This notice applies to care provided through Altium Health.

This Notice of Privacy Practices applies to Altium Health LLC and the members of its workforce who may create, receive, maintain, use, or disclose information about you while providing or supporting your care.

This may include:

• Physicians, nurse practitioners, nurses, therapists, counselors, case managers, and other healthcare professionals

• Medical students and clinical interns working under appropriate supervision

• Administrative, scheduling, billing, utilization-review, quality-assurance, and compliance staff

• Contractors and business associates performing services on behalf of Altium Health

• Other individuals who are legally permitted to participate in your care or clinic operations

This notice applies to records created through Altium Health’s medical, psychiatric, mental-health, substance-use, and supportive services, including:

• Psychiatric evaluations and medication management

• Individual, family, and group therapy

• Intensive Outpatient and Partial Hospitalization Programs

• Substance-use-disorder treatment

• Medication-Assisted Treatment

• Ambulatory detoxification

• Transcranial Magnetic Stimulation

• Ketamine treatment

• Laboratory and drug testing

• Case management and care coordination

• Other services included in your individualized treatment plan

Altium Health is a federally assisted substance-use-disorder treatment program subject to 42 CFR Part 2. Certain records identifying a person as having applied for, received, or been referred for substance-use-disorder services receive additional federal protection.

You have rights concerning your health information.

You have the right to:

• Receive an electronic or paper copy of your health record

• Ask us to correct information you believe is inaccurate or incomplete

• Request that we communicate with you confidentially

• Ask us to limit certain uses or disclosures of your information

• Request an accounting of certain disclosures

• Receive a copy of this notice

• Authorize another person to act on your behalf

• Consent to most uses and disclosures of records protected by 42 CFR Part 2

• Revoke an authorization or Part 2 consent, subject to certain limitations

• File a complaint without retaliation

HIPAA requires healthcare providers to describe these rights, explain how patients may exercise them, and identify whom patients may contact with questions or complaints.

You may ask to inspect or receive a copy of your information.

You may request an electronic or paper copy of the health information we maintain about you.

We will provide access within the time required by law. When permitted, we may charge a reasonable, cost-based fee for copying, mailing, electronic media, or other supplies needed to fulfill your request.

In limited situations, we may deny access to some information. When the law allows a review of that denial, we will explain how to request one.

Tell us when you believe something in your record is inaccurate.

You may ask us to correct or amend information that you believe is incorrect or incomplete.

We may deny your request when permitted by law, such as when Altium Health did not create the information or believes the existing record is accurate and complete. If the request is denied, we will provide an explanation and inform you of any available options for submitting a written statement of disagreement.

You may ask us to contact you in a particular way.

You may ask us to communicate with you:

• At a specific telephone number

• By a particular method

• At a different mailing address

• Through another reasonable communication arrangement

We will accommodate reasonable requests as required by law.

Please tell us when leaving voicemail, sending text messages, emailing, or mailing information could create a privacy concern for you.

You may request additional limits on your information.

You may ask us not to use or disclose certain information for treatment, payment, or healthcare operations.

We are not required to agree to every request. However, when you pay for a healthcare service entirely out of pocket and ask us not to disclose information about that service to your health plan for payment or healthcare operations, we will honor the request unless another law requires the disclosure.

Records protected by 42 CFR Part 2 may be subject to additional restrictions.

You may ask for information about certain disclosures we have made.

You may request a list of certain disclosures of your health information made during the legally permitted period.

An accounting may not include every use or disclosure. For example, HIPAA generally does not require an accounting of disclosures made for treatment, payment, healthcare operations, disclosures made directly to you, or disclosures you specifically authorized.

Federal regulations also establish accounting rights for certain Part 2 disclosures. The expanded compliance date for accounting of electronic Part 2 disclosures will be established when the corresponding HIPAA accounting requirement is revised.

An authorized representative may exercise rights on your behalf.

A personal representative may include:

• A legal guardian

• A parent acting for a minor, when permitted by law

• A person holding valid healthcare power of attorney

• Another person legally authorized to make healthcare or privacy decisions for you

We will verify that the individual has legal authority to act on your behalf before granting access or accepting instructions.

In certain circumstances, we may decline to recognize someone as your personal representative when permitted by law, including when doing so may place you at risk of abuse, neglect, exploitation, or harm.

You may make choices about certain uses of your information.

When permitted by law, you may tell us your preferences about:

• Sharing information with family members, friends, caregivers, or others involved in your care

• Contacting someone during an emergency

• Leaving voicemail messages

• Sending appointment reminders by text or email

• Sending billing communications

• Participating in telehealth services

• Receiving certain treatment-related or health-related communications

• Receiving fundraising communications

When you are present and able to make decisions, we will generally ask for your permission before sharing information with someone involved in your care.

When you are unavailable or unable to make decisions, we may share limited information when permitted by law and when, in our professional judgment, doing so is in your best interest.

