Notice of Privacy Practices

Effective date: November 2, 2026

THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU OR YOUR PERSONAL REPRESENTATIVE CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.

This Notice describes how Bloom and Renew Health, P.C. (the "Practice") and our physicians, other clinicians and staff may use and disclose your medical information for treatment, payment and health care operations, and for the other purposes described below. Medical information about you is personal, and we are committed to protecting it. This Notice applies to all records of your care created or maintained by the Practice. Where the law of the state where you receive care gives your information greater protection than federal law, we follow the more protective law.

Your medical information includes demographic information that may identify you and that relates to your past, present or future physical or mental health, the care you receive, and payment for that care. It typically includes your symptoms, test results, diagnoses, treatment and plan of care. We are required by law to protect the privacy of your medical information, to give you this Notice, and to follow its terms. We may change this Notice at any time. Any new Notice will apply to all medical information we maintain, will be posted on our website and in our patient portal, and is available on request.

I. Uses and disclosures for treatment, payment and health care operations

The following are examples only.

(a) Treatment. We may use and disclose your medical information to provide, coordinate and manage your care. For example, we may share information with laboratories that perform your tests, pharmacies that fill your prescriptions, and other health care providers involved in your care.

(b) Payment. We may use and disclose your medical information to obtain payment for the services you receive. Because we are a cash-pay practice, this generally means processing your payments, payment plans and receipts. If you ask us for documentation to submit to an insurer or a health savings or flexible spending account, we may include the information needed for that purpose.

(c) Health care operations. We may use and disclose your medical information to run the Practice. This includes reviewing the quality of care, training staff, licensing and accreditation, legal and compliance reviews, and business planning. We may use your information to remind you of appointments, lab draws or prescription refills, and to tell you about treatment options or other health-related services that may interest you.

(d) Business associates. We work with outside companies that perform services for us, such as our electronic health record and patient portal, scheduling, video visits, lab ordering, payment processing and secure communications. When these companies need your medical information, we require them by written contract to protect it.

II. Uses and disclosures you may agree to or object to

In the following situations you have the chance to agree or object. If you are not present or able to respond, your physician may use professional judgment to decide whether sharing is in your best interest, and will share only what is relevant.

(a) Others involved in your care. Unless you object, we may share information with a family member, relative, close friend or other person you identify, limited to what relates to their involvement in your care or payment for it. We may also use or share information to notify those people of your general condition, or to work with disaster relief organizations.

(b) Emergencies. We may use or disclose your information if needed for emergency treatment, and will try to get your agreement as soon as reasonably possible afterward.

(c) Communication barriers. If we cannot get your agreement because of a significant communication barrier, we may use or disclose your information if, in our professional judgment, you would agree.

III. Uses and disclosures without your authorization

We may use or disclose your medical information without your authorization in these situations, as permitted or required by law:

• (a) Required by law, when federal, state or local law requires it
• (b) Public health, such as preventing or controlling disease, injury or disability, and reporting to a person who may have been exposed to a communicable disease
• (c) Health oversight, such as audits, investigations, inspections and licensing
• (d) Abuse, neglect or domestic violence, reporting to authorized government agencies
• (e) Food and Drug Administration, reporting adverse events, product problems or recalls
• (f) Legal proceedings, in response to a court or administrative order, and in some cases a subpoena or other lawful request
• (g) Law enforcement, when legal requirements are met, such as responding to a warrant or court order, identifying a suspect or missing person, or reporting a crime
• (h) Coroners, medical examiners and funeral directors, as needed to carry out their duties
• (i) Organ and tissue donation, to organizations that handle donation and transplantation
• (j) Research, with your written authorization, or when an institutional review board or privacy board has approved a waiver of authorization under federal rules
• (k) Serious threats to health or safety, to prevent or lessen a serious and imminent threat to you, another person or the public
• (l) Military and national security, for armed forces personnel and authorized national security, intelligence and protective services activities
• (m) Workers' compensation, as authorized by workers' compensation laws
• (n) Correctional institutions, if you are an inmate and we provided care to you
• (o) Department of Health and Human Services, when it investigates our compliance with federal privacy rules

IV. Your rights regarding your medical information

(a) Right to inspect and copy. You may inspect and get a copy of your medical information, including an electronic copy if we keep it electronically. Send a written request to our Privacy Contact. We will respond within 30 days and may charge a reasonable, cost-based fee. If we deny your request, we will explain why in writing, and in some cases you may ask for the denial to be reviewed.

(b) Right to request restrictions. You may ask us in writing to limit how we use or share your information for treatment, payment or operations, or with people involved in your care. We are not required to agree, except that we must agree not to share information with a health plan about services you paid for in full yourself, unless the law requires it. If we agree, we will follow the restriction except in an emergency.

(c) Right to confidential communications. You may ask us in writing to contact you in a specific way or at a different address or phone number. We will accommodate reasonable requests.

(d) Right to request an amendment. If you believe information we have is incorrect or incomplete, you may ask us in writing to correct it. If we deny your request, we will explain why, and you may file a statement of disagreement.

(e) Right to an accounting of disclosures. You may ask for a list of certain disclosures we made in the six years before your request, other than for treatment, payment, operations and certain other purposes. We will tell you about any cost in advance.

(f) Uses that require your written authorization. We will use or disclose your information for other purposes only with your written authorization, including most uses of psychotherapy notes, most marketing uses, and any sale of your information. Marketing does not include face-to-face communications, gifts of nominal value, refill reminders for medications you currently take, or communications about your own treatment for which we receive no payment from a third party. You may revoke an authorization in writing at any time, except to the extent we have already acted on it.

(g) Right to be notified of a breach. You will be notified if we or one of our business associates discover a breach of your unsecured medical information.

(h) Right to a paper copy of this Notice, even if you agreed to receive it electronically.

(i) Right to complain. If you believe your privacy rights have been violated, you may file a written complaint with our Privacy Contact or with the U.S. Department of Health and Human Services Office for Civil Rights, 200 Independence Avenue, S.W., Washington, D.C. 20201, 1-877-696-6775, www.hhs.gov/hipaa/filing-a-complaint. We will not retaliate against you for filing a complaint.

V. State law

We care for patients located in Arizona, Colorado, Florida, Georgia, Pennsylvania and Virginia. Some of these states give certain information, such as mental health, HIV/AIDS, genetic testing, and alcohol or drug treatment information, more protection than federal law, and may require a specific written consent before it is shared. Where state law is more protective, we follow state law.

Privacy Contact

Name: Laura Hayes, MD
Address: 25 S Main St, Unit 1, Nazareth, PA 18064
Telephone: (484) 240-1762
Email: [email protected]
Effective date: November 2, 2026