Notice of Privacy Practices

Effective: Not yet in effectLast updated: July 22, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Novaya Health LLC ("Novaya Health," "we," "us," or "our") is required by law to protect the privacy of your health information, to give you this notice of our legal duties and privacy practices, and to follow the terms of the notice currently in effect. This notice applies to all records of your care that we create or maintain, whether we, a member of our clinical staff, or another party acting on our behalf recorded them.

We call this information protected health information, or PHI. It is information that identifies you and relates to your past, present, or future physical or mental health, the care you receive, or payment for that care.

How we may use and disclose your health information

For treatment

We use your health information to provide, coordinate, and manage your care. For example, a physician treating you may review your medication history before prescribing, or we may share your records with a specialist, laboratory, imaging center, or pharmacy involved in your care. If you use our monitoring or coaching tools, the readings and responses you submit are available to your care team for the purpose of treating you.

For payment

We may use and disclose your health information to bill and collect payment for the care you receive. This can include confirming your eligibility and benefits with a health plan, obtaining prior authorization for a medication or procedure, and submitting claims containing your diagnosis and the services provided.

For health care operations

We may use and disclose your health information to run our practice and keep the quality of care high. Examples include reviewing clinical outcomes, evaluating the performance of our clinicians, training staff and students, conducting internal audits, arranging for legal and accounting services, and planning our services.

To people involved in your care

Unless you object, we may share information relevant to a person's involvement with a family member, relative, friend, or other person you have identified as being involved in your care or payment for it. In an emergency, or if you are not present or able to agree, we may share information when we judge, using our professional judgment, that it is in your best interest.

Appointment reminders and health-related communications

We may contact you to remind you of appointments, to tell you about treatment alternatives, or to describe health-related benefits and services that may interest you. Where we use email, text message, or push notification for these, we will use the contact details you have given us.

Other uses and disclosures permitted or required without your authorization

Federal and state law permit or require us to disclose your health information without your written authorization in the following circumstances:

• As required by law. When a federal, state, or local law requires the disclosure.
• Public health activities. To prevent or control disease, injury, or disability; to report births and deaths; to report reactions to medications or problems with products; and to notify people of recalls.
• Victims of abuse, neglect, or domestic violence. To a government authority authorized to receive such reports, in the circumstances the law allows.
• Health oversight activities. To an agency conducting audits, investigations, inspections, or licensure activity necessary to oversee the health care system.
• Judicial and administrative proceedings. In response to a court or administrative order, or to a subpoena or discovery request where the required assurances about notifying you have been met.
• Law enforcement. For purposes such as responding to a court order or warrant, identifying or locating a suspect or missing person, or reporting a death we believe may have resulted from criminal conduct.
• Coroners, medical examiners, and funeral directors. To allow them to carry out their duties.
• Organ and tissue donation. To organizations that handle procurement or transplantation.
• Research. Where an institutional review board or privacy board has approved the research and established protections for your information.
• To avert a serious threat. When necessary to prevent or lessen a serious and imminent threat to the health or safety of you or the public.
• Specialized government functions. For military and veterans' activities, national security and intelligence, protective services for the President and others, and the health of inmates in correctional institutions.
• Workers' compensation. As authorized by workers' compensation or similar programs.
• Business associates. To vendors who perform services for us — for example electronic health record hosting, billing, or secure messaging — each of whom is bound by written contract to safeguard your information and use it only as permitted.

Uses and disclosures that require your written authorization

We will obtain your written authorization before we use or disclose your health information for any purpose not described in this notice, and specifically before we:

• use or disclose psychotherapy notes, except in the narrow circumstances the law permits;
• use or disclose your information for marketing purposes; or
• sell your health information.

You may revoke an authorization in writing at any time. A revocation stops any further use or disclosure under that authorization, but it cannot undo a use or disclosure we already made while the authorization was in effect.

Your rights regarding your health information

Right to inspect and obtain a copy

You may inspect and obtain a copy of the health information we use to make decisions about your care. If we hold the information electronically, you may ask for an electronic copy, and you may ask us to send it to a person or entity you designate. We may charge a reasonable, cost-based fee. In limited circumstances we may deny a request, and where the law provides for it you may ask for that denial to be reviewed.

Right to request an amendment

If you believe information in your record is incorrect or incomplete, you may ask us to amend it. Your request must be in writing and must give a reason. We may deny the request if the information was not created by us, is not part of the records we keep, is not information you would be permitted to inspect, or is accurate and complete. If we deny it, you may submit a statement of disagreement to be kept with the record.

Right to an accounting of disclosures

You may request a list of the disclosures we made of your health information, other than disclosures for treatment, payment, health care operations, and certain other categories the law excludes. The accounting covers up to six years before the date of your request. The first accounting in any twelve-month period is free; we may charge a reasonable, cost-based fee for additional ones.

Right to request restrictions

You may ask us to restrict how we use or disclose your information for treatment, payment, or health care operations, or to a person involved in your care. We are not generally required to agree. However, we must agree to your request to withhold information from your health plan when the disclosure is for payment or health care operations and you have paid for the item or service in full, out of pocket.

Right to request confidential communications

You may ask us to contact you about medical matters in a particular way or at a particular location — for example, only by email, or only at a work address. We will accommodate reasonable requests and will not ask you for a reason.

Right to a paper copy of this notice

You may ask for a paper copy of this notice at any time, even if you agreed to receive it electronically.

Right to be notified of a breach

We will notify you if a breach occurs that may have compromised the privacy or security of your health information.

Right to choose someone to act for you

If you have given someone medical power of attorney, or if someone is your legal guardian, that person can exercise these rights and make choices about your health information. We will verify that the person has this authority before we act.

Our responsibilities

• We are required by law to maintain the privacy and security of your health information.
• We will let you know promptly if a breach occurs that may have compromised it.
• We must follow the duties and privacy practices described in this notice and give you a copy.
• We will not use or share your information other than as described here unless you tell us in writing that we may. If you tell us we may and then change your mind, you may revoke that permission in writing at any time.

Changes to this notice

We reserve the right to change this notice and to make the revised notice effective for health information we already hold as well as information we receive in the future. The current notice will always be posted on this page with its effective date, and a copy will be available at our place of service on request.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with us using the contact details below, or with the Office for Civil Rights, U.S. Department of Health and Human Services. You will not be retaliated against, and your care will not be affected in any way, for filing a complaint.

Complaints to the federal government may be sent to 200 Independence Avenue, S.W., Washington, D.C. 20201, made by calling 1-877-696-6775, or filed online at https://www.hhs.gov/ocr/privacy/hipaa/complaints/.

How to contact us

To exercise any of the rights described above, to request a paper copy of this notice, or to raise a privacy concern, contact our Privacy Officer by email at hello@novayahealth.com.