Notice of Privacy Practices

Sano Protocol LLC is a healthcare provider and, where applicable, a Covered Entity, as that term is defined under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), and is committed to protecting the privacy of your health information. HIPAA requires Covered Entities to maintain the privacy of your Protected Health Information (“PHI”), to provide you with this Notice of Privacy Practices (the “Notice”), and to abide by the terms of this Notice. This Notice applies to health information we collect and maintain directly, as well as health information collected and maintained on our behalf through our patient portal, powered by our practice-management partner, Decoda Health.

Protected Health Information (PHI) is information about you, including demographic information, that may identify you and that relates to your past, present, or future physical or mental health or condition, the provision of health services to you, or the past, present, or future payment for the provision of health services to you.

For Treatment

We may use and disclose your PHI to provide, coordinate, and manage your health services. For example, we may share your health information with your assigned nurse, our Medical Director, or our contracted medical clearance provider to ensure you receive safe and appropriate services.

For Payment

We may use and disclose your PHI to obtain payment for services we provide to you. For example, we may share information with your payment processor to process charges for services rendered.

For Health Care Operations

We may use and disclose your PHI for our internal operations, including quality assessment, training, compliance activities, and business management. For example, we may review visit documentation to evaluate the quality of care provided by our nursing staff.

As Required by Law

We will disclose your PHI when required to do so by federal, state, or local law, including mandatory reporting requirements.

For Public Health Activities

We may disclose your PHI to public health authorities as required or permitted by law for purposes such as reporting communicable diseases or adverse events.

To Avert a Serious Threat to Health or Safety

We may use or disclose your PHI when necessary to prevent or lessen a serious and imminent threat to your health or safety or the health or safety of another person or the public.

Business Associates

We may share your PHI with third-party service providers (called Business Associates under HIPAA) who perform functions on our behalf, including Decoda Health (our practice-management platform, hosting our patient portal, booking, intake, and clinical documentation), Qualiphy (our contracted medical clearance provider), and our payment processor. We require all Business Associates to protect your PHI through written Business Associate Agreements.

The following uses and disclosures of your PHI require your written authorization:

• Most uses and disclosures of psychotherapy notes
• Uses and disclosures of PHI for marketing purposes
• Sales of PHI

You may revoke any authorization you have given us at any time by contacting us in writing. Your revocation will be effective for future uses and disclosures but will not affect actions we took before receiving your revocation.

Right to Access Your PHI

You have the right to inspect and obtain a copy of your PHI that we maintain. To request access, contact us at sanoteam@sanoprotocol.com. We may charge a reasonable fee for copies. We will respond within 30 days of receiving your request. If additional time is required, we may extend the response period as permitted by law and will notify you in writing.

Right to Request Amendment

If you believe your PHI in our records is incorrect or incomplete, you may request that we amend it. We may deny your request if we determine the information is accurate and complete. You will be notified of our decision within 60 days.

Right to an Accounting of Disclosures

You have the right to request a list of certain disclosures we have made of your PHI, covering up to six years prior to your request. This accounting does not include disclosures made for treatment, payment, or healthcare operations.

Right to Request Restrictions

You may request that we restrict how we use or disclose your PHI for treatment, payment, or healthcare operations. We are not required to agree to your request unless the restriction is on disclosure to a health plan for a service you paid for in full out of pocket.

Right to Request Confidential Communications

You may request that we communicate with you about your health information in a specific way or at a specific location. We will accommodate reasonable requests.

Right to a Paper Copy of This Notice

You have the right to receive a paper or electronic copy of this Notice at any time. To request a copy, contact us at sanoteam@sanoprotocol.com.

We are required by law to:

• Maintain the privacy of your PHI
• Provide you with this Notice of our legal duties and privacy practices
• Abide by the terms of this Notice currently in effect
• Notify you in the event of a breach of your unsecured PHI

We may communicate with you electronically through our patient portal, email, text messaging, or other electronic means when permitted by law and consistent with your communication preferences.

We reserve the right to change this Notice and to make the revised Notice effective for PHI we already hold as well as any PHI we receive in the future. We will post the current Notice on our Platform with the effective date. You may obtain a current copy at any time by contacting us.

If you believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the U.S. Department of Health and Human Services. To file a complaint with us, contact us at sanoteam@sanoprotocol.com. We will not retaliate against you for filing a complaint.

For questions about this Notice or to exercise any of your rights described above: