Notice of Privacy Practices

To the extent HIPAA applies, we and applicable covered Providers are required by law to maintain the privacy and security of PHI, provide this Notice, follow the duties and privacy practices described in the current Notice, and notify affected individuals following a breach of unsecured PHI when required by law.

We reserve the right to change this Notice and make the revised Notice effective for PHI we already have as well as PHI we receive in the future. The current Notice will be made available through the Services or upon request.

When HIPAA applies to your PHI, you have the following rights, subject to legal limits:

• Access and copies. You may ask to inspect or receive a copy of certain health and billing records. We may charge a reasonable, cost-based fee where permitted by law.
• Electronic copy. You may request an electronic copy of electronic PHI maintained in a designated record set, where required by law.
• Amendment. You may ask to correct or amend PHI you believe is inaccurate or incomplete. We may deny the request where permitted by law and will provide an explanation.
• Accounting of disclosures. You may request a list of certain disclosures of your PHI for up to six years before your request, excluding disclosures for treatment, payment, health care operations, and certain other disclosures.
• Restrictions. You may request restrictions on certain uses or disclosures. We are not required to agree except where required by law, such as certain disclosures to a health plan for payment or operations when you paid out-of-pocket in full and the disclosure is not otherwise required by law.
• Confidential communications. You may ask us to contact you in a specific way or at a specific location. We will accommodate reasonable requests where required by law.
• Paper copy. You may request a paper copy of this Notice even if you agreed to receive it electronically.
• Personal representative. You may identify someone authorized to act on your behalf, and we may verify that person's authority before taking action.
• Revoke authorization. If you sign an authorization for a use or disclosure of PHI, you may revoke it in writing, except to the extent action has already been taken in reliance on it.
• Complaint. You may file a complaint if you believe your privacy rights have been violated. We will not retaliate against you for filing a complaint.

To exercise a right or file a privacy complaint with Avono, contact compliance@avono.io. You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights. We will not retaliate against you for filing a complaint.

We may use and disclose PHI for treatment, payment, and health care operations without your written authorization as permitted by HIPAA.

• Treatment. We may use and disclose PHI to Providers, pharmacies, laboratories, care coordinators, and other professionals involved in your care. Example: a Provider may share prescription information with a pharmacy or request lab results to evaluate treatment.
• Payment. We may use and disclose PHI to bill and collect payment, process transactions, determine eligibility, administer subscriptions, respond to chargebacks, and coordinate payment with payment processors or other responsible parties.
• Health care operations. We may use and disclose PHI for quality assessment, credentialing, compliance, audits, training, case management, care coordination, customer support, fraud prevention, security, legal review, business planning, and other operational activities.

We may use or disclose PHI without your authorization when permitted or required by law, including for the following purposes:

• To business associates and service providers that perform services for or on behalf of covered entities and agree to protect PHI.
• To public health authorities for disease reporting, adverse event reporting, product recalls, and other public health activities.
• To report suspected abuse, neglect, domestic violence, or other safety concerns where required or permitted by law.
• To health oversight agencies for audits, investigations, inspections, licensure, discipline, and compliance activities.
• In response to court orders, subpoenas, discovery requests, administrative proceedings, or other legal processes when legal requirements are met.
• To law enforcement officials for limited purposes permitted or required by law.
• To coroners, medical examiners, funeral directors, or organ procurement organizations as permitted by law.
• To prevent or lessen a serious and imminent threat to health or safety.
• For workers' compensation or similar programs as authorized by law.
• For specialized government functions, including military, national security, protective services, or correctional purposes where permitted by law.
• For research where an institutional review board or privacy board approval, authorization, waiver, or other legal requirement is satisfied.

Except where permitted by law, we will obtain your written authorization before using or disclosing PHI for marketing communications that require authorization, selling PHI, or using or disclosing psychotherapy notes if any are maintained. Other uses and disclosures not described in this Notice will be made only with your authorization where required by law.

We may contact you about appointments, reminders, intake items, lab requests, prescription coordination, refills, support, treatment alternatives, health-related benefits, services that may interest you, and care coordination. Communications may occur by portal, email, phone, SMS/text, mail, or other methods consistent with your consents and applicable law.

We may disclose PHI to a family member, friend, caregiver, personal representative, or other person involved in your care or payment for your care if you agree, do not object when given the opportunity, or if we reasonably infer based on professional judgment that the disclosure is in your best interest and permitted by law.

Certain information, including substance use disorder treatment records subject to 42 CFR Part 2, genetic information, HIV/AIDS information, mental health information, reproductive or sexual health information, and other sensitive categories, may receive additional protections under federal or state law. To the extent we maintain such information, we will use and disclose it only as permitted by applicable law and any required consent or authorization.

When using, disclosing, or requesting PHI, we will make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose, except where the minimum necessary standard does not apply, such as disclosures for treatment or disclosures authorized by you.

If a breach of unsecured PHI occurs, we will notify affected individuals and others as required by applicable law.

For questions about this Notice, privacy rights, or complaints, contact Avono at compliance@avono.io.

Avono Health

compliance@avono.io

avonohealth.com