HIPAA Notice of Privacy Practices

Your Information. Your Rights. Our Responsibilities.

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

1. Introduction and Purpose

SDKare LLC (“SDKare,” “we,” “us,” or “our”) is committed to protecting the privacy and confidentiality of your health information.

This HIPAA Notice of Privacy Practices (“Notice”) explains how protected health information (PHI) may be used and disclosed in connection with healthcare services provided through SDKare, your rights regarding that information, and our legal responsibilities under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the Health Information Technology for Economic and Clinical Health Act (HITECH Act), and other applicable federal and state laws.

This Notice addresses:

• How we may use and disclose your health information.
• Circumstances in which your authorization is required.
• Your rights to access, amend, and obtain information about your medical records.
• Your choices concerning certain disclosures.
• Additional protections for sensitive healthcare information.
• Privacy and security responsibilities.
• Our obligations following a reportable breach.
• How to exercise your privacy rights or submit a complaint.

This Notice applies to PHI that SDKare creates, receives, maintains, or transmits in a capacity governed by HIPAA.

Where independently practicing healthcare providers or other organizations maintain separate legal responsibilities, their own applicable notices and privacy obligations may also apply.

Nothing in this Notice permits a use or disclosure prohibited by applicable federal or state law.

2. Our Legal Duties and Responsibilities

Where HIPAA applies, SDKare is required by law to:

• Maintain the privacy of your protected health information.
• Provide you with a notice describing our legal duties and privacy practices.
• Comply with the terms of the Notice currently in effect.
• Implement appropriate privacy and security safeguards for PHI.
• Protect electronic PHI in accordance with applicable HIPAA Security Rule requirements.
• Notify affected individuals following a breach of unsecured PHI when notification is required by law.
• Respect your applicable privacy rights.
• Obtain authorization for uses or disclosures when required.
• Comply with additional applicable state and federal confidentiality requirements.

We are responsible for handling PHI according to the legal requirements relevant to the information and healthcare activities involved.

We will not use or disclose your information in a manner inconsistent with applicable law or this Notice.

3. Information Protected by This Notice

Protected health information generally includes individually identifiable information relating to your past, present, or future physical or mental health, healthcare services, or payment for healthcare, when maintained or transmitted by an entity acting in a HIPAA-regulated capacity.

Depending on your services, PHI may include:

• Your name, date of birth, and contact details.
• Medical and mental health history.
• Diagnoses and current symptoms.
• Treatment plans and provider recommendations.
• Prescription and medication records.
• Laboratory results and diagnostic information.
• Clinical notes and follow-up records.
• Therapy and behavioral health records.
• Relevant substance use disorder information.
• Healthcare appointment records.
• Healthcare billing information.
• Other information contained in your medical records.

Information may be maintained electronically, in paper records, or communicated verbally.

Certain information may receive additional protection under applicable state laws or specialized federal confidentiality rules.

4. How We May Use and Disclose Your Health Information

HIPAA permits specified uses and disclosures of PHI without your separate written authorization.

Other uses and disclosures require authorization or another legally recognized basis.

4.1 Treatment

We may use and disclose your PHI to support healthcare treatment and coordination with appropriately authorized healthcare professionals.

Examples include:

• Allowing your treating provider to review your medical history.
• Documenting a telehealth consultation.
• Coordinating treatment with another healthcare professional.
• Supporting medication management.
• Referring you for laboratory testing or additional clinical evaluation.
• Communicating relevant treatment information to a participating pharmacy.
• Coordinating clinically appropriate follow-up care.

Example: Your treating healthcare provider may review your medication history and relevant medical records before developing a treatment plan.

4.2 Payment

We may use or disclose PHI for permitted payment-related activities.

Examples include:

• Processing healthcare consultation payments.
• Maintaining healthcare billing records.
• Reviewing payment or refund discrepancies.
• Responding to eligible billing disputes.
• Verifying charges for services provided.

Example: SDKare may use information about a completed appointment to verify the accuracy of an associated service charge.

SDKare operates on a self-pay basis and does not submit health insurance claims on patients’ behalf.

4.3 Healthcare Operations

We may use and disclose PHI for healthcare operations permitted by HIPAA.

Examples include:

• Healthcare quality assessment.
• Clinical quality improvement.
• Reviewing provider performance.
• Workforce training.
• Credentialing and compliance activities.
• Healthcare administration.
• Evaluating patient service processes.
• Conducting legally authorized audits.

Example: Authorized personnel may review relevant clinical documentation to assess whether healthcare services were appropriately coordinated.

4.4 Additional Legal Protections

A use or disclosure otherwise permitted by HIPAA may be restricted by another applicable federal or state law.

Where a more protective legal requirement applies, we will follow that requirement.

5. Other Uses and Disclosures Permitted or Required by Law

In addition to treatment, payment, and healthcare operations, HIPAA permits or requires certain disclosures under specific legal conditions.

Such disclosures may include the following.

5.1 Public Health Activities

We may disclose information to authorized public health authorities for legally permitted activities, such as reporting certain diseases or other public health matters.

5.2 Health Oversight Activities

We may disclose information to authorized oversight agencies for legally permitted audits, investigations, inspections, licensing, or regulatory activities.

5.3 Legal Compliance

We may disclose information when required by a law that applies to the relevant records and circumstances.

5.4 Judicial and Administrative Proceedings

We may disclose information in response to qualifying court orders, subpoenas, or other lawful legal processes when applicable HIPAA and other confidentiality requirements are satisfied.

Certain sensitive records may be subject to more restrictive rules.

5.5 Law Enforcement

Information may be disclosed to law enforcement only under circumstances permitted or required by applicable law.

5.6 Serious Threats to Health or Safety

We may disclose information where permitted by law to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.

5.7 Abuse, Neglect, or Domestic Violence

We may make legally permitted or required reports concerning abuse, neglect, or domestic violence, subject to applicable conditions and protections.

5.8 Research

PHI may be used or disclosed for research only when the relevant HIPAA requirements are met, such as obtaining required authorization or satisfying an applicable waiver or other legal permission.

5.9 Workers’ Compensation

Information may be disclosed as authorized by applicable workers’ compensation or similar laws.

5.10 Medical Examiners, Coroners, and Funeral Directors

Information may be disclosed to authorized persons for purposes permitted by law.

5.11 Organ and Tissue Donation

Where relevant, information may be disclosed to authorized organ procurement or donation organizations as permitted by law.

5.12 Government and Specialized Functions

Certain disclosures may be permitted for specified government functions, including authorized national security or other activities recognized by HIPAA.

5.13 Disaster Relief

Information may be shared with authorized disaster relief organizations under legally permitted circumstances to help coordinate care or notify appropriate persons regarding your condition or location.

We will apply the conditions and limitations imposed by the relevant laws before making these disclosures.

6. Your Choices About Certain Disclosures

You may have choices concerning whether certain information is shared with family members, friends, or others involved in your care.

6.1 Family Members and Other Persons Involved in Your Care

Where permitted by HIPAA, we may share information relevant to your care or payment for your care with a person involved in assisting you.

When you are present and capable of making healthcare decisions, we generally provide an opportunity for you to agree or object, as applicable.

If you are unavailable or incapacitated, limited disclosures may be permitted based on professional judgment and the relevant circumstances.

6.2 Notification of Your Condition or Location

Where legally permitted, limited information may be shared to notify an appropriate person about your location, general condition, or death.

6.3 Emergency and Disaster Situations

Applicable law may permit certain disclosures when obtaining your preference is impracticable due to an emergency.

6.4 Your Express Objection

If you object to a proposed disclosure in circumstances where HIPAA gives you that choice, we will respect the objection as required by law.

More restrictive legal requirements may apply to certain sensitive medical information.

7. Uses and Disclosures Requiring Your Written Authorization

Certain uses and disclosures of PHI require a valid written authorization unless an applicable legal exception permits otherwise.

7.1 Marketing

We will obtain written authorization for uses or disclosures of PHI for marketing when authorization is required by HIPAA.

Ordinary appointment reminders, qualifying treatment communications, and certain other communications may be permitted without marketing authorization when the legal conditions are satisfied.

7.2 Sale of PHI

We will not sell PHI without complying with the applicable HIPAA authorization requirements.

SDKare does not sell patient PHI as part of its stated healthcare practices.

7.3 Psychotherapy Notes

Most uses and disclosures of psychotherapy notes, as specifically defined by HIPAA, require separate authorization unless an applicable exception permits otherwise.

Not all behavioral healthcare notes are psychotherapy notes under HIPAA.

7.4 Other Uses and Disclosures

Uses and disclosures not otherwise permitted or required by law will be made only with valid authorization where required.

7.5 Revocation of Authorization

You may revoke a previously granted HIPAA authorization in writing, subject to applicable law.

