Notice of Privacy Practices

1. Our Duties Regarding Your Health Information

Revive Low T Clinic is required by law to:

• Maintain the privacy of your protected health information (PHI)
• Provide you with this Notice of our legal duties and privacy practices
• Follow the terms of the Notice currently in effect
• Notify you in the event of a breach of your unsecured PHI

We reserve the right to change this Notice and to make the revised Notice effective for PHI we already hold, as well as any PHI we receive in the future. If we make a material change, we will post the revised Notice at our clinic and on revivelowt.com, and make it available upon request.

2. How We Use and Disclose Your Health Information

Treatment

We use and disclose your PHI to provide, coordinate, and manage your care. For example, your treating physician may share lab results and medication information with our nursing staff to manage your TRT protocol, or may consult with a specialist about your care.

Payment

We may use and disclose your PHI to obtain payment for treatment services. For example, we may submit claims to your health insurer for lab work, and include your diagnosis and treatment codes on that claim.

Health Care Operations

We may use and disclose your PHI for operational purposes, including quality assurance, staff training, auditing, accreditation activities, and legal and business functions necessary to operate the clinic.

Appointment Reminders

We may contact you by phone, text, or email to remind you of upcoming appointments, notify you that lab results are ready, or follow up on your care — consistent with your communication preferences on file.

As Required by Law

We may use or disclose your PHI when required to do so by federal, state, or local law, including reporting to public health authorities, responding to court orders, and cooperating with law enforcement under specific legal conditions.

3. Other Permitted Uses and Disclosures

Business Associates

We share PHI with vendors who perform services on our behalf ("business associates"), such as our electronic health record system, laboratory partners, billing processor, and cloud infrastructure provider. All business associates are required by contract to protect your PHI under terms consistent with HIPAA.

Research

We may use or disclose your PHI for approved research under specific conditions, including IRB oversight and appropriate de-identification, or with your written authorization.

Serious Threats

We may disclose PHI if we believe it is necessary to prevent a serious and imminent threat to your health or safety, or to the health or safety of another person or the public.

Disclosures We Will Not Make Without Authorization

We will not sell your PHI, use it for marketing without your authorization, or disclose it for any purpose not described in this Notice unless you provide written authorization. You may revoke an authorization in writing at any time.

Washington My Health MY Data Act (MHMDA)

Washington state law provides additional protections for consumer health data. See our Consumer Health Data Privacy Notice for details on how we handle data under Washington state law.

4. Your Rights Regarding Your Health Information

To exercise any of these rights, please contact our Privacy Officer (see Section 6). We will respond in writing within 30 days. We will not retaliate against you for exercising your rights.

5. How to File a Complaint

If you believe we have violated your privacy rights, you may file a complaint with us or with the U.S. Department of Health and Human Services Office for Civil Rights (OCR). We will not retaliate against you for filing a complaint.

• File with us: Contact our Privacy Officer (see below). We will investigate and respond in writing within 30 days.
• File with HHS OCR: Visit hhs.gov/ocr or call 1-800-368-1019 (TDD: 1-800-537-7697).

There are no fees for filing a complaint with HHS OCR, and you may file electronically, by mail, or in person.

6. Contact Our Privacy Officer