Notice of Privacy Practices

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice describes the privacy practices applicable to healthcare services provided through East Coast Longevity and explains your rights concerning your health information.

The structure below follows the current HHS healthcare-provider model, including access, amendment, confidential communications, restrictions, accounting of disclosures, representatives and complaints.

Your Rights

When it comes to your health information, you have certain rights.

Obtain a Copy of Your Medical Record

• You may ask to inspect or receive an electronic or paper copy of your medical record and other health information we maintain about you.
• We will generally provide access within the timeframe required by applicable law.
• A reasonable, cost-based fee may apply where permitted.

Ask Us to Correct Your Medical Record

• You may ask us to correct health information that you believe is incorrect or incomplete.
• We may deny the request in certain circumstances permitted by law and will explain the reason when required.

Request Confidential Communications

• You may ask us to contact you in a particular way or at a particular location.
• We will accommodate reasonable requests as required by law.

Ask Us to Limit What We Use or Share

• You may ask us not to use or share certain health information for treatment, payment, or healthcare operations.
• We are generally not required to agree to every requested restriction.
• If you pay for a healthcare service or item completely out of pocket, you may ask us not to disclose information about that service to your health insurer for payment or healthcare operations, and we will honor that request when required by law.

Obtain an Accounting of Disclosures

• You may request information about certain disclosures of your health information made during the applicable period preceding your request.
• Certain disclosures—including many disclosures for treatment, payment, or healthcare operations—may not be included as permitted by law.

Obtain a Copy of This Notice

• You may request a paper copy of this Notice at any time, even if you previously agreed to receive it electronically.

Choose Someone to Act for You

• If you have given someone medical power of attorney or another person has legal authority to act on your behalf, that person may exercise your rights when appropriate.

File a Complaint

• You may complain if you believe your privacy rights have been violated.
• We will not retaliate against you for filing a complaint.
• You may contact East Coast Longevity using the information at the end of this Notice.
• You may also submit a complaint to the U.S. Department of Health and Human Services Office for Civil Rights. HHS expressly requires an NPP to explain both the right to complain and the organization’s non-retaliation obligations.

Your Choices

For certain health information, you may tell us your preferences about what we share.

Depending upon the circumstances, this may include sharing information with:

• Family members
• Friends involved in your care
• Other persons involved in your care or payment for your care
• Disaster-relief organizations

If you are unable to communicate your preference, we may share information when we believe it is in your best interest and applicable law permits the disclosure.

We generally will not use your PHI for marketing purposes or sell your PHI without your written authorization when authorization is required by law.

How We May Use and Disclose Your Information

HIPAA permits healthcare providers to use and disclose PHI in a number of circumstances without obtaining a separate authorization. The NPP must explain these practices, including treatment, payment, and healthcare operations.

Treatment

We may use and disclose your health information to provide, coordinate, and manage your healthcare. For example, we may share relevant information with another healthcare provider, laboratory, or pharmacy involved in your treatment.

Payment

We may use and disclose health information to bill and receive payment for healthcare services.

Healthcare Operations

We may use and disclose health information to operate our practice. Examples include:

• Quality assessment
• Staff training
• Compliance activities
• Business administration
• Patient service activities
• Healthcare professional review
• Improving our services

Business Associates

We may share information with companies that perform services on our behalf when permitted by HIPAA. When required, these organizations are contractually obligated to appropriately safeguard PHI.

Public Health and Safety

We may disclose information for certain public-health and safety activities permitted or required by law, such as:

• Reporting certain diseases
• Preventing or reducing serious threats to health or safety
• Reporting suspected abuse, neglect, or domestic violence when legally authorized or required
• Reporting adverse events or product issues

Required by Law

We may disclose health information when federal, state, or local law requires us to do so.

Health Oversight

We may disclose information to authorized health oversight agencies for activities such as audits, investigations, inspections, and licensure matters.

Legal Proceedings

We may disclose health information in response to certain court orders, subpoenas, administrative proceedings, or other lawful processes as permitted by law.

Law Enforcement

We may disclose information to law enforcement in circumstances permitted or required by law.

Coroners and Medical Examiners

We may disclose health information to coroners, medical examiners, or funeral directors when authorized by law.

Workers’ Compensation

We may disclose health information for workers’ compensation or similar programs as permitted by law.

Special Protections

Certain categories of information may receive additional protection under federal or state law, including information concerning behavioral health, substance use disorder treatment, HIV/AIDS, genetic information, reproductive healthcare, or other sensitive health information.

Where another law provides greater privacy protection than HIPAA, we will comply with the applicable requirements.

This section matters especially now: HHS’s February 2026 model NPP incorporates new requirements concerning 42 CFR Part 2 substance-use-disorder records, with the compliance date having arrived February 16, 2026.

Telehealth and Electronic Communications

ECL may provide healthcare using video, telephone, electronic messaging, patient portals, and other remote communication technologies. We take reasonable measures to safeguard information communicated electronically and use HIPAA-appropriate technologies where required.

Patients should also take reasonable precautions when participating in telehealth, including using a private location and secure devices and networks when possible. HHS specifically recommends private locations, headphones where appropriate, and limiting nearby devices that could overhear a telehealth encounter.

Our Responsibilities

We are required by law to:

• Maintain the privacy and security of PHI.
• Inform you promptly if a breach occurs that may have compromised the privacy or security of your information as required by law.
• Follow the duties and privacy practices described in the Notice currently in effect.
• Provide you with a copy of this Notice.
• Refrain from using or disclosing your information in ways not described by this Notice unless you authorize us in writing or another law permits or requires the use or disclosure.

If you provide written authorization, you may revoke it in writing, subject to applicable legal limitations. These duties correspond to the responsibilities in HHS’s current provider model NPP.

Changes to This Notice

We may change the terms of this Notice. Changes may apply to health information we already maintain as well as information we receive in the future. The current Notice will be available on our Website and upon request.

Privacy Contact

For questions about this Notice, requests concerning your health information, or privacy complaints, contact: