Effective Date: July 2026

OUR COMMITMENT TO YOUR PRIVACY

ONE HOUSE OF DERM, LLC (“we,” “us,” “our,” or the “Practice”) is dedicated to protecting the privacy of your health information. We are required by law to maintain the privacy of your protected health information (“PHI”), to provide you with this Notice of our legal duties and privacy practices, and to abide by the terms of this Notice while it is in effect. This Notice applies to all records containing your health information that are created or maintained by our Practice, regardless of the provider or staff member who created the record.

HOW WE MAY USE AND DISCLOSE YOUR HEALTH INFORMATION

For Treatment

We may use and disclose your PHI to provide, coordinate, or manage your care and related services, including sharing information among our providers and staff, and with other physicians, pharmacies, laboratories, or facilities involved in your care.

For Payment

Although ONE HOUSE OF DERM, LLC is a self-pay practice and does not bill insurance directly, we may use or disclose your PHI as necessary to process payments (including credit card and financing transactions), provide you with an itemized receipt for potential insurance reimbursement, or communicate with other healthcare providers involved in your care.

For Health Care Operations

We may use and disclose your PHI to support our business operations, including quality assessment and improvement, staff training, licensing, and general practice management and administrative activities.

Appointment Reminders & Practice Communications

We may use and disclose your PHI to contact you with appointment reminders, information about treatments or services, or other practice communications, by phone, text, email, or mail. Because our Practice uses electronic communications, including text messages and email, these communications may not always be encrypted. By providing your contact information, you acknowledge that these communications may be used for appointment reminders and other permitted healthcare communications.

OTHER PERMITTED OR REQUIRED USES AND DISCLOSURES

We may use or disclose your PHI without your written authorization in the following circumstances, as permitted or required by law:

• As Required by Law — when required by federal, state, or local law.

• Public Health Activities — to public health authorities for purposes such as disease prevention or control.

• Health Oversight Activities — to agencies conducting audits, investigations, or inspections.

• Judicial and Administrative Proceedings — in response to a court order, subpoena, or other lawful process.

• Law Enforcement — for limited law enforcement purposes, as required or permitted by law.

• Decedents — to coroners, medical examiners, or funeral directors as necessary.

• Organ and Tissue Donation — to organizations that facilitate donation and transplantation.

• Research — for research studies that have been approved through an established privacy review process.

• To Avert a Serious Threat to Health or Safety — to prevent or lessen a serious and imminent threat to a person or the public.

• Military, Veterans, and National Security — as required by applicable law.

• Workers’ Compensation — as authorized by workers’ compensation law.

• Inmates — to a correctional institution or law enforcement official having custody of an inmate, as required by law.

PHOTOGRAPHS AND CLINICAL IMAGES

We may take clinical photographs before, during, and after certain treatments for your medical record and to help plan and evaluate your care. We will not use your photographs for marketing, advertising, social media, or other promotional purposes without your separate, specific written authorization, which you may revoke at any time.

SUBSTANCE USE DISORDER PATIENT RECORDS

If our records include information about substance use disorder treatment received from another provider, that information is subject to additional confidentiality protections under federal law (42 C.F.R. Part 2), in addition to HIPAA. We will handle any such records consistent with applicable federal requirements.

USES AND DISCLOSURES REQUIRING YOUR WRITTEN AUTHORIZATION

Other than as described in this Notice, we will not use or disclose your PHI without your written authorization, including for purposes of marketing communications or the sale of your PHI. You may revoke a written authorization at any time by notifying us in writing, except to the extent we have already acted in reliance on it.

YOUR RIGHTS REGARDING YOUR HEALTH INFORMATION

• Right to Inspect and Copy — You may request to inspect and obtain a copy of your PHI, with limited exceptions.

• Right to Request Amendment — You may request that we amend your PHI if you believe it is incorrect or incomplete.

• Right to an Accounting of Disclosures — You may request a list of certain disclosures we have made of your PHI.

• Right to Request Restrictions — You may request that we restrict certain uses or disclosures of your PHI for treatment, payment, or operations. If you pay in full, out of pocket, for an item or service, you have the right to require us not to disclose information about that item or service to a health plan for purposes of payment or operations, and we must honor that request.

• Right to Request Confidential Communications — You may request that we communicate with you in a specific way or at a specific location.

• Right to a Paper Copy of This Notice — You may request a paper copy of this Notice at any time, even if you agreed to receive it electronically.

• Right to Choose Someone to Act on Your Behalf — A personal representative may exercise your rights on your behalf, subject to applicable law.

• Right to Be Notified of a Breach — We will notify you of a breach of your unsecured PHI as required by HIPAA, and, for Alabama residents, as expeditiously as possible and without unreasonable delay, and in no event later than 45 days after we determine a breach has occurred, consistent with the Alabama Data Breach Notification Act (Ala. Code § 8-38-5).

To exercise any of these rights, please contact our Privacy Officer using the information below.

ALABAMA STATE LAW PROVISIONS

In addition to federal HIPAA protections, the following Alabama-specific provisions may apply to your care and records:

• Minor Patients — As of October 1, 2025, Alabama law generally requires patients to be 16 years of age or older to consent to their own medical care, with limited statutory exceptions (for example, treatment related to pregnancy, sexually transmitted infections, or drug/alcohol dependency). Parents or legal guardians generally retain the right to access a minor patient’s medical records until the minor turns 19, even in cases where the minor consented to their own care under an exception. Please speak with our staff if you have questions about how this applies to your care.

• Medical Record Retention — In accordance with Alabama Board of Medical Examiners Rule 540-X-9-.10, we retain medical records for a minimum of seven (7) years from the date of your last visit. For minor patients, records are retained for the longer of seven (7) years from the last visit or two (2) years after the minor reaches the age of majority (19).

• Office-Based Procedures — Certain in-office procedures performed at our practice are subject to Alabama Board of Medical Examiners safety and accreditation standards for office-based procedures. You are welcome to ask your provider about facility accreditation and safety protocols for any procedure recommended to you.

• Where Alabama law provides greater privacy protection to your health information than federal law, we will follow the more protective standard.

COMPLAINTS

If you believe your privacy rights have been violated, you may file a complaint with our Privacy Officer at the contact information below, or with the U.S. Department of Health and Human Services, Office for Civil Rights. You will not be retaliated against for filing a complaint.

CHANGES TO THIS NOTICE

We reserve the right to change this Notice at any time. Any revised Notice will apply to all PHI we maintain, including PHI created or received before the revision. A copy of our current Notice will always be available at our office, on our website, and upon request.

CONTACT INFORMATION

ONE HOUSE OF DERM, LLC — Privacy Officer

Address: 790 Montgomery Hwy, Ste 108, Studio 125, Vestavia Hills, AL 35216

Phone: (205) 882-3348     Email: contact@onehouseofderm.com