Notice of Privacy Practices

Effective Date

Effective: April 18, 2026

A Spanish-language copy of this Notice is available upon request at the front desk.

Our Commitment to Your Privacy

Mi Bella Medical Spa ("we," "our," or "the practice") is committed to protecting the privacy of your health information. We are required by the Health Insurance Portability and Accountability Act (HIPAA) and applicable state law to: (1) maintain the privacy of your protected health information (PHI); (2) provide you with this Notice of our legal duties and privacy practices; (3) follow the terms of the Notice currently in effect; and (4) notify you in the event of a breach of unsecured PHI.

Uses and Disclosures Without Your Authorization

We may use and disclose your protected health information without your written authorization for the following purposes:

1. Treatment

We may use and disclose your PHI to provide, coordinate, or manage your medical care, including consultations between providers, referrals to specialists, and prescriptions issued to compounding or retail pharmacies.

2. Payment

We may use and disclose your PHI to bill and collect payment for the treatment and services you receive, including verifying coverage, obtaining authorizations, and processing claims with your health plan or third-party payors.

3. Health Care Operations

We may use and disclose your PHI for operational activities such as quality assessment, staff training and evaluation, accreditation, licensing, business management, and customer service.

4. Other Permitted Uses and Disclosures

We may also use or disclose your PHI without your authorization in the following circumstances:

• Appointment reminders, treatment alternatives, and health-related products and services we offer.
• As required by federal, state, or local law.
• For public health activities (e.g., reporting disease, vital statistics, FDA-related adverse events).
• To report victims of abuse, neglect, or domestic violence to authorities permitted by law.
• For health oversight activities, including audits and investigations by government agencies.
• In response to a court order, subpoena, warrant, or other lawful judicial or administrative process.
• To law enforcement officials as permitted or required by law.
• To coroners, medical examiners, and funeral directors.
• For organ, eye, or tissue donation purposes.
• To avert a serious threat to health or safety.
• For specialized government functions (military, national security, protective services).
• For workers' compensation purposes.
• To business associates who perform services on our behalf, subject to a written agreement requiring them to safeguard your PHI.

Uses and Disclosures Requiring Your Authorization

Other uses and disclosures of your PHI not described in this Notice will be made only with your written authorization. In particular, the following uses and disclosures will require your specific written authorization:

• Most uses and disclosures of psychotherapy notes.
• Uses and disclosures of PHI for marketing purposes.
• Disclosures that constitute a sale of PHI.
• Use of before-and-after photos or testimonials in advertising or on our website or social media.
• Disclosure of your PHI to family members, friends, or other individuals you designate, except as otherwise permitted by law.

You may revoke your authorization at any time, in writing, except to the extent that we have already taken action in reliance on it.

Your Rights Regarding Your Health Information

You have the following rights regarding the PHI we maintain about you:

Right to Inspect and Copy

You have the right to inspect and obtain a copy of your PHI maintained in our designated record set, including in an electronic format if we maintain it electronically. We may charge a reasonable, cost-based fee. We will respond to your request within 30 days.

Right to Amend

You have the right to request that we amend your PHI if you believe it is incorrect or incomplete. Your request must be in writing and provide a reason supporting the requested amendment. We may deny your request under certain circumstances.

Right to an Accounting of Disclosures

You have the right to request a list of certain disclosures we have made of your PHI, other than disclosures for treatment, payment, health care operations, and certain other exceptions. The accounting will cover up to six (6) years prior to the date of your request. The first accounting in any 12-month period is free; we may charge for additional requests.

Right to Request Restrictions

You have the right to request a restriction on certain uses and disclosures of your PHI for treatment, payment, or health care operations. We are not required to agree to your request, except in the case of a disclosure to a health plan for payment or operations purposes when you have paid for the service or item out-of-pocket in full.

Right to Confidential Communications

You have the right to request that we communicate with you about medical matters in a certain way or at a certain location (for example, only at home, by mail to a specific address, or by a specific phone number). We will accommodate reasonable requests.

Right to a Paper Copy of This Notice

You have the right to obtain a paper copy of this Notice at any time, even if you have agreed to receive it electronically. Please ask the front desk or contact our Privacy Officer.

Right to Be Notified of a Breach

You have the right to be notified following a breach of your unsecured PHI.

How to File a Complaint

If you believe your privacy rights have been violated, you may file a complaint with us or with the Secretary of the U.S. Department of Health and Human Services. You will not be retaliated against for filing a complaint.

To File a Complaint with the Practice

Submit your complaint in writing to our Privacy Officer (contact information below). All complaints will be reviewed promptly and confidentially.

To File a Complaint with HHS

Privacy Officer Contact Information

Changes to This Notice

We reserve the right to change the terms of this Notice at any time. We will make any new Notice effective for all PHI we maintain. The current Notice will be posted in our reception area, available at our front desk, and posted on our website. The effective date is shown at the top of this Notice.

Distribution of This Notice

In accordance with HIPAA requirements, this Notice is:

• Posted in a clear and prominent location in our reception area / lobby.
• Provided to every patient at the date of first service delivery, with written acknowledgment of receipt requested.
• Available in paper form at the front desk to anyone who requests a copy.
• Linked from the footer of every page on our website.

Acknowledgment

By receiving care at Mi Bella Medical Spa, you acknowledge that you have been provided with a copy of this Notice of Privacy Practices and that you have had an opportunity to review it. A signed acknowledgment of receipt is requested at your first visit.