protected health information in order to support the business activities of this office. These activities include, but are not limited to, improving quality of care, providing information about treatment alternatives or other health-related benefits and services, development or maintaining and supporting computer systems, legal services, and conducting audits and compliance programs, including fraud, waste and abuse investigations.

• Other Uses and Disclosures that Do Not Require Your Authorization. We may use or disclose your protected health information in the following situations without your authorization. These situations include the following uses and disclosures: as required by law; for public health purposes; for health care oversight purposes; for abuse or neglect reporting; pursuant to Food and Drug Administration requirements; in connection with legal proceedings; for law enforcement purposes; to coroners, funeral directors and organ donation agencies; for certain research purposes; for certain criminal activities; for certain military activity and national security purposes; for workers’ compensation reporting; relating to certain inmate reporting; and other required uses and disclosures.

Uses and Disclosures That Require Prior Authorization

• We will obtain your written authorization for the use or disclosure of psychotherapy notes, use or disclosure of PHI for marketing, and for the sale of PHI, except in limited circumstances where applicable law allows for the uses or disclosure without authorization.

• Other Uses and Disclosures. We will obtain your written authorization before using or disclosing your PHI for purposes other than those described in this Notice or otherwise permitted by law. You may revoke an authorization in writing at any time. Upon receipt of the written revocation, we will stop using or disclosing your PHI, except to the extent that we have already taken action in reliance on the authorization

YOUR RIGHTS REGARDING YOUR PHI

When it comes to your PHI, you have certain rights. This section explains your rights and some of our responsibilities to help you. To exercise any of these rights, please contact our Privacy Office using the contact information provided at the end of this Notice.

• Get an electronic or paper copy of your medical record. You can ask to see or get an electronic or paper copy of your medical record and other health information we have about you. Ask us how to do this. We will provide a copy or a summary of your health information. We may charge a reasonable, cost-based fee.

• Ask us to correct your medical record. You can ask us to correct health information about you that you think is incorrect or incomplete. Ask us how to do this. We may deny your request, but will provide you with a written explanation for doing so within sixty days.

• Request confidential communications. You can ask us to contact you in a specific way (for example, home or office phone) or to send mail to a different address. You must make any such request in writing, and you must specify how or where we are to contact you. While we will consider reasonable requests carefully, we are not required to agree to all requests. We will not ask you the reason for your request. We must accommodate reasonable requests by you to receive communications of PHI by alternative means or at alternative locations, if you clearly state that the disclosure of all or part of that information could endanger you.

• Ask us to limit what we use or share. You can ask us not to use or share certain health information for treatment, payment, or our operations. You also have the right to request a limit on the PHI we disclose to someone who is involved in your care or the payment for your care, such as a family member or friend. Your request for restriction must be submitted in writing and state the specific restriction requested. We are not required to agree to your request, except as required by law. If we do agree with your request for restriction, our agreement must be in writing, and we will comply with your request unless the information is needed to provide you emergency treatment or we are required or permitted by law to disclose it. We are allowed to end a non-mandated restriction if we tell you. If we end the restriction, it will affect PHI that was created or received only after we notify you..

• Get an accounting of disclosures. You can ask for a list (accounting) of the times we have shared your health information for six years prior to the date you ask, who we shared it with, and why. We will include all the disclosures except for those about treatment, payment, and health care operations, and certain other disclosures (such as any you asked us to make). We will provide one accounting a year for free but will charge a reasonable, cost-based fee if you ask for another one within twelve months.

• Right to Receive Paper Copy of this Notice. You can ask for a paper copy of this Notice at any time, even if you have agreed to receive the Notice electronically. We will provide you with a paper copy promptly.

• Choose someone to act for you. If you have given someone medical power of attorney or if someone is your legal guardian, that person can exercise your rights and make choices about your health information. We will make sure the person has this authority and can act for you before we take any action.

• Be notified of a breach. You have the right to receive written notice as soon as possible, but not later than 60 days, after any unauthorized use or disclosure that compromises the privacy and security of your PHI.

• File a complaint if you feel your rights are violated. You can complain if you feel we have violated your rights by contacting the Privacy Office using the contact information provided below. You can file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights by sending a letter to 200 Independence Avenue, S.W., Washington, D.C. 20201, calling 1-877-696-6775, or visiting hhs.gov/ocr/privacy/hipaa/complaints/.

We will not retaliate against you for filing a complaint.

HOW TO EXERCISE YOUR RIGHTS

To exercise your rights described in this Notice, send your request, in writing to our Privacy Officer address as follows:

Heuro, Inc

PO Box 1, Bedminster,

NJ 07921-0001, US

We may ask you to fill out and return to us a form that we will provide to you.

If you believe that Heuro has violated your privacy rights, you may file a complaint with us by calling 1-833-MY-HEURO at any time or by sending your complaint to the address shown immediately above.

You may also file a written complaint with the Secretary of the US Department of Health and Human Services (HHS). Your complaint can be sent by mail to the HHS Office of Civil Rights (OCR). To file a complaint with the Secretary, write to:

US Department of Health and Human Services

200 Independence Avenue, SW

Room 509F HHH Bldg.

Washington DC 20201

www.hhs.gov/ocr/privacy/hipaa/complaints/

Phone: 1-877-696-6775

We will not take any action against you if you exercise your right to file a complaint with us or the Secretary.

CHANGES TO OUR PRIVACY PRACTICES

We may change our privacy practices at any time. If we make a material change to our privacy practices, we will promptly change this notice and make the new notice available on our website at https://www.heurohealth.com/notice-of-privacy-practice. Except for changes required by law, we will not implement an important change to our privacy practices before we revise this notice.

EFFECTIVE DATE

The effective date of this Notice is October 15, 2024.