Notice of Privacy Practices

Who this notice applies to

This notice applies to StemNovaMD, PLLC ("StemNovaMD," "we," "us"), a medical practice providing telehealth services to patients located in Texas and Florida, and to the licensed clinicians who provide care through StemNovaMD. We are required by law to keep your protected health information ("PHI") private, to give you this notice of our legal duties and privacy practices, to notify you if a breach of your unsecured PHI occurs, and to follow the terms of the notice currently in effect.

How we may use and share your health information

Treatment. We use and share your information with the clinicians involved in your care, including the licensed clinician who performs your video evaluation, our prescribing physician, the pharmacy that fills your prescription, and any laboratory that processes your tests.

Example: we send your prescription to our partner pharmacy so it can be filled and shipped to you.

Payment. We use and share your information to bill and collect payment for your services.

Example: we process the payment card you saved when you confirm a treatment plan.

Health care operations. We use and share your information to run our practice, improve care, train staff and meet legal requirements.

Example: our Medical Director reviews visit records for quality and safety.

Business associates. We share your information with companies that perform services for us under written business associate agreements that require them to protect it. These include our telehealth platform provider, [Qualiphy PC]; [our pharmacy and lab partners, where acting on our behalf]; and our secure hosting, messaging and payment vendors.

Communications with you. We may contact you by email, text message or phone about appointments, prescriptions, shipments, lab results and your account. You can ask us to use a different address or method (see "Your rights").

Other uses and disclosures permitted or required by law

We may use or share your information without your written authorization when the law allows or requires it, including:

• when required by federal, state or local law;
• for public health activities, such as reporting adverse drug reactions to FDA;
• to report suspected abuse, neglect or domestic violence as required by law;
• for health oversight activities, such as audits, investigations and licensure;
• in response to a court or administrative order, subpoena or other lawful process;
• to law enforcement, as permitted by law;
• to prevent a serious threat to health or safety;
• for workers' compensation claims;
• for specialized government functions, such as military or national security purposes;
• to coroners, medical examiners and funeral directors;
• to prescription drug monitoring programs, such as the Texas PMP and Florida E-FORCSE, when required for controlled substances.

Uses that require your written authorization

We will not use or share your information for marketing purposes, sell your information, or share psychotherapy notes without your written authorization. Any other use not described in this notice requires your written authorization. You may revoke an authorization in writing at any time, except to the extent we have already acted on it.

We do not share your health information, drug names, conditions, symptoms, lab values or intake answers with advertising platforms. The patient portal does not use third-party advertising pixels or trackers.

Your rights

You have the right to:

• Get a copy of your health and billing records, electronic or paper. We will usually respond within 30 days and may charge a reasonable, cost-based fee.
• Ask us to correct your records if you believe they are incorrect or incomplete. We may say no, but we will tell you why in writing within 60 days.
• Request confidential communications, such as contact at a different address, email or phone number. We will agree to all reasonable requests.
• Ask us to limit what we use or share. We are not required to agree, except that if you pay for a service in full out of pocket, you can ask us not to share it with your health insurer, and we will agree unless the law requires the disclosure.
• Get a list of those with whom we have shared your information for up to six years before the date you ask, excluding disclosures for treatment, payment, health care operations and certain other purposes. We provide one list per year for free.
• Get a paper copy of this notice at any time, even if you agreed to receive it electronically.
• Choose someone to act for you. A person with your medical power of attorney or who is your legal guardian can exercise your rights.
• Be notified of a breach of your unsecured protected health information.

To exercise any of these rights, contact our Privacy Officer (below).

Complaints

If you believe your privacy rights have been violated, you can file a complaint with us using the contact information below, or with the U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue SW, Washington, D.C. 20201, 1-877-696-6775, www.hhs.gov/ocr/privacy/hipaa/complaints/. We will not retaliate against you for filing a complaint.

Changes to this notice

We may change the terms of this notice, and the changes will apply to all information we hold about you. The current notice will always be posted on this page and available on request, with its effective date.

Contact our Privacy Officer