Privacy Policy

Chateau de la Bella

AESTHETICS & MEDSPA PRIVACY NOTICE OF CHATEAU DE LA BELLA THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

We are required under the federal health care privacy rules (the "Privacy Rules"), to protect the privacy of your health

information, which includes information about your health history, symptoms, test results, diagnoses, treatment, and claims and

payment history (collectively, "Health Information"). We are also required to provide you with this Privacy Notice regarding our

legal duties, policies and procedures to protect and maintain the privacy of your Health Information. We are required to follow

the terms of this Privacy Notice unless (and until) it is revised. We reserve the right to change the terms of this Privacy Notice

and to make the new notice provisions effective for the Health Information that we maintain and use, as well as for any Health

Information that we may receive in the future. Should the terms of this Privacy Notice change, we will make a revised copy of

the notice available to you. Revised Privacy Notices will be available at our office(s). This Privacy Notice will also be posted and

made available electronically on our website.

PERMITTED USES AND DISCLOSURES OF YOUR HEALTH INFORMATION.

1) General Uses and Disclosures. Under the applicable law, we are permitted to use and disclose your Health

Information for the following purposes, without obtaining your permission or Authorization:

Treatment. We are permitted to use and disclose your Health Information in the provision and coordination of

your healthcare. For example, we may disclose your Health Information to your primary healthcare provider(s),

consulting providers, and to other health care personnel who have a need for such information for your care and

treatment.

Payment. We may use and disclose your Health Information so that the treatment and services you receive may

be billed to and payment may be collected from you, an insurance company or other third party, including

determining the applicability of any health insurance coverage. For example, a bill sent to your insurance

company may include information that identifies you, your medical information, and the procedures and supplies

used in your treatment.

Uses and Disclosures Required by Law. We may use and disclose your Health Information when required to do

so by law, including, but not limited to reporting abuse, neglect and domestic violence, in response to judicial and

administrative proceedings, in responding to a law enforcement request for information; or in order to alert law

enforcement to criminal conduct on our premises.

Public Health Activities. We may disclose your Health Information for public health reporting, including, but not

limited to; reporting communicable diseases and vital statistics; product recalls and adverse events; or notifying

person(s) who may have been exposed to a disease.

Abuse and Neglect. We may disclose your Health Information to a local, state, or federal government authority if

we have a reasonable belief of abuse, neglect or domestic violence.

Regulatory Agencies. We may disclose your Health Information to a healthcare oversight agency for activities

authorized by law, including, but not limited to, licensure investigations and inspections. These activities are

necessary for the government and certain private health oversight agencies to monitor the healthcare system,

government programs, and compliance with civil rights.

Judicial and Administrative Proceedings. We may disclose your Health Information in judicial and administrative

proceedings, as well as in response to an order of a court, administrative tribunal, or in response to a subpoena,

summons, warrant, discovery request, or similar legal request.

Threats to Health and Safety. We may use or disclose your Health Information if we believe, in good faith, that

the use or disclosure is necessary to prevent or lessen a serious or imminent threat to the health or safety of a

person or the public or is necessary for law enforcement to identify or apprehend an individual.

Specialized Government Functions. We may disclose your Health Information to authorized federal officials for

national security reasons and the Department of State for medical suitability determinations. We may also

disclose your Health Information to authorized federal officials for the provision of protective services to the

President of the United States or to foreign heads of state or to conduct related investigations. If you are a

member of the U.S. Armed Forces, we may disclose your Health Information as required by military command

authorities.

Workers' Compensation. We may disclose your Health Information as authorized by and to the extent necessary

to comply with laws relating to workers' compensation or other similar programs that provide benefits for work-

related injuries or illnesses without regard to fault.

Care Coordination Communication. Unless you tell us otherwise, we may communicate with you via call, mail, e-

mail, or text to provide you with appointment reminders, or that it is time to make a routine appointment, or

important information regarding our policy and procedure for our practice.

Business Associates. We may disclose your Health Information to business associates who provide services to us.

Our business associates are required to protect the confidentiality of your Health Information.

Other Uses and Disclosures. In addition to the reasons outlined above, we may use and disclose your Health

Information for other purposes permitted by the Privacy Rules.

2) Uses and Disclosures Which Require Patient Opportunity to Verbally Agree or Object. Under the Privacy Rules, we

are permitted to use and disclose your Health Information: to family members, close personal friends or any other

person identified by you, if the information is directly relevant to that person's involvement in your care or treatment.

Except in emergency situations, you will be notified in advance and have the opportunity to verbally agree or object to

this use and disclosure of your Health Information.

3) Uses and Disclosures Which Require Written Authorization. As required by applicable law, all other uses, and

disclosures of your Health Information (not described above) will be made only with your written permission, which is

called an Authorization. For example: We are not permitted to use and disclose your Health Information with family

and close friends without written permission.

4) Revoking Your Authorization. You may revoke your Authorization in writing at any time. The revocation of your

Authorization will be effective immediately, except to the extent that: we have relied upon it previously for the use

and disclosure of your Health Information; if the Authorization was obtained as a condition of obtaining insurance

coverage where other law provides the insurer with the right to contest a claim under the policy or the policy itself; or

where your Health Information was obtained as part of a research study and is necessary to maintain the integrity of

the study.

PATIENT RIGHTS.

You have the following rights concerning your Health Information:

1) Right to Receive Written Notification of a Breach of Your Unsecured Health Information. You have the right to

receive written notification of a breach of your unsecured Health Information if it has been accessed, used, acquired,

or disclosed in a manner not permitted by the Privacy Rules, which compromises the security or privacy of your Health

Information. We will provide this notification by first-class mail or, if necessary, by such other substituted forms of

communication allowable by law or you may request in writing to receive a notification of a breach by electronic mail.