Revocation generally applies prospectively and does not invalidate actions already taken in reliance on a valid authorization.

To request revocation, contact SDKare’s Privacy Officer using the contact information provided in this Notice.

8. Additional Protections for Sensitive Health Information

Certain health information may receive additional protections under federal or state law.

8.1 Mental and Behavioral Health Records

Mental and behavioral health information is protected under applicable privacy and confidentiality laws.

Some records are subject to restrictions beyond general HIPAA requirements.

8.2 Psychotherapy Notes

Psychotherapy notes maintained separately and meeting HIPAA’s specific definition generally receive additional legal protections.

They are treated differently from ordinary medical records, medication management notes, and standard therapy progress records.

8.3 Substance Use Disorder Records

Certain substance use disorder records are subject to additional confidentiality requirements under 42 CFR Part 2.

Where SDKare receives, maintains, or processes information protected by Part 2, the applicable requirements govern its use and disclosure.

For records protected by Part 2:

• Consent may be required for uses or disclosures unless a specific exception applies.
• Qualifying consent for treatment, payment, and healthcare operations may permit certain subsequent uses and disclosures by HIPAA-regulated recipients, subject to applicable law.
• Separate requirements apply to records used in investigations or proceedings against the patient.
• Additional protections may apply to qualifying substance use disorder counseling notes.
• Fundraising communications involving Part 2 records are subject to applicable requirements, including the right to opt out.
• Part 2 records must not be used or disclosed in legal proceedings against the patient except where the necessary consent, court order, and other legal requirements have been satisfied.

A disclosure of Part 2 information does not automatically eliminate applicable confidentiality protections.

These requirements apply when the particular records and circumstances are governed by Part 2. The fact that a patient receives addiction-related healthcare does not automatically mean that every associated record is a Part 2 record.

8.4 Reproductive, Sexual, and Other Sensitive Healthcare Information

Information concerning reproductive healthcare, sexual health, HIV-related care, genetic information, or other sensitive matters may be subject to additional confidentiality requirements.

We will apply the federal and state protections that are legally in effect and applicable to the information.

8.5 More Protective State Laws

When an applicable state law imposes stricter confidentiality requirements than HIPAA, we will comply with the governing requirement.

9. Your Right to Access Medical Records

You have the right to request access to and receive copies of PHI maintained in a designated record set, subject to applicable legal exceptions.

9.1 Requesting Access

You may request an electronic or paper copy of qualifying medical and billing records.

Access requests may be submitted to SDKare’s Privacy Officer using the contact information in Section 22.

9.2 Response Time

Under HIPAA, we generally must act on an eligible access request within 30 calendar days.

Where permitted by law, one extension of up to 30 additional calendar days may be available if the required written explanation and expected completion date are provided.

More protective state-law deadlines will be followed where applicable.

9.3 Electronic Copies

If qualifying information is maintained electronically, you may request an electronic copy in a form and format required by applicable law.

9.4 Fees

A reasonable, cost-based fee may be charged only to the extent permitted by law.

Fees may not be used to unreasonably discourage or obstruct legally protected access.

9.5 Denial of Access

Access may be denied only where permitted by law.

When required, we will provide an explanation and information about any applicable right to review the denial.

10. Your Right to Request an Amendment

If you believe information in your qualifying medical or billing records is inaccurate or incomplete, you may request an amendment.

10.1 Submitting a Request

Requests should identify the information you believe is inaccurate or incomplete and explain the correction sought.

10.2 Review and Response

We will evaluate qualifying requests according to HIPAA and any applicable state requirements.

Under HIPAA, we generally must act on an amendment request within 60 days, subject to a legally permitted extension.

10.3 Denial of an Amendment

An amendment request may be denied for reasons permitted by law, including when the information is accurate and complete or when another applicable condition is not satisfied.

Where required, we will explain the denial and available rights to submit a statement of disagreement.

11. Your Right to Request Confidential Communications

You may request that we communicate with you about your health information using an alternative method or at an alternative location.

Examples may include:

• Contacting you through a specified telephone number.
• Sending eligible written communications to a designated mailing address.
• Using another legally permissible communication method.

We will accommodate reasonable requests where required by HIPAA.

You are not generally required to explain why you prefer a confidential communication method.

Requests should be directed to SDKare’s Privacy Officer or another authorized contact channel.

12. Your Right to Request Restrictions

You may request restrictions on certain uses or disclosures of your PHI.

12.1 General Restrictions

You may ask us not to use or disclose certain information for treatment, payment, or healthcare operations.

We are not required to agree to every requested restriction, except where law requires it.

12.2 Special Protection for Services Paid Fully Out of Pocket

If you pay for a healthcare item or service entirely out of pocket, you may request that the corresponding PHI not be disclosed to your health plan for payment or healthcare operations purposes.

Where the applicable HIPAA conditions are met, we must honor that restriction unless disclosure is required by law.

12.3 Implementing Restrictions

Approved restrictions will be handled according to applicable law and the responsibilities of the relevant healthcare provider or regulated entity.

SDKare’s self-pay billing model does not eliminate your right to request legally available restrictions.

13. Your Right to an Accounting of Disclosures

You may request an accounting of certain disclosures of your PHI.

An accounting generally provides information concerning qualifying disclosures made during the applicable period.

13.1 Information Included

The accounting may identify:

• The date of a disclosure.
• The person or organization receiving the information.
• A description of the information disclosed.
• The purpose or legal basis of the disclosure.

13.2 Applicable Exclusions

HIPAA excludes certain disclosures from its standard accounting requirement, including many disclosures for treatment, payment, and healthcare operations, and other categories specified by law.

13.3 Accounting Period

Under the general HIPAA accounting rule, you may request qualifying disclosures for a period of up to six years before the request.

13.4 Fees

The first qualifying accounting provided within a 12-month period is generally free.

Additional accountings within the same period may be subject to reasonable, cost-based fees when permitted by law and after required advance notice.

13.5 Special Record Requirements

Additional accounting requirements concerning certain substance use disorder records may apply when legally effective and applicable.

14. Your Right to a Copy of This Notice

You have the right to receive a copy of this Notice.

You may request a paper copy even if you previously agreed to receive the Notice electronically.

A current copy will be available through SDKare’s official website and upon request.

We will provide copies as required by applicable law.

15. Your Right to Designate a Personal Representative

A legally authorized personal representative may exercise certain privacy rights or make relevant decisions on your behalf.

Examples may include a person holding valid healthcare authority or another representative recognized by applicable law.

Before disclosing PHI or allowing a representative to exercise your rights, SDKare will verify the individual’s identity and legal authority as required.

The scope of a representative’s authority may depend on:

• Applicable state law.
• Valid legal documentation.
• The nature of the requested action.
• Relevant privacy and patient safety requirements.

SDKare may decline to treat a person as a personal representative in circumstances permitted by HIPAA, including certain situations involving abuse, neglect, or endangerment.

16. Identity Verification and Privacy Request Procedures

To protect your confidential information, SDKare takes steps to verify the identity and authority of individuals requesting PHI.

Verification may apply to:

• Requests for medical records.
• Requests to amend health information.
• Requests for disclosure accountings.
• Requests submitted by personal representatives.
• Requests to authorize disclosure to third parties.
• Other privacy requests requiring verification.

We may ask for information reasonably necessary to establish identity or authority.

The verification process must comply with applicable law and must not create unreasonable barriers to exercising patient rights.

Patients should not send complete payment-card details, unnecessary identity documents, or sensitive medical information through unsecured email.

Requests may be submitted using the contact information in Section 22.

17. Business Associates and Healthcare Service Providers

SDKare may use authorized third parties to assist with healthcare delivery, administration, technology, records management, scheduling, payment processing, and other lawful operations.

When an organization functions as a HIPAA business associate, the applicable Business Associate Agreement and legal requirements must be satisfied.

Business associates may use or disclose PHI only as permitted by applicable law and their authorized arrangements.

Examples of functions that may involve regulated service providers include:

• Electronic health record support.
• Telehealth technology.
• Patient scheduling.
• Healthcare billing administration.
• Data hosting or storage.
• Authorized healthcare administrative support.

Independent healthcare providers, pharmacies, and laboratories may also have their own privacy duties.

Sharing information with a third party does not automatically make that organization a business associate. Its legal classification depends on the relevant activities and circumstances.

18. Telehealth Communications and Website Privacy

SDKare provides healthcare services using electronic communication technologies.

18.1 Telehealth Information

Information discussed, collected, or documented during telehealth consultations may constitute PHI.

Appropriate privacy and security requirements apply.

18.2 Communication Preferences

Patients may request confidential communications as described in Section 11.

18.3 Electronic Communication Risks

Email, text messaging, internet connections, and other electronic communications may involve confidentiality risks.