Some uses and disclosures require specific permission.

Unless otherwise permitted or required by law, Altium Health will obtain your written authorization before:

• Using or disclosing your information for marketing when authorization is required

• Selling your protected health information

• Using or disclosing most psychotherapy notes

• Using or disclosing separately maintained substance-use-disorder counseling notes

• Using Part 2 records in a legal investigation or proceeding against you

• Making another use or disclosure not described in this notice

If you provide written authorization, you may revoke it in writing at any time. Revocation will not affect information already used or disclosed in reliance on the authorization.

If Altium Health sends fundraising communications, you will have the right to opt out of receiving future fundraising messages.

We use information to provide care, obtain payment, and operate our clinic.

The following descriptions generally apply to health information governed by HIPAA. Additional requirements apply when information is also protected by 42 CFR Part 2.

TREATMENT

We may use and share health information to provide, coordinate, and manage your care.

For example, we may share appropriate information with:

• Members of your Altium Health treatment team

• A referring or receiving healthcare provider

• A hospital or emergency department

• A pharmacy, laboratory, or testing provider

• A provider helping manage your medications

• Another treatment program involved in your care

• A provider helping determine the appropriate level of care

Utah law provides additional protection for confidential communications with mental-health therapists and substance-use-disorder counselors. Those communications generally may not be disclosed without consent unless state or federal law, a court order, mandatory-reporting requirements, safety obligations, or another recognized legal or professional exception applies.

PAYMENT

We may use and disclose appropriate information to receive payment for services, including:

• Verifying insurance eligibility and benefits

• Requesting prior authorization

• Submitting claims

• Correcting or appealing claims

• Responding to insurance-company requests

• Coordinating benefits

• Conducting utilization review

• Supporting medical-necessity determinations

• Collecting copays, coinsurance, deductibles, and other balances

HEALTHCARE OPERATIONS

We may use and disclose information to operate and improve Altium Health, including:

• Quality assurance and performance improvement

• Clinical supervision

• Workforce training

• Credentialing and provider review

• Compliance and auditing

• Risk management

• Licensing and accreditation

• Reviewing complaints or incidents

• Business administration

• Legal and accounting services

• Information-technology support

• Evaluating the quality and effectiveness of our services

Outside organizations may help us provide and support care.

Altium Health may engage outside vendors or contractors to perform services such as:

• Electronic health-record support

• Claims processing and billing

• Clearinghouse services

• Secure forms and document storage

• Information technology and cybersecurity

• Laboratory and pharmacy services

• Legal, accounting, consulting, and compliance services

• Secure communication and appointment reminders

When required, these organizations enter into written agreements requiring them to safeguard protected health information and limit how it may be used or disclosed.

We may contact you about your treatment and account.

We may use the contact information you provide to:

• Confirm or remind you about appointments

• Notify you of schedule changes

• Discuss referrals or authorizations

• Communicate regarding medication refills

• Provide follow-up instructions

• Discuss billing or insurance matters

• Tell you about treatment options or services that may be relevant to your care

Depending on your preferences, we may communicate by telephone, voicemail, text message, email, mail, secure video, or another approved method.

Electronic communication may involve privacy risks. We will make reasonable efforts to limit sensitive information in routine messages.

The law sometimes permits or requires disclosure without authorization.

Subject to HIPAA, 42 CFR Part 2, Utah law, and other applicable confidentiality protections, we may use or disclose information when permitted or required for purposes such as:

• Reporting suspected child abuse or neglect

• Reporting abuse, neglect, or exploitation of a vulnerable adult

• Preventing or reducing a serious and imminent threat to health or safety

• Meeting an applicable legal duty to warn or protect

• Reporting certain communicable diseases

• Reporting adverse reactions to medications or defective products

• Responding to health-oversight, licensing, or regulatory activities

• Complying with workers’ compensation requirements

• Supporting approved research when legal requirements are satisfied

• Responding to a lawful court order, subpoena, or legal process

• Assisting coroners, medical examiners, or funeral directors

• Complying with lawful military, national-security, correctional, or governmental requirements

• Responding to an emergency

• Complying with another law that requires disclosure

When mental-health or substance-use information receives greater protection under federal or Utah law, Altium Health will follow the more protective requirement.

Certain records are protected by 42 CFR Part 2.

Altium Health is formally subject to 42 CFR Part 2.

Part 2 protects records that identify a person as having applied for, received, or been referred for substance-use-disorder diagnosis, treatment, or referral services through a federally assisted Part 2 program.

When Part 2 applies:

• Altium Health must obtain your consent for most uses and disclosures of your Part 2 records.

• You may sign one consent authorizing future disclosures for treatment, payment, and healthcare operations.

• You may revoke your consent in writing, subject to actions already taken in reliance on it.

• A separate consent is generally required for substance-use-disorder counseling notes maintained separately from the rest of your record.

