Notice of Privacy Practices

INSTITUTE FOR HUMAN OPTIMIZATION – NOTICE OF PRIVACY PRACTICES

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

1. Who This Notice Covers

This notice describes the privacy practices of the Institute for Human Optimization (“IFHO,” “we,” “our,” or “us”), including our clinicians, employees, and workforce members, and the Business Associates who handle your information on our behalf.

We are required by law to protect the privacy of your Protected Health Information (“PHI”), to give you this notice of our legal duties and privacy practices, and to follow the terms of the notice currently in effect.

PHI means information that identifies you and relates to your past, present, or future physical or mental health or conditions, healthcare services, or payment for healthcare.

Information collected through our website that is not PHI, such as an inquiry form submitted before you become a patient, is described in our Privacy Policy.

2. How We May Use and Disclose Your Information Without Your Authorization

A. Treatment

We use your PHI to provide, coordinate, and manage your care. For example, a physician may review your laboratory results, biomarker panels, or imaging in order to make a clinical recommendation, and may share relevant findings with another clinician involved in your care.

B. Payment

We use and disclose your PHI to obtain payment for the services we provide. For example, we may disclose the services performed and the diagnosis supporting them in order to process a payment, verify eligibility, or resolve a billing question.

C. Healthcare Operations

We use your PHI to run our practice, including for quality review, staff training and evaluation, licensing and accreditation, care coordination, and general business management.

D. Business Associates

We use vendors to perform functions on our behalf, such as our electronic health record, our patient-communication platform, and our payment processor. Each is bound by a written Business Associate Agreement requiring it to safeguard your information and to use it only for the purposes we permit.

E. Appointment Reminders and Care Communications

We may contact you by telephone, text message, email, or mail to remind you of an appointment, to provide intake instructions, or to tell you about treatment alternatives and health-related benefits and services that may interest you. Tell us if you prefer that we not use a particular method and we will accommodate a reasonable request.

F. Individuals Involved in Your Care

Unless you object, we may share information with a family member, relative, close friend, or any other person you identify, to the extent it is relevant to that person's involvement in your care or in payment for your care.

G. As Required or Permitted by Law

We may use or disclose your PHI without your authorization where the law requires or permits it, including:

• To public health authorities for disease prevention or control, or to report births, deaths, or reactions to medications and products;
• To report suspected abuse, neglect, or domestic violence;
• For health oversight activities such as audits, investigations, and licensure;
• In response to a court or administrative order, subpoena, warrant, or other lawful process;
• To law enforcement, in the limited circumstances the law allows;
• To coroners, medical examiners, and funeral directors;
• For organ, eye, or tissue donation purposes;
• To avert a serious and imminent threat to the health or safety of you or another person;
• For workers' compensation, military and veterans' activities, national security, and correctional institutions, as applicable; and
• For research, where an institutional review board has approved a waiver of authorization or the information has been de-identified.

3. Uses and Disclosures That Require Your Written Authorization

Other than the situations described above, we will not use or disclose your PHI unless you give us written authorization. In particular, your written authorization is required for:

• Psychotherapy notes, except in the narrow circumstances the law permits;
• Marketing communications, other than a face-to-face communication with you or a promotional gift of nominal value;
• Any sale of your PHI; and
• Most uses and disclosures of information about substance use disorder treatment, where more protective law applies.

You may revoke an authorization in writing at any time. Revocation stops any future use or disclosure, but does not undo anything we already did in reliance on it.

We do not sell your Protected Health Information.

4. Your Rights

A. Get an Electronic or Paper Copy of Your Record

You may inspect and request a copy of the PHI we hold about you. We will provide it in the form and format you request if we can readily produce it that way, including electronically. We may charge a reasonable, cost-based fee for copies. We will respond within 30 days, and will tell you in writing if we need one 30-day extension.

B. Ask Us to Correct Your Record

If you believe information in your record is incorrect or incomplete, you may ask us in writing to amend it. We may deny the request, for example if the record was not created by us, or is accurate and complete. If we deny it, we will explain why in writing and tell you how to submit a statement of disagreement.

C. Request Confidential Communications

You may ask us to contact you at a specific address or telephone number, or by a specific method. We will accommodate reasonable requests and will not ask you why.

D. Ask Us to Limit What We Use or Share

You may ask us to restrict a use or disclosure for treatment, payment, or healthcare operations. We are not required to agree, except in one case: if you pay for a service in full out of pocket and ask us not to disclose that information to your health plan, we are required to honor that request.

E. Get a List of Those With Whom We Have Shared Your Information

You may request an accounting of disclosures of your PHI for the six years before the date of your request, excluding disclosures for treatment, payment, and healthcare operations and certain others the law exempts. One accounting in any 12-month period is free; we may charge a reasonable, cost-based fee for additional requests.

F. Get a Paper Copy of This Notice

You may ask for a paper copy of this notice at any time, even if you agreed to receive it electronically. We will provide one promptly.

G. Be Notified if Your Information Is Breached

You have the right to be notified if we discover a breach of your unsecured PHI.

H. Choose Someone to Act for You

If you have given someone medical power of attorney, or if someone is your legal guardian, that person can exercise your rights and make choices about your PHI. We will verify the person's authority before acting.

I. File a Complaint

You may complain to us, or directly to the federal government, if you believe your privacy rights have been violated. We will not retaliate against you for filing a complaint, and filing one will not affect your care.

5. How to Exercise a Right or File a Complaint

Requests to access, amend, restrict, or account for your PHI should be made in writing to our Privacy Officer:

Privacy Officer
Institute for Human Optimization
7030 Hi Tech Drive, Suite 101
Hanover, MD 21076
Phone: 410-858-4086
Email: [email protected]

You may also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at 200 Independence Avenue SW, Washington, D.C. 20201, by telephone at 1-877-696-6775, or online at hhs.gov/hipaa/filing-a-complaint.

6. Our Duties

We are required by law to maintain the privacy and security of your PHI, to notify you if a breach of your unsecured PHI occurs, to follow the terms of the notice currently in effect, and to provide you with a copy of this notice.

We will not use or disclose your PHI other than as described here unless you authorize it in writing.

7. Changes to This Notice

We reserve the right to change this notice, and to make the revised notice effective for PHI we already hold as well as PHI we receive in the future. The current notice is always posted at ifho.org/notice-of-privacy-practices with its effective date, is available at our office, and a copy will be provided on request.

8. Website Privacy

This notice covers Protected Health Information. Information collected through our website that is not PHI is described in our Privacy Policy, which also covers cookies, SMS/text messaging consent, and website analytics.

This notice is effective 09-08-2026 and supersedes all prior versions.