HIPAA Notice of Privacy Practices

Effective date: October 7, 2026

This notice describes how medical information about you may be used and disclosed and how you can get access to this information. Please review it carefully.

This notice applies to protected health information maintained by Endless Vitality, LLC in providing healthcare services, including in-person and telehealth care.

Our responsibilities

We are required by law to protect the privacy of PHI, provide this notice of our legal duties and privacy practices, follow the notice currently in effect, and notify you following a breach of unsecured PHI as required by law. Clinical records and telehealth-related clinical information are maintained in TalkEHR. Authorized personnel and service providers may access information only as permitted by law and their responsibilities.

Uses and disclosures without your written authorization

Treatment. We may use and share information to provide or coordinate care. For example, we may send a prescription to your pharmacy or relevant results to a treating specialist.

Payment. We may use and share information to obtain payment for services, such as preparing a patient invoice or addressing a disputed charge, subject to legal limits and agreed restrictions.

Healthcare operations. We may use and share information to operate the practice, including evaluating care quality, training staff, and conducting compliance reviews. For example, a clinical reviewer may assess whether follow-up testing was appropriate.

Service providers. Business associates may assist with record management, billing, technology, or other authorized functions under agreements required by law.

Reminders and care information. We may contact you about appointments, treatment alternatives, and health-related benefits or services as permitted by law. Communications requiring authorization will not be treated as routine care communications.

People involved in your care and disaster relief. We may share relevant information with family, friends, or others involved in care or payment if you agree or do not object when given the opportunity. If you cannot express a preference, we may share information when professional judgment finds it in your best interests. Legally permitted disaster-relief disclosures may help locate or notify people responsible for your care.

Other legally permitted or required purposes. Subject to each purpose's legal conditions, we may disclose information for public-health reporting, disease prevention, adverse-event reporting, reports of abuse or neglect, health oversight and audits, legally qualifying judicial or administrative proceedings and law-enforcement requests, coroner or medical-examiner duties, funeral services, organ or tissue donation, workers' compensation, authorized national-security or military functions, and qualifying custodial circumstances. We may disclose information to prevent or lessen a serious and imminent threat as permitted by law. We may use or disclose information for research only when the applicable authorization, waiver, or other legal requirements are met. We may disclose information to HHS to assess our compliance. A request or subpoena does not automatically authorize release; applicable conditions must be satisfied.

Authorization and specially protected records

Uses or disclosures not described in this notice require your written authorization unless otherwise permitted or required by law. Most uses or disclosures of psychotherapy notes, marketing uses requiring authorization, and sales of PHI require your written authorization, subject to legal exceptions. We do not sell your PHI. You may revoke an authorization in writing through our Privacy Officer; revocation does not undo actions already taken in reliance on it.

More protective laws may limit disclosures of particular sensitive records and may require additional consent. If we receive substance-use-disorder records protected by 42 CFR Part 2, we apply its additional protections. Such records, and testimony revealing their contents, cannot be used or disclosed in civil, criminal, administrative, or legislative proceedings against you without your written consent or an appropriate court order issued after required notice and opportunity to be heard. A court order authorizing disclosure must be accompanied by a subpoena or other legal requirement compelling disclosure. A general treatment, payment, or operations consent does not authorize use against you in such proceedings. Information we lawfully disclose may be redisclosed by a recipient and may no longer be protected by HIPAA; other laws, including Part 2 where applicable, may continue to protect it.

Your rights and how to exercise them

Contact our Privacy Officer by phone, email, or mail below for request instructions. We may ask for a written request and reasonable identity verification. Do not send detailed health information by ordinary email; ask for a secure method.

• Access and copies: Request inspection or a paper or electronic copy of medical and billing information in the designated record set, subject to legal exceptions. We provide the requested format if readily producible and respond within applicable deadlines, including shorter state deadlines where required. Permitted copy fees are reasonable and cost-based under applicable law. If access is denied, we provide a written explanation and explain any right to review.
• Amendments: Request amendment of information you believe is inaccurate or incomplete and explain why. We normally act within 60 days. If a permitted extension is necessary, we explain it in writing. A denial includes its basis and your right to submit a statement of disagreement. An amendment does not necessarily erase the original entry.
• Restrictions: Ask us to limit certain treatment, payment, or operations uses or disclosures, or disclosures to people involved in care. We generally need not agree. However, if you or someone other than your health plan pays in full out of pocket for an item or service, we must honor a request not to disclose information solely about that item or service to your health plan for payment or operations, unless disclosure is required by law.
• Confidential communications: Ask us to contact you through an alternative method or at a different location. We accommodate reasonable requests. Tell us how and where to contact you; you do not have to explain why.
• Accounting: Request a list of certain disclosures made during the preceding six years. This generally excludes treatment, payment, operations, authorized disclosures, and other legally excluded categories. The first accounting in a 12-month period is free; we explain any permitted charge for additional requests before processing them.
• Notice copy: Obtain a paper copy of this notice at any time, even if you received it electronically.
• Representative: A person with lawful authority may exercise rights for you, subject to verification and legal limits.
• Complaints: Complain to us or HHS if you believe your privacy rights were violated. We will not retaliate against you.

Medical-record privacy rights do not include an unrestricted right to delete records that we are required to retain.

State protections

We follow applicable state medical-privacy laws in addition to HIPAA and apply more protective requirements where required. Arizona medical and payment records are confidential under A.R.S. § 12-2292, and record access is governed by A.R.S. § 12-2293 and applicable federal law. Telehealth medical reports are part of the medical record under A.R.S. § 36-3602. Patients in other states may have additional rights or consent protections based on the law applicable to their care and information. Ask our Privacy Officer for help with state-specific requests.

Breach notification

We notify affected individuals of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery, subject to legally permitted delay, and notify regulators and the media when required. Applicable state requirements may impose additional or shorter deadlines.

Privacy contact and complaints

Privacy Officer — Endless Vitality, LLC

• Phone: (602) 636-5000
• Email: secure@endlessvitality.com
• Mail: 1845 E Broadway Rd, Ste 116, Tempe, AZ 85282

To complain to us, describe your concern, when it occurred, and how we can contact you. For a federal complaint, visit HHS Office for Civil Rights, call (800) 368-1019, or write to Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Washington, DC 20201. HHS generally requires complaints within 180 days of when you knew of the issue, with extensions for good cause.

Changes and availability

We may revise this notice and make lawful changes effective for all PHI we maintain, including information collected earlier. We post the revised notice with its effective date on our website and at our office and provide copies upon request. Changes requiring authorization will still require authorization.