• A separate and specific consent or qualifying court order is generally required before Part 2 records may be used or disclosed in a civil, criminal, administrative, or legislative investigation or proceeding against you.

• Your Part 2 records generally cannot be used to investigate or prosecute you without your written consent or a court order meeting Part 2 requirements.

• Breaches involving unsecured Part 2 records are subject to federal breach-notification requirements.

• You may file a Part 2 complaint with the HHS Office for Civil Rights.

A HIPAA-covered entity or business associate that receives Part 2 information under a valid consent for treatment, payment, or healthcare operations may redisclose the information as HIPAA permits. However, the records still may not be used or disclosed in legal proceedings against you without the specific consent or court process required by Part 2.

Confidential therapy communications receive additional protection.

Utah law generally requires express consent before a licensed mental-health therapist discloses confidential communications with a client or patient.

Exceptions may apply when disclosure is permitted or required by state or federal law, including:

• Reporting suspected abuse, neglect, or exploitation

• Responding to a serious safety threat

• Meeting a legal duty to warn or protect

• Reporting certain communicable diseases

• Responding to a qualifying court order or legal proceeding

• Following a recognized professional or ethical requirement

Psychotherapy notes maintained separately from the rest of your clinical record receive additional protection under federal law and generally require written authorization before use or disclosure.

Privacy rights may depend on age and legal authority.

A parent or legal guardian generally acts as the personal representative of a minor. However, state or federal law may allow a minor to consent independently to certain services or control information connected to those services.

We will evaluate requests involving minors, guardians, and personal representatives according to applicable law and the circumstances of the care provided.

We use safeguards intended to protect electronic information.

Altium Health may create, receive, maintain, and transmit information through:

• Electronic health records

• Secure Google Workspace services

• Billing and clearinghouse systems

• Electronic prescribing platforms

• Secure online forms

• Telehealth platforms

• Approved communication and document-storage systems

We use administrative, physical, and technical safeguards intended to protect information from unauthorized access, use, disclosure, alteration, or loss.

No system can eliminate every security risk. If a breach occurs that may have compromised the privacy or security of your information, Altium Health will notify you as required by law.

We are required to protect the privacy and security of your information.

Altium Health is required to:

• Maintain the privacy and security of protected health information and Part 2 records

• Follow the duties and privacy practices described in the notice currently in effect

• Provide you with access to this notice

• Use reasonable safeguards to protect your information

• Notify you promptly when a reportable breach may have compromised your information

• Follow federal and Utah laws that provide additional confidentiality protections

• Obtain consent or authorization when required

• Refrain from retaliating against you for filing a complaint or exercising a privacy right

We will not use or disclose your information in a way that is not described in this notice unless you provide written permission or the use or disclosure is otherwise permitted or required by law.

We may update our privacy practices.

Altium Health may revise this notice and its privacy practices.

Revisions may apply to information we already maintain as well as information created or received after the change.

When this notice is materially revised, the current version will be:

• Available upon request

• Posted prominently at the clinic

• Published on the Altium Health website

• Provided electronically or in paper form as required

The complete and current notice is available at:

https://altiumhealth.com/privacy-practices

Federal rules require covered providers to make the notice available upon request, post it prominently at their facility, and publish it on a website that describes their services.

Contact us when you have a privacy question or concern.

Altium Health Privacy Officer

Stephanie Sarro, Operations Director and Privacy Officer

Phone:(801) 613-9843

Email: stephanie@altiumhealth.com

Address: 6783 South Redwood Road, Suite 103 West Jordan, Utah 84084

Website: https://altiumhealth.com/privacy-practices

You may contact the Privacy Officer to:

• Ask questions about this notice

• Request access to or correction of your record

• Request confidential communication

• Request a restriction

• Revoke an authorization or Part 2 consent

• Request an accounting of disclosures

• Report a privacy or security concern

• File a complaint

Altium Health will not retaliate against you, reduce your care, or treat you differently because you submitted a complaint or exercised a privacy right.

You may also contact federal or state agencies.

U.S. Department of Health and Human Services

Office for Civil Rights

You may file a HIPAA or 42 CFR Part 2 complaint through the HHS Office for Civil Rights complaint process.

Mail:
U.S. Department of Health and Human Services
Office for Civil Rights
200 Independence Avenue SW
Washington, DC 20201

Phone: 1-877-696-6775

Beginning February 16, 2026, the HHS Office for Civil Rights accepts complaints concerning alleged violations of 42 CFR Part 2 in addition to HIPAA complaints.

Utah Department of Health and Human Services

Division of Licensing and Background Checks

Phone: 801-538-4242
Email: dlbc@utah.gov
Address: 195 North 1950 West, Salt Lake City, Utah 84116

The current state contact information is published by the Utah Division of Licensing and Background Checks.

You will not be retaliated against for filing a complaint with Altium Health or an outside agency.