Notice of Privacy Practices

Who We Are

This Notice of Privacy Practices (“Notice”) is issued by Arora Health & Aesthetics, LLC (“we,” “us,” or “our”), the independent medical group whose licensed clinicians provide clinical services accessed through the Ironvale RX platform (ironvalerx.com). We are a “covered entity” under the Health Insurance Portability and Accountability Act (“HIPAA”). Ironvale Inc and Bask Health Inc support our practice as business associates — providing the storefront, administrative, and telehealth technology services through which you receive care — and are bound by Business Associate Agreements requiring them to safeguard your protected health information (“PHI”). We are required by law to maintain the privacy of your PHI, to provide you with this Notice of our legal duties and privacy practices, to notify you in the event of a breach of your unsecured PHI, and to abide by the terms of this Notice.

How We May Use and Disclose Your PHI

• Treatment. We may use and disclose your PHI to provide, coordinate, and manage your healthcare, including communicating with pharmacies that dispense your prescriptions, laboratories that perform your testing, and other healthcare providers involved in your care.
• Payment. Our services are provided on a direct-pay (cash-pay) basis. We may use and disclose your PHI to bill you and collect payment for services provided to you, including processing payments through our business associates and payment processors, and providing you receipts and statements. We do not bill federal or state health care programs for these services.
• Healthcare Operations. We may use and disclose your PHI for our healthcare operations, including quality assessment and improvement, case management, credentialing and licensing of our clinicians, audits, and obtaining legal and compliance services.
• As Required by Law. We will disclose your PHI when federal, state, or local law requires it.
• Public Health and Safety. We may disclose your PHI to public health authorities for activities such as reporting adverse reactions to medications or problems with products, and to prevent or lessen a serious and imminent threat to the health or safety of a person or the public.
• Abuse or Neglect. We may disclose your PHI to appropriate authorities to report suspected abuse, neglect, or domestic violence, as required or permitted by law.
• Health Oversight. We may disclose your PHI to health oversight agencies for activities authorized by law, such as audits, investigations, inspections, and licensure.
• Judicial and Administrative Proceedings; Law Enforcement. We may disclose your PHI in response to a court or administrative order and, in limited circumstances, a subpoena, discovery request, warrant, or other lawful process.

Other uses and disclosures not described in this Notice — including most uses and disclosures of PHI for marketing purposes and any sale of your PHI — will be made only with your written authorization, which you may revoke at any time in writing, except to the extent we have already acted in reliance on it.

Your Rights Regarding Your PHI

• Right to Inspect and Copy. You may inspect and obtain a copy of your PHI, including in electronic form, with limited exceptions. Submit requests to our Privacy Officer at contactus@arorahealthgroup.com. We may charge a reasonable, cost-based fee.
• Right to Amend. If you believe your PHI is incorrect or incomplete, you may request an amendment in writing, stating the reason. We may deny the request in certain circumstances, and you may submit a statement of disagreement.
• Right to an Accounting of Disclosures. You may request a list of certain disclosures of your PHI made in the prior six years, excluding disclosures for treatment, payment, healthcare operations, and certain other purposes.
• Right to Request Restrictions. You may request restrictions on our use or disclosure of your PHI. We are not required to agree to all requests; however, because you pay for our services out of pocket and in full, we WILL honor your request to restrict disclosure of PHI about those services to any health plan, as required by law.
• Right to Confidential Communications. You may request that we communicate with you in a certain way or at a certain location (for example, only by a specified email or phone number), and we will accommodate reasonable requests.
• Right to a Copy of This Notice. You may request a paper or electronic copy of this Notice at any time, even if you agreed to receive it electronically.
• Right to Breach Notification. You have the right to be notified if we discover a breach of your unsecured PHI.

State Privacy Protections

Where the law of your state provides privacy protections for medical information that are more stringent than HIPAA, we comply with the more stringent requirement. For example, certain states — including California (under the Confidentiality of Medical Information Act), New York, Texas, Florida, Illinois, and Massachusetts — impose heightened consent, security, or disclosure requirements, including for particularly sensitive categories of information (such as HIV-related information, genetic information, mental health records, and substance-use treatment records) and for the use of medical information in marketing. Where such laws apply to you, we will obtain any legally required consent before making the relevant use or disclosure.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer using the contact information below, or with the Secretary of the U.S. Department of Health and Human Services, Office for Civil Rights. You will not be penalized or retaliated against for filing a complaint.

Changes to This Notice

We reserve the right to change this Notice and to make the revised Notice effective for PHI we already maintain as well as PHI we receive in the future. The current Notice, with its effective date, will be posted at ironvalerx.com/legal/hipaa-policy and available upon request.

Contact

Platform correspondence: c/o Ironvale Inc, 12-45 River Rd #117, Fair Lawn, NJ 07410; privacy@ironvalerx.com.