HIPAA Notice of Privacy Practices

Effective Date: October 23, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN ACCESS THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice of Privacy Practices (“Notice”) applies to telehealth and healthcare services provided by the applicable treating clinical practice and its licensed healthcare providers, with administrative support from Veloryn Health, LLC.

Veloryn Health, LLC may provide administrative, technology, scheduling, payment, vendor-management, customer support, and care-coordination services for the treating clinical practice. Veloryn Health, LLC does not practice medicine unless it is separately identified as the licensed healthcare provider or covered entity under applicable law.

Where the treating clinical practice is a covered entity under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), Veloryn Health, LLC may handle protected health information as a business associate under a written business associate agreement.

1. Who Must Follow This Notice

This Notice applies to the treating clinical practice, its licensed healthcare providers, employees, workforce members, contractors, and business associates when they perform services on behalf of the practice.

It may apply to information created or received in connection with:

  • Telehealth appointments and consultations
  • Patient intake and eligibility forms
  • Medical histories and treatment plans
  • Patient messages and communications
  • Laboratory coordination and results
  • Prescription and pharmacy coordination
  • Billing, payments, refunds, and account administration
  • Medical-record management
  • Other services related to patient care

Separate healthcare providers, pharmacies, laboratories, hospitals, and other healthcare organizations may maintain their own privacy notices and privacy practices.

2. Our Privacy Responsibilities

We are required by law to:

  • Maintain the privacy and security of protected health information
  • Provide patients with this Notice describing our legal duties and privacy practices
  • Follow the terms of the Notice currently in effect
  • Notify affected patients following a breach of unsecured protected health information when notification is required by law
  • Respect patient privacy rights under applicable federal and state laws

We use reasonable administrative, technical, and physical safeguards designed to protect patient information. However, no electronic system, website, email service, or communication platform can be guaranteed to be completely secure.

3. Information Covered by This Notice

This Notice applies to information that identifies you and relates to your health, healthcare, treatment, or payment for healthcare.

Protected health information may include:

  • Patient intake forms
  • Medical history and symptoms
  • Diagnoses and treatment information
  • Prescriptions and medication information
  • Laboratory orders and results
  • Pharmacy communications
  • Telehealth notes and appointment records
  • Patient messages and support communications
  • Identity and contact information
  • Billing, payment, and refund records
  • Shipping and fulfillment information
  • Other records created or received for healthcare purposes

Certain categories of information may receive additional protection under federal or state law. These may include mental health records, substance use disorder records, HIV/AIDS information, genetic information, reproductive health information, information involving minors, and other sensitive health records.

When another law provides greater privacy protection than HIPAA, we will follow the more protective law.

4. Uses and Disclosures for Treatment

We may use and share your protected health information to provide, coordinate, or manage your healthcare.

This may include sharing information with:

  • Treating healthcare providers
  • Covering or consulting providers
  • Nurses and authorized clinical staff
  • Pharmacists and compounding pharmacies
  • Laboratories and diagnostic providers
  • Telehealth platforms
  • Patient support and care-coordination staff
  • Other healthcare professionals involved in your care

For example, a healthcare provider may send a prescription and relevant clinical information to a pharmacy so the pharmacy can evaluate, prepare, dispense, and ship medication when clinically appropriate and legally permitted.

5. Uses and Disclosures for Payment

We may use and share protected health information to obtain or process payment for healthcare and related services.

This may include using or disclosing information to:

  • Process service payments
  • Collect outstanding balances
  • Process refunds
  • Handle failed payments or chargebacks
  • Verify payment and transaction information
  • Respond to billing questions
  • Administer patient accounts
  • Document services that were provided

Payment and service information may be shared with payment processors, billing support providers, or other vendors involved in processing a transaction or refund.

6. Uses and Disclosures for Healthcare Operations

We may use and disclose protected health information for healthcare operations necessary to operate and improve the treating clinical practice and its services.

Healthcare operations may include:

  • Quality assessment and improvement
  • Compliance and legal review
  • Provider licensing and credentialing
  • Staff and provider training
  • Customer and patient support
  • Medical-record management
  • Security and fraud prevention
  • Internal and external audits
  • Vendor management
  • Claims and dispute handling
  • Business planning and administration

For example, patient records may be reviewed to confirm that consent forms were completed, prescriptions were properly handled, and follow-up instructions were provided.

