Notice of Privacy Practices — Opulence Chicago

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices applies to Opulence Chicago and all of its providers, staff, and patient care coordinators. It covers the protected health information (PHI) we create or receive about you: information that identifies you and relates to your health, the care you receive, or payment for that care. At Opulence, PHI includes your medical history, consultation and treatment notes, lab results, prescriptions, clinical before-and-after photographs, and billing records.

Our Legal Duties

We are required by law to protect the privacy of your PHI. Under the Health Insurance Portability and Accountability Act (HIPAA) and applicable Illinois law, we must:

• Maintain the privacy and security of your PHI.
• Give you this Notice of our legal duties and privacy practices with respect to your PHI.
• Follow the terms of the Notice currently in effect.
• Notify you promptly if a breach occurs that may have compromised the privacy or security of your unsecured PHI.
• Not use or share your information other than as described in this Notice unless you authorize us in writing. You may revoke an authorization at any time, in writing, except to the extent we have already acted on it.

How We May Use and Disclose Your PHI

We may use and share your PHI without your written authorization for the following purposes.

Treatment. We use your PHI to provide and coordinate your care. For example, your injector may review your medical history before a treatment, or we may share information with a lab processing your hormone panel or a pharmacy filling your prescription.

Payment. We use your PHI to bill and collect for services. For example, we may process payment for a treatment package, or provide information to a financing company or insurer if you ask us to.

Health care operations. We use your PHI to run our practice and improve care. For example, we may review records for quality assurance, train staff, or conduct audits.

Appointment reminders and service information. We may contact you by phone, text, or email to remind you of appointments, follow up on treatment, or tell you about treatment alternatives or health-related services that may interest you.

Business associates. We share PHI with vendors who perform services for us, such as our scheduling and records software provider. Each signs a written agreement requiring them to protect your information.

Individuals involved in your care. We may share relevant information with a family member, friend, or other person you identify as involved in your care or payment, unless you object.

Other uses permitted or required by law. We may also use or share your PHI:

• When required by federal, state, or local law.
• For public health activities, such as reporting adverse reactions to medications or products to the FDA.
• To report suspected abuse, neglect, or domestic violence to government authorities.
• For health oversight activities, such as audits, inspections, and licensure.
• In response to a court or administrative order, subpoena, or other lawful process.
• To law enforcement officials for specific purposes permitted by law.
• To avert a serious threat to the health or safety of you or others.
• To coroners, medical examiners, and funeral directors.
• For workers' compensation claims, as authorized by law.
• For specialized government functions, such as military or national security purposes.
• For research, subject to privacy protections required by law.
• To the U.S. Department of Health and Human Services to show our compliance with HIPAA.

Uses That Require Your Written Authorization

We will not use or share your PHI for the following purposes without your signed authorization:

• Photographs for promotion. We will never post or publish your before-and-after photos, videos, or testimonials on our website, social media, or advertising without a separate signed photo release. Clinical photos taken for your chart stay in your medical record.
• Marketing. Most marketing communications, including any we are paid to send by a third party.
• Sale of PHI. We do not sell your health information.
• Psychotherapy notes. Most uses and disclosures of psychotherapy notes, if any exist.

Any other use or disclosure not described in this Notice will be made only with your written authorization, which you may revoke at any time.

Additional Protections Under Illinois Law

Illinois law gives some types of health information extra protection beyond HIPAA. Where Illinois law is stricter, we follow it. This includes information about mental health treatment, HIV/AIDS testing and status, genetic testing, and sexually transmitted infections. In most cases, we will need your specific written consent before disclosing this information, except where the law allows otherwise.

Your Rights Regarding Your Health Information

You have the following rights. To exercise any of them, submit a written request to our Privacy Officer using the contact information at the end of this Notice. Our front desk team can provide request forms.

Right to inspect and get a copy of your records. You may view or get a paper or electronic copy of your medical and billing records, including clinical photographs. We will respond within 30 days. We may charge a reasonable, cost-based fee. In limited cases we may deny your request, and you may ask for that denial to be reviewed.

Right to request an amendment. If you believe information in your record is incorrect or incomplete, you may ask us to correct it. Your request must explain the reason. We will respond within 60 days. If we deny it, we will explain why in writing and you may submit a statement of disagreement to be added to your record.

Right to an accounting of disclosures. You may request a list of the times we shared your PHI in the six years before your request. The list will not include disclosures for treatment, payment, or operations, or those you authorized. The first list in any 12-month period is free; we may charge a reasonable fee for additional requests.

Right to request restrictions. You may ask us to limit how we use or share your PHI for treatment, payment, or operations. We are not required to agree, except in one case: if you pay for a service in full out of pocket, you may ask us not to share information about that service with your health plan, and we will agree unless the law requires us to share it.

Right to request confidential communications. You may ask us to contact you in a specific way or at a specific location, such as only by email or at a different address. We will accommodate reasonable requests and will not ask why.

Right to a paper copy of this Notice. You may ask for a paper copy at any time, even if you agreed to receive it electronically.

Right to choose someone to act for you. If you have given someone medical power of attorney, or if someone is your legal guardian, that person can exercise your rights. We will confirm their authority before acting.

Right to be notified of a breach. You will be notified if a breach compromises the privacy of your unsecured PHI.

How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with us or with the federal government. We will not retaliate against you in any way for filing a complaint.

With Opulence Chicago. Submit your complaint in writing to our Privacy Officer by mail or email (contact information below). Describe what happened and when. We will review it and respond.

With the U.S. Department of Health and Human Services. You may file a complaint with the HHS Office for Civil Rights:

• Online: www.hhs.gov/ocr/complaints
• By mail: U.S. Department of Health and Human Services, 200 Independence Avenue S.W., Washington, D.C. 20201
• By phone: 1-877-696-6775

Changes to This Notice

We may change the terms of this Notice, and the changes will apply to all information we have about you. The current Notice will be posted in our office and on our website, and you may request a copy at any visit.

Contact Us

For questions about this Notice or to exercise your rights, contact our Privacy Officer:

Effective date: October 5, 2026