Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

SpineZone Medical Fitness, Inc. (“SpineZone”) is committed to obtaining, maintaining, using and disclosing your protected health information (“PHI”) in a manner that protects your privacy. We urge you to read this Notice of Privacy Practices (this “Notice”), effective June 1, 2021, carefully in order to understand both our commitment to the privacy of your PHI and your rights.

SpineZone is required by law to maintain the privacy of your PHI and to provide you with a notice of our legal duties and privacy practices with respect to PHI. PHI is information about you, including basic demographic information, that may identify you and that relates to your past, present or future physical or mental health condition, treatment, or payment for health services. This Notice describes how we may use and disclose your PHI to carry out treatment, payment or health care operations, and for other specified purposes that are permitted or required by law. The Notice also describes your rights with respect to your PHI.

SpineZone reserves the right to amend this Notice from time to time. When material changes are made, SpineZone will promptly post the updated Notice on the SpineZone website at https://online.spinezone.com/privacy-policy/ and provide a copy to you at your request. SpineZone is required to abide by the terms of the Notice currently in effect.

I. Uses and Disclosures of Your Information

SpineZone may use or disclose your PHI for the following purposes:

· Treatment. SpineZone may use or disclose your PHI for purposes of providing your medical treatment. For example, we may disclose your PHI to your primary care physician if needed in order to coordinate your medical care.

· Payment. SpineZone may use or disclose your PHI for purposes of billing and collecting payment for our services. For example, we may disclose your PHI to your health plan in order to obtain payment for our services.

· Health Care Operations. SpineZone may use or disclose your PHI to facilitate our business’ health care operations. For example, we may review your PHI internally as part of an audit to confirm the quality of our services being delivered to our patients.

· As Required by Law. SpineZone may use or disclose your PHI if required to do so by federal or state law.

· Disclosures to your Representative and/or Individuals Involved in Your Care . SpineZone may disclose your PHI to your friends or family members who are involved in your care, including those who are responsible for paying for your care and/or those who assist in your transportation to and/or from appointments. SpineZone may also disclose your PHI to your personal representative, as established under applicable law, or to an administrator or authorized individual associated with your estate.

· Disclosures to Business Associates. SpineZone may disclose your PHI to certain of our service providers that have agreed to maintain the privacy and security thereof. For example, we may disclose your PHI to our contracted management company.

· De-Identification of PHI. SpineZone may de-identify your PHI, meaning that SpineZone would remove all identifying features as determined by law to make it extremely unlikely that the information could identify you. De-identified information no longer qualifies as PHI, meaning that SpineZone may use and disclose it for purposes not set forth in this Notice.

SpineZone may also use or disclose your PHI in other ways as permitted by law. Generally, these are ways that serve the public health and/or research. Specifically:

· SpineZone may use or disclose your PHI as needed to assist with public health and safety issues and may disclose your PHI to law enforcement officials when needed, to health oversight agencies for authorized activities, and for special government functions including national security needs.

· SpineZone may disclose your PHI as needed to organ procurement organizations, medical examiners, and funeral directors in the event of an individual’s death.

· SpineZone may use or disclose your PHI to address workers’ compensation claims.

· SpineZone may use or disclose your PHI in response to a court or administrative order, or in response to a subpoena.

Uses and disclosures of PHI for purposes other than those described above, including for marketing purposes and disclosures that would constitute the sale of PHI, will not be made in the absence of a written authorization signed by you or your personal representative. Once you sign an authorization, you may revoke it by contacting SpineZone at info@spinezone.com. However, any use or disclosure of your PHI already taken in reliance on your authorization prior to your revocation cannot be reversed.

II. Your Rights Regarding Your PHI

You have the following rights with respect to your PHI:

· You have the right to request restrictions on certain uses and disclosures of your PHI. SpineZone will consider every request to restrict uses or disclosures of your PHI and will strive to honor those that are reasonable. However, SpineZone is not legally required to honor each request unless the requested restriction involves a disclosure not required by law to a health plan for purposes of payment or health care operations, and you have paid for the applicable services in full, out of pocket. With respect to any requested restriction, if SpineZone agrees to honor it, we will document such restriction and continue to abide by it.

· You have the right to receive confidential communications of your PHI from SpineZone. Specifically, you may request that SpineZone communicate with you about your PHI using a specific means, phone number, or address. SpineZone will accommodate reasonable requests regarding confidential communications of your PHI.

· Subject to applicable state law, you have the right to inspect and copy your PHI. You also have the right to access and receive your PHI electronically if readily producible in such format.

· You have the right to correct or update your PHI. If you believe that there is an error in your PHI, you may request that SpineZone update it as appropriate.

· You have the right to receive an accounting of certain disclosures of your PHI made by SpineZone. Upon receipt of such request, SpineZone will provide you with a list of disclosures made by SpineZone in the prior six (6) years, not including certain types of disclosures such as, by way of example only, those made directly to you or pursuant to your written authorization.

· You have the right to obtain a paper copy of this Notice upon request.

To exercise any of these rights, please send written communication to SpineZone at info@spinezone.com.

III. Breach Notification

SpineZone is required by law to notify you in the event that your PHI is subject to a security breach unless SpineZone reasonably determines that, after fully investigating the situation and assessing the risk presented, there is a low probability that the privacy or security of your PHI has been compromised. You will be notified without unreasonable delay and in no event later than sixty (60) days following discovery of the security breach. Such notification will include information about the security breach, including steps that SpineZone has taken to mitigate potential harm, and a contact person to whom you may address additional questions.

IV. Questions, Comments, or Complaints

If you have any questions or comments about this Notice, or if you have any complaints about SpineZone’s privacy practices, please contact us at info@spinezone.com. You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services. SpineZone will not retaliate against you for filing a complaint.