2) Right to Inspect and/or Copy Your Health Information. Upon written request to Chateau de la Bella, you have the

right to inspect and copy your own Health Information contained in a designated record set maintained by us. A

“designated record set” contains medical and billing records and any other records that we use for making decisions

about you. However, we are not required to provide you access to all the Health Information that we maintain. For

example, this right of access does not extend to information compiled in reasonable anticipation of, or for use in, a

civil, criminal or administrative proceeding. Where permitted by the Privacy Rules, you may request that we review

certain denials to inspect and copy your Health Information. Instead of copies, we can provide you with a summary of

your Health Information if you agree to the form and cost of such summary. If you request a paper copy or summary

explanation of your Health Information, we may charge you a reasonable fee for copying costs, postage, and any other costs

associated with preparing the summary or explanation. Instead of paper copies, if your Health Information is

maintained in an electronic health record, you may request that we provide the information in electronic form to

either you or to a designated third-party if such designation is clear, conspicuous, and specific. We may charge you a

reasonable cost-based fee for an electronic copy, which shall not exceed our labor costs in responding to the request.

We may, in some cases, deny your request to inspect and copy your Health Information and will notify you in writing

of the reasons for our denial and provide you with information regarding your rights to have our denial reviewed. In

order to obtain copies of your Health Information maintained by other covered functions of Chateau de la Bella, you

should direct your written request directly to the particular covered function.

3) Right to Request Restrictions on the Use and Disclosure of Your Health Information. You have the right to request

restrictions on the use and disclosure of your Health Information for treatment, payment, and healthcare operations.

We will consider, but do not have to agree to, such requests. However, we must agree to restrict a disclosure of Health

Information about you to a health plan if: (a) the disclosure is for the purpose of carrying out payment or health care

operations and is not otherwise required by law; and (b) the Health Information pertains solely to a healthcare item or

service for which you, or someone other than the health plan on your behalf, has paid in full. In order to request

restrictions on the use and disclosure of your Health Information maintained by other covered functions of Chateau de

la Bella, you should direct your written request directly to the particular covered function.

4) Right to Request an Amendment of Your Health Information. You have the right to request an amendment of your

Health Information. We may deny your request if we determine that you have asked us to amend information that:

was not created by us, unless the person or entity that created the information is no longer available; is not Health

Information maintained by or for us; is Health Information that you are not permitted to inspect or copy; or we

determine that the information is accurate and complete. If we disagree with your requested amendment, we will

provide you with a written explanation of the reasons for the denial, an opportunity to submit a statement of

disagreement, and a description of how you may file a complaint. In order to request an amendment of your Health

Information maintained by Chateau de la Bella, you should direct your written request directly to each particular

covered function.

5) Right to an Accounting of Disclosures of Your Health Information. You have the right to receive an accounting of

disclosures of your Health Information made by us. With respect to Health Information contained in paper form, our

accounting will not include disclosures related to treatment, payment, or healthcare operations; disclosures to you;

disclosures based upon your Authorization; disclosures to individuals involved in your care; incidental disclosures;

disclosures to correctional institutions or law enforcement officials; disclosures that are part of a Limited Data Set; or

disclosures that occurred or as otherwise allowed by the Privacy Rules. With respect to Health Information contained

in an electronic health record, unless otherwise specified by law, the accounting will not contain disclosures made to

you upon your request; based upon your Authorization; to individuals involved in your care; or as allowed by law. You

may request an accounting of applicable disclosures made by us within six (6) years prior to the date of your request

for Health Information stored in paper form and made within three (3) years prior to the date of your request (but not

for any disclosures made prior to implementation of our electronic health records system) for Health Information

stored in an electronic health record. If you request an accounting more than once in a 12-month period, we may

charge you the reasonable cost-based expenses incurred to comply with your additional request. In order to request

an accounting of disclosures of your Health Information disclosed by other covered functions of Chateau de la Bella,

you should direct your written request directly to each particular covered function.

6) Right to Alternative Communications. You have the right to receive confidential communications of your Health

Information by a different means or at a different location than currently provided. Such requests must be in writing.

For example, you may request that we only contact you at home or by mail. In order to request confidential

communications of your Health Information from other covered functions of Chateau de la Bella, you should direct

your written request directly to each particular covered function.

7) Right to Receive a Paper Copy of this Privacy Notice. You have the right to receive a paper copy of this Privacy Notice

upon request, even if you have agreed to receive this Privacy Notice electronically. If you want to exercise any of these rights, please contact our Privacy Officer. All requests must be submitted to us in writing on a designated form (which we will provide to you) and returned to the attention of our Privacy Officer at the address below.

CONTACT INFORMATION AND HOW TO REPORT A PRIVACY RIGHTS VIOLATION.

If you want to exercise any of these rights, have any questions, or feel that your privacy rights have been violated, please contact

us. All requests must be submitted to us in writing and returned to the address below.

Address: Chateau de la Bella

ATTN: Privacy Officer / Manager

1925 E Glenn Avenue, STE 202

Auburn, AL 36830

Telephone Number: (334) 746-5676

If you believe that your privacy rights have been violated or that we have violated our own privacy practices, you may file a

complaint with our Privacy Officer / Manager. You may also file a complaint with the Office of Civil Rights, U.S. Department of

Health and Human Services. Our Privacy Officer / Manager can provide you with the address.