Privacy Statement

HIPAA PRIVACY STATEMENT

NOTICE OF PROTECTED HEALTH INFORMATION PRIVACY PRACTICES OF Aesthetic Assured THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Effective: March 15 2022 If you have any questions or requests, please contact Aesthetic Assured directly.

Contents of the following notice:

A. We have a legal duty to protect health information about you.

We are required by law to protect the privacy of health information about you and that can be identified with you, which is called "protected health information," or "PHI" for short. We must give you notice of our legal duties and privacy practices concerning PHI:

- We must protect PHI that we have created or received about: your past, present, or future health condition; health care we provide to you; or payment for your health care.

- We must notify you about how we protect PHI about you.

- We must explain how, when and why we use and/or disclose PHI about you.

- We may only use and/or disclose PHI as we have described in this Notice.

We are required to follow the procedures in this Notice. We reserve the right to change the terms of this Notice and to make new notice provisions effective for all PHI that we maintain by first:

- Posting the revised notice on our website online; and - Making copies of the revised notice available for download through copying and pasting this information

B. We may use and disclose PHI about you without your authorization in the following circumstances.

1. We may use and disclose PHI about you to provide health care treatment to you. We may use and disclose PHI about you to provide, coordinate or manage your health care and related services. This may include communicating with other health care providers regarding your treatment and coordinating and managing your health care with others.

2. We may use and disclose PHI about you to obtain payment for services. Generally, we may use and give your medical information to others to bill and collect payment for the supplies and services provided to you by our company. Before you receive scheduled services, we may share information about these services with your health plan(s) or with the proper government agency in charge of reimbursement for the supplies or services. Sharing information allows us to ask for coverage under your plan or policy and for approval of payment before we provide the services. We may also share portions of medical information about you with the following:

- Billing departments; - Collection departments or agencies, or attorneys assisting us with collections: - Insurance companies, health plans and their agents which provide you coverage; - Hospital departments that review the care you received to check that it and the costs associated with it were appropriate for your illness or injury, and - Consumer reporting agencies (e.g., credit bureaus).

3. We may use and disclose PHI under other circumstances without your authorization or an opportunity to agree or object. We may use and/or disclose PHI about you for a number of circumstances in which you do not have to consent, give authorization or otherwise have an opportunity to agree or object. Those circumstances include:

- When the use and/or disclosure is required by law, - When the use and/or disclosure is for health oversight activities. - When the disclosure is for judicial and administrative proceedings. - When the disclosure is for law enforcement purposes. - When the use and/or disclosure relates to decedents. - When the use and/or disclosure relates to organ, eye or tissue donation purposes. - When the use and/or disclosure relates to medical research, - When the use and/or disclosure is to avert a serious threat to health or safety, - When the use and/or disclosure relates to specialized government functions. - When the use and/or disclosure relates to correctional institutions and in other law enforcement custodial situations.

4. You can object to certain uses and disclosures by calling or writing Aesthetic Assured on its contact page. Unless you object, we may use or disclose PHI about you in the following circumstances:

- We may share with a family member, relative, friend or other person identified by you, PHI directly related to that person's involvement in your care or payment for your care. We may share with a family member, personal representative or other person responsible for your care PHI necessary to notify such individuals of your location, general condition or death. - We may share with a public or private agency (for example, American Red Cross) PHI about you for disaster relief purposes. Even if you object, we may still share the PHI about you, if necessary for the emergency circumstances.

5. We may contact you with information about treatment, services, products or health care providers.

** ANY OTHER USE OR DISCLOSURE OF PHI ABOUT YOU REQUIRES YOUR WRITTEN AUTHORIZATION **

C. We under any circumstances other than those listed above, we will ask for your written authorization before

se PHI about you. If you sign a written authorization allowing us to disclose PHI about you in a specific situation, you can later cancel your authorization in writing by contacting the practice's Privacy Officer.

If you cancel your authorization in writing, we will not disclose PHI about you after we receive your cancellation, except for disclosures which were being processed before we received your cancellation. You have several rights regarding PHI about you.

1. You have the right to request restrictions on uses and disclosures of PHI about you. We are not required to agree to your requested restrictions. However, even if we agree to your request, in certain situations your restrictions may not be followed. These situations include emergency treatment, disclosures to the Secretary of the Department of Health and Human Services, and uses and disclosures described in subsection (B)(4) of the previous section of this Notice. You may request a restriction by sending a letter with the specific terms of the request to our company listed on the contact page of this website. The company's designated Privacy Officer will evaluate your request.

2. You have the right to request different ways to communicate with you. Your request must be in writing. We must accommodate reasonable requests, but, when appropriate, may condition that accommodation on your providing us with information regarding how payment, if any, will be handled and your specification of an alternative address or other method of contact. You may request alternative communications by sending this information to our company listed on the contact page of this website. The company's designated Privacy Officer will evaluate your request.

3. You have the right to see and copy PHI about you. You have the right to request to see and receive a copy of PHI contained in orders, invoices, billing and other records used to process your supply and equipment requests. Most of this paperwork will be accessible through your personal online account with the company. For any items not available online, your request must be in writing. We may charge you related fees. Instead of providing you with a full copy of the PHI, we may give you a summary or explanation of the PHI about you, if you agree in advance to the form and cost of the summary or explanation. There are certain situations in which we are not required to comply with your request. Under these circumstances, we will respond to you in writing, stating why we will not grant your request and describing any rights you may have to request a review of our denial. You may request to see and receive a copy of PHI by contacting our company listed on the contact page of this website. The company's designated Privacy Officer will evaluate your request.

4. You have the right to request amendment of PHI about you. You have the right to request that we make amendments to supply, billing and other records used to provide you with supplies and services. Your request must be in writing and must explain your reason(s) for the amendment. We may deny your request if: 1) the information was not created by us (unless you prove the creator of the information is no longer available to amend the record); 2) the information is not part of the records used to supply your needs; 3) we believe the information is correct and complete; or 4) you would not have the right to see and copy the record. We will tell you in writing the reasons for the denial and describe your rights to give us a written statement disagreeing with the denial. If we accept your request to amend the information, we will make reasonable efforts to inform others of the amendment, including persons you name who have received PHI about you and who need the amendment. You may request an amendment of PHI about you by contacting the company's Privacy Officer in writing through the contact page on this website.

5. You have the right to a listing of disclosures we have made. If you ask our contact person in writing, you have the right to receive a written list of certain of our disclosures of PHI about you. You may ask for disclosures made up to six (6) years before your request.

6. You have a right to a copy of this Notice.

D. You may file a complaint about our privacy practices.

If you think we have violated your privacy rights, or you want to complain to us about our privacy. practices, you can contact the company's Privacy Officer through the contact page on this website. You may also send a written complaint to the United States Secretary of the Department of Health and Human Services. If you file a complaint, we will not take any action against you or change our treatment of you in any way.