7. Appointment Reminders and Service Communications

We may use your contact information to communicate with you regarding:

  • Appointment reminders
  • Intake and consent requests
  • Laboratory instructions and updates
  • Pharmacy and prescription updates
  • Billing and payment notices
  • Shipping or fulfillment updates
  • Follow-up care
  • Patient support matters
  • Other healthcare-related services

Communications may be sent by telephone, email, text message, patient portal, mail, or another contact method you provide or authorize.

Email and text messages may not always be fully secure. You may request that we use a different contact method or avoid certain communication methods. Some communication restrictions may affect our ability to provide services efficiently.

8. Health-Related Services and Benefits

We may contact you about healthcare services, refill reminders, treatment alternatives, care options, program updates, or benefits that may be relevant to your treatment.

We will obtain written authorization before using protected health information for marketing when authorization is required by HIPAA or applicable state law.

We do not sell protected health information.

We do not use protected health information for paid third-party marketing without written authorization when authorization is legally required.

9. Family Members, Caregivers, and Personal Representatives

We may share limited information with a family member, caregiver, personal representative, or another person involved in your care or payment for your care when:

  • You agree to the disclosure
  • You have an opportunity to object and do not object
  • Professional judgment indicates that the disclosure is in your best interest
  • The disclosure is otherwise permitted or required by law

A legally authorized personal representative may exercise your privacy rights on your behalf. We may require documentation confirming the representative’s legal authority before providing records or account access.

10. Emergencies and Safety

We may use or disclose protected health information when necessary to provide emergency care, prevent or lessen a serious and imminent threat to health or safety, or comply with applicable law.

The website, email, contact forms, patient portal, and routine telehealth support channels are not emergency services.

If you are experiencing a medical emergency, call 911 or go to the nearest emergency department.

11. Uses and Disclosures Required or Permitted by Law

We may use or disclose protected health information when required or permitted by law, including for:

  • Public health reporting
  • Adverse-event reporting
  • Communicable disease reporting
  • Reporting suspected abuse, neglect, or domestic violence
  • Healthcare oversight activities
  • Licensing and regulatory investigations
  • Audits and compliance reviews
  • Court orders, subpoenas, and legal proceedings
  • Law enforcement requests that meet applicable legal requirements
  • Coroners and medical examiners
  • Workers’ compensation matters
  • Organ and tissue donation
  • Prevention of serious threats to health or safety
  • Other purposes required or permitted by law

We will review legal requests for patient information and will disclose only the information required or permitted for the request, subject to applicable law.

12. Reproductive Health and Other Sensitive Information

Requests involving reproductive healthcare information or other sensitive health information will be handled under applicable federal and state laws.

When the law requires an attestation, authorization, court order, or additional review before disclosure, we will follow the required process.

Additional legal protections may apply to:

  • Reproductive healthcare information
  • Mental health records
  • Psychotherapy notes
  • Substance use disorder records
  • HIV/AIDS information
  • Genetic information
  • Minor-consent services
  • Other sensitive medical information

Veloryn Health, LLC and the treating clinical practice are not intended to operate as a federally assisted substance use disorder treatment program subject to 42 CFR Part 2 unless that status is separately stated in writing.

13. Business Associates and Service Providers

We may share protected health information with vendors that perform services for the treating clinical practice.

These vendors may include:

  • Telehealth technology providers
  • Electronic signature services
  • Scheduling and appointment systems
  • Electronic medical-record systems
  • Secure communication platforms
  • Pharmacy and laboratory coordination providers
  • Payment and billing support providers
  • Cloud hosting and data-storage providers
  • Cybersecurity providers
  • Customer support platforms
  • Legal, accounting, and compliance advisors

When required by HIPAA, a vendor handling protected health information must enter into a written business associate agreement and agree to protect the information and use it only as legally permitted.

14. Your Health Information Rights

You have the following rights regarding your protected health information, subject to identity verification and applicable legal limitations.

Right to Access Your Records

You may request to inspect or receive a copy of your medical and billing records.

If records are maintained electronically, you may request an electronic copy in a form and format that is readily producible. Fees may be charged only as permitted by law.

In limited circumstances, access may be denied or restricted when permitted or required by law.

Right to Request an Amendment

You may ask us to correct or add information to a medical or billing record that you believe is inaccurate or incomplete.

Your request should explain why you believe the record should be amended. A request may be denied in writing if:

  • The record is accurate and complete
  • The record was not created by the treating practice
  • The information is not part of the designated record set
  • The information cannot legally be amended

Right to an Accounting of Disclosures

You may request a list of certain disclosures of your protected health information made during the period permitted by law.

