Your health information, and your rights.

What this notice covers

Health information means anything that identifies you and relates to your health, the care we give you, or payment for that care. It includes your history and labs, your body composition readings, the treatments you receive, the notes we write, and the information we use to bill for a visit. It covers a medical visit with Dr. Abboud and an aesthetic treatment alike.

Your record begins when you become a patient. An appointment request made through this website is a scheduling request. It asks for your name, phone, email, whether you have visited before, how you prefer to be contacted, a preferred treatment, one or two preferred times, and an optional scheduling note. We ask you not to include medical details in that note. Once it reaches our team, we handle it with the same care as the rest of your record, and this notice applies to any details from it that we add to your record.

We are required by law to keep your health information private and secure, to give you this notice of our legal duties and privacy practices, and to follow the notice that is currently in effect. In particular:

• We will not use or share your information other than as described here unless you tell us in writing that we may. If you give us permission, you can withdraw it at any time, in writing.
• We will tell you promptly if a breach occurs that may have compromised the privacy or security of your information.
• Where Illinois law gives more protection than HIPAA, for example for mental health records, HIV test results, genetic information or substance use treatment records, we follow the stricter rule.

How we may use and share your information

We use and share your health information in the ordinary course of caring for you, without asking for separate permission each time: to treat you, to be paid for a visit, and to run the practice.

The law also permits or requires us to share health information in certain other situations. In each one we share only what the situation calls for. The list below covers both.

• Treatment. Dr. Abboud and her medical team use your record to evaluate you, plan your care and follow up with you. We may share it with a lab that runs your tests, a pharmacy that fills a prescription, or another clinician involved in your care.
• Payment. We use your information to bill and collect payment for a visit, including from your health insurer for medical visits. Aesthetic treatments and IV drips are paid directly by you, so no insurer is involved.
• Running the practice. We use your information to run the practice well: to review the quality of care, train staff, and manage scheduling and records.
• Appointment reminders and follow-up. We may contact you by phone, text or email, using the contact method you told us you prefer, to remind you of a visit or to check on you after one.
• People involved in your care. If you bring a family member or friend to a visit, or ask us to speak with one, we may share information relevant to their involvement. If you are not able to tell us what you want, we may share what we believe is in your best interest.
• Companies that work for us. Our electronic health record vendor and other companies that help us run the practice may see your information to do their work. Each one signs a written agreement requiring it to protect your information as we do.
• When the law requires it. When a federal, state or local law requires us to share information, we do so.
• Public health and safety. Reporting a communicable disease, a reaction to a medication or a product recall; reporting suspected abuse, neglect or domestic violence; and preventing a serious and imminent threat to a person's health or to the public.
• Oversight and legal process. Audits, inspections and licensing by health oversight agencies; a court or administrative order, a subpoena or a similar request, with the protections the law requires; and law enforcement, in the limited circumstances the law allows.
• Other situations the law allows. A coroner, medical examiner or funeral director, and organ and tissue donation; workers' compensation claims; research, only when an ethics review board has approved the study and the required protections are in place; and special government functions, such as military, national security or protective services.

When we need your written permission

For anything not described in this notice, we ask for your written authorization first. You can withdraw an authorization at any time by telling us in writing. We stop from that point on, though we cannot take back anything shared while it was in effect.

We will always ask before we do any of the following:

• Use your information for marketing.
• Sell your information. We do not, and will not, sell it.
• Share most psychotherapy notes, in the rare case a record contains them.
• Use your photograph, or a description of your results, anywhere public, including this website and social media. The patient stories and photos on our site are shared only with the patient's permission.

Your rights over your health information

You have rights over the information in your record. To use any of them, ask our front desk or write to the Privacy Officer named at the end of this notice. We may ask you to put a request in writing.

• See and get a copy of your record. Ask, and we will usually provide a paper or electronic copy within 30 days. We may charge a reasonable, cost-based fee for copies.
• Ask us to correct your record. If you believe something is wrong or missing, you can ask us to amend it. We may decline, and if we do, we will tell you why in writing within 60 days.
• Ask for a list of the times we shared your information. You can request an accounting of disclosures for the six years before your request. It leaves out sharing for treatment, payment and running the practice, and any sharing you authorized. One list a year is free.
• Ask us to limit what we share. You can ask us not to use or share certain information for treatment, payment or running the practice. We are not required to agree if it would affect your care. If you pay for a service in full yourself, you can ask us not to share it with your health insurer, and we will agree unless a law requires us to share it.
• Ask us to contact you a certain way. You can ask us to reach you at a particular phone number or address, or only by a certain method. We will agree to all reasonable requests.
• Choose someone to act for you. A person with medical power of attorney, or your legal guardian, can exercise these rights on your behalf. We will confirm their authority before we act.
• Get a paper copy of this notice. You can ask for one at any time, even if you agreed to receive it electronically.

Changes, questions and contact

We may change this notice, and the changes will apply to all the information we hold about you, including information we already have. The current notice is posted in our office and on this website, and you can ask for a copy at any visit. This version is effective [EFFECTIVE DATE] and stays in effect until we replace it.

If you have a question about this notice, or believe your privacy rights have been violated, please tell us first. Contact our Privacy Officer at the address, phone number or email below, and we will look into it and reply. Regular email is not a secure way to send detailed medical information, so for anything sensitive, call us or raise it at your visit.

You can also file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, at the address below. We will not retaliate against you for filing a complaint.

• Privacy Officer: [PRIVACY OFFICER NAME], Qua Wellness and Med Spa, 430 Village Center Drive, Burr Ridge, IL 60527. Phone (630) 561-0590. Email info@quawellness.com.
• Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Washington, DC 20201. Phone 1-877-696-6775. Online at www.hhs.gov/ocr/privacy/hipaa/complaints.