Notice of Privacy Practices

1. Our Legal Duty

delaeMD is required by federal law (HIPAA) and California state law (including the Confidentiality of Medical Information Act - CMIA) to:

• Maintain the privacy and security of your Protected Health Information (PHI).
• Provide you with this Notice detailing our legal duties and privacy practices regarding your PHI.
• Abide by the terms of the Notice currently in effect.
• Promptly notify you in the event of a breach that may have compromised the privacy or security of your unencrypted PHI.

2. How We May Use and Disclose Your Health Information

We typically use or share your health information in the following ways without requiring a separate written authorization:

• Treatment: We can use your PHI and share it with healthcare professionals involved in your care (e.g., consulting specialists, pharmacies, or laboratories).
• Payment: We may use your PHI to process your payment and to provide you an itemized statement. We do not bill health plans.
• Healthcare Operations: We can use and share your PHI to run our practice, assess and improve quality of care, manage clinical operations, train staff, and contact you when necessary.
• Other Permitted and Required Disclosures: We may disclose your PHI without your authorization for specific statutory purposes, including:
  • Public Health and Safety: Reporting disease outbreaks, medication adverse events to the FDA, or preventing serious threats to health or safety.
  • Abuse and Neglect: Reporting suspected child, elder, or dependent adult abuse, neglect, or domestic violence as required by California law.
  • Legal and Regulatory Compliance: Responding to court orders, administrative orders, law enforcement requests, valid subpoenas, or regulatory audits.
  • De-identified Data: Creating or using de-identified health data (data with all identifiers removed) for operational analysis or quality improvements.
  • De-identified Data for AI-Assisted Drafting: We may send de-identified health information (with the identifiers listed in the HIPAA Safe Harbor standard removed) to a third-party AI service provider to prepare a first draft of your report and to check it for completeness. Information de-identified in accordance with the HIPAA standard is not Protected Health Information. Your physician reviews and signs every report. See the agreement you signed with delaeMD (the Blueprint Agreement or the Patient-Provider Agreement) for details.

3. Telehealth, Digital Platforms, & Web Privacy

Because delaeMD delivers medical care digitally, we enforce heightened administrative, physical, and technical safeguards:

• Secure Platforms: All video consultations, audio communications, and patient-portal messaging occur on platforms that encrypt data in transit and at rest and that, where they handle Protected Health Information, operate under signed Business Associate Agreements. Our AI drafting tools do not handle Protected Health Information; see Section 2.
• Session Recordings: We strictly prohibit audio or video recording of telehealth encounters by our staff unless we obtain your explicit, separate written consent.
• Web Analytics & Digital Tracking: We do not disclose your health information, or data that identifies you as a patient (such as your IP address combined with appointment or clinical activity), to advertising networks, and we do not deploy third-party tracking technologies on pages where you provide health information.
• Your Responsibility: While we secure our systems, you are responsible for maintaining privacy in your physical environment and ensuring you connect via a secure, private internet network during telehealth visits.
• Patient-Held Records: If you use the delaeMD Healthspan Engine app, a copy of your report and results is kept on your own device and is not transmitted to delaeMD unless you choose to send us a file. You sign in to the app with an access code issued by your physician; the app’s server stores only a one-way encrypted (hashed) version of that code, not your name, email address, or health information. delaeMD continues to maintain your medical record in our clinical systems as described in this Notice.

4. Enhanced State & Federal Protections

Certain categories of health information receive additional, heightened protections under California law and federal regulations:

Federal Substance Use Disorder (SUD) Records (42 CFR Part 2)

If delaeMD creates, receives, or maintains SUD treatment records about you:

• We will not disclose these records in civil, criminal, administrative, or legislative proceedings against you without your explicit written consent or a specific court order meeting federal regulatory standards.
• Any permitted disclosure of SUD records must be accompanied by a written notice restricting secondary redisclosure by the recipient.

California Law (CMIA & Special Records)

• Employer Disclosures: Under California’s CMIA, we will never disclose your medical information to your employer without your express written authorization.
• Marketing & Sale: We will never sell your PHI or disclose it for marketing purposes without your prior written authorization.
• Heightened Consent Records: Psychotherapy notes, mental health treatment records, HIV/AIDS test results, genetic information, and certain reproductive healthcare records require heightened, specific written authorization prior to disclosure.

5. Disclosures Requiring Your Specific Written Authorization

For any purpose outside of Treatment, Payment, Healthcare Operations, or the legal exceptions listed above, we must obtain your explicit written authorization.

• Revocation: If you grant authorization, you have the right to revoke it at any time in writing by contacting our Privacy Officer. Revocation will stop future disclosures, but cannot undo disclosures already made in reliance on your prior consent.

6. Your Rights Regarding Your Health Information

7. Changes to This Notice

We reserve the right to change the terms of this Notice. Any revisions will apply to all PHI we maintain. The updated Notice will be posted on our website, available in the patient portal, and provided upon request.

8. Complaints & Questions

If you believe your privacy rights have been violated, or if you have questions about this Notice, please contact our Privacy Officer:

• Email: michaelleonemd@delaemd.com
• Address: 15558 Rising River Pl S, San Diego, CA 92127

You may also file a formal complaint with the U.S. Department of Health and Human Services Office for Civil Rights (OCR):

• Address: 200 Independence Avenue, S.W., Washington, D.C. 20201
• Phone: 1-877-696-6775
• Web: www.hhs.gov/ocr/privacy/hipaa/complaints/

Non-Retaliation Guarantee: delaeMD will not retaliate, penalize, or discriminate against you in any way for filing a privacy complaint or exercising your privacy rights.