The accounting may not include every disclosure. For example, it generally does not include disclosures made for treatment, payment, healthcare operations, disclosures authorized by you, or other disclosures excluded by law.

Right to Request Restrictions

You may ask us to restrict certain uses or disclosures of your protected health information.

We are not required to agree to every requested restriction. However, if you pay for a healthcare service completely out of pocket and ask us not to disclose information about that service to a health plan for payment or healthcare operations, we will honor the request unless disclosure is required by law.

Right to Request Confidential Communications

You may ask us to contact you in a particular way or at a particular address.

We will accommodate reasonable requests when possible.

Right to Receive a Paper Copy

You may request a paper copy of this Notice at any time, even if you previously received it electronically.

Right to File a Complaint

You may file a privacy complaint with the treating clinical practice or its designated privacy contact.

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights.

You will not be retaliated against for filing a complaint or exercising your privacy rights.

Right to Authorize or Revoke a Disclosure

You may sign a written authorization allowing a use or disclosure that is not otherwise permitted by this Notice or applicable law.

You may revoke an authorization in writing at any time, except to the extent that action has already been taken in reliance on the authorization.

15. Uses That Generally Require Written Authorization

We will obtain your written authorization when required for:

  • Most uses and disclosures of psychotherapy notes
  • Uses or disclosures of protected health information for marketing
  • The sale of protected health information
  • Other uses or disclosures not otherwise permitted by HIPAA or applicable state law

If written authorization is required and you do not provide it, we will not make the proposed use or disclosure.

16. Patient Responsibilities

You are responsible for:

  • Providing accurate and complete information
  • Updating your contact information
  • Protecting your account credentials
  • Using secure communication methods when available
  • Informing us if a particular communication method should not be used
  • Notifying us promptly if you believe your account or information has been accessed without authorization

17. Telehealth Privacy

During telehealth services, you may be asked to confirm your identity, current physical location, emergency contact information, and consent to receive care remotely.

Providers and support staff may document this information in your health record.

You should participate in telehealth appointments from a private and reasonably secure location when possible.

You should not record a telehealth appointment unless the provider agrees and recording is permitted by applicable law.

Telehealth services may involve third-party technology platforms. Reasonable efforts are made to select platforms that support privacy and security, but technical interruptions or connection failures may occur.

If a telehealth connection fails, the provider or support team may use another reasonable communication method or reschedule the appointment.

18. State Privacy Rights

California

California medical privacy laws, including the Confidentiality of Medical Information Act, may provide additional protection for medical information.

California consumer privacy laws may also apply to certain personal information that is not governed by HIPAA.

Protected health information governed by HIPAA will generally be handled through this Notice and the treating clinical practice’s HIPAA privacy process.

Texas

Texas medical privacy laws may apply to healthcare providers, business associates, and other persons who handle medical information.

Texas law may require additional safeguards, training, authorization, and notice procedures. We will follow applicable Texas requirements when they apply to a Texas patient or service.

Florida

Florida law may establish requirements concerning medical-record access, retention, copying, professional obligations, telehealth services, and patient complaints.

We will follow applicable Florida requirements when they apply to a Florida patient or service.

If applicable state law provides greater privacy protection than this Notice, the more protective law will control.

19. Copies and Acknowledgment of This Notice

This Notice may be provided electronically, through a patient portal, by email, by download, by mail, or in paper form.

You may request a paper copy at any time.

For direct treatment relationships, the treating practice may make a good-faith effort to obtain written or electronic acknowledgment that you received or were offered this Notice.

Signing an acknowledgment does not mean that you agree with every use or disclosure described in this Notice. It confirms only that you received or had access to the Notice.

20. Changes to This Notice

We may revise this Notice when privacy practices, services, or legal requirements change.

A revised Notice may apply to protected health information already maintained and to information received in the future.

The current version of this Notice will be available upon request and may be posted on the website or patient portal.

21. Questions, Requests, and Complaints

To ask a question, request access to records, request an amendment, request a restriction, change your communication preferences, or submit a privacy complaint, contact:

Veloryn Health, LLC
2108 N St, Ste N
Sacramento, CA 95816
United States

Email: support@velorynhealth.com
Phone: 949 228 9805
Website: velorynhealth.com

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights.

We will not retaliate against you for filing a complaint or exercising your privacy rights.