SDKare and participating healthcare providers must follow applicable privacy and security requirements.

18.4 Website Tracking

PHI must not be impermissibly disclosed through website analytics, advertising pixels, or tracking technologies.

Where a technology provider handles PHI in a manner creating a business associate relationship, applicable HIPAA requirements must be satisfied.

General cookie consent is not a replacement for a HIPAA authorization when one is legally required.

18.5 General Website Privacy

Additional information concerning non-clinical website information, cookies, marketing preferences, and other personal information is provided in SDKare’s separate Privacy Policy.

19. Breach Notification and Information Security

SDKare is required to maintain appropriate safeguards for protected health information under applicable law.

Where the HIPAA Security Rule applies, electronic PHI must be protected through reasonable and appropriate administrative, physical, and technical safeguards.

19.1 Security Incidents

Suspected unauthorized access, inappropriate disclosure, or other potential security incidents must be evaluated according to applicable requirements.

19.2 Reportable Breaches

If a breach of unsecured PHI occurs and notification is required under HIPAA, affected individuals will be notified without unreasonable delay and within the applicable legal timeframe.

19.3 Notification Content

Required notices will include information prescribed by applicable law, which may address the nature of the incident, information involved, protective steps, and available contact information.

19.4 Additional Legal Requirements

Federal and state breach notification obligations may differ according to the circumstances.

SDKare will comply with applicable notification requirements.

20. Complaints and Protection Against Retaliation

If you believe your privacy rights have been violated, you may submit a complaint to SDKare or the U.S. Department of Health and Human Services Office for Civil Rights.

20.1 Complaints to SDKare

Privacy complaints may concern:

• Unauthorized access to medical records.
• Inappropriate disclosure of PHI.
• Failure to respond to qualifying privacy requests.
• Improper handling of confidential communications.
• Other potential privacy violations.

Complaints may be directed to SDKare’s Privacy Officer through the contact information in Section 22.

SDKare may request information reasonably necessary to investigate the concern.

20.2 Complaints to HHS

You may file a HIPAA complaint with:

U.S. Department of Health and Human Services
Office for Civil Rights

Website: https://www.hhs.gov/ocr/complaints/index.html

Phone: 1-877-696-6775

Mailing Address: 200 Independence Avenue SW, Washington, DC 20201

You may contact HHS directly without first completing SDKare’s internal complaint process.

20.3 Non-Retaliation

SDKare will not retaliate against individuals for filing a privacy complaint, exercising rights protected by HIPAA, or participating in activities protected under applicable privacy laws.

You will not be required to waive your legal privacy rights as a condition of receiving healthcare services.

21. Changes to This Notice

SDKare LLC reserves the right to revise this Notice and, to the extent permitted by law, make the revised provisions effective for PHI that SDKare maintains, including information created or received before the revision.

We are required to follow the terms of the Notice currently in effect.

When material changes are made, we will update the Notice and make the revised version available as required by applicable law.

The current Notice will be available on SDKare’s website and upon request.

The Last Updated date will reflect the most recent approved revision.

Where applicable law requires separate authorization, consent, or notification, a revision of this Notice does not replace those requirements.

22. Privacy Officer and Contact Information

For questions about this Notice, requests to exercise your HIPAA rights, medical record access, confidential communications, privacy complaints, or other privacy-related matters, contact:

SDKare LLC

Privacy Officer: Sophie Brown

Security Official: Sophie Brown

Website: https://sdkare.com/

Email: contact.support@sdkare.com

Phone: (520) 800-6043

Mailing address: 2810 N Church St, Wilmington, DE 19802, United States

You may direct written privacy requests and complaints to the Privacy Officer using the contact information above.

Requests will be reviewed and handled in accordance with applicable federal and state requirements.

23. Relationship to Other SDKare Policies

This HIPAA Notice of Privacy Practices is intended to operate alongside SDKare’s:

• Privacy Policy.
• HIPAA Privacy and Security Policy.
• Terms & Conditions.
• Telehealth Informed Consent.
• Payment Policy for Clients.
• Refund Policy.
• Patient No-Show and Late Cancellation Policy.
• DEA and Telemedicine Prescribing Policy.

This Notice specifically describes HIPAA-related rights, permitted uses and disclosures, and legal duties relating to protected health information.

Other SDKare policies address general website privacy, scheduling, payment, clinical services, and operational matters.

If an applicable law establishes a more protective requirement than a provision in an SDKare policy, the governing legal requirement controls.