Notice of Privacy Practices

Evidence MD Medicine & Aesthetics | Portland, Oregon

Effective date: June 30, 2026

Evidence MD Medicine & Aesthetics LLC ("the Practice," "we," "us," or "our") is required by law to maintain the privacy of your Protected Health Information (PHI), to provide you with this Notice of our legal duties and privacy practices regarding PHI, to notify affected individuals following a breach of unsecured PHI, and to follow the terms of the Notice currently in effect. This Notice is provided in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), its implementing regulations, and applicable Oregon law. This Notice applies to all PHI created or received by the Practice.

What Is Protected Health Information?

Protected Health Information is information that identifies you, or could reasonably be used to identify you, and that relates to your past, present, or future physical or mental health condition, the health care provided to you, or payment for that care. It includes details such as your name, address, telephone number, email address, date of birth, and treatment records.

How We May Use and Disclose Your PHI Without Your Authorization

We may use and disclose your PHI without your written authorization for the following purposes.

Treatment

We use and disclose your PHI to provide, coordinate, and manage your care. For example, our providers share information about your condition to plan an evidence-based course of treatment, and we may communicate with other health care providers, laboratories, or pharmacies involved in your care.

Payment

We use and disclose your PHI to obtain payment for services. For example, we may use your information to process a credit-card payment or to work with a third-party payment processor.

Health Care Operations

We use and disclose your PHI for the operation of the Practice. For example, we may use information for quality assessment and improvement, staff training, licensing and accreditation, legal compliance, and general business management.

Appointment Reminders and Treatment Communications

We may contact you by phone, text message, email, or mail to provide appointment reminders, follow-up instructions, and information about treatment alternatives or other health-related benefits and services that may interest you. You may ask us to limit these communications.

Business Associates

We may disclose your PHI to third parties that perform services on our behalf, such as billing companies, scheduling platforms, electronic record systems, or IT providers. These business associates are required by written agreement to safeguard your information.

Other Uses and Disclosures Permitted or Required by Law

We may use or disclose your PHI without your authorization in the following circumstances, subject to the conditions and limits set by law:

• When required by federal, state, or local law
• For public health activities, such as reporting disease, injury, or vital events
• To report suspected abuse, neglect, or domestic violence
• For health oversight activities, such as audits and inspections
• In judicial and administrative proceedings, such as in response to a court order or subpoena
• For law enforcement purposes as permitted by law
• To coroners, medical examiners, and funeral directors
• For organ, eye, or tissue donation
• For research, when approved under applicable privacy protections
• To avert a serious and imminent threat to health or safety
• For specialized government functions, such as military or national security activities
• For workers' compensation as authorized by law

Uses and Disclosures That Require Your Written Authorization

The following uses and disclosures will be made only with your written authorization:

• Most uses and disclosures of psychotherapy notes
• Uses and disclosures for marketing purposes that are not otherwise permitted
• Disclosures that constitute a sale of your PHI

Any other use or disclosure not described in this Notice will be made only with your written authorization. If you authorize a use or disclosure, you may revoke that authorization in writing at any time, except to the extent we have already acted in reliance on it.

Protections for Reproductive Health Care Information

We are prohibited from using or disclosing your PHI to investigate or impose liability on you, or any person, for seeking, obtaining, providing, or facilitating lawful reproductive health care. For example, we will not disclose your information in response to a request that seeks to hold you liable for obtaining lawful reproductive health care.

When we receive a request for PHI that is potentially related to reproductive health care, we will, where required, obtain a signed attestation that the request is not for a prohibited purpose before disclosing the information. For example, before responding to a law-enforcement request for such records, we will require a valid attestation.

Redisclosure

Information we disclose under this Notice may be redisclosed by the recipient and may no longer be protected by federal privacy law.

More Stringent Law

Where Oregon law or other applicable law provides greater privacy protection than HIPAA for certain information, we follow the more protective law.

Your Rights Regarding Your Health Information

You have the following rights regarding your PHI. To exercise any of them, please submit a written request using the contact information at the end of this Notice.

• Request restrictions. You may request restrictions on certain uses and disclosures of your PHI. We are not required to agree, except that we must agree to your request to restrict disclosure to a health plan for a service you paid for in full out of pocket.
• Request confidential communications. You may ask us to communicate with you in a certain way or at a certain location, such as by an alternate mailing address.
• Inspect and obtain a copy. You may inspect and obtain a copy of your health records in the designated record set. We will act on your request within 30 days, with one extension of up to 30 additional days if we notify you in writing of the reason and the date we will respond. A reasonable, cost-based fee may apply.
• Request an amendment. You may request that we amend PHI you believe is incomplete or incorrect.
• Receive an accounting of disclosures. You may request a list of certain disclosures of your PHI that we have made.
• Obtain a paper copy. You may obtain a paper copy of this Notice at any time, even if you agreed to receive it electronically.
• Be notified of a breach. You have the right to be notified following a breach of your unsecured PHI.

Our Legal Duties

• We are required by law to maintain the privacy of your PHI, to provide this Notice of our legal duties and privacy practices, and to notify you following a breach of your unsecured PHI.
• We are required to abide by the terms of the Notice that is currently in effect.
• We reserve the right to change this Notice and to make the revised Notice effective for all PHI we maintain. If we make a material change, we will post the revised Notice on our website and at our practice location with a new effective date, and make it available to you on request.

Safeguarding Your Information

We maintain administrative, technical, and physical safeguards designed to protect your PHI against unauthorized access, use, or disclosure. Access to PHI is limited to authorized personnel with a legitimate need.

How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with the Practice using the contact information below, or with the Secretary of the U.S. Department of Health and Human Services. You will not be penalized or retaliated against for filing a complaint.

U.S. Department of Health and Human Services, Office for Civil Rights

200 Independence Avenue SW, Washington, DC 20201

Website: www.hhs.gov/ocr/privacy/hipaa/complaints

Contact Information

Privacy Officer: Dr. Aloysius Fobi, MD, Medical Director

Reach Our Privacy Officer

Effective date of this Notice: June 30, 2026