HIPAA Notice of
Privacy Practices

June 17, 2026

THIS NOTICE DESCRIBES HOW HEALTH INFORMATION ABOUT YOU (AS APATIENT OF THE PRACTICE) MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESSTO YOUR HEALTH INFORMATION.

 PLEASE REVIEW THIS NOTICE CAREFULLY.

 A. Commitment to your privacy:

 The terms of this Notice apply to HLCA, Inc. and each of the members of its Affiliated Covered Entity (collectively “Practice”). The Notice further applies to all records containing your PHI that are created or retained by Practice. An Affiliated Covered Entity is a group of health care providers undercommon ownership or control that designates itself as a single entity for purposes of compliance with the Health Insurance Portability and AccountabilityAct (“HIPAA”).  The members of the Affiliated Covered Entity will share protected health information (“PHI”) with each other for treatment, payment, or health care operations related to the Affiliated Covered Entity and aspermitted by HIPAA and this Notice of Privacy Practices.  For a complete list of the members of the Affiliated Covered Entity, please contact the Privacy Officer using the contact information provided below.

Practice reserves the right to revise or amend this Notice. Anyrevision or amendment to this Notice will be effective for all of your recordsthat Practice has created or maintained in the past, and for any of yourrecords that Practice may create or maintain in the future.

Practice is dedicated to maintaining the privacy of your healthinformation. In conducting Practice’s business, Practice will create records regarding you and the treatment and services Practice provides to you. Practice is required by law, including but not limited to HIPAA, to maintain the confidentiality of PHI that identifies you. Practice is also required by law toprovide you with this Notice of Practice’s legal duties and the privacy practices that Practice maintains concerning your PHI.

 Practice realizes that these laws are complicated, but Practice must provide you with the following important information:

• How Practice may use and disclose your PHI,
• Your privacy rights in your PHI,
• Practice’s obligations concerning the use and disclosure of your PHI.

B. If you have questions about this Notice, or would like tocontact Practice’s Privacy Officer, please use the following contact information:

Privacy Officer

HardLoop

29160 Heathercliff Road

PO BOX #4380

Malibu, CA 90264

privacyofficer@hardloop.biz

C. Practice may use and disclose your PHI in the following ways:

1. Treatment. Practice may use your PHI to treat you. For example, Practice may ask you to have     laboratory tests (such as blood or urine tests), and Practice may use the results to help Practice reach a diagnosis. Practice might use your PHI in order to write a prescription for you, or Practice might disclose your PHI to a pharmacy when Practice orders a prescription for you. Many of the people who work for Practice – including, but not limited to, Practice’s doctors and nurses – may use or disclose your PHI in order to treat you or to assist others in your treatment.

2. Payment. Practice may use and disclose your PHI in order to bill and collect payment for the services and items you may receive from Practice. For example, Practice may contact your health insurer to certify that you are eligible for benefits (and for what range of benefits), and Practice may provide your insurer with details regarding your treatment to determine if your insurer will cover, or pay for, your treatment.

3. Health  care operations. Practice may use and disclose your PHI to operate its business. As examples of the ways in which Practice may use and disclose your information for its operations, Practice may use your PHI to evaluate the quality of care you received from Practice, or to conduct cost-management and business planning activities for Practice. Practice may disclose your PHI to other health care providers and entities to assist in their health care operations.

4. Appointment reminders. Practice may use and disclose your PHI to contact you and remind you of an appointment.

5. Treatment options and Health-related benefits and services. Practice may use and disclose your PHI to inform you of potential treatment options or alternatives. Practice may use and disclose your PHI to inform you of health-related benefits or services that may be of interest to you.

6. Individuals involved in your care or payment for your care. When appropriate, Practice may share your PHI with a person who is involved in your medical care or payment for your care, such as your family or a close friend. Practice may also notify your family about your location or general condition or disclose such information to an entity assisting in a disaster relief effort.

7. Disclosures required by law. Practice will use and disclose your PHI when Practice is required to do so by federal, state or local law.

8. Psychotherapy  Notes. Psychotherapy notes have additional protections and, in certain cases, are     subject to additional requirements and restrictions related to disclosures to you and third parties.

