Notice of Privacy Practices

This notice describes the privacy practices of Halso Life FL, LLC, the clinical practice providing care through Hälso Life. "We," "us," and "our" refer to that practice. It covers protected health information we create or receive in providing care, including medical history, clinical notes, laboratory results, prescriptions, and care-related communications.

This is separate from the website Privacy Policy, which describes website and invitation information. Independent laboratories, pharmacies, and other treating providers have their own privacy notices. This notice does not make those organizations or Halso Life, LLC part of a joint covered entity.

Contact the Hälso Life Privacy Team:

• Email: privacy@halsolife.com
• Telephone: +1 (561) 235-2205
• Mail: Hälso Life Privacy Team, Halso Life FL, LLC, 1816 Clare Avenue, West Palm Beach, FL 33401

Use these contacts to ask about this notice, exercise the rights below, or make a privacy complaint. Please do not include medical records or detailed health information in an ordinary email. We will explain how to provide information securely. Email and voicemail are not emergency services.

The permissions described here are subject to applicable law. When Florida law or another law provides greater confidentiality protection, we follow that stricter requirement, including any additional consent requirement.

Treatment. We may use and share information to evaluate you, provide care, and coordinate treatment. For example, your clinician may review laboratory results and send a prescription and necessary treatment information to a pharmacy, or exchange information with another provider involved in your care.

Payment. We may use and share information necessary to bill for services and resolve payment questions. For example, authorized billing personnel may review the services charged to your account to correct a bill. Hälso Life is cash-pay, does not bill third-party payers, and does not issue superbills. Payment processing is separate from clinical care; payment does not authorize unrestricted access to your clinical record.

Healthcare operations. We may use and share information to operate the practice, review care quality, maintain records, and support care delivery. For example, a clinician may review documentation to assess the quality of care. Administrative and technology services, including services provided by Halso Life, LLC, may support these activities. Disclosures for these services are subject to the applicable safeguards and business associate agreement requirements. This notice does not itself authorize access or replace a required agreement.

We may contact you about care, appointments, and treatment options using permitted communication methods and subject to your communication preferences.

Video visits may involve recording and transcription for clinical documentation. Recording requires separate consent from everyone participating before capture begins. Ask your clinician about recording, transcription, and available visit arrangements before the visit. A clinical note prepared from a visit is maintained as part of your medical record.

AI tools may assist with organizing information and drafting documentation. Clinical decisions remain the responsibility of your licensed clinician. Permission to use information for care does not by itself authorize a separate use for marketing, research, or AI-model training. Any such use requires its own lawful basis and any required authorization. Ask the Privacy Team about the handling of information used by documentation tools.

This notice is not consent to recording, an AI acknowledgment, a research consent, or an authorization for any use of information that requires separate permission.

You may tell us whether we may share relevant information with family, friends, or others involved in your care or payment. If you cannot express a preference, we may share relevant information when professional judgment and applicable law permit it in your best interests. Similar safeguards apply to permitted disaster-relief disclosures.

We do not sell your health information, and we do not use it for fundraising. Uses or disclosures for marketing that require a HIPAA authorization require your written authorization. A general membership agreement or acknowledgment of this notice does not replace that authorization.

Most uses and disclosures of psychotherapy notes require your written authorization, apart from limited exceptions permitted by law. Psychotherapy notes are a specially defined category and are not the same as ordinary clinical progress notes.

Other uses and disclosures not described in this notice require your written authorization unless otherwise required by law. You may revoke an authorization by writing to the Privacy Team. Revocation does not undo actions already taken in reliance on your authorization.

Subject to the conditions of applicable law and the additional protections in section 7, information may be disclosed:

• Public health and safety: For legally authorized disease reporting, product recalls, adverse medication reactions, reporting abuse or neglect, or preventing a serious and imminent threat to health or safety.
• Oversight and legal requirements: To authorized health oversight bodies for activities such as licensing, audits, and investigations, or to the U.S. Department of Health and Human Services when legally required for a privacy investigation.
• Court and administrative proceedings: In response to legally sufficient orders or other legal process, after satisfying applicable notice, authorization, protective-order, and confidentiality requirements. A request or subpoena does not automatically permit disclosure.
• Law enforcement and government functions: Only as authorized or required by law, including applicable workers' compensation, military, national-security, protective-service, or correctional provisions.
• After death and donation: To a coroner, medical examiner, funeral director, or organ-procurement organization when permitted or required by law.

