Peak Vitality

Notice of Privacy Practices

Effective date: June 22, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

Our duties

The practice is required by law to maintain the privacy of your protected health information (PHI), to give you this Notice of our legal duties and privacy practices, and to follow the terms of the Notice currently in effect.

How we may use and disclose your health information

• Treatment: to provide, coordinate, and manage your care, including generating clinician-reviewed assessments and care pathways.
• Payment: to obtain payment for services, where applicable.
• Health care operations: for quality review, training, and administration of the practice.
• Business associates: with vendors who perform services for us under a written Business Associate Agreement that requires them to safeguard your information. Our cloud and AI infrastructure is provided by Google Cloud (including Vertex AI) under such an agreement.
• As required by law: when disclosure is required by federal, state, or local law.

Uses and disclosures that require your written authorization

Most uses and disclosures not described in this Notice will be made only with your written authorization, which you may revoke at any time in writing (except to the extent we have already acted on it). Your written authorization is always required for: any sale of your health information, most uses and disclosures for marketing purposes, and psychotherapy notes where we maintain them.

Use of artificial intelligence

We use AI tools to help read uploaded laboratory documents and to draft assessments. This processing occurs within our private, access-controlled environment under a Business Associate Agreement; your information is never sent to a public consumer AI service. A licensed clinician reviews and approves every assessment.

Your rights regarding your health information

• Access: to inspect and obtain a copy of your health information.
• Amendment: to request a correction of information you believe is inaccurate or incomplete.
• Accounting of disclosures: to request a list of certain disclosures we have made.
• Restriction: to request limits on how we use or disclose your information.
• Confidential communication: to request that we contact you in a specific way or at a specific location.
• Paper copy: to obtain a paper copy of this Notice on request.
• Breach notification: to be notified following a breach of unsecured PHI.

How we protect your information

Your information is held in a dedicated, access-controlled environment. It is encrypted in transit and at rest, and direct identifiers such as your name and date of birth are separately encrypted within the database. Every clinician and staff account requires two-factor authentication, and access to patient records is logged. The platform is used only by your practice's clinical team — there is no patient login, and your assessment is given to you directly by your provider.

Our duties and changes to this Notice

We are required by law to maintain the privacy of your health information, to provide you with this Notice of our legal duties and privacy practices, and to notify you following a breach of unsecured health information. We reserve the right to change this Notice and to make the revised Notice effective for information we already hold as well as information we receive in the future. A copy of the current Notice is available from the practice on request.

Complaints

If you believe your privacy rights have been violated, you may file a complaint with the practice's Privacy Officer or with the U.S. Department of Health and Human Services, Office for Civil Rights. You will not be retaliated against for filing a complaint.

Office for Civil Rights, U.S. Department of Health and Human Services, 200 Independence Avenue SW, Washington, D.C. 20201 · 1-877-696-6775 · hhs.gov/ocr/privacy/hipaa/complaints

Contact / Privacy Officer

[Privacy Officer name, address, phone, and email — to be completed by the practice.]