 D. Use and disclosure of your PHI in certain special circumstances: The following categories describe unique scenarios in which Practice may use or disclose your PHI:

1. Public health risks. Practice may disclose your PHI to public health authorities that are authorized by law to collect information for the purpose of
   
   1. Maintaining vital records, such as births and deaths,
   2. Reporting child abuse or neglect,
   3. Preventing or controlling disease, injury or disability,
   4. Notifying a person regarding potential exposure to a communicable disease,
   5. Notifying a person regarding a potential risk for spreading or contracting a disease or condition,
   6. Reporting reactions to drugs or problems with products or devices,
   7. Notifying individuals if a product or device they may be using has been recalled,
   8. Notifying appropriate government agency(ies) and authority(ies) regarding the potential abuse or neglect of an adult patient (including domestic violence); however, Practice will only disclose this information if the patient agrees or Practice is required or authorized by law to disclose this information
   9. Notifying your employer under limited circumstances related primarily to workplace injury or illness or medical surveillance.

2. Health oversight activities. Practice may disclose your PHI to a health oversight agency for activities authorized by law. Oversight activities can include, for example, investigations, inspections, audits, surveys, licensure and disciplinary actions; civil, administrative and criminal procedures or actions; or other activities necessary for the government to monitor government programs, compliance with civil rights laws and the health care system in general.

3. Lawsuits and similar proceedings. Practice may use and disclose your PHI in response to a court or administrative order, if you are involved in a lawsuit or similar proceeding. Practice also may disclose your PHI in response to a discovery request, subpoena or other lawful process by another party     involved in the dispute, but only if Practice has made an effort to inform you of the request or to obtain an order protecting the information the party has requested.

4. Law  enforcement. Practice may release PHI if asked to do so by a law enforcement official:
   
   1. Regarding a crime victim in certain situations, if Practice is unable to obtain the person’s agreement,
   2. Concerning a death Practice believes has resulted from criminal conduct,
   3. Regarding criminal conduct at Practice’s offices,
   4. In response to a warrant, summons, court order, subpoena or similar legal process,
   5. To identify/locate a suspect, material witness, fugitive or missing person,
   6. In an emergency, to report a crime (including the location or victim(s) of the crime, or the description, identity or location of the perpetrator).

5. Coroners, Medical Examiners and Funeral Directors. Practice may release PHI to a coroner or medical examiner. Practice may also release PHI to funeral directors as necessary for their duties.

6. Research. Under certain circumstances, Practice may use and disclose PHI for research. Before Practice uses or discloses PHI for research, the project will go through a special approval process. Even without special approval, Practice may permit researchers to look at records to help them identify patients who may be included in their research project or for other similar purposes, as long as they do not remove or take a copy of the PHI.

7. Serious threats to health or safety. Practice may use and disclose your PHI when necessary to reduce or prevent a serious threat to your health and safety or the health and safety of another individual or the     public. Under these circumstances, Practice will only make disclosures to a person or organization able to help prevent the threat.

8. Military. Practice may disclose your PHI if you are a member of U.S. or foreign military forces (including veterans) and if required by the appropriate authorities.

9. National security. Practice may disclose your PHI to federal officials for intelligence and national security activities authorized by law. Practice also may disclose your PHI to federal and national security activities     authorized by law. Practice may also disclose your PHI to federal officials in order to protect the president, other officials or foreign heads of state, or to conduct investigations.

10. Inmates. Practice may disclose your PHI to correctional institutions or law enforcement officials if you are an inmate or under the custody of a law enforcement official. Disclosure for these purposes would be necessary: (a) for the institution to provide health care services to you, (b) for the safety and security of the institution, and/or (c) to protect your health and safety or the health and safety of other individuals.

11. Workers’ compensation. Practice may release your PHI for workers’ compensation and similar programs.

12. Marketing and sale of PHI. Practice may use or disclose your PHI for marketing purposes, such as for communications that encourage the purchase or use of a product or service, and may receive remuneration for engaging in such marketing activities, with your written authorization. In addition, Practice may sell your PHI and receive remuneration in exchange for your PHI, with your written authorization.

E. Your rights regarding your PHI:

You have the following rights regarding the PHI that Practice maintains about you:

1. Confidential  communications. You have the right to request that Practice communicate with you about your health and related issues in a particular manner or at a certain location. For instance, you may ask that Practice contacts you at home, rather than work. In order to request a type of confidential communication, you must make a written request specifying the requested method of contact, or the location where you wish to be contacted. Practice will accommodate reasonable requests. You do not need to give a reason for your request.