We do not operate a research program. Any future research use would require the applicable approvals and legal basis, including your authorization where the law requires it, before it begins.

Florida law can restrict disclosure of medical records beyond HIPAA. For example, medical-record disclosures outside your care team generally require your written authorization unless a statutory exception applies. HIV test results have additional confidentiality requirements, and a general medical-record release may not be sufficient. Other protections may apply to mental-health and substance-use records. We obtain any additional permission required by applicable law.

If we receive substance use disorder patient records protected by 42 CFR Part 2, those protections apply even though we are not a Part 2 treatment program. We will not use or disclose those records, or testimony describing their contents, in civil, criminal, administrative, or legislative investigations or proceedings against you without your specific written consent, or a qualifying court order issued after notice and an opportunity to be heard is provided to you or the holder of the record, accompanied by a subpoena or other legal requirement compelling disclosure. A consent for treatment, payment, or operations does not authorize use in investigations or proceedings against you. Any permitted disclosure must satisfy Part 2 and other applicable law. We do not use these records for fundraising.

Contact the Privacy Team using section 2 to exercise these rights. We may request reasonable information to verify your identity or a representative's authority. Do not send identification documents until we explain the secure process.

Inspect or obtain records. You may request access to, or an electronic or paper copy of, the medical and billing information maintained about you in the designated record set. We act within 30 days. If a legally permitted extension is needed, we will explain the reason and completion date in writing. Any copying fee will comply with applicable law. If access is denied, we will provide a written explanation and describe any available review rights. Canceling membership does not end your access rights.

Request an amendment. You may ask us in writing to amend information you believe is inaccurate or incomplete and explain why. We respond within 60 days, with written notice of any permitted extension. We may deny an amendment when the law allows, but we will explain the denial and how you may submit a statement of disagreement. Amendment does not mean erasing the original record.

Request confidential communications. You may ask us to contact you in a particular way or at a different address. We accommodate reasonable requests.

Request restrictions. You may ask us to limit uses or disclosures for treatment, payment, or healthcare operations. We are not required to agree, except that if you pay for a service in full out of pocket, we must honor a request not to share information about it with a health plan for payment or healthcare operations, unless disclosure is required by law. If we agree to a restriction, emergency-treatment exceptions may apply.

Request an accounting of disclosures. You may request a list of disclosures subject to HIPAA's accounting requirement during the preceding six years. HIPAA excludes certain disclosures, including most treatment, payment, operations, and authorized disclosures. One accounting in a 12-month period is free. Any fee for an additional accounting will be permitted by law and disclosed before you decide whether to proceed. We also comply with any applicable Florida disclosure-record requirements.

Obtain this notice. You may request a paper copy at any time, even if you previously agreed to electronic delivery.

Use a representative. A person legally authorized to act for you may exercise your rights, subject to verification of that authority and applicable legal exceptions.

Clinical records, visit media, transcripts, and copies held in backups can have different retention requirements. Information incorporated into your clinical record may need to be kept even after associated visit media is deleted. We retain information as required by applicable law and legal holds. Contact the Privacy Team about the retention of a specific record. Ending membership or requesting deletion does not require deletion of records that must be retained. Your access rights are separate from retention requirements.

We are required by law to maintain the privacy and security of your protected health information, to provide you with this notice of our legal duties and privacy practices, and to notify you following a breach of unsecured protected health information. We must follow the notice currently in effect. We maintain administrative, technical, and physical safeguards for health information, but no system can guarantee absolute security.

You may complain to the Hälso Life Privacy Team by phone or in writing using section 2. Describe your concern and how we can contact you. We will not retaliate against you for making a privacy complaint.

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights through its privacy complaint process, by calling 1-877-696-6775, or by writing to 200 Independence Avenue, S.W., Washington, D.C. 20201. You do not have to complain to us first.

We may revise this notice as permitted by law and apply revised provisions to information we already maintain as well as information received later. A material change will not take effect before the revised notice's effective date unless the law requires otherwise. The current notice is available at https://halsolife.com/privacy-practices and on request.

Acknowledging receipt of this notice is not consent to treatment, recording, marketing, or research, and is not a waiver of privacy rights.