2. Requesting  restrictions. You have the right to request a restriction or limitation on the PHI Practice uses or discloses for treatment, payment, or health care operations. You also have the right to request a limit on     the PHI Practice discloses to someone involved in your care or the payment for your care, like a family member or friend. To request a restriction, you must make your request, in writing, to Practice. Practice is not required to agree to your request unless you are asking Practice to restrict the use and disclosure of your PHI to a health plan for payment or health care operation purposes and such information you wish to restrict pertains solely to a health care item or service for which you have paid Practice “out-of-pocket” in full. If Practice agrees, Practice will comply with your request unless the information is needed to provide you with emergency treatment.
   
   1. Out-of-Pocket-Payments. If you paid out-of-pocket (or in other words, you have requested that Practice not bill your health plan) in full for a specific item or service, you have the right to ask that your PHI with respect to that item or service not be disclosed to a health plan for purposes of payment or health care  operations, and Practice will honor that request.

3. Inspection and copies. You have the right to inspect and obtain a copy of the PHI that may be used to make decisions about you, including patient medical records and billing records, with limited exceptions. You must submit your request in writing to the Privacy Officer using the contact information above in order to inspect and/or obtain a copy of your PHI. Practice may charge a fee for the costs of copying, mailing, labor and supplies associated with your request. Practice may deny your request to inspect     and/or copy in certain limited circumstances; however, you may request a review of Practice’s denial.
   
   1. Right to an electronic copy. If your PHI is maintained in an electronic format (known as an electronic medical record or an electronic health record), you have the right to request that an electronic copy of your record be given to you or transmitted to another individual or entity. Practice may charge you a reasonable, cost-based fee for the labor associated with transmitting the electronic medical record.

4. Amendment. If you feel that PHI Practice has is incorrect or incomplete, you may ask Practice to amend the information. You have the right to request an amendment for as long as the information is kept by or for Practice’s office. To request an amendment, you must make your request, in writing, to the Privacy     Officer using the contact information above.
   
   1. Addendum. All of Practice’s patients have the right to provide Practice with a written addendum with respect to any item or statement in his or her records that  the patient believes to be incomplete or incorrect. Practice is obligated  to attach the addendum to the patient’s records and will include the  addendum if Practice makes a disclosure of the allegedly incomplete or incorrect portion of the patient’s records to any third party.

5. Accounting of disclosures. You have the right to request a list of certain disclosures Practice made of your PHI for six years prior to the date of your request. To request an accounting of disclosures, you must     make your request, in writing, to the Privacy Officer using the contact information above.

6. Right to get notice of a Breach. You have the right to be notified upon a Breach of any of your unsecured PHI.

7. Right to a paper copy of this notice. You are entitled to receive a paper copy of this Notice. You may ask Practice to give you a copy of this Notice at any time. To obtain a paper copy of this Notice, contact the     Privacy Officer using the contact information above.

8. Right to file a complaint. If you believe your privacy rights have been violated, you may file a complaint with Practice or with the Secretary of the Department of Health and Human Services. To file a     complaint with Practice, contact the Privacy Officer using the information above. All complaints must be submitted in writing. You will not be penalized for filing a complaint.

9. Right to provide an authorization for other uses and disclosures. Practice may obtain your written authorization for uses and disclosures that are not identified by this Notice or otherwise permitted by applicable law.  Any authorization you provide to Practice regarding the use and disclosure of your PHI may be revoked at any time in writing. After you revoke your authorization, Practice will no longer use or disclose your PHI for the reasons described in the authorization.

10. Potential for redisclosure.  There is the potential for PHI disclosed pursuant to HIPAA to be subject to redisclosure and no longer protected by HIPAA.

11. Electronic communications not secure. Using any unsecure electronic communication (such as regular email or text messaging) to communicate with Practice can present risks to the security of information. These risks include possible interception of the information by unauthorized parties, misdirected emails, shared accounts, message forwarding, or storage of the information on unsecured platforms and/or devices. By choosing to correspond with us via unsecure electronic communication     platforms, you are acknowledging and accepting these risks.

Again, if you have anyquestions regarding this Notice, please contact the Privacy Officer using the contact information above.

‍